gnunet-svn
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[gnunet] 01/07: - towards crypto agility; wip


From: gnunet
Subject: [gnunet] 01/07: - towards crypto agility; wip
Date: Thu, 15 Oct 2020 12:18:55 +0200

This is an automated email from the git hooks/post-receive script.

martin-schanzenbach pushed a commit to branch master
in repository gnunet.

commit 96c802b46be51e5c45f34e2de823f787d26c2929
Author: Martin Schanzenbach <mschanzenbach@posteo.de>
AuthorDate: Wed Oct 14 19:47:32 2020 +0200

    - towards crypto agility; wip
---
 src/fs/fs_download.c                               |   2 +-
 src/fs/gnunet-publish.c                            |  13 +-
 src/gns/gns.h                                      |   2 +-
 src/gns/gns_api.c                                  |   4 +-
 src/gns/gns_tld_api.c                              |  17 +-
 src/gns/gnunet-service-gns.c                       |   6 +-
 src/gns/gnunet-service-gns.h                       |   3 +-
 src/gns/gnunet-service-gns_interceptor.c           |   2 +-
 src/gns/gnunet-service-gns_resolver.c              |  22 +--
 src/gns/gnunet-service-gns_resolver.h              |   2 +-
 src/gnsrecord/Makefile.am                          |   1 +
 src/gnsrecord/gnsrecord_crypto.c                   | 148 ++++++++++++-----
 src/gnsrecord/gnsrecord_misc.c                     |  21 ++-
 src/gnsrecord/gnunet-gnsrecord-tvg.c               |  22 +--
 src/gnsrecord/perf_gnsrecord_crypto.c              |   5 +-
 src/gnsrecord/plugin_gnsrecord_dns.c               |   2 +-
 src/gnsrecord/test_gnsrecord_crypto.c              |  11 +-
 src/identity/gnunet-identity.c                     |  22 +--
 src/identity/gnunet-service-identity.c             |  77 ++++++++-
 src/identity/identity.h                            |  81 +++++-----
 src/identity/identity_api.c                        | 176 ++++++++++++++++++---
 src/identity/identity_api_lookup.c                 |   4 +-
 src/identity/plugin_rest_identity.c                |  23 +--
 src/identity/test_identity.c                       |   8 +-
 src/identity/test_identity_defaults.c              |   8 +-
 src/include/gnunet_gns_service.h                   |   5 +-
 src/include/gnunet_gnsrecord_lib.h                 |  24 +--
 src/include/gnunet_identity_service.h              | 107 ++++++++++++-
 src/include/gnunet_namestore_plugin.h              |  12 +-
 src/include/gnunet_namestore_service.h             |  15 +-
 src/include/gnunet_revocation_service.h            |  18 ++-
 src/namecache/gnunet-namecache.c                   |   4 +-
 src/namecache/namecache.h                          |   4 +-
 src/namecache/plugin_namecache_flat.c              |   6 +-
 src/namecache/plugin_namecache_postgres.c          |   6 +-
 src/namecache/plugin_namecache_sqlite.c            |   6 +-
 src/namecache/test_namecache_api_cache_block.c     |  20 +--
 src/namestore/gnunet-namestore-fcfsd.c             |  27 ++--
 src/namestore/gnunet-namestore.c                   |  35 ++--
 src/namestore/gnunet-service-namestore.c           |  34 ++--
 src/namestore/gnunet-zoneimport.c                  |   4 +-
 src/namestore/namestore.h                          |  18 +--
 src/namestore/namestore_api.c                      |  14 +-
 src/namestore/namestore_api_monitor.c              |   4 +-
 src/namestore/perf_namestore_api_zone_iteration.c  |   7 +-
 src/namestore/plugin_namestore_flat.c              |  32 ++--
 src/namestore/plugin_namestore_postgres.c          |  18 +--
 src/namestore/plugin_namestore_sqlite.c            |  18 +--
 src/namestore/plugin_rest_namestore.c              |  14 +-
 src/namestore/test_namestore_api_lookup_nick.c     |  11 +-
 src/namestore/test_namestore_api_lookup_private.c  |  11 +-
 src/namestore/test_namestore_api_lookup_public.c   |  17 +-
 src/namestore/test_namestore_api_lookup_shadow.c   |  17 +-
 .../test_namestore_api_lookup_shadow_filter.c      |  17 +-
 src/namestore/test_namestore_api_monitoring.c      |  12 +-
 .../test_namestore_api_monitoring_existing.c       |  12 +-
 src/namestore/test_namestore_api_remove.c          |  11 +-
 ...test_namestore_api_remove_not_existing_record.c |   9 +-
 src/namestore/test_namestore_api_store.c           |   9 +-
 src/namestore/test_namestore_api_store_update.c    |  13 +-
 src/namestore/test_namestore_api_zone_iteration.c  |  39 +----
 .../test_namestore_api_zone_iteration_nick.c       |  14 +-
 ...st_namestore_api_zone_iteration_specific_zone.c |  14 +-
 .../test_namestore_api_zone_iteration_stop.c       |  39 ++---
 src/namestore/test_namestore_api_zone_to_name.c    |  15 +-
 src/revocation/Makefile.am                         |   1 +
 src/revocation/gnunet-revocation-tvg.c             |  11 +-
 src/revocation/gnunet-revocation.c                 |  13 +-
 src/revocation/gnunet-service-revocation.c         |  71 +++++++--
 src/revocation/plugin_block_revocation.c           |  19 +--
 src/revocation/revocation.h                        |  11 +-
 src/revocation/revocation_api.c                    | 129 ++++++++++-----
 src/revocation/test_revocation.c                   |  21 +--
 73 files changed, 1057 insertions(+), 613 deletions(-)

diff --git a/src/fs/fs_download.c b/src/fs/fs_download.c
index 6154e8be0..d4677b794 100644
--- a/src/fs/fs_download.c
+++ b/src/fs/fs_download.c
@@ -1050,7 +1050,7 @@ process_result_with_request (void *cls,
     GNUNET_asprintf (
       &dc->emsg,
       _ (
-        "Internal error or bogus download URI (expected %u bytes at depth %u 
and offset %llu/%llu, got %u bytes)"),
+        "Internal error or bogus download URI (expected %lu bytes at depth %u 
and offset %llu/%llu, got %lu bytes)"),
       bs,
       dr->depth,
       (unsigned long long) dr->offset,
diff --git a/src/fs/gnunet-publish.c b/src/fs/gnunet-publish.c
index 91fcd8f8a..518192283 100644
--- a/src/fs/gnunet-publish.c
+++ b/src/fs/gnunet-publish.c
@@ -475,6 +475,7 @@ uri_ksk_continuation (void *cls,
                       const char *emsg)
 {
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv;
+  const struct GNUNET_IDENTITY_PrivateKey *pk;
 
   if (NULL != emsg)
   {
@@ -486,7 +487,10 @@ uri_ksk_continuation (void *cls,
     GNUNET_SCHEDULER_shutdown ();
     return;
   }
-  priv = GNUNET_IDENTITY_ego_get_private_key (namespace);
+  pk = GNUNET_IDENTITY_ego_get_private_key (namespace);
+  if (GNUNET_IDENTITY_TYPE_ECDSA != ntohl (pk->type))
+    return;
+  priv = &pk->ecdsa_key;
   GNUNET_FS_publish_sks (ctx,
                          priv,
                          this_id,
@@ -569,6 +573,7 @@ directory_trim_complete (struct GNUNET_FS_ShareTreeItem 
*directory_scan_result)
 {
   struct GNUNET_FS_FileInformation *fi;
   const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv;
+  const struct GNUNET_IDENTITY_PrivateKey *pk;
 
   fi = get_file_information (directory_scan_result);
   GNUNET_FS_share_tree_free (directory_scan_result);
@@ -589,7 +594,11 @@ directory_trim_complete (struct GNUNET_FS_ShareTreeItem 
*directory_scan_result)
   if (NULL == namespace)
     priv = NULL;
   else
-    priv = GNUNET_IDENTITY_ego_get_private_key (namespace);
+  {
+    pk = GNUNET_IDENTITY_ego_get_private_key (namespace);
+    if (GNUNET_IDENTITY_TYPE_ECDSA == ntohl (pk->type))
+      priv = &pk->ecdsa_key;
+  }
   pc = GNUNET_FS_publish_start (ctx,
                                 fi,
                                 priv,
diff --git a/src/gns/gns.h b/src/gns/gns.h
index a193632b7..d824742ad 100644
--- a/src/gns/gns.h
+++ b/src/gns/gns.h
@@ -48,7 +48,7 @@ struct LookupMessage
   /**
    * Zone that is to be used for lookup
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+  struct GNUNET_IDENTITY_PublicKey zone;
 
   /**
    * Local options for where to look for results
diff --git a/src/gns/gns_api.c b/src/gns/gns_api.c
index bf95bf340..841a0d240 100644
--- a/src/gns/gns_api.c
+++ b/src/gns/gns_api.c
@@ -343,7 +343,7 @@ GNUNET_GNS_lookup_cancel (struct GNUNET_GNS_LookupRequest 
*lr)
 struct GNUNET_GNS_LookupRequest *
 GNUNET_GNS_lookup_limited (struct GNUNET_GNS_Handle *handle,
                            const char *name,
-                           const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+                           const struct GNUNET_IDENTITY_PublicKey *zone,
                            uint32_t type,
                            enum GNUNET_GNS_LocalOptions options,
                            uint16_t recursion_depth_limit,
@@ -411,7 +411,7 @@ GNUNET_GNS_lookup_limited (struct GNUNET_GNS_Handle *handle,
 struct GNUNET_GNS_LookupRequest*
 GNUNET_GNS_lookup (struct GNUNET_GNS_Handle *handle,
                    const char *name,
-                   const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+                   const struct GNUNET_IDENTITY_PublicKey *zone,
                    uint32_t type,
                    enum GNUNET_GNS_LocalOptions options,
                    GNUNET_GNS_LookupResultProcessor proc,
diff --git a/src/gns/gns_tld_api.c b/src/gns/gns_tld_api.c
index 3ebf07db6..3eab6c109 100644
--- a/src/gns/gns_tld_api.c
+++ b/src/gns/gns_tld_api.c
@@ -167,7 +167,7 @@ process_lookup_result (void *cls,
  */
 static void
 lookup_with_public_key (struct GNUNET_GNS_LookupWithTldRequest *ltr,
-                        const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey)
+                        const struct GNUNET_IDENTITY_PublicKey *pkey)
 {
   ltr->lr = GNUNET_GNS_lookup (ltr->gns_handle,
                                ltr->name,
@@ -190,11 +190,11 @@ lookup_with_public_key (struct 
GNUNET_GNS_LookupWithTldRequest *ltr,
  */
 static void
 identity_zone_cb (void *cls,
-                  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+                  const struct GNUNET_IDENTITY_PrivateKey *priv,
                   const char *ego_name)
 {
   struct GNUNET_GNS_LookupWithTldRequest *ltr = cls;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
 
   ltr->id_co = NULL;
   if (NULL == priv)
@@ -219,7 +219,7 @@ identity_zone_cb (void *cls,
     ltr->options = GNUNET_GNS_LO_NO_DHT;
   else
     ltr->options = GNUNET_GNS_LO_LOCAL_MASTER;
-  GNUNET_CRYPTO_ecdsa_key_get_public (priv, &pkey);
+  GNUNET_IDENTITY_key_get_public (priv, &pkey);
   lookup_with_public_key (ltr, &pkey);
 }
 
@@ -249,7 +249,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle 
*handle,
   const char *tld;
   char *dot_tld;
   char *zonestr;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
 
   ltr = GNUNET_new (struct GNUNET_GNS_LookupWithTldRequest);
   ltr->gns_handle = handle;
@@ -261,7 +261,7 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle 
*handle,
   /* start with trivial case: TLD is zkey */
   tld = get_tld (ltr->name);
   if (GNUNET_OK ==
-      GNUNET_CRYPTO_ecdsa_public_key_from_string (tld, strlen (tld), &pkey))
+      GNUNET_IDENTITY_public_key_from_string (tld, &pkey))
   {
     eat_tld (ltr->name, tld);
     lookup_with_public_key (ltr, &pkey);
@@ -281,9 +281,8 @@ GNUNET_GNS_lookup_with_tld (struct GNUNET_GNS_Handle 
*handle,
                                                             &zonestr))
     {
       if (GNUNET_OK !=
-          GNUNET_CRYPTO_ecdsa_public_key_from_string (zonestr,
-                                                      strlen (zonestr),
-                                                      &pkey))
+          GNUNET_IDENTITY_public_key_from_string (zonestr,
+                                                  &pkey))
       {
         GNUNET_log_config_invalid (
           GNUNET_ERROR_TYPE_ERROR,
diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index 8c5b2d6c4..52300ae3b 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -123,7 +123,7 @@ struct GNS_TopLevelDomain
   /**
    * Public key associated with the @a tld.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
 
   /**
    * Top-level domain as a string, including leading ".".
@@ -177,7 +177,7 @@ static struct GNS_TopLevelDomain *tld_tail;
  */
 int
 GNS_find_tld (const char *tld_str,
-              struct GNUNET_CRYPTO_EcdsaPublicKey *pkey)
+              struct GNUNET_IDENTITY_PublicKey *pkey)
 {
   if ('\0' == *tld_str)
     return GNUNET_NO;
@@ -485,7 +485,7 @@ read_service_conf (void *cls,
                    const char *option,
                    const char *value)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
   struct GNS_TopLevelDomain *tld;
 
   (void) cls;
diff --git a/src/gns/gnunet-service-gns.h b/src/gns/gnunet-service-gns.h
index 2a432f8aa..d4fb9ec9f 100644
--- a/src/gns/gnunet-service-gns.h
+++ b/src/gns/gnunet-service-gns.h
@@ -26,6 +26,7 @@
 #ifndef GNUNET_SERVICE_GNS_H
 #define GNUNET_SERVICE_GNS_H
 
+#include "gnunet_identity_service.h"
 
 /**
  * Find GNS zone belonging to TLD @a tld.
@@ -36,7 +37,7 @@
  */
 int
 GNS_find_tld (const char *tld_str,
-              struct GNUNET_CRYPTO_EcdsaPublicKey *pkey);
+              struct GNUNET_IDENTITY_PublicKey *pkey);
 
 
 /**
diff --git a/src/gns/gnunet-service-gns_interceptor.c 
b/src/gns/gnunet-service-gns_interceptor.c
index 19416a506..b53f4af6b 100644
--- a/src/gns/gnunet-service-gns_interceptor.c
+++ b/src/gns/gnunet-service-gns_interceptor.c
@@ -314,7 +314,7 @@ handle_dns_request (void *cls,
 {
   struct GNUNET_DNSPARSER_Packet *p;
   struct InterceptLookupHandle *ilh;
-  struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+  struct GNUNET_IDENTITY_PublicKey zone;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Hijacked a DNS request. Processing.\n");
diff --git a/src/gns/gnunet-service-gns_resolver.c 
b/src/gns/gnunet-service-gns_resolver.c
index cb75b23c7..b34402f81 100644
--- a/src/gns/gnunet-service-gns_resolver.c
+++ b/src/gns/gnunet-service-gns_resolver.c
@@ -173,7 +173,7 @@ struct AuthorityChain
     /**
      * The zone of the GNS authority
      */
-    struct GNUNET_CRYPTO_EcdsaPublicKey gns_authority;
+    struct GNUNET_IDENTITY_PublicKey gns_authority;
 
     struct
     {
@@ -305,7 +305,7 @@ struct GNS_ResolverHandle
   /**
    * The top-level GNS authoritative zone to query
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey authority_zone;
+  struct GNUNET_IDENTITY_PublicKey authority_zone;
 
   /**
    * called when resolution phase finishes
@@ -1251,7 +1251,7 @@ handle_gns_cname_result (struct GNS_ResolverHandle *rh,
   const char *tld;
   struct AuthorityChain *ac;
   int af;
-  struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+  struct GNUNET_IDENTITY_PublicKey zone;
 
   nlen = strlen (cname);
   tld = GNS_get_tld (cname);
@@ -1698,7 +1698,7 @@ recursive_pkey_resolution (struct GNS_ResolverHandle *rh,
   struct AuthorityChain *ac;
 
   /* delegation to another zone */
-  if (sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey) !=
+  if (sizeof(struct GNUNET_IDENTITY_PublicKey) !=
       rd->data_size)
   {
     GNUNET_break_op (0);
@@ -1711,7 +1711,7 @@ recursive_pkey_resolution (struct GNS_ResolverHandle *rh,
   ac->gns_authority = GNUNET_YES;
   GNUNET_memcpy (&ac->authority_info.gns_authority,
                  rd->data,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey));
+                 sizeof(struct GNUNET_IDENTITY_PublicKey));
   ac->label = resolver_lookup_get_next_label (rh);
   /* add AC to tail */
   GNUNET_CONTAINER_DLL_insert_tail (rh->ac_head,
@@ -1754,7 +1754,7 @@ recursive_gns2dns_resolution (struct GNS_ResolverHandle 
*rh,
     char *n;
     size_t off;
     struct Gns2DnsPending *gp;
-    struct GNUNET_CRYPTO_EcdsaPublicKey zone;
+    struct GNUNET_IDENTITY_PublicKey zone;
     struct sockaddr_in v4;
     struct sockaddr_in6 v6;
 
@@ -2258,9 +2258,9 @@ handle_gns_resolution_result (void *cls,
 
       case GNUNET_GNSRECORD_TYPE_PKEY:
         {
-          struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+          struct GNUNET_IDENTITY_PublicKey pub;
 
-          if (rd[i].data_size != sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey))
+          if (rd[i].data_size != sizeof(struct GNUNET_IDENTITY_PublicKey))
           {
             GNUNET_break_op (0);
             break;
@@ -2471,7 +2471,7 @@ handle_dht_response (void *cls,
   block = data;
   if (size !=
       ntohl (block->purpose.size)
-      + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+      + sizeof(struct GNUNET_IDENTITY_PublicKey)
       + sizeof(struct GNUNET_CRYPTO_EcdsaSignature))
   {
     /* how did this pass DHT block validation!? */
@@ -2594,7 +2594,7 @@ handle_namecache_block_response (void *cls,
   struct GNS_ResolverHandle *rh = cls;
   struct AuthorityChain *ac = rh->ac_tail;
   const char *label = ac->label;
-  const struct GNUNET_CRYPTO_EcdsaPublicKey *auth =
+  const struct GNUNET_IDENTITY_PublicKey *auth =
     &ac->authority_info.gns_authority;
   struct GNUNET_HashCode query;
 
