I think that stashing the pointers in krb5_get_in_tkt_with_* is the right solution. Avoiding the memset may break some applications that pass in garbage a credential, as might avoiding memsetting the client and server. Rolling back the change to krb5_get_in_tkt would require that we handle the AES issue some other way.