gnunet-svn
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[gnunet] branch master updated: fixing #6149


From: gnunet
Subject: [gnunet] branch master updated: fixing #6149
Date: Sat, 11 Apr 2020 21:51:28 +0200

This is an automated email from the git hooks/post-receive script.

grothoff pushed a commit to branch master
in repository gnunet.

The following commit(s) were added to refs/heads/master by this push:
     new 90ff9edfa fixing #6149
90ff9edfa is described below

commit 90ff9edfa9c5fcfa3a36d1653ff105e89b888e21
Author: Christian Grothoff <address@hidden>
AuthorDate: Sat Apr 11 21:43:28 2020 +0200

    fixing #6149
---
 src/cadet/gnunet-service-cadet_tunnels.c           |   6 +-
 src/core/gnunet-service-core.c                     |  26 +-
 src/core/gnunet-service-core_kx.c                  |  49 +-
 src/fs/gnunet-service-fs.c                         |  19 +-
 src/fs/test_fs_namespace.c                         |  16 +-
 src/fs/test_fs_namespace_list_updateable.c         |  21 +-
 src/fs/test_fs_uri.c                               |  14 +-
 src/gnsrecord/perf_gnsrecord_crypto.c              |  10 +-
 src/gnsrecord/test_gnsrecord_crypto.c              |  14 +-
 src/hostlist/gnunet-daemon-hostlist_server.c       |   5 +-
 src/identity/gnunet-service-identity.c             |  33 +-
 src/identity/identity.h                            |   2 +-
 src/identity/identity_api.c                        |  50 +-
 src/identity/identity_api_lookup.c                 |   2 +-
 src/include/gnunet_crypto_lib.h                    |  83 ++-
 src/include/gnunet_disk_lib.h                      |  29 --
 src/include/gnunet_identity_service.h              |  30 +-
 src/namestore/perf_namestore_api_zone_iteration.c  |  14 +-
 src/namestore/test_namestore_api_lookup_nick.c     |  25 +-
 src/namestore/test_namestore_api_lookup_private.c  |  18 +-
 src/namestore/test_namestore_api_lookup_public.c   |  24 +-
 src/namestore/test_namestore_api_lookup_shadow.c   |  24 +-
 .../test_namestore_api_lookup_shadow_filter.c      |  24 +-
 src/namestore/test_namestore_api_monitoring.c      |  33 +-
 .../test_namestore_api_monitoring_existing.c       |  30 +-
 src/namestore/test_namestore_api_remove.c          |  16 +-
 ...test_namestore_api_remove_not_existing_record.c |  18 +-
 src/namestore/test_namestore_api_store.c           |  14 +-
 src/namestore/test_namestore_api_store_update.c    |  18 +-
 .../test_namestore_api_zone_iteration_nick.c       |  39 +-
 ...st_namestore_api_zone_iteration_specific_zone.c |  33 +-
 src/namestore/test_namestore_api_zone_to_name.c    |  18 +-
 src/reclaim/oidc_helper.c                          |  13 +-
 src/sq/sq_query_helper.c                           |   4 +-
 src/transport/gnunet-communicator-tcp.c            |   6 +-
 src/transport/gnunet-communicator-udp.c            |   2 +-
 src/transport/gnunet-service-tng.c                 |   3 +-
 src/transport/gnunet-service-transport.c           |  27 +-
 src/transport/gnunet-service-transport.h           |   2 +-
 .../gnunet-service-transport_neighbours.c          |   2 +-
 .../gnunet-service-transport_validation.c          |   2 +-
 src/util/crypto_ecc.c                              |  96 ++--
 src/util/crypto_ecc_setup.c                        | 573 +++++++++------------
 src/util/disk.c                                    |  64 ---
 src/util/gnunet-crypto-tvg.c                       | 123 +++--
 src/util/gnunet-ecc.c                              | 108 ++--
 src/util/gnunet-scrypt.c                           |  11 +-
 src/util/os_priority.c                             |   2 +-
 src/util/test_crypto_ecdh_ecdsa.c                  |  27 +-
 src/util/test_crypto_ecdh_eddsa.c                  |  24 +-
 src/util/test_crypto_ecdhe.c                       |  27 +-
 src/util/test_crypto_ecdsa.c                       | 100 ++--
 src/util/test_crypto_eddsa.c                       | 108 ++--
 53 files changed, 927 insertions(+), 1154 deletions(-)

diff --git a/src/cadet/gnunet-service-cadet_tunnels.c 
b/src/cadet/gnunet-service-cadet_tunnels.c
index ae201ed2d..f1f2ec81f 100644
--- a/src/cadet/gnunet-service-cadet_tunnels.c
+++ b/src/cadet/gnunet-service-cadet_tunnels.c
@@ -677,8 +677,7 @@ new_ephemeral (struct CadetTunnelAxolotl *ax)
 {
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Creating new ephemeral ratchet key (DHRs)\n");
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdhe_key_create2 (&ax->DHRs));
+  GNUNET_CRYPTO_ecdhe_key_create (&ax->DHRs);
 }
 
 
@@ -3186,8 +3185,7 @@ GCT_create_tunnel (struct CadetPeer *destination)
 
   t->kx_retry_delay = INITIAL_KX_RETRY_DELAY;
   new_ephemeral (&t->ax);
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdhe_key_create2 (&t->ax.kx_0));
+  GNUNET_CRYPTO_ecdhe_key_create (&t->ax.kx_0);
   t->destination = destination;
   t->channels = GNUNET_CONTAINER_multihashmap32_create (8);
   t->maintain_connections_task
diff --git a/src/core/gnunet-service-core.c b/src/core/gnunet-service-core.c
index 04e6d0141..34f8440ae 100644
--- a/src/core/gnunet-service-core.c
+++ b/src/core/gnunet-service-core.c
@@ -912,14 +912,15 @@ run (void *cls,
      const struct GNUNET_CONFIGURATION_Handle *c,
      struct GNUNET_SERVICE_Handle *service)
 {
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
   char *keyfile;
 
   GSC_cfg = c;
-  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_filename (GSC_cfg,
-                                                            "PEER",
-                                                            "PRIVATE_KEY",
-                                                            &keyfile))
+  if (GNUNET_OK !=
+      GNUNET_CONFIGURATION_get_value_filename (GSC_cfg,
+                                               "PEER",
+                                               "PRIVATE_KEY",
+                                               &keyfile))
   {
     GNUNET_log (
       GNUNET_ERROR_TYPE_ERROR,
@@ -931,10 +932,19 @@ run (void *cls,
   GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
   GNUNET_SERVICE_suspend (service);
   GSC_TYPEMAP_init ();
-  pk = GNUNET_CRYPTO_eddsa_key_create_from_file (keyfile);
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                         GNUNET_YES,
+                                         &pk))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to setup peer's private key\n");
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (keyfile);
+    return;
+  }
   GNUNET_free (keyfile);
-  GNUNET_assert (NULL != pk);
-  if (GNUNET_OK != GSC_KX_init (pk))
+  if (GNUNET_OK != GSC_KX_init (&pk))
   {
     GNUNET_SCHEDULER_shutdown ();
     return;
diff --git a/src/core/gnunet-service-core_kx.c 
b/src/core/gnunet-service-core_kx.c
index 315095938..cafe658e8 100644
--- a/src/core/gnunet-service-core_kx.c
+++ b/src/core/gnunet-service-core_kx.c
@@ -366,12 +366,12 @@ static struct GNUNET_TRANSPORT_CoreHandle *transport;
 /**
  * Our private key.
  */
-static struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
+static struct GNUNET_CRYPTO_EddsaPrivateKey my_private_key;
 
 /**
  * Our ephemeral private key.
  */
-static struct GNUNET_CRYPTO_EcdhePrivateKey *my_ephemeral_key;
+static struct GNUNET_CRYPTO_EcdhePrivateKey my_ephemeral_key;
 
 /**
  * Current message we send for a key exchange.
@@ -935,9 +935,10 @@ derive_session_keys (struct GSC_KeyExchangeInfo *kx)
 {
   struct GNUNET_HashCode key_material;
 
-  if (GNUNET_OK != GNUNET_CRYPTO_ecc_ecdh (my_ephemeral_key,
-                                           &kx->other_ephemeral_key,
-                                           &key_material))
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecc_ecdh (&my_ephemeral_key,
+                              &kx->other_ephemeral_key,
+                              &key_material))
   {
     GNUNET_break (0);
     return;
@@ -1850,11 +1851,11 @@ sign_ephemeral_key ()
     current_ekm.expiration_time =
       GNUNET_TIME_absolute_hton (GNUNET_TIME_UNIT_FOREVER_ABS);
   }
-  GNUNET_CRYPTO_ecdhe_key_get_public (my_ephemeral_key,
+  GNUNET_CRYPTO_ecdhe_key_get_public (&my_ephemeral_key,
                                       &current_ekm.ephemeral_key);
   current_ekm.origin_identity = GSC_my_identity;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_eddsa_sign_ (my_private_key,
+                 GNUNET_CRYPTO_eddsa_sign_ (&my_private_key,
                                             &current_ekm.purpose,
                                             &current_ekm.signature));
 }
@@ -1871,10 +1872,7 @@ do_rekey (void *cls)
   struct GSC_KeyExchangeInfo *pos;
 
   rekey_task = GNUNET_SCHEDULER_add_delayed (REKEY_FREQUENCY, &do_rekey, NULL);
-  if (NULL != my_ephemeral_key)
-    GNUNET_free (my_ephemeral_key);
-  my_ephemeral_key = GNUNET_CRYPTO_ecdhe_key_create ();
-  GNUNET_assert (NULL != my_ephemeral_key);
+  GNUNET_CRYPTO_ecdhe_key_create (&my_ephemeral_key);
   sign_ephemeral_key ();
   {
     struct GNUNET_HashCode eh;
@@ -1931,17 +1929,10 @@ GSC_KX_init (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
                            NULL),
     GNUNET_MQ_handler_end () };
 
-  my_private_key = pk;
-  GNUNET_CRYPTO_eddsa_key_get_public (my_private_key,
+  my_private_key = *pk;
+  GNUNET_CRYPTO_eddsa_key_get_public (&my_private_key,
                                       &GSC_my_identity.public_key);
-  my_ephemeral_key = GNUNET_CRYPTO_ecdhe_key_create ();
-  if (NULL == my_ephemeral_key)
-  {
-    GNUNET_break (0);
-    GNUNET_free (my_private_key);
-    my_private_key = NULL;
-    return GNUNET_SYSERR;
-  }
+  GNUNET_CRYPTO_ecdhe_key_create (&my_ephemeral_key);
   sign_ephemeral_key ();
   {
     struct GNUNET_HashCode eh;
@@ -1989,16 +1980,12 @@ GSC_KX_done ()
     GNUNET_SCHEDULER_cancel (rekey_task);
     rekey_task = NULL;
   }
-  if (NULL != my_ephemeral_key)
-  {
-    GNUNET_free (my_ephemeral_key);
-    my_ephemeral_key = NULL;
-  }
-  if (NULL != my_private_key)
-  {
-    GNUNET_free (my_private_key);
-    my_private_key = NULL;
-  }
+  memset (&my_ephemeral_key,
+          0,
+          sizeof (my_ephemeral_key));
+  memset (&my_private_key,
+          0,
+          sizeof (my_private_key));
   if (NULL != nc)
   {
     GNUNET_notification_context_destroy (nc);
diff --git a/src/fs/gnunet-service-fs.c b/src/fs/gnunet-service-fs.c
index 29e6de9d5..cf9069918 100644
--- a/src/fs/gnunet-service-fs.c
+++ b/src/fs/gnunet-service-fs.c
@@ -315,7 +315,7 @@ static struct GNUNET_CONFIGURATION_Handle *block_cfg;
 /**
  * Private key of this peer.  Used to sign LOC URI requests.
  */
-static struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+static struct GNUNET_CRYPTO_EddsaPrivateKey pk;
 
 /**
  * ID of our task that we use to age the cover counters.
@@ -939,7 +939,7 @@ handle_client_loc_sign (void *cls,
   base.data.chk.chk = msg->chk;
   base.data.chk.file_length = GNUNET_ntohll (msg->file_length);
   loc = GNUNET_FS_uri_loc_create (&base,
-                                  pk,
+                                  &pk,
                                   GNUNET_TIME_absolute_ntoh (
                                     msg->expiration_time));
   env = GNUNET_MQ_msg (resp,
@@ -1283,10 +1283,19 @@ main_init (const struct GNUNET_CONFIGURATION_Handle *c)
     GNUNET_SCHEDULER_shutdown ();
     return GNUNET_SYSERR;
   }
-  pk = GNUNET_CRYPTO_eddsa_key_create_from_file (keyfile);
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                         GNUNET_YES,
+                                         &pk))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to setup peer's private key\n");
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (keyfile);
+    return GNUNET_SYSERR;
+  }
   GNUNET_free (keyfile);
-  GNUNET_assert (NULL != pk);
-  GNUNET_CRYPTO_eddsa_key_get_public (pk,
+  GNUNET_CRYPTO_eddsa_key_get_public (&pk,
                                       &GSF_my_id.public_key);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
diff --git a/src/fs/test_fs_namespace.c b/src/fs/test_fs_namespace.c
index cdcb4d8fd..484884243 100644
--- a/src/fs/test_fs_namespace.c
+++ b/src/fs/test_fs_namespace.c
@@ -239,7 +239,7 @@ static void
 adv_cont (void *cls, const struct GNUNET_FS_Uri *uri, const char *emsg)
 {
   struct GNUNET_CONTAINER_MetaData *meta;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *ns;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey ns;
   struct GNUNET_FS_BlockOptions bo;
 
   if (NULL != emsg)
@@ -249,7 +249,7 @@ adv_cont (void *cls, const struct GNUNET_FS_Uri *uri, const 
char *emsg)
     GNUNET_FS_stop (fs);
     return;
   }
-  ns = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_CRYPTO_ecdsa_key_create (&ns);
   meta = GNUNET_CONTAINER_meta_data_create ();
   sks_expect_uri = GNUNET_FS_uri_dup (uri);
   bo.content_priority = 1;
@@ -257,24 +257,23 @@ adv_cont (void *cls, const struct GNUNET_FS_Uri *uri, 
const char *emsg)
   bo.replication_level = 0;
   bo.expiration_time =
     GNUNET_TIME_relative_to_absolute (GNUNET_TIME_UNIT_MINUTES);
-  GNUNET_CRYPTO_ecdsa_key_get_public (ns, &nsid);
-  GNUNET_FS_publish_sks (fs, ns, "this", "next", meta, uri,
+  GNUNET_CRYPTO_ecdsa_key_get_public (&ns,
+                                      &nsid);
+  GNUNET_FS_publish_sks (fs,
+                         &ns, "this", "next", meta, uri,
                          &bo, GNUNET_FS_PUBLISH_OPTION_NONE, &sks_cont, NULL);
   GNUNET_CONTAINER_meta_data_destroy (meta);
-  GNUNET_free (ns);
 }
 
 
 static void
-testNamespace ()
+testNamespace (void)
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *ns;
   struct GNUNET_FS_BlockOptions bo;
   struct GNUNET_CONTAINER_MetaData *meta;
   struct GNUNET_FS_Uri *ksk_uri;
   struct GNUNET_FS_Uri *sks_uri;
 
-  ns = GNUNET_CRYPTO_ecdsa_key_create ();
   meta = GNUNET_CONTAINER_meta_data_create ();
   ksk_uri = GNUNET_FS_uri_parse ("gnunet://fs/ksk/testnsa", NULL);
   bo.content_priority = 1;
@@ -293,7 +292,6 @@ testNamespace ()
                                   NULL);
   GNUNET_FS_uri_destroy (ksk_uri);
   GNUNET_CONTAINER_meta_data_destroy (meta);
-  GNUNET_free (ns);
 }
 
 
diff --git a/src/fs/test_fs_namespace_list_updateable.c 
b/src/fs/test_fs_namespace_list_updateable.c
index 4311f0110..2132220fb 100644
--- a/src/fs/test_fs_namespace_list_updateable.c
+++ b/src/fs/test_fs_namespace_list_updateable.c
@@ -33,7 +33,7 @@ static struct GNUNET_FS_Handle *fs;
 
 static int err;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *ns;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey ns;
 
 static struct GNUNET_CONTAINER_MetaData *meta;
 
@@ -58,8 +58,6 @@ do_shutdown ()
     GNUNET_FS_uri_destroy (uri_this);
   if (uri_next != NULL)
     GNUNET_FS_uri_destroy (uri_next);
-  if (ns != NULL)
-    GNUNET_free (ns);
   if (meta != NULL)
     GNUNET_CONTAINER_meta_data_destroy (meta);
 }
@@ -87,7 +85,7 @@ check_this_next (void *cls, const char *last_id,
   GNUNET_break (0 == strcmp (next_id, "next"));
   err -= 2;
   err += 4;
-  GNUNET_FS_namespace_list_updateable (fs, ns, next_id, &check_next, NULL);
+  GNUNET_FS_namespace_list_updateable (fs, &ns, next_id, &check_next, NULL);
 }
 
 
@@ -96,7 +94,7 @@ sks_cont_next (void *cls, const struct GNUNET_FS_Uri *uri, 
const char *emsg)
 {
   GNUNET_assert (NULL == emsg);
   err += 2;
-  GNUNET_FS_namespace_list_updateable (fs, ns, NULL, &check_this_next, NULL);
+  GNUNET_FS_namespace_list_updateable (fs, &ns, NULL, &check_this_next, NULL);
 }
 
 
@@ -117,17 +115,17 @@ sks_cont_this (void *cls, const struct GNUNET_FS_Uri 
*uri, const char *emsg)
 {
   GNUNET_assert (NULL == emsg);
   err = 1;
-  GNUNET_FS_namespace_list_updateable (fs, ns, NULL, &check_this, NULL);
-  GNUNET_FS_publish_sks (fs, ns, "next", "future", meta, uri_next, &bo,
+  GNUNET_FS_namespace_list_updateable (fs, &ns, NULL, &check_this, NULL);
+  GNUNET_FS_publish_sks (fs,
+                         &ns, "next", "future", meta, uri_next, &bo,
                          GNUNET_FS_PUBLISH_OPTION_NONE, &sks_cont_next, NULL);
 }
 
 
 static void
-testNamespace ()
+testNamespace (void)
 {
-  ns = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != ns);
+  GNUNET_CRYPTO_ecdsa_key_create (&ns);
   bo.content_priority = 1;
   bo.anonymity_level = 1;
   bo.replication_level = 0;
@@ -145,7 +143,8 @@ testNamespace ()
     (
       
