Please take a review at http://cr.openjdk.java.net/~weijun/8246193/webrev.00/ While searching for ENC-PA-REP in the PA-DATA list of AS-REQ, it's possible there is no PA-DATA at all. This could happen when preauth is turned off. Thanks, Max