- started implementing new crypto

- $-expansion and XDG in config

35 files changed, 795 insertions, 929 deletions

diff --git a/src/main/java/org/gnunet/construct/MessageLoader.java b/src/main/java/org/gnunet/construct/MessageLoader.java
index 71e2719..aa4b98a 100644
--- a/src/main/java/org/gnunet/construct/MessageLoader.java
+++ b/src/main/java/org/gnunet/construct/MessageLoader.java
@@ -46,7 +46,7 @@ public class MessageLoader {
 
 
     /**
-     * Thrown when a trying to serialize an object that is not registered as a union type.
+     * Thrown when trying to serialize an object that is not registered as a union type.
      */
     public static class UnknownUnionException extends RuntimeException {
         public UnknownUnionException(String msg) {
diff --git a/src/main/java/org/gnunet/identity/Identity.java b/src/main/java/org/gnunet/identity/Identity.java
index 657a0b9..1450031 100644
--- a/src/main/java/org/gnunet/identity/Identity.java
+++ b/src/main/java/org/gnunet/identity/Identity.java
@@ -27,6 +27,8 @@ import org.gnunet.mq.Envelope;
 import org.gnunet.requests.RequestContainer;
 import org.gnunet.requests.SequentialRequestContainer;
 import org.gnunet.util.*;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
+import org.gnunet.util.crypto.EcdsaPublicKey;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -45,17 +47,17 @@ public class Identity {
 
     public static class Ego {
         private String name;
-        private CryptoECC.PrivateKey privateKey;
+        private EcdsaPrivateKey privateKey;
 
-        public Ego(String egoName, CryptoECC.PrivateKey privateKey) {
+        public Ego(String egoName, EcdsaPrivateKey privateKey) {
             this.name = egoName;
             this.privateKey = privateKey;
         }
-        public CryptoECC.PrivateKey getPrivateKey() {
+        public EcdsaPrivateKey getPrivateKey() {
             return privateKey;
         }
-        public CryptoECC.PublicSignKey getPublicKey() {
-            return CryptoECC.computePublicKey(privateKey);
+        public EcdsaPublicKey getPublicKey() {
+            return privateKey.getPublicKey();
         }
         public String getName() {
             return name;
@@ -171,10 +173,10 @@ public class Identity {
     }
 
     public class CreateRequest extends IdentityRequest {
-        final CryptoECC.PrivateKey privateKey;
+        final EcdsaPrivateKey privateKey;
         IdentityContinuation cont;
         String name;
-        CreateRequest(String name, CryptoECC.PrivateKey privateKey, IdentityContinuation cont) {
+        CreateRequest(String name, EcdsaPrivateKey privateKey, IdentityContinuation cont) {
             this.cont = cont;
             this.privateKey = privateKey;
             this.name = name;
@@ -200,7 +202,7 @@ public class Identity {
 
     public static Ego getAnonymousEgo() {
         if (anonymousEgo == null) {
-            anonymousEgo = new Ego(null, CryptoECC.getAnonymous());
+            anonymousEgo = new Ego(null, EcdsaPrivateKey.getAnonymous());
         }
         return anonymousEgo;
     }
@@ -248,7 +250,7 @@ public class Identity {
      * @return object for cancellation
      */
     public Cancelable create(String name, IdentityContinuation cont) {
-        CryptoECC.PrivateKey privateKey = CryptoECC.PrivateKey.createRandom();
+        EcdsaPrivateKey privateKey = EcdsaPrivateKey.createRandom();
         return requests.addRequest(new CreateRequest(name, privateKey, cont));
     }
 
@@ -273,7 +275,7 @@ public class Identity {
         return requests.addRequest(new DeleteRequest(name));
     }
 
-    private Ego getEgoForKey(CryptoECC.PrivateKey privateKey) {
+    private Ego getEgoForKey(EcdsaPrivateKey privateKey) {
         for (Ego ex : knownEgos) {
             if (ex.privateKey.equals(privateKey)) {
                 return ex;
diff --git a/src/main/java/org/gnunet/identity/messages/CreateRequestMessage.java b/src/main/java/org/gnunet/identity/messages/CreateRequestMessage.java
index 475100c..dd67fa1 100644
--- a/src/main/java/org/gnunet/identity/messages/CreateRequestMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/CreateRequestMessage.java
@@ -44,8 +44,8 @@ import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UInt16;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
 
 @UnionCase(629)
 public class CreateRequestMessage implements GnunetMessage.Body {
@@ -57,7 +57,7 @@ public class CreateRequestMessage implements GnunetMessage.Body {
     @UInt16
     public int reserved;
     @NestedMessage
-    public CryptoECC.PrivateKey privateKey;
+    public EcdsaPrivateKey privateKey;
     @ZeroTerminatedString
     public String name;
 }
diff --git a/src/main/java/org/gnunet/identity/messages/GetDefaultMessage.java b/src/main/java/org/gnunet/identity/messages/GetDefaultMessage.java
index fab5f33..eb44eba 100644
--- a/src/main/java/org/gnunet/identity/messages/GetDefaultMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/GetDefaultMessage.java
@@ -80,11 +80,9 @@
 
 package org.gnunet.identity.messages;
 
-import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UInt16;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
 
 @UnionCase(627)
diff --git a/src/main/java/org/gnunet/identity/messages/ResultCodeMessage.java b/src/main/java/org/gnunet/identity/messages/ResultCodeMessage.java
index c761603..12bd55b 100644
--- a/src/main/java/org/gnunet/identity/messages/ResultCodeMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/ResultCodeMessage.java
@@ -101,7 +101,6 @@
 package org.gnunet.identity.messages;
 
 import org.gnunet.construct.*;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
 
