diff --git a/router/crypto.go b/router/crypto.go
index 80fefacf..531e5cce 100644
--- a/router/crypto.go
+++ b/router/crypto.go
@@ -124,8 +124,8 @@ type NaClEncryptor struct {
 	nonce      *[24]byte
 	nonceChan  chan *[24]byte
 	prefixLen  int
-	conn       *LocalConnection
 	sessionKey *[32]byte
+	sendNonce  func([]byte)
 	df         bool
 }
 
@@ -175,7 +175,7 @@ func (ne *NonEncryptor) TotalLen() int {
 	return ne.buffered
 }
 
-func NewNaClEncryptor(prefix []byte, conn *LocalConnection, sessionKey *[32]byte, df bool) *NaClEncryptor {
+func NewNaClEncryptor(prefix []byte, sessionKey *[32]byte, sendNonce func([]byte), df bool) *NaClEncryptor {
 	buf := make([]byte, MaxUDPPacketSize)
 	prefixLen := copy(buf, prefix)
 	return &NaClEncryptor{
@@ -185,8 +185,8 @@ func NewNaClEncryptor(prefix []byte, conn *LocalConnection, sessionKey *[32]byte
 		nonce:        nil,
 		nonceChan:    make(chan *[24]byte, ChannelSize),
 		prefixLen:    prefixLen,
-		conn:         conn,
 		sessionKey:   sessionKey,
+		sendNonce:    sendNonce,
 		df:           df}
 }
 
@@ -213,7 +213,7 @@ func (ne *NaClEncryptor) Bytes() ([]byte, error) {
 		if err != nil {
 			return nil, err
 		}
-		ne.conn.SendProtocolMsg(ProtocolMsg{ProtocolNonce, encodedNonce})
+		ne.sendNonce(encodedNonce)
 		ne.nonce = freshNonce
 		nonce = freshNonce
 	}
@@ -232,7 +232,7 @@ func (ne *NaClEncryptor) Bytes() ([]byte, error) {
 			return nil, err
 		}
 		ne.nonceChan <- nonce
-		ne.conn.SendProtocolMsg(ProtocolMsg{ProtocolNonce, encodedNonce})
+		ne.sendNonce(encodedNonce)
 	}
 	ne.offset = offset
 
diff --git a/router/forwarder.go b/router/forwarder.go
index c365faf1..d3f61847 100644
--- a/router/forwarder.go
+++ b/router/forwarder.go
@@ -30,8 +30,8 @@ func (conn *LocalConnection) ensureForwarders() error {
 	usingPassword := conn.SessionKey != nil
 	var encryptor, encryptorDF Encryptor
 	if usingPassword {
-		encryptor = NewNaClEncryptor(conn.local.NameByte, conn, conn.SessionKey, false)
-		encryptorDF = NewNaClEncryptor(conn.local.NameByte, conn, conn.SessionKey, true)
+		encryptor = NewNaClEncryptor(conn.local.NameByte, conn.SessionKey, conn.sendNonce, false)
+		encryptorDF = NewNaClEncryptor(conn.local.NameByte, conn.SessionKey, conn.sendNonce, true)
 	} else {
 		encryptor = NewNonEncryptor(conn.local.NameByte)
 		encryptorDF = NewNonEncryptor(conn.local.NameByte)
@@ -62,6 +62,10 @@ func (conn *LocalConnection) stopForwarders() {
 	conn.forwarderDF.Shutdown()
 }
 
+func (conn *LocalConnection) sendNonce(encodedNonce []byte) {
+	conn.SendProtocolMsg(ProtocolMsg{ProtocolNonce, encodedNonce})
+}
+
 // Called from peer.Relay[Broadcast] which is itself invoked from
 // router (both UDP listener process and sniffer process). Also called
 // from connection's heartbeat process, and from the connection's TCP