"gnunet://fs/chk/C282GG70GKK41O4551011DO413KFBVTVMQG1OG30I0K4045N0G41HAPB82G680A02JRVVFO8URVRU2F159011DO41000000022RG820.RNVVVVOOLCLK065B5D04HTNVNSIB2AI022RG8200HSLK1CO1000ATQ98824DMA2032LIMG50CG0K057NVUVG200000H000004400000.43",
       NULL);
-  GNUNET_FS_publish_sks (fs, ns, "this", "next", meta, uri_this, &bo,
+  GNUNET_FS_publish_sks (fs,
+                         &ns, "this", "next", meta, uri_this, &bo,
                          GNUNET_FS_PUBLISH_OPTION_NONE, &sks_cont_this, NULL);
 }
 
diff --git a/src/fs/test_fs_uri.c b/src/fs/test_fs_uri.c
index 2a324af9a..30eafab9a 100644
--- a/src/fs/test_fs_uri.c
+++ b/src/fs/test_fs_uri.c
@@ -81,7 +81,7 @@ testLocation ()
   struct GNUNET_FS_Uri *uri2;
   struct GNUNET_FS_Uri *baseURI;
   char *emsg;
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
 
   baseURI =
     GNUNET_FS_uri_parse
@@ -90,11 +90,10 @@ testLocation ()
       &emsg);
   GNUNET_assert (baseURI != NULL);
   GNUNET_assert (emsg == NULL);
-  pk = GNUNET_CRYPTO_eddsa_key_create ();
+  GNUNET_CRYPTO_eddsa_key_create (&pk);
   uri = GNUNET_FS_uri_loc_create (baseURI,
-                                  pk,
+                                  &pk,
                                   GNUNET_TIME_absolute_get ());
-  GNUNET_free (pk);
   if (NULL == uri)
   {
     GNUNET_break (0);
@@ -154,7 +153,7 @@ testNamespace (int i)
   char *uri;
   struct GNUNET_FS_Uri *ret;
   char *emsg;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *ph;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey ph;
   struct GNUNET_CRYPTO_EcdsaPublicKey id;
   char buf[1024];
   char ubuf[1024];
@@ -187,8 +186,9 @@ testNamespace (int i)
     GNUNET_assert (0);
   }
   GNUNET_free (emsg);
-  ph = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_CRYPTO_ecdsa_key_get_public (ph, &id);
+  GNUNET_CRYPTO_ecdsa_key_create (&ph);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&ph,
+                                      &id);
   sret = GNUNET_STRINGS_data_to_string (&id, sizeof(id),
                                         ubuf, sizeof(ubuf) - 1);
   GNUNET_assert (NULL != sret);
diff --git a/src/gnsrecord/perf_gnsrecord_crypto.c 
b/src/gnsrecord/perf_gnsrecord_crypto.c
index 3bb4ca4e1..b2614eb77 100644
--- a/src/gnsrecord/perf_gnsrecord_crypto.c
+++ b/src/gnsrecord/perf_gnsrecord_crypto.c
@@ -73,7 +73,7 @@ run (void *cls,
   struct GNUNET_GNSRECORD_Data *s_rd;
   const char *s_name;
   struct GNUNET_TIME_Absolute start_time;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
   struct GNUNET_TIME_Absolute expire;
 
   (void) cls;
@@ -81,8 +81,7 @@ run (void *cls,
   (void) cfgfile;
   (void) cfg;
   expire = GNUNET_TIME_absolute_get ();
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
 
   /* test block creation */
   s_name = "DUMMY.dummy.gnunet";
@@ -91,12 +90,12 @@ run (void *cls,
   for (unsigned int i = 0; i < ROUNDS; i++)
   {
     GNUNET_assert (NULL != (block =
-                              GNUNET_GNSRECORD_block_create2 (privkey,
+                              GNUNET_GNSRECORD_block_create2 (&privkey,
                                                               expire,
                                                               s_name,
                                                               s_rd,
                                                               RECORDS)));
-    GNUNET_GNSRECORD_query_from_private_key (privkey,
+    GNUNET_GNSRECORD_query_from_private_key (&privkey,
                                              s_name,
                                              &query);
     GNUNET_free (block);
@@ -110,7 +109,6 @@ run (void *cls,
   for (unsigned int i = 0; i < RECORDS; i++)
     GNUNET_free ((void *) s_rd[i].data);
   GNUNET_free (s_rd);
-  GNUNET_free (privkey);
 }
 
 
diff --git a/src/gnsrecord/test_gnsrecord_crypto.c 
b/src/gnsrecord/test_gnsrecord_crypto.c
index 0da19fbe9..b67e9a123 100644
--- a/src/gnsrecord/test_gnsrecord_crypto.c
+++ b/src/gnsrecord/test_gnsrecord_crypto.c
@@ -41,8 +41,6 @@
 #define TEST_REMOVE_RECORD_DATA 'b'
 
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
-
 static struct GNUNET_GNSRECORD_Data *s_rd;
 
 static char *s_name;
@@ -106,15 +104,16 @@ run (void *cls,
   struct GNUNET_HashCode query_pub;
   struct GNUNET_HashCode query_priv;
   struct GNUNET_TIME_Absolute expire = GNUNET_TIME_absolute_get ();
+  struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+
 
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
   /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   /* test query derivation */
-  GNUNET_GNSRECORD_query_from_private_key (privkey,
+  GNUNET_GNSRECORD_query_from_private_key (&privkey,
                                            "testlabel",
                                            &query_priv);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey,
@@ -129,7 +128,7 @@ run (void *cls,
 
   /* Create block */
   GNUNET_assert (NULL != (block =
-                            GNUNET_GNSRECORD_block_create (privkey,
+                            GNUNET_GNSRECORD_block_create (&privkey,
                                                            expire,
                                                            s_name,
                                                            s_rd,
@@ -143,7 +142,6 @@ run (void *cls,
                                                  &rd_decrypt_cb,
                                                  s_name));
   GNUNET_free (block);
-  GNUNET_free (privkey);
 }
 
 
diff --git a/src/hostlist/gnunet-daemon-hostlist_server.c 
b/src/hostlist/gnunet-daemon-hostlist_server.c
index b2b7dac72..999730e3e 100644
--- a/src/hostlist/gnunet-daemon-hostlist_server.c
+++ b/src/hostlist/gnunet-daemon-hostlist_server.c
@@ -32,6 +32,7 @@
 #include "gnunet_peerinfo_service.h"
 #include "gnunet-daemon-hostlist.h"
 #include "gnunet_resolver_service.h"
+#include "gnunet_mhd_compat.h"
 
 
 /**
@@ -294,7 +295,7 @@ host_processor (void *cls,
  * @param addrlen length of @a addr
  * @return #MHD_YES if connection is allowed, #MHD_NO if not (we are not ready)
  */
-static int
+static MHD_RESULT
 accept_policy_callback (void *cls,
                         const struct sockaddr *addr,
                         socklen_t addrlen)
@@ -345,7 +346,7 @@ accept_policy_callback (void *cls,
  *         #MHD_NO if the socket must be closed due to a serios
  *         error while handling the request
  */
-static int
+static MHD_RESULT
 access_handler_callback (void *cls,
                          struct MHD_Connection *connection,
                          const char *url,
diff --git a/src/identity/gnunet-service-identity.c 
b/src/identity/gnunet-service-identity.c
index b509e7e9a..42ad94df1 100644
--- a/src/identity/gnunet-service-identity.c
+++ b/src/identity/gnunet-service-identity.c
@@ -57,7 +57,7 @@ struct Ego
   /**
    * Private key of the ego.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
 
   /**
    * String identifier for the ego.
@@ -190,7 +190,6 @@ shutdown_task (void *cls)
   while (NULL != (e = ego_head))
   {
     GNUNET_CONTAINER_DLL_remove (ego_head, ego_tail, e);
-    GNUNET_free (e->pk);
     GNUNET_free (e->identifier);
     GNUNET_free (e);
   }
@@ -247,7 +246,7 @@ create_update_message (struct Ego *ego)
   env = GNUNET_MQ_msg_extra (um, name_len, 
GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
   um->name_len = htons (name_len);
   um->end_of_list = htons (GNUNET_NO);
-  um->private_key = *ego->pk;
+  um->private_key = ego->pk;
   GNUNET_memcpy (&um[1], ego->identifier, name_len);
   return env;
 }
@@ -273,7 +272,7 @@ create_set_default_message (struct Ego *ego, const char 
*servicename)
                              GNUNET_MESSAGE_TYPE_IDENTITY_SET_DEFAULT);
   sdm->name_len = htons (name_len);
   sdm->reserved = htons (0);
-  sdm->private_key = *ego->pk;
+  sdm->private_key = ego->pk;
   GNUNET_memcpy (&sdm[1], servicename, name_len);
   return env;
 }
@@ -584,7 +583,8 @@ handle_set_default_message (void *cls, const struct 
SetDefaultMessage *sdm)
               str);
   for (ego = ego_head; NULL != ego; ego = ego->next)
   {
-    if (0 == key_cmp (ego->pk, &sdm->private_key))
+    if (0 == key_cmp (&ego->pk,
+                      &sdm->private_key))
     {
       GNUNET_CONFIGURATION_set_value_string (subsystem_cfg,
                                              str,
@@ -627,7 +627,7 @@ notify_listeners (struct Ego *ego)
   um->header.size = htons (sizeof(struct UpdateMessage) + name_len);
   um->name_len = htons (name_len);
   um->end_of_list = htons (GNUNET_NO);
-  um->private_key = *ego->pk;
+  um->private_key = ego->pk;
   GNUNET_memcpy (&um[1], ego->identifier, name_len);
   GNUNET_notification_context_broadcast (nc, &um->header, GNUNET_NO);
   GNUNET_free (um);
@@ -704,8 +704,7 @@ handle_create_message (void *cls, const struct 
CreateRequestMessage *crm)
     }
   }
   ego = GNUNET_new (struct Ego);
-  ego->pk = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
-  *ego->pk = crm->private_key;
+  ego->pk = crm->private_key;
   ego->identifier = GNUNET_strdup (str);
   GNUNET_CONTAINER_DLL_insert (ego_head, ego_tail, ego);
   send_result_code (client, 0, NULL);
@@ -997,7 +996,6 @@ handle_delete_message (void *cls, const struct 
DeleteMessage *dm)
       GNUNET_free (ego->identifier);
       ego->identifier = NULL;
       notify_listeners (ego);
-      GNUNET_free (ego->pk);
       GNUNET_free (ego);
       GNUNET_free (name);
       send_result_code (client, 0, NULL);
@@ -1023,7 +1021,8 @@ handle_delete_message (void *cls, const struct 
DeleteMessage *dm)
  *  #GNUNET_SYSERR to abort iteration with error!
  */
 static int
-process_ego_file (void *cls, const char *filename)
+process_ego_file (void *cls,
+                  const char *filename)
 {
   struct Ego *ego;
   const char *fn;
@@ -1035,8 +1034,10 @@ process_ego_file (void *cls, const char *filename)
     return GNUNET_OK;
   }
   ego = GNUNET_new (struct Ego);
-  ego->pk = GNUNET_CRYPTO_ecdsa_key_create_from_file (filename);
-  if (NULL == ego->pk)
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecdsa_key_from_file (filename,
+                                         GNUNET_NO,
+                                         &ego->pk))
   {
     GNUNET_free (ego);
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
@@ -1044,7 +1045,9 @@ process_ego_file (void *cls, const char *filename)
                 filename);
     return GNUNET_OK;
   }
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Loaded ego `%s'\n", fn + 1);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Loaded ego `%s'\n",
+              fn + 1);
   ego->identifier = GNUNET_strdup (fn + 1);
   GNUNET_CONTAINER_DLL_insert (ego_head, ego_tail, ego);
   return GNUNET_OK;
@@ -1108,7 +1111,9 @@ run (void *cls,
                 _ ("Failed to create directory `%s' for storing egos\n"),
                 ego_directory);
   }
-  GNUNET_DISK_directory_scan (ego_directory, &process_ego_file, NULL);
+  GNUNET_DISK_directory_scan (ego_directory,
+                              &process_ego_file,
+                              NULL);
   GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
 }
 
diff --git a/src/identity/identity.h b/src/identity/identity.h
index b3c03d1ce..2303bf214 100644
--- a/src/identity/identity.h
+++ b/src/identity/identity.h
@@ -247,7 +247,7 @@ struct GNUNET_IDENTITY_Ego
   /**
    * Private key associated with this ego.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
 
   /**
    * Current name associated with this ego.
diff --git a/src/identity/identity_api.c b/src/identity/identity_api.c
index 29d9b9011..9176acc27 100644
--- a/src/identity/identity_api.c
+++ b/src/identity/identity_api.c
@@ -74,7 +74,7 @@ struct GNUNET_IDENTITY_Operation
   /**
    * Private key to return to @e create_cont, or NULL.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
 
   /**
    * Continuation to invoke with the result of the transmission for
@@ -156,14 +156,18 @@ const struct GNUNET_IDENTITY_Ego *
 GNUNET_IDENTITY_ego_get_anonymous ()
 {
   static struct GNUNET_IDENTITY_Ego anon;
+  static int setup;
   struct GNUNET_CRYPTO_EcdsaPublicKey pub;
 
-  if (NULL != anon.pk)
+  if (setup)
     return &anon;
-  anon.pk = (struct GNUNET_CRYPTO_EcdsaPrivateKey *)
-            GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
-  GNUNET_CRYPTO_ecdsa_key_get_public (anon.pk, &pub);
-  GNUNET_CRYPTO_hash (&pub, sizeof(pub), &anon.id);
+  anon.pk = *GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
+  GNUNET_CRYPTO_ecdsa_key_get_public (&anon.pk,
+                                      &pub);
+  GNUNET_CRYPTO_hash (&pub,
+                      sizeof(pub),
+                      &anon.id);
+  setup = 1;
   return &anon;
 }
 
@@ -193,7 +197,6 @@ free_ego (void *cls, const struct GNUNET_HashCode *key, 
void *value)
 
   if (NULL != h->cb)
     h->cb (h->cb_cls, ego, &ego->ctx, NULL);
-  GNUNET_free (ego->pk);
   GNUNET_free (ego->name);
   GNUNET_assert (GNUNET_YES ==
                  GNUNET_CONTAINER_multihashmap_remove (h->egos, key, value));
@@ -230,7 +233,6 @@ reschedule_connect (struct GNUNET_IDENTITY_Handle *h)
       op->create_cont (op->cls,
                        NULL,
                        "Failed to communicate with the identity service");
-    GNUNET_free_non_null (op->pk);
     GNUNET_free (op);
   }
   GNUNET_CONTAINER_multihashmap_iterate (h->egos, &free_ego, h);
@@ -304,8 +306,7 @@ handle_identity_result_code (void *cls, const struct 
ResultCodeMessage *rcm)
   else if (NULL != op->cb)
     op->cb (op->cls, NULL, NULL, NULL);
   else if (NULL != op->create_cont)
-    op->create_cont (op->cls, (NULL == str) ? op->pk : NULL, str);
-  GNUNET_free_non_null (op->pk);
+    op->create_cont (op->cls, (NULL == str) ? &op->pk : NULL, str);
   GNUNET_free (op);
 }
 
@@ -371,8 +372,7 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
       return;
     }
     ego = GNUNET_new (struct GNUNET_IDENTITY_Ego);
-    ego->pk = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
-    *ego->pk = um->private_key;
+    ego->pk = um->private_key;
     ego->name = GNUNET_strdup (str);
     ego->id = id;
     GNUNET_assert (GNUNET_YES ==
@@ -401,7 +401,6 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
   /* complete deletion */
   if (NULL == str)
   {
-    GNUNET_free (ego->pk);
     GNUNET_free (ego->name);
     GNUNET_free (ego);
   }
@@ -554,7 +553,7 @@ GNUNET_IDENTITY_connect (const struct 
GNUNET_CONFIGURATION_Handle *cfg,
 const struct GNUNET_CRYPTO_EcdsaPrivateKey *
 GNUNET_IDENTITY_ego_get_private_key (const struct GNUNET_IDENTITY_Ego *ego)
 {
-  return ego->pk;
+  return &ego->pk;
 }
 
 
@@ -568,7 +567,8 @@ void
 GNUNET_IDENTITY_ego_get_public_key (const struct GNUNET_IDENTITY_Ego *ego,
                                     struct GNUNET_CRYPTO_EcdsaPublicKey *pk)
 {
-  GNUNET_CRYPTO_ecdsa_key_get_public (ego->pk, pk);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&ego->pk,
+                                      pk);
 }
 
 
@@ -657,7 +657,7 @@ GNUNET_IDENTITY_set (struct GNUNET_IDENTITY_Handle *h,
     GNUNET_MQ_msg_extra (sdm, slen, GNUNET_MESSAGE_TYPE_IDENTITY_SET_DEFAULT);
   sdm->name_len = htons (slen);
   sdm->reserved = htons (0);
-  sdm->private_key = *ego->pk;
+  sdm->private_key = ego->pk;
   GNUNET_memcpy (&sdm[1], service_name, slen);
   GNUNET_MQ_send (h->mq, env);
   return op;
@@ -682,7 +682,6 @@ GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
   struct GNUNET_IDENTITY_Operation *op;
   struct GNUNET_MQ_Envelope *env;
   struct CreateRequestMessage *crm;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk;
   size_t slen;
 
   if (NULL == h->mq)
@@ -701,9 +700,8 @@ GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
   env = GNUNET_MQ_msg_extra (crm, slen, GNUNET_MESSAGE_TYPE_IDENTITY_CREATE);
   crm->name_len = htons (slen);
   crm->reserved = htons (0);
-  pk = GNUNET_CRYPTO_ecdsa_key_create ();
-  crm->private_key = *pk;
-  op->pk = pk;
+  GNUNET_CRYPTO_ecdsa_key_create (&crm->private_key);
+  op->pk = crm->private_key;
   GNUNET_memcpy (&crm[1], name, slen);
   GNUNET_MQ_send (h->mq, env);
   return op;
@@ -820,11 +818,9 @@ GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation 
*op)
   op->cont = NULL;
   op->cb = NULL;
   op->create_cont = NULL;
-  if (NULL != op->pk)
-  {
-    GNUNET_free (op->pk);
-    op->pk = NULL;
-  }
+  memset (&op->pk,
+          0,
+          sizeof (op->pk));
 }
 