@@ -2857,7 +2857,7 @@ start_resolver_lookup (void *cls)
  * @return handle to cancel operation
  */
 struct GNS_ResolverHandle *
-GNS_resolver_lookup (const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+GNS_resolver_lookup (const struct GNUNET_IDENTITY_PublicKey *zone,
                      uint32_t record_type,
                      const char *name,
                      enum GNUNET_GNS_LocalOptions options,
diff --git a/src/gns/gnunet-service-gns_resolver.h 
b/src/gns/gnunet-service-gns_resolver.h
index 3dab3c91a..b099c5d65 100644
--- a/src/gns/gnunet-service-gns_resolver.h
+++ b/src/gns/gnunet-service-gns_resolver.h
@@ -86,7 +86,7 @@ typedef void
  * @return handle to cancel operation
  */
 struct GNS_ResolverHandle *
-GNS_resolver_lookup (const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+GNS_resolver_lookup (const struct GNUNET_IDENTITY_PublicKey *zone,
                      uint32_t record_type,
                      const char *name,
                      enum GNUNET_GNS_LocalOptions options,
diff --git a/src/gnsrecord/Makefile.am b/src/gnsrecord/Makefile.am
index 2e6eca7ba..1748ad39d 100644
--- a/src/gnsrecord/Makefile.am
+++ b/src/gnsrecord/Makefile.am
@@ -47,6 +47,7 @@ libgnunetgnsrecord_la_SOURCES = \
   gnsrecord_misc.c
 libgnunetgnsrecord_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL)
 libgnunetgnsrecord_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS)  \
diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index c8919760a..b32b148fe 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -152,7 +152,8 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*key,
                                                    label,
                                                    "gns");
     GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
-                                        &block->derived_key);
+                                        &block->derived_key.ecdsa_key);
+    block->derived_key.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
     derive_block_aes_key (&iv,
                           &skey,
                           label,
@@ -191,7 +192,7 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*key,
  * @return NULL on error (block too large)
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+GNUNET_GNSRECORD_block_create (const struct GNUNET_IDENTITY_PrivateKey *key,
                                struct GNUNET_TIME_Absolute expire,
                                const char *label,
                                const struct GNUNET_GNSRECORD_Data *rd,
@@ -199,14 +200,21 @@ GNUNET_GNSRECORD_block_create (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *key,
 {
   struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
 
-  GNUNET_CRYPTO_ecdsa_key_get_public (key,
-                                      &pkey);
-  return block_create (key,
-                       &pkey,
-                       expire,
-                       label,
-                       rd,
-                       rd_count);
+  switch (ntohl (key->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    GNUNET_CRYPTO_ecdsa_key_get_public (&key->ecdsa_key,
+                                        &pkey);
+    return block_create (&key->ecdsa_key,
+                         &pkey,
+                         expire,
+                         label,
+                         rd,
+                         rd_count);
+  default:
+    GNUNET_assert (0);
+  }
+  return NULL;
 }
 
 
@@ -240,12 +248,19 @@ struct KeyCacheLine
  * @return NULL on error (block too large)
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*key,
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_IDENTITY_PrivateKey *pkey,
                                 struct GNUNET_TIME_Absolute expire,
                                 const char *label,
                                 const struct GNUNET_GNSRECORD_Data *rd,
                                 unsigned int rd_count)
 {
+  const struct GNUNET_CRYPTO_EcdsaPrivateKey *key;
+
+  if (GNUNET_IDENTITY_TYPE_ECDSA != ntohl (pkey->type))
+  {
+    return NULL; //FIXME
+  }
+  key = &pkey->ecdsa_key;
 #define CSIZE 64
   static struct KeyCacheLine cache[CSIZE];
   struct KeyCacheLine *line;
@@ -277,29 +292,27 @@ GNUNET_GNSRECORD_block_create2 (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *key,
  * @param block block to verify
  * @return #GNUNET_OK if the signature is valid
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
 {
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *key;
+
+  if (GNUNET_GNSRECORD_TYPE_PKEY != ntohl (block->derived_key.type))
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+  key = &block->derived_key.ecdsa_key;
+
   return GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN,
                                       &block->purpose,
                                       &block->signature,
-                                      &block->derived_key);
+                                      key);
 }
 
 
-/**
- * Decrypt block.
- *
- * @param block block to decrypt
- * @param zone_key public key of the zone
- * @param label the name for the records
- * @param proc function to call with the result
- * @param proc_cls closure for proc
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the block was
- *        not well-formed
- */
-int
-GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
+enum GNUNET_GenericReturnValue
+block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
                                 const struct
                                 GNUNET_CRYPTO_EcdsaPublicKey *zone_key,
                                 const char *label,
@@ -425,6 +438,39 @@ GNUNET_GNSRECORD_block_decrypt (const struct 
GNUNET_GNSRECORD_Block *block,
 }
 
 
+/**
+ * Decrypt block.
+ *
+ * @param block block to decrypt
+ * @param zone_key public key of the zone
+ * @param label the name for the records
+ * @param proc function to call with the result
+ * @param proc_cls closure for proc
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the block was
+ *        not well-formed
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
+                                const struct
+                                GNUNET_IDENTITY_PublicKey *zone_key,
+                                const char *label,
+                                GNUNET_GNSRECORD_RecordCallback proc,
+                                void *proc_cls)
+{
+  const struct GNUNET_CRYPTO_EcdsaPublicKey *key;
+
+  if (GNUNET_IDENTITY_TYPE_ECDSA != ntohl (zone_key->type))
+  {
+    return GNUNET_NO;
+  }
+  key = &zone_key->ecdsa_key;
+
+  return block_decrypt (block, key, label, proc, proc_cls);
+
+}
+
+
+
 /**
  * Calculate the DHT query for a given @a label in a given @a zone.
  *
@@ -434,17 +480,24 @@ GNUNET_GNSRECORD_block_decrypt (const struct 
GNUNET_GNSRECORD_Block *block,
  */
 void
 GNUNET_GNSRECORD_query_from_private_key (const struct
-                                         GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                         GNUNET_IDENTITY_PrivateKey *zone,
                                          const char *label,
                                          struct GNUNET_HashCode *query)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
-
-  GNUNET_CRYPTO_ecdsa_key_get_public (zone,
-                                      &pub);
-  GNUNET_GNSRECORD_query_from_public_key (&pub,
-                                          label,
-                                          query);
+  struct GNUNET_IDENTITY_PublicKey pub;
+  switch (ntohl (zone->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+
+    GNUNET_IDENTITY_key_get_public (zone,
+                                    &pub);
+    GNUNET_GNSRECORD_query_from_public_key (&pub,
+                                            label,
+                                            query);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
 }
 
 
@@ -457,18 +510,27 @@ GNUNET_GNSRECORD_query_from_private_key (const struct
  */
 void
 GNUNET_GNSRECORD_query_from_public_key (const struct
-                                        GNUNET_CRYPTO_EcdsaPublicKey *pub,
+                                        GNUNET_IDENTITY_PublicKey *pub,
                                         const char *label,
                                         struct GNUNET_HashCode *query)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pd;
-  GNUNET_CRYPTO_ecdsa_public_key_derive (pub,
-                                         label,
-                                         "gns",
-                                         &pd);
-  GNUNET_CRYPTO_hash (&pd,
-                      sizeof(pd),
-                      query);
+  struct GNUNET_IDENTITY_PublicKey pd;
+
+  switch (ntohl (pub->type))
+  {
+  case GNUNET_GNSRECORD_TYPE_PKEY:
+    pd.type = pub->type;
+    GNUNET_CRYPTO_ecdsa_public_key_derive (&pub->ecdsa_key,
+                                           label,
+                                           "gns",
+                                           &pd.ecdsa_key);
+    GNUNET_CRYPTO_hash (&pd,
+                        sizeof(pd),
+                        query);
+    break;
+  default:
+    GNUNET_assert (0);
+  }
 }
 
 
diff --git a/src/gnsrecord/gnsrecord_misc.c b/src/gnsrecord/gnsrecord_misc.c
index 5061f8493..8b590e35f 100644
--- a/src/gnsrecord/gnsrecord_misc.c
+++ b/src/gnsrecord/gnsrecord_misc.c
@@ -62,14 +62,14 @@ GNUNET_GNSRECORD_string_to_lowercase (const char *src)
  * @return string form; will be overwritten by next call to 
#GNUNET_GNSRECORD_z2s
  */
 const char *
-GNUNET_GNSRECORD_z2s (const struct GNUNET_CRYPTO_EcdsaPublicKey *z)
+GNUNET_GNSRECORD_z2s (const struct GNUNET_IDENTITY_PublicKey *z)
 {
-  static char buf[sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey) * 8];
+  static char buf[sizeof(struct GNUNET_IDENTITY_PublicKey) * 8];
   char *end;
 
   end = GNUNET_STRINGS_data_to_string ((const unsigned char *) z,
                                        sizeof(struct
-                                              GNUNET_CRYPTO_EcdsaPublicKey),
+                                              GNUNET_IDENTITY_PublicKey),
                                        buf, sizeof(buf));
   if (NULL == end)
   {
@@ -99,7 +99,7 @@ GNUNET_GNSRECORD_records_cmp (const struct 
GNUNET_GNSRECORD_Data *a,
   if (a->record_type != b->record_type)
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Record type %lu != %lu\n", a->record_type, b->record_type);
+         "Record type %u != %u\n", a->record_type, b->record_type);
     return GNUNET_NO;
   }
   if ((a->expiration_time != b->expiration_time) &&
@@ -115,7 +115,7 @@ GNUNET_GNSRECORD_records_cmp (const struct 
GNUNET_GNSRECORD_Data *a,
       != (b->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS))
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Flags %lu (%lu) != %lu (%lu)\n", a->flags,
+         "Flags %u (%u) != %u (%u)\n", a->flags,
          a->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS, b->flags,
          b->flags & GNUNET_GNSRECORD_RF_RCMP_FLAGS);
     return GNUNET_NO;
@@ -236,12 +236,12 @@ GNUNET_GNSRECORD_is_expired (const struct 
GNUNET_GNSRECORD_Data *rd)
  *         key in an encoding suitable for DNS labels.
  */
 const char *
-GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey)
+GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_IDENTITY_PublicKey *pkey)
 {
   static char ret[128];
   char *pkeys;
 
-  pkeys = GNUNET_CRYPTO_ecdsa_public_key_to_string (pkey);
+  pkeys = GNUNET_IDENTITY_public_key_to_string (pkey);
   GNUNET_snprintf (ret,
                    sizeof(ret),
                    "%s",
@@ -262,12 +262,11 @@ GNUNET_GNSRECORD_pkey_to_zkey (const struct 
GNUNET_CRYPTO_EcdsaPublicKey *pkey)
  */
 int
 GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
-                               struct GNUNET_CRYPTO_EcdsaPublicKey *pkey)
+                               struct GNUNET_IDENTITY_PublicKey *pkey)
 {
   if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_public_key_from_string (zkey,
-                                                  strlen (zkey),
-                                                  pkey))
+      GNUNET_IDENTITY_public_key_from_string (zkey,
+                                              pkey))
     return GNUNET_SYSERR;
   return GNUNET_OK;
 }
diff --git a/src/gnsrecord/gnunet-gnsrecord-tvg.c 
b/src/gnsrecord/gnunet-gnsrecord-tvg.c
index 789ff8aa3..31f077722 100644
--- a/src/gnsrecord/gnunet-gnsrecord-tvg.c
+++ b/src/gnsrecord/gnunet-gnsrecord-tvg.c
@@ -90,18 +90,19 @@ run (void *cls,
   struct GNUNET_TIME_Absolute exp_abs = GNUNET_TIME_absolute_get ();
   struct GNUNET_GNSRECORD_Block *rrblock;
   char *bdata;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey id_priv;
-  struct GNUNET_CRYPTO_EcdsaPublicKey id_pub;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey pkey_data_p;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey_data;
+  struct GNUNET_IDENTITY_PrivateKey id_priv;
+  struct GNUNET_IDENTITY_PublicKey id_pub;
+  struct GNUNET_IDENTITY_PrivateKey pkey_data_p;
+  struct GNUNET_IDENTITY_PublicKey pkey_data;
   void *data;
   size_t data_size;
   char *rdata;
   size_t rdata_size;
 
-  GNUNET_CRYPTO_ecdsa_key_create (&id_priv);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&id_priv,
-                                      &id_pub);
+  id_priv.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&id_priv,
+                                  &id_pub);
   fprintf (stdout, "Zone private key (d, little-endian scalar):\n");
   print_bytes (&id_priv, sizeof(id_priv), 0);
   fprintf (stdout, "\n");
@@ -109,9 +110,10 @@ run (void *cls,
   print_bytes (&id_pub, sizeof(id_pub), 0);
   fprintf (stdout, "\n");
 
-  GNUNET_CRYPTO_ecdsa_key_create (&pkey_data_p);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&pkey_data_p,
-                                      &pkey_data);
+  pkey_data_p.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&pkey_data_p.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&pkey_data_p,
+                                  &pkey_data);
   fprintf (stdout,
            "Label: %s\nRRCOUNT: %d\n\n", TEST_RECORD_LABEL, TEST_RRCOUNT);
   memset (rd, 0, sizeof (struct GNUNET_GNSRECORD_Data) * 2);
diff --git a/src/gnsrecord/perf_gnsrecord_crypto.c 
b/src/gnsrecord/perf_gnsrecord_crypto.c
index eb4633f75..d9a3c20cf 100644
--- a/src/gnsrecord/perf_gnsrecord_crypto.c
+++ b/src/gnsrecord/perf_gnsrecord_crypto.c
@@ -73,7 +73,7 @@ run (void *cls,
   struct GNUNET_GNSRECORD_Data *s_rd;
   const char *s_name;
   struct GNUNET_TIME_Absolute start_time;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+  struct GNUNET_IDENTITY_PrivateKey privkey;
   struct GNUNET_TIME_Absolute expire;
 
   (void) cls;
@@ -81,7 +81,8 @@ run (void *cls,
   (void) cfgfile;
   (void) cfg;
   expire = GNUNET_TIME_absolute_get ();
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
 
   /* test block creation */
   s_name = "DUMMY.dummy.gnunet";
diff --git a/src/gnsrecord/plugin_gnsrecord_dns.c 
b/src/gnsrecord/plugin_gnsrecord_dns.c
index 9ac6fb9e6..bde9944e2 100644
--- a/src/gnsrecord/plugin_gnsrecord_dns.c
+++ b/src/gnsrecord/plugin_gnsrecord_dns.c
@@ -100,7 +100,7 @@ dns_value_to_string (void *cls,
         return NULL;
       }
       GNUNET_asprintf (&result,
-                       "rname=%s mname=%s %lu,%lu,%lu,%lu,%lu",
+                       "rname=%s mname=%s %u,%u,%u,%u,%u",
                        soa->rname,
                        soa->mname,
                        soa->serial,
diff --git a/src/gnsrecord/test_gnsrecord_crypto.c 
b/src/gnsrecord/test_gnsrecord_crypto.c
index b67e9a123..d541f3076 100644
--- a/src/gnsrecord/test_gnsrecord_crypto.c
+++ b/src/gnsrecord/test_gnsrecord_crypto.c
@@ -100,17 +100,18 @@ run (void *cls,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   struct GNUNET_GNSRECORD_Block *block;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  struct GNUNET_IDENTITY_PublicKey pubkey;
   struct GNUNET_HashCode query_pub;
   struct GNUNET_HashCode query_priv;
   struct GNUNET_TIME_Absolute expire = GNUNET_TIME_absolute_get ();
-  struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+  struct GNUNET_IDENTITY_PrivateKey privkey;
 
 
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
   /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
 
   /* test query derivation */
   GNUNET_GNSRECORD_query_from_private_key (&privkey,
diff --git a/src/identity/gnunet-identity.c b/src/identity/gnunet-identity.c
index d0f5546f3..e16ca83e3 100644
--- a/src/identity/gnunet-identity.c
+++ b/src/identity/gnunet-identity.c
@@ -108,7 +108,7 @@ static struct GNUNET_IDENTITY_Operation *delete_op;
 /**
  * Private key from command line option, or NULL.
  */
-struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
+struct GNUNET_IDENTITY_PrivateKey pk;
 
 /**
  * Value to return from #main().
@@ -197,7 +197,7 @@ delete_finished (void *cls,
  */
 static void
 create_finished (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+                 const struct GNUNET_IDENTITY_PrivateKey *pk,
                  const char *emsg)
 {
   struct GNUNET_IDENTITY_Operation **op = cls;
@@ -212,16 +212,16 @@ create_finished (void *cls,
   }
   else if (verbose)
   {
-    struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+    struct GNUNET_IDENTITY_PublicKey pub;
     char *pubs;
 
-    GNUNET_CRYPTO_ecdsa_key_get_public (pk, &pub);
-    pubs = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pub);
+    GNUNET_IDENTITY_key_get_public (pk, &pub);
+    pubs = GNUNET_IDENTITY_public_key_to_string (&pub);
     if (private_keys)
     {
       char *privs;
 
-      privs = GNUNET_CRYPTO_ecdsa_private_key_to_string (pk);
+      privs = GNUNET_IDENTITY_private_key_to_string (pk);
       fprintf (stdout, "%s - %s\n", pubs, privs);
       GNUNET_free (privs);
     }
@@ -293,7 +293,7 @@ print_ego (void *cls,
            void **ctx,
            const char *identifier)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
   char *s;
   char *privs;
 
@@ -342,8 +342,8 @@ print_ego (void *cls,
                      set_ego)) )
     return;
   GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
-  s = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
-  privs = GNUNET_CRYPTO_ecdsa_private_key_to_string (
+  s = GNUNET_IDENTITY_public_key_to_string (&pk);
+  privs = GNUNET_IDENTITY_private_key_to_string (
     GNUNET_IDENTITY_ego_get_private_key (ego));
   if ((monitor) || (NULL != identifier))
   {
@@ -407,11 +407,12 @@ run (void *cls,
                                      strlen (privkey_ego),
                                      &pk,
                                      sizeof(struct
-                                            GNUNET_CRYPTO_EcdsaPrivateKey));
+                                            GNUNET_IDENTITY_PrivateKey));
       create_op =
         GNUNET_IDENTITY_create (sh,
                                 create_ego,
                                 &pk,
+                                0, //Ignored
                                 &create_finished,
                                 &create_op);
     }
@@ -420,6 +421,7 @@ run (void *cls,
         GNUNET_IDENTITY_create (sh,
                                 create_ego,
                                 NULL,
+                                GNUNET_IDENTITY_TYPE_ECDSA, //FIXME from 
parameter
                                 &create_finished,
                                 &create_op);
   }
diff --git a/src/identity/gnunet-service-identity.c 
b/src/identity/gnunet-service-identity.c
index bdacf3ba0..6cdb1c2f7 100644
--- a/src/identity/gnunet-service-identity.c
+++ b/src/identity/gnunet-service-identity.c
@@ -57,7 +57,7 @@ struct Ego
   /**
    * Private key of the ego.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
+  struct GNUNET_IDENTITY_PrivateKey pk;
 
   /**
    * String identifier for the ego.
@@ -538,8 +538,8 @@ handle_get_default_message (void *cls,
  * @return 0 if the keys are equal
  */
 static int
-key_cmp (const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk1,
-         const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk2)
+key_cmp (const struct GNUNET_IDENTITY_PrivateKey *pk1,
+         const struct GNUNET_IDENTITY_PrivateKey *pk2)
 {
   return GNUNET_memcmp (pk1, pk2);
 }
@@ -738,10 +738,10 @@ handle_create_message (void *cls,
   send_result_code (client, 0, NULL);
   fn = get_ego_filename (ego);
   (void) GNUNET_DISK_directory_create_for_file (fn);
-  if (sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey) !=
+  if (sizeof(struct GNUNET_IDENTITY_PrivateKey) !=
       GNUNET_DISK_fn_write (fn,
                             &crm->private_key,
-                            sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey),
+                            sizeof(struct GNUNET_IDENTITY_PrivateKey),
                             GNUNET_DISK_PERM_USER_READ
                             | GNUNET_DISK_PERM_USER_WRITE))
     GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "write", fn);
@@ -1038,6 +1038,67 @@ handle_delete_message (void *cls, const struct 
DeleteMessage *dm)
 }
 
