diff --git a/lib/security/audit/principal.go b/lib/security/audit/principal.go
index 81d7211..95dd8cc 100644
--- a/lib/security/audit/principal.go
+++ b/lib/security/audit/principal.go
@@ -75,15 +75,6 @@
 func (p *auditingPrincipal) Roots() security.BlessingRoots         { return p.principal.Roots() }
 func (p *auditingPrincipal) BlessingStore() security.BlessingStore { return p.principal.BlessingStore() }
 
-func (p *auditingPrincipal) Encrypter() security.BlessingsBasedEncrypter {
-	return p.principal.Encrypter()
-}
-
-// TODO(ataly): Return an auditing decrypter instead.
-func (p *auditingPrincipal) Decrypter() security.BlessingsBasedDecrypter {
-	return p.principal.Decrypter()
-}
-
 func (p *auditingPrincipal) audit(err error, method string, args args, result interface{}) error {
 	if err != nil {
 		return err
diff --git a/lib/security/audit/principal_test.go b/lib/security/audit/principal_test.go
index 5fa6f2f..75148b6 100644
--- a/lib/security/audit/principal_test.go
+++ b/lib/security/audit/principal_test.go
@@ -202,8 +202,6 @@
 func (p *mockPrincipal) PublicKey() security.PublicKey               { return p.NextResult.(security.PublicKey) }
 func (p *mockPrincipal) Roots() security.BlessingRoots               { return nil }
 func (p *mockPrincipal) BlessingStore() security.BlessingStore       { return nil }
-func (p *mockPrincipal) Encrypter() security.BlessingsBasedEncrypter { return nil }
-func (p *mockPrincipal) Decrypter() security.BlessingsBasedDecrypter { return nil }
 
 type mockAuditor struct {
 	LastEntry audit.Entry
@@ -257,7 +255,7 @@
 		t.Fatal(err)
 	}
 	signer := security.NewInMemoryECDSASigner(key)
-	p, err := security.CreatePrincipal(signer, nil, nil, nil, nil)
+	p, err := security.CreatePrincipal(signer, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/lib/security/principal.go b/lib/security/principal.go
index 39d3dfb..9532970 100644
--- a/lib/security/principal.go
+++ b/lib/security/principal.go
@@ -44,7 +44,7 @@
 	if err != nil {
 		return nil, err
 	}
-	return security.CreatePrincipal(security.NewInMemoryECDSASigner(priv), newInMemoryBlessingStore(pub), newInMemoryBlessingRoots(), nil, nil)
+	return security.CreatePrincipal(security.NewInMemoryECDSASigner(priv), newInMemoryBlessingStore(pub), newInMemoryBlessingRoots())
 }
 
 // PrincipalStateSerializer is used to persist BlessingRoots/BlessingStore state for
@@ -73,9 +73,9 @@
 // same serializers. Otherwise, the state (ie: BlessingStore, BlessingRoots) is kept in memory.
 func NewPrincipalFromSigner(signer security.Signer, state *PrincipalStateSerializer) (security.Principal, error) {
 	if state == nil {
-		return security.CreatePrincipal(signer, newInMemoryBlessingStore(signer.PublicKey()), newInMemoryBlessingRoots(), nil, nil)
+		return security.CreatePrincipal(signer, newInMemoryBlessingStore(signer.PublicKey()), newInMemoryBlessingRoots())
 	}
-	serializationSigner, err := security.CreatePrincipal(signer, nil, nil, nil, nil)
+	serializationSigner, err := security.CreatePrincipal(signer, nil, nil)
 	if err != nil {
 		return nil, verror.New(errCantCreateSigner, nil, err)
 	}
@@ -87,7 +87,7 @@
 	if err != nil {
 		return nil, verror.New(errCantLoadBlessingStore, nil, err)
 	}
-	return security.CreatePrincipal(signer, blessingStore, blessingRoots, nil, nil)
+	return security.CreatePrincipal(signer, blessingStore, blessingRoots)
 }
 
 // LoadPersistentPrincipal reads state for a principal (private key, BlessingRoots, BlessingStore)
diff --git a/lib/security/serialization/serialization_test.go b/lib/security/serialization/serialization_test.go
index 241b3e2..3ed62a7 100644
--- a/lib/security/serialization/serialization_test.go
+++ b/lib/security/serialization/serialization_test.go
@@ -68,7 +68,7 @@
 	if err != nil {
 		panic(err)
 	}
-	p, err := security.CreatePrincipal(security.NewInMemoryECDSASigner(key), nil, nil, nil, nil)
+	p, err := security.CreatePrincipal(security.NewInMemoryECDSASigner(key), nil, nil)
 	if err != nil {
 		panic(err)
 	}
diff --git a/runtime/internal/flow/manager/manager.go b/runtime/internal/flow/manager/manager.go
index f413de6..01ebcc8 100644
--- a/runtime/internal/flow/manager/manager.go
+++ b/runtime/internal/flow/manager/manager.go
@@ -45,14 +45,14 @@
 
