diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java
index 88744bb..44c2d37 100644
--- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java
+++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceRequestToken.java
@@ -49,6 +49,26 @@ import org.springframework.security.extensions.kerberos.web.SpnegoAuthentication
  * @see SpnegoAuthenticationProcessingFilter
  */
 
+/**
+ * @author Jeremy.Stone
+ *
+ */
+/**
+ * @author Jeremy.Stone
+ *
+ */
+/**
+ * @author Jeremy.Stone
+ *
+ */
+/**
+ * @author Jeremy.Stone
+ *
+ */
+/**
+ * @author Jeremy.Stone
+ * 
+ */
 public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
 
     private static final long serialVersionUID = 395488921064775014L;
@@ -59,8 +79,11 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
 
     private final KerberosTicketValidation ticketValidation;
 
-    /** Creates an authenticated token, normally used as an output of an authentication provider.
-     * @param principal the user principal (mostly of instance <code>UserDetails</code>
+    /**
+     * Creates an authenticated token, normally used as an output of an
+     * authentication provider.
+     * @param principal the user principal (mostly of instance
+     * <code>UserDetails</code>
      * @param ticketValidation result of ticket validation
      * @param authorities the authorities which are granted to the user
      * @param token the Kerberos/SPNEGO token
@@ -79,7 +102,7 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
     /**
      * Creates an unauthenticated instance which should then be authenticated by
      * <code>KerberosServiceAuthenticationProvider/code>
-     *
+     * 
      * @param token Kerberos/SPNEGO token
      * @see KerberosServiceAuthenticationProvider
      */
@@ -118,14 +141,18 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
         return true;
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
+     * 
      * @see org.springframework.security.core.Authentication#getCredentials()
      */
     public Object getCredentials() {
         return null;
     }
 
-    /* (non-Javadoc)
+    /*
+     * (non-Javadoc)
+     * 
      * @see org.springframework.security.core.Authentication#getPrincipal()
      */
     public Object getPrincipal() {
@@ -201,4 +228,49 @@ public class KerberosServiceRequestToken extends AbstractAuthenticationToken {
                     }
                 });
     }
+
+    /**
+     * Unwraps an encrypted message using the gss context
+     * 
+     * @param data
+     * @return the decrypted message
+     * @throws PrivilegedActionException
+     */
+    public byte[] decrypt(final byte[] data) throws PrivilegedActionException {
+        return decrypt(data, 0, data.length);
+    }
+
+    /**
+     * Wraps an message using the gss context
+     * 
+     * @param data
+     * @param offset
+     * @param length
+     * @return the encrypted message
+     * @throws PrivilegedActionException
+     */
+    public byte[] encrypt(final byte[] data, final int offset, final int length)
+            throws PrivilegedActionException {
+
+        return Subject.doAs(getTicketValidation().subject(),
+                new PrivilegedExceptionAction<byte[]>() {
+                    public byte[] run() throws Exception {
+                        final GSSContext context = getTicketValidation()
+                                .getGssContext();
+                        return context.wrap(data, offset, length,
+                                new MessageProp(true));
+                    }
+                });
+    }
+
+    /**
+     * Wraps an message using the gss context
+     * 
+     * @param data
+     * @return the encrypted message
+     * @throws PrivilegedActionException
+     */
+    public byte[] encrypt(final byte[] data) throws PrivilegedActionException {
+        return encrypt(data, 0, data.length);
+    }
 }
diff --git a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java
index 125ba2b..42dc076 100644
--- a/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java
+++ b/spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/SunJaasKerberosTicketValidator.java
@@ -55,6 +55,7 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
     private String servicePrincipal;
     private Resource keyTabLocation;
     private Subject serviceSubject;
+    private boolean holdOnToGSSContext;
     private boolean debug = false;
     private static final Log LOG = LogFactory.getLog(SunJaasKerberosTicketValidator.class);
 
@@ -106,6 +107,17 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
     public void setDebug(boolean debug) {
         this.debug = debug;
     }
+    
+    /**
+     * Determines whether to hold on to the {@link GSSContext GSS security context} or
+     * otherwise {@link GSSContext#dispose() dispose} of it immediately (the default behaviour).
+     * <p>Holding on to the GSS context allows decrypt and encrypt operations for subsequent 
+     * interactions with the principal.
+     * @param holdOnToGSSContext
+     */
+    public void setHoldOnToGSSContext(boolean holdOnToGSSContext) {
+        this.holdOnToGSSContext = holdOnToGSSContext;
+    }
 
     /* (non-Javadoc)
      * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
@@ -156,9 +168,11 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
             
             String user = context.getSrcName().toString();
 
-            // context.dispose();
+            if (!holdOnToGSSContext) {
+                context.dispose();
+            }
             return new KerberosTicketValidation(user, servicePrincipal,
-                responseToken, context);
+                    responseToken, context);
         }
     }