 
+static int
+read_from_file (const char *filename,
+                void *buf,
+                size_t buf_size)
+{
+  int fd;
+  struct stat sb;
+
+  fd = open (filename,
+             O_RDONLY);
+  if (-1 == fd)
+  {
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (0 != fstat (fd,
+                  &sb))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "stat",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (sb.st_size != buf_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "File `%s' has wrong size (%llu), expected %llu bytes\n",
+                filename,
+                (unsigned long long) sb.st_size,
+                (unsigned long long) buf_size);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  if (buf_size !=
+      read (fd,
+            buf,
+            buf_size))
+  {
+    GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_WARNING,
+                              "read",
+                              filename);
+    GNUNET_assert (0 == close (fd));
+    memset (buf,
+            0,
+            buf_size);
+    return GNUNET_SYSERR;
+  }
+  GNUNET_assert (0 == close (fd));
+  return GNUNET_OK;
+}
+
+
 /**
  * Process the given file from the "EGODIR".  Parses the file
  * and creates the respective 'struct Ego' in memory.
@@ -1063,9 +1124,9 @@ process_ego_file (void *cls,
   }
   ego = GNUNET_new (struct Ego);
   if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_key_from_file (filename,
-                                         GNUNET_NO,
-                                         &ego->pk))
+      read_from_file (filename,
+                      &ego->pk,
+                      sizeof (ego->pk)))
   {
     GNUNET_free (ego);
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
diff --git a/src/identity/identity.h b/src/identity/identity.h
index ef638fa36..11c5883bc 100644
--- a/src/identity/identity.h
+++ b/src/identity/identity.h
@@ -30,6 +30,44 @@
 
 #include "gnunet_common.h"
 
+/**
+ * Handle for an ego.
+ */
+struct GNUNET_IDENTITY_Ego
+{
+  /**
+   * Hash of the private key of this ego.
+   */
+  struct GNUNET_HashCode id;
+
+  /**
+   * The identity key pair
+   */
+  struct GNUNET_IDENTITY_PublicKey pub;
+
+  /**
+   * The identity key pair
+   */
+  struct GNUNET_IDENTITY_PrivateKey pk;
+
+  /**
+   * Current name associated with this ego.
+   */
+  char *name;
+
+  /**
+   * Client context associated with this ego.
+   */
+  void *ctx;
+
+  /**
+   * Set to true once @e pub was initialized
+   */
+  bool pub_initialized;
+};
+
+
+
 
 GNUNET_NETWORK_STRUCT_BEGIN
 
@@ -95,7 +133,7 @@ struct UpdateMessage
   /**
    * The private key
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by 0-terminated ego name */
 };
@@ -151,7 +189,7 @@ struct SetDefaultMessage
   /**
    * The private key
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by 0-terminated service name */
 };
@@ -181,7 +219,7 @@ struct CreateRequestMessage
   /**
    * The private key
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by 0-terminated identity name */
 };
@@ -239,42 +277,5 @@ struct DeleteMessage
 
 GNUNET_NETWORK_STRUCT_END
 
-/**
- * Handle for an ego.
- */
-struct GNUNET_IDENTITY_Ego
-{
-  /**
-   * Hash of the private key of this ego.
-   */
-  struct GNUNET_HashCode id;
-
-  /**
-   * Private key associated with this ego.
-   */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
-
-  /**
-   * Public key associated with this ego. Initialized on demand.
-   * Always use #GNUNET_IDENTITY_ego_get_public_key() to obtain.
-   */
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
-
-  /**
-   * Current name associated with this ego.
-   */
-  char *name;
-
-  /**
-   * Client context associated with this ego.
-   */
-  void *ctx;
-
-  /**
-   * Set to true once @e pub was initialized
-   */
-  bool pub_initialized;
-};
-
 
 #endif
diff --git a/src/identity/identity_api.c b/src/identity/identity_api.c
index f7aca1655..63fa4b919 100644
--- a/src/identity/identity_api.c
+++ b/src/identity/identity_api.c
@@ -74,7 +74,7 @@ struct GNUNET_IDENTITY_Operation
   /**
    * Private key to return to @e create_cont, or NULL.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
+  struct GNUNET_IDENTITY_PrivateKey pk;
 
   /**
    * Continuation to invoke with the result of the transmission for
@@ -157,13 +157,12 @@ GNUNET_IDENTITY_ego_get_anonymous ()
 {
   static struct GNUNET_IDENTITY_Ego anon;
   static int setup;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
 
   if (setup)
     return &anon;
-  anon.pk = *GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
-  GNUNET_CRYPTO_ecdsa_key_get_public (&anon.pk,
-                                      &pub);
+  anon.pk.type = htonl (GNUNET_IDENTITY_TYPE_ECDSA);
+  anon.pub.type = htonl (GNUNET_IDENTITY_TYPE_ECDSA);
+  anon.pk.ecdsa_key = *GNUNET_CRYPTO_ecdsa_key_get_anonymous ();
   GNUNET_CRYPTO_hash (&anon.pk,
                       sizeof(anon.pk),
                       &anon.id);
@@ -172,6 +171,51 @@ GNUNET_IDENTITY_ego_get_anonymous ()
 }
 
 
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_key_get_public (const struct
+                                GNUNET_IDENTITY_PrivateKey *privkey,
+                                struct GNUNET_IDENTITY_PublicKey *key)
+{
+  key->type = privkey->type;
+  switch (ntohl (privkey->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    GNUNET_CRYPTO_ecdsa_key_get_public (&privkey->ecdsa_key,
+                                        &key->ecdsa_key);
+    break;
+  case GNUNET_IDENTITY_TYPE_EDDSA:
+    GNUNET_CRYPTO_eddsa_key_get_public (&privkey->eddsa_key,
+                                        &key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static int
+private_key_create (enum GNUNET_IDENTITY_KeyType ktype,
+                    struct GNUNET_IDENTITY_PrivateKey *key)
+{
+  key->type = htonl (ktype);
+  switch (ktype)
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    GNUNET_CRYPTO_ecdsa_key_create (&key->ecdsa_key);
+    break;
+  case GNUNET_IDENTITY_TYPE_EDDSA:
+    GNUNET_CRYPTO_eddsa_key_create (&key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
 /**
  * Try again to connect to the identity service.
  *
@@ -591,7 +635,7 @@ GNUNET_IDENTITY_connect (const struct 
GNUNET_CONFIGURATION_Handle *cfg,
  * @param ego the ego
  * @return associated ECC key, valid as long as the ego is valid
  */
-const struct GNUNET_CRYPTO_EcdsaPrivateKey *
+const struct GNUNET_IDENTITY_PrivateKey *
 GNUNET_IDENTITY_ego_get_private_key (const struct GNUNET_IDENTITY_Ego *ego)
 {
   return &ego->pk;
@@ -606,12 +650,11 @@ GNUNET_IDENTITY_ego_get_private_key (const struct 
GNUNET_IDENTITY_Ego *ego)
  */
 void
 GNUNET_IDENTITY_ego_get_public_key (struct GNUNET_IDENTITY_Ego *ego,
-                                    struct GNUNET_CRYPTO_EcdsaPublicKey *pk)
+                                    struct GNUNET_IDENTITY_PublicKey *pk)
 {
   if (GNUNET_NO == ego->pub_initialized)
   {
-    GNUNET_CRYPTO_ecdsa_key_get_public (&ego->pk,
-                                        &ego->pub);
+    GNUNET_IDENTITY_key_get_public (&ego->pk, &ego->pub);
     ego->pub_initialized = GNUNET_YES;
   }
   *pk = ego->pub;
@@ -710,20 +753,11 @@ GNUNET_IDENTITY_set (struct GNUNET_IDENTITY_Handle *h,
 }
 
 
-/**
- * Create a new identity with the given name.
- *
- * @param h identity service to use
- * @param name desired name
- * @param privkey desired private key or NULL to create one
- * @param cont function to call with the result (will only be called once)
- * @param cont_cls closure for @a cont
- * @return handle to abort the operation
- */
 struct GNUNET_IDENTITY_Operation *
 GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
                         const char *name,
-                        const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey,
+                        const struct GNUNET_IDENTITY_PrivateKey *privkey,
+                        enum GNUNET_IDENTITY_KeyType ktype,
                         GNUNET_IDENTITY_CreateContinuation cont,
                         void *cont_cls)
 {
@@ -749,7 +783,10 @@ GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *h,
   crm->name_len = htons (slen);
   crm->reserved = htons (0);
   if (NULL == privkey)
-    GNUNET_CRYPTO_ecdsa_key_create (&crm->private_key);
+  {
+    GNUNET_assert (GNUNET_OK ==
+                   private_key_create (ktype, &crm->private_key));
+  }
   else
     crm->private_key = *privkey;
   op->pk = crm->private_key;
@@ -917,4 +954,101 @@ GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle 
*h)
 }
 
 
+ssize_t
+GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key)
+{
+  switch (ntohl (key->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return sizeof (key->type) + sizeof (key->ecdsa_key);
+    break;
+  case GNUNET_IDENTITY_TYPE_EDDSA:
+    return sizeof (key->type) + sizeof (key->eddsa_key);
+    break;
+  default:
+    GNUNET_break (0);
+  }
+  return -1;
+}
+
+
+char *
+GNUNET_IDENTITY_public_key_to_string (const struct
+                                      GNUNET_IDENTITY_PublicKey *key)
+{
+  size_t size = 0;
+  char *res;
+  size = GNUNET_IDENTITY_key_get_length (key);
+  GNUNET_STRINGS_base64_encode (key,
+                                size,
+                                &res);
+  return res;
+}
+
+
+char *
+GNUNET_IDENTITY_private_key_to_string (const struct
+                                       GNUNET_IDENTITY_PrivateKey *key)
+{
+  size_t size = 0;
+  char *res;
+  size += sizeof (key->type);
+  switch (ntohl (key->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    size += sizeof (key->ecdsa_key);
+    break;
+  case GNUNET_IDENTITY_TYPE_EDDSA:
+    size += sizeof (key->eddsa_key);
+    break;
+  }
+  size = GNUNET_STRINGS_base64_encode (key,
+                                       size,
+                                       &res);
+  return res;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_public_key_from_string (const char *str,
+                                        struct GNUNET_IDENTITY_PublicKey *key)
+{
+  char *data = NULL;
+  size_t size;
+
+  size = GNUNET_STRINGS_base64_decode (str,
+                                       strlen (str),
+                                       (void*) &data);
+  if ((NULL == data) ||
+      (size > sizeof (*key)))
+  {
+    GNUNET_free (data);
+    return GNUNET_SYSERR;
+  }
+  memcpy (key, data, size);
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_private_key_from_string (const char *str,
+                                         struct GNUNET_IDENTITY_PrivateKey 
*key)
+{
+  char *data = NULL;
+  size_t size;
+
+  size = GNUNET_STRINGS_base64_decode (str,
+                                       strlen (str),
+                                       (void*) &data);
+  if ((NULL == data) ||
+      (size > sizeof (*key)))
+  {
+    GNUNET_free (data);
+    return GNUNET_SYSERR;
+  }
+  memcpy (key, data, size);
+  return GNUNET_OK;
+}
+
+
 /* end of identity_api.c */
diff --git a/src/identity/identity_api_lookup.c 
b/src/identity/identity_api_lookup.c
index 26b1eacd7..51afb2515 100644
--- a/src/identity/identity_api_lookup.c
+++ b/src/identity/identity_api_lookup.c
@@ -127,14 +127,12 @@ handle_identity_update (void *cls, const struct 
UpdateMessage *um)
   struct GNUNET_IDENTITY_EgoLookup *el = cls;
   uint16_t name_len = ntohs (um->name_len);
   const char *str = (0 == name_len) ? NULL : (const char *) &um[1];
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
   struct GNUNET_HashCode id;
   struct GNUNET_IDENTITY_Ego ego;
   memset (&ego, 0, sizeof (ego));
 
   GNUNET_break (GNUNET_YES != ntohs (um->end_of_list));
-  GNUNET_CRYPTO_ecdsa_key_get_public (&um->private_key, &pub);
-  GNUNET_CRYPTO_hash (&pub, sizeof(pub), &id);
+  GNUNET_CRYPTO_hash (&um->private_key, sizeof(um->private_key), &id);
   ego.pk = um->private_key;
   ego.name = (char *) str;
   ego.id = id;
diff --git a/src/identity/plugin_rest_identity.c 
b/src/identity/plugin_rest_identity.c
index d86d29e36..dba1d478d 100644
--- a/src/identity/plugin_rest_identity.c
+++ b/src/identity/plugin_rest_identity.c
@@ -384,7 +384,7 @@ ego_get_for_subsystem (void *cls,
 {
   struct RequestHandle *handle = cls;
   struct MHD_Response *resp;
-  struct GNUNET_CRYPTO_EcdsaPublicKey public_key;
+  struct GNUNET_IDENTITY_PublicKey public_key;
   json_t *json_root;
   char *result_str;
   char *public_key_string;
@@ -398,7 +398,7 @@ ego_get_for_subsystem (void *cls,
   }
 
   GNUNET_IDENTITY_ego_get_public_key (ego, &public_key);
-  public_key_string = GNUNET_CRYPTO_ecdsa_public_key_to_string (&public_key);
+  public_key_string = GNUNET_IDENTITY_public_key_to_string (&public_key);
 
   // create json with subsystem identity
   json_root = json_object ();
@@ -496,7 +496,7 @@ ego_get_all (struct GNUNET_REST_RequestHandle *con_handle,
         GNUNET_CONTAINER_multihashmap_contains (
           handle->rest_handle->url_param_map, &key))
     {
-      privkey_str = GNUNET_CRYPTO_ecdsa_private_key_to_string (
+      privkey_str = GNUNET_IDENTITY_private_key_to_string (
         GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego));
       json_object_set_new (json_ego,
                            GNUNET_REST_IDENTITY_PARAM_PRIVKEY,
@@ -549,7 +549,7 @@ ego_get_response (struct RequestHandle *handle, struct 
EgoEntry *ego_entry)
       GNUNET_CONTAINER_multihashmap_contains (
         handle->rest_handle->url_param_map, &key))
   {
-    privkey_str = GNUNET_CRYPTO_ecdsa_private_key_to_string (
+    privkey_str = GNUNET_IDENTITY_private_key_to_string (
       GNUNET_IDENTITY_ego_get_private_key (ego_entry->ego));
     json_object_set_new (json_ego,
                          GNUNET_REST_IDENTITY_PARAM_PRIVKEY,
@@ -686,7 +686,7 @@ do_finished (void *cls, const char *emsg)
  */
 static void
 do_finished_create (void *cls,
-                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+                    const struct GNUNET_IDENTITY_PrivateKey *pk,
                     const char *emsg)
 {
   struct RequestHandle *handle = cls;
@@ -999,8 +999,8 @@ ego_create (struct GNUNET_REST_RequestHandle *con_handle,
   json_error_t err;
   char *egoname;
   char *privkey;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey pk;
-  struct GNUNET_CRYPTO_EcdsaPrivateKey *pk_ptr;
+  struct GNUNET_IDENTITY_PrivateKey pk;
+  struct GNUNET_IDENTITY_PrivateKey *pk_ptr;
   int json_unpack_state;
   char term_data[handle->data_size + 1];
 
@@ -1074,7 +1074,7 @@ ego_create (struct GNUNET_REST_RequestHandle *con_handle,
                                    strlen (privkey),
                                    &pk,
                                    sizeof(struct
-                                          GNUNET_CRYPTO_EcdsaPrivateKey));
+                                          GNUNET_IDENTITY_PrivateKey));
     pk_ptr = &pk;
   }
   else
@@ -1084,6 +1084,7 @@ ego_create (struct GNUNET_REST_RequestHandle *con_handle,
   handle->op = GNUNET_IDENTITY_create (identity_handle,
                                        handle->name,
                                        pk_ptr,
+                                       GNUNET_IDENTITY_TYPE_ECDSA,
                                        &do_finished_create,
                                        handle);
 }
@@ -1208,7 +1209,7 @@ list_ego (void *cls,
           const char *identifier)
 {
   struct EgoEntry *ego_entry;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
 
   if ((NULL == ego) && (ID_REST_STATE_INIT == state))
   {
@@ -1219,7 +1220,7 @@ list_ego (void *cls,
   {
     ego_entry = GNUNET_new (struct EgoEntry);
     GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
-    ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
+    ego_entry->keystring = GNUNET_IDENTITY_public_key_to_string (&pk);
     ego_entry->ego = ego;
     ego_entry->identifier = GNUNET_strdup (identifier);
     GNUNET_CONTAINER_DLL_insert_tail (ego_head,
@@ -1245,7 +1246,7 @@ list_ego (void *cls,
       /* Add */
       ego_entry = GNUNET_new (struct EgoEntry);
       GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
-      ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
+      ego_entry->keystring = GNUNET_IDENTITY_public_key_to_string (&pk);
       ego_entry->ego = ego;
       ego_entry->identifier = GNUNET_strdup (identifier);
       GNUNET_CONTAINER_DLL_insert_tail (ego_head,
diff --git a/src/identity/test_identity.c b/src/identity/test_identity.c
index 37eeab238..4954fe7be 100644
--- a/src/identity/test_identity.c
+++ b/src/identity/test_identity.c
@@ -253,7 +253,7 @@ success_rename_cont (void *cls, const char *emsg)
  */
 static void
 create_cb (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+           const struct GNUNET_IDENTITY_PrivateKey *pk,
            const char *emsg)
 {
   CHECK (NULL != pk);
@@ -279,7 +279,11 @@ run (void *cls,
   GNUNET_SCHEDULER_add_shutdown (&cleanup, NULL);
   h = GNUNET_IDENTITY_connect (cfg, &notification_cb, NULL);
   CHECK (NULL != h);
-  op = GNUNET_IDENTITY_create (h, "test-id", NULL, &create_cb, NULL);
+  op = GNUNET_IDENTITY_create (h,
+                               "test-id",
+                               NULL,
+                               GNUNET_IDENTITY_TYPE_ECDSA,
+                               &create_cb, NULL);
 }
 
 
diff --git a/src/identity/test_identity_defaults.c 
b/src/identity/test_identity_defaults.c
index 53eec1252..2d5244d1b 100644
--- a/src/identity/test_identity_defaults.c
+++ b/src/identity/test_identity_defaults.c
@@ -241,7 +241,7 @@ notification_cb (void *cls,
  */
 static void
 create_cb (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+           const struct GNUNET_IDENTITY_PrivateKey *pk,
            const char *emsg)
 {
   CHECK (NULL == emsg);
@@ -266,7 +266,11 @@ run_set (void *cls,
   GNUNET_SCHEDULER_add_shutdown (&cleanup, NULL);
   h = GNUNET_IDENTITY_connect (cfg, &notification_cb, NULL);
   CHECK (NULL != h);
-  op = GNUNET_IDENTITY_create (h, "test-id", NULL, &create_cb, NULL);
+  op = GNUNET_IDENTITY_create (h,
+                               "test-id",
+                               NULL,
+                               GNUNET_IDENTITY_TYPE_ECDSA,
+                               &create_cb, NULL);
 }
 
 
diff --git a/src/include/gnunet_gns_service.h b/src/include/gnunet_gns_service.h
index ef81e9a88..3f6c9b9aa 100644
--- a/src/include/gnunet_gns_service.h
+++ b/src/include/gnunet_gns_service.h
@@ -36,6 +36,7 @@
 
