May I suggest you use the public interface krb5_error_code KRB5_CALLCONV krb5_set_default_tgs_enctypes (krb5_context, const krb5_enctype *); which does exactly the same thing?