gnunet-svn
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[gnunet] branch master updated: IDENTITY


From: gnunet
Subject: [gnunet] branch master updated: IDENTITY
Date: Sat, 29 Oct 2022 11:08:17 +0200

This is an automated email from the git hooks/post-receive script.

martin-schanzenbach pushed a commit to branch master
in repository gnunet.

The following commit(s) were added to refs/heads/master by this push:
     new 0f2da4636 IDENTITY
     new 0c673248a Merge branch 'master' of git+ssh://git.gnunet.org/gnunet
0f2da4636 is described below

commit 0f2da4636e108c70697c589d9e38781f2bafefba
Author: Martin Schanzenbach <schanzen@gnunet.org>
AuthorDate: Sat Oct 29 18:06:26 2022 +0900

    IDENTITY
    
    This commit is a major rework of the unclean GNUNET_IDENTITY_*Key
    structures and its use in serialized objects (e.g. RPC messages).
    The structures are now no longer to be used directly but instead through
    their serialization helper functions whenever needed.
---
 src/conversation/conversation.h                   |  33 +-
 src/conversation/conversation_api.c               |  38 +-
 src/conversation/conversation_api_call.c          |  12 +-
 src/conversation/gnunet-service-conversation.c    | 105 +++++-
 src/conversation/test_conversation_api.c          |  13 +-
 src/conversation/test_conversation_api_reject.c   |  13 +-
 src/conversation/test_conversation_api_twocalls.c |  13 +-
 src/gns/plugin_gnsrecord_gns.c                    |   2 +-
 src/gnsrecord/gnsrecord_misc.c                    |   2 +-
 src/gnsrecord/gnunet-gnsrecord-tvg.c              |  12 +-
 src/identity/Makefile.am                          |   1 +
 src/identity/gnunet-service-identity.c            |  47 ++-
 src/identity/identity.h                           |  15 +-
 src/identity/identity_api.c                       | 151 ++++++--
 src/identity/identity_api_lookup.c                |  23 +-
 src/identity/identity_api_suffix_lookup.c         |  22 +-
 src/identity/test_identity_messages.sh            |   2 +-
 src/include/gnunet_identity_service.h             |  82 +++-
 src/include/gnunet_reclaim_service.h              |  37 ++
 src/namestore/Makefile.am                         |   1 -
 src/namestore/gnunet-namestore.c                  |  15 +-
 src/namestore/gnunet-service-namestore.c          | 241 ++++++++++--
 src/namestore/namestore.h                         |  65 ++--
 src/namestore/namestore_api.c                     | 137 +++++--
 src/namestore/namestore_api_monitor.c             |  47 ++-
 src/reclaim/Makefile.am                           |   1 +
 src/reclaim/gnunet-service-reclaim.c              | 410 +++++++++++++++++---
 src/reclaim/gnunet-service-reclaim_tickets.c      |  68 +++-
 src/reclaim/reclaim.h                             | 127 ++++---
 src/reclaim/reclaim_api.c                         | 432 ++++++++++++++--------
 src/reclaim/test_did_helper.c                     |   5 +-
 src/reclaim/test_reclaim.conf                     |   6 +-
 src/reclaim/test_reclaim_attribute.sh             |   2 +-
 src/reclaim/test_reclaim_consume.sh               |   6 +-
 src/reclaim/test_reclaim_issue.sh                 |   4 +-
 src/revocation/gnunet-revocation-tvg.c            |   4 +-
 src/revocation/gnunet-revocation.c                |   2 +-
 src/revocation/gnunet-service-revocation.c        |   4 +-
 src/revocation/plugin_block_revocation.c          |  50 +--
 src/revocation/revocation_api.c                   |  27 +-
 40 files changed, 1703 insertions(+), 574 deletions(-)

diff --git a/src/conversation/conversation.h b/src/conversation/conversation.h
index d244f5163..ee4ca372c 100644
--- a/src/conversation/conversation.h
+++ b/src/conversation/conversation.h
@@ -105,9 +105,13 @@ struct ClientPhoneRingMessage
   uint32_t cid GNUNET_PACKED;
 
   /**
-   * Who is calling us?
+   * The identity key length
+   */
+  uint32_t key_len;
+
+  /**
+   * followed by who is calling us?, a public key
    */
-  struct GNUNET_IDENTITY_PublicKey caller_id;
 };
 
 
@@ -230,9 +234,13 @@ struct ClientCallMessage
   struct GNUNET_HashCode line_port;
 
   /**
-   * Identity of the caller.
+   * The identity key length
+   */
+  uint32_t key_len;
+
+  /**
+   * followed by the identity of the caller.
    */
-  struct GNUNET_IDENTITY_PrivateKey caller_id;
 };
 
 
@@ -301,19 +309,24 @@ struct CadetPhoneRingMessage
   uint32_t reserved GNUNET_PACKED;
 
   /**
-   * Who is calling us? (also who is signing).
+   * When does the signature expire?
    */
-  struct GNUNET_IDENTITY_PublicKey caller_id;
+  struct GNUNET_TIME_AbsoluteNBO expiration_time;
 
   /**
-   * When does the signature expire?
+   * The length of the key
    */
-  struct GNUNET_TIME_AbsoluteNBO expiration_time;
+  uint32_t key_len;
+
+  /**
+   * The length of the signature
+   */
+  uint32_t sig_len;
 
   /**
-   * Signature over a `struct CadetPhoneRingInfoPS`
+   * Followed by the public key of who is calling us? (also who is signing).
+   * followed by the signature over a `struct CadetPhoneRingInfoPS`
    */
-  struct GNUNET_IDENTITY_Signature signature;
 };
 
 
diff --git a/src/conversation/conversation_api.c 
b/src/conversation/conversation_api.c
index 2ede33586..9c4c520be 100644
--- a/src/conversation/conversation_api.c
+++ b/src/conversation/conversation_api.c
@@ -238,7 +238,19 @@ transmit_phone_audio (void *cls,
                   e);
 }
 
-
+/**
+ * We received a `struct ClientPhoneRingMessage`
+ *
+ * @param cls the `struct GNUNET_CONVERSATION_Phone`
+ * @param ring the message
+ */
+static enum GNUNET_GenericReturnValue
+check_phone_ring (void *cls,
+                   const struct ClientPhoneRingMessage *ring)
+{
+  //FIXME
+  return GNUNET_OK;
+}
 /**
  * We received a `struct ClientPhoneRingMessage`
  *
@@ -251,7 +263,11 @@ handle_phone_ring (void *cls,
 {
   struct GNUNET_CONVERSATION_Phone *phone = cls;
   struct GNUNET_CONVERSATION_Caller *caller;
+  struct GNUNET_IDENTITY_PublicKey caller_id;
+  size_t key_len;
+  size_t read;
 
+  key_len = ntohl (ring->key_len);
   switch (phone->state)
   {
   case PS_REGISTER:
@@ -259,12 +275,22 @@ handle_phone_ring (void *cls,
     break;
 
   case PS_READY:
+    if ((GNUNET_SYSERR ==
+         GNUNET_IDENTITY_read_public_key_from_buffer (&ring[1],
+                                                      key_len,
+                                                      &caller_id,
+                                                      &read)) ||
+        (read != key_len))
+    {
+      GNUNET_break (0);
+      break;
+    }
     caller = GNUNET_new (struct GNUNET_CONVERSATION_Caller);
     caller->phone = phone;
     GNUNET_CONTAINER_DLL_insert (phone->caller_head,
                                  phone->caller_tail,
                                  caller);
-    caller->caller_id = ring->caller_id;
+    caller->caller_id = caller_id;
     caller->cid = ring->cid;
     caller->state = CS_RINGING;
     phone->event_handler (phone->event_handler_cls,
@@ -562,10 +588,10 @@ static void
 reconnect_phone (struct GNUNET_CONVERSATION_Phone *phone)
 {
   struct GNUNET_MQ_MessageHandler handlers[] = {
-    GNUNET_MQ_hd_fixed_size (phone_ring,
-                             GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_RING,
-                             struct ClientPhoneRingMessage,
-                             phone),
+    GNUNET_MQ_hd_var_size (phone_ring,
+                           GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_RING,
+                           struct ClientPhoneRingMessage,
+                           phone),
     GNUNET_MQ_hd_fixed_size (phone_hangup,
                              GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_HANG_UP,
                              struct ClientPhoneHangupMessage,
diff --git a/src/conversation/conversation_api_call.c 
b/src/conversation/conversation_api_call.c
index 909b603ac..129192bf0 100644
--- a/src/conversation/conversation_api_call.c
+++ b/src/conversation/conversation_api_call.c
@@ -455,6 +455,8 @@ handle_gns_response (void *cls,
   struct GNUNET_CONVERSATION_Call *call = cls;
   struct GNUNET_MQ_Envelope *e;
   struct ClientCallMessage *ccm;
+  const struct GNUNET_IDENTITY_PrivateKey *caller_id;
+  size_t key_len;
 
   (void) was_gns;
   GNUNET_break (NULL != call->gns_lookup);
@@ -472,11 +474,15 @@ handle_gns_response (void *cls,
       GNUNET_memcpy (&call->phone_record,
                      rd[i].data,
                      rd[i].data_size);
-      e = GNUNET_MQ_msg (ccm,
-                         GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_CALL);
+      caller_id = GNUNET_IDENTITY_ego_get_private_key (call->caller_id);
+      key_len = GNUNET_IDENTITY_private_key_get_length (caller_id);
+      e = GNUNET_MQ_msg_extra (ccm, key_len,
+                               GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_CALL);
       ccm->line_port = call->phone_record.line_port;
       ccm->target = call->phone_record.peer;
-      ccm->caller_id = *GNUNET_IDENTITY_ego_get_private_key (call->caller_id);
+      GNUNET_IDENTITY_write_private_key_to_buffer (caller_id,
+                                                   &ccm[1], key_len);
+      ccm->key_len = htonl (key_len);
       GNUNET_MQ_send (call->mq,
                       e);
       call->state = CS_RINGING;
diff --git a/src/conversation/gnunet-service-conversation.c 
b/src/conversation/gnunet-service-conversation.c
index a69c95a80..a551bed1a 100644
--- a/src/conversation/gnunet-service-conversation.c
+++ b/src/conversation/gnunet-service-conversation.c
@@ -729,6 +729,18 @@ handle_client_audio_message (void *cls, const struct 
ClientAudioMessage *msg)
   GNUNET_SERVICE_client_continue (line->client);
 }
 
+/**
+ * Function to handle a ring message incoming over cadet
+ *
+ * @param cls closure, NULL
+ * @param msg the incoming message
+ */
+static enum GNUNET_GenericReturnValue
+check_cadet_ring_message (void *cls, const struct CadetPhoneRingMessage *msg)
+{
+  //FIXME
+  return GNUNET_OK;
+}
 
 /**
  * Function to handle a ring message incoming over cadet
@@ -744,19 +756,40 @@ handle_cadet_ring_message (void *cls, const struct 
CadetPhoneRingMessage *msg)
   struct GNUNET_MQ_Envelope *env;
   struct ClientPhoneRingMessage *cring;
   struct CadetPhoneRingInfoPS rs;
+  struct GNUNET_IDENTITY_PublicKey identity;
+  struct GNUNET_IDENTITY_Signature sig;
+  size_t key_len;
+  size_t sig_len;
+  size_t read;
 
   rs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_CONVERSATION_RING);
   rs.purpose.size = htonl (sizeof(struct CadetPhoneRingInfoPS));
   rs.line_port = line->line_port;
   rs.target_peer = my_identity;
   rs.expiration_time = msg->expiration_time;
-
+  key_len = ntohl (msg->key_len);
+  sig_len = ntohl (msg->sig_len);
+
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_public_key_from_buffer (&msg[1],
+                                                    key_len,
+                                                    &identity,
+                                                    &read)) ||
+      (read != key_len))
+  {
+    GNUNET_break_op (0);
+    destroy_line_cadet_channels (ch);
+    return;
+  }
+  GNUNET_IDENTITY_read_signature_from_buffer (&sig,
+                                              (char*) &msg[1] + read,
+                                              sig_len);
   if (GNUNET_OK !=
       GNUNET_IDENTITY_signature_verify (
         GNUNET_SIGNATURE_PURPOSE_CONVERSATION_RING,
         &rs,
-        &msg->signature,
-        &msg->caller_id))
+        &sig,
+        &identity))
   {
     GNUNET_break_op (0);
     destroy_line_cadet_channels (ch);
@@ -782,9 +815,12 @@ handle_cadet_ring_message (void *cls, const struct 
CadetPhoneRingMessage *msg)
   }
   GNUNET_CADET_receive_done (ch->channel);
   ch->status = CS_CALLEE_RINGING;
-  env = GNUNET_MQ_msg (cring, GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_RING);
+  env = GNUNET_MQ_msg_extra (cring,
+                             key_len,
+                             GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_RING);
   cring->cid = ch->cid;
-  cring->caller_id = msg->caller_id;
+  memcpy (&cring[1], &msg[1], key_len);
+  cring->key_len = msg->key_len;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending RING message to client. CID is %u\n",
               (unsigned int) ch->cid);
@@ -1080,6 +1116,18 @@ inbound_end (void *cls, const struct 
GNUNET_CADET_Channel *channel)
   clean_up_channel (ch);
 }
 
+/**
+ * Function to handle call request from the client
+ *
+ * @param cls the `struct Line` the message is about
+ * @param msg the message from the client
+ */
+static enum GNUNET_GenericReturnValue
+check_client_call_message (void *cls, const struct ClientCallMessage *msg)
+{
+  // FIXME
+  return GNUNET_OK;
+}
 
 /**
  * Function to handle call request from the client
@@ -1117,6 +1165,14 @@ handle_client_call_message (void *cls, const struct 
ClientCallMessage *msg)
   struct GNUNET_MQ_Envelope *e;
   struct CadetPhoneRingMessage *ring;
   struct CadetPhoneRingInfoPS rs;
+  struct GNUNET_IDENTITY_PrivateKey caller_id;
+  struct GNUNET_IDENTITY_PublicKey caller_id_pub;
+  struct GNUNET_IDENTITY_Signature sig;
+  ssize_t written;
+  size_t key_len;
+  size_t pkey_len;
+  size_t sig_len;
+  size_t read;
 
   line->line_port = msg->line_port;
   rs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_CONVERSATION_RING);
@@ -1136,10 +1192,27 @@ handle_client_call_message (void *cls, const struct 
ClientCallMessage *msg)
                                              &inbound_end,
                                              cadet_handlers);
   ch->mq = GNUNET_CADET_get_mq (ch->channel);
-  e = GNUNET_MQ_msg (ring, GNUNET_MESSAGE_TYPE_CONVERSATION_CADET_PHONE_RING);
-  GNUNET_IDENTITY_key_get_public (&msg->caller_id, &ring->caller_id);
+  key_len = ntohl (msg->key_len);
+  GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                key_len,
+                                                &caller_id,
+                                                &read);
+  GNUNET_assert (read == key_len);
+  GNUNET_IDENTITY_sign (&caller_id, &rs, &sig);
+  sig_len = GNUNET_IDENTITY_signature_get_length (&sig);
+  GNUNET_IDENTITY_key_get_public (&caller_id, &caller_id_pub);
+  pkey_len = GNUNET_IDENTITY_public_key_get_length (&caller_id_pub);
+  e = GNUNET_MQ_msg_extra (ring, pkey_len + sig_len,
+                           GNUNET_MESSAGE_TYPE_CONVERSATION_CADET_PHONE_RING);
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&caller_id_pub,
+                                                        &ring[1],
+                                                        pkey_len);
   ring->expiration_time = rs.expiration_time;
-  GNUNET_IDENTITY_sign (&msg->caller_id, &rs, &ring->signature);
+  ring->key_len = htonl (pkey_len);
+  ring->sig_len = htonl (sig_len);
+  GNUNET_IDENTITY_write_signature_to_buffer (&sig,
+                                             (char *) &ring[1] + written,
+                                             sig_len);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending RING message via CADET\n");
   GNUNET_MQ_send (ch->mq, e);
   GNUNET_SERVICE_client_continue (line->client);
@@ -1246,10 +1319,10 @@ handle_client_register_message (void *cls,
 {
   struct Line *line = cls;
   struct GNUNET_MQ_MessageHandler cadet_handlers[] =
-  { GNUNET_MQ_hd_fixed_size (cadet_ring_message,
-                             GNUNET_MESSAGE_TYPE_CONVERSATION_CADET_PHONE_RING,
-                             struct CadetPhoneRingMessage,
-                             NULL),
+  { GNUNET_MQ_hd_var_size (cadet_ring_message,
+                           GNUNET_MESSAGE_TYPE_CONVERSATION_CADET_PHONE_RING,
+                           struct CadetPhoneRingMessage,
+                           NULL),
     GNUNET_MQ_hd_fixed_size (cadet_hangup_message,
                              