 #include "gnunet_util_lib.h"
 #include "gnunet_dnsparser_lib.h"
+#include "gnunet_identity_service.h"
 #include "gnunet_namestore_service.h"
 
 #ifdef __cplusplus
@@ -139,7 +140,7 @@ enum GNUNET_GNS_LocalOptions
 struct GNUNET_GNS_LookupRequest *
 GNUNET_GNS_lookup (struct GNUNET_GNS_Handle *handle,
                    const char *name,
-                   const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+                   const struct GNUNET_IDENTITY_PublicKey *zone,
                    uint32_t type,
                    enum GNUNET_GNS_LocalOptions options,
                    GNUNET_GNS_LookupResultProcessor proc,
@@ -163,7 +164,7 @@ GNUNET_GNS_lookup (struct GNUNET_GNS_Handle *handle,
 struct GNUNET_GNS_LookupRequest *
 GNUNET_GNS_lookup_limited (struct GNUNET_GNS_Handle *handle,
                            const char *name,
-                           const struct GNUNET_CRYPTO_EcdsaPublicKey *zone,
+                           const struct GNUNET_IDENTITY_PublicKey *zone,
                            uint32_t type,
                            enum GNUNET_GNS_LocalOptions options,
                            uint16_t recursion_depth_limit,
diff --git a/src/include/gnunet_gnsrecord_lib.h 
b/src/include/gnunet_gnsrecord_lib.h
index 960203fb1..6124b2925 100644
--- a/src/include/gnunet_gnsrecord_lib.h
+++ b/src/include/gnunet_gnsrecord_lib.h
@@ -34,6 +34,8 @@
 #ifndef GNUNET_GNSRECORD_LIB_H
 #define GNUNET_GNSRECORD_LIB_H
 
+#include "gnunet_identity_service.h"
+
 #ifdef __cplusplus
 extern "C" {
 #if 0 /* keep Emacsens' auto-indent happy */
@@ -55,7 +57,7 @@ extern "C" {
 /**
  * Record type for GNS zone transfer ("PKEY").
  */
-#define GNUNET_GNSRECORD_TYPE_PKEY 65536
+#define GNUNET_GNSRECORD_TYPE_PKEY GNUNET_IDENTITY_TYPE_ECDSA
 
 /**
  * Record type for GNS nick names ("NICK").
@@ -275,7 +277,7 @@ struct GNUNET_GNSRECORD_Block
   /**
    * Derived key used for signing; hash of this is the query.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey derived_key;
+  struct GNUNET_IDENTITY_PublicKey derived_key;
 
   /**
    * Number of bytes signed; also specifies the number of bytes
@@ -335,7 +337,7 @@ struct GNUNET_GNSRECORD_ReverseRecord
   /**
    * The public key of the namespace the is delegating to our namespace
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
 
   /**
    * The expiration time of the delegation
@@ -488,7 +490,7 @@ GNUNET_GNSRECORD_string_to_lowercase (const char *src);
  * #GNUNET_GNSRECORD_z2s.
  */
 const char *
-GNUNET_GNSRECORD_z2s (const struct GNUNET_CRYPTO_EcdsaPublicKey *z);
+GNUNET_GNSRECORD_z2s (const struct GNUNET_IDENTITY_PublicKey *z);
 
 
 /**
@@ -502,7 +504,7 @@ GNUNET_GNSRECORD_z2s (const struct 
GNUNET_CRYPTO_EcdsaPublicKey *z);
  *         key in an encoding suitable for DNS labels.
  */
 const char *
-GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_CRYPTO_EcdsaPublicKey 
*pkey);
+GNUNET_GNSRECORD_pkey_to_zkey (const struct GNUNET_IDENTITY_PublicKey *pkey);
 
 
 /**
@@ -516,7 +518,7 @@ GNUNET_GNSRECORD_pkey_to_zkey (const struct 
GNUNET_CRYPTO_EcdsaPublicKey *pkey);
  */
 int
 GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
-                               struct GNUNET_CRYPTO_EcdsaPublicKey *pkey);
+                               struct GNUNET_IDENTITY_PublicKey *pkey);
 
 
 /**
@@ -528,7 +530,7 @@ GNUNET_GNSRECORD_zkey_to_pkey (const char *zkey,
  */
 void
 GNUNET_GNSRECORD_query_from_private_key (
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone, const char *label,
+  const struct GNUNET_IDENTITY_PrivateKey *zone, const char *label,
   struct GNUNET_HashCode *query);
 
 
@@ -541,7 +543,7 @@ GNUNET_GNSRECORD_query_from_private_key (
  */
 void
 GNUNET_GNSRECORD_query_from_public_key (
-  const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, const char *label,
+  const struct GNUNET_IDENTITY_PublicKey *pub, const char *label,
   struct GNUNET_HashCode *query);
 
 
@@ -555,7 +557,7 @@ GNUNET_GNSRECORD_query_from_public_key (
  * @param rd_count number of records in @a rd
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+GNUNET_GNSRECORD_block_create (const struct GNUNET_IDENTITY_PrivateKey *key,
                                struct GNUNET_TIME_Absolute expire,
                                const char *label,
                                const struct GNUNET_GNSRECORD_Data *rd,
@@ -574,7 +576,7 @@ GNUNET_GNSRECORD_block_create (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *key,
  * @param rd_count number of records in @a rd
  */
 struct GNUNET_GNSRECORD_Block *
-GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*key,
+GNUNET_GNSRECORD_block_create2 (const struct GNUNET_IDENTITY_PrivateKey *key,
                                 struct GNUNET_TIME_Absolute expire,
                                 const char *label,
                                 const struct GNUNET_GNSRECORD_Data *rd,
@@ -606,7 +608,7 @@ GNUNET_GNSRECORD_block_verify (const struct 
GNUNET_GNSRECORD_Block *block);
 int
 GNUNET_GNSRECORD_block_decrypt (
   const struct GNUNET_GNSRECORD_Block *block,
-  const struct GNUNET_CRYPTO_EcdsaPublicKey *zone_key, const char *label,
+  const struct GNUNET_IDENTITY_PublicKey *zone_key, const char *label,
   GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls);
 
 
diff --git a/src/include/gnunet_identity_service.h 
b/src/include/gnunet_identity_service.h
index 94127248e..c72e6d146 100644
--- a/src/include/gnunet_identity_service.h
+++ b/src/include/gnunet_identity_service.h
@@ -57,6 +57,21 @@ extern "C" {
  */
 #define GNUNET_IDENTITY_VERSION 0x00000100
 
+enum GNUNET_IDENTITY_KeyType
+{
+  /**
+   * The identity type. The value is the same as the
+   * PKEY record type.
+   */
+  GNUNET_IDENTITY_TYPE_ECDSA = 65536,
+
+  /**
+   * EDDSA identity. The value is the same as the EDKEY
+   * record type.
+   */
+  GNUNET_IDENTITY_TYPE_EDDSA = 65599 // FIXME
+};
+
 /**
  * Handle to access the identity service.
  */
@@ -67,6 +82,61 @@ struct GNUNET_IDENTITY_Handle;
  */
 struct GNUNET_IDENTITY_Ego;
 
+
+/**
+ * A private key for an identity as per LSD0001.
+ */
+struct GNUNET_IDENTITY_PrivateKey
+{
+  /**
+   * Type of public key.
+   * Defined by the GNS zone type value.
+   * In NBO.
+   */
+  uint32_t type;
+
+  union
+  {
+    /**
+     * An ECDSA identity key.
+     */
+    struct GNUNET_CRYPTO_EcdsaPrivateKey ecdsa_key;
+
+    /**
+     * AN EdDSA identtiy key
+     */
+    struct GNUNET_CRYPTO_EddsaPrivateKey eddsa_key;
+  };
+};
+
+
+/**
+ * An identity key as per LSD0001.
+ */
+struct GNUNET_IDENTITY_PublicKey
+{
+  /**
+   * Type of public key.
+   * Defined by the GNS zone type value.
+   * In NBO.
+   */
+  uint32_t type;
+
+  union
+  {
+    /**
+     * An ECDSA identity key.
+     */
+    struct GNUNET_CRYPTO_EcdsaPublicKey ecdsa_key;
+
+    /**
+     * AN EdDSA identtiy key
+     */
+    struct GNUNET_CRYPTO_EddsaPublicKey eddsa_key;
+  };
+};
+
+
 /**
  * Handle for an operation with the identity service.
  */
@@ -79,7 +149,7 @@ struct GNUNET_IDENTITY_Operation;
  * @param ego the ego
  * @return associated ECC key, valid as long as the ego is valid
  */
-const struct GNUNET_CRYPTO_EcdsaPrivateKey *
+const struct GNUNET_IDENTITY_PrivateKey *
 GNUNET_IDENTITY_ego_get_private_key (const struct GNUNET_IDENTITY_Ego *ego);
 
 
@@ -100,7 +170,7 @@ GNUNET_IDENTITY_ego_get_anonymous (void);
  */
 void
 GNUNET_IDENTITY_ego_get_public_key (struct GNUNET_IDENTITY_Ego *ego,
-                                    struct GNUNET_CRYPTO_EcdsaPublicKey *pk);
+                                    struct GNUNET_IDENTITY_PublicKey *pk);
 
 
 /**
@@ -224,7 +294,7 @@ GNUNET_IDENTITY_disconnect (struct GNUNET_IDENTITY_Handle 
*h);
 typedef void
 (*GNUNET_IDENTITY_CreateContinuation) (
   void *cls,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+  const struct GNUNET_IDENTITY_PrivateKey *pk,
   const char *emsg);
 
 
@@ -234,6 +304,7 @@ typedef void
  * @param id identity service to use
  * @param name desired name
  * @param privkey desired private key or NULL to create one
+ * @param ktype the type of key to create. Ignored if privkey != NULL.
  * @param cont function to call with the result (will only be called once)
  * @param cont_cls closure for @a cont
  * @return handle to abort the operation
@@ -241,7 +312,8 @@ typedef void
 struct GNUNET_IDENTITY_Operation *
 GNUNET_IDENTITY_create (struct GNUNET_IDENTITY_Handle *id,
                         const char *name,
-                        const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey,
+                        const struct GNUNET_IDENTITY_PrivateKey *privkey,
+                        enum GNUNET_IDENTITY_KeyType ktype,
                         GNUNET_IDENTITY_CreateContinuation cont,
                         void *cont_cls);
 
@@ -291,6 +363,31 @@ GNUNET_IDENTITY_delete (struct GNUNET_IDENTITY_Handle *id,
 void
 GNUNET_IDENTITY_cancel (struct GNUNET_IDENTITY_Operation *op);
 
+ssize_t
+GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key);
+
+char *
+GNUNET_IDENTITY_public_key_to_string (const struct
+                                      GNUNET_IDENTITY_PublicKey *key);
+
+
+char *
+GNUNET_IDENTITY_private_key_to_string (const struct
+                                       GNUNET_IDENTITY_PrivateKey *key);
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_public_key_from_string (const char*str,
+                                        struct GNUNET_IDENTITY_PublicKey *key);
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_private_key_from_string (const char*str,
+                                         struct GNUNET_IDENTITY_PrivateKey 
*key);
+
+enum GNUNET_GenericReturnValue
+GNUNET_IDENTITY_key_get_public (const struct GNUNET_IDENTITY_PrivateKey 
*privkey,
+                                struct GNUNET_IDENTITY_PublicKey *key);
+
 
 /* ************* convenience API to lookup an ego ***************** */
 
@@ -344,7 +441,7 @@ GNUNET_IDENTITY_ego_lookup_cancel (struct 
GNUNET_IDENTITY_EgoLookup *el);
 typedef void
 (*GNUNET_IDENTITY_EgoSuffixCallback) (
   void *cls,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *priv,
+  const struct GNUNET_IDENTITY_PrivateKey *priv,
   const char *ego_name);
 
 
diff --git a/src/include/gnunet_namestore_plugin.h 
b/src/include/gnunet_namestore_plugin.h
index 443c9e451..9cc8abc6e 100644
--- a/src/include/gnunet_namestore_plugin.h
+++ b/src/include/gnunet_namestore_plugin.h
@@ -58,7 +58,7 @@ typedef void
 (*GNUNET_NAMESTORE_RecordIterator) (void *cls,
                                     uint64_t serial,
                                     const struct
-                                    GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
+                                    GNUNET_IDENTITY_PrivateKey *private_key,
                                     const char *label,
                                     unsigned int rd_count,
                                     const struct GNUNET_GNSRECORD_Data *rd);
@@ -87,7 +87,7 @@ struct GNUNET_NAMESTORE_PluginFunctions
    */
   int
   (*store_records) (void *cls,
-                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                    const struct GNUNET_IDENTITY_PrivateKey *zone,
                     const char *label,
                     unsigned int rd_count,
                     const struct GNUNET_GNSRECORD_Data *rd);
@@ -104,7 +104,7 @@ struct GNUNET_NAMESTORE_PluginFunctions
    */
   int
   (*lookup_records) (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                     const struct GNUNET_IDENTITY_PrivateKey *zone,
                      const char *label,
                      GNUNET_NAMESTORE_RecordIterator iter,
                      void *iter_cls);
@@ -126,7 +126,7 @@ struct GNUNET_NAMESTORE_PluginFunctions
    */
   int
   (*iterate_records) (void *cls,
-                      const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                      const struct GNUNET_IDENTITY_PrivateKey *zone,
                       uint64_t serial,
                       uint64_t limit,
                       GNUNET_NAMESTORE_RecordIterator iter,
@@ -146,8 +146,8 @@ struct GNUNET_NAMESTORE_PluginFunctions
    */
   int
   (*zone_to_name) (void *cls,
-                   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-                   const struct GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+                   const struct GNUNET_IDENTITY_PrivateKey *zone,
+                   const struct GNUNET_IDENTITY_PublicKey *value_zone,
                    GNUNET_NAMESTORE_RecordIterator iter,
                    void *iter_cls);
 };
diff --git a/src/include/gnunet_namestore_service.h 
b/src/include/gnunet_namestore_service.h
index bf42c8d34..ca4d2cb52 100644
--- a/src/include/gnunet_namestore_service.h
+++ b/src/include/gnunet_namestore_service.h
@@ -41,6 +41,7 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_gnsrecord_lib.h"
+#include "gnunet_identity_service.h"
 
 #ifdef __cplusplus
 extern "C"
@@ -127,7 +128,7 @@ typedef void
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_records_store (struct GNUNET_NAMESTORE_Handle *h,
                                 const struct
-                                GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+                                GNUNET_IDENTITY_PrivateKey *pkey,
                                 const char *label,
                                 unsigned int rd_count,
                                 const struct GNUNET_GNSRECORD_Data *rd,
@@ -147,7 +148,7 @@ GNUNET_NAMESTORE_records_store (struct 
GNUNET_NAMESTORE_Handle *h,
 typedef void
 (*GNUNET_NAMESTORE_RecordMonitor) (void *cls,
                                    const struct
-                                   GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                   GNUNET_IDENTITY_PrivateKey *zone,
                                    const char *label,
                                    unsigned int rd_count,
                                    const struct GNUNET_GNSRECORD_Data *rd);
@@ -170,7 +171,7 @@ typedef void
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_records_lookup (struct GNUNET_NAMESTORE_Handle *h,
                                  const struct
-                                 GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+                                 GNUNET_IDENTITY_PrivateKey *pkey,
                                  const char *label,
                                  GNUNET_SCHEDULER_TaskCallback error_cb,
                                  void *error_cb_cls,
@@ -197,9 +198,9 @@ GNUNET_NAMESTORE_records_lookup (struct 
GNUNET_NAMESTORE_Handle *h,
  */
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_zone_to_name (struct GNUNET_NAMESTORE_Handle *h,
-                               const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*zone,
+                               const struct GNUNET_IDENTITY_PrivateKey *zone,
                                const struct
-                               GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+                               GNUNET_IDENTITY_PublicKey *value_zone,
                                GNUNET_SCHEDULER_TaskCallback error_cb,
                                void *error_cb_cls,
                                GNUNET_NAMESTORE_RecordMonitor proc,
@@ -246,7 +247,7 @@ GNUNET_NAMESTORE_cancel (struct GNUNET_NAMESTORE_QueueEntry 
*qe);
 struct GNUNET_NAMESTORE_ZoneIterator *
 GNUNET_NAMESTORE_zone_iteration_start (struct GNUNET_NAMESTORE_Handle *h,
                                        const struct
-                                       GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                       GNUNET_IDENTITY_PrivateKey *zone,
                                        GNUNET_SCHEDULER_TaskCallback error_cb,
                                        void *error_cb_cls,
                                        GNUNET_NAMESTORE_RecordMonitor proc,
@@ -316,7 +317,7 @@ struct GNUNET_NAMESTORE_ZoneMonitor *
 GNUNET_NAMESTORE_zone_monitor_start (const struct
                                      GNUNET_CONFIGURATION_Handle *cfg,
                                      const struct
-                                     GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                     GNUNET_IDENTITY_PrivateKey *zone,
                                      int iterate_first,
                                      GNUNET_SCHEDULER_TaskCallback error_cb,
                                      void *error_cb_cls,
diff --git a/src/include/gnunet_revocation_service.h 
b/src/include/gnunet_revocation_service.h
index 105bb1149..479cc61d7 100644
--- a/src/include/gnunet_revocation_service.h
+++ b/src/include/gnunet_revocation_service.h
@@ -21,6 +21,8 @@
 #ifndef GNUNET_REVOCATION_SERVICE_H_
 #define GNUNET_REVOCATION_SERVICE_H_
 
+#include "gnunet_identity_service.h"
+
 /**
  * @author Christian Grothoff
  *
@@ -80,14 +82,16 @@ struct GNUNET_REVOCATION_PowP
   uint64_t pow[POW_COUNT] GNUNET_PACKED;
 
   /**
-   * The signature
+   * The revoked public key
    */
-  struct GNUNET_CRYPTO_EcdsaSignature signature;
+  struct GNUNET_IDENTITY_PublicKey key;
 
   /**
-   * The revoked public key
+   * Length of the signature
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
+  uint32_t sig_len;
+
+  /** followed by a signature **/
 };
 
 
@@ -104,7 +108,7 @@ struct GNUNET_REVOCATION_SignaturePurposePS
   /**
    * The revoked public key
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
+  struct GNUNET_IDENTITY_PublicKey key;
 