 /**
diff --git a/src/main/java/org/gnunet/identity/messages/SetDefaultMessage.java b/src/main/java/org/gnunet/identity/messages/SetDefaultMessage.java
index bcdb233..484bde7 100644
--- a/src/main/java/org/gnunet/identity/messages/SetDefaultMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/SetDefaultMessage.java
@@ -64,8 +64,8 @@ import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UInt16;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
 
 
 /**
@@ -79,7 +79,7 @@ public class SetDefaultMessage implements GnunetMessage.Body {
     @UInt16
     public int reserved;
     @NestedMessage
-    public CryptoECC.PrivateKey privateKey;
+    public EcdsaPrivateKey privateKey;
     @ZeroTerminatedString
     public String serviceName;
 }
diff --git a/src/main/java/org/gnunet/identity/messages/StartMessage.java b/src/main/java/org/gnunet/identity/messages/StartMessage.java
index b8fbbee..ffc0a08 100644
--- a/src/main/java/org/gnunet/identity/messages/StartMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/StartMessage.java
@@ -60,11 +60,7 @@
 
 package org.gnunet.identity.messages;
 
-import org.gnunet.construct.NestedMessage;
-import org.gnunet.construct.UInt16;
 import org.gnunet.construct.UnionCase;
-import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
 
 @UnionCase(624)
diff --git a/src/main/java/org/gnunet/identity/messages/UpdateListMessage.java b/src/main/java/org/gnunet/identity/messages/UpdateListMessage.java
index f1fb8ab..f30d18a 100644
--- a/src/main/java/org/gnunet/identity/messages/UpdateListMessage.java
+++ b/src/main/java/org/gnunet/identity/messages/UpdateListMessage.java
@@ -84,8 +84,8 @@ import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UInt16;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
 
 
 /**
@@ -98,7 +98,7 @@ public class UpdateListMessage implements GnunetMessage.Body{
     @UInt16
     public int endOfList;
     @NestedMessage
-    public CryptoECC.PrivateKey privateKey;
+    public EcdsaPrivateKey privateKey;
     @ZeroTerminatedString
     public String egoName;
 }
diff --git a/src/main/java/org/gnunet/util/Configuration.java b/src/main/java/org/gnunet/util/Configuration.java
index 43290d0..2ea2d0e 100644
--- a/src/main/java/org/gnunet/util/Configuration.java
+++ b/src/main/java/org/gnunet/util/Configuration.java
@@ -21,6 +21,7 @@
 package org.gnunet.util;
 
 import com.google.common.base.Charsets;
+import com.google.common.base.Joiner;
 import com.google.common.base.Optional;
 import com.google.common.collect.HashBasedTable;
 import com.google.common.collect.Table;
@@ -33,6 +34,7 @@ import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
 import java.nio.charset.Charset;
+import java.nio.file.Path;
 import java.util.*;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -73,23 +75,95 @@ public class Configuration {
 
 
     /**
-     * Expand an expression of the form "$FOO/BAR" to "DIRECTORY/BAR" where
-     * either in the "PATHS" section or the environment "FOO" is set to
-     * "DIRECTORY".
+     * Expand an expression of the form "$FOO/BAR" to "DIRECTORY/BAR"
+     * where either in the "PATHS" section or the environtment "FOO" is
+     * set to "DIRECTORY".  We also support default expansion,
+     * i.e. ${VARIABLE:-default} will expand to $VARIABLE if VARIABLE is
+     * set in PATHS or the environment, and otherwise to "default".  Note
+     * that "default" itself can also be a $-expression, thus
+     * "${VAR1:-{$VAR2}}" will expand to VAR1 and if that is not defined
+     * to VAR2.
      *
      * @param orig string to $-expand
      * @return $-expanded string
      */
     public String expandDollar(String orig) {
-        Map<String, String> env = System.getenv();
-        for (final Map.Entry<String, String> e : env.entrySet()) {
-            orig = orig.replace("$" + e.getKey(), e.getValue());
+
+        if (orig.length() < 2 || !orig.startsWith("$"))
+            return orig;
+        String defaultVal;
+        String substVal;
+        String outside;
+
+        if (orig.charAt(1) == '{')
+        {
+            int open = 1;
+            int p = 2;
+            while (open != 0) {
+                if (orig.length() == p) {
+                    logger.debug("unclosed '{'");
+                    break;
+                }
+                if (orig.charAt(p) == '{') {
+                    open++;
+                } else if (orig.charAt(p) == '}') {
+                    open--;
+                }
+                p++;
+            }
+            if (p != 2) {
+                String inside = orig.substring(2, p-1);
+                String[] parts = inside.split(Pattern.quote(":-"), 2);
+                if (parts.length == 1) {
+                    substVal = orig.substring(2, p-1);
+                    defaultVal = "";
+                } else {
+                    substVal = parts[0];
+                    defaultVal = parts[1];
+                }
+                if (orig.length() > p) {
+                    outside = orig.substring(p, orig.length());
+                } else {
+                    outside = "";
+                }
+            } else {
+                outside = "";
+                substVal = "";
+                defaultVal = "";
+            }
+        } else {
+            defaultVal = "";
+            int p = 1;
+            for (; p < orig.length(); p++) {
+                if (orig.charAt(p) == '\\' || orig.charAt(p) == '/') {
+                    break;
+                }
+            }
+            if (p != orig.length()) {
+                substVal = orig.substring(1, p);
+                outside = orig.substring(p, orig.length());
+            } else {
+                substVal = orig.substring(1, orig.length());
+                outside = "";
+            }
         }
 
-        for (final Map.Entry<String, String> e : sections.row("PATHS").entrySet()) {
-            orig = orig.replace("$" + e.getKey(), e.getValue());
+        String result;
+
+        Map<String, String> env = System.getenv();
+        if (env.containsKey(substVal)) {
+            result = env.get(substVal);
+        } else {
+            Optional<String> path = getValueString("PATHS", substVal);
+            if (path.isPresent()) {
+                result = path.get();
+            } else {
+                result = expandDollar(defaultVal);
+            }
         }
-        return orig;
+
+        return result + outside;
+
     }
 