 
@@ -854,7 +850,9 @@ GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle 
*h)
   {
     GNUNET_break (NULL == op->cont);
     GNUNET_CONTAINER_DLL_remove (h->op_head, h->op_tail, op);
-    GNUNET_free_non_null (op->pk);
+    memset (&op->pk,
+            0,
+            sizeof (op->pk));
     GNUNET_free (op);
   }
   if (NULL != h->mq)
diff --git a/src/identity/identity_api_lookup.c 
b/src/identity/identity_api_lookup.c
index 108fc7fcf..6c61d3977 100644
--- a/src/identity/identity_api_lookup.c
+++ b/src/identity/identity_api_lookup.c
@@ -134,7 +134,7 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
   GNUNET_break (GNUNET_YES != ntohs (um->end_of_list));
   GNUNET_CRYPTO_ecdsa_key_get_public (&um->private_key, &pub);
   GNUNET_CRYPTO_hash (&pub, sizeof(pub), &id);
-  ego.pk = (struct GNUNET_CRYPTO_EcdsaPrivateKey *) &um->private_key;
+  ego.pk = um->private_key;
   ego.name = (char *) str;
   ego.id = id;
   el->cb (el->cb_cls, &ego);
diff --git a/src/include/gnunet_crypto_lib.h b/src/include/gnunet_crypto_lib.h
index ba992ed56..a5a50e749 100644
--- a/src/include/gnunet_crypto_lib.h
+++ b/src/include/gnunet_crypto_lib.h
@@ -1210,40 +1210,44 @@ GNUNET_CRYPTO_eddsa_public_key_from_string (
 
 /**
  * @ingroup crypto
- * Create a new private key by reading it from a file.  If the
- * files does not exist, create a new key and write it to the
- * file.  Caller must free return value.  Note that this function
- * can not guarantee that another process might not be trying
- * the same operation on the same file at the same time.
- * If the contents of the file
- * are invalid the old file is deleted and a fresh key is
- * created.
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
  *
  * @param filename name of file to use to store the key
- * @return new private key, NULL on error (for example,
- *   permission denied); free using #GNUNET_free
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
+ *         we found an existing file, #GNUNET_SYSERR on failure
  */
-struct GNUNET_CRYPTO_EcdsaPrivateKey *
-GNUNET_CRYPTO_ecdsa_key_create_from_file (const char *filename);
+int
+GNUNET_CRYPTO_ecdsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey);
 
 
 /**
  * @ingroup crypto
- * Create a new private key by reading it from a file.  If the
- * files does not exist, create a new key and write it to the
- * file.  Caller must free return value.  Note that this function
- * can not guarantee that another process might not be trying
- * the same operation on the same file at the same time.
- * If the contents of the file
- * are invalid the old file is deleted and a fresh key is
- * created.
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
  *
  * @param filename name of file to use to store the key
- * @return new private key, NULL on error (for example,
- *   permission denied); free using #GNUNET_free
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
+ *         we found an existing file, #GNUNET_SYSERR on failure
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *
-GNUNET_CRYPTO_eddsa_key_create_from_file (const char *filename);
+int
+GNUNET_CRYPTO_eddsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EddsaPrivateKey *pkey);
 
 
 /**
@@ -1268,22 +1272,22 @@ GNUNET_CRYPTO_eddsa_key_create_from_configuration (
 
 /**
  * @ingroup crypto
- * Create a new private key. Caller must free return value.
+ * Create a new private key.
  *
- * @return fresh private key; free using #GNUNET_free
+ * @param[out] pk private key to initialize
  */
-struct GNUNET_CRYPTO_EcdsaPrivateKey *
-GNUNET_CRYPTO_ecdsa_key_create (void);
+void
+GNUNET_CRYPTO_ecdsa_key_create (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk);
 
 
 /**
  * @ingroup crypto
- * Create a new private key. Caller must free return value.
+ * Create a new private key.
  *
- * @return fresh private key; free using #GNUNET_free
+ * @param[out] pk private key to initialize
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *
-GNUNET_CRYPTO_eddsa_key_create (void);
+void
+GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk);
 
 
 /**
@@ -1291,20 +1295,9 @@ GNUNET_CRYPTO_eddsa_key_create (void);
  * Create a new private key.  Clear with #GNUNET_CRYPTO_ecdhe_key_clear().
  *
  * @param[out] pk set to fresh private key;
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
  */
-int
-GNUNET_CRYPTO_ecdhe_key_create2 (struct GNUNET_CRYPTO_EcdhePrivateKey *pk);
-
-
-/**
- * @ingroup crypto
- * Create a new private key. Caller must free return value.
- *
- * @return fresh private key; free using #GNUNET_free
- */
-struct GNUNET_CRYPTO_EcdhePrivateKey *
-GNUNET_CRYPTO_ecdhe_key_create (void);
+void
+GNUNET_CRYPTO_ecdhe_key_create (struct GNUNET_CRYPTO_EcdhePrivateKey *pk);
 
 
 /**
diff --git a/src/include/gnunet_disk_lib.h b/src/include/gnunet_disk_lib.h
index b79be5f70..f43cf8943 100644
--- a/src/include/gnunet_disk_lib.h
+++ b/src/include/gnunet_disk_lib.h
@@ -690,35 +690,6 @@ int
 GNUNET_DISK_directory_create (const char *dir);
 
 
-/**
- * Lock a part of a file.
- *
- * @param fh file handle
- * @param lock_start absolute position from where to lock
- * @param lock_end absolute position until where to lock
- * @param excl #GNUNET_YES for an exclusive lock
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_DISK_file_lock (struct GNUNET_DISK_FileHandle *fh,
-                       off_t lock_start,
-                       off_t lock_end, int excl);
-
-
-/**
- * Unlock a part of a file.
- *
- * @param fh file handle
- * @param unlock_start absolute position from where to unlock
- * @param unlock_end absolute position until where to unlock
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_DISK_file_unlock (struct GNUNET_DISK_FileHandle *fh,
-                         off_t unlock_start,
-                         off_t unlock_end);
-
-
 /**
  * @brief Removes special characters as ':' from a filename.
  * @param fn the filename to canonicalize
diff --git a/src/include/gnunet_identity_service.h 
b/src/include/gnunet_identity_service.h
index 674176e0e..e09e2f196 100644
--- a/src/include/gnunet_identity_service.h
+++ b/src/include/gnunet_identity_service.h
@@ -137,10 +137,11 @@ GNUNET_IDENTITY_ego_get_public_key (const struct 
GNUNET_IDENTITY_Ego *ego,
  *                   NULL if the user just deleted the ego and it
  *                   must thus no longer be used
  */
-typedef void (*GNUNET_IDENTITY_Callback) (void *cls,
-                                          struct GNUNET_IDENTITY_Ego *ego,
-                                          void **ctx,
-                                          const char *name);
+typedef void
+(*GNUNET_IDENTITY_Callback) (void *cls,
+                             struct GNUNET_IDENTITY_Ego *ego,
+                             void **ctx,
+                             const char *name);
 
 
 /**
@@ -180,7 +181,9 @@ GNUNET_IDENTITY_get (struct GNUNET_IDENTITY_Handle *id,
  * @param cls closure
  * @param emsg NULL on success, otherwise an error message
  */
-typedef void (*GNUNET_IDENTITY_Continuation) (void *cls, const char *emsg);
+typedef void
+(*GNUNET_IDENTITY_Continuation) (void *cls,
+                                 const char *emsg);
 
 
 /**
@@ -218,7 +221,8 @@ GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle 
*h);
  * @param pk private key, NULL on error
  * @param emsg error message, NULL on success
  */
-typedef void (*GNUNET_IDENTITY_CreateContinuation) (
+typedef void
+(*GNUNET_IDENTITY_CreateContinuation) (
   void *cls,
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
   const char *emsg);
@@ -294,9 +298,9 @@ GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation 
*op);
  * @param cls closure
  * @param ego NULL on error / ego not found
  */
-typedef void (*GNUNET_IDENTITY_EgoCallback) (
-  void *cls,
-  const struct GNUNET_IDENTITY_Ego *ego);
+typedef void
+(*GNUNET_IDENTITY_EgoCallback) (void *cls,
+                                const struct GNUNET_IDENTITY_Ego *ego);
 
 /**
  * Handle for ego lookup.
@@ -335,7 +339,8 @@ GNUNET_IDENTITY_ego_lookup_cancel (struct 
GNUNET_IDENTITY_EgoLookup *el);
  * @param ego NULL on error / ego not found
  * @param ego_name NULL on error, name of the ego otherwise
  */
-typedef void (*GNUNET_IDENTITY_EgoSuffixCallback) (
+typedef void
+(*GNUNET_IDENTITY_EgoSuffixCallback) (
   void *cls,
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
   const char *ego_name);
@@ -373,8 +378,9 @@ GNUNET_IDENTITY_ego_lookup_by_suffix (const struct
  * @param el handle for lookup to abort
  */
 void
-GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (struct
-                                             GNUNET_IDENTITY_EgoSuffixLookup 
*el);
+GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (
+  struct GNUNET_IDENTITY_EgoSuffixLookup *el);
+
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/namestore/perf_namestore_api_zone_iteration.c 
b/src/namestore/perf_namestore_api_zone_iteration.c
index e8277ae65..c1012de62 100644
--- a/src/namestore/perf_namestore_api_zone_iteration.c
+++ b/src/namestore/perf_namestore_api_zone_iteration.c
@@ -64,7 +64,7 @@ static struct GNUNET_SCHEDULER_Task *timeout_task;
 
 static struct GNUNET_SCHEDULER_Task *t;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -115,11 +115,6 @@ end (void *cls)
     GNUNET_SCHEDULER_cancel (timeout_task);
     timeout_task = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
 }
 
 
@@ -243,7 +238,7 @@ zone_proc (void *cls,
   }
   GNUNET_free (wrd);
   if (0 != GNUNET_memcmp (zone,
-                          privkey))
+                          &privkey))
   {
     res = 5;
     GNUNET_break (0);
@@ -324,7 +319,7 @@ publish_record (void *cls)
                    "l%u",
                    off);
   qe = GNUNET_NAMESTORE_records_store (nsh,
-                                       privkey,
+                                       &privkey,
                                        label,
                                        1, rd,
                                        &put_cont,
@@ -346,8 +341,7 @@ run (void *cls,
                                                NULL);
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_assert (NULL != nsh);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
   start = GNUNET_TIME_absolute_get ();
   t = GNUNET_SCHEDULER_add_now (&publish_record,
                                 NULL);
diff --git a/src/namestore/test_namestore_api_lookup_nick.c 
b/src/namestore/test_namestore_api_lookup_nick.c
index b3946de34..145a3e885 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -40,7 +40,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -63,11 +63,6 @@ cleanup ()
     GNUNET_NAMESTORE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -111,7 +106,7 @@ lookup_it (void *cls,
   int found_record = GNUNET_NO;
   int found_nick = GNUNET_NO;
 
-  if (0 != GNUNET_memcmp (privkey, zone))
+  if (0 != GNUNET_memcmp (&privkey, zone))
   {
     GNUNET_break (0);
     GNUNET_SCHEDULER_cancel (endbadly_task);
@@ -247,7 +242,7 @@ put_cont (void *cls, int32_t success, const char *emsg)
   }
   /* Lookup */
   nsqe = GNUNET_NAMESTORE_records_lookup (nsh,
-                                          privkey,
+                                          &privkey,
                                           name,
                                           &fail_cb,
                                           NULL,
@@ -272,8 +267,11 @@ nick_cont (void *cls, int32_t success, const char *emsg)
   rd_orig.flags = 0;
   memset ((char *) rd_orig.data, 'a', TEST_RECORD_DATALEN);
 
-  nsqe = GNUNET_NAMESTORE_records_store (nsh, privkey, name,
-                                         1, &rd_orig, &put_cont, (void *) 
name);
+  nsqe = GNUNET_NAMESTORE_records_store (nsh, &privkey,
+                                         name,
+                                         1,
+                                         &rd_orig,
+                                         &put_cont, (void *) name);
 }
 
 
@@ -285,16 +283,15 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
 
   nsqe = GNUNET_NAMESTORE_set_nick (nsh,
-                                    privkey,
+                                    &privkey,
                                     TEST_NICK,
                                     &nick_cont,
                                     (void *) name);
diff --git a/src/namestore/test_namestore_api_lookup_private.c 
b/src/namestore/test_namestore_api_lookup_private.c
index e2600855c..98fdb1b43 100644
--- a/src/namestore/test_namestore_api_lookup_private.c
+++ b/src/namestore/test_namestore_api_lookup_private.c
@@ -38,7 +38,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -58,11 +58,6 @@ cleanup ()
     GNUNET_NAMESTORE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -103,7 +98,7 @@ lookup_it (void *cls,
 {
   nsqe = NULL;
 
-  if (0 != GNUNET_memcmp (privkey,
+  if (0 != GNUNET_memcmp (&privkey,
                           zone))
   {
     GNUNET_break (0);
@@ -173,7 +168,7 @@ put_cont (void *cls,
   }
   /* Lookup */
   nsqe = GNUNET_NAMESTORE_records_lookup (nsh,
-                                          privkey,
+                                          &privkey,
                                           name,
                                           &fail_cb,
                                           NULL,
@@ -192,9 +187,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
   rd.record_type = TEST_RECORD_TYPE;
@@ -206,7 +200,7 @@ run (void *cls,
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          1,
                                          &rd,
diff --git a/src/namestore/test_namestore_api_lookup_public.c 
b/src/namestore/test_namestore_api_lookup_public.c
index 6640f47ed..83a5a78f6 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -42,7 +42,7 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -66,11 +66,6 @@ cleanup ()
     GNUNET_NAMECACHE_disconnect (nch);
     nch = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -178,7 +173,8 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
+                                      &pubkey);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey, name, &derived_hash);
 
   ncqe = GNUNET_NAMECACHE_lookup_block (nch, &derived_hash,
@@ -197,9 +193,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
@@ -213,8 +208,13 @@ run (void *cls,
   nch = GNUNET_NAMECACHE_connect (cfg);
   GNUNET_break (NULL != nsh);
   GNUNET_break (NULL != nch);
-  nsqe = GNUNET_NAMESTORE_records_store (nsh, privkey, name,
-                                         1, &rd, &put_cont, (void *) name);
+  nsqe = GNUNET_NAMESTORE_records_store (nsh,
+                                         &privkey,
+                                         name,
+                                         1,
+                                         &rd,
+                                         &put_cont,
+                                         (void *) name);
   if (NULL == nsqe)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c 
b/src/namestore/test_namestore_api_lookup_shadow.c
index 7daa6987c..08c428731 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -44,7 +44,7 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -68,11 +68,6 @@ cleanup ()
     GNUNET_NAMECACHE_disconnect (nch);
     nch = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -210,10 +205,14 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
-  GNUNET_GNSRECORD_query_from_public_key (&pubkey, name, &derived_hash);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
+                                      &pubkey);
+  GNUNET_GNSRECORD_query_from_public_key (&pubkey,
+                                          name,
+                                          &derived_hash);
 
-  ncqe = GNUNET_NAMECACHE_lookup_block (nch, &derived_hash,
+  ncqe = GNUNET_NAMECACHE_lookup_block (nch,
+                                        &derived_hash,
                                         &name_lookup_proc, (void *) name);
 }
 
@@ -229,9 +228,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
   rd.record_type = TEST_RECORD_TYPE;
@@ -245,7 +243,7 @@ run (void *cls,
   GNUNET_break (NULL != nsh);
   GNUNET_break (NULL != nch);
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          1,
                                          &rd,
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c 
b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index 694c189e1..634a6a3c4 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -48,7 +48,7 @@ static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
 static struct GNUNET_SCHEDULER_Task *delayed_lookup_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -82,11 +82,6 @@ cleanup ()
     GNUNET_NAMECACHE_disconnect (nch);
     nch = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -272,7 +267,8 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
+                                      &pubkey);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey, TEST_NAME, &derived_hash);
 
   if (0 == GNUNET_TIME_absolute_get_remaining (record_expiration).rel_value_us)
@@ -301,9 +297,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   record_expiration = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
@@ -328,8 +323,13 @@ run (void *cls,
   nch = GNUNET_NAMECACHE_connect (cfg);
   GNUNET_break (NULL != nsh);
   GNUNET_break (NULL != nch);
-  nsqe = GNUNET_NAMESTORE_records_store (nsh, privkey, TEST_NAME,
-                                         2, records, &put_cont, NULL);
+  nsqe = GNUNET_NAMESTORE_records_store (nsh,
+                                         &privkey,
+                                         TEST_NAME,
+                                         2,
+                                         records,
+                                         &put_cont,
+                                         NULL);
   if (NULL == nsqe)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/namestore/test_namestore_api_monitoring.c 
b/src/namestore/test_namestore_api_monitoring.c
index a23424d30..d26492517 100644
--- a/src/namestore/test_namestore_api_monitoring.c
+++ b/src/namestore/test_namestore_api_monitoring.c
@@ -37,9 +37,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneMonitor *zm;
 
@@ -107,17 +107,6 @@ do_shutdown ()
     GNUNET_free ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
-
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (NULL != privkey2)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
 }
 
 
@@ -156,7 +145,7 @@ zone_proc (void *cls,
               "Comparing results name %s\n",
               name);
   if (0 != GNUNET_memcmp (zone_key,
-                          privkey))
+                          &privkey))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Monitoring returned wrong zone key\n");
@@ -284,12 +273,10 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   res = 1;
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
   /* Start monitoring */
   zm = GNUNET_NAMESTORE_zone_monitor_start (cfg,
-                                            privkey,
+                                            &privkey,
                                             GNUNET_YES,
                                             &fail_cb,
                                             NULL,
@@ -317,9 +304,7 @@ run (void *cls,
     return;
   }
 
