The implementation of krb5_c_decrypt based on the AEAD APIs does not treat the input argument as constant. I think you need to copy the input data before using crypto_type_stream. --Sam