diff --git a/ChangeLog b/ChangeLog
index f640cc0..8601a02 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2011-11-01  Niibe Yutaka  <gniibe@fsij.org>
 
+	* src/ac.c (verify_user_0): Fix for non-initialized PW1.
+
 	* src/Makefile.in (MCFLAGS): Override MCFLAGS option for newer
 	GCC of summon-arm-toolchain to add -mfix-cortex-m3-ldrd.
 	NOTE: This should not be needed (as -mcpu=cortex-m3 defaults
diff --git a/src/ac.c b/src/ac.c
index f6300d5..4d29ef7 100644
--- a/src/ac.c
+++ b/src/ac.c
@@ -75,7 +75,7 @@ verify_user_0 (const uint8_t *pw, int buf_len, int pw_len_known,
 	  || strncmp ((const char *)pw, OPENPGP_CARD_INITIAL_PW1, pw_len))
 	goto failure;
       else
-	goto success;
+	goto success_one_step;
     }
   else
     pw_len = ks_pw1[0];
@@ -88,15 +88,15 @@ verify_user_0 (const uint8_t *pw, int buf_len, int pw_len_known,
       return -1;
     }
 
+ success_one_step:
   sha1 (pw, pw_len, keystring);
   if ((r = gpg_do_load_prvkey (GPG_KEY_FOR_SIGNING, BY_USER, keystring))
       < 0)
     goto failure;
   else if (r == 0)
-    if (memcmp (ks_pw1+1, keystring, KEYSTRING_MD_SIZE) != 0)
+    if (ks_pw1 != NULL && memcmp (ks_pw1+1, keystring, KEYSTRING_MD_SIZE) != 0)
       goto failure;
 
- success:
   gpg_pw_reset_err_counter (PW_ERR_PW1);
   return pw_len;
 }