anchor.diff:        (let* ((msg (decrypt-des-cbc key emsg))
   	     (message (subseq msg 8))) ;; drop the confounder 
   	;; compute the checksum
  -	(let ((the-cksum (des-mac (md5 message)
  +	(let ((the-cksum (des-mac (md5 msg) ;;message)
   				  nil
   				  session-key)))
   	  ;; validate the checksums match
  
positive.code: 						     (kerberos-context-seqno context)
  						     (authenticator-seqno (ap-req-authenticator req))))
  					   v)
  					 (if initiator '(0 0 0 0) '(#xff #xff #xff #xff))))
  	      (error "Seqnos don't match"))))
  	;; return the decrypted message
  	message))))
  
negative.code: 	   (key (map '(vector (unsigned-byte 8)) 
  		     (lambda (x) (logxor x #xf0))
  		     session-key))
  	   (cksum (des-mac (md5 msg) ;;message)
  			     nil
  			     session-key))
  	   (seqno (encrypt-des-cbc session-key 
  