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey2 != NULL);
-
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 3\n");
@@ -328,7 +313,7 @@ run (void *cls,
   s_rd_3 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[2] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey2,
+                                                            &privkey2,
                                                             s_name_3,
                                                             1,
                                                             s_rd_3,
@@ -340,7 +325,7 @@ run (void *cls,
   s_rd_1 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[0] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey,
+                                                            &privkey,
                                                             s_name_1,
                                                             1,
                                                             s_rd_1,
@@ -353,7 +338,7 @@ run (void *cls,
   s_rd_2 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[1] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey,
+                                                            &privkey,
                                                             s_name_2,
                                                             1,
                                                             s_rd_2,
diff --git a/src/namestore/test_namestore_api_monitoring_existing.c 
b/src/namestore/test_namestore_api_monitoring_existing.c
index a0951b943..040a63f91 100644
--- a/src/namestore/test_namestore_api_monitoring_existing.c
+++ b/src/namestore/test_namestore_api_monitoring_existing.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneMonitor *zm;
 
@@ -124,16 +124,6 @@ end (void *cls)
     GNUNET_free ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (NULL != privkey2)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
 }
 
 
@@ -151,7 +141,7 @@ zone_proc (void *cls,
               "Comparing results name %s\n",
               name);
   if (0 != GNUNET_memcmp (zone_key,
-                          privkey))
+                          &privkey))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Monitoring returned wrong zone key\n");
@@ -262,7 +252,7 @@ put_cont (void *cls,
   {
     /* Start monitoring */
     zm = GNUNET_NAMESTORE_zone_monitor_start (cfg,
-                                              privkey,
+                                              &privkey,
                                               GNUNET_YES,
                                               &fail_cb,
                                               NULL,
@@ -312,10 +302,8 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   res = 1;
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey);
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey2);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
 
   cfg = mycfg;
   GNUNET_SCHEDULER_add_shutdown (&end,
@@ -342,7 +330,7 @@ run (void *cls,
   s_rd_3 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[2] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey2,
+                                                            &privkey2,
                                                             s_name_3,
                                                             1,
                                                             s_rd_3,
@@ -355,7 +343,7 @@ run (void *cls,
   s_rd_1 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[0] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey,
+                                                            &privkey,
                                                             s_name_1,
                                                             1,
                                                             s_rd_1,
@@ -367,7 +355,7 @@ run (void *cls,
   s_rd_2 = create_record (1);
   GNUNET_assert (NULL != (ns_ops[1] =
                             GNUNET_NAMESTORE_records_store (nsh,
-                                                            privkey,
+                                                            &privkey,
                                                             s_name_2,
                                                             1,
                                                             s_rd_2,
diff --git a/src/namestore/test_namestore_api_remove.c 
b/src/namestore/test_namestore_api_remove.c
index ff826804e..3f0c4c123 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -39,7 +39,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -58,11 +58,6 @@ cleanup ()
     GNUNET_NAMESTORE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -145,7 +140,7 @@ put_cont (void *cls,
               name,
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          0, NULL,
                                          &remove_cont, (void *) name);
@@ -163,9 +158,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   removed = GNUNET_NO;
@@ -182,7 +176,7 @@ run (void *cls,
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          1,
                                          &rd,
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c 
b/src/namestore/test_namestore_api_remove_not_existing_record.c
index 217f8a51a..75e1cc3ed 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -38,7 +38,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -48,18 +48,13 @@ static struct GNUNET_NAMESTORE_QueueEntry *nsqe;
 
 
 static void
-cleanup ()
+cleanup (void)
 {
   if (NULL != nsh)
   {
     GNUNET_NAMESTORE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -137,13 +132,14 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
 
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
-  nsqe = GNUNET_NAMESTORE_records_store (nsh, privkey, name,
+  nsqe = GNUNET_NAMESTORE_records_store (nsh,
+                                         &privkey,
+                                         name,
                                          0, NULL,
                                          &put_cont, (void *) name);
   if (NULL == nsqe)
diff --git a/src/namestore/test_namestore_api_store.c 
b/src/namestore/test_namestore_api_store.c
index 5bd0c3472..ab211aeae 100644
--- a/src/namestore/test_namestore_api_store.c
+++ b/src/namestore/test_namestore_api_store.c
@@ -39,7 +39,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -56,11 +56,6 @@ cleanup ()
     GNUNET_NAMESTORE_disconnect (nsh);
     nsh = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   GNUNET_SCHEDULER_shutdown ();
 }
 
@@ -118,9 +113,8 @@ run (void *cls,
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly, NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey, &pubkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
 
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
@@ -133,7 +127,7 @@ run (void *cls,
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          1,
                                          &rd,
diff --git a/src/namestore/test_namestore_api_store_update.c 
b/src/namestore/test_namestore_api_store_update.c
index b0244453a..65dbdbd8c 100644
--- a/src/namestore/test_namestore_api_store_update.c
+++ b/src/namestore/test_namestore_api_store_update.c
@@ -48,7 +48,7 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -106,11 +106,6 @@ end (void *cls)
     GNUNET_NAMECACHE_disconnect (nch);
     nch = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
 }
 
 
@@ -157,7 +152,7 @@ rd_decrypt_cb (void *cls,
             TEST_RECORD_DATALEN2);
 
     nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                           privkey,
+                                           &privkey,
                                            name,
                                            1,
                                            &rd_new,
@@ -226,7 +221,7 @@ put_cont (void *cls,
               name,
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
   /* Create derived hash */
-  GNUNET_GNSRECORD_query_from_private_key (privkey,
+  GNUNET_GNSRECORD_query_from_private_key (&privkey,
                                            name,
                                            &derived_hash);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -251,9 +246,8 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
   rd.flags = GNUNET_GNSRECORD_RF_NONE;
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
@@ -269,7 +263,7 @@ run (void *cls,
   nch = GNUNET_NAMECACHE_connect (cfg);
   GNUNET_break (NULL != nch);
   nsqe = GNUNET_NAMESTORE_records_store (nsh,
-                                         privkey,
+                                         &privkey,
                                          name,
                                          1,
                                          &rd,
diff --git a/src/namestore/test_namestore_api_zone_iteration_nick.c 
b/src/namestore/test_namestore_api_zone_iteration_nick.c
index 35eab2735..f5ffe3899 100644
--- a/src/namestore/test_namestore_api_zone_iteration_nick.c
+++ b/src/namestore/test_namestore_api_zone_iteration_nick.c
@@ -37,9 +37,9 @@
 
 static struct GNUNET_NAMESTORE_Handle *nsh;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -100,17 +100,6 @@ end (void *cls)
     GNUNET_free ((void *) s_rd_3->data);
     GNUNET_free (s_rd_3);
   }
-
-  if (privkey != NULL)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (privkey2 != NULL)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
 }
 
 
@@ -171,13 +160,13 @@ zone_proc (void *cls,
   int failed = GNUNET_NO;
 
   GNUNET_assert (NULL != zone);
-  if (0 == GNUNET_memcmp (zone, privkey))
+  if (0 == GNUNET_memcmp (zone, &privkey))
   {
     failed = check_zone_1 (label, rd_count, rd);
     if (GNUNET_YES == failed)
       GNUNET_break (0);
   }
-  else if (0 == GNUNET_memcmp (zone, privkey2))
+  else if (0 == GNUNET_memcmp (zone, &privkey2))
   {
     failed = check_zone_2 (label, rd_count, rd);
     if (GNUNET_YES == failed)
@@ -295,7 +284,7 @@ nick_2_cont (void *cls,
 
   GNUNET_asprintf (&s_name_1, "dummy1");
   s_rd_1 = create_record (1);
-  GNUNET_NAMESTORE_records_store (nsh, privkey, s_name_1,
+  GNUNET_NAMESTORE_records_store (nsh, &privkey, s_name_1,
                                   1, s_rd_1,
                                   &put_cont, NULL);
 
@@ -303,7 +292,7 @@ nick_2_cont (void *cls,
               "Created record 2 \n");
   GNUNET_asprintf (&s_name_2, "dummy2");
   s_rd_2 = create_record (1);
-  GNUNET_NAMESTORE_records_store (nsh, privkey, s_name_2,
+  GNUNET_NAMESTORE_records_store (nsh, &privkey, s_name_2,
                                   1, s_rd_2, &put_cont, NULL);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -312,7 +301,7 @@ nick_2_cont (void *cls,
   /* name in different zone */
   GNUNET_asprintf (&s_name_3, "dummy3");
   s_rd_3 = create_record (1);
-  GNUNET_NAMESTORE_records_store (nsh, privkey2, s_name_3,
+  GNUNET_NAMESTORE_records_store (nsh, &privkey2, s_name_3,
                                   1, s_rd_3,
                                   &put_cont, NULL);
 }
@@ -325,7 +314,8 @@ nick_1_cont (void *cls, int32_t success, const char *emsg)
               "Nick 1 added : %s\n",
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
-  nsqe = GNUNET_NAMESTORE_set_nick (nsh, privkey2, ZONE_NICK_2, &nick_2_cont,
+  nsqe = GNUNET_NAMESTORE_set_nick (nsh,
+                                    &privkey2, ZONE_NICK_2, &nick_2_cont,
                                     &privkey2);
   if (NULL == nsqe)
   {
@@ -374,16 +364,13 @@ empty_zone_end (void *cls)
 {
   GNUNET_assert (nsh == cls);
   zi = NULL;
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey2 != NULL);
-
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
   nsqe = GNUNET_NAMESTORE_set_nick (nsh,
-                                    privkey,
+                                    &privkey,
                                     ZONE_NICK_1,
                                     &nick_1_cont,
-                                    &privkey);
+                                    NULL);
   if (NULL == nsqe)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c 
b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
index d37fb8cd3..97093cb71 100644
--- a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
+++ b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey2;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -88,16 +88,6 @@ end (void *cls)
     GNUNET_SCHEDULER_cancel (endbadly_task);
     endbadly_task = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
-  if (NULL != privkey2)
-  {
-    GNUNET_free (privkey2);
-    privkey2 = NULL;
-  }
   GNUNET_free_non_null (s_name_1);
   GNUNET_free_non_null (s_name_2);
   GNUNET_free_non_null (s_name_3);
@@ -143,7 +133,7 @@ zone_proc (void *cls,
 
   GNUNET_assert (NULL != zone);
   if (0 == GNUNET_memcmp (zone,
-                          privkey))
+                          &privkey))
   {
     if (0 == strcmp (label, s_name_1))
     {
@@ -188,7 +178,7 @@ zone_proc (void *cls,
       GNUNET_break (0);
     }
   }
-  else if (0 == GNUNET_memcmp (zone, privkey2))
+  else if (0 == GNUNET_memcmp (zone, &privkey2))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Received data for not requested zone\n");
@@ -271,7 +261,7 @@ put_cont (void *cls,
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "All records created, starting iteration over all zones \n");
     zi = GNUNET_NAMESTORE_zone_iteration_start (nsh,
-                                                privkey,
+                                                &privkey,
                                                 &fail_cb,
                                                 NULL,
                                                 &zone_proc,
@@ -351,18 +341,15 @@ static void
 empty_zone_proc_end (void *cls)
 {
   zi = NULL;
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey != NULL);
-  privkey2 = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (privkey2 != NULL);
-
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 1\n");
   GNUNET_asprintf (&s_name_1,
                    "dummy1");
   s_rd_1 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey,
+                                  &privkey,
                                   s_name_1,
                                   1,
                                   s_rd_1,
@@ -375,7 +362,7 @@ empty_zone_proc_end (void *cls)
                    "dummy2");
   s_rd_2 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey,
+                                  &privkey,
                                   s_name_2,
                                   1,
                                   s_rd_2,
@@ -390,7 +377,7 @@ empty_zone_proc_end (void *cls)
                    "dummy3");
   s_rd_3 = create_record (1);
   GNUNET_NAMESTORE_records_store (nsh,
-                                  privkey2,
+                                  &privkey2,
                                   s_name_3,
                                   1, s_rd_3,
                                   &put_cont,
diff --git a/src/namestore/test_namestore_api_zone_to_name.c 
b/src/namestore/test_namestore_api_zone_to_name.c
index 65366e267..94cc5c285 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -42,7 +42,7 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
 
 static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
 
@@ -82,11 +82,6 @@ end (void *cls)
     GNUNET_SCHEDULER_cancel (endbadly_task);
     endbadly_task = NULL;
   }
-  if (NULL != privkey)
-  {
-    GNUNET_free (privkey);
-    privkey = NULL;
-  }
   if (NULL != nsh)
   {
     GNUNET_NAMESTORE_disconnect (nsh);
@@ -133,7 +128,7 @@ zone_to_name_proc (void *cls,
     }
     if ((NULL == zone_key) ||
         (0 != GNUNET_memcmp (zone_key,
-                             privkey)))
+                             &privkey)))
     {
       fail = GNUNET_YES;
       GNUNET_break (0);
@@ -176,7 +171,7 @@ put_cont (void *cls,
     res = 0;
 
     qe = GNUNET_NAMESTORE_zone_to_name (nsh,
-                                        privkey,
+                                        &privkey,
                                         &s_zone_value,
                                         &error_cb,
                                         NULL,
@@ -208,10 +203,9 @@ run (void *cls,
   GNUNET_SCHEDULER_add_shutdown (&end,
                                  NULL);
   GNUNET_asprintf (&s_name, "dummy");
-  privkey = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_assert (NULL != privkey);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
   /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public (privkey,
+  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
                                       &pubkey);
 
   GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
@@ -229,7 +223,7 @@ run (void *cls,
     nsh = GNUNET_NAMESTORE_connect (cfg);
     GNUNET_break (NULL != nsh);
     GNUNET_NAMESTORE_records_store (nsh,
-                                    privkey,
+                                    &privkey,
                                     s_name,
                                     1,
                                     &rd,
diff --git a/src/reclaim/oidc_helper.c b/src/reclaim/oidc_helper.c
index dded06389..29e8cb2ef 100644
--- a/src/reclaim/oidc_helper.c
+++ b/src/reclaim/oidc_helper.c
@@ -449,7 +449,7 @@ OIDC_build_authz_code (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *issuer,
   uint32_t nonce;
   uint32_t nonce_tmp;
   struct GNUNET_CRYPTO_EccSignaturePurpose *purpose;
-  struct GNUNET_CRYPTO_EcdhePrivateKey *ecdh_priv;
+  struct GNUNET_CRYPTO_EcdhePrivateKey ecdh_priv;
   struct GNUNET_CRYPTO_EcdhePublicKey ecdh_pub;
 
   /** PLAINTEXT **/
@@ -531,8 +531,8 @@ OIDC_build_authz_code (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *issuer,
               code_payload_len);
 
   // Generate ECDH key
-  ecdh_priv = GNUNET_CRYPTO_ecdhe_key_create ();
-  GNUNET_CRYPTO_ecdhe_key_get_public (ecdh_priv, &ecdh_pub);
+  GNUNET_CRYPTO_ecdhe_key_create (&ecdh_priv);
+  GNUNET_CRYPTO_ecdhe_key_get_public (&ecdh_priv, &ecdh_pub);
   // Initialize code payload
   code_payload = GNUNET_malloc (code_payload_len);
   GNUNET_assert (NULL != code_payload);
@@ -545,8 +545,11 @@ OIDC_build_authz_code (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *issuer,
   memcpy (buf_ptr, &ecdh_pub, sizeof(ecdh_pub));
   buf_ptr += sizeof(ecdh_pub);
   // Encrypt plaintext and store
-  encrypt_payload (&ticket->audience, ecdh_priv, payload, payload_len, 
buf_ptr);
-  GNUNET_free (ecdh_priv);
+  encrypt_payload (&ticket->audience,
+                   &ecdh_priv,
+                   payload,
+                   payload_len,
+                   buf_ptr);
   GNUNET_free (payload);
   buf_ptr += payload_len;
   // Sign and store signature
diff --git a/src/sq/sq_query_helper.c b/src/sq/sq_query_helper.c
index c9e4bf031..1f7662b95 100644
--- a/src/sq/sq_query_helper.c
+++ b/src/sq/sq_query_helper.c
@@ -151,7 +151,7 @@ bind_rsa_pub (void *cls,
               unsigned int off)
 {
   const struct GNUNET_CRYPTO_RsaPublicKey *rsa = data;
-  char *buf;
+  void *buf;
   size_t buf_size;
 
   GNUNET_break (NULL == cls);
@@ -211,7 +211,7 @@ bind_rsa_sig (void *cls,
               unsigned int off)
 {
   const struct GNUNET_CRYPTO_RsaSignature *sig = data;
-  char *buf;
+  void *buf;
   size_t buf_size;
 
   GNUNET_break (NULL == cls);
diff --git a/src/transport/gnunet-communicator-tcp.c 
b/src/transport/gnunet-communicator-tcp.c
index 2786ba184..82ee309a5 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -1270,8 +1270,7 @@ inject_rekey (struct Queue *queue)
 
   GNUNET_assert (0 == queue->pwrite_off);
   memset (&rekey, 0, sizeof(rekey));
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdhe_key_create2 (&queue->ephemeral));
+  GNUNET_CRYPTO_ecdhe_key_create (&queue->ephemeral);
   rekey.header.type = ntohs (GNUNET_MESSAGE_TYPE_COMMUNICATOR_TCP_REKEY);
   rekey.header.size = ntohs (sizeof(rekey));
   GNUNET_CRYPTO_ecdhe_key_get_public (&queue->ephemeral, &rekey.ephemeral);
@@ -1610,8 +1609,7 @@ start_initial_kx_out (struct Queue *queue)
 {
   struct GNUNET_CRYPTO_EcdhePublicKey epub;
 
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdhe_key_create2 (&queue->ephemeral));
+  GNUNET_CRYPTO_ecdhe_key_create (&queue->ephemeral);
   GNUNET_CRYPTO_ecdhe_key_get_public (&queue->ephemeral, &epub);
   setup_out_cipher (queue);
   transmit_kx (queue, &epub);
diff --git a/src/transport/gnunet-communicator-udp.c 
b/src/transport/gnunet-communicator-udp.c
index 1542a7702..e0b14f669 100644
--- a/src/transport/gnunet-communicator-udp.c
+++ b/src/transport/gnunet-communicator-udp.c
@@ -1918,7 +1918,7 @@ mq_send (struct GNUNET_MQ_Handle *mq,
     struct SharedSecret *ss;
 
