diff --git a/lib/libiscsiutil/keys.c b/lib/libiscsiutil/keys.c
--- a/lib/libiscsiutil/keys.c
+++ b/lib/libiscsiutil/keys.c
@@ -59,22 +59,22 @@
 }
 
 void
-keys_load(struct keys *keys, const struct pdu *pdu)
+keys_load(struct keys *keys, const char *data, size_t len)
 {
 	int i;
 	char *keys_data, *name, *pair, *value;
 	size_t pair_len;
 
-	if (pdu->pdu_data_len == 0)
+	if (len == 0)
 		return;
 
-	if (pdu->pdu_data[pdu->pdu_data_len - 1] != '\0')
+	if (data[len - 1] != '\0')
 		log_errx(1, "protocol error: key not NULL-terminated\n");
 
-	keys_data = malloc(pdu->pdu_data_len);
+	keys_data = malloc(len);
 	if (keys_data == NULL)
 		log_err(1, "malloc");
-	memcpy(keys_data, pdu->pdu_data, pdu->pdu_data_len);
+	memcpy(keys_data, data, len);
 
 	/*
 	 * XXX: Review this carefully.
@@ -96,15 +96,15 @@
 		    keys->keys_names[i], keys->keys_values[i]);
 
 		pair += pair_len + 1; /* +1 to skip the terminating '\0'. */
-		if (pair == keys_data + pdu->pdu_data_len)
+		if (pair == keys_data + len)
 			break;
-		assert(pair < keys_data + pdu->pdu_data_len);
+		assert(pair < keys_data + len);
 	}
 	free(keys_data);
 }
 
 void
-keys_save(struct keys *keys, struct pdu *pdu)
+keys_save(struct keys *keys, char **datap, size_t *lenp)
 {
 	FILE *fp;
 	char *data;
@@ -131,8 +131,8 @@
 		data = NULL;
 	}
 
-	pdu->pdu_data = data;
-	pdu->pdu_data_len = len;
+	*datap = data;
+	*lenp = len;
 }
 
 const char *
diff --git a/lib/libiscsiutil/libiscsiutil.h b/lib/libiscsiutil/libiscsiutil.h
--- a/lib/libiscsiutil/libiscsiutil.h
+++ b/lib/libiscsiutil/libiscsiutil.h
@@ -109,14 +109,28 @@
 
 struct keys		*keys_new(void);
 void			keys_delete(struct keys *key);
-void			keys_load(struct keys *keys, const struct pdu *pdu);
-void			keys_save(struct keys *keys, struct pdu *pdu);
+void			keys_load(struct keys *keys, const char *data,
+			    size_t len);
+void			keys_save(struct keys *keys, char **datap,
+			    size_t *lenp);
 const char		*keys_find(struct keys *keys, const char *name);
 void			keys_add(struct keys *keys,
 			    const char *name, const char *value);
 void			keys_add_int(struct keys *keys,
 			    const char *name, int value);
 
+static __inline void
+keys_load_pdu(struct keys *keys, const struct pdu *pdu)
+{
+	keys_load(keys, pdu->pdu_data, pdu->pdu_data_len);
+}
+
+static __inline void
+keys_save_pdu(struct keys *keys, struct pdu *pdu)
+{
+	keys_save(keys, &pdu->pdu_data, &pdu->pdu_data_len);
+}
+
 struct pdu		*pdu_new(struct connection *ic);
 struct pdu		*pdu_new_response(struct pdu *request);
 int			pdu_ahs_length(const struct pdu *pdu);
diff --git a/usr.sbin/ctld/discovery.c b/usr.sbin/ctld/discovery.c
--- a/usr.sbin/ctld/discovery.c
+++ b/usr.sbin/ctld/discovery.c
@@ -287,7 +287,7 @@
 	log_debugx("beginning discovery session; waiting for Text PDU");
 	request = text_receive(&conn->conn);
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 
 	send_targets = keys_find(request_keys, "SendTargets");
 	if (send_targets == NULL)
@@ -317,7 +317,7 @@
 			}
 		}
 	}
-	keys_save(response_keys, response);
+	keys_save_pdu(response_keys, response);
 
 	pdu_send(response);
 	pdu_delete(response);
diff --git a/usr.sbin/ctld/login.c b/usr.sbin/ctld/login.c
--- a/usr.sbin/ctld/login.c
+++ b/usr.sbin/ctld/login.c
@@ -236,7 +236,7 @@
 
 	request = login_receive(conn, false);
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 
 	chap_a = keys_find(request_keys, "CHAP_A");
 	if (chap_a == NULL) {
@@ -270,7 +270,7 @@
 	keys_add(response_keys, "CHAP_C", chap_c);
 	free(chap_i);
 	free(chap_c);
-	keys_save(response_keys, response);
+	keys_save_pdu(response_keys, response);
 	pdu_send(response);
 	pdu_delete(response);
 	keys_delete(response_keys);
@@ -288,7 +288,7 @@
 
 	request = login_receive(conn, false);
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 
 	chap_n = keys_find(request_keys, "CHAP_N");
 	if (chap_n == NULL) {
@@ -352,7 +352,7 @@
 	 * Actually, one more thing: mutual authentication.
 	 */
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 	chap_i = keys_find(request_keys, "CHAP_I");
 	chap_c = keys_find(request_keys, "CHAP_C");
 	if (chap_i != NULL || chap_c != NULL) {
@@ -389,7 +389,7 @@
 		keys_add(response_keys, "CHAP_N", auth->a_mutual_user);
 		keys_add(response_keys, "CHAP_R", chap_r);
 		free(chap_r);
-		keys_save(response_keys, response);
+		keys_save_pdu(response_keys, response);
 		keys_delete(response_keys);
 	} else {
 		log_debugx("initiator did not request target authentication");
@@ -635,7 +635,7 @@
 	response_keys = keys_new();
 	keys_add(response_keys, "TargetAddress", target_address);
 