   /**
    * The timestamp of the revocation
@@ -150,7 +154,7 @@ typedef void (*GNUNET_REVOCATION_Callback) (void *cls,
  */
 struct GNUNET_REVOCATION_Query *
 GNUNET_REVOCATION_query (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                         const struct GNUNET_CRYPTO_EcdsaPublicKey *key,
+                         const struct GNUNET_IDENTITY_PublicKey *key,
                          GNUNET_REVOCATION_Callback func, void *func_cls);
 
 
@@ -217,7 +221,7 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
  * @param pow the pow object to work with in the calculation.
  */
 void
-GNUNET_REVOCATION_pow_init (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+GNUNET_REVOCATION_pow_init (const struct GNUNET_IDENTITY_PrivateKey *key,
                             struct GNUNET_REVOCATION_PowP *pow);
 
 
diff --git a/src/namecache/gnunet-namecache.c b/src/namecache/gnunet-namecache.c
index 2e3c733e6..19f2a5766 100644
--- a/src/namecache/gnunet-namecache.c
+++ b/src/namecache/gnunet-namecache.c
@@ -51,7 +51,7 @@ static char *name;
 /**
  * Public key of the zone to look in.
  */
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 /**
  * Public key of the zone to look in, in ASCII.
@@ -177,7 +177,7 @@ run (void *cls,
   }
 
   if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_public_key_from_string (pkey, strlen (pkey), 
&pubkey))
+      GNUNET_IDENTITY_public_key_from_string (pkey, &pubkey))
   {
     fprintf (stderr, _ ("Invalid public key for zone `%s'\n"), pkey);
     GNUNET_SCHEDULER_shutdown ();
diff --git a/src/namecache/namecache.h b/src/namecache/namecache.h
index 1657662c2..43c8cf85f 100644
--- a/src/namecache/namecache.h
+++ b/src/namecache/namecache.h
@@ -92,7 +92,7 @@ struct LookupBlockResponseMessage
   /**
    * Derived public key.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey derived_key;
+  struct GNUNET_IDENTITY_PublicKey derived_key;
 
   /* follwed by encrypted block data */
 };
@@ -121,7 +121,7 @@ struct BlockCacheMessage
   /**
    * Derived public key.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey derived_key;
+  struct GNUNET_IDENTITY_PublicKey derived_key;
 
   /* follwed by encrypted block data */
 };
diff --git a/src/namecache/plugin_namecache_flat.c 
b/src/namecache/plugin_namecache_flat.c
index 24f4f2570..1775561e1 100644
--- a/src/namecache/plugin_namecache_flat.c
+++ b/src/namecache/plugin_namecache_flat.c
@@ -208,7 +208,7 @@ store_and_free_entries (void *cls,
   size_t block_size;
 
   block_size = ntohl (entry->block->purpose.size)
-               + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+               + sizeof(struct GNUNET_IDENTITY_PublicKey)
                + sizeof(struct GNUNET_CRYPTO_EcdsaSignature);
 
   GNUNET_STRINGS_base64_encode ((char *) entry->block,
@@ -320,10 +320,10 @@ namecache_cache_block (void *cls,
 
   namecache_expire_blocks (plugin);
   GNUNET_CRYPTO_hash (&block->derived_key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &query);
   block_size = ntohl (block->purpose.size)
-               + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+               + sizeof(struct GNUNET_IDENTITY_PublicKey)
                + sizeof(struct GNUNET_CRYPTO_EcdsaSignature);
   if (block_size > 64 * 65536)
   {
diff --git a/src/namecache/plugin_namecache_postgres.c 
b/src/namecache/plugin_namecache_postgres.c
index 654a3ae81..3c8fc4555 100644
--- a/src/namecache/plugin_namecache_postgres.c
+++ b/src/namecache/plugin_namecache_postgres.c
@@ -183,7 +183,7 @@ namecache_postgres_cache_block (void *cls,
   struct Plugin *plugin = cls;
   struct GNUNET_HashCode query;
   size_t block_size = ntohl (block->purpose.size)
-                      + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+                      + sizeof(struct GNUNET_IDENTITY_PublicKey)
                       + sizeof(struct GNUNET_CRYPTO_EcdsaSignature);
   struct GNUNET_PQ_QueryParam params[] = {
     GNUNET_PQ_query_param_auto_from_type (&query),
@@ -195,7 +195,7 @@ namecache_postgres_cache_block (void *cls,
 
   namecache_postgres_expire_blocks (plugin);
   GNUNET_CRYPTO_hash (&block->derived_key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &query);
   if (block_size > 64 * 65536)
   {
@@ -265,7 +265,7 @@ namecache_postgres_lookup_block (void *cls,
   }
   if ((bsize < sizeof(*block)) ||
       (bsize != ntohl (block->purpose.size)
-       + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+       + sizeof(struct GNUNET_IDENTITY_PublicKey)
        + sizeof(struct GNUNET_CRYPTO_EcdsaSignature)))
   {
     GNUNET_break (0);
diff --git a/src/namecache/plugin_namecache_sqlite.c 
b/src/namecache/plugin_namecache_sqlite.c
index c9d79ba2d..33970631b 100644
--- a/src/namecache/plugin_namecache_sqlite.c
+++ b/src/namecache/plugin_namecache_sqlite.c
@@ -333,7 +333,7 @@ namecache_sqlite_cache_block (void *cls,
   struct GNUNET_HashCode query;
   struct GNUNET_TIME_Absolute expiration;
   size_t block_size = ntohl (block->purpose.size)
-                      + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+                      + sizeof(struct GNUNET_IDENTITY_PublicKey)
                       + sizeof(struct GNUNET_CRYPTO_EcdsaSignature);
   struct GNUNET_SQ_QueryParam del_params[] = {
     GNUNET_SQ_query_param_auto_from_type (&query),
@@ -357,7 +357,7 @@ namecache_sqlite_cache_block (void *cls,
     namecache_sqlite_expire_blocks (plugin);
   }
   GNUNET_CRYPTO_hash (&block->derived_key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                      sizeof(block->derived_key),
                       &query);
   expiration = GNUNET_TIME_absolute_ntoh (block->expiration_time);
   GNUNET_log (GNUNET_ERROR_TYPE_INFO,
@@ -500,7 +500,7 @@ namecache_sqlite_lookup_block (void *cls,
     }
     else if ((block_size < sizeof(struct GNUNET_GNSRECORD_Block)) ||
              (ntohl (block->purpose.size)
-              + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+              + sizeof(struct GNUNET_IDENTITY_PublicKey)
               + sizeof(struct GNUNET_CRYPTO_EcdsaSignature) != block_size))
     {
       GNUNET_break (0);
diff --git a/src/namecache/test_namecache_api_cache_block.c 
b/src/namecache/test_namecache_api_cache_block.c
index 12b72d93b..310c4de42 100644
--- a/src/namecache/test_namecache_api_cache_block.c
+++ b/src/namecache/test_namecache_api_cache_block.c
@@ -39,9 +39,9 @@ static struct GNUNET_NAMECACHE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -172,23 +172,13 @@ run (void *cls,
 {
   struct GNUNET_GNSRECORD_Data rd;
   struct GNUNET_GNSRECORD_Block *block;
-  char *hostkey_file;
   const char *name = "dummy.dummy.gnunet";
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly, NULL);
-  GNUNET_asprintf (&hostkey_file,
-                   "zonefiles%s%s",
-                   DIR_SEPARATOR_STR,
-                   
"N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Using zonekey file `%s' \n",
-              hostkey_file);
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
-                                                    GNUNET_YES,
-                                                    &privkey));
-  GNUNET_free (hostkey_file);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey, &pubkey);
 
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 10000000000;
diff --git a/src/namestore/gnunet-namestore-fcfsd.c 
b/src/namestore/gnunet-namestore-fcfsd.c
index 34641d22e..844f4a990 100644
--- a/src/namestore/gnunet-namestore-fcfsd.c
+++ b/src/namestore/gnunet-namestore-fcfsd.c
@@ -164,7 +164,7 @@ struct Request
    */
   char public_key[128];
 
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+  struct GNUNET_IDENTITY_PublicKey pub;
 };
 
 /**
@@ -211,7 +211,7 @@ static struct GNUNET_NAMESTORE_Handle *ns;
 /**
  * Private key for the fcfsd zone.
  */
-static struct GNUNET_CRYPTO_EcdsaPrivateKey fcfs_zone_pkey;
+static struct GNUNET_IDENTITY_PrivateKey fcfs_zone_pkey;
 
 /**
  * Connection to identity service.
@@ -306,7 +306,6 @@ zone_iteration_end (void *cls)
   /* return static form */
   GNUNET_asprintf (&full_page,
                    ZONEINFO_PAGE,
-                   zr->zoneinfo,
                    zr->zoneinfo);
   response = MHD_create_response_from_buffer (strlen (full_page),
                                               (void *) full_page,
@@ -332,7 +331,7 @@ zone_iteration_end (void *cls)
  */
 static void
 iterate_cb (void *cls,
-            const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+            const struct GNUNET_IDENTITY_PrivateKey *zone_key,
             const char *name,
             unsigned int rd_len,
             const struct GNUNET_GNSRECORD_Data *rd)
@@ -615,7 +614,7 @@ zone_to_name_error (void *cls)
  */
 static void
 zone_to_name_cb (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                 const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                  const char *name,
                  unsigned int rd_count,
                  const struct GNUNET_GNSRECORD_Data *rd)
@@ -677,7 +676,7 @@ lookup_it_error (void *cls)
  */
 static void
 lookup_it_processor (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zonekey,
+                     const struct GNUNET_IDENTITY_PrivateKey *zonekey,
                      const char *label,
                      unsigned int rd_count,
                      const struct GNUNET_GNSRECORD_Data *rd)
@@ -712,9 +711,8 @@ lookup_it_finished (void *cls)
     return;
   }
   if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_public_key_from_string (request->public_key,
-                                                  strlen (request->public_key),
-                                                  &request->pub))
+      GNUNET_IDENTITY_public_key_from_string (request->public_key,
+                                              &request->pub))
   {
     GNUNET_break (0);
     request->phase = RP_FAIL;
@@ -767,7 +765,7 @@ create_response (void *cls,
 {
   struct MHD_Response *response;
   struct Request *request;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+  struct GNUNET_IDENTITY_PublicKey pub;
   MHD_RESULT ret;
 
   (void) cls;
@@ -822,10 +820,8 @@ create_response (void *cls,
       request->pp = NULL;
     }
     if (GNUNET_OK !=
-        GNUNET_CRYPTO_ecdsa_public_key_from_string (request->public_key,
-                                                    strlen (
-                                                      request->public_key),
-                                                    &pub))
+        GNUNET_IDENTITY_public_key_from_string (request->public_key,
+                                                &pub))
     {
       /* parse error */
       return fill_s_reply ("Failed to parse given public key",
@@ -1211,7 +1207,8 @@ main (int argc,
                          options,
                          &run, NULL)) ? 0 : 1;
   GNUNET_free_nz ((void *) argv);
-  GNUNET_CRYPTO_ecdsa_key_clear (&fcfs_zone_pkey);
+  // FIXME
+  // GNUNET_CRYPTO_ecdsa_key_clear (&fcfs_zone_pkey);
   return ret;
 }
 
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 07d045b90..345d76910 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -59,7 +59,7 @@ static struct GNUNET_NAMESTORE_Handle *ns;
 /**
  * Private key for the our zone.
  */
-static struct GNUNET_CRYPTO_EcdsaPrivateKey zone_pkey;
+static struct GNUNET_IDENTITY_PrivateKey zone_pkey;
 
 /**
  * Handle to identity lookup.
@@ -496,7 +496,7 @@ display_record (const char *rname,
  */
 static void
 display_record_iterator (void *cls,
-                         const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                         const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                          const char *rname,
                          unsigned int rd_len,
                          const struct GNUNET_GNSRECORD_Data *rd)
@@ -519,7 +519,7 @@ display_record_iterator (void *cls,
  */
 static void
 display_record_monitor (void *cls,
-                        const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                        const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                         const char *rname,
                         unsigned int rd_len,
                         const struct GNUNET_GNSRECORD_Data *rd)
@@ -542,7 +542,7 @@ display_record_monitor (void *cls,
  */
 static void
 display_record_lookup (void *cls,
-                       const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                       const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                        const char *rname,
                        unsigned int rd_len,
                        const struct GNUNET_GNSRECORD_Data *rd)
@@ -622,7 +622,7 @@ add_error_cb (void *cls)
  */
 static void
 get_existing_record (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                     const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                      const char *rec_name,
                      unsigned int rd_count,
                      const struct GNUNET_GNSRECORD_Data *rd)
@@ -781,7 +781,7 @@ reverse_error_cb (void *cls)
  */
 static void
 handle_reverse_lookup (void *cls,
-                       const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                       const struct GNUNET_IDENTITY_PrivateKey *zone,
                        const char *label,
                        unsigned int rd_count,
                        const struct GNUNET_GNSRECORD_Data *rd)
@@ -826,7 +826,7 @@ del_lookup_error_cb (void *cls)
  */
 static void
 del_monitor (void *cls,
-             const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+             const struct GNUNET_IDENTITY_PrivateKey *zone,
              const char *label,
              unsigned int rd_count,
              const struct GNUNET_GNSRECORD_Data *rd)
@@ -1187,12 +1187,11 @@ run_with_zone_pkey (const struct 
GNUNET_CONFIGURATION_Handle *cfg)
   }
   if (NULL != reverse_pkey)
   {
-    struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+    struct GNUNET_IDENTITY_PublicKey pubkey;
 
     if (GNUNET_OK !=
-        GNUNET_CRYPTO_ecdsa_public_key_from_string (reverse_pkey,
-                                                    strlen (reverse_pkey),
-                                                    &pubkey))
+        GNUNET_IDENTITY_public_key_from_string (reverse_pkey,
+                                                &pubkey))
     {
       fprintf (stderr,
                _ ("Invalid public key for reverse lookup `%s'\n"),
@@ -1211,12 +1210,12 @@ run_with_zone_pkey (const struct 
GNUNET_CONFIGURATION_Handle *cfg)
   {
     char sh[105];
     char sname[64];
-    struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+    struct GNUNET_IDENTITY_PublicKey pkey;
 
     GNUNET_STRINGS_utf8_tolower (uri, uri);
     if ((2 != (sscanf (uri, "gnunet://gns/%52s/%63s", sh, sname))) ||
         (GNUNET_OK !=
-         GNUNET_CRYPTO_ecdsa_public_key_from_string (sh, strlen (sh), &pkey)))
+         GNUNET_IDENTITY_public_key_from_string (sh, &pkey)))
     {
       fprintf (stderr, _ ("Invalid URI `%s'\n"), uri);
       GNUNET_SCHEDULER_shutdown ();
@@ -1242,8 +1241,8 @@ run_with_zone_pkey (const struct 
GNUNET_CONFIGURATION_Handle *cfg)
     }
     memset (&rd, 0, sizeof(rd));
     rd.data = &pkey;
-    rd.data_size = sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey);
-    rd.record_type = GNUNET_GNSRECORD_TYPE_PKEY;
+    rd.data_size = GNUNET_IDENTITY_key_get_length (&pkey);
+    rd.record_type = ntohl (pkey.type);
     rd.expiration_time = etime;
     if (GNUNET_YES == etime_is_rel)
       rd.flags |= GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
@@ -1704,11 +1703,13 @@ main (int argc, char *const *argv)
                                   NULL)))
   {
     GNUNET_free_nz ((void *) argv);
-    GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+    //FIXME
+    //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
     return lret;
   }
   GNUNET_free_nz ((void *) argv);
-  GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
+  //FIXME
+  //GNUNET_CRYPTO_ecdsa_key_clear (&zone_pkey);
   return ret;
 }
 
diff --git a/src/namestore/gnunet-service-namestore.c 
b/src/namestore/gnunet-service-namestore.c
index b24bb2952..d6774b37b 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -82,7 +82,7 @@ struct ZoneIteration
   /**
    * Key of the zone we are iterating over.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * Last sequence number in the zone iteration used to address next
@@ -174,7 +174,7 @@ struct ZoneMonitor
   /**
    * Private key of the zone.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * Task active during initial iteration.
@@ -314,7 +314,7 @@ struct NickCache
   /**
    * Zone the cache entry is for.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * Cached record data.
@@ -336,7 +336,7 @@ static struct NickCache nick_cache[NC_SIZE];
 /**
  * Public key of all zeros.
  */
-static const struct GNUNET_CRYPTO_EcdsaPrivateKey zero;
+static const struct GNUNET_IDENTITY_PrivateKey zero;
 
 /**
  * Configuration handle.
@@ -481,7 +481,7 @@ free_store_activity (struct StoreActivity *sa)
 static void
 lookup_nick_it (void *cls,
                 uint64_t seq,
-                const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
+                const struct GNUNET_IDENTITY_PrivateKey *private_key,
                 const char *label,
                 unsigned int rd_count,
                 const struct GNUNET_GNSRECORD_Data *rd)
@@ -521,7 +521,7 @@ lookup_nick_it (void *cls,
  * @param nick nick entry to cache
  */
 static void
-cache_nick (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+cache_nick (const struct GNUNET_IDENTITY_PrivateKey *zone,
             const struct GNUNET_GNSRECORD_Data *nick)
 {
   struct NickCache *oldest;
@@ -564,9 +564,9 @@ cache_nick (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*zone,
  * @return NULL if no NICK record was found
  */
 static struct GNUNET_GNSRECORD_Data *
-get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone)
+get_nick_record (const struct GNUNET_IDENTITY_PrivateKey *zone)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pub;
+  struct GNUNET_IDENTITY_PublicKey pub;
   struct GNUNET_GNSRECORD_Data *nick;
   int res;
 