     /**
@@ -382,9 +456,7 @@ public class Configuration {
 
 
     public void loadDefaults() {
-        Collection<File> dirs = new ArrayList<File>(5);
-        dirs.add(new File("/usr/share/gnunet/config.d/"));
-        dirs.add(new File("/usr/local/share/gnunet/config.d/"));
+        Collection<File> dirs = new ArrayList<File>();
         String pfx = System.getenv("GNUNET_PREFIX");
         if (pfx != null) {
             dirs.add(new File(pfx, "share/gnunet/config.d/"));
@@ -402,6 +474,24 @@ public class Configuration {
                 }
             }
         }
+        Collection<File> files = new ArrayList<File>();
+        String xdg = System.getenv("XDG_CONFIG_HOME");
+        if (xdg != null && !xdg.isEmpty()) {
+            File f = new File(xdg + "/gnunet.conf");
+            if (f.exists()) {
+                parse(f.getAbsolutePath());
+            }
+        }
+    }
+
+    /**
+     * Read a filename from the section.
+     * @param section
+     * @param option
+     * @return
+     */
+    public Optional<String> getValueFilename(String section, String option) {
+        return null;
     }
 
     public void deserialize(String str) {
diff --git a/src/main/java/org/gnunet/util/CryptoECC.java b/src/main/java/org/gnunet/util/CryptoECC.java
deleted file mode 100644
index a02cf70..0000000
--- a/src/main/java/org/gnunet/util/CryptoECC.java
+++ /dev/null
@@ -1,513 +0,0 @@
-/*
- This file is part of GNUnet.
-  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
-
-  GNUnet is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published
-  by the Free Software Foundation; either version 3, or (at your
-  option) any later version.
-
-  GNUnet is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with GNUnet; see the file COPYING.  If not, write to the
-  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-  Boston, MA 02111-1307, USA.
- */
-
-package org.gnunet.util;
-
-import org.gnunet.construct.FixedSizeIntegerArray;
-import org.gnunet.construct.Message;
-
-import java.io.File;
-import java.io.IOError;
-import java.io.IOException;
-import java.math.BigInteger;
-import java.nio.ByteBuffer;
-import java.nio.file.Files;
-import java.nio.file.StandardOpenOption;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.util.Arrays;
-import java.util.Random;
-
-/**
- * Implementation of the Ed25519 public-key signature system. See http://ed25519.cr.yp.to/.
- * Original Java version written and placed into the public domain by k3d3 (https://github.com/k3d3/ed25519-java).
- */
-public class CryptoECC {
-    /**
-     * Private ECC key.
-     */
-    public static final class PrivateKey implements Message {
-        /**
-         * Value of the private key, represents a number modulo q.
-         * The number is stored as little endian.
-         */
-        @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
-        public byte[] d;
-
-        /**
-         * Load a private key from the given file.
-         *
-         * @param privKeyFilename the private key file name
-         * @return the private key from the file
-         */
-        public static PrivateKey fromFile(String privKeyFilename) {
-            byte[] data;
-            try {
-                data = Files.readAllBytes(new File(privKeyFilename).toPath());
-            } catch (IOException e) {
-                throw new IOError(e);
-            }
-            if (data.length != 32)
-                return null;
-            PrivateKey privateKey = new PrivateKey();
-            privateKey.d = data;
-            return privateKey;
-        }
-
-        public static PrivateKey createRandom() {
-            PrivateKey privateKey = new PrivateKey();
-            privateKey.d = new byte[32];
-            SecureRandom r = new SecureRandom();
-            r.nextBytes(privateKey.d);
-            return privateKey;
-        }
-
-        public void write(String privKeyFilename) throws IOException {
-            File f = new File(privKeyFilename);
-            Files.write(f.toPath(), d, StandardOpenOption.CREATE_NEW);
-        }
-    }
-
-    /**
-     * Public ECC key.
-     */
-    public static final class PublicSignKey implements Message {
-        /**
-         * x-coordinate of the point on the curve.
-         * The number is stored as little endian.
-         */
-        @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
-        public byte[] x;
-
-        /**
-         * y-coordinate of the point on the curve.
-         * The number is stored as little endian.
-         */
-        @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
-        public byte[] y;
-
-        @Override
-        public String toString() {
-            byte[] data = encodepoint(asPoint());
-            return Strings.dataToString(data);
-        }
-
-        public BigInteger[] asPoint() {
-            return new BigInteger[]{decodeint(x), decodeint(y)};
-        }
-
-        public static PublicSignKey fromString(String s) {
-            PublicSignKey pk = new PublicSignKey();
-            byte[] data = Strings.stringToData(s, 32);
-            if (null == data)
-                return null;
-            BigInteger[] point = decodepoint(data);
-            pk.x = encodeint(point[0]);