     /* setup key material */
-    GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecdhe_key_create2 (&epriv));
+    GNUNET_CRYPTO_ecdhe_key_create (&epriv);
 
     ss = setup_shared_secret_enc (&epriv, receiver);
     setup_cipher (&ss->master, 0, &out_cipher);
diff --git a/src/transport/gnunet-service-tng.c 
b/src/transport/gnunet-service-tng.c
index 75763fd9d..5f3178939 100644
--- a/src/transport/gnunet-service-tng.c
+++ b/src/transport/gnunet-service-tng.c
@@ -4130,8 +4130,7 @@ update_ephemeral (struct DistanceVector *dv)
   dv->monotime = GNUNET_TIME_absolute_get_monotonic (GST_cfg);
   dv->ephemeral_validity =
     GNUNET_TIME_absolute_add (dv->monotime, EPHEMERAL_VALIDITY);
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdhe_key_create2 (&dv->private_key));
+  GNUNET_CRYPTO_ecdhe_key_create (&dv->private_key);
   GNUNET_CRYPTO_ecdhe_key_get_public (&dv->private_key, &dv->ephemeral_key);
   ec.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL);
   ec.purpose.size = htonl (sizeof(ec));
diff --git a/src/transport/gnunet-service-transport.c 
b/src/transport/gnunet-service-transport.c
index 927a8753c..93fa031f4 100644
--- a/src/transport/gnunet-service-transport.c
+++ b/src/transport/gnunet-service-transport.c
@@ -384,7 +384,7 @@ struct GNUNET_PEERINFO_Handle *GST_peerinfo;
 /**
  * Our private key.
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *GST_my_private_key;
+struct GNUNET_CRYPTO_EddsaPrivateKey GST_my_private_key;
 
 /**
  * ATS scheduling handle.
@@ -2183,11 +2183,6 @@ shutdown_task (void *cls)
     GNUNET_STATISTICS_destroy (GST_stats, GNUNET_NO);
     GST_stats = NULL;
   }
-  if (NULL != GST_my_private_key)
-  {
-    GNUNET_free (GST_my_private_key);
-    GST_my_private_key = NULL;
-  }
 }
 
 
@@ -2611,7 +2606,6 @@ run (void *cls,
      struct GNUNET_SERVICE_Handle *service)
 {
   char *keyfile;
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
   long long unsigned int max_fd_cfg;
   int max_fd_rlimit;
   int max_fd;
@@ -2638,17 +2632,22 @@ run (void *cls,
   {
     hello_expiration = GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION;
   }
-  pk = GNUNET_CRYPTO_eddsa_key_create_from_file (keyfile);
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (keyfile,
+                                         GNUNET_YES,
+                                         &GST_my_private_key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to setup peer's private key\n");
+    GNUNET_SCHEDULER_shutdown ();
+    GNUNET_free (keyfile);
+    return;
+  }
   GNUNET_free (keyfile);
-  GNUNET_assert (NULL != pk);
-  GST_my_private_key = pk;
-
   GST_stats = GNUNET_STATISTICS_create ("transport", GST_cfg);
   GST_peerinfo = GNUNET_PEERINFO_connect (GST_cfg);
-  GNUNET_CRYPTO_eddsa_key_get_public (GST_my_private_key,
+  GNUNET_CRYPTO_eddsa_key_get_public (&GST_my_private_key,
                                       &GST_my_identity.public_key);
-  GNUNET_assert (NULL != GST_my_private_key);
-
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
               "My identity is `%s'\n",
               GNUNET_i2s_full (&GST_my_identity));
diff --git a/src/transport/gnunet-service-transport.h 
b/src/transport/gnunet-service-transport.h
index acb1de395..ea9e71e4b 100644
--- a/src/transport/gnunet-service-transport.h
+++ b/src/transport/gnunet-service-transport.h
@@ -56,7 +56,7 @@ extern struct GNUNET_PEERINFO_Handle *GST_peerinfo;
 /**
  * Our private key.
  */
-extern struct GNUNET_CRYPTO_EddsaPrivateKey *GST_my_private_key;
+extern struct GNUNET_CRYPTO_EddsaPrivateKey GST_my_private_key;
 
 /**
  * ATS handle.
diff --git a/src/transport/gnunet-service-transport_neighbours.c 
b/src/transport/gnunet-service-transport_neighbours.c
index ec64ca607..ca1b4d1da 100644
--- a/src/transport/gnunet-service-transport_neighbours.c
+++ b/src/transport/gnunet-service-transport_neighbours.c
@@ -1045,7 +1045,7 @@ send_disconnect (struct NeighbourMapEntry *n)
     GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get ());
   disconnect_msg.public_key = GST_my_identity.public_key;
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_eddsa_sign_ (GST_my_private_key,
+                 GNUNET_CRYPTO_eddsa_sign_ (&GST_my_private_key,
                                             &disconnect_msg.purpose,
                                             &disconnect_msg.signature));
 
diff --git a/src/transport/gnunet-service-transport_validation.c 
b/src/transport/gnunet-service-transport_validation.c
index 610c45a21..e5d670889 100644
--- a/src/transport/gnunet-service-transport_validation.c
+++ b/src/transport/gnunet-service-transport_validation.c
@@ -1271,7 +1271,7 @@ GST_validation_handle_ping (const struct 
GNUNET_PeerIdentity *sender,
     *sig_cache_exp = GNUNET_TIME_relative_to_absolute 
(PONG_SIGNATURE_LIFETIME);
     pong->expiration = GNUNET_TIME_absolute_hton (*sig_cache_exp);
     if (GNUNET_OK !=
-        GNUNET_CRYPTO_eddsa_sign_ (GST_my_private_key,
+        GNUNET_CRYPTO_eddsa_sign_ (&GST_my_private_key,
                                    &pong->purpose,
                                    sig_cache))
     {
diff --git a/src/util/crypto_ecc.c b/src/util/crypto_ecc.c
index 4c1169f43..851a45f93 100644
--- a/src/util/crypto_ecc.c
+++ b/src/util/crypto_ecc.c
@@ -491,118 +491,98 @@ GNUNET_CRYPTO_eddsa_key_clear (struct 
GNUNET_CRYPTO_EddsaPrivateKey *pk)
 
 
 /**
- * Create a new private key. Caller must free return value.
+ * Create a new private key.
  *
- * @return fresh private key
+ * @param[out] pk fresh private key
  */
-struct GNUNET_CRYPTO_EcdhePrivateKey *
-GNUNET_CRYPTO_ecdhe_key_create ()
-{
-  struct GNUNET_CRYPTO_EcdhePrivateKey *priv;
-
-  priv = GNUNET_new (struct GNUNET_CRYPTO_EcdhePrivateKey);
-  if (GNUNET_OK != GNUNET_CRYPTO_ecdhe_key_create2 (priv))
-  {
-    GNUNET_free (priv);
-    return NULL;
-  }
-  return priv;
-}
-
-
-/**
- * @ingroup crypto
- * Create a new private key.  Clear with #GNUNET_CRYPTO_ecdhe_key_clear().
- *
- * @param[out] pk set to fresh private key;
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
- */
-int
-GNUNET_CRYPTO_ecdhe_key_create2 (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
+void
+GNUNET_CRYPTO_ecdhe_key_create (struct GNUNET_CRYPTO_EcdhePrivateKey *pk)
 {
   BENCHMARK_START (ecdhe_key_create);
   GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                               pk,
                               sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
   BENCHMARK_END (ecdhe_key_create);
-  return GNUNET_OK;
 }
 
 
 /**
- * Create a new private key. Caller must free return value.
+ * Create a new private key.
  *
- * @return fresh private key
+ * @param[out] pk private key to initialize
  */
-struct GNUNET_CRYPTO_EcdsaPrivateKey *
-GNUNET_CRYPTO_ecdsa_key_create ()
+void
+GNUNET_CRYPTO_ecdsa_key_create (struct GNUNET_CRYPTO_EcdsaPrivateKey *pk)
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *priv;
   gcry_sexp_t priv_sexp;
   gcry_sexp_t s_keyparam;
   gcry_mpi_t d;
   int rc;
 
   BENCHMARK_START (ecdsa_key_create);
-
   if (0 != (rc = gcry_sexp_build (&s_keyparam,
                                   NULL,
                                   "(genkey(ecc(curve \"" CURVE "\")"
                                   "(flags)))")))
   {
-    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_sexp_build", rc);
-    return NULL;
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "gcry_sexp_build",
+              rc);
+    GNUNET_assert (0);
   }
-  if (0 != (rc = gcry_pk_genkey (&priv_sexp, s_keyparam)))
+  if (0 != (rc = gcry_pk_genkey (&priv_sexp,
+                                 s_keyparam)))
   {
-    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_pk_genkey", rc);
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "gcry_pk_genkey",
+              rc);
     gcry_sexp_release (s_keyparam);
-    return NULL;
+    GNUNET_assert (0);
   }
   gcry_sexp_release (s_keyparam);
 #if EXTRA_CHECKS
   if (0 != (rc = gcry_pk_testkey (priv_sexp)))
   {
-    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "gcry_pk_testkey", rc);
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "gcry_pk_testkey",
+              rc);
     gcry_sexp_release (priv_sexp);
-    return NULL;
+    GNUNET_assert (0);
   }
 #endif
-  if (0 != (rc = key_from_sexp (&d, priv_sexp, "private-key", "d")))
+  if (0 != (rc = key_from_sexp (&d, priv_sexp,
+                                "private-key",
+                                "d")))
   {
-    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR, "key_from_sexp", rc);
+    LOG_GCRY (GNUNET_ERROR_TYPE_ERROR,
+              "key_from_sexp",
+              rc);
     gcry_sexp_release (priv_sexp);
-    return NULL;
+    GNUNET_assert (0);
   }
   gcry_sexp_release (priv_sexp);
-  priv = GNUNET_new (struct GNUNET_CRYPTO_EcdsaPrivateKey);
-  GNUNET_CRYPTO_mpi_print_unsigned (priv->d, sizeof(priv->d), d);
+  GNUNET_CRYPTO_mpi_print_unsigned (pk->d,
+                                    sizeof(pk->d),
+                                    d);
   gcry_mpi_release (d);
-
   BENCHMARK_END (ecdsa_key_create);
-
-  return priv;
 }
 
 
 /**
- * Create a new private key. Caller must free return value.
+ * Create a new private key.
  *
- * @return fresh private key
+ * @param[out] pk set to fresh private key
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *
-GNUNET_CRYPTO_eddsa_key_create ()
+void
+GNUNET_CRYPTO_eddsa_key_create (struct GNUNET_CRYPTO_EddsaPrivateKey *pk)
 {
-  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
-
   BENCHMARK_START (eddsa_key_create);
-  priv = GNUNET_new (struct GNUNET_CRYPTO_EddsaPrivateKey);
   GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
-                              priv,
+                              pk,
                               sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+  // FIXME: should we not do the clamping here? Or is this done elsewhere?
   BENCHMARK_END (eddsa_key_create);
-
-  return priv;
 }
 
 
diff --git a/src/util/crypto_ecc_setup.c b/src/util/crypto_ecc_setup.c
index b3d410b7a..5167a33fb 100644
--- a/src/util/crypto_ecc_setup.c
+++ b/src/util/crypto_ecc_setup.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2012, 2013, 2015 GNUnet e.V.
+     Copyright (C) 2012, 2013, 2015, 2020 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -53,375 +53,261 @@
 
 
 /**
- * Wait for a short time (we're trying to lock a file or want
- * to give another process a shot at finishing a disk write, etc.).
- * Sleeps for 100ms (as that should be long enough for virtually all
- * modern systems to context switch and allow another process to do
- * some 'real' work).
+ * Read file to @a buf. Fails if the file does not exist or
+ * does not have precisely @a buf_size bytes.
+ *
+ * @param filename file to read
+ * @param[out] buf where to write the file contents
+ * @param buf_size number of bytes in @a buf
+ * @return #GNUNET_OK on success
  */
-static void
-short_wait ()
+static int
+read_from_file (const char *filename,
+                void *buf,
+                size_t buf_size)
 {
-  struct GNUNET_TIME_Relative timeout;
+  int fd;
+  struct stat sb;
 
-  timeout = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MILLISECONDS, 100);
-  (void) GNUNET_NETWORK_socket_select (NULL, NULL, NULL, timeout);
+  fd = open (filename,
+             O_RDONLY);
+  if (-1 == fd)
+  {
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (0 != fstat (fd,
+                  &sb))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "stat",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (sb.st_size != buf_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "File `%s' has wrong size (%llu), expected %llu bytes\n",
+                filename,
+                (unsigned long long) sb.st_size,
+                (unsigned long long) buf_size);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (buf_size !=
+      read (fd,
+            buf,
+            buf_size))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "read",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 == close (fd));
+  return GNUNET_OK;
 }
 
 
 /**
- * Create a new private key by reading it from a file.  If the
- * files does not exist, create a new key and write it to the
- * file.  Caller must free return value.  Note that this function
- * can not guarantee that another process might not be trying
- * the same operation on the same file at the same time.
- * If the contents of the file
- * are invalid the old file is deleted and a fresh key is
- * created.
+ * Write contents of @a buf atomically to @a filename.
+ * Fail if @a filename already exists or if not exactly
+ * @a buf with @a buf_size bytes could be written to
+ * @a filename.
  *
- * @param filename name of file to use to store the key
- * @return new private key, NULL on error (for example,
- *   permission denied)
+ * @param filename where to write
+ * @param buf buffer to write
+ * @param buf_size number of bytes in @a buf to write
+ * @return #GNUNET_OK on success,
+ *         #GNUNET_NO if a file existed under @a filename
+ *         #GNUNET_SYSERR on failure
  */
-struct GNUNET_CRYPTO_EddsaPrivateKey *
-GNUNET_CRYPTO_eddsa_key_create_from_file (const char *filename)
+static int
+atomic_write_to_file (const char *filename,
+                      const void *buf,
+                      size_t buf_size)
 {
-  struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
-  struct GNUNET_DISK_FileHandle *fd;
-  unsigned int cnt;
-  int ec;
-  uint64_t fs;
-  ssize_t sret;
+  char *tmpl;
+  int fd;
 
-  if (GNUNET_SYSERR == GNUNET_DISK_directory_create_for_file (filename))
-    return NULL;
-  while (GNUNET_YES != GNUNET_DISK_file_test (filename))
   {
-    fd =
-      GNUNET_DISK_file_open (filename,
-                             GNUNET_DISK_OPEN_WRITE | GNUNET_DISK_OPEN_CREATE
-                             | GNUNET_DISK_OPEN_FAILIFEXISTS,
-                             GNUNET_DISK_PERM_USER_READ
-                             | GNUNET_DISK_PERM_USER_WRITE);
-    if (NULL == fd)
-    {
-      if (EEXIST == errno)
-      {
-        if (GNUNET_YES != GNUNET_DISK_file_test (filename))
-        {
-          /* must exist but not be accessible, fail for good! */
-          if (0 != access (filename, R_OK))
-            LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "access", filename);
-          else
-            GNUNET_break (0);        /* what is going on!? */
-          return NULL;
-        }
-        continue;
-      }
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "open", filename);
-      return NULL;
-    }
-    cnt = 0;
-    while (GNUNET_YES !=
-           GNUNET_DISK_file_lock (fd,
-                                  0,
-                                  sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey),
-                                  GNUNET_YES))
-    {
-      short_wait ();
-      if (0 == ++cnt % 10)
-      {
-        ec = errno;
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("Could not acquire lock on file `%s': %s...\n"),
-             filename,
-             strerror (ec));
-      }
-    }
-    LOG (GNUNET_ERROR_TYPE_INFO,
-         _ ("Creating a new private key.  This may take a while.\n"));
-    priv = GNUNET_CRYPTO_eddsa_key_create ();
-    GNUNET_assert (NULL != priv);
-    GNUNET_assert (sizeof(*priv) ==
-                   GNUNET_DISK_file_write (fd, priv, sizeof(*priv)));
-    GNUNET_DISK_file_sync (fd);
-    if (GNUNET_YES !=
-        GNUNET_DISK_file_unlock (fd,
-                                 0,
-                                 sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey)))
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-    GNUNET_assert (GNUNET_YES == GNUNET_DISK_file_close (fd));
-    return priv;
+    char *dname;
+
+    dname = GNUNET_strdup (filename);
+    GNUNET_asprintf (&tmpl,
+                     "%s/XXXXXX",
+                     dirname (dname));
+    GNUNET_free (dname);
   }
-  /* key file exists already, read it! */
-  fd = GNUNET_DISK_file_open (filename,
-                              GNUNET_DISK_OPEN_READ,
-                              GNUNET_DISK_PERM_NONE);
-  if (NULL == fd)
+  fd = mkstemp (tmpl);
+  if (-1 == fd)
   {
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "open", filename);
-    return NULL;
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "mkstemp",
+                              tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
   }
-  cnt = 0;
-  while (1)
+  if (0 != fchmod (fd,
+                   S_IRUSR))
   {
-    if (GNUNET_YES !=
-        GNUNET_DISK_file_lock (fd,
-                               0,
-                               sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey),
-                               GNUNET_NO))
-    {
-      if (0 == ++cnt % 60)
-      {
-        ec = errno;
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("Could not acquire lock on file `%s': %s...\n"),
-             filename,
-             strerror (ec));
-        LOG (
-          GNUNET_ERROR_TYPE_ERROR,
-          _ (
-            "This may be ok if someone is currently generating a private 
key.\n"));
-      }
-      short_wait ();
-      continue;
-    }
-    if (GNUNET_YES != GNUNET_DISK_file_test (filename))
-    {
-      /* eh, what!? File we opened is now gone!? */
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", filename);
-      if (GNUNET_YES !=
-          GNUNET_DISK_file_unlock (fd,
-                                   0,
-                                   sizeof(
-                                     struct GNUNET_CRYPTO_EddsaPrivateKey)))
-        LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-      GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fd));
-
-      return NULL;
-    }
-    if (GNUNET_OK !=
-        GNUNET_DISK_file_size (filename, &fs, GNUNET_YES, GNUNET_YES))
-      fs = 0;
-    if (fs < sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey))
-    {
-      /* maybe we got the read lock before the key generating
-       * process had a chance to get the write lock; give it up! */
-      if (GNUNET_YES !=
-          GNUNET_DISK_file_unlock (fd,
-                                   0,
-                                   sizeof(
-                                     struct GNUNET_CRYPTO_EddsaPrivateKey)))
-        LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-      if (0 == ++cnt % 10)
-      {
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ (
-               "When trying to read key file `%s' I found %u bytes but I need 
at least %u.\n"),
-             filename,
-             (unsigned int) fs,
-             (unsigned int) sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey));
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("This may be ok if someone is currently generating a key.\n"));
-      }
-      short_wait ();    /* wait a bit longer! */
-      continue;
-    }
-    break;
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "chmod",
+                              tmpl);
+    GNUNET_assert (0 == close (fd));
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
   }
-  fs = sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey);
-  priv = GNUNET_malloc (fs);
-  sret = GNUNET_DISK_file_read (fd, priv, fs);
-  GNUNET_assert ((sret >= 0) && (fs == (size_t) sret));
-  if (GNUNET_YES !=
-      GNUNET_DISK_file_unlock (fd,
-                               0,
-                               sizeof(struct GNUNET_CRYPTO_EddsaPrivateKey)))
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-  GNUNET_assert (GNUNET_YES == GNUNET_DISK_file_close (fd));
-#if CRYPTO_BUG
-  if (GNUNET_OK != check_eddsa_key (priv))
+  if (buf_size !=
+      write (fd,
+             buf,
+             buf_size))
   {
-    GNUNET_break (0);
-    GNUNET_free (priv);
-    return NULL;
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "write",
+                              tmpl);
+    GNUNET_assert (0 == close (fd));
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_SYSERR;
   }
-#endif
-  return priv;
+  GNUNET_assert (0 == close (fd));
+
+  if (0 != link (tmpl,
+                 filename))
+  {
+    if (0 != unlink (tmpl))
+      GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                                "unlink",
+                                tmpl);
+    GNUNET_free (tmpl);
+    return GNUNET_NO;
+  }
+  if (0 != unlink (tmpl))
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR,
+                              "unlink",
+                              tmpl);
+  GNUNET_free (tmpl);
+  return GNUNET_OK;
 }
 
