diff --git a/Ext4Crypt.cpp b/Ext4Crypt.cpp
index 751a4eb..95cbfb7 100644
--- a/Ext4Crypt.cpp
+++ b/Ext4Crypt.cpp
@@ -285,6 +285,7 @@
     return 0;
 }
 
+// Get raw keyref - used to make keyname and to pass to ioctl
 static std::string generate_key_ref(const char* key, int length)
 {
     SHA512_CTX c;
@@ -351,9 +352,7 @@
     return 0;
 }
 
-// Install password into global keyring
-// Return raw key reference for use in policy
-static std::string e4crypt_install_key(const std::string &key)
+static ext4_encryption_key fill_key(const std::string &key)
 {
     // ext4enc:TODO Currently raw key is required to be of length
     // sizeof(ext4_key.raw) == EXT4_MAX_KEY_SIZE, so zero pad to
@@ -365,37 +364,52 @@
     static_assert(key_length / 8 <= sizeof(ext4_key.raw),
                   "Key too long!");
     memcpy(ext4_key.raw, &key[0], key.size());
+    return ext4_key;
+}
 
-    // Get raw keyref - used to make keyname and to pass to ioctl
-    auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
-
-    // Generate keyname
+static std::string keyname(const std::string &raw_ref)
+{
     std::ostringstream o;
+    o << "ext4:";
     for (auto i = raw_ref.begin(); i != raw_ref.end(); ++i) {
         o << std::hex << std::setw(2) << std::setfill('0') << (int)*i;
     }
-    auto ref = std::string("ext4:") + o.str();
+    return o.str();
+}
 
-    // Find existing keyring
-    key_serial_t device_keyring = keyctl_search(KEY_SPEC_SESSION_KEYRING,
-                                                "keyring", "e4crypt", 0);
+// Get the keyring we store all keys in
+static key_serial_t e4crypt_keyring()
+{
+    return keyctl_search(KEY_SPEC_SESSION_KEYRING, "keyring", "e4crypt", 0);
+}
 
+static int e4crypt_install_key(const ext4_encryption_key &ext4_key, const std::string &ref)
+{
+    key_serial_t device_keyring = e4crypt_keyring();
     SLOGI("Found device_keyring - id is %d", device_keyring);
-
-    // Add key ...
     key_serial_t key_id = add_key("logon", ref.c_str(),
                                   (void*)&ext4_key, sizeof(ext4_key),
                                   device_keyring);
-
     if (key_id == -1) {
         SLOGE("Failed to insert key into keyring with error %s",
               strerror(errno));
-        return "";
+        return -1;
     }
-
     SLOGI("Added key %d (%s) to keyring %d in process %d",
           key_id, ref.c_str(), device_keyring, getpid());
+    return 0;
+}
 
+// Install password into global keyring
+// Return raw key reference for use in policy
+static std::string e4crypt_install_key(const std::string &key)
+{
+    auto ext4_key = fill_key(key);
+    auto raw_ref = generate_key_ref(ext4_key.raw, ext4_key.size);
+    auto ref = keyname(raw_ref);
+    if (e4crypt_install_key(ext4_key, ref) == -1) {
+        return "";
+    }
     return raw_ref;
 }
 
@@ -509,12 +523,10 @@
 
 // ext4enc:TODO this can't be the only place keys are read from /dev/urandom
 // we should unite those places.
-static std::string e4crypt_get_user_key(
-    const char *mount_path,
-    const char *user_handle,
+static std::string e4crypt_get_key(
+    const std::string &key_path,
     bool create_if_absent)
 {
-    auto key_path = get_key_path(mount_path, user_handle);
     std::string content;
     if (android::base::ReadFileToString(key_path, &content)) {
         if (content.size() != key_length/8) {
@@ -539,20 +551,21 @@
         SLOGE("Unable to read key from /dev/urandom (%s)", strerror(errno));
         return "";
     }
-    std::string user_key(key_bytes, sizeof(key_bytes));
-    if (!android::base::WriteStringToFile(user_key, key_path)) {
+    std::string key(key_bytes, sizeof(key_bytes));
+    if (!android::base::WriteStringToFile(key, key_path)) {
         SLOGE("Unable to write key to %s (%s)",
                 key_path.c_str(), strerror(errno));
         return "";
     }
-    return user_key;
+    return key;
 }
 
 static int e4crypt_set_user_policy(const char *mount_path, const char *user_handle,
                             const char *path, bool create_if_absent)
 {
     SLOGD("e4crypt_set_user_policy for %s", user_handle);
-    auto user_key = e4crypt_get_user_key(mount_path, user_handle,
+    auto user_key = e4crypt_get_key(
+        get_key_path(mount_path, user_handle),
         create_if_absent);
     if (user_key.empty()) {
         return -1;
@@ -623,7 +636,16 @@
 int e4crypt_delete_user_key(const char *user_handle) {
     SLOGD("e4crypt_delete_user_key(\"%s\")", user_handle);
     auto key_path = get_key_path(DATA_MNT_POINT, user_handle);
-    // ext4enc:TODO evict the key from the keyring.
+    auto key = e4crypt_get_key(key_path, false);
+    auto ext4_key = fill_key(key);
+    auto ref = keyname(generate_key_ref(ext4_key.raw, ext4_key.size));
+    auto key_serial = keyctl_search(e4crypt_keyring(), "logon", ref.c_str(), 0);
+    if (keyctl_revoke(key_serial) == 0) {
+        SLOGD("Revoked key with serial %ld ref %s\n", key_serial, ref.c_str());
+    } else {
+        SLOGE("Failed to revoke key with serial %ld ref %s: %s\n",
+            key_serial, ref.c_str(), strerror(errno));
+    }
     int pid = fork();
     if (pid < 0) {
         SLOGE("Unable to fork: %s", strerror(errno));