-            pk.y = encodeint(point[1]);
-            return pk;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) return true;
-            if (o == null || getClass() != o.getClass()) return false;
-
-            PublicSignKey that = (PublicSignKey) o;
-
-            if (!Arrays.equals(x, that.x)) return false;
-            if (!Arrays.equals(y, that.y)) return false;
-
-            return true;
-        }
-
-        @Override
-        public int hashCode() {
-            int result = Arrays.hashCode(x);
-            result = 31 * result + Arrays.hashCode(y);
-            return result;
-        }
-    }
-
-    /**
-     * ECC Signature.
-     */
-    public static final class Signature implements Message {
-        /**
-         * R value of the signature in compressed form.
-         * The number is stored as little endian.
-         */
-        @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
-        public byte[] r;
-
-        /**
-         * S-value of the signature.
-         * The number is stored as little endian.
-         */
-        @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
-        public byte[] s;
-
-        @Override
-        public String toString() {
-            byte[] data = new byte[r.length + s.length];
-            System.arraycopy(r, 0, data, 0, r.length);
-            System.arraycopy(s, 0, data, r.length, s.length);
-            return Strings.dataToString(data);
-        }
-
-        public static Signature fromString(String s) {
-            Signature sig = new Signature();
-            sig.r = new byte[32];
-            sig.s = new byte[32];
-            byte[] data = Strings.stringToData(s, 64);
-            if (null == data) {
-                return null;
-            }
-            System.arraycopy(data, 0, sig.r, 0, 32);
-            System.arraycopy(data, 32, sig.s, 0, 32);
-            return sig;
-        }
-
-        /**
-         * Create a random signature that is invalid with
-         * very high probability.
-         *
-         * @return random signature, most probably invalid
-         */
-        public static Signature randomSignature() {
-            Random r = new Random();
-            Signature sig = new Signature();
-            sig.r = new byte[32];
-            sig.s = new byte[32];
-            r.nextBytes(sig.r);
-            r.nextBytes(sig.s);
-            return sig;
-        }
-    }
-
-    // curve parameter b
-    private static final int b = 256;
-    // curve parameter q
-    private static final BigInteger q = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819949");
-    // q-3
-    private static final BigInteger qm2 = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819947");
-    // q-3
-    private static final BigInteger qp3 = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819952");
-    private static final BigInteger l = new BigInteger("7237005577332262213973186563042994240857116359379907606001950938285454250989");
-    private static final BigInteger d = new BigInteger("-4513249062541557337682894930092624173785641285191125241628941591882900924598840740");
-    private static final BigInteger I = new BigInteger("19681161376707505956807079304988542015446066515923890162744021073123829784752");
-    private static final BigInteger By = new BigInteger("46316835694926478169428394003475163141307993866256225615783033603165251855960");
-    private static final BigInteger Bx = new BigInteger("15112221349535400772501151409588531511454012693041857206046113283949847762202");
-    private static final BigInteger[] B = {Bx.mod(q),By.mod(q)};
-    // 2^255
-    private static final BigInteger un = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819967");
-
-    static final private MessageDigest sha512;
-    static {
-        try {
-            sha512 = MessageDigest.getInstance("SHA-512");
-        } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA-512 not available");
-        }
-    }
-
-    /**
-     * Computes the multiplicative inverse of x modulo q using Euler's theorem.
-     *
-     * @param x the group element to invert
-     * @return the inverse of x modulo q
-     */
-    private static BigInteger inv(BigInteger x) {
-        return x.modPow(qm2, q);
-    }
-
-    /**
-     * Compute the x-component of a point on our curve from
-     * the y-coordinate.
-     *
-     * @param y the y-coordinate of a point
-     * @return the x-coordinate of the point (x,y) on the curve
-     */
-    private static BigInteger xrecover(BigInteger y) {
-        BigInteger y2 = y.multiply(y);
-        BigInteger xx = (y2.subtract(BigInteger.ONE)).multiply(inv(d.multiply(y2).add(BigInteger.ONE)));
-        BigInteger x = xx.modPow(qp3.divide(BigInteger.valueOf(8)), q);
-        if (!x.multiply(x).subtract(xx).mod(q).equals(BigInteger.ZERO)) x = (x.multiply(I).mod(q));
-        if (!x.mod(BigInteger.valueOf(2)).equals(BigInteger.ZERO)) x = q.subtract(x);
-        return x;
-    }
-
-    /**
-     * Implements the group operation (twisted Edwards addition) on our curve.
-     *
-     * @param P a point on the curve
-     * @param Q another point on the curve
-     * @return P+Q
-     */
-    private static BigInteger[] edwards(BigInteger[] P, BigInteger[] Q) {
