diff --git a/src/vnet/crypto/crypto.c b/src/vnet/crypto/crypto.c
index 58b1363..dbdb58b 100644
--- a/src/vnet/crypto/crypto.c
+++ b/src/vnet/crypto/crypto.c
@@ -119,8 +119,11 @@
       if (id == 0)
 	continue;
       od = vec_elt_at_index (cm->opt_data, id);
-      od->active_engine_index = p[0];
-      cm->ops_handlers[id] = ce->ops_handlers[id];
+      if (ce->ops_handlers[id])
+	{
+	  od->active_engine_index = p[0];
+	  cm->ops_handlers[id] = ce->ops_handlers[id];
+	}
     }
 
   return 0;
diff --git a/src/vnet/ipsec/esp_decrypt.c b/src/vnet/ipsec/esp_decrypt.c
index de951d1..fc4a99a 100644
--- a/src/vnet/ipsec/esp_decrypt.c
+++ b/src/vnet/ipsec/esp_decrypt.c
@@ -232,9 +232,7 @@
 	  vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
 	  vnet_crypto_op_init (op, sa0->crypto_dec_op_id);
 	  op->key = sa0->crypto_key.data;
-	  op->key_len = sa0->crypto_key.len;
 	  op->iv = payload;
-	  op->iv_len = cpd.iv_sz;
 	  op->src = op->dst = payload += cpd.iv_sz;
 	  op->len = len;
 	  op->user_data = b - bufs;
@@ -287,7 +285,7 @@
 	      bi = op->user_data;
 
 	      if (op->status == VNET_CRYPTO_OP_STATUS_FAIL_BAD_HMAC)
-		err = ESP_DECRYPT_ERROR_INTEG_ERROR;
+		err = ESP_DECRYPT_ERROR_DECRYPTION_FAILED;
 	      else
 		err = ESP_DECRYPT_ERROR_CRYPTO_ENGINE_ERROR;
 
diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index c801859..bb1effd 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -431,10 +431,8 @@
 	  vec_add2_aligned (ptd->crypto_ops, op, 1, CLIB_CACHE_LINE_BYTES);
 	  vnet_crypto_op_init (op, sa0->crypto_enc_op_id);
 	  op->iv = payload - iv_sz;
-	  op->iv_len = iv_sz;
 	  op->src = op->dst = payload;
 	  op->key = sa0->crypto_key.data;
-	  op->key_len = sa0->crypto_key.len;
 	  op->len = payload_len - icv_sz;
 	  op->flags = VNET_CRYPTO_OP_FLAG_INIT_IV;
 	  op->user_data = b - bufs;