GNUNET_MESSAGE_TYPE_CONVERSATION_CADET_PHONE_HANG_UP,
                              struct CadetPhoneHangupMessage,
@@ -1367,10 +1440,10 @@ GNUNET_SERVICE_MAIN (
                            GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_HANG_UP,
                            struct ClientPhoneHangupMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (client_call_message,
-                           GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_CALL,
-                           struct ClientCallMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (client_call_message,
+                         GNUNET_MESSAGE_TYPE_CONVERSATION_CS_PHONE_CALL,
+                         struct ClientCallMessage,
+                         NULL),
   GNUNET_MQ_hd_var_size (client_audio_message,
                          GNUNET_MESSAGE_TYPE_CONVERSATION_CS_AUDIO,
                          struct ClientAudioMessage,
diff --git a/src/conversation/test_conversation_api.c 
b/src/conversation/test_conversation_api.c
index 41ef75821..22e9b1dd9 100644
--- a/src/conversation/test_conversation_api.c
+++ b/src/conversation/test_conversation_api.c
@@ -386,21 +386,20 @@ call_event_handler (void *cls, enum 
GNUNET_CONVERSATION_CallEventCode code)
 static void
 caller_ego_create_cont (void *cls,
                         const struct GNUNET_IDENTITY_PrivateKey *pk,
-                        const char *emsg)
+                        enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
 static void
-namestore_put_cont (void *cls, int32_t success, const char *emsg)
+namestore_put_cont (void *cls, enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   qe = NULL;
-  GNUNET_assert (GNUNET_YES == success);
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
   GNUNET_assert (NULL == op);
   op = GNUNET_IDENTITY_create (id, "caller-ego", NULL,
                                GNUNET_IDENTITY_TYPE_ECDSA,
@@ -468,11 +467,11 @@ identity_cb (void *cls,
 static void
 phone_ego_create_cont (void *cls,
                        const struct GNUNET_IDENTITY_PrivateKey *pk,
-                       const char *emsg)
+                       enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
diff --git a/src/conversation/test_conversation_api_reject.c 
b/src/conversation/test_conversation_api_reject.c
index 15728123b..a7aab069f 100644
--- a/src/conversation/test_conversation_api_reject.c
+++ b/src/conversation/test_conversation_api_reject.c
@@ -239,21 +239,20 @@ call_event_handler (void *cls, enum 
GNUNET_CONVERSATION_CallEventCode code)
 static void
 caller_ego_create_cont (void *cls,
                         const struct GNUNET_IDENTITY_PrivateKey *pk,
-                        const char *emsg)
+                        enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
 static void
-namestore_put_cont (void *cls, int32_t success, const char *emsg)
+namestore_put_cont (void *cls, enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   qe = NULL;
-  GNUNET_assert (GNUNET_YES == success);
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
   GNUNET_assert (NULL == op);
   op = GNUNET_IDENTITY_create (id, "caller-ego", NULL,
                                GNUNET_IDENTITY_TYPE_ECDSA,
@@ -321,11 +320,11 @@ identity_cb (void *cls,
 static void
 phone_ego_create_cont (void *cls,
                        const struct GNUNET_IDENTITY_PrivateKey *pk,
-                       const char *emsg)
+                       enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
diff --git a/src/conversation/test_conversation_api_twocalls.c 
b/src/conversation/test_conversation_api_twocalls.c
index 9abf91d0b..1bd2b4e22 100644
--- a/src/conversation/test_conversation_api_twocalls.c
+++ b/src/conversation/test_conversation_api_twocalls.c
@@ -508,21 +508,20 @@ call_event_handler (void *cls, enum 
GNUNET_CONVERSATION_CallEventCode code)
 static void
 caller_ego_create_cont (void *cls,
                         const struct GNUNET_IDENTITY_PrivateKey *pk,
-                        const char *emsg)
+                        enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
 static void
-namestore_put_cont (void *cls, int32_t success, const char *emsg)
+namestore_put_cont (void *cls, enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   qe = NULL;
-  GNUNET_assert (GNUNET_YES == success);
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
   GNUNET_assert (NULL == op);
   op = GNUNET_IDENTITY_create (id, "caller-ego", NULL,
                                GNUNET_IDENTITY_TYPE_ECDSA,
@@ -597,11 +596,11 @@ identity_cb (void *cls,
 static void
 phone_ego_create_cont (void *cls,
                        const struct GNUNET_IDENTITY_PrivateKey *pk,
-                       const char *emsg)
+                       enum GNUNET_ErrorCode ec)
 {
   (void) cls;
   op = NULL;
-  GNUNET_assert (NULL == emsg);
+  GNUNET_assert (GNUNET_EC_NONE == ec);
 }
 
 
diff --git a/src/gns/plugin_gnsrecord_gns.c b/src/gns/plugin_gnsrecord_gns.c
index 0ce782a43..296957f19 100644
--- a/src/gns/plugin_gnsrecord_gns.c
+++ b/src/gns/plugin_gnsrecord_gns.c
@@ -178,7 +178,7 @@ gns_string_to_value (void *cls,
                   s);
       return GNUNET_SYSERR;
     }
-    *data_size = GNUNET_IDENTITY_key_get_length (&pk);
+    *data_size = GNUNET_IDENTITY_public_key_get_length (&pk);
     if (GNUNET_OK !=
         GNUNET_GNSRECORD_data_from_identity (&pk,
                                              (char **) data,
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 742eaf186..97ca7b135 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -304,7 +304,7 @@ GNUNET_GNSRECORD_data_from_identity (const struct
 {
   char *tmp;
   *type = ntohl (key->type);
-  *data_size = GNUNET_IDENTITY_key_get_length (key) - sizeof (key->type);
+  *data_size = GNUNET_IDENTITY_public_key_get_length (key) - sizeof 
(key->type);
   if (0 == *data_size)
     return GNUNET_SYSERR;
   tmp = GNUNET_malloc (*data_size);
diff --git a/src/gnsrecord/gnunet-gnsrecord-tvg.c 
b/src/gnsrecord/gnunet-gnsrecord-tvg.c
index 4d5eb73b3..91abe1954 100644
--- a/src/gnsrecord/gnunet-gnsrecord-tvg.c
+++ b/src/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -154,10 +154,10 @@ run_pkey (struct GNUNET_GNSRECORD_Data *rd, int rd_count, 
const char *label)
                 sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey), 8, 1);
   printf ("\n");
   printf ("Zone identifier (ztype|zkey):\n");
-  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
-  print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
+  GNUNET_assert (0 < GNUNET_IDENTITY_public_key_get_length (&id_pub));
+  print_bytes (&id_pub, GNUNET_IDENTITY_public_key_get_length (&id_pub), 8);
   GNUNET_STRINGS_data_to_string (&id_pub,
-                                 GNUNET_IDENTITY_key_get_length (&id_pub),
+                                 GNUNET_IDENTITY_public_key_get_length 
(&id_pub),
                                  ztld,
                                  sizeof (ztld));
   printf ("\n");
@@ -280,10 +280,10 @@ run_edkey (struct GNUNET_GNSRECORD_Data *rd, int 
rd_count, const char*label)
                                            GNUNET_CRYPTO_EddsaPrivateKey), 8);
   printf ("\n");
   printf ("Zone identifier (ztype|zkey):\n");
-  GNUNET_assert (0 < GNUNET_IDENTITY_key_get_length (&id_pub));
-  print_bytes (&id_pub, GNUNET_IDENTITY_key_get_length (&id_pub), 8);
+  GNUNET_assert (0 < GNUNET_IDENTITY_public_key_get_length (&id_pub));
+  print_bytes (&id_pub, GNUNET_IDENTITY_public_key_get_length (&id_pub), 8);
   GNUNET_STRINGS_data_to_string (&id_pub,
-                                 GNUNET_IDENTITY_key_get_length (&id_pub),
+                                 GNUNET_IDENTITY_public_key_get_length 
(&id_pub),
                                  ztld,
                                  sizeof (ztld));
   printf ("\n");
diff --git a/src/identity/Makefile.am b/src/identity/Makefile.am
index 12d3906a8..be6bbf822 100644
--- a/src/identity/Makefile.am
+++ b/src/identity/Makefile.am
@@ -54,6 +54,7 @@ libexec_PROGRAMS = \
 gnunet_service_identity_SOURCES = \
  gnunet-service-identity.c
 gnunet_service_identity_LDADD = \
+  libgnunetidentity.la \
   $(top_builddir)/src/statistics/libgnunetstatistics.la \
   $(top_builddir)/src/util/libgnunetutil.la \
   $(GN_LIBINTL)
diff --git a/src/identity/gnunet-service-identity.c 
b/src/identity/gnunet-service-identity.c
index 5e3f7bb35..f1156e0b6 100644
--- a/src/identity/gnunet-service-identity.c
+++ b/src/identity/gnunet-service-identity.c
@@ -236,13 +236,18 @@ create_update_message (struct Ego *ego)
   struct UpdateMessage *um;
   struct GNUNET_MQ_Envelope *env;
   size_t name_len;
+  ssize_t key_len;
 
+  key_len = GNUNET_IDENTITY_private_key_get_length (&ego->pk);
   name_len = (NULL == ego->identifier) ? 0 : (strlen (ego->identifier) + 1);
-  env = GNUNET_MQ_msg_extra (um, name_len, 
GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
+  env = GNUNET_MQ_msg_extra (um, name_len + key_len,
+                             GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
   um->name_len = htons (name_len);
   um->end_of_list = htons (GNUNET_NO);
-  um->private_key = ego->pk;
   GNUNET_memcpy (&um[1], ego->identifier, name_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (&ego->pk,
+                                               ((char*) &um[1]) + name_len,
+                                               key_len);
   return env;
 }
 
@@ -412,15 +417,19 @@ notify_listeners (struct Ego *ego)
 {
   struct UpdateMessage *um;
   size_t name_len;
+  ssize_t key_len;
 
   name_len = (NULL == ego->identifier) ? 0 : (strlen (ego->identifier) + 1);
-  um = GNUNET_malloc (sizeof(struct UpdateMessage) + name_len);
+  key_len = GNUNET_IDENTITY_private_key_get_length (&ego->pk);
+  um = GNUNET_malloc (sizeof(struct UpdateMessage) + name_len + key_len);
   um->header.type = htons (GNUNET_MESSAGE_TYPE_IDENTITY_UPDATE);
-  um->header.size = htons (sizeof(struct UpdateMessage) + name_len);
+  um->header.size = htons (sizeof(struct UpdateMessage) + name_len + key_len);
   um->name_len = htons (name_len);
   um->end_of_list = htons (GNUNET_NO);
-  um->private_key = ego->pk;
   GNUNET_memcpy (&um[1], ego->identifier, name_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (&ego->pk,
+                                               ((char*) &um[1]) + name_len,
+                                               key_len);
   GNUNET_notification_context_broadcast (nc, &um->header, GNUNET_NO);
   GNUNET_free (um);
 }
@@ -439,6 +448,7 @@ check_create_message (void *cls,
 {
   uint16_t size;
   uint16_t name_len;
+  size_t key_len;
   const char *str;
 
   size = ntohs (msg->header.size);
@@ -448,13 +458,14 @@ check_create_message (void *cls,
     return GNUNET_SYSERR;
   }
   name_len = ntohs (msg->name_len);
+  key_len = ntohl (msg->key_len);
   GNUNET_break (0 == ntohs (msg->reserved));
-  if (name_len + sizeof(struct CreateRequestMessage) != size)
+  if (name_len + key_len + sizeof(struct CreateRequestMessage) != size)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  str = (const char *) &msg[1];
+  str = (const char *) &msg[1] + key_len;
   if ('\0' != str[name_len - 1])
   {
     GNUNET_break (0);
@@ -474,14 +485,28 @@ static void
 handle_create_message (void *cls,
                        const struct CreateRequestMessage *crm)
 {
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   struct GNUNET_SERVICE_Client *client = cls;
   struct Ego *ego;
   char *str;
   char *fn;
+  size_t key_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREATE message from 
client\n");
-  str = GNUNET_strdup ((const char *) &crm[1]);
-  GNUNET_STRINGS_utf8_tolower ((const char *) &crm[1], str);
+  key_len = ntohl (crm->key_len);
+  if ((GNUNET_SYSERR ==
+      GNUNET_IDENTITY_read_private_key_from_buffer (&crm[1],
+                                                    key_len,
+                                                    &private_key,
+                                                    &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_SERVICE_client_drop (client);
+    return;
+  }
+  str = GNUNET_strdup ((const char *) &crm[1] + key_len);
+  GNUNET_STRINGS_utf8_tolower ((const char *) &crm[1] + key_len, str);
   for (ego = ego_head; NULL != ego; ego = ego->next)
   {
     if (0 == strcmp (ego->identifier, str))
@@ -494,7 +519,7 @@ handle_create_message (void *cls,
     }
   }
   ego = GNUNET_new (struct Ego);
-  ego->pk = crm->private_key;
+  ego->pk = private_key;
   ego->identifier = GNUNET_strdup (str);
   GNUNET_CONTAINER_DLL_insert (ego_head,
                                ego_tail,
@@ -503,7 +528,7 @@ handle_create_message (void *cls,
   fn = get_ego_filename (ego);
   if (GNUNET_OK !=
       GNUNET_DISK_fn_write (fn,
-                            &crm->private_key,
+                            &private_key,
                             sizeof(struct GNUNET_IDENTITY_PrivateKey),
                             GNUNET_DISK_PERM_USER_READ
                             | GNUNET_DISK_PERM_USER_WRITE))
diff --git a/src/identity/identity.h b/src/identity/identity.h
index 57ce091b8..dc57ee11e 100644
--- a/src/identity/identity.h
+++ b/src/identity/identity.h
@@ -128,12 +128,8 @@ struct UpdateMessage
    */
   uint16_t end_of_list GNUNET_PACKED;
 
-  /**
-   * The private key
-   */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
-
   /* followed by 0-terminated ego name */
+  /* followed by the private key */
 };
 
 
@@ -158,12 +154,11 @@ struct CreateRequestMessage
    */
   uint16_t reserved GNUNET_PACKED;
 
-  /**
-   * The private key
-   */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by 0-terminated identity name */
+  /*
+   * Followed by the private key
+   * followed by 0-terminated identity name */
 };
 
 
diff --git a/src/identity/identity_api.c b/src/identity/identity_api.c
index d41e05104..4abd62434 100644
--- a/src/identity/identity_api.c
+++ b/src/identity/identity_api.c
@@ -164,7 +164,7 @@ GNUNET_IDENTITY_ego_get_anonymous ()
   anon.pub.type = htonl (GNUNET_IDENTITY_TYPE_ECDSA);
   anon.pk.ecdsa_key = *GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
   GNUNET_CRYPTO_hash (&anon.pk,
-                      sizeof(anon.pk),
+                      GNUNET_IDENTITY_private_key_get_length (&anon.pk),
                       &anon.id);
   setup = 1;
   return &anon;
@@ -194,8 +194,7 @@ GNUNET_IDENTITY_key_get_public (const struct
   return GNUNET_OK;
 }
 
-
-static int
+static enum GNUNET_GenericReturnValue
 private_key_create (enum GNUNET_IDENTITY_KeyType ktype,
                     struct GNUNET_IDENTITY_PrivateKey *key)
 {
@@ -368,7 +367,7 @@ check_identity_update (void *cls,
   uint16_t name_len = ntohs (um->name_len);
   const char *str = (const char *) &um[1];
 
-  if ((size != name_len + sizeof(struct UpdateMessage)) ||
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
       ((0 != name_len) && ('\0' != str[name_len - 1])))
   {
     GNUNET_break (0);
@@ -390,9 +389,13 @@ handle_identity_update (void *cls,
 {
   struct GNUNET_IDENTITY_Handle *h = cls;
   uint16_t name_len = ntohs (um->name_len);
-  const char *str = (0 == name_len) ? NULL : (const char *) &um[1];
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
   struct GNUNET_HashCode id;
   struct GNUNET_IDENTITY_Ego *ego;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
+  const char *tmp;
 
   if (GNUNET_YES == ntohs (um->end_of_list))
   {
@@ -401,8 +404,18 @@ handle_identity_update (void *cls,
       h->cb (h->cb_cls, NULL, NULL, NULL);
     return;
   }
-  GNUNET_CRYPTO_hash (&um->private_key,
-                      sizeof (um->private_key),
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->header.size) - name_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (tmp + name_len,
+                                                               key_len,
+                                                               &private_key,
+                                                               &kb_read));
+  GNUNET_assert (0 <= GNUNET_IDENTITY_private_key_get_length (&private_key));
+  GNUNET_CRYPTO_hash (&private_key,
+                      GNUNET_IDENTITY_private_key_get_length (&private_key),
                       &id);
   ego = GNUNET_CONTAINER_multihashmap_get (h->egos,
                                            &id);
@@ -418,7 +431,7 @@ handle_identity_update (void *cls,
     }
     ego = GNUNET_new (struct GNUNET_IDENTITY_Ego);
     ego->pub_initialized = GNUNET_NO;
-    ego->pk = um->private_key;
+    ego->pk = private_key;
     ego->name = GNUNET_strdup (str);
     ego->id = id;
     GNUNET_assert (GNUNET_YES ==
@@ -572,10 +585,12 @@ GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
                         GNUNET_IDENTITY_CreateContinuation cont,
                         void *cont_cls)
 {
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   struct GNUNET_IDENTITY_Operation *op;
   struct GNUNET_MQ_Envelope *env;
   struct CreateRequestMessage *crm;
   size_t slen;
+  size_t key_len;
 
   if (NULL == h->mq)
     return NULL;
@@ -590,18 +605,23 @@ GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
   op->create_cont = cont;
   op->cls = cont_cls;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
-  env = GNUNET_MQ_msg_extra (crm, slen, GNUNET_MESSAGE_TYPE_IDENTITY_CREATE);
-  crm->name_len = htons (slen);
-  crm->reserved = htons (0);
   if (NULL == privkey)
   {
     GNUNET_assert (GNUNET_OK ==
-                   private_key_create (ktype, &crm->private_key));
+                   private_key_create (ktype, &private_key));
   }
   else
-    crm->private_key = *privkey;
-  op->pk = crm->private_key;
-  GNUNET_memcpy (&crm[1], name, slen);
+    private_key = *privkey;
+  key_len = GNUNET_IDENTITY_private_key_get_length (&private_key);
+  env = GNUNET_MQ_msg_extra (crm, slen + key_len, 
GNUNET_MESSAGE_TYPE_IDENTITY_CREATE);
+  crm->name_len = htons (slen);
+  crm->reserved = htons (0);
+  GNUNET_IDENTITY_write_private_key_to_buffer (&private_key,
+                                               &crm[1],
+                                               key_len);
+  crm->key_len = htonl (key_len);
+  op->pk = private_key;
+  GNUNET_memcpy ((char*) &crm[1] + key_len, name, slen);
   GNUNET_MQ_send (h->mq, env);
   return op;
 }
@@ -780,8 +800,9 @@ check_key_type (uint32_t type)
 }
 
 
-static ssize_t
-private_key_get_length (const struct GNUNET_IDENTITY_PrivateKey *key)
+ssize_t
+GNUNET_IDENTITY_private_key_get_length (const struct
+                                        GNUNET_IDENTITY_PrivateKey *key)
 {
   switch (ntohl (key->type))
   {
@@ -792,6 +813,8 @@ private_key_get_length (const struct 
GNUNET_IDENTITY_PrivateKey *key)
     return sizeof (key->type) + sizeof (key->eddsa_key);
     break;
   default:
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Got key type %u\n", ntohl (key->type));
     GNUNET_break (0);
   }
   return -1;
@@ -799,7 +822,8 @@ private_key_get_length (const struct 
GNUNET_IDENTITY_PrivateKey *key)
 
 
 ssize_t
-GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key)
+GNUNET_IDENTITY_public_key_get_length (const struct
+                                       GNUNET_IDENTITY_PublicKey *key)
 {
   switch (ntohl (key->type))
   {
@@ -813,36 +837,99 @@ GNUNET_IDENTITY_key_get_length (const struct 
GNUNET_IDENTITY_PublicKey *key)
   return -1;
 }
 
-
 ssize_t
-GNUNET_IDENTITY_read_key_from_buffer (struct GNUNET_IDENTITY_PublicKey *key,
-                                      const void *buffer,
-                                      size_t len)
+GNUNET_IDENTITY_private_key_length_by_type (enum GNUNET_IDENTITY_KeyType kt)
+{
+  switch (kt)
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+    break;
+  case GNUNET_IDENTITY_TYPE_EDDSA:
+    return sizeof (struct GNUNET_CRYPTO_EcdsaPrivateKey);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_read_public_key_from_buffer (const void *buffer,
+                                             size_t len,
+                                             struct GNUNET_IDENTITY_PublicKey *
+                                             key,
+                                             size_t *kb_read)
 {
   if (len < sizeof (key->type))
-    return -1;
+    return GNUNET_SYSERR;
   GNUNET_memcpy (&key->type,
                  buffer,
                  sizeof (key->type));
-  ssize_t length = GNUNET_IDENTITY_key_get_length (key);
+  ssize_t length = GNUNET_IDENTITY_public_key_get_length (key);
+  if (len < length)
+    return GNUNET_SYSERR;
+  if (length < 0)
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->ecdsa_key,
+                 buffer + sizeof (key->type),
+                 length - sizeof (key->type));
+  *kb_read = length;
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_IDENTITY_write_public_key_to_buffer (const struct
+                                            GNUNET_IDENTITY_PublicKey *key,
+                                            void*buffer,
+                                            size_t len)
+{
+  const ssize_t length = GNUNET_IDENTITY_public_key_get_length (key);
   if (len < length)
     return -1;
   if (length < 0)
     return -2;
+  GNUNET_memcpy (buffer, &(key->type), sizeof (key->type));
+  GNUNET_memcpy (buffer + sizeof (key->type), &(key->ecdsa_key), length
+                 - sizeof (key->type));
+  return length;
+}
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_read_private_key_from_buffer (const void *buffer,
+                                              size_t len,
+                                              struct
+                                              GNUNET_IDENTITY_PrivateKey *key,
+                                              size_t *kb_read)
+{
+  if (len < sizeof (key->type))
+    return GNUNET_SYSERR;
+  GNUNET_memcpy (&key->type,
+                 buffer,
+                 sizeof (key->type));
+  ssize_t length = GNUNET_IDENTITY_private_key_get_length (key);
+  if (len < length)
+    return GNUNET_SYSERR;
+  if (length < 0)
+    return GNUNET_SYSERR;
   GNUNET_memcpy (&key->ecdsa_key,
                  buffer + sizeof (key->type),
                  length - sizeof (key->type));
-  return length;
+  *kb_read = length;
+  return GNUNET_OK;
 }
 
 
 ssize_t
-GNUNET_IDENTITY_write_key_to_buffer (const struct
-                                     GNUNET_IDENTITY_PublicKey *key,
-                                     void*buffer,
-                                     size_t len)
+GNUNET_IDENTITY_write_private_key_to_buffer (const struct
+                                             GNUNET_IDENTITY_PrivateKey *key,
+                                             void *buffer,
+                                             size_t len)
 {
-  const ssize_t length = GNUNET_IDENTITY_key_get_length (key);
+  const ssize_t length = GNUNET_IDENTITY_private_key_get_length (key);
   if (len < length)
     return -1;
   if (length < 0)
@@ -1123,7 +1210,7 @@ char *
 GNUNET_IDENTITY_public_key_to_string (const struct
                                       GNUNET_IDENTITY_PublicKey *key)
 {
-  size_t size = GNUNET_IDENTITY_key_get_length (key);
+  size_t size = GNUNET_IDENTITY_public_key_get_length (key);
   return GNUNET_STRINGS_data_to_string_alloc (key,
                                               size);
 }
@@ -1133,7 +1220,7 @@ char *
 GNUNET_IDENTITY_private_key_to_string (const struct
                                        GNUNET_IDENTITY_PrivateKey *key)
 {
-  size_t size = private_key_get_length (key);
+  size_t size = GNUNET_IDENTITY_private_key_get_length (key);
   return GNUNET_STRINGS_data_to_string_alloc (key,
                                               size);
 }
diff --git a/src/identity/identity_api_lookup.c 
b/src/identity/identity_api_lookup.c
index 51afb2515..4cc0b6334 100644
--- a/src/identity/identity_api_lookup.c
+++ b/src/identity/identity_api_lookup.c
@@ -105,7 +105,7 @@ check_identity_update (void *cls, const struct 
UpdateMessage *um)
   uint16_t name_len = ntohs (um->name_len);
   const char *str = (const char *) &um[1];
 