 
 /**
- * Create a new private key by reading it from a file.  If the
- * files does not exist, create a new key and write it to the
- * file.  Caller must free return value.  Note that this function
- * can not guarantee that another process might not be trying
- * the same operation on the same file at the same time.
- * If the contents of the file
- * are invalid the old file is deleted and a fresh key is
- * created.
+ * @ingroup crypto
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
  *
  * @param filename name of file to use to store the key
- * @return new private key, NULL on error (for example,
- *   permission denied)
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
+ *         we found an existing file, #GNUNET_SYSERR on failure
  */
-struct GNUNET_CRYPTO_EcdsaPrivateKey *
-GNUNET_CRYPTO_ecdsa_key_create_from_file (const char *filename)
+int
+GNUNET_CRYPTO_eddsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EddsaPrivateKey *pkey)
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *priv;
-  struct GNUNET_DISK_FileHandle *fd;
-  unsigned int cnt;
-  int ec;
-  uint64_t fs;
-  ssize_t sret;
-
-  if (GNUNET_SYSERR == GNUNET_DISK_directory_create_for_file (filename))
-    return NULL;
-  while (GNUNET_YES != GNUNET_DISK_file_test (filename))
+  int ret;
+
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
   {
-    fd =
-      GNUNET_DISK_file_open (filename,
-                             GNUNET_DISK_OPEN_WRITE | GNUNET_DISK_OPEN_CREATE
-                             | GNUNET_DISK_OPEN_FAILIFEXISTS,
-                             GNUNET_DISK_PERM_USER_READ
-                             | GNUNET_DISK_PERM_USER_WRITE);
-    if (NULL == fd)
-    {
-      if (EEXIST == errno)
-      {
-        if (GNUNET_YES != GNUNET_DISK_file_test (filename))
-        {
-          /* must exist but not be accessible, fail for good! */
-          if (0 != access (filename, R_OK))
-            LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "access", filename);
-          else
-            GNUNET_break (0);        /* what is going on!? */
-          return NULL;
-        }
-        continue;
-      }
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "open", filename);
-      return NULL;
-    }
-    cnt = 0;
-    while (GNUNET_YES !=
-           GNUNET_DISK_file_lock (fd,
-                                  0,
-                                  sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey),
-                                  GNUNET_YES))
-    {
-      short_wait ();
-      if (0 == ++cnt % 10)
-      {
-        ec = errno;
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("Could not acquire lock on file `%s': %s...\n"),
-             filename,
-             strerror (ec));
-      }
-    }
-    LOG (GNUNET_ERROR_TYPE_INFO,
-         _ ("Creating a new private key.  This may take a while.\n"));
-    priv = GNUNET_CRYPTO_ecdsa_key_create ();
-    GNUNET_assert (NULL != priv);
-    GNUNET_assert (sizeof(*priv) ==
-                   GNUNET_DISK_file_write (fd, priv, sizeof(*priv)));
-    GNUNET_DISK_file_sync (fd);
-    if (GNUNET_YES !=
-        GNUNET_DISK_file_unlock (fd,
-                                 0,
-                                 sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey)))
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-    GNUNET_assert (GNUNET_YES == GNUNET_DISK_file_close (fd));
-    return priv;
+    /* file existed, report that we didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
   }
-  /* key file exists already, read it! */
-  fd = GNUNET_DISK_file_open (filename,
-                              GNUNET_DISK_OPEN_READ,
-                              GNUNET_DISK_PERM_NONE);
-  if (NULL == fd)
+  GNUNET_CRYPTO_eddsa_key_create (pkey);
+  ret = atomic_write_to_file (filename,
+                              pkey,
+                              sizeof (*pkey));
+  if ( (GNUNET_OK == ret) ||
+       (GNUNET_SYSERR == ret) )
+    return ret;
+  /* maybe another process succeeded in the meantime, try reading one more 
time */
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
   {
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_ERROR, "open", filename);
-    return NULL;
+    /* file existed, report that *we* didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
   }
-  cnt = 0;
-  while (1)
+  /* give up */
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * @ingroup crypto
+ * @brief Create a new private key by reading it from a file.
+ *
+ * If the files does not exist and @a do_create is set, creates a new key and
+ * write it to the file.
+ *
+ * If the contents of the file are invalid, an error is returned.
+ *
+ * @param filename name of file to use to store the key
+ * @param do_create should a file be created?
+ * @param[out] pkey set to the private key from @a filename on success
+ * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
+ *         we found an existing file, #GNUNET_SYSERR on failure
+ */
+int
+GNUNET_CRYPTO_ecdsa_key_from_file (const char *filename,
+                                   int do_create,
+                                   struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey)
+{
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
   {
-    if (GNUNET_YES !=
-        GNUNET_DISK_file_lock (fd,
-                               0,
-                               sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey),
-                               GNUNET_NO))
-    {
-      if (0 == ++cnt % 60)
-      {
-        ec = errno;
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("Could not acquire lock on file `%s': %s...\n"),
-             filename,
-             strerror (ec));
-        LOG (
-          GNUNET_ERROR_TYPE_ERROR,
-          _ (
-            "This may be ok if someone is currently generating a private 
key.\n"));
-      }
-      short_wait ();
-      continue;
-    }
-    if (GNUNET_YES != GNUNET_DISK_file_test (filename))
-    {
-      /* eh, what!? File we opened is now gone!? */
-      LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "stat", filename);
-      if (GNUNET_YES !=
-          GNUNET_DISK_file_unlock (fd,
-                                   0,
-                                   sizeof(
-                                     struct GNUNET_CRYPTO_EcdsaPrivateKey)))
-        LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-      GNUNET_assert (GNUNET_OK == GNUNET_DISK_file_close (fd));
-
-      return NULL;
-    }
-    if (GNUNET_OK !=
-        GNUNET_DISK_file_size (filename, &fs, GNUNET_YES, GNUNET_YES))
-      fs = 0;
-    if (fs < sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey))
-    {
-      /* maybe we got the read lock before the key generating
-       * process had a chance to get the write lock; give it up! */
-      if (GNUNET_YES !=
-          GNUNET_DISK_file_unlock (fd,
-                                   0,
-                                   sizeof(
-                                     struct GNUNET_CRYPTO_EcdsaPrivateKey)))
-        LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-      if (0 == ++cnt % 10)
-      {
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ (
-               "When trying to read key file `%s' I found %u bytes but I need 
at least %u.\n"),
-             filename,
-             (unsigned int) fs,
-             (unsigned int) sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
-        LOG (GNUNET_ERROR_TYPE_ERROR,
-             _ ("This may be ok if someone is currently generating a key.\n"));
-      }
-      short_wait ();    /* wait a bit longer! */
-      continue;
-    }
-    break;
+    /* file existed, report that we didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
   }
-  fs = sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey);
-  priv = GNUNET_malloc (fs);
-  sret = GNUNET_DISK_file_read (fd, priv, fs);
-  GNUNET_assert ((sret >= 0) && (fs == (size_t) sret));
-  if (GNUNET_YES !=
-      GNUNET_DISK_file_unlock (fd,
-                               0,
-                               sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey)))
-    LOG_STRERROR_FILE (GNUNET_ERROR_TYPE_WARNING, "fcntl", filename);
-  GNUNET_assert (GNUNET_YES == GNUNET_DISK_file_close (fd));
-  return priv;
+  GNUNET_CRYPTO_ecdsa_key_create (pkey);
+  if (GNUNET_OK ==
+      atomic_write_to_file (filename,
+                            pkey,
+                            sizeof (*pkey)))
+    return GNUNET_OK;
+  /* maybe another process succeeded in the meantime, try reading one more 
time */
+  if (GNUNET_OK ==
+      read_from_file (filename,
+                      pkey,
+                      sizeof (*pkey)))
+  {
+    /* file existed, report that *we* didn't create it... */
+    return (do_create) ? GNUNET_NO : GNUNET_OK;
+  }
+  /* give up */
+  return GNUNET_SYSERR;
 }
 
 
@@ -441,9 +327,15 @@ GNUNET_CRYPTO_eddsa_key_create_from_configuration (
   char *fn;
 
   if (GNUNET_OK !=
-      GNUNET_CONFIGURATION_get_value_filename (cfg, "PEER", "PRIVATE_KEY", 
&fn))
+      GNUNET_CONFIGURATION_get_value_filename (cfg,
+                                               "PEER",
+                                               "PRIVATE_KEY",
+                                               &fn))
     return NULL;
-  priv = GNUNET_CRYPTO_eddsa_key_create_from_file (fn);
+  priv = GNUNET_new (struct GNUNET_CRYPTO_EddsaPrivateKey);
+  GNUNET_CRYPTO_eddsa_key_from_file (fn,
+                                     GNUNET_YES,
+                                     priv);
   GNUNET_free (fn);
   return priv;
 }
@@ -469,7 +361,8 @@ GNUNET_CRYPTO_get_peer_identity (const struct 
GNUNET_CONFIGURATION_Handle *cfg,
                 _ ("Could not load peer's private key\n"));
     return GNUNET_SYSERR;
   }
-  GNUNET_CRYPTO_eddsa_key_get_public (priv, &dst->public_key);
+  GNUNET_CRYPTO_eddsa_key_get_public (priv,
+                                      &dst->public_key);
   GNUNET_free (priv);
   return GNUNET_OK;
 }
diff --git a/src/util/disk.c b/src/util/disk.c
index b98c81e4b..9018aa955 100644
--- a/src/util/disk.c
+++ b/src/util/disk.c
@@ -1187,70 +1187,6 @@ GNUNET_DISK_file_change_owner (const char *filename, 
const char *user)
 }
 
 
-/**
- * Lock a part of a file
- *
- * @param fh file handle
- * @param lock_start absolute position from where to lock
- * @param lock_end absolute position until where to lock
- * @param excl #GNUNET_YES for an exclusive lock
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_DISK_file_lock (struct GNUNET_DISK_FileHandle *fh,
-                       off_t lock_start,
-                       off_t lock_end,
-                       int excl)
-{
-  if (fh == NULL)
-  {
-    errno = EINVAL;
-    return GNUNET_SYSERR;
-  }
-
-  struct flock fl;
-
-  memset (&fl, 0, sizeof(struct flock));
-  fl.l_type = excl ? F_WRLCK : F_RDLCK;
-  fl.l_whence = SEEK_SET;
-  fl.l_start = lock_start;
-  fl.l_len = lock_end;
-
-  return fcntl (fh->fd, F_SETLK, &fl) != 0 ? GNUNET_SYSERR : GNUNET_OK;
-}
-
-
-/**
- * Unlock a part of a file
- *
- * @param fh file handle
- * @param unlock_start absolute position from where to unlock
- * @param unlock_end absolute position until where to unlock
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
-GNUNET_DISK_file_unlock (struct GNUNET_DISK_FileHandle *fh,
-                         off_t unlock_start,
-                         off_t unlock_end)
-{
-  if (fh == NULL)
-  {
-    errno = EINVAL;
-    return GNUNET_SYSERR;
-  }
-
-  struct flock fl;
-
-  memset (&fl, 0, sizeof(struct flock));
-  fl.l_type = F_UNLCK;
-  fl.l_whence = SEEK_SET;
-  fl.l_start = unlock_start;
-  fl.l_len = unlock_end;
-
-  return fcntl (fh->fd, F_SETLK, &fl) != 0 ? GNUNET_SYSERR : GNUNET_OK;
-}
-
-
 /**
  * Open a file.  Note that the access permissions will only be
  * used if a new file is created and if the underlying operating
diff --git a/src/util/gnunet-crypto-tvg.c b/src/util/gnunet-crypto-tvg.c
index e0ef9a622..c3fead62e 100644
--- a/src/util/gnunet-crypto-tvg.c
+++ b/src/util/gnunet-crypto-tvg.c
@@ -86,50 +86,63 @@ run (void *cls,
     display_data ("  output", &hc, sizeof (struct GNUNET_HashCode));
   }
   {
-    struct GNUNET_CRYPTO_EcdhePrivateKey *priv1;
+    struct GNUNET_CRYPTO_EcdhePrivateKey priv1;
     struct GNUNET_CRYPTO_EcdhePublicKey pub1;
-    struct GNUNET_CRYPTO_EcdhePrivateKey *priv2;
+    struct GNUNET_CRYPTO_EcdhePrivateKey priv2;
     struct GNUNET_HashCode skm;
-    priv1 = GNUNET_CRYPTO_ecdhe_key_create ();
-    priv2 = GNUNET_CRYPTO_ecdhe_key_create ();
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv1, &pub1);
-    GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_ecc_ecdh (priv2, &pub1, &skm));
+
+    GNUNET_CRYPTO_ecdhe_key_create (&priv1);
+    GNUNET_CRYPTO_ecdhe_key_create (&priv2);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv1,
+                                        &pub1);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CRYPTO_ecc_ecdh (&priv2,
+                                           &pub1,
+                                           &skm));
 
     printf ("ecdhe key:\n");
-    display_data ("  priv1", priv1, sizeof (struct
-                                            GNUNET_CRYPTO_EcdhePrivateKey));
-    display_data ("  pub1", &pub1, sizeof (struct
-                                           GNUNET_CRYPTO_EcdhePublicKey));
-    display_data ("  priv2", priv2, sizeof (struct
-                                            GNUNET_CRYPTO_EcdhePrivateKey));
-    display_data ("  skm", &skm, sizeof (struct GNUNET_HashCode));
-    GNUNET_free (priv1);
-    GNUNET_free (priv2);
+    display_data ("  priv1",
+                  &priv1,
+                  sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+    display_data ("  pub1",
+                  &pub1,
+                  sizeof (struct GNUNET_CRYPTO_EcdhePublicKey));
+    display_data ("  priv2",
+                  &priv2,
+                  sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+    display_data ("  skm",
+                  &skm,
+                  sizeof (struct GNUNET_HashCode));
   }
 
   {
-    struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+    struct GNUNET_CRYPTO_EddsaPrivateKey priv;
     struct GNUNET_CRYPTO_EddsaPublicKey pub;
-    priv = GNUNET_CRYPTO_eddsa_key_create ();
-    GNUNET_CRYPTO_eddsa_key_get_public (priv, &pub);
+
+    GNUNET_CRYPTO_eddsa_key_create (&priv);
+    GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                        &pub);
 
     printf ("eddsa key:\n");
-    display_data ("  priv", priv, sizeof (struct
-                                          GNUNET_CRYPTO_EddsaPrivateKey));
-    display_data ("  pub", &pub, sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
-    GNUNET_free (priv);
+    display_data ("  priv",
+                  &priv,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+    display_data ("  pub",
+                  &pub,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
   }
   {
-    struct GNUNET_CRYPTO_EddsaPrivateKey *priv;
+    struct GNUNET_CRYPTO_EddsaPrivateKey priv;
     struct GNUNET_CRYPTO_EddsaPublicKey pub;
     struct GNUNET_CRYPTO_EddsaSignature sig;
     struct TestSignatureDataPS data = { 0 };
 
-    priv = GNUNET_CRYPTO_eddsa_key_create ();
-    GNUNET_CRYPTO_eddsa_key_get_public (priv, &pub);
+    GNUNET_CRYPTO_eddsa_key_create (&priv);
+    GNUNET_CRYPTO_eddsa_key_get_public (&priv,
+                                        &pub);
     data.purpose.size = htonl (sizeof (data));
     data.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
-    GNUNET_CRYPTO_eddsa_sign (priv,
+    GNUNET_CRYPTO_eddsa_sign (&priv,
                               &data,
                               &sig);
     GNUNET_assert (GNUNET_OK ==
@@ -139,12 +152,18 @@ run (void *cls,
                                                &pub));
 
     printf ("eddsa sig:\n");
-    display_data ("  priv", priv, sizeof (struct
-                                          GNUNET_CRYPTO_EddsaPrivateKey));
-    display_data ("  pub", &pub, sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
-    display_data ("  data", &data, sizeof (struct TestSignatureDataPS));
-    display_data ("  sig", &sig, sizeof (struct GNUNET_CRYPTO_EddsaSignature));
-    GNUNET_free (priv);
+    display_data ("  priv",
+                  &priv,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+    display_data ("  pub",
+                  &pub,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
+    display_data ("  data",
+                  &data,
+                  sizeof (struct TestSignatureDataPS));
+    display_data ("  sig",
+                  &sig,
+                  sizeof (struct GNUNET_CRYPTO_EddsaSignature));
   }
 
