diff --git a/src/cache.c b/src/cache.c
index 55dd2b9..9fd1cf2 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -1364,6 +1364,23 @@ struct keydata *keydata_alloc(char *data, size_t len)
   return ret;
 }
 
+size_t keydata_walk(struct keydata **key, unsigned char **p, size_t cnt)
+{
+  size_t ret;
+
+  if (*p == NULL)
+    *p = (*key)->key;
+  else if (*p == (*key)->key + KEYBLOCK_LEN)
+    {
+      *key = (*key)->next;
+      if (*key == NULL)
+        return 0;
+      *p = (*key)->key;
+    }
+
+  return MIN(cnt, (*key)->key + KEYBLOCK_LEN - (*p));
+}
+
 void keydata_free(struct keydata *blocks)
 {
   struct keydata *tmp;
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index 6c62a52..4331066 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -925,6 +925,7 @@ char *cache_get_name(struct crec *crecp);
 struct crec *cache_enumerate(int init);
 #ifdef HAVE_DNSSEC
 struct keydata *keydata_alloc(char *data, size_t len);
+size_t keydata_walk(struct keydata **key, unsigned char **p, size_t cnt);
 void keydata_free(struct keydata *blocks);
 #endif