-        BigInteger x1 = P[0];
-        BigInteger y1 = P[1];
-        BigInteger x2 = Q[0];
-        BigInteger y2 = Q[1];
-        BigInteger dtemp = d.multiply(x1).multiply(x2).multiply(y1).multiply(y2);
-        BigInteger x3 = ((x1.multiply(y2)).add((x2.multiply(y1)))).multiply(inv(BigInteger.ONE.add(dtemp)));
-        BigInteger y3 = ((y1.multiply(y2)).add((x1.multiply(x2)))).multiply(inv(BigInteger.ONE.subtract(dtemp)));
-        return new BigInteger[]{x3.mod(q), y3.mod(q)};
-    }
-
-    /**
-     * Multiply a point on the curve with a constant.
-     *
-     * @param P point on the curve
-     * @param e constant
-     * @return eP
-     */
-    private static BigInteger[] scalarmult(BigInteger[] P, BigInteger e) {
-        if (e.equals(BigInteger.ZERO)) {
-            return new BigInteger[]{BigInteger.ZERO, BigInteger.ONE};
-        }
-        BigInteger[] Q = scalarmult(P, e.shiftRight(1));
-        Q = edwards(Q, Q);
-        if (e.testBit(0)) Q = edwards(Q, P);
-        return Q;
-    }
-
-    /**
-     * Encode an integer to binary format.
-     *
-     * @param y integer to encode
-     * @return encoded integer as byte array
-     */
-    private static byte[] encodeint(BigInteger y) {
-        byte[] in = y.toByteArray();
-        // reverse the array
-        for (int i = 0; i < in.length / 2; i++) {
-            byte tmp = in[i];
-            in[i] = in[in.length - i - 1];
-            in[in.length - i - 1] = tmp;
-        }
-        return in;
-    }
-
-    /**
-     * Encode a point to binary format.
-     *
-     * @param P point to encode
-     * @return encoded point as byte array
-     */
-    private static byte[] encodepoint(BigInteger[] P) {
-        BigInteger x = P[0];
-        BigInteger y = P[1];
-        byte[] out = encodeint(y);
-        out[out.length-1] |= (x.testBit(0) ? 0x80 : 0);
-        return out;
-    }
-
-    /**
-     * Get return the i-th bit in the given array of bytes h.
-     *
-     * @param h array of bytes
-     * @param i bit index
-     * @return i-th bit in h
-     */
-    private static int bit(byte[] h, int i) {
-        return h[i/8] >> (i%8) & 1;
-    }
-
-    /**
-     * Compute from a private key the scalar value that yields the public key when
-     * multiplied with the generator point.
-     *
-     * @param sk private key
-     * @return public key coefficient
-     */
-    static private BigInteger computePublicKeyCoefficient(PrivateKey sk) {
-        byte[] h = sha512.digest(sk.d);
-        BigInteger a = BigInteger.valueOf(2).pow(b-2);
-        for (int i=3; i < (b - 2); i++) {
-            BigInteger apart = BigInteger.valueOf(2).pow(i).multiply(BigInteger.valueOf(bit(h,i)));
-            a = a.add(apart);
-        }
-        return a;
-    }
-
-    /**
-     * Derive the public key from the private key 'sk'.
-     *
-     * @param sk private key
-     * @return public key derived from 'sk'
-     */
-    static public PublicSignKey computePublicKey(PrivateKey sk) {
-        BigInteger a = computePublicKeyCoefficient(sk);
-        BigInteger[] A = scalarmult(B, a);
-        PublicSignKey publicKey = new PublicSignKey();
-        publicKey.x = encodeint(A[0]);
-        publicKey.y = encodeint(A[1]);
-        return publicKey;
-    }
-
-    /**
-     * Hash the data in m and return 2^h(m)
-     *
-     * @param m data to hash
-     * @return 2^h(m)
-     */
-    static private BigInteger Hint(byte[] m) {
-        final byte[] h = sha512.digest(m);
-        for (int i = 0; i < 32; i++) {
-            byte tmp = h[i];
-            h[i] = h[63 - i];
-            h[63 - i] = tmp;
-        }
-        return new BigInteger(1, h);
-    }
-
-    /**
-     * Sign a message.
-     *
-     * @param m the message to sign
-     * @param sk the private (secret) key
-     * @param pk the public key, derived from 'sk', but passed as a
-     *           parameter for performance reasons
-     * @return a signature on m
-     */
-    public static Signature sign(byte[] m, PrivateKey sk, PublicSignKey pk) {
-        byte[] compressed_pk = encodepoint(new BigInteger[]{decodeint(pk.x), decodeint(pk.y)});
-        byte[] h = sha512.digest(sk.d);
-        BigInteger a = BigInteger.valueOf(2).pow(b-2);
-        for (int i = 3; i < (b - 2); i++) {
-            a = a.add(BigInteger.valueOf(2).pow(i).multiply(BigInteger.valueOf(bit(h,i))));
-        }
-        ByteBuffer rsub = ByteBuffer.allocate((b/8)+m.length);
-        rsub.put(h, b/8, b/4-b/8).put(m);
-        BigInteger r = Hint(rsub.array());
-        BigInteger[] R = scalarmult(B,r);
-
-        Signature sig = new Signature();
-        sig.r = encodepoint(R);
-
-        ByteBuffer buf = ByteBuffer.allocate(32 + compressed_pk.length + m.length);
-        buf.put(encodepoint(R)).put(compressed_pk).put(m);
-
-        BigInteger S = r.add(Hint(buf.array()).multiply(a)).mod(l);
-        sig.s = encodeint(S);
-
-        return sig;
-    }
-
-    /**
-     * Check if a point is on the curve.
-     *
-     * @param P point to check
-     * @return whether the point P is on the curve
-     */
-    private static boolean isoncurve(BigInteger[] P) {
-        BigInteger x = P[0];
-        BigInteger y = P[1];
-        BigInteger xx = x.multiply(x);