 func NewWithBlessings(ctx *context.T, serverBlessings security.Blessings, rid naming.RoutingID) flow.Manager {
 	m := &manager{
-		rid:             rid,
-		closed:          make(chan struct{}),
-		cache:           NewConnCache(),
-		ctx:             ctx,
-		serverBlessings: serverBlessings,
-		serverNames:     security.BlessingNames(v23.GetPrincipal(ctx), serverBlessings),
+		rid:    rid,
+		closed: make(chan struct{}),
+		cache:  NewConnCache(),
+		ctx:    ctx,
 	}
 	if rid != naming.NullRoutingID {
+		m.serverBlessings = serverBlessings
+		m.serverNames = security.BlessingNames(v23.GetPrincipal(ctx), serverBlessings)
 		m.ls = &listenState{
 			q:         upcqueue.New(),
 			listeners: []flow.Listener{},
diff --git a/runtime/internal/rpc/test/full_test.go b/runtime/internal/rpc/test/full_test.go
index ad8bfdb..5af791a 100644
--- a/runtime/internal/rpc/test/full_test.go
+++ b/runtime/internal/rpc/test/full_test.go
@@ -932,8 +932,7 @@
 		(*crypto.BoxKey)(rpk))
 
 	// Read the auth message from the server.
-	var rAuth *message.Auth
-	for {
+	for auth := false; !auth; {
 		b, err = conn.ReadMsg()
 		if err != nil {
 			t.Fatal(err)
@@ -945,23 +944,26 @@
 		if err != nil {
 			t.Fatal(err)
 		}
-		if rAuth, ok = m.(*message.Auth); ok {
-			break
+		switch m.(type) {
+		case *message.Auth:
+			auth = true
+		case *message.Data:
+		default:
+			continue
 		}
-	}
+		if b, err = message.Append(ctx, m, nil); err != nil {
+			t.Fatal(err)
+		}
+		tmp := make([]byte, len(b)+cipher.MACSize())
+		copy(tmp, b)
+		b = tmp
+		if err = cipher.Seal(b); err != nil {
+			t.Fatal(err)
+		}
+		if _, err = conn.WriteMsg(b); err != nil {
+			t.Fatal(err)
+		}
 
-	// Send the auth message back to the server.
-	if b, err = message.Append(ctx, rAuth, nil); err != nil {
-		t.Fatal(err)
-	}
-	tmp := make([]byte, len(b)+cipher.MACSize())
-	copy(tmp, b)
-	b = tmp
-	if err = cipher.Seal(b); err != nil {
-		t.Fatal(err)
-	}
-	if _, err = conn.WriteMsg(b); err != nil {
-		t.Fatal(err)
 	}
 
 	// The server should send a tearDown message complaining about the channel binding.
diff --git a/services/agent/agentlib/client.go b/services/agent/agentlib/client.go
index 396df74..8cc257f 100644
--- a/services/agent/agentlib/client.go
+++ b/services/agent/agentlib/client.go
@@ -257,16 +257,6 @@
 	return &blessingRoots{c.caller}
 }
 
-// TODO(ataly): Implement this method.
-func (c *client) Encrypter() security.BlessingsBasedEncrypter {
-	return nil
-}
-
-// TODO(ataly): Implement this method.
-func (c *client) Decrypter() security.BlessingsBasedDecrypter {
-	return nil
-}
-
 type blessingStore struct {
 	caller caller
 	key    security.PublicKey
diff --git a/services/agent/internal/cache/cache.go b/services/agent/internal/cache/cache.go
index 4c8ec1d..ea2e8cb 100644
--- a/services/agent/internal/cache/cache.go
+++ b/services/agent/internal/cache/cache.go
@@ -410,7 +410,7 @@
 		cachedRoots.flush()
 		cachedStore.flush()
 	}
-	sp, err := security.CreatePrincipal(dummySigner{impl.PublicKey()}, cachedStore, cachedRoots, impl.Encrypter(), impl.Decrypter())
+	sp, err := security.CreatePrincipal(dummySigner{impl.PublicKey()}, cachedStore, cachedRoots)
 	if err != nil {
 		return
 	}
diff --git a/services/wspr/internal/principal/cache_test.go b/services/wspr/internal/principal/cache_test.go
index d2141d1..73be928 100644
--- a/services/wspr/internal/principal/cache_test.go
+++ b/services/wspr/internal/principal/cache_test.go
@@ -89,7 +89,7 @@
 	bc := NewBlessingsCache(notifier, onDemandGCPolicy)
 
 	// Blessings for the tests.
-	p, err := security.CreatePrincipal(newSigner(), nil, nil, nil, nil)
+	p, err := security.CreatePrincipal(newSigner(), nil, nil)
 	if err != nil {
 		t.Fatal("Failed to create principal: ", err)
 	}