-	keys_save(response_keys, response);
+	keys_save_pdu(response_keys, response);
 	pdu_send(response);
 	pdu_delete(response);
 	keys_delete(response_keys);
@@ -753,7 +753,7 @@
 	}
 
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 
 	response = login_new_response(request);
 	bhslr2 = (struct iscsi_bhs_login_response *)response->pdu_bhs;
@@ -801,7 +801,7 @@
 	log_debugx("operational parameter negotiation done; "
 	    "transitioning to Full Feature Phase");
 
-	keys_save(response_keys, response);
+	keys_save_pdu(response_keys, response);
 	pdu_send(response);
 	pdu_delete(response);
 	keys_delete(response_keys);
@@ -867,7 +867,7 @@
 	 * XXX: Implement the C flag some day.
 	 */
 	request_keys = keys_new();
-	keys_load(request_keys, request);
+	keys_load_pdu(request_keys, request);
 
 	assert(conn->conn_initiator_name == NULL);
 	initiator_name = keys_find(request_keys, "InitiatorName");
@@ -1036,7 +1036,7 @@
 		keys_add_int(response_keys,
 		    "TargetPortalGroupTag", pg->pg_tag);
 	}
-	keys_save(response_keys, response);
+	keys_save_pdu(response_keys, response);
 
 	pdu_send(response);
 	pdu_delete(response);
diff --git a/usr.sbin/iscsid/discovery.c b/usr.sbin/iscsid/discovery.c
--- a/usr.sbin/iscsid/discovery.c
+++ b/usr.sbin/iscsid/discovery.c
@@ -177,7 +177,7 @@
 	request = text_new_request(&conn->conn);
 	request_keys = keys_new();
 	keys_add(request_keys, "SendTargets", "All");
-	keys_save(request_keys, request);
+	keys_save_pdu(request_keys, request);
 	keys_delete(request_keys);
 	request_keys = NULL;
 	pdu_send(request);
@@ -187,7 +187,7 @@
 	log_debugx("waiting for Text Response");
 	response = text_receive(&conn->conn);
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 	for (i = 0; i < KEYS_MAX; i++) {
 		if (response_keys->keys_names[i] == NULL)
 			break;
diff --git a/usr.sbin/iscsid/login.c b/usr.sbin/iscsid/login.c
--- a/usr.sbin/iscsid/login.c
+++ b/usr.sbin/iscsid/login.c
@@ -198,7 +198,7 @@
 	assert (bhslr->bhslr_status_class == 1);
 
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 
 	target_address = keys_find(response_keys, "TargetAddress");
 	if (target_address == NULL)
@@ -543,7 +543,7 @@
 	keys_add(request_keys, "DefaultTime2Wait", "0");
 	keys_add(request_keys, "DefaultTime2Retain", "0");
 	keys_add(request_keys, "ErrorRecoveryLevel", "0");
-	keys_save(request_keys, request);
+	keys_save_pdu(request_keys, request);
 	keys_delete(request_keys);
 	request_keys = NULL;
 	pdu_send(request);
@@ -552,7 +552,7 @@
 
 	response = login_receive(&conn->conn);
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 	for (i = 0; i < KEYS_MAX; i++) {
 		if (response_keys->keys_names[i] == NULL)
 			break;
@@ -607,7 +607,7 @@
 	request = login_new_request(conn, BHSLR_STAGE_SECURITY_NEGOTIATION);
 	request_keys = keys_new();
 	keys_add(request_keys, "CHAP_A", "5");
-	keys_save(request_keys, request);
+	keys_save_pdu(request_keys, request);
 	keys_delete(request_keys);
 	pdu_send(request);
 	pdu_delete(request);
@@ -636,7 +636,7 @@
 	conn = (struct iscsid_connection *)response->pdu_connection;
 
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 
 	/*
 	 * First, compute the response.
@@ -693,7 +693,7 @@
 		free(mutual_chap_c);
 	}
 
-	keys_save(request_keys, request);
+	keys_save_pdu(request_keys, request);
 	keys_delete(request_keys);
 	pdu_send(request);
 	pdu_delete(request);
@@ -710,7 +710,7 @@
 	conn = (struct iscsid_connection *)response->pdu_connection;
 
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 
         chap_n = keys_find(response_keys, "CHAP_N");
         if (chap_n == NULL)
@@ -816,7 +816,7 @@
 	} else {
 		keys_add(request_keys, "SessionType", "Discovery");
 	}
-	keys_save(request_keys, request);
+	keys_save_pdu(request_keys, request);
 	keys_delete(request_keys);
 	pdu_send(request);
 	pdu_delete(request);
@@ -824,7 +824,7 @@
 	response = login_receive(&conn->conn);
 
 	response_keys = keys_new();
-	keys_load(response_keys, response);
+	keys_load_pdu(response_keys, response);
 
 	for (i = 0; i < KEYS_MAX; i++) {
 		if (response_keys->keys_names[i] == NULL)