On the server side, the server must send out etype_info2 with a s2kparams of 1 for AFS salts. At least if the enctype is DES-based. On the client side, the code needs to call afs_string_to_key if the s2kparams of 1 are used.