-        BigInteger yy = y.multiply(y);
-        BigInteger dxxyy = d.multiply(yy).multiply(xx);
-        return xx.negate().add(yy).subtract(BigInteger.ONE).subtract(dxxyy).mod(q).equals(BigInteger.ZERO);
-    }
-
-    /**
-     * Decode an integer from its binary form.
-     *
-     * @param s the binary form if the integer
-     * @return the decoded integer
-     */
-    private static BigInteger decodeint(byte[] s) {
-        byte[] out = new byte[s.length];
-        for (int i=0;i<s.length;i++) {
-            out[i] = s[s.length-1-i];
-        }
-        return new BigInteger(out).and(un);
-    }
-
-    /**
-     * Decode a curve point from its compressed form.
-     *
-     * @param s the compressed point data
-     * @return the uncompressed point, null if not a valid point
-     */
-    private static BigInteger[] decodepoint(byte[] s) {
-        byte[] ybyte = new byte[s.length];
-        for (int i=0;i<s.length;i++) {
-            ybyte[i] = s[s.length-1-i];
-        }
-        BigInteger y = new BigInteger(ybyte).and(un);
-        BigInteger x = xrecover(y);
-        if ((x.testBit(0)?1:0) != bit(s, b-1)) {
-            x = q.subtract(x);
-        }
-        BigInteger[] P = {x,y};
-        if (!isoncurve(P))
-            return null;
-        return P;
-    }
-
-    /**
-     * Verify the validity of a signature on a message.
-     *
-     * @param sig signature
-     * @param m message
-     * @param pk public key of the signature creator
-     * @return whether the signature is valid
-     */
-    public static boolean verify(Signature sig, byte[] m, PublicSignKey pk) {
-        BigInteger[] R = decodepoint(sig.r);
-        BigInteger[] A = new BigInteger[]{decodeint(pk.x), decodeint(pk.y)};
-        BigInteger S = decodeint(sig.s);
-        ByteBuffer Stemp = ByteBuffer.allocate(32 + 32 + m.length);
-        Stemp.put(encodepoint(R)).put(encodepoint(A)).put(m);
-        BigInteger h = Hint(Stemp.array());
-        BigInteger[] ra = scalarmult(B,S);
-        BigInteger[] rb = edwards(R,scalarmult(A,h));
-        return ra[0].equals(rb[0]) && ra[1].equals(rb[1]);
-    }
-
-    /**
-     * Derive key material from a public and a private ECC key.
-     *
-     * @param privateKey private key to use for the ECDH (x)
-     * @param publicKey public key to use for the ECDH (yG)
-     * @return key material (xyG)
-     */
-    public static HashCode ecdh(PrivateKey privateKey, PublicSignKey publicKey) {
-        BigInteger[] publicPoint = new BigInteger[]{decodeint(publicKey.x), decodeint(publicKey.y)};
-        BigInteger coeff = computePublicKeyCoefficient(privateKey);
-        BigInteger[] R = scalarmult(publicPoint, coeff);
-        // FIXME: this is *not* equivalent to the GNUnet C implementation, which hashes an s-expr
-        sha512.update(R[0].toByteArray());
-        return new HashCode(sha512.digest(R[1].toByteArray()));
-    }
-
-    /**
-     * Get the shared private key we use for anonymous users.
-     *
-     * @return "anonymous" private key
-     */
-    public static PrivateKey getAnonymous() {
-        PrivateKey privateKey = new PrivateKey();
-        privateKey.d = encodeint(BigInteger.ONE);
-        return privateKey;
-    }
-
-}
diff --git a/src/main/java/org/gnunet/util/HashCode.java b/src/main/java/org/gnunet/util/HashCode.java
index 2ae127d..63ab11d 100644
--- a/src/main/java/org/gnunet/util/HashCode.java
+++ b/src/main/java/org/gnunet/util/HashCode.java
@@ -96,4 +96,6 @@ public class HashCode implements Message {
     public String toString() {
         return Strings.dataToString(data);
     }
+
+
 }
\ No newline at end of file
diff --git a/src/main/java/org/gnunet/util/crypto/Curve25519.java b/src/main/java/org/gnunet/util/crypto/Curve25519.java
new file mode 100644
index 0000000..86e6949
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/Curve25519.java
@@ -0,0 +1,69 @@
+/*
+ This file is part of GNUnet.
+  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+  Boston, MA 02111-1307, USA.
+ */
+
+package org.gnunet.util.crypto;
+
+
+import java.math.BigInteger;
+
+/**
+ * Java-only implementation of arithmetic on DJBs Curve25519.
+ * The curve is a Montgomery curve, and we use coordinates in
+ * Montgomery form.
+ * Very, very slow.
+ */
+public class Curve25519 {
+    private BigInteger X;
+    private BigInteger Z;
+
+    private BigInteger B = new BigInteger("486662");
+
+    // curve parameter q =  255^(-19)
+    private static final BigInteger q = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819949");
+
+
+    public Curve25519(BigInteger X, BigInteger Z) {
+        this.X = X;
+        this.Z = Z;
+    }
+
+    public Curve25519 scalarmult(BigInteger e) {
+        if (e.equals(BigInteger.ZERO)) {
+            return new Curve25519(BigInteger.ZERO, BigInteger.ONE);
+        }
+        Curve25519 Q = scalarmult(e.shiftRight(1));
+        Q = Q.add(Q);
+        if (e.testBit(0)) Q = Q.add(this);
+        return Q;
+    }
+
+    /**
+     * Addition law for montgomery curve in montgomery coordinates.
+     *
+     * @param other
+     * @return
+     */
+    public Curve25519 add(Curve25519 other) {
+        return null;
+    }
+
+
+
+}