-  if ((size != name_len + sizeof(struct UpdateMessage)) ||
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
       ((0 != name_len) && ('\0' != str[name_len - 1])))
   {
     GNUNET_break (0);
@@ -126,14 +126,29 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
 {
   struct GNUNET_IDENTITY_EgoLookup *el = cls;
   uint16_t name_len = ntohs (um->name_len);
-  const char *str = (0 == name_len) ? NULL : (const char *) &um[1];
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
   struct GNUNET_HashCode id;
   struct GNUNET_IDENTITY_Ego ego;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
+  const char *tmp;
+
   memset (&ego, 0, sizeof (ego));
 
   GNUNET_break (GNUNET_YES != ntohs (um->end_of_list));
-  GNUNET_CRYPTO_hash (&um->private_key, sizeof(um->private_key), &id);
-  ego.pk = um->private_key;
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->header.size) - sizeof (*um) - name_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (tmp + name_len,
+                                                               key_len,
+                                                               &private_key,
+                                                               &kb_read));
+  GNUNET_assert (key_len == kb_read);
+  GNUNET_CRYPTO_hash (&private_key, sizeof (private_key), &id);
+  ego.pk = private_key;
   ego.name = (char *) str;
   ego.id = id;
   el->cb (el->cb_cls, &ego);
diff --git a/src/identity/identity_api_suffix_lookup.c 
b/src/identity/identity_api_suffix_lookup.c
index 2667ddbc8..fa6bd8310 100644
--- a/src/identity/identity_api_suffix_lookup.c
+++ b/src/identity/identity_api_suffix_lookup.c
@@ -108,7 +108,7 @@ check_identity_update (void *cls, const struct 
UpdateMessage *um)
   const char *str = (const char *) &um[1];
 
   (void) cls;
-  if ((size != name_len + sizeof(struct UpdateMessage)) ||
+  if ((size < name_len + sizeof(struct UpdateMessage)) ||
       ((0 != name_len) && ('\0' != str[name_len - 1])))
   {
     GNUNET_break (0);
@@ -129,9 +129,23 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
 {
   struct GNUNET_IDENTITY_EgoSuffixLookup *el = cls;
   uint16_t name_len = ntohs (um->name_len);
-  const char *str = (0 == name_len) ? NULL : (const char *) &um[1];
-
-  el->cb (el->cb_cls, &um->private_key, str);
+  const char *str;
+  size_t key_len;
+  size_t kb_read;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
+  const char *tmp;
+
+  tmp = (const char*) &um[1];
+  str = (0 == name_len) ? NULL : tmp;
+  memset (&private_key, 0, sizeof (private_key));
+  key_len = ntohs (um->header.size) - name_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (tmp + name_len,
+                                                               key_len,
+                                                               &private_key,
+                                                               &kb_read));
+  GNUNET_assert (key_len == kb_read);
+  el->cb (el->cb_cls, &private_key, str);
   GNUNET_IDENTITY_ego_lookup_by_suffix_cancel (el);
 }
 
diff --git a/src/identity/test_identity_messages.sh 
b/src/identity/test_identity_messages.sh
index daecb1ed2..0879061e4 100755
--- a/src/identity/test_identity_messages.sh
+++ b/src/identity/test_identity_messages.sh
@@ -27,7 +27,7 @@ gnunet-identity -D recipientego -c test_identity.conf
 gnunet-arm -e -c test_identity.conf
 if [ "$TEST_MSG" != "$MSG_DEC" ]
 then
-  echo "Failed - $TEST_MSG != $MSG_DEC"
+  echo "Failed - \"$TEST_MSG\" != \"$MSG_DEC\""
   exit 1
 fi
 
diff --git a/src/include/gnunet_identity_service.h 
b/src/include/gnunet_identity_service.h
index d234ff552..cd745ba51 100644
--- a/src/include/gnunet_identity_service.h
+++ b/src/include/gnunet_identity_service.h
@@ -85,11 +85,10 @@ struct GNUNET_IDENTITY_Handle;
  */
 struct GNUNET_IDENTITY_Ego;
 
-// FIXME: these types are NOT packed,
-// NOT 64-bit aligned, but used in messages!!??
-
 /**
  * A private key for an identity as per LSD0001.
+ * Note that these types are NOT packed and MUST NOT be used in RPC
+ * messages. Use the respective serialization functions.
  */
 struct GNUNET_IDENTITY_PrivateKey
 {
@@ -406,8 +405,7 @@ GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation 
*op);
  * @return -1 on error, else the compacted length of the key.
  */
 ssize_t
-GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key);
-
+GNUNET_IDENTITY_public_key_get_length (const struct GNUNET_IDENTITY_PublicKey 
*key);
 
 /**
  * Reads a #GNUNET_IDENTITY_PublicKey from a compact buffer.
@@ -416,15 +414,32 @@ GNUNET_IDENTITY_key_get_length (const struct 
GNUNET_IDENTITY_PublicKey *key);
  * If the buffer is too small, the function returns -1 as error.
  * If the buffer does not contain a valid key, it returns -2 as error.
  *
- * @param key the key
  * @param buffer the buffer
  * @param len the length of buffer
- * @return -1 or -2 on error, else the amount of bytes read from the buffer
+ * @param key the key
+ * @param the amount of bytes read from the buffer
+ * @return GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_read_public_key_from_buffer (const void *buffer,
+                                             size_t len,
+                                             struct
+                                             GNUNET_IDENTITY_PublicKey *key,
+                                             size_t *read);
+
+/**
+ * Get the compacted length of a #GNUNET_IDENTITY_PrivateKey.
+ * Compacted means that it returns the minimum number of bytes this
+ * key is long, as opposed to the union structure inside
+ * #GNUNET_IDENTITY_PrivateKey.
+ * Useful for compact serializations.
+ *
+ * @param key the key.
+ * @return -1 on error, else the compacted length of the key.
  */
 ssize_t
-GNUNET_IDENTITY_read_key_from_buffer (struct GNUNET_IDENTITY_PublicKey *key,
-                                      const void*buffer,
-                                      size_t len);
+GNUNET_IDENTITY_private_key_get_length (const struct
+                                        GNUNET_IDENTITY_PrivateKey *key);
 
 
 /**
@@ -440,10 +455,49 @@ GNUNET_IDENTITY_read_key_from_buffer (struct 
GNUNET_IDENTITY_PublicKey *key,
  * @return -1 or -2 on error, else the amount of bytes written to the buffer
  */
 ssize_t
-GNUNET_IDENTITY_write_key_to_buffer (const struct
-                                     GNUNET_IDENTITY_PublicKey *key,
-                                     void*buffer,
-                                     size_t len);
+GNUNET_IDENTITY_write_public_key_to_buffer (const struct
+                                            GNUNET_IDENTITY_PublicKey *key,
+                                            void*buffer,
+                                            size_t len);
+
+
+/**
+ * Reads a #GNUNET_IDENTITY_PrivateKey from a compact buffer.
+ * The buffer has to contain at least the compacted length of
+ * a #GNUNET_IDENTITY_PrivateKey in bytes.
+ * If the buffer is too small, the function returns GNUNET_SYSERR as error.
+ *
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @param key the key
+ * @param the amount of bytes read from the buffer
+ * @return GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_read_private_key_from_buffer (const void*buffer,
+                                              size_t len,
+                                              struct
+                                              GNUNET_IDENTITY_PrivateKey *key,
+                                              size_t *read);
+
+
+/**
+ * Writes a #GNUNET_IDENTITY_PrivateKey to a compact buffer.
+ * The buffer requires space for at least the compacted length of
+ * a #GNUNET_IDENTITY_PrivateKey in bytes.
+ * If the buffer is too small, the function returns -1 as error.
+ * If the key is not valid, it returns -2 as error.
+ *
+ * @param key the key
+ * @param buffer the buffer
+ * @param len the length of buffer
+ * @return -1 or -2 on error, else the amount of bytes written to the buffer
+ */
+ssize_t
+GNUNET_IDENTITY_write_private_key_to_buffer (const struct
+                                             GNUNET_IDENTITY_PrivateKey *key,
+                                             void*buffer,
+                                             size_t len);
 
 
 /**
diff --git a/src/include/gnunet_reclaim_service.h 
b/src/include/gnunet_reclaim_service.h
index e9e0f144d..a3f6c19b6 100644
--- a/src/include/gnunet_reclaim_service.h
+++ b/src/include/gnunet_reclaim_service.h
@@ -498,6 +498,43 @@ GNUNET_RECLAIM_disconnect (struct GNUNET_RECLAIM_Handle 
*h);
 void
 GNUNET_RECLAIM_cancel (struct GNUNET_RECLAIM_Operation *op);
 
+/**
+ * Get serialized ticket size
+ *
+ * @param tkt the ticket
+ * @return the buffer length requirement for a serialization
+ */
+size_t
+GNUNET_RECLAIM_ticket_serialize_get_size (const struct GNUNET_RECLAIM_Ticket 
*tkt);
+
+/**
+ * Deserializes a ticket
+ *
+ * @param buffer the buffer to read from
+ * @param len the length of the buffer
+ * @param tkt the ticket to write to (must be allocated)
+ * @param kb_read how many bytes were read from buffer
+ * @return GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_RECLAIM_read_ticket_from_buffer (const void *buffer,
+                                        size_t len,
+                                        struct GNUNET_RECLAIM_Ticket *tkt,
+                                        size_t *tb_read);
+
+/**
+ * Serializes a ticket
+ *
+ * @param tkt the ticket to serialize
+ * @param buffer the buffer to serialize to (must be allocated with sufficient 
size
+ * @param len the length of the buffer
+ * @return the number of written bytes or < 0 on error
+ */
+ssize_t
+GNUNET_RECLAIM_write_ticket_to_buffer (const struct
+                                       GNUNET_RECLAIM_Ticket *tkt,
+                                       void *buffer,
+                                       size_t len);
 
 #if 0 /* keep Emacsens' auto-indent happy */
 {
diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index 2a1558e09..fb2a670bc 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -179,7 +179,6 @@ gnunet_namestore_fcfsd_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
 
 gnunet_service_namestore_SOURCES = \
  gnunet-service-namestore.c
-
 gnunet_service_namestore_LDADD = \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 843158c68..6444d446d 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -128,11 +128,6 @@ static struct GNUNET_IDENTITY_EgoLookup *el;
  */
 static struct GNUNET_IDENTITY_Handle *idh;
 
-/**
- * Obtain default ego
- */
-struct GNUNET_IDENTITY_Operation *get_default;
-
 /**
  * Name of the ego controlling the zone.
  */
@@ -342,10 +337,10 @@ do_shutdown (void *cls)
   struct MarkedRecord *mrec;
   struct MarkedRecord *mrec_tmp;
   (void) cls;
-  if (NULL != get_default)
+  if (NULL != ego_name)
   {
-    GNUNET_IDENTITY_cancel (get_default);
-    get_default = NULL;
+    GNUNET_free (ego_name);
+    ego_name = NULL;
   }
   if (NULL != purge_task)
   {
@@ -1530,7 +1525,7 @@ run_with_zone_pkey (const struct 
GNUNET_CONFIGURATION_Handle *cfg)
     }
     memset (&rd, 0, sizeof(rd));
     rd.data = &pkey;
-    rd.data_size = GNUNET_IDENTITY_key_get_length (&pkey);
+    rd.data_size = GNUNET_IDENTITY_public_key_get_length (&pkey);
     rd.record_type = ntohl (pkey.type);
     rd.expiration_time = etime;
     if (GNUNET_YES == etime_is_rel)
@@ -1589,8 +1584,6 @@ identity_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     return;
   }
   zone_pkey = *GNUNET_IDENTITY_ego_get_private_key (ego);
-  GNUNET_free (ego_name);
-  ego_name = NULL;
   run_with_zone_pkey (cfg);
 }
 
diff --git a/src/namestore/gnunet-service-namestore.c 
b/src/namestore/gnunet-service-namestore.c
index 92c81c4eb..f0739cbeb 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -711,6 +711,7 @@ send_lookup_response_with_filter (struct NamestoreClient 
*nc,
   unsigned int res_count;
   unsigned int rd_nf_count;
   size_t name_len;
+  size_t key_len;
   ssize_t rd_ser_len;
   char *name_tmp;
   char *rd_ser;
@@ -778,16 +779,20 @@ send_lookup_response_with_filter (struct NamestoreClient 
*nc,
     GNUNET_SERVICE_client_drop (nc->client);
     return 0;
   }
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone_key);
   env = GNUNET_MQ_msg_extra (zir_msg,
-                             name_len + rd_ser_len,
+                             name_len + rd_ser_len + key_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_RESULT);
   zir_msg->gns_header.r_id = htonl (request_id);
   zir_msg->name_len = htons (name_len);
   zir_msg->rd_count = htons (res_count);
   zir_msg->rd_len = htons ((uint16_t) rd_ser_len);
-  zir_msg->private_key = *zone_key;
+  zir_msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone_key,
+                                               &zir_msg[1],
+                                               key_len);
   zir_msg->expire = GNUNET_TIME_absolute_hton (block_exp);
-  name_tmp = (char *) &zir_msg[1];
+  name_tmp = (char *) &zir_msg[1] + key_len;
   GNUNET_memcpy (name_tmp, name, name_len);
   rd_ser = &name_tmp[name_len];
   GNUNET_assert (
@@ -1309,16 +1314,17 @@ check_record_lookup (void *cls, const struct 
LabelLookupMessage *ll_msg)
 {
   uint32_t name_len;
   size_t src_size;
+  size_t key_len;
 
   (void) cls;
   name_len = ntohl (ll_msg->label_len);
+  key_len = ntohl (ll_msg->key_len);
   src_size = ntohs (ll_msg->gns_header.header.size);
-  if (name_len != src_size - sizeof(struct LabelLookupMessage))
+  if (name_len + key_len != src_size - sizeof(struct LabelLookupMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  GNUNET_MQ_check_zero_termination (ll_msg);
   return GNUNET_OK;
 }
 
@@ -1332,6 +1338,7 @@ check_record_lookup (void *cls, const struct 
LabelLookupMessage *ll_msg)
 static void
 handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct GNUNET_MQ_Envelope *env;
   struct LabelLookupResponseMessage *llr_msg;
@@ -1341,8 +1348,23 @@ handle_record_lookup (void *cls, const struct 
LabelLookupMessage *ll_msg)
   char *conv_name;
   uint32_t name_len;
   int res;
-
-  name_tmp = (const char *) &ll_msg[1];
+  size_t key_len;
+  size_t kb_read;
+
+  key_len = ntohl (ll_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ll_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error reading private key\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
+  name_tmp = (const char *) &ll_msg[1] + key_len;
   GNUNET_SERVICE_client_continue (nc->client);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received NAMESTORE_RECORD_LOOKUP message for name `%s'\n",
@@ -1366,37 +1388,38 @@ handle_record_lookup (void *cls, const struct 
LabelLookupMessage *ll_msg)
   rlc.res_rd_count = 0;
   rlc.res_rd = NULL;
   rlc.rd_ser_len = 0;
-  rlc.nick = get_nick_record (&ll_msg->zone);
+  rlc.nick = get_nick_record (&zone);
   if (GNUNET_YES != ntohl (ll_msg->is_edit_request))
     res = nc->GSN_database->lookup_records (nc->GSN_database->cls,
-                                            &ll_msg->zone,
+                                            &zone,
                                             conv_name,
                                             &lookup_it,
                                             &rlc);
   else
     res = nc->GSN_database->edit_records (nc->GSN_database->cls,
-                                          &ll_msg->zone,
+                                          &zone,
                                           conv_name,
                                           &lookup_it,
                                           &rlc);
 
   env =
     GNUNET_MQ_msg_extra (llr_msg,
-                         name_len + rlc.rd_ser_len,
+                         key_len + name_len + rlc.rd_ser_len,
                          GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP_RESPONSE);
   llr_msg->gns_header.r_id = ll_msg->gns_header.r_id;
-  llr_msg->private_key = ll_msg->zone;
+  GNUNET_memcpy (&llr_msg[1], &ll_msg[1], key_len);
+  llr_msg->key_len = ll_msg->key_len;
   llr_msg->name_len = htons (name_len);
   llr_msg->rd_count = htons (rlc.res_rd_count);
   llr_msg->rd_len = htons (rlc.rd_ser_len);
-  res_name = (char *) &llr_msg[1];
+  res_name = ((char *) &llr_msg[1]) + key_len;
   if (GNUNET_YES == rlc.found)
     llr_msg->found = htons (GNUNET_YES);
   else if (GNUNET_SYSERR == res)
     llr_msg->found = htons (GNUNET_SYSERR);
   else
     llr_msg->found = htons (GNUNET_NO);
-  GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
+  GNUNET_memcpy (res_name, conv_name, name_len);
   GNUNET_memcpy (&res_name[name_len], rlc.res_rd, rlc.rd_ser_len);
   GNUNET_MQ_send (nc->mq, env);
   GNUNET_free (rlc.res_rd);
@@ -1418,11 +1441,14 @@ check_record_store (void *cls, const struct 
RecordStoreMessage *rp_msg)
   size_t msg_size;
   size_t min_size_exp;
   size_t rd_set_count;
+  size_t key_len;
 
   (void) cls;
   msg_size = ntohs (rp_msg->gns_header.header.size);
   rd_set_count = ntohs (rp_msg->rd_set_count);
-  min_size_exp = sizeof(struct RecordStoreMessage) + sizeof (struct RecordSet)
+  key_len = ntohl (rp_msg->key_len);
+
+  min_size_exp = sizeof(*rp_msg) + key_len + sizeof (struct RecordSet)
                  * rd_set_count;
   if (msg_size < min_size_exp)
   {
@@ -1701,24 +1727,40 @@ store_record_set (struct NamestoreClient *nc,
 static void
 handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   uint32_t rid;
   uint16_t rd_set_count;
   const char *buf;
   ssize_t read;
+  size_t key_len;
+  size_t kb_read;
   struct StoreActivity *sa;
   struct RecordSet *rs;
   enum GNUNET_ErrorCode res;
 