   {
@@ -173,28 +192,34 @@ run (void *cls,
     display_data ("  out", out, out_len);
   }
   {
-    struct GNUNET_CRYPTO_EcdhePrivateKey *priv_ecdhe;
+    struct GNUNET_CRYPTO_EcdhePrivateKey priv_ecdhe;
     struct GNUNET_CRYPTO_EcdhePublicKey pub_ecdhe;
-    struct GNUNET_CRYPTO_EddsaPrivateKey *priv_eddsa;
+    struct GNUNET_CRYPTO_EddsaPrivateKey priv_eddsa;
     struct GNUNET_CRYPTO_EddsaPublicKey pub_eddsa;
     struct GNUNET_HashCode key_material;
-    priv_ecdhe = GNUNET_CRYPTO_ecdhe_key_create ();
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv_ecdhe, &pub_ecdhe);
-    priv_eddsa = GNUNET_CRYPTO_eddsa_key_create ();
-    GNUNET_CRYPTO_eddsa_key_get_public (priv_eddsa, &pub_eddsa);
-    GNUNET_CRYPTO_ecdh_eddsa (priv_ecdhe, &pub_eddsa, &key_material);
+
+    GNUNET_CRYPTO_ecdhe_key_create (&priv_ecdhe);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv_ecdhe, &pub_ecdhe);
+    GNUNET_CRYPTO_eddsa_key_create (&priv_eddsa);
+    GNUNET_CRYPTO_eddsa_key_get_public (&priv_eddsa, &pub_eddsa);
+    GNUNET_CRYPTO_ecdh_eddsa (&priv_ecdhe, &pub_eddsa, &key_material);
 
     printf ("eddsa_ecdh:\n");
-    display_data ("  priv_ecdhe", priv_ecdhe, sizeof (struct
-                                                      
GNUNET_CRYPTO_EcdhePrivateKey));
-    display_data ("  pub_ecdhe", &pub_ecdhe, sizeof (struct
-                                                     
GNUNET_CRYPTO_EcdhePublicKey));
-    display_data ("  priv_eddsa", priv_eddsa, sizeof (struct
-                                                      
GNUNET_CRYPTO_EddsaPrivateKey));
-    display_data ("  pub_eddsa", &pub_eddsa, sizeof (struct
-                                                     
GNUNET_CRYPTO_EddsaPublicKey));
-    display_data ("  key_material", &key_material, sizeof (struct
-                                                           GNUNET_HashCode));
+    display_data ("  priv_ecdhe",
+                  &priv_ecdhe,
+                  sizeof (struct GNUNET_CRYPTO_EcdhePrivateKey));
+    display_data ("  pub_ecdhe",
+                  &pub_ecdhe,
+                  sizeof (struct GNUNET_CRYPTO_EcdhePublicKey));
+    display_data ("  priv_eddsa",
+                  &priv_eddsa,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPrivateKey));
+    display_data ("  pub_eddsa",
+                  &pub_eddsa,
+                  sizeof (struct GNUNET_CRYPTO_EddsaPublicKey));
+    display_data ("  key_material",
+                  &key_material,
+                  sizeof (struct GNUNET_HashCode));
   }
 
   {
diff --git a/src/util/gnunet-ecc.c b/src/util/gnunet-ecc.c
index 02d2020ad..764a507b6 100644
--- a/src/util/gnunet-ecc.c
+++ b/src/util/gnunet-ecc.c
@@ -79,7 +79,7 @@ static void
 create_keys (const char *fn, const char *prefix)
 {
   FILE *f;
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
   struct GNUNET_CRYPTO_EddsaPublicKey target_pub;
   static char vanity[KEY_STR_LEN + 1];
   size_t len;
@@ -141,17 +141,16 @@ create_keys (const char *fn, const char *prefix)
   while (0 < make_keys--)
   {
     fprintf (stderr, ".");
-    if (NULL == (pk = GNUNET_CRYPTO_eddsa_key_create ()))
-    {
-      GNUNET_break (0);
-      break;
-    }
+    GNUNET_CRYPTO_eddsa_key_create (&pk);
     if (NULL != prefix)
     {
       struct GNUNET_CRYPTO_EddsaPublicKey newkey;
 
-      GNUNET_CRYPTO_eddsa_key_get_public (pk, &newkey);
-      if (0 != memcmp (&target_pub, &newkey, n))
+      GNUNET_CRYPTO_eddsa_key_get_public (&pk,
+                                          &newkey);
+      if (0 != memcmp (&target_pub,
+                       &newkey,
+                       n))
       {
         make_keys++;
         continue;
@@ -169,16 +168,17 @@ create_keys (const char *fn, const char *prefix)
       }
     }
     if (GNUNET_TESTING_HOSTKEYFILESIZE !=
-        fwrite (pk, 1, GNUNET_TESTING_HOSTKEYFILESIZE, f))
+        fwrite (&pk,
+                1,
+                GNUNET_TESTING_HOSTKEYFILESIZE,
+                f))
     {
       fprintf (stderr,
                _ ("\nFailed to write to `%s': %s\n"),
                fn,
                strerror (errno));
-      GNUNET_free (pk);
       break;
     }
-    GNUNET_free (pk);
   }
   if (UINT_MAX == make_keys)
     fprintf (stderr, _ ("\nFinished!\n"));
@@ -201,49 +201,75 @@ print_hex (const char *msg, const void *buf, size_t size)
 
 
 static void
-print_examples_ecdh ()
+print_examples_ecdh (void)
 {
-  struct GNUNET_CRYPTO_EcdhePrivateKey *dh_priv1;
-  struct GNUNET_CRYPTO_EcdhePublicKey *dh_pub1;
-  struct GNUNET_CRYPTO_EcdhePrivateKey *dh_priv2;
-  struct GNUNET_CRYPTO_EcdhePublicKey *dh_pub2;
+  struct GNUNET_CRYPTO_EcdhePrivateKey dh_priv1;
+  struct GNUNET_CRYPTO_EcdhePublicKey dh_pub1;
+  struct GNUNET_CRYPTO_EcdhePrivateKey dh_priv2;
+  struct GNUNET_CRYPTO_EcdhePublicKey dh_pub2;
   struct GNUNET_HashCode hash;
   char buf[128];
 
-  dh_pub1 = GNUNET_new (struct GNUNET_CRYPTO_EcdhePublicKey);
-  dh_priv1 = GNUNET_CRYPTO_ecdhe_key_create ();
-  dh_pub2 = GNUNET_new (struct GNUNET_CRYPTO_EcdhePublicKey);
-  dh_priv2 = GNUNET_CRYPTO_ecdhe_key_create ();
-  GNUNET_CRYPTO_ecdhe_key_get_public (dh_priv1, dh_pub1);
-  GNUNET_CRYPTO_ecdhe_key_get_public (dh_priv2, dh_pub2);
+  GNUNET_CRYPTO_ecdhe_key_create (&dh_priv1);
+  GNUNET_CRYPTO_ecdhe_key_create (&dh_priv2);
+  GNUNET_CRYPTO_ecdhe_key_get_public (&dh_priv1,
+                                      &dh_pub1);
+  GNUNET_CRYPTO_ecdhe_key_get_public (&dh_priv2,
+                                      &dh_pub2);
 
   GNUNET_assert (NULL !=
-                 GNUNET_STRINGS_data_to_string (dh_priv1, 32, buf, 128));
+                 GNUNET_STRINGS_data_to_string (&dh_priv1,
+                                                sizeof (dh_priv1),
+                                                buf,
+                                                sizeof (buf)));
   printf ("ECDHE key 1:\n");
-  printf ("private: %s\n", buf);
-  print_hex ("private(hex)", dh_priv1, sizeof *dh_priv1);
-  GNUNET_assert (NULL != GNUNET_STRINGS_data_to_string (dh_pub1, 32, buf, 
128));
-  printf ("public: %s\n", buf);
-  print_hex ("public(hex)", dh_pub1, sizeof *dh_pub1);
+  printf ("private: %s\n",
+          buf);
+  print_hex ("private(hex)",
+             &dh_priv1, sizeof (dh_priv1));
+  GNUNET_assert (NULL !=
+                 GNUNET_STRINGS_data_to_string (&dh_pub1,
+                                                sizeof (dh_pub1),
+                                                buf,
+                                                sizeof (buf)));
+  printf ("public: %s\n",
+          buf);
+  print_hex ("public(hex)",
+             &dh_pub1,
+             sizeof (dh_pub1));
 
   GNUNET_assert (NULL !=
-                 GNUNET_STRINGS_data_to_string (dh_priv2, 32, buf, 128));
+                 GNUNET_STRINGS_data_to_string (&dh_priv2,
+                                                sizeof (dh_priv2),
+                                                buf,
+                                                sizeof (buf)));
   printf ("ECDHE key 2:\n");
   printf ("private: %s\n", buf);
-  print_hex ("private(hex)", dh_priv2, sizeof *dh_priv2);
-  GNUNET_assert (NULL != GNUNET_STRINGS_data_to_string (dh_pub2, 32, buf, 
128));
+  print_hex ("private(hex)",
+             &dh_priv2,
+             sizeof (dh_priv2));
+  GNUNET_assert (NULL !=
+                 GNUNET_STRINGS_data_to_string (&dh_pub2,
+                                                sizeof (dh_pub2),
+                                                buf,
+                                                sizeof (buf)));
   printf ("public: %s\n", buf);
-  print_hex ("public(hex)", dh_pub2, sizeof *dh_pub2);
+  print_hex ("public(hex)",
+             &dh_pub2,
+             sizeof (dh_pub2));
 
   GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecc_ecdh (dh_priv1, dh_pub2, &hash));
-  GNUNET_assert (NULL != GNUNET_STRINGS_data_to_string (&hash, 64, buf, 128));
-  printf ("ECDH shared secret: %s\n", buf);
-
-  GNUNET_free (dh_priv1);
-  GNUNET_free (dh_priv2);
-  GNUNET_free (dh_pub1);
-  GNUNET_free (dh_pub2);
+                 GNUNET_CRYPTO_ecc_ecdh (&dh_priv1,
+                                         &dh_pub2,
+                                         &hash));
+  GNUNET_assert (NULL !=
+                 GNUNET_STRINGS_data_to_string (&hash,
+                                                sizeof (hash),
+                                                buf,
+                                                sizeof (buf)));
+  printf ("ECDH shared secret: %s\n",
+          buf);
+
 }
 
 
@@ -251,7 +277,7 @@ print_examples_ecdh ()
  * Print some random example operations to stdout.
  */
 static void
-print_examples ()
+print_examples (void)
 {
   print_examples_ecdh ();
   // print_examples_ecdsa ();
diff --git a/src/util/gnunet-scrypt.c b/src/util/gnunet-scrypt.c
index bc8ce83c0..8c46136b9 100644
--- a/src/util/gnunet-scrypt.c
+++ b/src/util/gnunet-scrypt.c
@@ -174,7 +174,7 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *config)
 {
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
   char *pids;
 
   (void) cls;
@@ -214,15 +214,18 @@ run (void *cls,
     }
   }
   GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Private Key file: %s\n", pkfn);
-  if (NULL == (pk = GNUNET_CRYPTO_eddsa_key_create_from_file (pkfn)))
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_eddsa_key_from_file (pkfn,
+                                         GNUNET_YES,
+                                         &pk))
   {
     fprintf (stderr, _ ("Loading hostkey from `%s' failed.\n"), pkfn);
     GNUNET_free (pkfn);
     return;
   }
   GNUNET_free (pkfn);
-  GNUNET_CRYPTO_eddsa_key_get_public (pk, &pub);
-  GNUNET_free (pk);
+  GNUNET_CRYPTO_eddsa_key_get_public (&pk,
+                                      &pub);
   pids = GNUNET_CRYPTO_eddsa_public_key_to_string (&pub);
   GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Peer ID: %s\n", pids);
   GNUNET_free (pids);
diff --git a/src/util/os_priority.c b/src/util/os_priority.c
index 722aac872..36f0d8e30 100644
--- a/src/util/os_priority.c
+++ b/src/util/os_priority.c
@@ -975,7 +975,7 @@ GNUNET_OS_process_status (struct GNUNET_OS_Process *proc,
  * @param proc pointer to process structure
  * @param type status type
  * @param code return code/signal number
- * @return #GNUNET_OK on success, #GNUNET_NO if the process is still running, 
#GNUNET_SYSERR otherwise
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR otherwise
  */
 int
 GNUNET_OS_process_wait_status (struct GNUNET_OS_Process *proc,
diff --git a/src/util/test_crypto_ecdh_ecdsa.c 
b/src/util/test_crypto_ecdh_ecdsa.c
index 8a581ef73..3cc12de9b 100644
--- a/src/util/test_crypto_ecdh_ecdsa.c
+++ b/src/util/test_crypto_ecdh_ecdsa.c
@@ -32,39 +32,37 @@
 static int
 test_ecdh ()
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *priv_dsa;
-  struct GNUNET_CRYPTO_EcdhePrivateKey *priv_ecdh;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey priv_dsa;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv_ecdh;
   struct GNUNET_CRYPTO_EcdsaPublicKey id1;
   struct GNUNET_CRYPTO_EcdhePublicKey id2;
   struct GNUNET_HashCode dh[2];
 
   /* Generate keys */
-  priv_dsa = GNUNET_CRYPTO_ecdsa_key_create ();
-  GNUNET_CRYPTO_ecdsa_key_get_public (priv_dsa,
+  GNUNET_CRYPTO_ecdsa_key_create (&priv_dsa);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&priv_dsa,
                                       &id1);
   for (unsigned int j = 0; j < 4; j++)
   {
     fprintf (stderr, ",");
-    priv_ecdh = GNUNET_CRYPTO_ecdhe_key_create ();
+    GNUNET_CRYPTO_ecdhe_key_create (&priv_ecdh);
     /* Extract public keys */
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv_ecdh,
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv_ecdh,
                                         &id2);
     /* Do ECDH */
     GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CRYPTO_ecdsa_ecdh (priv_dsa,
+                   GNUNET_CRYPTO_ecdsa_ecdh (&priv_dsa,
                                              &id2,
                                              &dh[0]));
     GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CRYPTO_ecdh_ecdsa (priv_ecdh,
+                   GNUNET_CRYPTO_ecdh_ecdsa (&priv_ecdh,
                                              &id1,
                                              &dh[1]));
     /* Check that both DH results are equal. */
-    GNUNET_assert (0 == memcmp (&dh[0],
-                                &dh[1],
-                                sizeof(struct GNUNET_HashCode)));
-    GNUNET_free (priv_ecdh);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&dh[0],
+                                  &dh[1]));
   }
-  GNUNET_free (priv_dsa);
   return 0;
 }
 
@@ -75,8 +73,7 @@ main (int argc, char *argv[])
   if (! gcry_check_version ("1.6.0"))
   {
     fprintf (stderr,
-             _ (
-               "libgcrypt has not the expected version (version %s is 
required).\n"),
+             "libgcrypt has not the expected version (version %s is 
required).\n",
              "1.6.0");
     return 0;
   }
diff --git a/src/util/test_crypto_ecdh_eddsa.c 
b/src/util/test_crypto_ecdh_eddsa.c
index 68f8c4671..6efd4d2fe 100644
--- a/src/util/test_crypto_ecdh_eddsa.c
+++ b/src/util/test_crypto_ecdh_eddsa.c
@@ -32,39 +32,37 @@
 static int
 test_ecdh ()
 {
-  struct GNUNET_CRYPTO_EddsaPrivateKey *priv_dsa;
-  struct GNUNET_CRYPTO_EcdhePrivateKey *priv_ecdh;
+  struct GNUNET_CRYPTO_EddsaPrivateKey priv_dsa;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv_ecdh;
   struct GNUNET_CRYPTO_EddsaPublicKey id1;
   struct GNUNET_CRYPTO_EcdhePublicKey id2;
   struct GNUNET_HashCode dh[2];
 
