8 files changed, 12 insertions, 9 deletions
diff --git a/src/lib/krb5/krb/decode_kdc.c b/src/lib/krb5/krb/decode_kdc.c
index 932a7b6a08..b30d233302 100644
--- a/src/lib/krb5/krb/decode_kdc.c
+++ b/src/lib/krb5/krb/decode_kdc.c
@@ -72,7 +72,7 @@ OLDDECLARG(krb5_kdc_rep **, dec_rep)
 
     if (local_dec_rep->etype != etype) {
 	krb5_free_kdc_rep(local_dec_rep);
-	return KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
+	return KRB5_WRONG_ETYPE;
     }
     if (retval = krb5_kdc_rep_decrypt_proc(key, 0, local_dec_rep)) {
 	krb5_free_kdc_rep(local_dec_rep);
diff --git a/src/lib/krb5/krb/decrypt_tk.c b/src/lib/krb5/krb/decrypt_tk.c
index bd5a48602a..833e60d7da 100644
--- a/src/lib/krb5/krb/decrypt_tk.c
+++ b/src/lib/krb5/krb/decrypt_tk.c
@@ -45,7 +45,7 @@ register krb5_ticket *ticket;
     krb5_error_code retval;
 
     if (!valid_etype(ticket->etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP;
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     /* put together an eblock for this encryption */
 
diff --git a/src/lib/krb5/krb/encode_kdc.c b/src/lib/krb5/krb/encode_kdc.c
index c176f49d32..8e761d409a 100644
--- a/src/lib/krb5/krb/encode_kdc.c
+++ b/src/lib/krb5/krb/encode_kdc.c
@@ -54,7 +54,7 @@ OLDDECLARG(krb5_data **, enc_rep)
     krb5_error_code retval;
 
     if (!valid_etype(dec_rep->etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP;
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     switch (type) {
     case KRB5_AS_REP:
diff --git a/src/lib/krb5/krb/encrypt_tk.c b/src/lib/krb5/krb/encrypt_tk.c
index e37d4ea43c..9ae3ca8151 100644
--- a/src/lib/krb5/krb/encrypt_tk.c
+++ b/src/lib/krb5/krb/encrypt_tk.c
@@ -48,7 +48,7 @@ register krb5_ticket *dec_ticket;
     /* encrypt the encrypted part */
 
     if (!valid_etype(dec_ticket->etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP;
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     /*  start by encoding the to-be-encrypted part. */
     if (retval = encode_krb5_enc_tkt_part(dec_tkt_part, &scratch)) {
diff --git a/src/lib/krb5/krb/kdc_rep_dc.c b/src/lib/krb5/krb/kdc_rep_dc.c
index 29d2a68d28..adf9821054 100644
--- a/src/lib/krb5/krb/kdc_rep_dc.c
+++ b/src/lib/krb5/krb/kdc_rep_dc.c
@@ -42,7 +42,7 @@ OLDDECLARG(krb5_kdc_rep *, dec_rep)
     krb5_enc_kdc_rep_part *local_encpart;
 
     if (!valid_etype(dec_rep->etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     /* set up scratch decrypt/decode area */
 
diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
index 23115f9e2d..90f55fd4a3 100644
--- a/src/lib/krb5/krb/mk_req_ext.c
+++ b/src/lib/krb5/krb/mk_req_ext.c
@@ -90,10 +90,13 @@ krb5_data *outbuf;
 	    return(retval);
     }
     /* verify a valid etype is available */
-    etype = keytype_to_etype(creds->keyblock.keytype); /* XXX */
+    if (!valid_keytype(creds->keyblock.keytype))
+	return KRB5_PROG_KEYTYPE_NOSUPP;
+
+    etype = krb5_keytype_array[creds->keyblock.keytype]->system->proto_enctype;
 
     if (!valid_etype(etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP;
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     request.ap_options = ap_req_options;
     /* we need a native ticket */
diff --git a/src/lib/krb5/krb/mk_safe.c b/src/lib/krb5/krb/mk_safe.c
index 7ff5d40a69..11b3b6de32 100644
--- a/src/lib/krb5/krb/mk_safe.c
+++ b/src/lib/krb5/krb/mk_safe.c
@@ -61,7 +61,7 @@ OLDDECLARG(krb5_data *, outbuf)
     krb5_data *scratch;
 
     if (!valid_cksumtype(sumtype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
+	return KRB5_PROG_SUMTYPE_NOSUPP;
 
     addrs[0] = sender_addr->address;
     addrs[1] = 0;
diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 3c03b4c9d4..c11042db33 100644
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -188,7 +188,7 @@ krb5_authenticator **authpp;
     etype = keytype_to_etype(sesskey->keytype);
 
     if (!valid_etype(etype))
-	return KRB5KDC_ERR_ETYPE_NOSUPP;
+	return KRB5_PROG_ETYPE_NOSUPP;
 
     /* put together an eblock for this encryption */