@@ -606,7 +606,7 @@ get_nick_record (const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*zone)
                                            __LINE__);
     if (1 == do_log)
     {
-      GNUNET_CRYPTO_ecdsa_key_get_public (zone, &pub);
+      GNUNET_IDENTITY_key_get_public (zone, &pub);
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG | GNUNET_ERROR_TYPE_BULK,
                   "No nick name set for zone `%s'\n",
                   GNUNET_GNSRECORD_z2s (&pub));
@@ -720,7 +720,7 @@ merge_with_nick_records (const struct GNUNET_GNSRECORD_Data 
*nick_rd,
 static void
 send_lookup_response (struct NamestoreClient *nc,
                       uint32_t request_id,
-                      const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                      const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                       const char *name,
                       unsigned int rd_count,
                       const struct GNUNET_GNSRECORD_Data *rd)
@@ -899,14 +899,14 @@ static void
 refresh_block (struct NamestoreClient *nc,
                struct ZoneIteration *zi,
                uint32_t rid,
-               const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+               const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                const char *name,
                unsigned int rd_count,
                const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct GNUNET_GNSRECORD_Block *block;
   struct CacheOperation *cop;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
   struct GNUNET_GNSRECORD_Data *nick;
   struct GNUNET_GNSRECORD_Data *res;
   unsigned int res_count;
@@ -946,7 +946,7 @@ refresh_block (struct NamestoreClient *nc,
     block =
       GNUNET_GNSRECORD_block_create (zone_key, exp_time, name, res, res_count);
   GNUNET_assert (NULL != block);
-  GNUNET_CRYPTO_ecdsa_key_get_public (zone_key, &pkey);
+  GNUNET_IDENTITY_key_get_public (zone_key, &pkey);
   GNUNET_log (
     GNUNET_ERROR_TYPE_DEBUG,
     "Caching block for label `%s' with %u records and expiration %s in zone 
`%s' in namecache\n",
@@ -1214,7 +1214,7 @@ struct RecordLookupContext
 static void
 lookup_it (void *cls,
            uint64_t seq,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key,
+           const struct GNUNET_IDENTITY_PrivateKey *private_key,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -1605,7 +1605,7 @@ struct ZoneToNameCtx
 static void
 handle_zone_to_name_it (void *cls,
                         uint64_t seq,
-                        const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                        const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                         const char *name,
                         unsigned int rd_count,
                         const struct GNUNET_GNSRECORD_Data *rd)
@@ -1738,7 +1738,7 @@ struct ZoneIterationProcResult
 static void
 zone_iterate_proc (void *cls,
                    uint64_t seq,
-                   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                   const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                    const char *name,
                    unsigned int rd_count,
                    const struct GNUNET_GNSRECORD_Data *rd)
@@ -2009,7 +2009,7 @@ monitor_iteration_next (void *cls);
 static void
 monitor_iterate_cb (void *cls,
                     uint64_t seq,
-                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                    const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                     const char *name,
                     unsigned int rd_count,
                     const struct GNUNET_GNSRECORD_Data *rd)
diff --git a/src/namestore/gnunet-zoneimport.c 
b/src/namestore/gnunet-zoneimport.c
index 5b4e41475..ce62b52d5 100644
--- a/src/namestore/gnunet-zoneimport.c
+++ b/src/namestore/gnunet-zoneimport.c
@@ -96,7 +96,7 @@ struct Zone
   /**
    * Private key of the zone.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey key;
+  struct GNUNET_IDENTITY_PrivateKey key;
 };
 
 
@@ -1405,7 +1405,7 @@ ns_lookup_error_cb (void *cls)
  */
 static void
 ns_lookup_result_cb (void *cls,
-                     const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                     const struct GNUNET_IDENTITY_PrivateKey *key,
                      const char *label,
                      unsigned int rd_count,
                      const struct GNUNET_GNSRECORD_Data *rd)
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index 6f45ab1c1..fd9a8ed47 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -90,7 +90,7 @@ struct RecordStoreMessage
   /**
    * The private key of the authority.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by:
    * name with length name_len
@@ -134,7 +134,7 @@ struct LabelLookupMessage
   /**
    * The private key of the zone to look up in
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /* followed by:
    * name with length name_len
@@ -176,7 +176,7 @@ struct LabelLookupResponseMessage
   /**
    * The private key of the authority.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by:
    * name with length name_len
@@ -198,12 +198,12 @@ struct ZoneToNameMessage
   /**
    * The private key of the zone to look up in
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * The public key of the target zone
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey value_zone;
+  struct GNUNET_IDENTITY_PublicKey value_zone;
 };
 
 
@@ -241,7 +241,7 @@ struct ZoneToNameResponseMessage
   /**
    * The private key of the zone that contained the name.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /* followed by:
    * name with length name_len
@@ -283,7 +283,7 @@ struct RecordResultMessage
   /**
    * The private key of the authority.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /* followed by:
    * name with length name_len
@@ -311,7 +311,7 @@ struct ZoneMonitorStartMessage
   /**
    * Zone key.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 };
 
 
@@ -352,7 +352,7 @@ struct ZoneIterationStartMessage
   /**
    * Zone key.  All zeros for "all zones".
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 };
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index f383f8b4a..c845b5019 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -174,7 +174,7 @@ struct GNUNET_NAMESTORE_ZoneIterator
   /**
    * Private key of the zone.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * The operation id this zone iteration operation has
@@ -493,7 +493,7 @@ handle_lookup_result (void *cls, const struct 
LabelLookupResponseMessage *msg)
 static int
 check_record_result (void *cls, const struct RecordResultMessage *msg)
 {
-  static struct GNUNET_CRYPTO_EcdsaPrivateKey priv_dummy;
+  static struct GNUNET_IDENTITY_PrivateKey priv_dummy;
   const char *name;
   size_t msg_len;
   size_t name_len;
@@ -981,7 +981,7 @@ warn_delay (void *cls)
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_records_store (
   struct GNUNET_NAMESTORE_Handle *h,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
   const char *label,
   unsigned int rd_count,
   const struct GNUNET_GNSRECORD_Data *rd,
@@ -1080,7 +1080,7 @@ GNUNET_NAMESTORE_records_store (
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_records_lookup (
   struct GNUNET_NAMESTORE_Handle *h,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+  const struct GNUNET_IDENTITY_PrivateKey *pkey,
   const char *label,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
@@ -1140,8 +1140,8 @@ GNUNET_NAMESTORE_records_lookup (
 struct GNUNET_NAMESTORE_QueueEntry *
 GNUNET_NAMESTORE_zone_to_name (
   struct GNUNET_NAMESTORE_Handle *h,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
-  const struct GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+  const struct GNUNET_IDENTITY_PrivateKey *zone,
+  const struct GNUNET_IDENTITY_PublicKey *value_zone,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
   GNUNET_NAMESTORE_RecordMonitor proc,
@@ -1196,7 +1196,7 @@ GNUNET_NAMESTORE_zone_to_name (
 struct GNUNET_NAMESTORE_ZoneIterator *
 GNUNET_NAMESTORE_zone_iteration_start (
   struct GNUNET_NAMESTORE_Handle *h,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+  const struct GNUNET_IDENTITY_PrivateKey *zone,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
   GNUNET_NAMESTORE_RecordMonitor proc,
diff --git a/src/namestore/namestore_api_monitor.c 
b/src/namestore/namestore_api_monitor.c
index 9dc955544..6670e54ce 100644
--- a/src/namestore/namestore_api_monitor.c
+++ b/src/namestore/namestore_api_monitor.c
@@ -82,7 +82,7 @@ struct GNUNET_NAMESTORE_ZoneMonitor
   /**
    * Monitored zone.
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey zone;
+  struct GNUNET_IDENTITY_PrivateKey zone;
 
   /**
    * Do we first iterate over all existing records?
@@ -302,7 +302,7 @@ reconnect (struct GNUNET_NAMESTORE_ZoneMonitor *zm)
 struct GNUNET_NAMESTORE_ZoneMonitor *
 GNUNET_NAMESTORE_zone_monitor_start (
   const struct GNUNET_CONFIGURATION_Handle *cfg,
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+  const struct GNUNET_IDENTITY_PrivateKey *zone,
   int iterate_first,
   GNUNET_SCHEDULER_TaskCallback error_cb,
   void *error_cb_cls,
diff --git a/src/namestore/perf_namestore_api_zone_iteration.c 
b/src/namestore/perf_namestore_api_zone_iteration.c
index c1012de62..f46a1c523 100644
--- a/src/namestore/perf_namestore_api_zone_iteration.c
+++ b/src/namestore/perf_namestore_api_zone_iteration.c
@@ -64,7 +64,7 @@ static struct GNUNET_SCHEDULER_Task *timeout_task;
 
 static struct GNUNET_SCHEDULER_Task *t;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -188,7 +188,7 @@ fail_cb (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -341,7 +341,8 @@ run (void *cls,
                                                NULL);
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_assert (NULL != nsh);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
   start = GNUNET_TIME_absolute_get ();
   t = GNUNET_SCHEDULER_add_now (&publish_record,
                                 NULL);
diff --git a/src/namestore/plugin_namestore_flat.c 
b/src/namestore/plugin_namestore_flat.c
index 60b24df67..1a071fd80 100644
--- a/src/namestore/plugin_namestore_flat.c
+++ b/src/namestore/plugin_namestore_flat.c
@@ -54,7 +54,7 @@ struct FlatFileEntry
   /**
    * Entry zone
    */
-  struct GNUNET_CRYPTO_EcdsaPrivateKey private_key;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
 
   /**
    * Record cound
@@ -86,7 +86,7 @@ struct FlatFileEntry
  * @param h[out] initialized hash
  */
 static void
-hash_pkey_and_label (const struct GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
+hash_pkey_and_label (const struct GNUNET_IDENTITY_PrivateKey *pkey,
                      const char *label,
                      struct GNUNET_HashCode *h)
 {
@@ -95,14 +95,14 @@ hash_pkey_and_label (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *pkey,
   size_t key_len;
 
   label_len = strlen (label);
-  key_len = label_len + sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey);
+  key_len = label_len + sizeof(struct GNUNET_IDENTITY_PrivateKey);
   key = GNUNET_malloc (key_len);
   GNUNET_memcpy (key,
                  label,
                  label_len);
   GNUNET_memcpy (key + label_len,
                  pkey,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
+                 sizeof(struct GNUNET_IDENTITY_PrivateKey));
   GNUNET_CRYPTO_hash (key,
                       key_len,
                       h);
@@ -296,7 +296,7 @@ database_setup (struct Plugin *plugin)
     GNUNET_free (record_data);
 
     {
-      struct GNUNET_CRYPTO_EcdsaPrivateKey *private_key;
+      struct GNUNET_IDENTITY_PrivateKey *private_key;
 
       GNUNET_STRINGS_base64_decode (zone_private_key,
                                     strlen (zone_private_key),
@@ -345,7 +345,7 @@ store_and_free_entries (void *cls,
 
   (void) key;
   GNUNET_STRINGS_base64_encode (&entry->private_key,
-                                sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey),
+                                sizeof(struct GNUNET_IDENTITY_PrivateKey),
                                 &zone_private_key);
   data_size = GNUNET_GNSRECORD_records_get_size (entry->record_count,
                                                  entry->record_data);
@@ -452,7 +452,7 @@ database_shutdown (struct Plugin *plugin)
 static int
 namestore_flat_store_records (void *cls,
                               const struct
-                              GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                              GNUNET_IDENTITY_PrivateKey *zone_key,
                               const char *label,
                               unsigned int rd_count,
                               const struct GNUNET_GNSRECORD_Data *rd)
@@ -482,7 +482,7 @@ namestore_flat_store_records (void *cls,
                    strlen (label));
   GNUNET_memcpy (&entry->private_key,
                  zone_key,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPrivateKey));
+                 sizeof(struct GNUNET_IDENTITY_PrivateKey));
   entry->rvalue = rvalue;
   entry->record_count = rd_count;
   entry->record_data = GNUNET_new_array (rd_count,
@@ -517,7 +517,7 @@ namestore_flat_store_records (void *cls,
  */
 static int
 namestore_flat_lookup_records (void *cls,
-                               const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*zone,
+                               const struct GNUNET_IDENTITY_PrivateKey *zone,
                                const char *label,
                                GNUNET_NAMESTORE_RecordIterator iter,
                                void *iter_cls)
@@ -574,7 +574,7 @@ struct IterateContext
   /**
    * Target zone.
    */
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone;
+  const struct GNUNET_IDENTITY_PrivateKey *zone;
 
   /**
    * Function to call on each record.
@@ -647,7 +647,7 @@ iterate_zones (void *cls,
 static int
 namestore_flat_iterate_records (void *cls,
                                 const struct
-                                GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                GNUNET_IDENTITY_PrivateKey *zone,
                                 uint64_t serial,
                                 uint64_t limit,
                                 GNUNET_NAMESTORE_RecordIterator iter,
@@ -674,8 +674,8 @@ namestore_flat_iterate_records (void *cls,
  */
 struct ZoneToNameContext
 {
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone;
-  const struct GNUNET_CRYPTO_EcdsaPublicKey *value_zone;
+  const struct GNUNET_IDENTITY_PrivateKey *zone;
+  const struct GNUNET_IDENTITY_PublicKey *value_zone;
   GNUNET_NAMESTORE_RecordIterator iter;
   void *iter_cls;
 
@@ -702,7 +702,7 @@ zone_to_name (void *cls,
       continue;
     if (0 == memcmp (ztn->value_zone,
                      entry->record_data[i].data,
-                     sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)))
+                     sizeof(struct GNUNET_IDENTITY_PublicKey)))
     {
       ztn->iter (ztn->iter_cls,
                  i + 1,    /* zero is illegal! */
@@ -730,9 +730,9 @@ zone_to_name (void *cls,
  */
 static int
 namestore_flat_zone_to_name (void *cls,
-                             const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                             const struct GNUNET_IDENTITY_PrivateKey *zone,
                              const struct
-                             GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+                             GNUNET_IDENTITY_PublicKey *value_zone,
                              GNUNET_NAMESTORE_RecordIterator iter,
                              void *iter_cls)
 {
diff --git a/src/namestore/plugin_namestore_postgres.c 
b/src/namestore/plugin_namestore_postgres.c
index 04100567c..358fd35d6 100644
--- a/src/namestore/plugin_namestore_postgres.c
+++ b/src/namestore/plugin_namestore_postgres.c
@@ -180,13 +180,13 @@ database_setup (struct Plugin *plugin)
 static int
 namestore_postgres_store_records (void *cls,
                                   const struct
-                                  GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                                  GNUNET_IDENTITY_PrivateKey *zone_key,
                                   const char *label,
                                   unsigned int rd_count,
                                   const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct Plugin *plugin = cls;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
   uint64_t rvalue;
   uint32_t rd_count32 = (uint32_t) rd_count;
   ssize_t data_size;
@@ -197,7 +197,7 @@ namestore_postgres_store_records (void *cls,
   for (unsigned int i = 0; i < rd_count; i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
-      GNUNET_break (sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey) ==
+      GNUNET_break (sizeof(struct GNUNET_IDENTITY_PublicKey) ==
                     rd[i].data_size);
       GNUNET_memcpy (&pkey,
                      rd[i].data,
@@ -296,7 +296,7 @@ struct ParserContext
   /**
    * Zone key, NULL if part of record.
    */
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key;
+  const struct GNUNET_IDENTITY_PrivateKey *zone_key;
 
   /**
    * Number of results still to return (counted down by
@@ -330,7 +330,7 @@ parse_result_call_iterator (void *cls,
     size_t data_size;
     uint32_t record_count;
     char *label;
-    struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
+    struct GNUNET_IDENTITY_PrivateKey zk;
     struct GNUNET_PQ_ResultSpec rs_with_zone[] = {
       GNUNET_PQ_result_spec_uint64 ("seq", &serial),
       GNUNET_PQ_result_spec_uint32 ("record_count", &record_count),
@@ -407,7 +407,7 @@ parse_result_call_iterator (void *cls,
 static int
 namestore_postgres_lookup_records (void *cls,
                                    const struct
-                                   GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                   GNUNET_IDENTITY_PrivateKey *zone,
                                    const char *label,
                                    GNUNET_NAMESTORE_RecordIterator iter,
                                    void *iter_cls)
@@ -457,7 +457,7 @@ namestore_postgres_lookup_records (void *cls,
 static int
 namestore_postgres_iterate_records (void *cls,
                                     const struct
-                                    GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                    GNUNET_IDENTITY_PrivateKey *zone,
                                     uint64_t serial,
                                     uint64_t limit,
                                     GNUNET_NAMESTORE_RecordIterator iter,
@@ -524,9 +524,9 @@ namestore_postgres_iterate_records (void *cls,
 static int
 namestore_postgres_zone_to_name (void *cls,
                                  const struct
-                                 GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                 GNUNET_IDENTITY_PrivateKey *zone,
                                  const struct
-                                 GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+                                 GNUNET_IDENTITY_PublicKey *value_zone,
                                  GNUNET_NAMESTORE_RecordIterator iter,
                                  void *iter_cls)
 {
diff --git a/src/namestore/plugin_namestore_sqlite.c 
b/src/namestore/plugin_namestore_sqlite.c
index 45fb782f7..4a4ce3d8d 100644
--- a/src/namestore/plugin_namestore_sqlite.c
+++ b/src/namestore/plugin_namestore_sqlite.c
@@ -314,14 +314,14 @@ database_shutdown (struct Plugin *plugin)
 static int
 namestore_sqlite_store_records (void *cls,
                                 const struct
-                                GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                                GNUNET_IDENTITY_PrivateKey *zone_key,
                                 const char *label,
                                 unsigned int rd_count,
                                 const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct Plugin *plugin = cls;
   int n;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pkey;
+  struct GNUNET_IDENTITY_PublicKey pkey;
   uint64_t rvalue;
   ssize_t data_size;
 
@@ -331,7 +331,7 @@ namestore_sqlite_store_records (void *cls,
   for (unsigned int i = 0; i < rd_count; i++)
     if (GNUNET_GNSRECORD_TYPE_PKEY == rd[i].record_type)
     {
-      GNUNET_break (sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey) ==
+      GNUNET_break (sizeof(struct GNUNET_IDENTITY_PublicKey) ==
                     rd[i].data_size);
       GNUNET_memcpy (&pkey,
                      rd[i].data,
@@ -461,7 +461,7 @@ static int
 get_records_and_call_iterator (struct Plugin *plugin,
                                sqlite3_stmt *stmt,
                                const struct
-                               GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                               GNUNET_IDENTITY_PrivateKey *zone_key,
                                uint64_t limit,
                                GNUNET_NAMESTORE_RecordIterator iter,
                                void *iter_cls)
@@ -496,7 +496,7 @@ get_records_and_call_iterator (struct Plugin *plugin,
       size_t data_size;
       void *data;
       char *label;
-      struct GNUNET_CRYPTO_EcdsaPrivateKey zk;
+      struct GNUNET_IDENTITY_PrivateKey zk;
       struct GNUNET_SQ_ResultSpec rs[] = {
         GNUNET_SQ_result_spec_uint64 (&seq),
         GNUNET_SQ_result_spec_uint32 (&record_count),
@@ -578,7 +578,7 @@ get_records_and_call_iterator (struct Plugin *plugin,
 static int
 namestore_sqlite_lookup_records (void *cls,
                                  const struct
-                                 GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                 GNUNET_IDENTITY_PrivateKey *zone,
                                  const char *label,
                                  GNUNET_NAMESTORE_RecordIterator iter,
                                  void *iter_cls)
@@ -629,7 +629,7 @@ namestore_sqlite_lookup_records (void *cls,
 static int
 namestore_sqlite_iterate_records (void *cls,
                                   const struct
-                                  GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                                  GNUNET_IDENTITY_PrivateKey *zone,
                                   uint64_t serial,
                                   uint64_t limit,
                                   GNUNET_NAMESTORE_RecordIterator iter,
@@ -695,9 +695,9 @@ namestore_sqlite_iterate_records (void *cls,
  */
 static int
 namestore_sqlite_zone_to_name (void *cls,
-                               const struct GNUNET_CRYPTO_EcdsaPrivateKey 
*zone,
+                               const struct GNUNET_IDENTITY_PrivateKey *zone,
                                const struct
-                               GNUNET_CRYPTO_EcdsaPublicKey *value_zone,
+                               GNUNET_IDENTITY_PublicKey *value_zone,
                                GNUNET_NAMESTORE_RecordIterator iter,
                                void *iter_cls)
 {
diff --git a/src/namestore/plugin_rest_namestore.c 
b/src/namestore/plugin_rest_namestore.c
index 9354b9896..f295951bc 100644
--- a/src/namestore/plugin_rest_namestore.c
+++ b/src/namestore/plugin_rest_namestore.c
@@ -214,7 +214,7 @@ struct RequestHandle
   /**
    * Private key for the zone
    */
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_pkey;
+  const struct GNUNET_IDENTITY_PrivateKey *zone_pkey;
 