   /* Generate keys */
-  priv_dsa = GNUNET_CRYPTO_eddsa_key_create ();
-  GNUNET_CRYPTO_eddsa_key_get_public (priv_dsa,
+  GNUNET_CRYPTO_eddsa_key_create (&priv_dsa);
+  GNUNET_CRYPTO_eddsa_key_get_public (&priv_dsa,
                                       &id1);
   for (unsigned int j = 0; j < 4; j++)
   {
     fprintf (stderr, ",");
-    priv_ecdh = GNUNET_CRYPTO_ecdhe_key_create ();
+    GNUNET_CRYPTO_ecdhe_key_create (&priv_ecdh);
     /* Extract public keys */
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv_ecdh,
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv_ecdh,
                                         &id2);
     /* Do ECDH */
     GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CRYPTO_eddsa_ecdh (priv_dsa,
+                   GNUNET_CRYPTO_eddsa_ecdh (&priv_dsa,
                                              &id2,
                                              &dh[0]));
     GNUNET_assert (GNUNET_OK ==
-                   GNUNET_CRYPTO_ecdh_eddsa (priv_ecdh,
+                   GNUNET_CRYPTO_ecdh_eddsa (&priv_ecdh,
                                              &id1,
                                              &dh[1]));
     /* Check that both DH results are equal. */
-    GNUNET_assert (0 == memcmp (&dh[0],
-                                &dh[1],
-                                sizeof(struct GNUNET_HashCode)));
-    GNUNET_free (priv_ecdh);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&dh[0],
+                                  &dh[1]));
   }
-  GNUNET_free (priv_dsa);
   return 0;
 }
 
diff --git a/src/util/test_crypto_ecdhe.c b/src/util/test_crypto_ecdhe.c
index 6f91be746..1144f1fe5 100644
--- a/src/util/test_crypto_ecdhe.c
+++ b/src/util/test_crypto_ecdhe.c
@@ -31,8 +31,8 @@
 int
 main (int argc, char *argv[])
 {
-  struct GNUNET_CRYPTO_EcdhePrivateKey *priv1;
-  struct GNUNET_CRYPTO_EcdhePrivateKey *priv2;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv1;
+  struct GNUNET_CRYPTO_EcdhePrivateKey priv2;
   struct GNUNET_CRYPTO_EcdhePublicKey pub1;
   struct GNUNET_CRYPTO_EcdhePublicKey pub2;
   struct GNUNET_HashCode ecdh1;
@@ -41,9 +41,7 @@ main (int argc, char *argv[])
   if (! gcry_check_version ("1.6.0"))
   {
     fprintf (stderr,
-             _
-             (
-               "libgcrypt has not the expected version (version %s is 
required).\n"),
+             "libgcrypt has not the expected version (version %s is 
required).\n",
              "1.6.0");
     return 0;
   }
@@ -55,16 +53,15 @@ main (int argc, char *argv[])
   {
     fprintf (stderr,
              ".");
-    priv1 = GNUNET_CRYPTO_ecdhe_key_create ();
-    priv2 = GNUNET_CRYPTO_ecdhe_key_create ();
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv1, &pub1);
-    GNUNET_CRYPTO_ecdhe_key_get_public (priv2, &pub2);
-    GNUNET_CRYPTO_ecc_ecdh (priv1, &pub2, &ecdh1);
-    GNUNET_CRYPTO_ecc_ecdh (priv2, &pub1, &ecdh2);
-    GNUNET_assert (0 == memcmp (&ecdh1, &ecdh2,
-                                sizeof(struct GNUNET_HashCode)));
-    GNUNET_free (priv1);
-    GNUNET_free (priv2);
+    GNUNET_CRYPTO_ecdhe_key_create (&priv1);
+    GNUNET_CRYPTO_ecdhe_key_create (&priv2);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv1, &pub1);
+    GNUNET_CRYPTO_ecdhe_key_get_public (&priv2, &pub2);
+    GNUNET_CRYPTO_ecc_ecdh (&priv1, &pub2, &ecdh1);
+    GNUNET_CRYPTO_ecc_ecdh (&priv2, &pub1, &ecdh2);
+    GNUNET_assert (0 ==
+                   GNUNET_memcmp (&ecdh1,
+                                  &ecdh2));
   }
   return 0;
 }
diff --git a/src/util/test_crypto_ecdsa.c b/src/util/test_crypto_ecdsa.c
index 190c58d7d..cfa236d6d 100644
--- a/src/util/test_crypto_ecdsa.c
+++ b/src/util/test_crypto_ecdsa.c
@@ -33,65 +33,74 @@
 #define PERF GNUNET_YES
 
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey *key;
+static struct GNUNET_CRYPTO_EcdsaPrivateKey key;
 
 
 static int
-testSignVerify ()
+testSignVerify (void)
 {
   struct GNUNET_CRYPTO_EcdsaSignature sig;
   struct GNUNET_CRYPTO_EccSignaturePurpose purp;
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
-  int i;
   struct GNUNET_TIME_Absolute start;
   int ok = GNUNET_OK;
 
   fprintf (stderr, "%s", "W");
-  GNUNET_CRYPTO_ecdsa_key_get_public (key, &pkey);
+  GNUNET_CRYPTO_ecdsa_key_get_public (&key,
+                                      &pkey);
   start = GNUNET_TIME_absolute_get ();
   purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
   purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
 
-  for (i = 0; i < ITER; i++)
+  for (unsigned int i = 0; i < ITER; i++)
   {
-    fprintf (stderr, "%s", "."); fflush (stderr);
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
     if (GNUNET_SYSERR ==
-        GNUNET_CRYPTO_ecdsa_sign_ (key, &purp, &sig))
+        GNUNET_CRYPTO_ecdsa_sign_ (&key,
+                                   &purp,
+                                   &sig))
     {
       fprintf (stderr,
-               "%s",
                "GNUNET_CRYPTO_ecdsa_sign returned SYSERR\n");
       ok = GNUNET_SYSERR;
       continue;
     }
     if (GNUNET_SYSERR ==
         GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
-                                     &purp, &sig,
+                                     &purp,
+                                     &sig,
                                      &pkey))
     {
-      printf ("GNUNET_CRYPTO_ecdsa_verify failed!\n");
+      fprintf (stderr,
+               "GNUNET_CRYPTO_ecdsa_verify failed!\n");
       ok = GNUNET_SYSERR;
       continue;
     }
     if (GNUNET_SYSERR !=
         GNUNET_CRYPTO_ecdsa_verify_ (
           GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
-          &purp, &sig, &pkey))
+          &purp,
+          &sig,
+          &pkey))
     {
-      printf ("GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+      fprintf (stderr,
+               "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
       ok = GNUNET_SYSERR;
       continue;
     }
   }
-  printf ("%d ECDSA sign/verify operations %s\n", ITER,
+  printf ("%d ECDSA sign/verify operations %s\n",
+          ITER,
           GNUNET_STRINGS_relative_time_to_string (
-            GNUNET_TIME_absolute_get_duration (start), GNUNET_YES));
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
   return ok;
 }
 
 
 static int
-testDeriveSignVerify ()
+testDeriveSignVerify (void)
 {
   struct GNUNET_CRYPTO_EcdsaSignature sig;
   struct GNUNET_CRYPTO_EccSignaturePurpose purp;
@@ -99,15 +108,22 @@ testDeriveSignVerify ()
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
   struct GNUNET_CRYPTO_EcdsaPublicKey dpub;
 
-  dpriv = GNUNET_CRYPTO_ecdsa_private_key_derive (key, "test-derive",
+  dpriv = GNUNET_CRYPTO_ecdsa_private_key_derive (&key,
+                                                  "test-derive",
                                                   "test-CTX");
-  GNUNET_CRYPTO_ecdsa_key_get_public (key, &pkey);
-  GNUNET_CRYPTO_ecdsa_public_key_derive (&pkey, "test-derive", "test-CTX",
+  GNUNET_CRYPTO_ecdsa_key_get_public (&key,
+                                      &pkey);
+  GNUNET_CRYPTO_ecdsa_public_key_derive (&pkey,
+                                         "test-derive",
+                                         "test-CTX",
                                          &dpub);
   purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
   purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
 
-  if (GNUNET_SYSERR == GNUNET_CRYPTO_ecdsa_sign_ (dpriv, &purp, &sig))
+  if (GNUNET_SYSERR ==
+      GNUNET_CRYPTO_ecdsa_sign_ (dpriv,
+                                 &purp,
+                                 &sig))
   {
     fprintf (stderr, "%s", "GNUNET_CRYPTO_ecdsa_sign returned SYSERR\n");
     GNUNET_free (dpriv);
@@ -115,27 +131,34 @@ testDeriveSignVerify ()
   }
   if (GNUNET_SYSERR ==
       GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
-                                   &purp, &sig,
+                                   &purp,
+                                   &sig,
                                    &dpub))
   {
-    printf ("GNUNET_CRYPTO_ecdsa_verify failed!\n");
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed!\n");
     GNUNET_free (dpriv);
     return GNUNET_SYSERR;
   }
   if (GNUNET_SYSERR !=
       GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
-                                   &purp, &sig,
+                                   &purp,
+                                   &sig,
                                    &pkey))
   {
-    printf ("GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
     GNUNET_free (dpriv);
     return GNUNET_SYSERR;
   }
   if (GNUNET_SYSERR !=
       GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
-                                   &purp, &sig, &dpub))
+                                   &purp,
+                                   &sig,
+                                   &dpub))
   {
-    printf ("GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
+    fprintf (stderr,
+             "GNUNET_CRYPTO_ecdsa_verify failed to fail!\n");
     GNUNET_free (dpriv);
     return GNUNET_SYSERR;
   }
@@ -146,7 +169,7 @@ testDeriveSignVerify ()
 
 #if PERF
 static int
-testSignPerformance ()
+testSignPerformance (void)
 {
   struct GNUNET_CRYPTO_EccSignaturePurpose purp;
   struct GNUNET_CRYPTO_EcdsaSignature sig;
@@ -183,26 +206,24 @@ testSignPerformance ()
 
 
 static void
-perf_keygen ()
+perf_keygen (void)
 {
   struct GNUNET_TIME_Absolute start;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk;
-  int i;
+  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
 
   fprintf (stderr, "%s", "W");
   start = GNUNET_TIME_absolute_get ();
-  for (i = 0; i < 10; i++)
+  for (unsigned int i = 0; i < 10; i++)
   {
-    fprintf (stderr, "."); fflush (stderr);
-    pk = GNUNET_CRYPTO_ecdsa_key_create ();
-    GNUNET_free (pk);
-  }
-  for (; i < 25; i++)
     fprintf (stderr, ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_ecdsa_key_create (&pk);
+  }
   fflush (stderr);
   printf ("10 ECDSA keys created in %s\n",
           GNUNET_STRINGS_relative_time_to_string (
-            GNUNET_TIME_absolute_get_duration (start), GNUNET_YES));
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
 }
 
 
@@ -214,16 +235,14 @@ main (int argc, char *argv[])
   if (! gcry_check_version ("1.6.0"))
   {
     fprintf (stderr,
-             _
-             (
-               "libgcrypt has not the expected version (version %s is 
required).\n"),
+             "libgcrypt has not the expected version (version %s is 
required).\n",
              "1.6.0");
     return 0;
   }
   if (getenv ("GNUNET_GCRYPT_DEBUG"))
     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
   GNUNET_log_setup ("test-crypto-ecc", "WARNING", NULL);
-  key = GNUNET_CRYPTO_ecdsa_key_create ();
+  GNUNET_CRYPTO_ecdsa_key_create (&key);
   if (GNUNET_OK != testDeriveSignVerify ())
   {
     failure_count++;
@@ -237,7 +256,6 @@ main (int argc, char *argv[])
 #endif
   if (GNUNET_OK != testSignVerify ())
     failure_count++;
-  GNUNET_free (key);
   perf_keygen ();
 
   if (0 != failure_count)
diff --git a/src/util/test_crypto_eddsa.c b/src/util/test_crypto_eddsa.c
index 87990cbac..5baf696b1 100644
--- a/src/util/test_crypto_eddsa.c
+++ b/src/util/test_crypto_eddsa.c
@@ -35,11 +35,11 @@
 #define PERF GNUNET_YES
 
 
-static struct GNUNET_CRYPTO_EddsaPrivateKey *key;
+static struct GNUNET_CRYPTO_EddsaPrivateKey key;
 
 
 static int
-testSignVerify ()
+testSignVerify (void)
 {
   struct GNUNET_CRYPTO_EddsaSignature sig;
   struct GNUNET_CRYPTO_EccSignaturePurpose purp;
@@ -48,7 +48,8 @@ testSignVerify ()
   int ok = GNUNET_OK;
 
   fprintf (stderr, "%s", "W");
-  GNUNET_CRYPTO_eddsa_key_get_public (key, &pkey);
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &pkey);
   start = GNUNET_TIME_absolute_get ();
   purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
   purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
@@ -56,34 +57,45 @@ testSignVerify ()
   for (unsigned int i = 0; i < ITER; i++)
   {
     fprintf (stderr, "%s", "."); fflush (stderr);
-    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_sign_ (key, &purp, &sig))
+    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_sign_ (&key,
+                                                    &purp,
+                                                    &sig))
     {
-      fprintf (stderr, "%s", "GNUNET_CRYPTO_eddsa_sign returned SYSERR\n");
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_sign returned SYSERR\n");
       ok = GNUNET_SYSERR;
       continue;
     }
     if (GNUNET_SYSERR ==
-        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST, &purp, 
&sig,
+        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_TEST,
+                                     &purp,
+                                     &sig,
                                      &pkey))
     {
-      printf ("GNUNET_CRYPTO_eddsa_verify failed!\n");
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_verify failed!\n");
       ok = GNUNET_SYSERR;
       continue;
     }
     if (GNUNET_SYSERR !=
         GNUNET_CRYPTO_eddsa_verify_ (
           GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN,
-          &purp, &sig, &pkey))
+          &purp,
+          &sig,
+          &pkey))
     {
-      printf ("GNUNET_CRYPTO_eddsa_verify failed to fail!\n");
+      fprintf (stderr,
+               "GNUNET_CRYPTO_eddsa_verify failed to fail!\n");
       ok = GNUNET_SYSERR;
       continue;
     }
   }
   fprintf (stderr, "\n");
-  printf ("%d EdDSA sign/verify operations %s\n", ITER,
+  printf ("%d EdDSA sign/verify operations %s\n",
+          ITER,
           GNUNET_STRINGS_relative_time_to_string (
-            GNUNET_TIME_absolute_get_duration (start), GNUNET_YES));
+            GNUNET_TIME_absolute_get_duration (start),
+            GNUNET_YES));
   return ok;
 }
 
@@ -101,12 +113,17 @@ testSignPerformance ()
   purp.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose));
   purp.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_TEST);
   fprintf (stderr, "%s", "W");
-  GNUNET_CRYPTO_eddsa_key_get_public (key, &pkey);
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &pkey);
   start = GNUNET_TIME_absolute_get ();
   for (unsigned int i = 0; i < ITER; i++)
   {
-    fprintf (stderr, "%s", "."); fflush (stderr);
-    if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_sign_ (key, &purp, &sig))
+    fprintf (stderr, "%s", ".");
+    fflush (stderr);
+    if (GNUNET_SYSERR ==
+        GNUNET_CRYPTO_eddsa_sign_ (&key,
+                                   &purp,
+                                   &sig))
     {
       fprintf (stderr, "%s", "GNUNET_CRYPTO_eddsa_sign returned SYSERR\n");
       ok = GNUNET_SYSERR;
@@ -114,7 +131,8 @@ testSignPerformance ()
     }
   }
   fprintf (stderr, "\n");
-  printf ("%d EdDSA sign operations %s\n", ITER,
+  printf ("%d EdDSA sign operations %s\n",
+          ITER,
           GNUNET_STRINGS_relative_time_to_string (
             GNUNET_TIME_absolute_get_duration (start),
             GNUNET_YES));
@@ -126,43 +144,53 @@ testSignPerformance ()
 
 
 static int
-testCreateFromFile ()
+testCreateFromFile (void)
 {
   struct GNUNET_CRYPTO_EddsaPublicKey p1;
   struct GNUNET_CRYPTO_EddsaPublicKey p2;
 
-  key = GNUNET_CRYPTO_eddsa_key_create_from_file (KEYFILE);
-  GNUNET_assert (NULL != key);
-  GNUNET_CRYPTO_eddsa_key_get_public (key, &p1);
-  GNUNET_free (key);
-  key = GNUNET_CRYPTO_eddsa_key_create_from_file (KEYFILE);
-  GNUNET_assert (NULL != key);
-  GNUNET_CRYPTO_eddsa_key_get_public (key, &p2);
-  GNUNET_assert (0 == memcmp (&p1, &p2, sizeof(p1)));
-  GNUNET_free (key);
+  GNUNET_assert (0 <=
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_YES,
+                                                    &key));
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &p1);
+  GNUNET_assert (GNUNET_NO ==
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_YES,
+                                                    &key));
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &p2);
+  GNUNET_assert (0 ==
+                 GNUNET_memcmp (&p1,
+                                &p2));
   GNUNET_assert (0 == unlink (KEYFILE));
-  key = GNUNET_CRYPTO_eddsa_key_create_from_file (KEYFILE);
-  GNUNET_assert (NULL != key);
-  GNUNET_CRYPTO_eddsa_key_get_public (key, &p2);
-  GNUNET_assert (0 != memcmp (&p1, &p2, sizeof(p1)));
-  GNUNET_free (key);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
+                                                    GNUNET_NO,
+                                                    &key));
+  GNUNET_CRYPTO_eddsa_key_get_public (&key,
+                                      &p2);
+  GNUNET_assert (0 !=
+                 GNUNET_memcmp (&p1,
+                                &p2));
   return GNUNET_OK;
 }
 
 
 static void
-perf_keygen ()
+perf_keygen (void)
 {
   struct GNUNET_TIME_Absolute start;
-  struct GNUNET_CRYPTO_EddsaPrivateKey *pk;
+  struct GNUNET_CRYPTO_EddsaPrivateKey pk;
 
   fprintf (stderr, "%s", "W");
   start = GNUNET_TIME_absolute_get ();
   for (unsigned int i = 0; i < 10; i++)
   {
-    fprintf (stderr, "."); fflush (stderr);
-    pk = GNUNET_CRYPTO_eddsa_key_create ();
-    GNUNET_free (pk);
+    fprintf (stderr, ".");
+    fflush (stderr);
+    GNUNET_CRYPTO_eddsa_key_create (&pk);
   }
   fprintf (stderr, "\n");
   printf ("10 EdDSA keys created in %s\n",
@@ -179,22 +207,22 @@ main (int argc, char *argv[])
   if (! gcry_check_version ("1.6.0"))
   {
     fprintf (stderr,
-             _ (
-               "libgcrypt has not the expected version (version %s is 
required).\n"),
+             "libgcrypt has not the expected version (version %s is 
required).\n",
              "1.6.0");
     return 0;
   }
   if (getenv ("GNUNET_GCRYPT_DEBUG"))
     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
-  GNUNET_log_setup ("test-crypto-eddsa", "WARNING", NULL);
-  key = GNUNET_CRYPTO_eddsa_key_create ();
+  GNUNET_log_setup ("test-crypto-eddsa",
+                    "WARNING",
+                    NULL);
+  GNUNET_CRYPTO_eddsa_key_create (&key);
 #if PERF
   if (GNUNET_OK != testSignPerformance ())
     failure_count++;
 #endif
   if (GNUNET_OK != testSignVerify ())
     failure_count++;
-  GNUNET_free (key);
   if (GNUNET_OK != testCreateFromFile ())
     failure_count++;
   GNUNET_assert (0 == unlink (KEYFILE));

-- 
To stop receiving notification emails like this one, please contact
address@hidden.



reply via email to

[Prev in Thread] Current Thread [Next in Thread]