+  key_len = ntohl (rp_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&rp_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error reading private key\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received NAMESTORE_RECORD_STORE message\n");
   rid = ntohl (rp_msg->gns_header.r_id);
   rd_set_count = ntohs (rp_msg->rd_set_count);
-  buf = (const char *) &rp_msg[1];
+  buf = (const char *) &rp_msg[1] + key_len;
   for (int i = 0; i < rd_set_count; i++)
   {
     rs = (struct RecordSet *) buf;
-    res = store_record_set (nc, &rp_msg->private_key,
+    res = store_record_set (nc, &zone,
                             rs, &read);
     if (GNUNET_EC_NONE != res)
     {
@@ -1735,11 +1777,11 @@ handle_record_store (void *cls, const struct 
RecordStoreMessage *rp_msg)
   sa->nc = nc;
   sa->rs = (struct RecordSet *) &sa[1];
   sa->rd_set_count = rd_set_count;
-  GNUNET_memcpy (&sa[1], (char *) &rp_msg[1],
+  GNUNET_memcpy (&sa[1], (char *) &rp_msg[1] + key_len,
                  ntohs (rp_msg->gns_header.header.size) - sizeof (*rp_msg));
   sa->rid = rid;
   sa->rd_set_pos = 0;
-  sa->private_key = rp_msg->private_key;
+  sa->private_key = zone;
   sa->zm_pos = monitor_head;
   sa->uncommited = nc->in_transaction;
   continue_store_activity (sa, GNUNET_YES);
@@ -1913,6 +1955,7 @@ handle_zone_to_name_it (void *cls,
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameResponseMessage *ztnr_msg;
   size_t name_len;
+  size_t key_len;
   ssize_t rd_ser_len;
   size_t msg_size;
   char *name_tmp;
@@ -1931,7 +1974,9 @@ handle_zone_to_name_it (void *cls,
     ztn_ctx->ec = htonl (GNUNET_EC_NAMESTORE_UNKNOWN);
     return;
   }
-  msg_size = sizeof(struct ZoneToNameResponseMessage) + name_len + rd_ser_len;
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone_key);
+  msg_size = sizeof(struct ZoneToNameResponseMessage)
+             + name_len + rd_ser_len + key_len;
   if (msg_size >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
@@ -1940,7 +1985,7 @@ handle_zone_to_name_it (void *cls,
   }
   env =
     GNUNET_MQ_msg_extra (ztnr_msg,
-                         name_len + rd_ser_len,
+                         key_len + name_len + rd_ser_len,
                          GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME_RESPONSE);
   ztnr_msg->gns_header.header.size = htons (msg_size);
   ztnr_msg->gns_header.r_id = htonl (ztn_ctx->rid);
@@ -1948,8 +1993,11 @@ handle_zone_to_name_it (void *cls,
   ztnr_msg->rd_len = htons (rd_ser_len);
   ztnr_msg->rd_count = htons (rd_count);
   ztnr_msg->name_len = htons (name_len);
-  ztnr_msg->zone = *zone_key;
-  name_tmp = (char *) &ztnr_msg[1];
+  ztnr_msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone_key,
+                                               &ztnr_msg[1],
+                                               key_len);
+  name_tmp = (char *) &ztnr_msg[1] + key_len;
   GNUNET_memcpy (name_tmp, name, name_len);
   rd_tmp = &name_tmp[name_len];
   GNUNET_assert (
@@ -1959,6 +2007,13 @@ handle_zone_to_name_it (void *cls,
   GNUNET_MQ_send (ztn_ctx->nc->mq, env);
 }
 
+static enum GNUNET_GenericReturnValue
+check_zone_to_name (void *cls,
+                    const struct ZoneToNameMessage *zis_msg)
+{
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME message
@@ -1969,18 +2024,52 @@ handle_zone_to_name_it (void *cls,
 static void
 handle_zone_to_name (void *cls, const struct ZoneToNameMessage *ztn_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
+  struct GNUNET_IDENTITY_PublicKey value_zone;
   struct NamestoreClient *nc = cls;
   struct ZoneToNameCtx ztn_ctx;
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameResponseMessage *ztnr_msg;
+  size_t key_len;
+  size_t pkey_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ZONE_TO_NAME message\n");
   ztn_ctx.rid = ntohl (ztn_msg->gns_header.r_id);
   ztn_ctx.nc = nc;
   ztn_ctx.ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+  key_len = ntohl (ztn_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ztn_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Error parsing private key.\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    GNUNET_break (0);
+    return;
+  }
+  pkey_len = ntohl (ztn_msg->pkey_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_public_key_from_buffer ((char*) &ztn_msg[1]
+                                                    + key_len,
+                                                    pkey_len,
+                                                    &value_zone,
+                                                    &kb_read)) ||
+      (kb_read != pkey_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Error parsing public key.\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    GNUNET_break (0);
+    return;
+  }
   if (GNUNET_SYSERR == nc->GSN_database->zone_to_name (nc->GSN_database->cls,
-                                                       &ztn_msg->zone,
-                                                       &ztn_msg->value_zone,
+                                                       &zone,
+                                                       &value_zone,
                                                        &handle_zone_to_name_it,
                                                        &ztn_ctx))
   {
@@ -2133,6 +2222,24 @@ run_zone_iteration_round (struct ZoneIteration *zi, 
uint64_t limit)
     zone_iteration_done_client_continue (zi);
 }
 
+static enum GNUNET_GenericReturnValue
+check_iteration_start (void *cls,
+                       const struct ZoneIterationStartMessage *zis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (zis_msg->gns_header.header.size);
+  key_len = ntohs (zis_msg->key_len);
+
+  if (size < key_len + sizeof(*zis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START message
@@ -2144,18 +2251,35 @@ static void
 handle_iteration_start (void *cls,
                         const struct ZoneIterationStartMessage *zis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct ZoneIteration *zi;
+  size_t key_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_ITERATION_START message\n");
+  key_len = ntohl (zis_msg->key_len);
   zi = GNUNET_new (struct ZoneIteration);
+  if (0 < key_len)
+  {
+    if ((GNUNET_SYSERR ==
+         GNUNET_IDENTITY_read_private_key_from_buffer (&zis_msg[1],
+                                                       key_len,
+                                                       &zone,
+                                                       &kb_read)) ||
+        (kb_read != key_len))
+    {
+      GNUNET_SERVICE_client_drop (nc->client);
+      GNUNET_free (zi);
+      return;
+    }
+    zi->zone = zone;
+  }
   zi->request_id = ntohl (zis_msg->gns_header.r_id);
   zi->filter = ntohs (zis_msg->filter);
   zi->offset = 0;
   zi->nc = nc;
-  zi->zone = zis_msg->zone;
-
   GNUNET_CONTAINER_DLL_insert (nc->op_head, nc->op_tail, zi);
   run_zone_iteration_round (zi, 1);
 }
@@ -2349,6 +2473,24 @@ monitor_iterate_cb (void *cls,
   }
 }
 
+static enum GNUNET_GenericReturnValue
+check_monitor_start (void *cls,
+                     const struct ZoneMonitorStartMessage *zis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (zis_msg->header.size);
+  key_len = ntohs (zis_msg->key_len);
+
+  if (size < key_len + sizeof(*zis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START message
@@ -2360,14 +2502,33 @@ static void
 handle_monitor_start (void *cls, const struct
                       ZoneMonitorStartMessage *zis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct ZoneMonitor *zm;
+  size_t key_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_MONITOR_START message\n");
   zm = GNUNET_new (struct ZoneMonitor);
   zm->nc = nc;
-  zm->zone = zis_msg->zone;
+  key_len = ntohl (zis_msg->key_len);
+  if (0 < key_len)
+  {
+    if ((GNUNET_SYSERR ==
+         GNUNET_IDENTITY_read_private_key_from_buffer (&zis_msg[1],
+                                                       key_len,
+                                                       &zone,
+                                                       &kb_read)) ||
+        (kb_read != key_len))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Error reading private key\n");
+      GNUNET_SERVICE_client_drop (nc->client);
+      return;
+    }
+    zm->zone = zone;
+  }
   zm->limit = 1;
   zm->filter = ntohs (zis_msg->filter);
   zm->in_first_iteration = (GNUNET_YES == ntohl (zis_msg->iterate_first));
@@ -2557,14 +2718,14 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP,
                          struct LabelLookupMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (zone_to_name,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME,
-                           struct ZoneToNameMessage,
-                           NULL),
-  GNUNET_MQ_hd_fixed_size (iteration_start,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START,
-                           struct ZoneIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (zone_to_name,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME,
+                         struct ZoneToNameMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (iteration_start,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START,
+                         struct ZoneIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (iteration_next,
                            GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT,
                            struct ZoneIterationNextMessage,
@@ -2573,10 +2734,10 @@ GNUNET_SERVICE_MAIN (
                            GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_STOP,
                            struct ZoneIterationStopMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (monitor_start,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START,
-                           struct ZoneMonitorStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (monitor_start,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START,
+                         struct ZoneMonitorStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (monitor_next,
                            GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_NEXT,
                            struct ZoneMonitorNextMessage,
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index 37c1576bc..0b50ac1ab 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -91,16 +91,17 @@ struct RecordStoreMessage
   struct GNUNET_NAMESTORE_Header gns_header;
 
   /**
-   * The private key of the authority.
+   * Number of record sets
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint16_t rd_set_count;
 
   /**
-   * Number of record sets
+   * Length of the zone key
    */
-  uint16_t rd_set_count;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
+   * Followed by the private zone key
    * Followed by rd_set_count RecordSets
    */
 };
@@ -150,11 +151,12 @@ struct LabelLookupMessage
   uint16_t filter;
 
   /**
-   * The private key of the zone to look up in
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    */
 };
@@ -192,11 +194,12 @@ struct LabelLookupResponseMessage
   int16_t found GNUNET_PACKED;
 
   /**
-   * The private key of the authority.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -214,14 +217,20 @@ struct ZoneToNameMessage
   struct GNUNET_NAMESTORE_Header gns_header;
 
   /**
-   * The private key of the zone to look up in
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Length of the public value zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t pkey_len GNUNET_PACKED;
 
   /**
-   * The public key of the target zone
+   * Followed by
+   * - the private zone key to look up in
+   * - the public key of the target zone
    */
-  struct GNUNET_IDENTITY_PublicKey value_zone;
 };
 
 
@@ -259,11 +268,12 @@ struct ZoneToNameResponseMessage
   int32_t ec GNUNET_PACKED;
 
   /**
-   * The private key of the zone that contained the name.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -307,11 +317,12 @@ struct RecordResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The private key of the authority.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private key of the authority
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -386,9 +397,13 @@ struct ZoneMonitorStartMessage
   uint16_t reserved;
 
   /**
-   * Zone key.
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private zone key.
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
 };
 
 
@@ -426,11 +441,6 @@ struct ZoneIterationStartMessage
    */
   struct GNUNET_NAMESTORE_Header gns_header;
 
-  /**
-   * Zone key.  All zeros for "all zones".
-   */
-  struct GNUNET_IDENTITY_PrivateKey zone;
-
   /**
    * Record set filter control flags.
    * See GNUNET_NAMESTORE_Filter enum.
@@ -441,6 +451,15 @@ struct ZoneIterationStartMessage
    * Reserved for alignment
    */
   uint16_t reserved;
+
+  /**
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private zone key (optional)
+   */
 };
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index 41c1fcc73..e020b9e42 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -401,18 +401,20 @@ check_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
   size_t msg_len;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
 
   (void) cls;
   rd_len = ntohs (msg->rd_len);
   msg_len = ntohs (msg->gns_header.header.size);
   name_len = ntohs (msg->name_len);
-  exp_msg_len = sizeof(*msg) + name_len + rd_len;
+  key_len = ntohl (msg->key_len);
+  exp_msg_len = sizeof(*msg) + name_len + rd_len + key_len;
   if (msg_len != exp_msg_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
   if ((name_len > 0) && ('\0' != name[name_len - 1]))
   {
     GNUNET_break (0);
@@ -443,10 +445,13 @@ handle_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
 {
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   const char *name;
   const char *rd_tmp;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned int rd_count;
   int16_t found = (int16_t) ntohs (msg->found);
 
@@ -458,12 +463,19 @@ handle_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
   rd_len = ntohs (msg->rd_len);
   rd_count = ntohs (msg->rd_count);
   name_len = ntohs (msg->name_len);
-  name = (const char *) &msg[1];
+  key_len = ntohl (msg->key_len);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
+  name = (const char *) &msg[1] + key_len;
   if (GNUNET_NO == found)
   {
     /* label was not in namestore */
     if (NULL != qe->proc)
-      qe->proc (qe->proc_cls, &msg->private_key, name, 0, NULL);
+      qe->proc (qe->proc_cls, &private_key, name, 0, NULL);
     free_qe (qe);
     return;
   }
@@ -486,7 +498,7 @@ handle_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
       name = NULL;
     if (NULL != qe->proc)
       qe->proc (qe->proc_cls,
-                &msg->private_key,
+                &private_key,
                 name,
                 rd_count,
                 (rd_count > 0) ? rd : NULL);
@@ -506,33 +518,35 @@ handle_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
 static int
 check_record_result (void *cls, const struct RecordResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey priv_dummy;
   const char *name;
   size_t msg_len;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
 
   (void) cls;
   rd_len = ntohs (msg->rd_len);
   msg_len = ntohs (msg->gns_header.header.size);
+  key_len = ntohl (msg->key_len);
   name_len = ntohs (msg->name_len);
   if (0 != ntohs (msg->reserved))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if (msg_len != sizeof(struct RecordResultMessage) + name_len + rd_len)
+  if (msg_len != sizeof(struct RecordResultMessage) + key_len + name_len
+      + rd_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
   if ((0 == name_len) || ('\0' != name[name_len - 1]))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if (0 == GNUNET_memcmp (&msg->private_key, &priv_dummy))
+  if (0 == key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -554,16 +568,20 @@ handle_record_result (void *cls, const struct 
RecordResultMessage *msg)
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
   struct GNUNET_NAMESTORE_ZoneIterator *ze;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   const char *name;
   const char *rd_tmp;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned int rd_count;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_RESULT\n");
   rd_len = ntohs (msg->rd_len);
   rd_count = ntohs (msg->rd_count);
   name_len = ntohs (msg->name_len);
+  key_len = ntohl (msg->key_len);
   ze = find_zi (h, ntohl (msg->gns_header.r_id));
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
   if ((NULL == ze) && (NULL == qe))
@@ -574,7 +592,13 @@ handle_record_result (void *cls, const struct 
RecordResultMessage *msg)
     force_reconnect (h);
     return;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   rd_tmp = &name[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -588,7 +612,7 @@ handle_record_result (void *cls, const struct 
RecordResultMessage *msg)
     {
       if (NULL != qe->proc)
         qe->proc (qe->proc_cls,
-                  &msg->private_key,
+                  &private_key,
                   name,
                   rd_count,
                   (rd_count > 0) ? rd : NULL);
@@ -598,9 +622,9 @@ handle_record_result (void *cls, const struct 
RecordResultMessage *msg)
     if (NULL != ze)
     {
       if (NULL != ze->proc)
-        ze->proc (ze->proc_cls, &msg->private_key, name, rd_count, rd);
+        ze->proc (ze->proc_cls, &private_key, name, rd_count, rd);
       if (NULL != ze->proc2)
-        ze->proc2 (ze->proc_cls, &msg->private_key, name,
+        ze->proc2 (ze->proc_cls, &private_key, name,
                    rd_count, rd, GNUNET_TIME_absolute_ntoh (msg->expire));
       return;
     }
@@ -680,20 +704,23 @@ check_zone_to_name_response (void *cls,
 {
   size_t name_len;
   size_t rd_ser_len;
+  size_t key_len;
   const char *name_tmp;
 
   (void) cls;
   if (GNUNET_EC_NONE != ntohl (msg->ec))
     return GNUNET_OK;
+  key_len = ntohl (msg->key_len);
   name_len = ntohs (msg->name_len);
   rd_ser_len = ntohs (msg->rd_len);
   if (ntohs (msg->gns_header.header.size) !=
-      sizeof(struct ZoneToNameResponseMessage) + name_len + rd_ser_len)
+      sizeof(struct ZoneToNameResponseMessage) + key_len + name_len
+      + rd_ser_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name_tmp = (const char *) &msg[1];
+  name_tmp = (const char *) &msg[1] + key_len;
   if ((name_len > 0) && ('\0' != name_tmp[name_len - 1]))
   {
     GNUNET_break (0);
@@ -716,12 +743,15 @@ handle_zone_to_name_response (void *cls,
 {
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
+  struct GNUNET_IDENTITY_PrivateKey zone;
   enum GNUNET_ErrorCode res;
   size_t name_len;
   size_t rd_ser_len;
   unsigned int rd_count;
   const char *name_tmp;
   const char *rd_tmp;
+  size_t key_len;
+  size_t kbytes_read;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Received ZONE_TO_NAME_RESPONSE\n");
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
@@ -732,6 +762,13 @@ handle_zone_to_name_response (void *cls,
     return;
   }
   res = ntohl (msg->ec);
+  key_len = ntohl (msg->key_len);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &zone,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   switch (res)
   {
   break;
@@ -740,7 +777,7 @@ handle_zone_to_name_response (void *cls,
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Namestore has no result for zone to name mapping \n");
     if (NULL != qe->proc)
-      qe->proc (qe->proc_cls, &msg->zone, NULL, 0, NULL);
+      qe->proc (qe->proc_cls, &zone, NULL, 0, NULL);
     free_qe (qe);
     return;
 
@@ -750,7 +787,7 @@ handle_zone_to_name_response (void *cls,
     name_len = ntohs (msg->name_len);
     rd_count = ntohs (msg->rd_count);
     rd_ser_len = ntohs (msg->rd_len);
-    name_tmp = (const char *) &msg[1];
+    name_tmp = (const char *) &msg[1] + key_len;
     rd_tmp = &name_tmp[name_len];
     {
       struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -762,7 +799,7 @@ handle_zone_to_name_response (void *cls,
                                                            rd));
       /* normal end, call continuation with result */
       if (NULL != qe->proc)
-        qe->proc (qe->proc_cls, &msg->zone, name_tmp, rd_count, rd);
+        qe->proc (qe->proc_cls, &zone, name_tmp, rd_count, rd);
       /* return is important here: break would call continuation with error! */
       free_qe (qe);
       return;
@@ -1050,7 +1087,10 @@ GNUNET_NAMESTORE_records_store2 (
   ssize_t sret;
   int i;
   size_t rd_set_len = 0;
-  size_t max_len = UINT16_MAX - sizeof (struct RecordStoreMessage);
+  size_t key_len = 0;
+  size_t max_len;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
+  max_len = UINT16_MAX - key_len - sizeof (struct RecordStoreMessage);
 
