Index: /trunk/src/VBox/Devices/Storage/DrvVD.cpp
===================================================================
--- /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 82689)
+++ /trunk/src/VBox/Devices/Storage/DrvVD.cpp	(revision 82690)
@@ -5080,19 +5080,29 @@
 
             /* Check VDConfig for encryption config. */
-            if (pCfgVDConfig)
-                pThis->pCfgCrypto = CFGMR3GetChild(pCfgVDConfig, "CRYPT");
-
-            if (pThis->pCfgCrypto)
-            {
-                /* Setup VDConfig interface for disk encryption support. */
-                pThis->VDIfCfg.pfnAreKeysValid  = drvvdCfgAreKeysValid;
-                pThis->VDIfCfg.pfnQuerySize     = drvvdCfgQuerySize;
-                pThis->VDIfCfg.pfnQuery         = drvvdCfgQuery;
-                pThis->VDIfCfg.pfnQueryBytes    = NULL;
-
-                pThis->VDIfCrypto.pfnKeyRetain               = drvvdCryptoKeyRetain;
-                pThis->VDIfCrypto.pfnKeyRelease              = drvvdCryptoKeyRelease;
-                pThis->VDIfCrypto.pfnKeyStorePasswordRetain  = drvvdCryptoKeyStorePasswordRetain;
-                pThis->VDIfCrypto.pfnKeyStorePasswordRelease = drvvdCryptoKeyStorePasswordRelease;
+            /** @todo This makes sure that the crypto config is not cleared accidentally
+             * when it was set because there are multiple VDConfig entries for a snapshot chain
+             * but only one contains the crypto config.
+             *
+             * This needs to be properly fixed by specifying which part of the image should contain the
+             * crypto stuff.
+             */
+            if (!pThis->pCfgCrypto)
+            {
+                if (pCfgVDConfig)
+                    pThis->pCfgCrypto = CFGMR3GetChild(pCfgVDConfig, "CRYPT");
+
+                if (pThis->pCfgCrypto)
+                {
+                    /* Setup VDConfig interface for disk encryption support. */
+                    pThis->VDIfCfg.pfnAreKeysValid  = drvvdCfgAreKeysValid;
+                    pThis->VDIfCfg.pfnQuerySize     = drvvdCfgQuerySize;
+                    pThis->VDIfCfg.pfnQuery         = drvvdCfgQuery;
+                    pThis->VDIfCfg.pfnQueryBytes    = NULL;
+
+                    pThis->VDIfCrypto.pfnKeyRetain               = drvvdCryptoKeyRetain;
+                    pThis->VDIfCrypto.pfnKeyRelease              = drvvdCryptoKeyRelease;
+                    pThis->VDIfCrypto.pfnKeyStorePasswordRetain  = drvvdCryptoKeyStorePasswordRetain;
+                    pThis->VDIfCrypto.pfnKeyStorePasswordRelease = drvvdCryptoKeyStorePasswordRelease;
+                }
             }