diff --git a/router/connection.go b/router/connection.go
index 90f5f80f..7a1f878f 100644
--- a/router/connection.go
+++ b/router/connection.go
@@ -196,7 +196,7 @@ func (conn *LocalConnection) run(actionChan <-chan ConnectionAction, finished ch
 		RemoteAddr:         conn.TCPConn.RemoteAddr().(*net.TCPAddr),
 		Outbound:           conn.outbound,
 		ConnUID:            conn.uid,
-		Crypto:             conn.forwarderCrypto(),
+		SessionKey:         conn.SessionKey,
 		SendControlMessage: conn.sendOverlayControlMessage,
 		Features:           intro.Features,
 	}
@@ -390,19 +390,6 @@ func (conn *LocalConnection) shutdown(err error) {
 	conn.Router.ConnectionMaker.ConnectionTerminated(conn, err)
 }
 
-func (conn *LocalConnection) forwarderCrypto() *OverlayCrypto {
-	if !conn.Router.UsingPassword() {
-		return nil
-	}
-
-	name := conn.local.NameByte
-	return &OverlayCrypto{
-		Dec:   NewNaClDecryptor(conn.SessionKey, conn.outbound),
-		Enc:   NewNaClEncryptor(name, conn.SessionKey, conn.outbound, false),
-		EncDF: NewNaClEncryptor(name, conn.SessionKey, conn.outbound, true),
-	}
-}
-
 func (conn *LocalConnection) sendOverlayControlMessage(tag byte, msg []byte) error {
 	return conn.sendProtocolMsg(ProtocolMsg{ProtocolTag(tag), msg})
 }
diff --git a/router/fastdp.go b/router/fastdp.go
index f0a76e22..440a93b8 100644
--- a/router/fastdp.go
+++ b/router/fastdp.go
@@ -507,7 +507,7 @@ type fastDatapathForwarder struct {
 }
 
 func (fastdp fastDatapathOverlay) MakeForwarder(params ForwarderParams) (OverlayForwarder, error) {
-	if params.Crypto != nil {
+	if params.SessionKey != nil {
 		// No encryption suport in fastdp.  The weaver main.go
 		// is responsible for ensuring this doesn't happen.
 		log.Fatal("Attempt to use FastDatapath with encryption")
diff --git a/router/overlay.go b/router/overlay.go
index 914f40dd..1789f886 100644
--- a/router/overlay.go
+++ b/router/overlay.go
@@ -46,8 +46,8 @@ type ForwarderParams struct {
 	// Unique identifier for this connection
 	ConnUID uint64
 
-	// Crypto bits.  Nil if not encrypting
-	Crypto *OverlayCrypto
+	// Session key, if connection is encrypted; nil otherwise
+	SessionKey *[32]byte
 
 	// Function to send a control message to the counterpart
 	// forwarder.
diff --git a/router/sleeve.go b/router/sleeve.go
index 89dbb750..01001b3f 100644
--- a/router/sleeve.go
+++ b/router/sleeve.go
@@ -344,11 +344,15 @@ type controlMessage struct {
 }
 
 func (sleeve *SleeveOverlay) MakeForwarder(params ForwarderParams) (OverlayForwarder, error) {
+	name := sleeve.localPeer.NameByte
 	var crypto OverlayCrypto
-	if params.Crypto != nil {
-		crypto = *params.Crypto
+	if params.SessionKey != nil {
+		crypto = OverlayCrypto{
+			Dec:   NewNaClDecryptor(params.SessionKey, params.Outbound),
+			Enc:   NewNaClEncryptor(name, params.SessionKey, params.Outbound, false),
+			EncDF: NewNaClEncryptor(name, params.SessionKey, params.Outbound, true),
+		}
 	} else {
-		name := sleeve.localPeer.NameByte
 		crypto = OverlayCrypto{
 			Dec:   NewNonDecryptor(),
 			Enc:   NewNonEncryptor(name),