   *rds_sent = 0;
   for (i = 0; i < rd_set_count; i++)
@@ -1093,17 +1133,19 @@ GNUNET_NAMESTORE_records_store2 (
   qe->cont_cls = cont_cls;
   qe->op_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
-
   /* setup msg */
   env = GNUNET_MQ_msg_extra (msg,
-                             rd_set_len,
+                             key_len + rd_set_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE);
   GNUNET_assert (NULL != msg);
   GNUNET_assert (NULL != env);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   msg->rd_set_count = htons ((uint16_t) (*rds_sent));
-  msg->private_key = *pkey;
-  rd_set = (struct RecordSet*) &msg[1];
+  GNUNET_IDENTITY_write_private_key_to_buffer (pkey,
+                                               &msg[1],
+                                               key_len);
+  rd_set = (struct RecordSet*) (((char*) &msg[1]) + key_len);
   for (int i = 0; i < *rds_sent; i++)
   {
     label = record_info[i].a_label;
@@ -1162,6 +1204,7 @@ records_lookup (
   struct GNUNET_MQ_Envelope *env;
   struct LabelLookupMessage *msg;
   size_t label_len;
+  size_t key_len;
 
   if (1 == (label_len = strlen (label) + 1))
   {
@@ -1178,15 +1221,20 @@ records_lookup (
   qe->op_id = get_op_id (h);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
 
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   env = GNUNET_MQ_msg_extra (msg,
-                             label_len,
+                             label_len +  key_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP);
   msg->gns_header.r_id = htonl (qe->op_id);
-  msg->zone = *pkey;
+  GNUNET_IDENTITY_write_private_key_to_buffer (pkey,
+                                               &msg[1],
+                                               key_len);
+
+  msg->key_len = htonl (key_len);
   msg->is_edit_request = htonl (is_edit_request);
   msg->label_len = htonl (label_len);
   msg->filter = htons (filter);
-  GNUNET_memcpy (&msg[1], label, label_len);
+  GNUNET_memcpy (((char*) &msg[1]) + key_len, label, label_len);
   if (NULL == h->mq)
     qe->env = env;
   else
@@ -1257,6 +1305,8 @@ GNUNET_NAMESTORE_zone_to_name (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameMessage *msg;
   uint32_t rid;
+  size_t key_len;
+  ssize_t pkey_len;
 
   rid = get_op_id (h);
   qe = GNUNET_new (struct GNUNET_NAMESTORE_QueueEntry);
@@ -1268,10 +1318,17 @@ GNUNET_NAMESTORE_zone_to_name (
   qe->op_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
 
-  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME);
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  pkey_len = GNUNET_IDENTITY_public_key_get_length (value_zone);
+  env = GNUNET_MQ_msg_extra (msg, key_len + pkey_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME);
   msg->gns_header.r_id = htonl (rid);
-  msg->zone = *zone;
-  msg->value_zone = *value_zone;
+  msg->key_len = htonl (key_len);
+  msg->pkey_len = htonl (pkey_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
+  GNUNET_IDENTITY_write_public_key_to_buffer (value_zone,
+                                              (char*) &msg[1] + key_len,
+                                              pkey_len);
   if (NULL == h->mq)
     qe->env = env;
   else
@@ -1295,6 +1352,7 @@ GNUNET_NAMESTORE_zone_iteration_start (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len = 0;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Sending ZONE_ITERATION_START message\n");
   rid = get_op_id (h);
@@ -1308,12 +1366,18 @@ GNUNET_NAMESTORE_zone_iteration_start (
   it->proc_cls = proc_cls;
   it->op_id = rid;
   if (NULL != zone)
+  {
     it->zone = *zone;
+    key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  }
   GNUNET_CONTAINER_DLL_insert_tail (h->z_head, h->z_tail, it);
-  env = GNUNET_MQ_msg (msg, 
GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             
GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   if (NULL != zone)
-    msg->zone = *zone;
+    GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1337,6 +1401,7 @@ GNUNET_NAMESTORE_zone_iteration_start2 (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len = 0;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Sending ZONE_ITERATION_START message\n");
   rid = get_op_id (h);
@@ -1350,13 +1415,19 @@ GNUNET_NAMESTORE_zone_iteration_start2 (
   it->proc_cls = proc_cls;
   it->op_id = rid;
   if (NULL != zone)
+  {
     it->zone = *zone;
+    key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  }
   GNUNET_CONTAINER_DLL_insert_tail (h->z_head, h->z_tail, it);
-  env = GNUNET_MQ_msg (msg, 
GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             
GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   msg->filter = htons ((uint16_t) filter);
   if (NULL != zone)
-    msg->zone = *zone;
+    GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
diff --git a/src/namestore/namestore_api_monitor.c 
b/src/namestore/namestore_api_monitor.c
index 56ae8cb53..81ea41f7d 100644
--- a/src/namestore/namestore_api_monitor.c
+++ b/src/namestore/namestore_api_monitor.c
@@ -98,6 +98,11 @@ struct GNUNET_NAMESTORE_ZoneMonitor
    * Do we first iterate over all existing records?
    */
   int iterate_first;
+
+  /**
+   * Zone key length
+   */
+  uint32_t key_len;
 };
 
 
@@ -146,10 +151,12 @@ check_result (void *cls, const struct RecordResultMessage 
*lrm)
   unsigned rd_count;
   const char *name_tmp;
   const char *rd_ser_tmp;
+  size_t key_len;
 
+  (void) zm;
+  key_len = ntohl (lrm->key_len);
   (void) cls;
-  if ((0 != GNUNET_memcmp (&lrm->private_key, &zm->zone)) &&
-      (GNUNET_NO == GNUNET_is_zero (&zm->zone)))
+  if (0 == key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -163,7 +170,7 @@ check_result (void *cls, const struct RecordResultMessage 
*lrm)
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  exp_lrm_len = sizeof(struct RecordResultMessage) + name_len + rd_len;
+  exp_lrm_len = sizeof(struct RecordResultMessage) + name_len + rd_len + 
key_len;
   if (lrm_len != exp_lrm_len)
   {
     GNUNET_break (0);
@@ -174,7 +181,7 @@ check_result (void *cls, const struct RecordResultMessage 
*lrm)
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name_tmp = (const char *) &lrm[1];
+  name_tmp = (const char *) &lrm[1] + key_len;
   if (name_tmp[name_len - 1] != '\0')
   {
     GNUNET_break (0);
@@ -206,16 +213,26 @@ static void
 handle_result (void *cls, const struct RecordResultMessage *lrm)
 {
   struct GNUNET_NAMESTORE_ZoneMonitor *zm = cls;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned rd_count;
   const char *name_tmp;
   const char *rd_ser_tmp;
 
+  key_len = ntohl (lrm->key_len);
   rd_len = ntohs (lrm->rd_len);
   rd_count = ntohs (lrm->rd_count);
   name_len = ntohs (lrm->name_len);
-  name_tmp = (const char *) &lrm[1];
+  name_tmp = (const char *) &lrm[1] + key_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&lrm[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   rd_ser_tmp = (const char *) &name_tmp[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -224,10 +241,10 @@ handle_result (void *cls, const struct 
RecordResultMessage *lrm)
       GNUNET_OK ==
       GNUNET_GNSRECORD_records_deserialize (rd_len, rd_ser_tmp, rd_count, rd));
     if (NULL != zm->monitor2)
-      zm->monitor2 (zm->monitor_cls, &lrm->private_key, name_tmp,
+      zm->monitor2 (zm->monitor_cls, &private_key, name_tmp,
                     rd_count, rd, GNUNET_TIME_absolute_ntoh (lrm->expire));
     else
-      zm->monitor (zm->monitor_cls, &lrm->private_key, name_tmp, rd_count, rd);
+      zm->monitor (zm->monitor_cls, &private_key, name_tmp, rd_count, rd);
   }
 }
 
@@ -283,9 +300,15 @@ reconnect (struct GNUNET_NAMESTORE_ZoneMonitor *zm)
                                   zm);
   if (NULL == zm->mq)
     return;
-  env = GNUNET_MQ_msg (sm, GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START);
+  env = GNUNET_MQ_msg_extra (sm,
+                             zm->key_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START);
   sm->iterate_first = htonl (zm->iterate_first);
-  sm->zone = zm->zone;
+  if (0 < zm->key_len)
+    GNUNET_IDENTITY_write_private_key_to_buffer (&zm->zone,
+                                               &sm[1],
+                                               zm->key_len);
+  sm->key_len = htonl (zm->key_len);
   sm->filter = htons (zm->filter);
   GNUNET_MQ_send (zm->mq, env);
 }
@@ -307,7 +330,10 @@ GNUNET_NAMESTORE_zone_monitor_start (
 
   zm = GNUNET_new (struct GNUNET_NAMESTORE_ZoneMonitor);
   if (NULL != zone)
+  {
+    zm->key_len = GNUNET_IDENTITY_private_key_get_length (zone);
     zm->zone = *zone;
+  }
   zm->iterate_first = iterate_first;
   zm->error_cb = error_cb;
   zm->error_cb_cls = error_cb_cls;
@@ -342,7 +368,10 @@ GNUNET_NAMESTORE_zone_monitor_start2 (
 
   zm = GNUNET_new (struct GNUNET_NAMESTORE_ZoneMonitor);
   if (NULL != zone)
+  {
+    zm->key_len = GNUNET_IDENTITY_private_key_get_length (zone);
     zm->zone = *zone;
+  }
   zm->iterate_first = iterate_first;
   zm->error_cb = error_cb;
   zm->error_cb_cls = error_cb_cls;
diff --git a/src/reclaim/Makefile.am b/src/reclaim/Makefile.am
index d29b5857a..37af360c8 100644
--- a/src/reclaim/Makefile.am
+++ b/src/reclaim/Makefile.am
@@ -138,6 +138,7 @@ libgnunetreclaim_la_SOURCES = \
  reclaim_credential.h
 libgnunetreclaim_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL) $(XLIB)
 libgnunetreclaim_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS)   \
diff --git a/src/reclaim/gnunet-service-reclaim.c 
b/src/reclaim/gnunet-service-reclaim.c
index 5c484e55d..ea97f8749 100644
--- a/src/reclaim/gnunet-service-reclaim.c
+++ b/src/reclaim/gnunet-service-reclaim.c
@@ -657,18 +657,27 @@ send_ticket_result (const struct IdpClient *client,
   struct TicketResultMessage *irm;
   struct GNUNET_MQ_Envelope *env;
   size_t pres_len = 0;
+  size_t tkt_len = 0;
+  ssize_t written;
+  char *buf;
 
   if (NULL != presentations)
   {
     pres_len =
       GNUNET_RECLAIM_presentation_list_serialize_get_size (presentations);
   }
+  if (NULL != ticket)
+    tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
   env = GNUNET_MQ_msg_extra (irm,
-                             pres_len,
+                             pres_len + tkt_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
+  buf = (char*) &irm[1];
   if (NULL != ticket)
   {
-    irm->ticket = *ticket;
+    irm->tkt_len = htonl (tkt_len);
+    written = GNUNET_RECLAIM_write_ticket_to_buffer (ticket, buf, tkt_len);
+    GNUNET_assert (0 <= written);
+    buf += written;
   }
   // TODO add success member
   irm->id = htonl (r_id);
@@ -676,7 +685,7 @@ send_ticket_result (const struct IdpClient *client,
   if (NULL != presentations)
   {
     GNUNET_RECLAIM_presentation_list_serialize (presentations,
-                                                (char*) &irm[1]);
+                                                buf);
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending TICKET_RESULT message\n");
   GNUNET_MQ_send (client->mq, env);
@@ -732,11 +741,15 @@ check_issue_ticket_message (void *cls, const struct 
IssueTicketMessage *im)
 {
   uint16_t size;
   size_t attrs_len;
+  size_t key_len;
+  size_t pkey_len;
 
   size = ntohs (im->header.size);
   attrs_len = ntohs (im->attr_len);
-
-  if (attrs_len > size - sizeof(struct IssueTicketMessage))
+  key_len = ntohl (im->key_len);
+  pkey_len = ntohl (im->pkey_len);
+  if (size != attrs_len + key_len + pkey_len + sizeof(struct
+                                                      IssueTicketMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -758,12 +771,43 @@ handle_issue_ticket_message (void *cls, const struct 
IssueTicketMessage *im)
   struct IdpClient *idp = cls;
   struct GNUNET_RECLAIM_AttributeList *attrs;
   struct GNUNET_RECLAIM_AttributeListEntry *le;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_IDENTITY_PublicKey rp;
   size_t attrs_len;
+  size_t key_len;
+  size_t pkey_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ISSUE_TICKET message\n");
+  key_len = ntohl (im->key_len);
+  buf = (char *) &im[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  pkey_len = ntohl (im->pkey_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_public_key_from_buffer (buf, pkey_len,
+                                                    &rp, &read)) ||
+      (read != pkey_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read public key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   tio = GNUNET_new (struct TicketIssueOperation);
   attrs_len = ntohs (im->attr_len);
-  attrs = GNUNET_RECLAIM_attribute_list_deserialize ((char *) &im[1],
+  attrs = GNUNET_RECLAIM_attribute_list_deserialize (buf,
                                                      attrs_len);
   for (le = attrs->list_head; NULL != le; le = le->next)
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -772,9 +816,9 @@ handle_issue_ticket_message (void *cls, const struct 
IssueTicketMessage *im)
   tio->r_id = ntohl (im->id);
   tio->client = idp;
   GNUNET_CONTAINER_DLL_insert (idp->issue_op_head, idp->issue_op_tail, tio);
-  RECLAIM_TICKETS_issue (&im->identity,
+  RECLAIM_TICKETS_issue (&identity,
                          attrs,
-                         &im->rp,
+                         &rp,
                          &issue_ticket_result_cb,
                          tio);
   GNUNET_SERVICE_client_continue (idp->client);
@@ -846,15 +890,44 @@ handle_revoke_ticket_message (void *cls, const struct 
RevokeTicketMessage *rm)
 {
   struct TicketRevocationOperation *rop;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t key_len;
+  size_t tkt_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received REVOKE_TICKET message\n");
+  key_len = ntohl (rm->key_len);
+  buf = (char *) &rm[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  tkt_len = ntohl (rm->tkt_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_RECLAIM_read_ticket_from_buffer (buf, key_len,
+                                               &ticket, &read)) ||
+      (read != tkt_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read ticket\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   rop = GNUNET_new (struct TicketRevocationOperation);
   rop->r_id = ntohl (rm->id);
   rop->client = idp;
   GNUNET_CONTAINER_DLL_insert (idp->revoke_op_head, idp->revoke_op_tail, rop);
   rop->rh
-    = RECLAIM_TICKETS_revoke (&rm->ticket, &rm->identity, &revoke_result_cb,
-                              rop);
+    = RECLAIM_TICKETS_revoke (&ticket, &identity, &revoke_result_cb, rop);
   GNUNET_SERVICE_client_continue (idp->client);
 }
 
@@ -882,6 +955,8 @@ consume_result_cb (void *cls,
   char *data_tmp;
   size_t attrs_len = 0;
   size_t pres_len = 0;
+  size_t key_len;
+  ssize_t written;
 
   if (GNUNET_OK != success)
   {
@@ -890,17 +965,23 @@ consume_result_cb (void *cls,
   attrs_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
   pres_len = GNUNET_RECLAIM_presentation_list_serialize_get_size (
     presentations);
+  key_len = GNUNET_IDENTITY_public_key_get_length (identity);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending CONSUME_TICKET_RESULT message\n");
   env = GNUNET_MQ_msg_extra (crm,
-                             attrs_len + pres_len,
+                             attrs_len + pres_len + key_len,
                              
GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET_RESULT);
   crm->id = htonl (cop->r_id);
   crm->attrs_len = htons (attrs_len);
   crm->presentations_len = htons (pres_len);
-  crm->identity = *identity;
+  crm->key_len = htonl (key_len);
   crm->result = htonl (success);
   data_tmp = (char *) &crm[1];
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (0 <= written);
+  data_tmp += written;
   GNUNET_RECLAIM_attribute_list_serialize (attrs, data_tmp);
   data_tmp += attrs_len;
   GNUNET_RECLAIM_presentation_list_serialize (presentations, data_tmp);
@@ -924,7 +1005,7 @@ check_consume_ticket_message (void *cls, const struct 
ConsumeTicketMessage *cm)
   uint16_t size;
 
   size = ntohs (cm->header.size);
-  if (size != sizeof(struct ConsumeTicketMessage))
+  if (size <= sizeof(struct ConsumeTicketMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -944,13 +1025,43 @@ handle_consume_ticket_message (void *cls, const struct 
ConsumeTicketMessage *cm)
 {
   struct ConsumeTicketOperation *cop;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t key_len;
+  size_t tkt_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CONSUME_TICKET message\n");
+  key_len = ntohl (cm->key_len);
+  buf = (char *) &cm[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  tkt_len = ntohl (cm->tkt_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_RECLAIM_read_ticket_from_buffer (buf, tkt_len,
+                                               &ticket, &read)) ||
+      (read != tkt_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read ticket\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   cop = GNUNET_new (struct ConsumeTicketOperation);
   cop->r_id = ntohl (cm->id);
   cop->client = idp;
   cop->ch
-    = RECLAIM_TICKETS_consume (&cm->identity, &cm->ticket, &consume_result_cb,
+    = RECLAIM_TICKETS_consume (&identity, &ticket, &consume_result_cb,
                                cop);
   GNUNET_CONTAINER_DLL_insert (idp->consume_op_head, idp->consume_op_tail, 
cop);
   GNUNET_SERVICE_client_continue (idp->client);
@@ -1077,21 +1188,37 @@ handle_attribute_store_message (void *cls,
 {
   struct AttributeStoreHandle *ash;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ATTRIBUTE_STORE message\n");
 
   data_len = ntohs (sam->attr_len);
-
+  key_len = ntohl (sam->key_len);
+  buf = (char *) &sam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   ash = GNUNET_new (struct AttributeStoreHandle);
-  GNUNET_RECLAIM_attribute_deserialize ((char *) &sam[1],
+  GNUNET_RECLAIM_attribute_deserialize (buf,
                                         data_len,
                                         &ash->claim);
 
   ash->r_id = ntohl (sam->id);
-  ash->identity = sam->identity;
+  ash->identity = identity;
   ash->exp.rel_value_us = GNUNET_ntohll (sam->exp);
-  GNUNET_IDENTITY_key_get_public (&sam->identity, &ash->identity_pkey);
+  GNUNET_IDENTITY_key_get_public (&identity, &ash->identity_pkey);
 
   GNUNET_SERVICE_client_continue (idp->client);
   ash->client = idp;
@@ -1262,20 +1389,36 @@ handle_credential_store_message (void *cls,
 {
   struct AttributeStoreHandle *ash;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREDENTIAL_STORE message\n");
 
   data_len = ntohs (sam->attr_len);
-
+  key_len = ntohl (sam->key_len);
+  buf = (char *) &sam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   ash = GNUNET_new (struct AttributeStoreHandle);
-  ash->credential = GNUNET_RECLAIM_credential_deserialize ((char *) &sam[1],
+  ash->credential = GNUNET_RECLAIM_credential_deserialize (buf,
                                                            data_len);
 
   ash->r_id = ntohl (sam->id);
-  ash->identity = sam->identity;
+  ash->identity = identity;
   ash->exp.rel_value_us = GNUNET_ntohll (sam->exp);
-  GNUNET_IDENTITY_key_get_public (&sam->identity, &ash->identity_pkey);
+  GNUNET_IDENTITY_key_get_public (&identity, &ash->identity_pkey);
 