diff --git a/src/main/java/org/gnunet/util/crypto/DsaPrng.java b/src/main/java/org/gnunet/util/crypto/DsaPrng.java
new file mode 100644
index 0000000..c26848e
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/DsaPrng.java
@@ -0,0 +1,86 @@
+/*
+ This file is part of GNUnet.
+  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+  Boston, MA 02111-1307, USA.
+ */
+
+package org.gnunet.util.crypto;
+
+import com.google.common.primitives.Bytes;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.math.BigInteger;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+
+/**
+ * Deterministic generator for the 'k'-value of DSA, conforming to RFC 6979.
+ * SHA-1 is used as H.
+ */
+public class DsaPrng {
+    private static final int qlen = 32;
+    private Mac mac;
+    private byte[] V = new byte[64];
+    private byte[] K = new byte[64];
+
+    public byte[] hmacK(byte[]... args) {
+        try {
+            mac.init(new SecretKeySpec(K, "HmacSHA1"));
+        } catch (InvalidKeyException e) {
+            throw new RuntimeException("invalid key: " + e.getMessage());
+        }
+        for (byte[] bytes : args) {
+            mac.update(bytes);
+        }
+        return mac.doFinal();
+    }
+
+    public DsaPrng(byte[] key, byte[] message) {
+        try {
+            mac = Mac.getInstance("HmacSHA1");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("crypto algorithm 'HmacSHA1' required but not provided");
+        }
+        MessageDigest digest;
+        try {
+            digest = MessageDigest.getInstance("SHA-512");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("crypto algorithm 'SHA-512' required but not provided");
+        }
+        byte[] h1 = digest.digest(message);
+
+        Arrays.fill(V, (byte) 1);
+        K = hmacK(V, new byte[]{0}, key, h1);
+        V = hmacK(V);
+        K = hmacK(V, new byte[]{1}, key, h1);
+        V = hmacK(V);
+    }
+
+    public BigInteger nextK() {
+        byte[] T = new byte[0];
+        while (T.length < qlen) {
+            V = hmacK(V);
+            T = Bytes.concat(T, V);
+        }
+        K = hmacK(V, new byte[]{0});
+        V = hmacK(V);
+        return new BigInteger(1, T);
+    }
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EcdhePrivateKey.java b/src/main/java/org/gnunet/util/crypto/EcdhePrivateKey.java
new file mode 100644
index 0000000..e3cd861
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EcdhePrivateKey.java
@@ -0,0 +1,4 @@
+package org.gnunet.util.crypto;
+
+public class EcdhePrivateKey {
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EcdhePublicKey.java b/src/main/java/org/gnunet/util/crypto/EcdhePublicKey.java
new file mode 100644
index 0000000..3943137
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EcdhePublicKey.java
@@ -0,0 +1,20 @@
+package org.gnunet.util.crypto;
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+
+public class EcdhePublicKey {
+    /**
+     * x-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] x;
+
+    /**
+     * y-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] y;
+
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EcdsaPrivateKey.java b/src/main/java/org/gnunet/util/crypto/EcdsaPrivateKey.java
new file mode 100644
index 0000000..284c88c
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EcdsaPrivateKey.java
@@ -0,0 +1,35 @@
+package org.gnunet.util.crypto;
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+import org.gnunet.construct.Message;
+
+import java.security.SecureRandom;
+
+public class EcdsaPrivateKey implements Message {
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] d;
+
+    public static EcdsaPrivateKey getAnonymous() {
+        return null;
+    }
+
+    public EcdsaSignature sign(int purpose, byte[] data) {
+        return null;
+    }
+
+    public static EcdsaPrivateKey fromFile(String privKeyFilename) {
+        return null;
+    }
+
+    public EcdsaPublicKey getPublicKey() {
+        return null;
+    }
+
+    public static EcdsaPrivateKey createRandom() {
+        SecureRandom sr = new SecureRandom();
+        EcdsaPrivateKey privateKey = new EcdsaPrivateKey();
+        privateKey.d = new byte[32];
+        sr.nextBytes(privateKey.d);
+        return privateKey;
+    }
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EcdsaPublicKey.java b/src/main/java/org/gnunet/util/crypto/EcdsaPublicKey.java
new file mode 100644
index 0000000..9642e1a
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EcdsaPublicKey.java
@@ -0,0 +1,27 @@
+package org.gnunet.util.crypto;
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+
+public class EcdsaPublicKey {
+    /**
+     * x-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] x;
+
+    /**
+     * y-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] y;
+
+    public EcdsaPublicKey(Ed25519 a) {
+
+    }
+
+    public static EcdsaPublicKey fromString(String s) {
+        return null;
+    }
+}
diff --git a/src/main/java/org/gnunet/voting/messages/CertificateDenyMessage.java b/src/main/java/org/gnunet/util/crypto/EcdsaSignature.java
index aefd6ab..fcb2ba5 100644
--- a/src/main/java/org/gnunet/voting/messages/CertificateDenyMessage.java
+++ b/src/main/java/org/gnunet/util/crypto/EcdsaSignature.java
@@ -18,17 +18,15 @@
   Boston, MA 02111-1307, USA.
  */
 