   /**
    * IDENTITY Operation
@@ -510,7 +510,7 @@ namestore_list_finished (void *cls)
  */
 static void
 namestore_list_iteration (void *cls,
-                          const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                          const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                           const char *rname,
                           unsigned int rd_len,
                           const struct GNUNET_GNSRECORD_Data *rd)
@@ -561,7 +561,7 @@ ns_lookup_error_cb (void *cls)
 
 static void
 ns_get_lookup_cb (void *cls,
-                  const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                  const struct GNUNET_IDENTITY_PrivateKey *zone,
                   const char *label,
                   unsigned int rd_len,
                   const struct GNUNET_GNSRECORD_Data *rd)
@@ -689,7 +689,7 @@ namestore_get (struct GNUNET_REST_RequestHandle *con_handle,
 
 static void
 ns_lookup_cb (void *cls,
-              const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+              const struct GNUNET_IDENTITY_PrivateKey *zone,
               const char *label,
               unsigned int rd_count,
               const struct GNUNET_GNSRECORD_Data *rd)
@@ -946,7 +946,7 @@ list_ego (void *cls,
           const char *identifier)
 {
   struct EgoEntry *ego_entry;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
 
   if ((NULL == ego) && (ID_REST_STATE_INIT == state))
   {
@@ -957,7 +957,7 @@ list_ego (void *cls,
   {
     ego_entry = GNUNET_new (struct EgoEntry);
     GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
-    ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
+    ego_entry->keystring = GNUNET_IDENTITY_public_key_to_string (&pk);
     ego_entry->ego = ego;
     ego_entry->identifier = GNUNET_strdup (identifier);
     GNUNET_CONTAINER_DLL_insert_tail (ego_head,
@@ -983,7 +983,7 @@ list_ego (void *cls,
       /* Add */
       ego_entry = GNUNET_new (struct EgoEntry);
       GNUNET_IDENTITY_ego_get_public_key (ego, &pk);
-      ego_entry->keystring = GNUNET_CRYPTO_ecdsa_public_key_to_string (&pk);
+      ego_entry->keystring = GNUNET_IDENTITY_public_key_to_string (&pk);
       ego_entry->ego = ego;
       ego_entry->identifier = GNUNET_strdup (identifier);
       GNUNET_CONTAINER_DLL_insert_tail (ego_head,
diff --git a/src/namestore/test_namestore_api_lookup_nick.c 
b/src/namestore/test_namestore_api_lookup_nick.c
index 14fe7fc70..6ce969c9b 100644
--- a/src/namestore/test_namestore_api_lookup_nick.c
+++ b/src/namestore/test_namestore_api_lookup_nick.c
@@ -41,9 +41,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -98,7 +98,7 @@ end (void *cls)
 
 static void
 lookup_it (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -288,8 +288,9 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey,
                                       &pubkey);
 
   nsh = GNUNET_NAMESTORE_connect (cfg);
diff --git a/src/namestore/test_namestore_api_lookup_private.c 
b/src/namestore/test_namestore_api_lookup_private.c
index d0ad726cc..67cf54582 100644
--- a/src/namestore/test_namestore_api_lookup_private.c
+++ b/src/namestore/test_namestore_api_lookup_private.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -91,7 +91,7 @@ end (void *cls)
 
 static void
 lookup_it (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -187,8 +187,9 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey, &pubkey);
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
   rd.record_type = TEST_RECORD_TYPE;
diff --git a/src/namestore/test_namestore_api_lookup_public.c 
b/src/namestore/test_namestore_api_lookup_public.c
index 039c7cbf6..5e3e7bbd8 100644
--- a/src/namestore/test_namestore_api_lookup_public.c
+++ b/src/namestore/test_namestore_api_lookup_public.c
@@ -42,9 +42,9 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -163,7 +163,7 @@ put_cont (void *cls, int32_t success, const char *emsg)
 {
   const char *name = cls;
   struct GNUNET_HashCode derived_hash;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  struct GNUNET_IDENTITY_PublicKey pubkey;
 
   nsqe = NULL;
   GNUNET_assert (NULL != cls);
@@ -173,8 +173,8 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey, name, &derived_hash);
 
   ncqe = GNUNET_NAMECACHE_lookup_block (nch, &derived_hash,
@@ -193,9 +193,10 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
   rd.record_type = TEST_RECORD_TYPE;
diff --git a/src/namestore/test_namestore_api_lookup_shadow.c 
b/src/namestore/test_namestore_api_lookup_shadow.c
index d399d903a..79fa4c9c6 100644
--- a/src/namestore/test_namestore_api_lookup_shadow.c
+++ b/src/namestore/test_namestore_api_lookup_shadow.c
@@ -44,9 +44,9 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -195,7 +195,7 @@ put_cont (void *cls, int32_t success, const char *emsg)
 {
   const char *name = cls;
   struct GNUNET_HashCode derived_hash;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  struct GNUNET_IDENTITY_PublicKey pubkey;
 
   nsqe = NULL;
   GNUNET_assert (NULL != cls);
@@ -205,8 +205,8 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey,
                                           name,
                                           &derived_hash);
@@ -228,9 +228,10 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
   rd.record_type = TEST_RECORD_TYPE;
   rd.data_size = TEST_RECORD_DATALEN;
diff --git a/src/namestore/test_namestore_api_lookup_shadow_filter.c 
b/src/namestore/test_namestore_api_lookup_shadow_filter.c
index 40dbeb90f..4fc197750 100644
--- a/src/namestore/test_namestore_api_lookup_shadow_filter.c
+++ b/src/namestore/test_namestore_api_lookup_shadow_filter.c
@@ -48,9 +48,9 @@ static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
 static struct GNUNET_SCHEDULER_Task *delayed_lookup_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -66,7 +66,7 @@ static struct GNUNET_TIME_Absolute record_expiration;
 
 static struct GNUNET_HashCode derived_hash;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 
 static void
@@ -267,8 +267,8 @@ put_cont (void *cls, int32_t success, const char *emsg)
               (success == GNUNET_OK) ? "SUCCESS" : "FAIL");
 
   /* Create derived hash */
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
   GNUNET_GNSRECORD_query_from_public_key (&pubkey, TEST_NAME, &derived_hash);
 
   if (0 == GNUNET_TIME_absolute_get_remaining (record_expiration).rel_value_us)
@@ -297,9 +297,10 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
 
   record_expiration = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                                 EXPIRATION);
diff --git a/src/namestore/test_namestore_api_monitoring.c 
b/src/namestore/test_namestore_api_monitoring.c
index 3f1be1403..df0c38608 100644
--- a/src/namestore/test_namestore_api_monitoring.c
+++ b/src/namestore/test_namestore_api_monitoring.c
@@ -37,9 +37,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneMonitor *zm;
 
@@ -133,7 +133,7 @@ end (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+           const struct GNUNET_IDENTITY_PrivateKey *zone_key,
            const char *name,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -273,7 +273,8 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   res = 1;
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
   /* Start monitoring */
   zm = GNUNET_NAMESTORE_zone_monitor_start (cfg,
                                             &privkey,
@@ -304,7 +305,8 @@ run (void *cls,
     return;
   }
 
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 3\n");
diff --git a/src/namestore/test_namestore_api_monitoring_existing.c 
b/src/namestore/test_namestore_api_monitoring_existing.c
index 728fcc25e..366f5739f 100644
--- a/src/namestore/test_namestore_api_monitoring_existing.c
+++ b/src/namestore/test_namestore_api_monitoring_existing.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneMonitor *zm;
 
@@ -129,7 +129,7 @@ end (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+           const struct GNUNET_IDENTITY_PrivateKey *zone_key,
            const char *name,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -302,8 +302,10 @@ run (void *cls,
      struct GNUNET_TESTING_Peer *peer)
 {
   res = 1;
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
 
   cfg = mycfg;
   GNUNET_SCHEDULER_add_shutdown (&end,
diff --git a/src/namestore/test_namestore_api_remove.c 
b/src/namestore/test_namestore_api_remove.c
index e575821e8..b6254e531 100644
--- a/src/namestore/test_namestore_api_remove.c
+++ b/src/namestore/test_namestore_api_remove.c
@@ -39,9 +39,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -158,9 +158,10 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
 
   removed = GNUNET_NO;
 
diff --git a/src/namestore/test_namestore_api_remove_not_existing_record.c 
b/src/namestore/test_namestore_api_remove_not_existing_record.c
index 75e1cc3ed..e66992909 100644
--- a/src/namestore/test_namestore_api_remove_not_existing_record.c
+++ b/src/namestore/test_namestore_api_remove_not_existing_record.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -132,8 +132,9 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey, &pubkey);
 
   nsh = GNUNET_NAMESTORE_connect (cfg);
   GNUNET_break (NULL != nsh);
diff --git a/src/namestore/test_namestore_api_store.c 
b/src/namestore/test_namestore_api_store.c
index 9223b56a3..e0b7daa5d 100644
--- a/src/namestore/test_namestore_api_store.c
+++ b/src/namestore/test_namestore_api_store.c
@@ -39,9 +39,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -113,8 +113,9 @@ run (void *cls,
 
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly, NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey, &pubkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey, &pubkey);
 
 
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us;
diff --git a/src/namestore/test_namestore_api_store_update.c 
b/src/namestore/test_namestore_api_store_update.c
index 7a5a69a6c..5c169734a 100644
--- a/src/namestore/test_namestore_api_store_update.c
+++ b/src/namestore/test_namestore_api_store_update.c
@@ -48,9 +48,9 @@ static struct GNUNET_NAMECACHE_Handle *nch;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
 static int res;
 
@@ -246,9 +246,10 @@ run (void *cls,
   endbadly_task = GNUNET_SCHEDULER_add_delayed (TIMEOUT,
                                                 &endbadly,
                                                 NULL);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  memset (&privkey, 0, sizeof (privkey));
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&privkey, &pubkey);
   rd.flags = GNUNET_GNSRECORD_RF_NONE;
   rd.expiration_time = GNUNET_TIME_absolute_get ().abs_value_us + 1000000000;
   rd.record_type = TEST_RECORD_TYPE;
@@ -291,7 +292,7 @@ main (int argc,
   SETUP_CFG (plugin_name, cfg_name);
   res = 1;
   if (0 !=
-      GNUNET_TESTING_peer_run ("test-namestore-api-store-update",
+      GNUNET_TESTING_peer_run ("test--store-update",
                                cfg_name,
                                &run,
                                NULL))
diff --git a/src/namestore/test_namestore_api_zone_iteration.c 
b/src/namestore/test_namestore_api_zone_iteration.c
index 5d02b9e49..55ca901e2 100644
--- a/src/namestore/test_namestore_api_zone_iteration.c
+++ b/src/namestore/test_namestore_api_zone_iteration.c
@@ -37,9 +37,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -142,7 +142,7 @@ fail_cb (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -331,7 +331,7 @@ create_record (unsigned int count)
  */
 static void
 empty_zone_proc (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                 const struct GNUNET_IDENTITY_PrivateKey *zone,
                  const char *label,
                  unsigned int rd_count,
                  const struct GNUNET_GNSRECORD_Data *rd)
@@ -362,34 +362,11 @@ empty_zone_proc (void *cls,
 static void
 empty_zone_end (void *cls)
 {
-  char *hostkey_file;
-
   zi = NULL;
-  GNUNET_asprintf (&hostkey_file,
-                   "zonefiles%s%s",
-                   DIR_SEPARATOR_STR,
-                   
"N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s' \n",
-              hostkey_file);
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
-                                                    GNUNET_YES,
-                                                    &privkey));
-  GNUNET_free (hostkey_file);
-
-  GNUNET_asprintf (&hostkey_file,
-                   "zonefiles%s%s",
-                   DIR_SEPARATOR_STR,
-                   
"HGU0A0VCU334DN7F2I9UIUMVQMM7JMSD142LIMNUGTTV9R0CF4EG.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s' \n",
-              hostkey_file);
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
-                                                    GNUNET_YES,
-                                                    &privkey2));
-  GNUNET_free (hostkey_file);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Created record 1\n");
 
diff --git a/src/namestore/test_namestore_api_zone_iteration_nick.c 
b/src/namestore/test_namestore_api_zone_iteration_nick.c
index 4e54a05d2..c203a63a6 100644
--- a/src/namestore/test_namestore_api_zone_iteration_nick.c
+++ b/src/namestore/test_namestore_api_zone_iteration_nick.c
@@ -38,9 +38,9 @@
 
 static struct GNUNET_NAMESTORE_Handle *nsh;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -153,7 +153,7 @@ zone_proc_end (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -345,7 +345,7 @@ nick_1_cont (void *cls, int32_t success, const char *emsg)
  */
 static void
 empty_zone_proc (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                 const struct GNUNET_IDENTITY_PrivateKey *zone,
                  const char *label,
                  unsigned int rd_count,
                  const struct GNUNET_GNSRECORD_Data *rd)
@@ -379,8 +379,10 @@ empty_zone_end (void *cls)
   struct GNUNET_GNSRECORD_Data rd;
 
   zi = NULL;
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
 
   memset (&rd, 0, sizeof(rd));
   rd.data = ZONE_NICK_1;
diff --git a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c 
b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
index 30920713f..70097a69e 100644
--- a/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
+++ b/src/namestore/test_namestore_api_zone_iteration_specific_zone.c
@@ -38,9 +38,9 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -124,7 +124,7 @@ fail_cb (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -309,7 +309,7 @@ create_record (unsigned int count)
  */
 static void
 empty_zone_proc (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                 const struct GNUNET_IDENTITY_PrivateKey *zone,
                  const char *label,
                  unsigned int rd_count,
                  const struct GNUNET_GNSRECORD_Data *rd)
@@ -341,8 +341,10 @@ static void
 empty_zone_proc_end (void *cls)
 {
   zi = NULL;
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey2);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 1\n");
   GNUNET_asprintf (&s_name_1,
diff --git a/src/namestore/test_namestore_api_zone_iteration_stop.c 
b/src/namestore/test_namestore_api_zone_iteration_stop.c
index bdcdd1706..71b36ba09 100644
--- a/src/namestore/test_namestore_api_zone_iteration_stop.c
+++ b/src/namestore/test_namestore_api_zone_iteration_stop.c
@@ -34,9 +34,9 @@
 
 static struct GNUNET_NAMESTORE_Handle *nsh;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey2;
+static struct GNUNET_IDENTITY_PrivateKey privkey2;
 
 static struct GNUNET_NAMESTORE_ZoneIterator *zi;
 
@@ -112,7 +112,7 @@ fail_cb (void *cls)
 
 static void
 zone_proc (void *cls,
-           const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+           const struct GNUNET_IDENTITY_PrivateKey *zone,
            const char *label,
            unsigned int rd_count,
            const struct GNUNET_GNSRECORD_Data *rd)
@@ -318,7 +318,7 @@ create_record (unsigned int count)
  */
 static void
 empty_zone_proc (void *cls,
-                 const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone,
+                 const struct GNUNET_IDENTITY_PrivateKey *zone,
                  const char *label,
                  unsigned int rd_count,
                  const struct GNUNET_GNSRECORD_Data *rd)
@@ -347,34 +347,13 @@ empty_zone_proc (void *cls,
 static void
 empty_zone_proc_end (void *cls)
 {
-  char *hostkey_file;
-
   GNUNET_assert (nsh == cls);
   zi = NULL;
-  GNUNET_asprintf (&hostkey_file,
-                   "zonefiles%s%s",
-                   DIR_SEPARATOR_STR,
-                   
"N0UJMP015AFUNR2BTNM3FKPBLG38913BL8IDMCO2H0A1LIB81960.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s' \n",
-              hostkey_file);
-  GNUNET_assert (GNUNET_SYSERR
-                 != GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
-                                                       GNUNET_YES,
-                                                       &privkey));
-  GNUNET_free (hostkey_file);
-  GNUNET_asprintf (&hostkey_file,
-                   "zonefiles%s%s",
-                   DIR_SEPARATOR_STR,
-                   
"HGU0A0VCU334DN7F2I9UIUMVQMM7JMSD142LIMNUGTTV9R0CF4EG.zkey");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Using zonekey file `%s'\n",
-              hostkey_file);
-  GNUNET_assert (GNUNET_SYSERR !=
-                 GNUNET_CRYPTO_ecdsa_key_from_file (hostkey_file,
-                                                    GNUNET_YES,
-                                                    &privkey2));
-  GNUNET_free (hostkey_file);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  privkey2.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey2.ecdsa_key);
+
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Created record 1\n");
 
diff --git a/src/namestore/test_namestore_api_zone_to_name.c 
b/src/namestore/test_namestore_api_zone_to_name.c
index 94cc5c285..e5ede6bcd 100644
--- a/src/namestore/test_namestore_api_zone_to_name.c
+++ b/src/namestore/test_namestore_api_zone_to_name.c
@@ -42,11 +42,11 @@ static struct GNUNET_NAMESTORE_Handle *nsh;
 
 static struct GNUNET_SCHEDULER_Task *endbadly_task;
 
-static struct GNUNET_CRYPTO_EcdsaPrivateKey privkey;
+static struct GNUNET_IDENTITY_PrivateKey privkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+static struct GNUNET_IDENTITY_PublicKey pubkey;
 
-static struct GNUNET_CRYPTO_EcdsaPublicKey s_zone_value;
+static struct GNUNET_IDENTITY_PublicKey s_zone_value;
 
 static char *s_name;
 
@@ -92,7 +92,7 @@ end (void *cls)
 
 static void
 zone_to_name_proc (void *cls,
-                   const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone_key,
+                   const struct GNUNET_IDENTITY_PrivateKey *zone_key,
                    const char *n,
                    unsigned int rd_count,
                    const struct GNUNET_GNSRECORD_Data *rd)
@@ -203,10 +203,11 @@ run (void *cls,
   GNUNET_SCHEDULER_add_shutdown (&end,
                                  NULL);
   GNUNET_asprintf (&s_name, "dummy");
-  GNUNET_CRYPTO_ecdsa_key_create (&privkey);
+  privkey.type = htonl (GNUNET_GNSRECORD_TYPE_PKEY);
+  GNUNET_CRYPTO_ecdsa_key_create (&privkey.ecdsa_key);
   /* get public key */
-  GNUNET_CRYPTO_ecdsa_key_get_public (&privkey,
-                                      &pubkey);
+  GNUNET_IDENTITY_key_get_public (&privkey,
+                                  &pubkey);
 
   GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
                               &s_zone_value,
diff --git a/src/revocation/Makefile.am b/src/revocation/Makefile.am
index 9d98502a6..d63d7213c 100644
--- a/src/revocation/Makefile.am
+++ b/src/revocation/Makefile.am
@@ -63,6 +63,7 @@ libgnunetrevocation_la_SOURCES = \
   revocation_api.c revocation.h
 libgnunetrevocation_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(LIBGCRYPT_LIBS) \
   $(GN_LIBINTL) $(XLIB) -lgcrypt
 libgnunetrevocation_la_LDFLAGS = \
diff --git a/src/revocation/gnunet-revocation-tvg.c 
b/src/revocation/gnunet-revocation-tvg.c
index 29df1bb4d..13dee3529 100644
--- a/src/revocation/gnunet-revocation-tvg.c
+++ b/src/revocation/gnunet-revocation-tvg.c
@@ -65,15 +65,16 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey id_priv;
-  struct GNUNET_CRYPTO_EcdsaPublicKey id_pub;
+  struct GNUNET_IDENTITY_PrivateKey id_priv;
+  struct GNUNET_IDENTITY_PublicKey id_pub;
   struct GNUNET_REVOCATION_PowP pow;
   struct GNUNET_REVOCATION_PowCalculationHandle *ph;
   struct GNUNET_TIME_Relative exp;
 
-  GNUNET_CRYPTO_ecdsa_key_create (&id_priv);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&id_priv,
-                                      &id_pub);
+  id_priv.type = htonl (GNUNET_IDENTITY_TYPE_ECDSA);
+  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&id_priv,
+                                  &id_pub);
   fprintf (stdout, "Zone private key (d, little-endian scalar):\n");
   print_bytes (&id_priv, sizeof(id_priv), 0);
   fprintf (stdout, "\n");
diff --git a/src/revocation/gnunet-revocation.c 
b/src/revocation/gnunet-revocation.c
index 0e1e482ab..2ba5d0420 100644
--- a/src/revocation/gnunet-revocation.c
+++ b/src/revocation/gnunet-revocation.c
@@ -101,7 +101,7 @@ static struct GNUNET_SCHEDULER_Task *pow_task;
 /**
  * Proof-of-work object
  */
-static struct GNUNET_REVOCATION_PowP proof_of_work;
+static struct GNUNET_REVOCATION_PowP *proof_of_work;
 
 /**
  * Function run if the user aborts with CTRL-C.
@@ -325,8 +325,8 @@ calculate_pow (void *cls)
 static void
 ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+  struct GNUNET_IDENTITY_PublicKey key;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
   struct GNUNET_REVOCATION_PowCalculationHandle *ph = NULL;
 
   el = NULL;
@@ -403,15 +403,14 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *c)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
 
   cfg = c;
   if (NULL != test_ego)
   {
     if (GNUNET_OK !=
-        GNUNET_CRYPTO_ecdsa_public_key_from_string (test_ego,
-                                                    strlen (test_ego),
-                                                    &pk))
+        GNUNET_IDENTITY_public_key_from_string (test_ego,
+                                                &pk))
     {
       fprintf (stderr, _ ("Public key `%s' malformed\n"), test_ego);
       return;
diff --git a/src/revocation/gnunet-service-revocation.c 
b/src/revocation/gnunet-service-revocation.c
index ddebb38ad..56ec9f489 100644
--- a/src/revocation/gnunet-service-revocation.c
+++ b/src/revocation/gnunet-service-revocation.c
@@ -172,7 +172,8 @@ new_peer_entry (const struct GNUNET_PeerIdentity *peer)
 static int
 verify_revoke_message (const struct RevokeMessage *rm)
 {
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (&rm->proof_of_work,
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) 
&rm[1];
+  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
                                                  (unsigned
                                                   int) 
revocation_work_required,
                                                  epoch_duration))
@@ -236,7 +237,7 @@ handle_query_message (void *cls,
   int res;
 
   GNUNET_CRYPTO_hash (&qm->key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &hc);
   res = GNUNET_CONTAINER_multihashmap_contains (revocation_map,
                                                 &hc);
@@ -276,9 +277,11 @@ do_flood (void *cls,
     return GNUNET_OK; /* peer connected to us via SET,
                          but we have no direct CORE
                          connection for flooding */
-  e = GNUNET_MQ_msg (cp,
+  e = GNUNET_MQ_msg_extra (cp,
+                     htonl (rm->pow_size),
                      GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
   *cp = *rm;
+  memcpy (&cp[1], &rm[1], htonl (rm->pow_size));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Flooding revocation to `%s'\n",
               GNUNET_i2s (target));
@@ -304,8 +307,9 @@ publicize_rm (const struct RevokeMessage *rm)
   struct GNUNET_HashCode hc;
   struct GNUNET_SETU_Element e;
 
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) 
&rm[1];
+  GNUNET_CRYPTO_hash (&pow->key,
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &hc);
   if (GNUNET_YES ==
       GNUNET_CONTAINER_multihashmap_contains (revocation_map,
@@ -371,6 +375,23 @@ publicize_rm (const struct RevokeMessage *rm)
 }
 
 
+static int
+check_revoke_message (void *cls,
+                      const struct RevokeMessage *rm)
+{
+  uint16_t size;
+
+  size = ntohs (rm->header.size);
+  if (size <= sizeof(struct RevokeMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+
+}
+
+
 /**
  * Handle REVOKE message from client.
  *
@@ -403,6 +424,23 @@ handle_revoke_message (void *cls,
 }
 
 
+static int
+check_p2p_revoke (void *cls,
+                  const struct RevokeMessage *rm)
+{
+  uint16_t size;
+
+  size = ntohs (rm->header.size);
+  if (size <= sizeof(struct RevokeMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+
+}
+
+
 /**
  * Core handler for flooded revocation messages.
  *
@@ -784,10 +822,10 @@ run (void *cls,
      struct GNUNET_SERVICE_Handle *service)
 {
   struct GNUNET_MQ_MessageHandler core_handlers[] = {
-    GNUNET_MQ_hd_fixed_size (p2p_revoke,
-                             GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
-                             struct RevokeMessage,
-                             NULL),
+    GNUNET_MQ_hd_var_size (p2p_revoke,
+                           GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
+                           struct RevokeMessage,
+                           NULL),
     GNUNET_MQ_handler_end ()
   };
   char *fn;
@@ -892,9 +930,10 @@ run (void *cls,
       GNUNET_free (fn);
       return;
     }
-    GNUNET_break (0 == ntohl (rm->reserved));
-    GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                        sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+    struct GNUNET_REVOCATION_PowP *pow = (struct
+                                          GNUNET_REVOCATION_PowP *) &rm[1];
+    GNUNET_CRYPTO_hash (&pow->key,
+                        sizeof(struct GNUNET_IDENTITY_PublicKey),
                         &hc);
     GNUNET_break (GNUNET_OK ==
                   GNUNET_CONTAINER_multihashmap_put (revocation_map,
@@ -939,10 +978,10 @@ GNUNET_SERVICE_MAIN
                            GNUNET_MESSAGE_TYPE_REVOCATION_QUERY,
                            struct QueryMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (revoke_message,
-                           GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
-                           struct RevokeMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (revoke_message,
+                         GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
+                         struct RevokeMessage,
+                         NULL),
   GNUNET_MQ_handler_end ());
 
 
diff --git a/src/revocation/plugin_block_revocation.c 
b/src/revocation/plugin_block_revocation.c
index 291c56f70..ba3c33b6f 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -143,16 +143,16 @@ block_plugin_revocation_evaluate (void *cls,
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
-  if (0 >=
-      GNUNET_REVOCATION_check_pow (&rm->proof_of_work,
-                                   ic->matching_bits,
-                                   ic->epoch_duration))
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) 
&rm[1];
+  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
+                                                 ic->matching_bits,
+                                                 ic->epoch_duration))
   {
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  GNUNET_CRYPTO_hash (&pow->key,
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &chash);
   if (GNUNET_YES ==
       GNUNET_BLOCK_GROUP_bf_test_and_set (group,
@@ -182,13 +182,14 @@ block_plugin_revocation_get_key (void *cls,
 {
   const struct RevokeMessage *rm = block;
 
-  if (block_size != sizeof(*rm))
+  if (block_size <= sizeof(*rm))
   {
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) 
&rm[1];
+  GNUNET_CRYPTO_hash (&pow->key,
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       key);
   return GNUNET_OK;
 }
diff --git a/src/revocation/revocation.h b/src/revocation/revocation.h
index 635c56cfc..c3a9c9e6b 100644
--- a/src/revocation/revocation.h
+++ b/src/revocation/revocation.h
@@ -49,7 +49,7 @@ struct QueryMessage
   /**
    * Key to check.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
+  struct GNUNET_IDENTITY_PublicKey key;
 };
 
 
@@ -85,14 +85,11 @@ struct RevokeMessage
   struct GNUNET_MessageHeader header;
 
   /**
-   * For alignment.
+   * Length of PoW with signature.
    */
-  uint32_t reserved GNUNET_PACKED;
+  uint32_t pow_size GNUNET_PACKED;
 
-  /**
-   * Number that causes a hash collision with the @e public_key.
-   */
-  struct GNUNET_REVOCATION_PowP proof_of_work;
+  /** Followed by the PoW **/
 };
 
 
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index 75cfd8761..34529df35 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -160,7 +160,7 @@ handle_revocation_query_response (void *cls,
  */
 struct GNUNET_REVOCATION_Query *
 GNUNET_REVOCATION_query (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                         const struct GNUNET_CRYPTO_EcdsaPublicKey *key,
+                         const struct GNUNET_IDENTITY_PublicKey *key,
                          GNUNET_REVOCATION_Callback func,
                          void *func_cls)
 {
@@ -359,10 +359,12 @@ GNUNET_REVOCATION_revoke (const struct 
GNUNET_CONFIGURATION_Handle *cfg,
   }
   h->func = func;
   h->func_cls = func_cls;
-  env = GNUNET_MQ_msg (rm,
-                       GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
-  rm->reserved = htonl (0);
-  rm->proof_of_work = *pow;
+  size_t extra_len = ntohl (pow->sig_len) + sizeof (*pow);
+  env = GNUNET_MQ_msg_extra (rm,
+                             extra_len,
+                             GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
+  rm->pow_size = htonl (extra_len);
+  memcpy (&rm[1], pow, extra_len);
   GNUNET_MQ_send (h->mq,
                   env);
   return h;
@@ -420,6 +422,46 @@ calculate_score (const struct 
GNUNET_REVOCATION_PowCalculationHandle *ph)
 }
 
 
+enum GNUNET_GenericReturnValue
+check_signature_ecdsa (const struct GNUNET_REVOCATION_PowP *pow,
+                       const struct GNUNET_CRYPTO_EcdsaPublicKey *key)
+{
+  struct GNUNET_REVOCATION_SignaturePurposePS spurp;
+  struct GNUNET_CRYPTO_EcdsaSignature *sig;
+
+  spurp.key = pow->key;
+  spurp.timestamp = pow->timestamp;
+  spurp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
+  spurp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                              + sizeof(struct GNUNET_IDENTITY_PublicKey)
+                              + sizeof (struct GNUNET_TIME_AbsoluteNBO));
+  sig = (struct GNUNET_CRYPTO_EcdsaSignature *) &pow[1];
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REVOCATION,
+                                   &spurp.purpose,
+                                   sig,
+                                   key))
+  {
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_signature (const struct GNUNET_REVOCATION_PowP *pow)
+{
+  switch (ntohl (pow->key.type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return check_signature_ecdsa (pow, &pow->key.ecdsa_key);
+  default:
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_SYSERR;
+}
+
+
 /**
  * Check if the given proof-of-work is valid.
  *
@@ -433,10 +475,9 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
                              unsigned int difficulty,
                              struct GNUNET_TIME_Relative epoch_duration)
 {
-  char buf[sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+  char buf[sizeof(struct GNUNET_IDENTITY_PublicKey)
            + sizeof (struct GNUNET_TIME_AbsoluteNBO)
            + sizeof (uint64_t)] GNUNET_ALIGN;
-  struct GNUNET_REVOCATION_SignaturePurposePS spurp;
   struct GNUNET_HashCode result;
   struct GNUNET_TIME_Absolute ts;
   struct GNUNET_TIME_Absolute exp;
@@ -450,21 +491,11 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
   /**
    * Check if signature valid
    */
-  spurp.key = pow->key;
-  spurp.timestamp = pow->timestamp;
-  spurp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
-  spurp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-                              + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
-                              + sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REVOCATION,
-                                   &spurp.purpose,
-                                   &pow->signature,
-                                   &pow->key))
+  if (GNUNET_OK != check_signature (pow))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Proof of work signature invalid!\n");
-    return GNUNET_NO;
+    return GNUNET_SYSERR;
   }
 
   /**
@@ -480,7 +511,7 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
                  sizeof (uint64_t));
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
                  &pow->key,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey));
+                 sizeof(struct GNUNET_IDENTITY_PublicKey));
   for (unsigned int i = 0; i < POW_COUNT; i++)
   {
     pow_val = GNUNET_ntohll (pow->pow[i]);
@@ -529,15 +560,9 @@ GNUNET_REVOCATION_check_pow (const struct 
GNUNET_REVOCATION_PowP *pow,
 }
 
 
-/**
- * Initializes a fresh PoW computation.
- *
- * @param key the key to calculate the PoW for.
- * @param[out] pow starting point for PoW calculation (not yet valid)
- */
-void
-GNUNET_REVOCATION_pow_init (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
-                            struct GNUNET_REVOCATION_PowP *pow)
+enum GNUNET_GenericReturnValue
+sign_pow_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                struct GNUNET_REVOCATION_PowP *pow)
 {
   struct GNUNET_TIME_Absolute ts = GNUNET_TIME_absolute_get ();
   struct GNUNET_REVOCATION_SignaturePurposePS rp;
@@ -553,14 +578,44 @@ GNUNET_REVOCATION_pow_init (const struct 
GNUNET_CRYPTO_EcdsaPrivateKey *key,
   rp.timestamp = pow->timestamp;
   rp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
   rp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-                           + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+                           + sizeof(struct GNUNET_IDENTITY_PublicKey)
                            + sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  GNUNET_CRYPTO_ecdsa_key_get_public (key, &pow->key);
   rp.key = pow->key;
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdsa_sign_ (key,
-                                            &rp.purpose,
-                                            &pow->signature));
+  pow->sig_len = htonl (sizeof (struct GNUNET_CRYPTO_EcdsaSignature));
+  return GNUNET_CRYPTO_ecdsa_sign_ (key,
+                                    &rp.purpose,
+                                    (void*) &pow[1]);
+
+}
+
+
+enum GNUNET_GenericReturnValue
+sign_pow (const struct GNUNET_IDENTITY_PrivateKey *key,
+          struct GNUNET_REVOCATION_PowP *pow)
+{
+  GNUNET_IDENTITY_key_get_public (key, &pow->key);
+  switch (ntohl (pow->key.type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return sign_pow_ecdsa (&key->ecdsa_key, pow);
+  default:
+    return GNUNET_NO;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Initializes a fresh PoW computation.
+ *
+ * @param key the key to calculate the PoW for.
+ * @param[out] pow starting point for PoW calculation (not yet valid)
+ */
+void
+GNUNET_REVOCATION_pow_init (const struct GNUNET_IDENTITY_PrivateKey *key,
+                            struct GNUNET_REVOCATION_PowP *pow)
+{
+  GNUNET_assert (GNUNET_OK == sign_pow (key, pow));
 }
 
 
@@ -622,7 +677,7 @@ cmp_pow_value (const void *a, const void *b)
 enum GNUNET_GenericReturnValue
 GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
 {
-  char buf[sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+  char buf[sizeof(struct GNUNET_IDENTITY_PublicKey)
            + sizeof (uint64_t)
            + sizeof (uint64_t)] GNUNET_ALIGN;
   struct GNUNET_HashCode result;
@@ -645,7 +700,7 @@ GNUNET_REVOCATION_pow_round (struct 
GNUNET_REVOCATION_PowCalculationHandle *pc)
                  sizeof (uint64_t));
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
                  &pc->pow->key,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey));
+                 sizeof(struct GNUNET_IDENTITY_PublicKey));
   GNUNET_CRYPTO_pow_hash (&salt,
                           buf,
                           sizeof(buf),
diff --git a/src/revocation/test_revocation.c b/src/revocation/test_revocation.c
index b65567d79..58fcf2e76 100644
--- a/src/revocation/test_revocation.c
+++ b/src/revocation/test_revocation.c
@@ -38,8 +38,8 @@ struct TestPeer
   struct GNUNET_TESTBED_Operation *core_op;
   struct GNUNET_IDENTITY_Handle *idh;
   const struct GNUNET_CONFIGURATION_Handle *cfg;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
+  struct GNUNET_IDENTITY_PublicKey pubkey;
   struct GNUNET_CRYPTO_EcdsaSignature sig;
   struct GNUNET_IDENTITY_Operation *create_id_op;
   struct GNUNET_IDENTITY_EgoLookup *ego_lookup;
@@ -142,13 +142,13 @@ revocation_cb (void *cls, enum GNUNET_GenericReturnValue 
is_valid)
 }
 
 
-static struct GNUNET_REVOCATION_PowP proof_of_work;
+static struct GNUNET_REVOCATION_PowP *proof_of_work;
 
 static void
 ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 {
   static int completed = 0;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
 
   if ((NULL != ego) && (cls == &testpeers[0]))
   {
@@ -164,10 +164,11 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     GNUNET_IDENTITY_ego_get_public_key (ego, &testpeers[1].pubkey);
     GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Calculating proof of work...\n");
     privkey = GNUNET_IDENTITY_ego_get_private_key (ego);
-    memset (&proof_of_work, 0, sizeof (proof_of_work));
+    proof_of_work = GNUNET_malloc (sizeof (struct GNUNET_REVOCATION_PowP) +
+                                   sizeof (struct 
GNUNET_CRYPTO_EcdsaSignature));
     GNUNET_REVOCATION_pow_init (privkey,
-                                &proof_of_work);
-    testpeers[1].pow = GNUNET_REVOCATION_pow_start (&proof_of_work,
+                                proof_of_work);
+    testpeers[1].pow = GNUNET_REVOCATION_pow_start (proof_of_work,
                                                     1,
                                                     5);
     int res =
@@ -184,7 +185,7 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Egos retrieved\n");
     testpeers[1].revok_handle = GNUNET_REVOCATION_revoke (testpeers[1].cfg,
-                                                          &proof_of_work,
+                                                          proof_of_work,
                                                           &revocation_cb,
                                                           NULL);
     GNUNET_REVOCATION_pow_stop (testpeers[1].pow);
@@ -194,7 +195,7 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 
 static void
 identity_create_cb (void *cls,
-                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+                    const struct GNUNET_IDENTITY_PrivateKey *pk,
                     const char *emsg)
 {
   static int completed = 0;
@@ -238,11 +239,13 @@ identity_completion_cb (void *cls,
   testpeers[0].create_id_op = GNUNET_IDENTITY_create (testpeers[0].idh,
                                                       "client",
                                                       NULL,
+                                                      
GNUNET_IDENTITY_TYPE_ECDSA,
                                                       &identity_create_cb,
                                                       &testpeers[0]);
   testpeers[1].create_id_op = GNUNET_IDENTITY_create (testpeers[1].idh,
                                                       "toberevoked",
                                                       NULL,
+                                                      
GNUNET_IDENTITY_TYPE_ECDSA,
                                                       &identity_create_cb,
                                                       &testpeers[1]);
 }

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.



reply via email to

[Prev in Thread] Current Thread [Next in Thread]