   GNUNET_SERVICE_client_continue (idp->client);
   ash->client = idp;
@@ -1717,20 +1860,36 @@ handle_attribute_delete_message (void *cls,
 {
   struct AttributeDeleteHandle *adh;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ATTRIBUTE_DELETE message\n");
 
   data_len = ntohs (dam->attr_len);
-
+  key_len = ntohl (dam->key_len);
+  buf = (char *) &dam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   adh = GNUNET_new (struct AttributeDeleteHandle);
-  GNUNET_RECLAIM_attribute_deserialize ((char *) &dam[1],
+  GNUNET_RECLAIM_attribute_deserialize (buf,
                                         data_len,
                                         &adh->claim);
   adh->credential = NULL;
 
   adh->r_id = ntohl (dam->id);
-  adh->identity = dam->identity;
+  adh->identity = identity;
   adh->label
     = GNUNET_STRINGS_data_to_string_alloc (&adh->claim->id,
                                            sizeof(adh->claim->id));
@@ -1808,19 +1967,35 @@ handle_credential_delete_message (void *cls,
 {
   struct AttributeDeleteHandle *adh;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREDENTIAL_DELETE message\n");
 
   data_len = ntohs (dam->attr_len);
-
+  key_len = ntohl (dam->key_len);
+  buf = (char *) &dam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   adh = GNUNET_new (struct AttributeDeleteHandle);
-  adh->credential = GNUNET_RECLAIM_credential_deserialize ((char *) &dam[1],
+  adh->credential = GNUNET_RECLAIM_credential_deserialize (buf,
                                                            data_len);
   adh->claim = NULL;
 
   adh->r_id = ntohl (dam->id);
-  adh->identity = dam->identity;
+  adh->identity = identity;
   adh->label
     = GNUNET_STRINGS_data_to_string_alloc (&adh->credential->id,
                                            sizeof(adh->credential->id));
@@ -1858,6 +2033,7 @@ attr_iter_finished (void *cls)
   env = GNUNET_MQ_msg (arm, GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_RESULT);
   arm->id = htonl (ai->request_id);
   arm->attr_len = htons (0);
+  arm->pkey_len = htonl (0);
   GNUNET_MQ_send (ai->client->mq, env);
   GNUNET_CONTAINER_DLL_remove (ai->client->attr_iter_head,
                                ai->client->attr_iter_tail,
@@ -1899,7 +2075,10 @@ attr_iter_cb (void *cls,
 {
   struct Iterator *ai = cls;
   struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_IDENTITY_PublicKey identity;
   char *data_tmp;
+  size_t key_len;
+  ssize_t written;
 
   if ((rd_count != 1) ||
       (GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE != rd->record_type))
@@ -1912,18 +2091,44 @@ attr_iter_cb (void *cls,
               label);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending ATTRIBUTE_RESULT message\n");
+  GNUNET_IDENTITY_key_get_public (zone, &identity);
+  key_len = GNUNET_IDENTITY_public_key_get_length (&identity);
   env = GNUNET_MQ_msg_extra (arm,
-                             rd->data_size,
+                             rd->data_size + key_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_RESULT);
   arm->id = htonl (ai->request_id);
   arm->attr_len = htons (rd->data_size);
-  GNUNET_IDENTITY_key_get_public (zone, &arm->identity);
   data_tmp = (char *) &arm[1];
+  arm->pkey_len = htonl (key_len);
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (0 <= written);
+  data_tmp += written;
   GNUNET_memcpy (data_tmp, rd->data, rd->data_size);
   GNUNET_MQ_send (ai->client->mq, env);
 }
 
 
+static enum GNUNET_GenericReturnValue
+check_iteration_start (
+  void *cls,
+  const struct AttributeIterationStartMessage *ais_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (ais_msg->header.size);
+  key_len = ntohs (ais_msg->key_len);
+
+  if (size < key_len + sizeof(*ais_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 /**
  * Iterate over zone to get attributes
  *
@@ -1936,13 +2141,29 @@ handle_iteration_start (void *cls,
 {
   struct IdpClient *idp = cls;
   struct Iterator *ai;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ATTRIBUTE_ITERATION_START message\n");
+  key_len = ntohl (ais_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ais_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key.\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   ai = GNUNET_new (struct Iterator);
   ai->request_id = ntohl (ais_msg->id);
   ai->client = idp;
-  ai->identity = ais_msg->identity;
+  ai->identity = identity;
 
   GNUNET_CONTAINER_DLL_insert (idp->attr_iter_head, idp->attr_iter_tail, ai);
   ai->ns_it = GNUNET_NAMESTORE_zone_iteration_start (nsh,
@@ -2084,7 +2305,10 @@ cred_iter_cb (void *cls,
   struct Iterator *ai = cls;
   struct GNUNET_MQ_Envelope *env;
   struct CredentialResultMessage *arm;
+  struct GNUNET_IDENTITY_PublicKey identity;
   char *data_tmp;
+  size_t key_len;
+  ssize_t written;
 
   if ((rd_count != 1) ||
       (GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL != rd->record_type))
@@ -2096,18 +2320,42 @@ cred_iter_cb (void *cls,
               label);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending CREDENTIAL_RESULT message\n");
+  GNUNET_IDENTITY_key_get_public (zone, &identity);
+  key_len = GNUNET_IDENTITY_public_key_get_length (&identity);
   env = GNUNET_MQ_msg_extra (arm,
-                             rd->data_size,
+                             rd->data_size + key_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_RESULT);
   arm->id = htonl (ai->request_id);
   arm->credential_len = htons (rd->data_size);
-  GNUNET_IDENTITY_key_get_public (zone, &arm->identity);
   data_tmp = (char *) &arm[1];
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (written >= 0);
+  data_tmp += written;
   GNUNET_memcpy (data_tmp, rd->data, rd->data_size);
-
   GNUNET_MQ_send (ai->client->mq, env);
 }
 
+static enum GNUNET_GenericReturnValue
+check_credential_iteration_start (
+  void *cls,
+  const struct CredentialIterationStartMessage *cis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (cis_msg->header.size);
+  key_len = ntohs (cis_msg->key_len);
+
+  if (size < key_len + sizeof(*cis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Iterate over zone to get attributes
@@ -2122,13 +2370,29 @@ handle_credential_iteration_start (void *cls,
 {
   struct IdpClient *idp = cls;
   struct Iterator *ai;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received CREDENTIAL_ITERATION_START message\n");
+  key_len = ntohl (ais_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ais_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key.\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   ai = GNUNET_new (struct Iterator);
   ai->request_id = ntohl (ais_msg->id);
   ai->client = idp;
-  ai->identity = ais_msg->identity;
+  ai->identity = identity;
 
   GNUNET_CONTAINER_DLL_insert (idp->cred_iter_head, idp->cred_iter_tail,
                                ai);
@@ -2227,8 +2491,16 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket 
*ticket)
   struct TicketIteration *ti = cls;
   struct GNUNET_MQ_Envelope *env;
   struct TicketResultMessage *trm;
+  size_t tkt_len;
 
-  env = GNUNET_MQ_msg (trm, GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
+  if (NULL == ticket)
+    tkt_len = 0;
+  else
+    tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
+
+  env = GNUNET_MQ_msg_extra (trm,
+                             tkt_len,
+                             GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
   if (NULL == ticket)
   {
     /* send empty response to indicate end of list */
@@ -2238,8 +2510,11 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket 
*ticket)
   }
   else
   {
-    trm->ticket = *ticket;
+    GNUNET_RECLAIM_write_ticket_to_buffer (ticket,
+                                           &trm[1],
+                                           tkt_len);
   }
+  trm->tkt_len = htonl (tkt_len);
   trm->id = htonl (ti->r_id);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending TICKET_RESULT message\n");
   GNUNET_MQ_send (ti->client->mq, env);
@@ -2247,6 +2522,24 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket 
*ticket)
     GNUNET_free (ti);
 }
 
+static enum GNUNET_GenericReturnValue
+check_ticket_iteration_start (
+  void *cls,
+  const struct TicketIterationStartMessage *tis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (tis_msg->header.size);
+  key_len = ntohs (tis_msg->key_len);
+
+  if (size < key_len + sizeof(*tis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
 
 /**
  * Client requests a ticket iteration
@@ -2259,20 +2552,35 @@ handle_ticket_iteration_start (
   void *cls,
   const struct TicketIterationStartMessage *tis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey identity;
   struct IdpClient *client = cls;
   struct TicketIteration *ti;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received TICKET_ITERATION_START message\n");
+  key_len = ntohl (tis_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&tis_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (client->client);
+    return;
+  }
   ti = GNUNET_new (struct TicketIteration);
   ti->r_id = ntohl (tis_msg->id);
   ti->client = client;
-
   GNUNET_CONTAINER_DLL_insert (client->ticket_iter_head,
                                client->ticket_iter_tail,
                                ti);
   ti->iter
-    = RECLAIM_TICKETS_iteration_start (&tis_msg->identity, &ticket_iter_cb, 
ti);
+    = RECLAIM_TICKETS_iteration_start (&identity, &ticket_iter_cb, ti);
   GNUNET_SERVICE_client_continue (client->client);
 }
 
@@ -2451,10 +2759,10 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_DELETE,
                          struct AttributeDeleteMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (iteration_start,
-                           
GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START,
-                           struct AttributeIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (iteration_start,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START,
+                         struct AttributeIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (iteration_next,
                            
GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_NEXT,
                            struct AttributeIterationNextMessage,
@@ -2463,10 +2771,10 @@ GNUNET_SERVICE_MAIN (
                            
GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_STOP,
                            struct AttributeIterationStopMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (credential_iteration_start,
-                           
GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START,
-                           struct CredentialIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (credential_iteration_start,
+                         
GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START,
+                         struct CredentialIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (credential_iteration_next,
                            
GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_NEXT,
                            struct CredentialIterationNextMessage,
@@ -2484,10 +2792,10 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET,
                          struct ConsumeTicketMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (ticket_iteration_start,
-                           GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START,
-                           struct TicketIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (ticket_iteration_start,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START,
+                         struct TicketIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (ticket_iteration_next,
                            GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_NEXT,
                            struct TicketIterationNextMessage,
diff --git a/src/reclaim/gnunet-service-reclaim_tickets.c 
b/src/reclaim/gnunet-service-reclaim_tickets.c
index 9552094f1..5e2a5e974 100644
--- a/src/reclaim/gnunet-service-reclaim_tickets.c
+++ b/src/reclaim/gnunet-service-reclaim_tickets.c
@@ -742,7 +742,8 @@ rvk_move_attr_cb (void *cls,
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding credential %s\n",
                   new_label);
       GNUNET_free (credential);
-    } else {
+    }
+    else {
       memcpy (&new_rd[i], &rd[i], sizeof (struct GNUNET_GNSRECORD_Data));
     }
   }
@@ -1197,9 +1198,11 @@ RECLAIM_TICKETS_consume (const struct 
GNUNET_IDENTITY_PrivateKey *id,
   label =
     GNUNET_STRINGS_data_to_string_alloc (&cth->ticket.rnd,
                                          sizeof(cth->ticket.rnd));
+  char *str = GNUNET_IDENTITY_public_key_to_string (&cth->ticket.identity);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Looking for AuthZ info under %s\n",
-              label);
+              "Looking for AuthZ info under %s in %s\n",
+              label, str);
+  GNUNET_free (str);
   cth->lookup_start_time = GNUNET_TIME_absolute_get ();
   cth->lookup_request =
     GNUNET_GNS_lookup (gns,
@@ -1289,6 +1292,7 @@ issue_ticket (struct TicketIssueHandle *ih)
   struct GNUNET_RECLAIM_PresentationListEntry *ple;
   struct GNUNET_GNSRECORD_Data *attrs_record;
   char *label;
+  char *tkt_data;
   int i;
   int j;
   int attrs_count = 0;
@@ -1376,8 +1380,13 @@ issue_ticket (struct TicketIssueHandle *ih)
       }
     }
   }
-  attrs_record[i].data = &ih->ticket;
-  attrs_record[i].data_size = sizeof(struct GNUNET_RECLAIM_Ticket);
+  attrs_record[i].data_size =
+    GNUNET_RECLAIM_ticket_serialize_get_size (&ih->ticket);
+  tkt_data = GNUNET_malloc (attrs_record[i].data_size);
+  GNUNET_RECLAIM_write_ticket_to_buffer (&ih->ticket,
+                                         tkt_data,
+                                         attrs_record[i].data_size);
+  attrs_record[i].data = tkt_data;
   attrs_record[i].expiration_time = ticket_refresh_interval.rel_value_us;
   attrs_record[i].record_type = GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET;
   attrs_record[i].flags =
@@ -1387,6 +1396,13 @@ issue_ticket (struct TicketIssueHandle *ih)
   label =
     GNUNET_STRINGS_data_to_string_alloc (&ih->ticket.rnd,
                                          sizeof(ih->ticket.rnd));
+  struct GNUNET_IDENTITY_PublicKey pub;
+  GNUNET_IDENTITY_key_get_public (&ih->identity,
+                                  &pub);
+  char *str = GNUNET_IDENTITY_public_key_to_string (&pub);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Storing AuthZ information under %s in %s\n", label, str);
+  GNUNET_free (str);
   // Publish record
   ih->ns_qe = GNUNET_NAMESTORE_records_store (nsh,
                                               &ih->identity,
@@ -1404,6 +1420,7 @@ issue_ticket (struct TicketIssueHandle *ih)
     char *ptr = (char*) attrs_record[j].data;
     GNUNET_free (ptr);
   }
+  GNUNET_free (tkt_data);
   GNUNET_free (attrs_record);
   GNUNET_free (label);
 }
@@ -1454,7 +1471,7 @@ filter_tickets_cb (void *cls,
                    const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct TicketIssueHandle *tih = cls;
-  struct GNUNET_RECLAIM_Ticket *ticket = NULL;
+  struct GNUNET_RECLAIM_Ticket ticket;
   struct GNUNET_RECLAIM_Presentation *presentation;
   struct GNUNET_RECLAIM_PresentationList *ticket_presentations;
   struct GNUNET_RECLAIM_Credential *cred;
@@ -1462,6 +1479,7 @@ filter_tickets_cb (void *cls,
   struct GNUNET_RECLAIM_AttributeListEntry *le;
   unsigned int attr_cnt = 0;
   unsigned int pres_cnt = 0;
+  int ticket_found = GNUNET_NO;
 
   for (le = tih->attrs->list_head; NULL != le; le = le->next)
   {
@@ -1473,6 +1491,7 @@ filter_tickets_cb (void *cls,
   // ticket search
   unsigned int found_attrs_cnt = 0;
   unsigned int found_pres_cnt = 0;
+  size_t read;
   ticket_presentations = GNUNET_new (struct GNUNET_RECLAIM_PresentationList);
 
   for (int i = 0; i < rd_count; i++)
@@ -1480,16 +1499,28 @@ filter_tickets_cb (void *cls,
     // found ticket
     if (GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET == rd[i].record_type)
     {
-      ticket = (struct GNUNET_RECLAIM_Ticket *) rd[i].data;
+      if ((GNUNET_SYSERR ==
+           GNUNET_RECLAIM_read_ticket_from_buffer (rd[i].data,
+                                                   rd[i].data_size,
+                                                   &ticket,
+                                                   &read)) ||
+          (read != rd[i].data_size))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Failed to deserialize ticket from record\n");
+        continue;
+      }
       // cmp audience
+      // FIXME this is ugly, GNUNET_IDENTITY_PublicKey cannot be compared
+      // like this
       if (0 == memcmp (&tih->ticket.audience,
-                       &ticket->audience,
+                       &ticket.audience,
                        sizeof(struct GNUNET_IDENTITY_PublicKey)))
       {
-        tih->ticket = *ticket;
+        tih->ticket = ticket;
+        ticket_found = GNUNET_YES;
         continue;
       }
-      ticket = NULL;
     }
 
     // cmp requested attributes with ticket attributes
@@ -1573,7 +1604,7 @@ filter_tickets_cb (void *cls,
    */
   if ((attr_cnt == found_attrs_cnt) &&
       (pres_cnt == found_pres_cnt) &&
-      (NULL != ticket))
+      (GNUNET_YES == ticket_found))
   {
     GNUNET_NAMESTORE_zone_iteration_stop (tih->ns_it);
     tih->cb (tih->cb_cls, &tih->ticket, ticket_presentations, GNUNET_OK, NULL);
@@ -1683,12 +1714,25 @@ collect_tickets_cb (void *cls,
                     const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct RECLAIM_TICKETS_Iterator *iter = cls;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t read;
 
   for (int i = 0; i < rd_count; i++)
   {
     if (GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET != rd[i].record_type)
       continue;
-    iter->cb (iter->cb_cls, (struct GNUNET_RECLAIM_Ticket *) rd[i].data);
+    if ((GNUNET_SYSERR ==
+         GNUNET_RECLAIM_read_ticket_from_buffer (rd[i].data,
+                                                 rd[i].data_size,
+                                                 &ticket,
+                                                 &read)) ||
+        (read != rd[i].data_size))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to deserialize ticket from record\n");
+      continue;
+    }
+    iter->cb (iter->cb_cls, &ticket);
     return;
   }
   GNUNET_NAMESTORE_zone_iterator_next (iter->ns_it, 1);
diff --git a/src/reclaim/reclaim.h b/src/reclaim/reclaim.h
index aae8ee89a..5813beaf7 100644
--- a/src/reclaim/reclaim.h
+++ b/src/reclaim/reclaim.h
@@ -44,6 +44,11 @@ struct AttributeStoreMessage
    */
   struct GNUNET_MessageHeader header;
 
+  /**
+   * The expiration interval of the attribute
+   */
+  uint64_t exp GNUNET_PACKED;
+
   /**
    * Unique identifier for this request (for key collisions).
    */
@@ -55,16 +60,13 @@ struct AttributeStoreMessage
   uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * The expiration interval of the attribute
-   */
-  uint64_t exp GNUNET_PACKED;
-
-  /**
-   * Identity
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by the serialized attribute */
+  /*
+   * followed by the zone private key
+   * followed by the serialized attribute */
 };
 
 
@@ -89,9 +91,9 @@ struct AttributeDeleteMessage
   uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * Identity
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by the serialized attribute */
 };
@@ -149,11 +151,13 @@ struct AttributeResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the public key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t pkey_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * followed by the public key key.
+   * followed by:
    * serialized attribute data
    */
 };
@@ -184,11 +188,13 @@ struct CredentialResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the public key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * followed by the private key.
+   * followed by:
    * serialized credential data
    */
 };
@@ -210,9 +216,13 @@ struct AttributeIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -249,9 +259,13 @@ struct CredentialIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -321,9 +335,13 @@ struct TicketIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -377,21 +395,25 @@ struct IssueTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * length of serialized attribute list
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * Requesting party.
+   * The length of the identity private key
    */
-  struct GNUNET_IDENTITY_PublicKey rp;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * length of serialized attribute list
+   * The length of the relying party public key
    */
-  uint32_t attr_len GNUNET_PACKED;
+  uint32_t pkey_len GNUNET_PACKED;
 
-  // Followed by a serialized attribute list
+  /**
+   * Followed by the private key.
+   * Followed by the public key.
+   * Followed by a serialized attribute list
+   */
 };
 
 /**
@@ -410,19 +432,20 @@ struct RevokeTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * length of serialized attribute list
+   * The length of the ticket
    */
-  uint32_t attrs_len GNUNET_PACKED;
+  uint32_t tkt_len GNUNET_PACKED;
 
   /**
-   * The ticket to revoke
+   * Followed by the serialized ticket.
+   * Followed by the private key.
+   * Followed by a serialized attribute list
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
 };
 
 /**
@@ -463,16 +486,19 @@ struct TicketResultMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Length of new presentations created
+   * Ticket length
    */
-  uint32_t presentations_len GNUNET_PACKED;
+  uint32_t tkt_len GNUNET_PACKED;
 
   /**
-   * The new ticket
+   * Length of new presentations created
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
+  uint32_t presentations_len GNUNET_PACKED;
 
-  /* Followed by the serialized GNUNET_RECLAIM_PresentationList */
+  /*
+   * Followed by the serialized ticket
+   * Followed by the serialized GNUNET_RECLAIM_PresentationList
+   */
 };
 
 /**
@@ -491,14 +517,19 @@ struct ConsumeTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * The ticket to consume
+   * The length of the ticket
+   */
+  uint32_t tkt_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private key.
+   * Followed by the serialized ticket.
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
 };
 
 /**
@@ -537,11 +568,13 @@ struct ConsumeTicketResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * Followed by the private key.
+   * followed by:
    * serialized attributes data
    */
 };
diff --git a/src/reclaim/reclaim_api.c b/src/reclaim/reclaim_api.c
index 6f55d62e4..efc45e616 100644
--- a/src/reclaim/reclaim_api.c
+++ b/src/reclaim/reclaim_api.c
@@ -567,12 +567,13 @@ check_consume_ticket_result (void *cls,
   size_t msg_len;
   size_t attrs_len;
   size_t pl_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   attrs_len = ntohs (msg->attrs_len);
+  key_len = ntohl (msg->key_len);
   pl_len = ntohs (msg->presentations_len);
-  if (msg_len !=
-      sizeof(struct ConsumeTicketResultMessage) + attrs_len + pl_len)
+  if (msg_len != sizeof(*msg) + attrs_len + pl_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -592,14 +593,18 @@ static void
 handle_consume_ticket_result (void *cls,
                               const struct ConsumeTicketResultMessage *msg)
 {
+  struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_Operation *op;
   size_t attrs_len;
   size_t pl_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
   char *read_ptr;
 
   attrs_len = ntohs (msg->attrs_len);
+  key_len = ntohl (msg->key_len);
   pl_len = ntohs (msg->presentations_len);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Processing ticket result.\n");
 
@@ -615,15 +620,22 @@ handle_consume_ticket_result (void *cls,
     struct GNUNET_RECLAIM_AttributeListEntry *le;
     struct GNUNET_RECLAIM_PresentationList *pl;
     struct GNUNET_RECLAIM_PresentationListEntry *ple;
+    read_ptr = (char *) &msg[1];
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (read_ptr,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    read_ptr += read;
     attrs =
-      GNUNET_RECLAIM_attribute_list_deserialize ((char *) &msg[1], attrs_len);
-    read_ptr = ((char *) &msg[1]) + attrs_len;
+      GNUNET_RECLAIM_attribute_list_deserialize (read_ptr, attrs_len);
+    read_ptr += attrs_len;
     pl = GNUNET_RECLAIM_presentation_list_deserialize (read_ptr, pl_len);
     if (NULL != op->atr_cb)
     {
       if (NULL == attrs)
       {
-        op->atr_cb (op->cls, &msg->identity, NULL, NULL);
+        op->atr_cb (op->cls, &identity, NULL, NULL);
       }
       else
       {
@@ -638,7 +650,7 @@ handle_consume_ticket_result (void *cls,
                   GNUNET_RECLAIM_id_is_equal (&le->attribute->credential,
                                               
&ple->presentation->credential_id))
               {
-                op->atr_cb (op->cls, &msg->identity,
+                op->atr_cb (op->cls, &identity,
                             le->attribute, ple->presentation);
                 break;
               }
@@ -647,7 +659,7 @@ handle_consume_ticket_result (void *cls,
           }
           else     // No credentials
           {
-            op->atr_cb (op->cls, &msg->identity,
+            op->atr_cb (op->cls, &identity,
                         le->attribute, NULL);
           }
         }
@@ -679,10 +691,12 @@ check_attribute_result (void *cls, const struct 
AttributeResultMessage *msg)
 {
   size_t msg_len;
   size_t attr_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   attr_len = ntohs (msg->attr_len);
-  if (msg_len != sizeof(struct AttributeResultMessage) + attr_len)
+  key_len = ntohl (msg->pkey_len);
+  if (msg_len != sizeof(*msg) + attr_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -701,17 +715,20 @@ check_attribute_result (void *cls, const struct 
AttributeResultMessage *msg)
 static void
 handle_attribute_result (void *cls, const struct AttributeResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey identity_dummy;
+  static struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_AttributeIterator *it;
   struct GNUNET_RECLAIM_Operation *op;
   size_t attr_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
+  char *buf;
 
   attr_len = ntohs (msg->attr_len);
+  key_len = ntohl (msg->pkey_len);
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Processing attribute result.\n");
 
-
   for (it = h->it_head; NULL != it; it = it->next)
     if (it->r_id == r_id)
       break;
@@ -721,8 +738,8 @@ handle_attribute_result (void *cls, const struct 
AttributeResultMessage *msg)
   if ((NULL == it) && (NULL == op))
     return;
 
-  if ((0 ==
-       (memcmp (&msg->identity, &identity_dummy, sizeof(identity_dummy)))))
+  buf = (char *) &msg[1];
+  if (0 == key_len)
   {
     if ((NULL == it) && (NULL == op))
     {
@@ -748,17 +765,22 @@ handle_attribute_result (void *cls, const struct 
AttributeResultMessage *msg)
 
   {
     struct GNUNET_RECLAIM_Attribute *attr;
-    GNUNET_RECLAIM_attribute_deserialize ((char *) &msg[1], attr_len,
-                                          &attr);
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (buf,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    buf += read;
+    GNUNET_RECLAIM_attribute_deserialize (buf, attr_len, &attr);
     if (NULL != it)
     {
       if (NULL != it->proc)
-        it->proc (it->proc_cls, &msg->identity, attr);
+        it->proc (it->proc_cls, &identity, attr);
     }
     else if (NULL != op)
     {
       if (NULL != op->ar_cb)
-        op->ar_cb (op->cls, &msg->identity, attr);
+        op->ar_cb (op->cls, &identity, attr);
     }
     GNUNET_free (attr);
     return;
@@ -780,10 +802,12 @@ check_credential_result (void *cls, const struct 
CredentialResultMessage *msg)
 {
   size_t msg_len;
   size_t cred_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   cred_len = ntohs (msg->credential_len);
-  if (msg_len != sizeof(struct CredentialResultMessage) + cred_len)
+  key_len = ntohl (msg->key_len);
+  if (msg_len != sizeof(*msg) + cred_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -803,13 +827,17 @@ static void
 handle_credential_result (void *cls, const struct
                           CredentialResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey identity_dummy;
+  struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_CredentialIterator *it;
   struct GNUNET_RECLAIM_Operation *op;
   size_t att_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
+  char *buf;
 
+  key_len = ntohl (msg->key_len);
   att_len = ntohs (msg->credential_len);
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Processing credential result.\n");
 
@@ -823,8 +851,17 @@ handle_credential_result (void *cls, const struct
   if ((NULL == it) && (NULL == op))
     return;
 
-  if ((0 ==
-       (memcmp (&msg->identity, &identity_dummy, sizeof(identity_dummy)))))
+  buf = (char *) &msg[1];
+  if (0 < key_len)
+  {
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (buf,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    buf += read;
+  }
+  if (0 == key_len)
   {
     if ((NULL == it) && (NULL == op))
     {
@@ -850,17 +887,17 @@ handle_credential_result (void *cls, const struct
 
   {
     struct GNUNET_RECLAIM_Credential *att;
-    att = GNUNET_RECLAIM_credential_deserialize ((char *) &msg[1], att_len);
+    att = GNUNET_RECLAIM_credential_deserialize (buf, att_len);
 
     if (NULL != it)
     {
       if (NULL != it->proc)
-        it->proc (it->proc_cls, &msg->identity, att);
+        it->proc (it->proc_cls, &identity, att);
     }
     else if (NULL != op)
     {
       if (NULL != op->at_cb)
-        op->at_cb (op->cls, &msg->identity, att);
+        op->at_cb (op->cls, &identity, att);
     }
     GNUNET_free (att);
     return;
@@ -882,10 +919,12 @@ check_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
 {
   size_t msg_len;
   size_t pres_len;
+  size_t tkt_len;
 
   msg_len = ntohs (msg->header.size);
   pres_len = ntohs (msg->presentations_len);
-  if (msg_len != sizeof(struct TicketResultMessage) + pres_len)
+  tkt_len = ntohl (msg->tkt_len);
+  if (msg_len != sizeof(*msg) + pres_len + tkt_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -909,9 +948,14 @@ handle_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
   struct GNUNET_RECLAIM_TicketIterator *it;
   struct GNUNET_RECLAIM_PresentationList *presentation;
   uint32_t r_id = ntohl (msg->id);
-  static const struct GNUNET_RECLAIM_Ticket ticket;
-  uint32_t pres_len = ntohs (msg->presentations_len);
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t pres_len;
+  size_t tkt_len;
+  size_t tb_read;
+  char *buf;
 
+  tkt_len = ntohl (msg->tkt_len);
+  pres_len = ntohs (msg->presentations_len);
   for (op = handle->op_head; NULL != op; op = op->next)
     if (op->r_id == r_id)
       break;
@@ -920,15 +964,21 @@ handle_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
       break;
   if ((NULL == op) && (NULL == it))
     return;
+  buf = (char*) &msg[1];
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_RECLAIM_read_ticket_from_buffer (buf,
+                                                         tkt_len,
+                                                         &ticket,
+                                                         &tb_read));
+  buf += tb_read;
   if (NULL != op)
   {
     if (0 < pres_len)
       presentation = GNUNET_RECLAIM_presentation_list_deserialize (
-        (char*) &msg[1],
+        buf,
         pres_len);
     GNUNET_CONTAINER_DLL_remove (handle->op_head, handle->op_tail, op);
-    if (0 ==
-        memcmp (&msg->ticket, &ticket, sizeof(struct GNUNET_RECLAIM_Ticket)))
+    if (0 == tb_read)
     {
       if (NULL != op->ti_cb)
         op->ti_cb (op->cls, NULL, NULL);
@@ -937,7 +987,7 @@ handle_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
     {
       if (NULL != op->ti_cb)
         op->ti_cb (op->cls,
-                   &msg->ticket,
+                   &ticket,
                    (0 < pres_len) ? presentation : NULL);
     }
     if (0 < pres_len)
@@ -947,8 +997,7 @@ handle_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
   }
   else if (NULL != it)
   {
-    if (0 ==
-        memcmp (&msg->ticket, &ticket, sizeof(struct GNUNET_RECLAIM_Ticket)))
+    if (0 == tkt_len)
     {
       GNUNET_CONTAINER_DLL_remove (handle->ticket_it_head,
                                    handle->ticket_it_tail,
@@ -959,7 +1008,7 @@ handle_ticket_result (void *cls, const struct 
TicketResultMessage *msg)
     else
     {
       if (NULL != it->tr_cb)
-        it->tr_cb (it->cls, &msg->ticket);
+        it->tr_cb (it->cls, &ticket);
     }
     return;
   }
@@ -1110,18 +1159,6 @@ GNUNET_RECLAIM_disconnect (struct GNUNET_RECLAIM_Handle 
*h)
 }
 
 
-/**
- * Store an attribute.  If the attribute is already present,
- * it is replaced with the new attribute.
- *
- * @param h handle to the re:claimID service
- * @param pkey private key of the identity
- * @param attr the attribute value
- * @param exp_interval the relative expiration interval for the attribute
- * @param cont continuation to call when done
- * @param cont_cls closure for @a cont
- * @return handle to abort the request
- */
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_store (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1134,6 +1171,9 @@ GNUNET_RECLAIM_attribute_store (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeStoreMessage *sam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
@@ -1141,15 +1181,20 @@ GNUNET_RECLAIM_attribute_store (
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   attr_len = GNUNET_RECLAIM_attribute_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (sam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_STORE);
-  sam->identity = *pkey;
+  sam->key_len = htonl (key_len);
+  buf = (char *) &sam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 < written);
+  buf += written;
   sam->id = htonl (op->r_id);
   sam->exp = GNUNET_htonll (exp_interval->rel_value_us);
 
-  GNUNET_RECLAIM_attribute_serialize (attr, (char *) &sam[1]);
+  GNUNET_RECLAIM_attribute_serialize (attr, buf);
 
   sam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1158,17 +1203,6 @@ GNUNET_RECLAIM_attribute_store (
 }
 
 
-/**
- * Delete an attribute. Tickets used to share this attribute are updated
- * accordingly.
- *
- * @param h handle to the re:claimID service
- * @param pkey Private key of the identity to add an attribute to
- * @param attr The attribute
- * @param cont Continuation to call when done
- * @param cont_cls Closure for @a cont
- * @return handle Used to to abort the request
- */
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_delete (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1180,6 +1214,9 @@ GNUNET_RECLAIM_attribute_delete (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeDeleteMessage *dam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
@@ -1187,13 +1224,18 @@ GNUNET_RECLAIM_attribute_delete (
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   attr_len = GNUNET_RECLAIM_attribute_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (dam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_DELETE);
-  dam->identity = *pkey;
+  dam->key_len = htonl (key_len);
+  buf = (char *) &dam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 < written);
+  buf += written;
   dam->id = htonl (op->r_id);
-  GNUNET_RECLAIM_attribute_serialize (attr, (char *) &dam[1]);
+  GNUNET_RECLAIM_attribute_serialize (attr, buf);
 
   dam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1214,22 +1256,30 @@ GNUNET_RECLAIM_credential_store (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeStoreMessage *sam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->as_cb = cont;
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_credential_serialize_get_size (credential);
   op->env = GNUNET_MQ_msg_extra (sam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_STORE);
-  sam->identity = *pkey;
+  sam->key_len = htonl (key_len);
+  buf = (char *) &sam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   sam->id = htonl (op->r_id);
   sam->exp = GNUNET_htonll (exp_interval->rel_value_us);
 
-  GNUNET_RECLAIM_credential_serialize (credential, (char *) &sam[1]);
+  GNUNET_RECLAIM_credential_serialize (credential, buf);
 
   sam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1249,20 +1299,28 @@ GNUNET_RECLAIM_credential_delete (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeDeleteMessage *dam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->as_cb = cont;
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_credential_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (dam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  
GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_DELETE);
-  dam->identity = *pkey;
+  dam->key_len = htonl (key_len);
+  buf = (char *) &dam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   dam->id = htonl (op->r_id);
-  GNUNET_RECLAIM_credential_serialize (attr, (char *) &dam[1]);
+  GNUNET_RECLAIM_credential_serialize (attr, buf);
 
   dam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1271,30 +1329,6 @@ GNUNET_RECLAIM_credential_delete (
 }
 
 
-/**
- * List all attributes for a local identity.
- * This MUST lock the `struct GNUNET_RECLAIM_Handle`
- * for any other calls than #GNUNET_RECLAIM_get_attributes_next() and
- * #GNUNET_RECLAIM_get_attributes_stop. @a proc will be called once
- * immediately, and then again after
- * #GNUNET_RECLAIM_get_attributes_next() is invoked.
- *
- * On error (disconnect), @a error_cb will be invoked.
- * On normal completion, @a finish_cb proc will be
- * invoked.
- *
- * @param h Handle to the re:claimID service
- * @param identity Identity to iterate over
- * @param error_cb Function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls Closure for @a error_cb
- * @param proc Function to call on each attribute
- * @param proc_cls Closure for @a proc
- * @param finish_cb Function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls Closure for @a finish_cb
- * @return an iterator Handle to use for iteration
- */
 struct GNUNET_RECLAIM_AttributeIterator *
 GNUNET_RECLAIM_get_attributes_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1310,6 +1344,7 @@ GNUNET_RECLAIM_get_attributes_start (
   struct GNUNET_MQ_Envelope *env;
   struct AttributeIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   it = GNUNET_new (struct GNUNET_RECLAIM_AttributeIterator);
@@ -1322,11 +1357,15 @@ GNUNET_RECLAIM_get_attributes_start (
   it->proc_cls = proc_cls;
   it->r_id = rid;
   it->identity = *identity;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->it_head, h->it_tail, it);
   env =
-    GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START);
+    GNUNET_MQ_msg_extra (msg,
+                         key_len,
+                         
GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1349,13 +1388,6 @@ GNUNET_RECLAIM_get_attributes_next (struct 
GNUNET_RECLAIM_AttributeIterator *it)
 }
 
 
-/**
- * Stops iteration and releases the handle for further calls. Must
- * be called on any iteration that has not yet completed prior to calling
- * #GNUNET_RECLAIM_disconnect.
- *
- * @param it the iterator
- */
 void
 GNUNET_RECLAIM_get_attributes_stop (struct GNUNET_RECLAIM_AttributeIterator 
*it)
 {
@@ -1374,30 +1406,6 @@ GNUNET_RECLAIM_get_attributes_stop (struct 
GNUNET_RECLAIM_AttributeIterator *it)
 }
 
 
-/**
- * List all credentials for a local identity.
- * This MUST lock the `struct GNUNET_RECLAIM_Handle`
- * for any other calls than #GNUNET_RECLAIM_get_credentials_next() and
- * #GNUNET_RECLAIM_get_credentials_stop. @a proc will be called once
- * immediately, and then again after
- * #GNUNET_RECLAIM_get_credentials_next() is invoked.
- *
- * On error (disconnect), @a error_cb will be invoked.
- * On normal completion, @a finish_cb proc will be
- * invoked.
- *
- * @param h Handle to the re:claimID service
- * @param identity Identity to iterate over
- * @param error_cb Function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls Closure for @a error_cb
- * @param proc Function to call on each credential
- * @param proc_cls Closure for @a proc
- * @param finish_cb Function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls Closure for @a finish_cb
- * @return an iterator Handle to use for iteration
- */
 struct GNUNET_RECLAIM_CredentialIterator *
 GNUNET_RECLAIM_get_credentials_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1413,6 +1421,7 @@ GNUNET_RECLAIM_get_credentials_start (
   struct GNUNET_MQ_Envelope *env;
   struct CredentialIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   ait = GNUNET_new (struct GNUNET_RECLAIM_CredentialIterator);
@@ -1425,12 +1434,15 @@ GNUNET_RECLAIM_get_credentials_start (
   ait->proc_cls = proc_cls;
   ait->r_id = rid;
   ait->identity = *identity;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->ait_head, h->ait_tail, ait);
   env =
-    GNUNET_MQ_msg (msg,
-                   GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START);
+    GNUNET_MQ_msg_extra (msg,
+                         key_len,
+                         
GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, &msg[1], key_len);
   if (NULL == h->mq)
     ait->env = env;
   else
@@ -1486,23 +1498,35 @@ GNUNET_RECLAIM_ticket_issue (
   struct GNUNET_RECLAIM_Operation *op;
   struct IssueTicketMessage *tim;
   size_t attr_len;
+  size_t key_len;
+  size_t rpk_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->ti_cb = cb;
   op->cls = cb_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (iss);
+  rpk_len = GNUNET_IDENTITY_public_key_get_length (rp);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
   op->env = GNUNET_MQ_msg_extra (tim,
-                                 attr_len,
+                                 attr_len + key_len + rpk_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ISSUE_TICKET);
-  tim->identity = *iss;
-  tim->rp = *rp;
+  tim->key_len = htonl (key_len);
+  tim->pkey_len = htonl (rpk_len);
+  buf = (char *) &tim[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (iss, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (rp, buf, rpk_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   tim->id = htonl (op->r_id);
 
-  GNUNET_RECLAIM_attribute_list_serialize (attrs, (char *) &tim[1]);
-
+  GNUNET_RECLAIM_attribute_list_serialize (attrs, buf);
   tim->attr_len = htons (attr_len);
   if (NULL != h->mq)
     GNUNET_MQ_send_copy (h->mq, op->env);
@@ -1532,17 +1556,28 @@ GNUNET_RECLAIM_ticket_consume (
 {
   struct GNUNET_RECLAIM_Operation *op;
   struct ConsumeTicketMessage *ctm;
+  size_t key_len;
+  size_t tkt_len;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->atr_cb = cb;
   op->cls = cb_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
+  tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
-  op->env = GNUNET_MQ_msg (ctm, GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET);
-  ctm->identity = *identity;
+  op->env = GNUNET_MQ_msg_extra (ctm,
+                                 key_len + tkt_len,
+                                 GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET);
+  ctm->key_len = htonl (key_len);
+  buf = (char*) &ctm[1];
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, buf, key_len);
+  buf += key_len;
+  ctm->tkt_len = htonl (tkt_len);
+  GNUNET_RECLAIM_write_ticket_to_buffer (ticket, buf, tkt_len);
   ctm->id = htonl (op->r_id);
-  ctm->ticket = *ticket;
   if (NULL != h->mq)
     GNUNET_MQ_send_copy (h->mq, op->env);
   else
@@ -1551,23 +1586,6 @@ GNUNET_RECLAIM_ticket_consume (
 }
 
 
-/**
- * Lists all tickets that have been issued to remote
- * identites (relying parties)
- *
- * @param h the reclaim to use
- * @param identity the issuing identity
- * @param error_cb function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls closure for @a error_cb
- * @param proc function to call on each ticket; it
- *        will be called repeatedly with a value (if available)
- * @param proc_cls closure for @a proc
- * @param finish_cb function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls closure for @a finish_cb
- * @return an iterator handle to use for iteration
- */
 struct GNUNET_RECLAIM_TicketIterator *
 GNUNET_RECLAIM_ticket_iteration_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1583,6 +1601,7 @@ GNUNET_RECLAIM_ticket_iteration_start (
   struct GNUNET_MQ_Envelope *env;
   struct TicketIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   it = GNUNET_new (struct GNUNET_RECLAIM_TicketIterator);
@@ -1594,10 +1613,17 @@ GNUNET_RECLAIM_ticket_iteration_start (
   it->tr_cb = proc;
   it->cls = proc_cls;
   it->r_id = rid;
+
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->ticket_it_head, h->ticket_it_tail, it);
-  env = GNUNET_MQ_msg (msg, 
GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             
GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity,
+                                               &msg[1],
+                                               key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1674,6 +1700,10 @@ GNUNET_RECLAIM_ticket_revoke (
   struct GNUNET_RECLAIM_Operation *op;
   struct RevokeTicketMessage *msg;
   uint32_t rid;
+  size_t key_len;
+  size_t tkt_len;
+  ssize_t written;
+  char *buf;
 
   rid = h->r_id_gen++;
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
@@ -1682,10 +1712,23 @@ GNUNET_RECLAIM_ticket_revoke (
   op->cls = cb_cls;
   op->r_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
-  op->env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_RECLAIM_REVOKE_TICKET);
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
+  tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
+  op->env = GNUNET_MQ_msg_extra (msg,
+                                 key_len + tkt_len,
+                                 GNUNET_MESSAGE_TYPE_RECLAIM_REVOKE_TICKET);
   msg->id = htonl (rid);
-  msg->identity = *identity;
-  msg->ticket = *ticket;
+  msg->key_len = htonl (key_len);
+  msg->tkt_len = htonl (tkt_len);
+  buf = (char*) &msg[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (identity,
+                                                         buf,
+                                                         key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
+  GNUNET_RECLAIM_write_ticket_to_buffer (ticket,
+                                         buf,
+                                         tkt_len);
   if (NULL != h->mq)
   {
     GNUNET_MQ_send (h->mq, op->env);
@@ -1694,5 +1737,78 @@ GNUNET_RECLAIM_ticket_revoke (
   return op;
 }
 
+size_t
+GNUNET_RECLAIM_ticket_serialize_get_size (const struct
+                                          GNUNET_RECLAIM_Ticket *tkt)
+{
+  size_t size = sizeof (tkt->rnd);
+  size += GNUNET_IDENTITY_public_key_get_length (&tkt->identity);
+  size += GNUNET_IDENTITY_public_key_get_length (&tkt->audience);
+  return size;
+}
+
+enum GNUNET_GenericReturnValue
+GNUNET_RECLAIM_read_ticket_from_buffer (const void *buffer,
+                                        size_t len,
+                                        struct GNUNET_RECLAIM_Ticket *tkt,
+                                        size_t *tb_read)
+{
+  const char *tmp = buffer;
+  size_t read = 0;
+  size_t left = len;
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_read_public_key_from_buffer (tmp,
+                                                   left,
+                                                   &tkt->identity,
+                                                   &read))
+    return GNUNET_SYSERR;
+  left -= read;
+  tmp += read;
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_read_public_key_from_buffer (tmp,
+                                                   left,
+                                                   &tkt->audience,
+                                                   &read))
+    return GNUNET_SYSERR;
+  left -= read;
+  tmp += read;
+  if (left < sizeof (tkt->rnd))
+    return GNUNET_SYSERR;
+  memcpy (&tkt->rnd, tmp, sizeof (tkt->rnd));
+  *tb_read = tmp - (char*) buffer + sizeof (tkt->rnd);
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_RECLAIM_write_ticket_to_buffer (const struct
+                                       GNUNET_RECLAIM_Ticket *tkt,
+                                       void *buffer,
+                                       size_t len)
+{
+  char *tmp = buffer;
+  size_t left = len;
+  ssize_t written = 0;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&tkt->identity,
+                                                        buffer,
+                                                        left);
+  if (0 > written)
+    return written;
+  left -= written;
+  tmp += written;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&tkt->audience,
+                                                        tmp,
+                                                        left);
+  if (0 > written)
+    return written;
+  left -= written;
+  tmp += written;
+  if (left < sizeof (tkt->rnd))
+    return -1;
+  memcpy (tmp, &tkt->rnd, sizeof (tkt->rnd));
+  return tmp - (char*) buffer + sizeof (tkt->rnd);
+}
+
+
 
 /* end of reclaim_api.c */
diff --git a/src/reclaim/test_did_helper.c b/src/reclaim/test_did_helper.c
index 698edf180..446c199fc 100644
--- a/src/reclaim/test_did_helper.c
+++ b/src/reclaim/test_did_helper.c
@@ -78,8 +78,9 @@ test_GNUNET_DID_did_to_pkey ()
   DID_did_to_pkey ((char *) test_did, &pkey);
 
   GNUNET_assert (test_pkey.type = pkey.type);
-  GNUNET_assert (strcmp (pkey.eddsa_key.q_y,
-                         test_pkey.eddsa_key.q_y) == 0);
+  GNUNET_assert (memcmp (&pkey.eddsa_key,
+                         &test_pkey.eddsa_key,
+                         sizeof (test_pkey.eddsa_key)) == 0);
 }
 
 // void
diff --git a/src/reclaim/test_reclaim.conf b/src/reclaim/test_reclaim.conf
index 2dc53fe81..faa195ae1 100644
--- a/src/reclaim/test_reclaim.conf
+++ b/src/reclaim/test_reclaim.conf
@@ -13,9 +13,13 @@ PREFIX = valgrind --leak-check=full --track-origins=yes 
--log-file=$GNUNET_TMP/r
 [transport]
 PLUGINS =
 
+[zonemaster]
+START_ON_DEMAND = YES
+IMMEDIATE_START = YES
+
 [reclaim]
 START_ON_DEMAND = YES
-TICKET_REFRESH_INTERVAL = 30 s
+TICKET_REFRESH_INTERVAL = 1 h
 #PREFIX = valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes 
--log-file=$GNUNET_TMP/idplog
 
 [gns]
diff --git a/src/reclaim/test_reclaim_attribute.sh 
b/src/reclaim/test_reclaim_attribute.sh
index 744c898ed..17f7863d4 100755
--- a/src/reclaim/test_reclaim_attribute.sh
+++ b/src/reclaim/test_reclaim_attribute.sh
@@ -29,7 +29,7 @@ gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
-gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf > /dev/null 2>&1
+gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 if test $? != 0
 then
   echo "Failed."
diff --git a/src/reclaim/test_reclaim_consume.sh 
b/src/reclaim/test_reclaim_consume.sh
index c012862c3..8a88136c6 100755
--- a/src/reclaim/test_reclaim_consume.sh
+++ b/src/reclaim/test_reclaim_consume.sh
@@ -25,6 +25,7 @@ which timeout >/dev/null 2>&1 && DO_TIMEOUT="timeout 30"
 TEST_ATTR="test"
 gnunet-arm -s -c test_reclaim.conf
 #gnunet-arm -i rest -c test_reclaim.conf
+gnunet-arm -I
 gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 SUBJECT_KEY=$(gnunet-identity -d -e rpego -q -c test_reclaim.conf)
@@ -32,7 +33,10 @@ TEST_KEY=$(gnunet-identity -d -e testego -q -c 
test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
 gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 TICKET=$(gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c 
test_reclaim.conf | awk '{print $1}')
-gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf #>/dev/null 2>&1
+gnunet-namestore -z testego -D -c test_reclaim.conf
+gnunet-identity -d -c test_reclaim.conf
+sleep 1
+gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf
 
 RES=$?
 gnunet-identity -D testego -c test_reclaim.conf
diff --git a/src/reclaim/test_reclaim_issue.sh 
b/src/reclaim/test_reclaim_issue.sh
index cfddc9407..63140e54c 100755
--- a/src/reclaim/test_reclaim_issue.sh
+++ b/src/reclaim/test_reclaim_issue.sh
@@ -29,8 +29,8 @@ gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 SUBJECT_KEY=$(gnunet-identity -d -e rpego -q -c test_reclaim.conf)
 TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
-gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf > 
/dev/null 2>&1
-gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf > /dev/null 2>&1
+gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
+gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 #gnunet-reclaim -e testego -D -c test_reclaim.conf
 gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c test_reclaim.conf 
> /dev/null 2>&1
 if test $? != 0
diff --git a/src/revocation/gnunet-revocation-tvg.c 
b/src/revocation/gnunet-revocation-tvg.c
index 682f41530..a126709ce 100644
--- a/src/revocation/gnunet-revocation-tvg.c
+++ b/src/revocation/gnunet-revocation-tvg.c
@@ -115,14 +115,14 @@ run (void *cls,
   GNUNET_IDENTITY_key_get_public (&id_priv,
                                   &id_pub);
   GNUNET_STRINGS_data_to_string (&id_pub,
-                                 GNUNET_IDENTITY_key_get_length (&id_pub),
+                                 GNUNET_IDENTITY_public_key_get_length 
(&id_pub),
                                  ztld,
                                  sizeof (ztld));
   fprintf (stdout, "Zone private key (d, big-endian scalar):\n");
   print_bytes_ (&id_priv.ecdsa_key, sizeof(id_priv.ecdsa_key), 8, 1);
   fprintf (stdout, "\n");
   fprintf (stdout, "Zone identifier (ztype|zkey):\n");
-  key_len = GNUNET_IDENTITY_key_get_length (&id_pub);
+  key_len = GNUNET_IDENTITY_public_key_get_length (&id_pub);
   GNUNET_assert (0 < key_len);
   print_bytes (&id_pub, key_len, 8);
   fprintf (stdout, "\n");
diff --git a/src/revocation/gnunet-revocation.c 
b/src/revocation/gnunet-revocation.c
index a7f96385c..853ca0f71 100644
--- a/src/revocation/gnunet-revocation.c
+++ b/src/revocation/gnunet-revocation.c
@@ -343,7 +343,7 @@ ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
               GNUNET_DISK_fn_read (filename, proof_of_work,
                                    GNUNET_REVOCATION_MAX_PROOF_SIZE))))
   {
-    ssize_t ksize = GNUNET_IDENTITY_key_get_length (&key);
+    ssize_t ksize = GNUNET_IDENTITY_public_key_get_length (&key);
     if (0 > ksize)
     {
       fprintf (stderr,
diff --git a/src/revocation/gnunet-service-revocation.c 
b/src/revocation/gnunet-service-revocation.c
index 4494ade83..fe74201f3 100644
--- a/src/revocation/gnunet-service-revocation.c
+++ b/src/revocation/gnunet-service-revocation.c
@@ -316,7 +316,7 @@ publicize_rm (const struct RevokeMessage *rm)
   const struct GNUNET_IDENTITY_PublicKey *pk
     = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
 
-  pklen = GNUNET_IDENTITY_key_get_length (pk);
+  pklen = GNUNET_IDENTITY_public_key_get_length (pk);
   if (0 > pklen)
   {
     GNUNET_break_op (0);
@@ -950,7 +950,7 @@ run (void *cls,
                                           GNUNET_REVOCATION_PowP *) &rm[1];
     ssize_t ksize;
     pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-    ksize = GNUNET_IDENTITY_key_get_length (pk);
+    ksize = GNUNET_IDENTITY_public_key_get_length (pk);
     if (0 > ksize)
     {
       GNUNET_break_op (0);
diff --git a/src/revocation/plugin_block_revocation.c 
b/src/revocation/plugin_block_revocation.c
index 12ec555e4..0c81440eb 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -56,10 +56,10 @@ struct InternalContext
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_revocation_check_query (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size)
+                                     enum GNUNET_BLOCK_Type type,
+                                     const struct GNUNET_HashCode *query,
+                                     const void *xquery,
+                                     size_t xquery_size)
 {
   (void) cls;
   (void) query;
@@ -86,16 +86,16 @@ block_plugin_revocation_check_query (void *cls,
  */
 static enum GNUNET_GenericReturnValue
 block_plugin_revocation_check_block (void *cls,
-                                    enum GNUNET_BLOCK_Type type,
-                                    const void *block,
-                                    size_t block_size)
+                                     enum GNUNET_BLOCK_Type type,
+                                     const void *block,
+                                     size_t block_size)
 {
   struct InternalContext *ic = cls;
   const struct RevokeMessage *rm = block;
   const struct GNUNET_REVOCATION_PowP *pow
     = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
   struct GNUNET_IDENTITY_PublicKey pk;
-  ssize_t pklen;
+  size_t pklen;
   size_t left;
 
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
@@ -114,9 +114,10 @@ block_plugin_revocation_check_block (void *cls,
     return GNUNET_NO;
   }
   left = block_size - sizeof (*rm) - sizeof (*pow);
-  pklen = GNUNET_IDENTITY_read_key_from_buffer (&pk,
-                                                &pow[1],
-                                                left);
+  GNUNET_IDENTITY_read_public_key_from_buffer (&pow[1],
+                                               left,
+                                               &pk,
+                                               &pklen);
   if (0 > pklen)
   {
     GNUNET_break_op (0);
@@ -152,14 +153,14 @@ block_plugin_revocation_check_block (void *cls,
  */
 static enum GNUNET_BLOCK_ReplyEvaluationResult
 block_plugin_revocation_check_reply (
-                                     void *cls,
-                                     enum GNUNET_BLOCK_Type type,
-                                    struct GNUNET_BLOCK_Group *group,
-                                    const struct GNUNET_HashCode *query,
-                                    const void *xquery,
-                                    size_t xquery_size,
-                                    const void *reply_block,
-                                    size_t reply_block_size)
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
 {
   (void) cls;
   (void) group;
@@ -199,7 +200,7 @@ block_plugin_revocation_get_key (void *cls,
   const struct GNUNET_REVOCATION_PowP *pow
     = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
   struct GNUNET_IDENTITY_PublicKey pk;
-  ssize_t pklen;
+  size_t pklen;
   size_t left;
 
   if (GNUNET_BLOCK_TYPE_REVOCATION != type)
@@ -218,9 +219,10 @@ block_plugin_revocation_get_key (void *cls,
     return GNUNET_NO;
   }
   left = block_size - sizeof (*rm) - sizeof (*pow);
-  pklen = GNUNET_IDENTITY_read_key_from_buffer (&pk,
-                                                &pow[1],
-                                                left);
+  GNUNET_IDENTITY_read_public_key_from_buffer (&pow[1],
+                                               left,
+                                               &pk,
+                                               &pklen);
   if (0 > pklen)
   {
     GNUNET_break_op (0);
@@ -242,7 +244,7 @@ void *
 libgnunet_plugin_block_revocation_init (void *cls)
 {
   static const enum GNUNET_BLOCK_Type types[] = {
-                                                 GNUNET_BLOCK_TYPE_REVOCATION,
+    GNUNET_BLOCK_TYPE_REVOCATION,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index 78b3c083a..34b4eddd7 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -407,14 +407,14 @@ REV_create_signature_message (const struct 
GNUNET_REVOCATION_PowP *pow)
   size_t ksize;
 
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  ksize = GNUNET_IDENTITY_key_get_length (pk);
+  ksize = GNUNET_IDENTITY_public_key_get_length (pk);
   spurp = GNUNET_malloc (sizeof (*spurp) + ksize);
   spurp->timestamp = pow->timestamp;
   spurp->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
   spurp->purpose.size = htonl (sizeof(*spurp) + ksize);
-  GNUNET_IDENTITY_write_key_to_buffer (pk,
-                                       (char*) &spurp[1],
-                                       ksize);
+  GNUNET_IDENTITY_write_public_key_to_buffer (pk,
+                                              (char*) &spurp[1],
+                                              ksize);
   return spurp;
 }
 
@@ -426,14 +426,15 @@ check_signature_identity (const struct 
GNUNET_REVOCATION_PowP *pow,
   unsigned char *sig;
   size_t ksize;
 
-  ksize = GNUNET_IDENTITY_key_get_length (key);
+  ksize = GNUNET_IDENTITY_public_key_get_length (key);
   spurp = REV_create_signature_message (pow);
   sig = ((unsigned char*) &pow[1] + ksize);
   if (GNUNET_OK !=
-      GNUNET_IDENTITY_signature_verify_raw_ 
(GNUNET_SIGNATURE_PURPOSE_REVOCATION,
-                                             &spurp->purpose,
-                                             sig,
-                                             key))
+      GNUNET_IDENTITY_signature_verify_raw_ (
+        GNUNET_SIGNATURE_PURPOSE_REVOCATION,
+        &spurp->purpose,
+        sig,
+        key))
   {
     return GNUNET_SYSERR;
   }
@@ -503,7 +504,7 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
   GNUNET_memcpy (&buf[sizeof(uint64_t)],
                  &pow->timestamp,
                  sizeof (uint64_t));
-  pklen = GNUNET_IDENTITY_key_get_length (pk);
+  pklen = GNUNET_IDENTITY_public_key_get_length (pk);
   if (0 > pklen)
   {
     GNUNET_break (0);
@@ -578,7 +579,7 @@ sign_pow_identity (const struct GNUNET_IDENTITY_PrivateKey 
*key,
   ts = GNUNET_TIME_absolute_subtract (ts,
                                       GNUNET_TIME_UNIT_WEEKS);
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  ksize = GNUNET_IDENTITY_key_get_length (pk);
+  ksize = GNUNET_IDENTITY_public_key_get_length (pk);
   pow->timestamp = GNUNET_TIME_absolute_hton (ts);
   rp = REV_create_signature_message (pow);
   sig = ((char*) &pow[1]) + ksize;
@@ -691,7 +692,7 @@ GNUNET_REVOCATION_pow_round (struct 
GNUNET_REVOCATION_PowCalculationHandle *pc)
   GNUNET_memcpy (&buf[sizeof(uint64_t)],
                  &pc->pow->timestamp,
                  sizeof (uint64_t));
-  ksize = GNUNET_IDENTITY_key_get_length (pk);
+  ksize = GNUNET_IDENTITY_public_key_get_length (pk);
   GNUNET_assert (0 < ksize);
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
                  pk,
@@ -749,7 +750,7 @@ GNUNET_REVOCATION_proof_get_size (const struct 
GNUNET_REVOCATION_PowP *pow)
 
   size = sizeof (struct GNUNET_REVOCATION_PowP);
   pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  ksize = GNUNET_IDENTITY_key_get_length (pk);
+  ksize = GNUNET_IDENTITY_public_key_get_length (pk);
   size += ksize;
   size += GNUNET_IDENTITY_signature_get_raw_length_by_type (pk->type);
   return size;

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.



reply via email to

[Prev in Thread] Current Thread [Next in Thread]