-package org.gnunet.voting.messages;
+package org.gnunet.util.crypto;
 
 
-import org.gnunet.construct.NestedMessage;
-import org.gnunet.construct.UnionCase;
-import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
-import org.gnunet.util.GnunetMessage;
+public class EcdsaSignature {
+    boolean verify() {
+        return false;
+    }
 
-@UnionCase(42011)
-public class CertificateDenyMessage implements GnunetMessage.Body {
-    @ZeroTerminatedString
-    public String reason;
+    public static EcdsaSignature fromString(String s) {
+        return null;  //To change body of created methods use File | Settings | File Templates.
+    }
 }
diff --git a/src/main/java/org/gnunet/util/crypto/Ed25519.java b/src/main/java/org/gnunet/util/crypto/Ed25519.java
new file mode 100644
index 0000000..0947de4
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/Ed25519.java
@@ -0,0 +1,133 @@
+package org.gnunet.util.crypto;
+
+
+import java.math.BigInteger;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+/**
+ * Java-only implementation of arithmetic on DJBs Ed25519.
+ * Very, very slow.
+ */
+public class Ed25519 {
+    // curve parameter b
+    static final int b = 256;
+    // curve parameter q =  255^(-19)
+    private static final BigInteger q = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819949");
+    // q-3
+    private static final BigInteger qm2 = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819947");
+    // q-3
+    private static final BigInteger qp3 = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819952");
+    static final BigInteger l = new BigInteger("7237005577332262213973186563042994240857116359379907606001950938285454250989");
+    private static final BigInteger d = new BigInteger("-4513249062541557337682894930092624173785641285191125241628941591882900924598840740");
+    private static final BigInteger I = new BigInteger("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+    private static final BigInteger By = new BigInteger("46316835694926478169428394003475163141307993866256225615783033603165251855960");
+    private static final BigInteger Bx = new BigInteger("15112221349535400772501151409588531511454012693041857206046113283949847762202");
+    static final Ed25519 B = new Ed25519(Bx.mod(q),By.mod(q));
+    // 2^255
+    private static final BigInteger un = new BigInteger("57896044618658097711785492504343953926634992332820282019728792003956564819967");
+
+
+    BigInteger P0;
+    BigInteger P1;
+
+    public Ed25519(BigInteger P0, BigInteger P1) {
+        this.P0 = P0;
+        this.P1 = P1;
+    }
+
+    public static Ed25519 decompress(BigInteger y) {
+        BigInteger y2 = y.multiply(y);
+        BigInteger xx = (y2.subtract(BigInteger.ONE)).multiply(inv(d.multiply(y2).add(BigInteger.ONE)));
+        BigInteger x = xx.modPow(qp3.divide(BigInteger.valueOf(8)), q);
+        if (!x.multiply(x).subtract(xx).mod(q).equals(BigInteger.ZERO)) x = (x.multiply(I).mod(q));
+        if (!x.mod(BigInteger.valueOf(2)).equals(BigInteger.ZERO)) x = q.subtract(x);
+        return new Ed25519(x, y);
+    }
+
+    /**
+     * Computes the multiplicative inverse of x modulo q using Euler's theorem.
+     *
+     * @param x the group element to invert
+     * @return the inverse of x modulo q
+     */
+    private static BigInteger inv(BigInteger x) {
+        return x.modPow(qm2, q);
+    }
+
+    /**
+     * Twisted edwards curve addition law.
+     *
+     * @param other other point
+     * @return this + other
+     */
+    public Ed25519 add(Ed25519 other) {
+        BigInteger x1 = this.P0;
+        BigInteger y1 = this.P1;
+        BigInteger x2 = other.P0;
+        BigInteger y2 = other.P1;
+        BigInteger dtemp = d.multiply(x1).multiply(x2).multiply(y1).multiply(y2);
+        BigInteger x3 = ((x1.multiply(y2)).add((x2.multiply(y1)))).multiply(inv(BigInteger.ONE.add(dtemp)));
+        BigInteger y3 = ((y1.multiply(y2)).add((x1.multiply(x2)))).multiply(inv(BigInteger.ONE.subtract(dtemp)));
+        return new Ed25519(x3.mod(q), y3.mod(q));
+    }
+
+    public Ed25519 scalarmult(BigInteger e) {
+        if (e.equals(BigInteger.ZERO)) {
+            return new Ed25519(BigInteger.ZERO, BigInteger.ONE);
+        }
+        Ed25519 Q = scalarmult(e.shiftRight(1));
+        Q = Q.add(Q);
+        if (e.testBit(0)) Q = Q.add(this);
+        return Q;
+    }
+
+    public static BigInteger decodeScalar(byte[] s) {
+        byte[] out = new byte[s.length];
+        for (int i=0; i < s.length;i++) {
+            out[i] = s[s.length-1-i];
+        }
+        return new BigInteger(out).and(un);
+    }
+
+    public static byte[] encodeScalar(BigInteger n) {
+        byte[] in = n.toByteArray();
+        // reverse the array
+        for (int i = 0; i < in.length / 2; i++) {
+            byte tmp = in[i];
+            in[i] = in[in.length - i - 1];
+            in[in.length - i - 1] = tmp;
+        }
+        return in;
+    }
+
+    public byte[] encode() {
+        byte[] out = encodeScalar(P1);
+        out[out.length-1] |= (P0.testBit(0) ? 0x80 : 0);
+        return out;
+    }
+
+
+    /**
+     * Hash the data in m and return 2^h(m)
+     *
+     * @param m data to hash
+     * @return 2^h(m)
+     */
+    static BigInteger Hint(byte[] m) {
+        MessageDigest sha512;
+        try {
+            sha512 = MessageDigest.getInstance("SHA-512");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("crypto algorithm required but not provided");
+        }
+        final byte[] h = sha512.digest(m);
+        for (int i = 0; i < 32; i++) {
+            byte tmp = h[i];
+            h[i] = h[63 - i];
+            h[63 - i] = tmp;
+        }
+        return new BigInteger(1, h);
+    }
+
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EddsaPrivateKey.java b/src/main/java/org/gnunet/util/crypto/EddsaPrivateKey.java
new file mode 100644
index 0000000..973706f
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EddsaPrivateKey.java
@@ -0,0 +1,83 @@
+package org.gnunet.util.crypto;
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+import org.gnunet.construct.Message;
+
+import java.math.BigInteger;
+import java.nio.ByteBuffer;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+
+public class EddsaPrivateKey implements Message {
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] d;
+
+    public EddsaSignature sign(EddsaPublicKey publicKey, int purpose, byte[] m) {
+        MessageDigest sha512;
+        try {
+            sha512 = MessageDigest.getInstance("SHA-512");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("crypto algorithm required but not provided");
+        }
+        byte[] h = sha512.digest(d);
+        BigInteger a = BigInteger.valueOf(2).pow(Ed25519.b-2);
+        for (int i = 3; i < (Ed25519.b - 2); i++) {
+            a = a.add(BigInteger.valueOf(2).pow(i).multiply(BigInteger.valueOf(bit(h,i))));
+        }
+        ByteBuffer rsub = ByteBuffer.allocate((Ed25519.b/8)+m.length);
+        rsub.put(h, Ed25519.b/8, Ed25519.b/4-Ed25519.b/8).put(m);
+        BigInteger r = Ed25519.Hint(rsub.array());
+        Ed25519 R = Ed25519.B.scalarmult(r);
+
+        byte[] encodedPublicKey = publicKey.asPoint().encode();
+        ByteBuffer buf = ByteBuffer.allocate(32 + encodedPublicKey.length + m.length);
+        buf.put(R.encode()).put(encodedPublicKey).put(m);
+
+        BigInteger S = r.add(Ed25519.Hint(buf.array()).multiply(a)).mod(Ed25519.l);
+
+        return new EddsaSignature(R, S);
+    }
+
+    /**
+     * Get return the i-th bit in the given array of bytes h.
+     *
+     * @param h array of bytes
+     * @param i bit index
+     * @return i-th bit in h
+     */
+    private static int bit(byte[] h, int i) {
+        return h[i/8] >> (i%8) & 1;
+    }
+
+
+    private BigInteger computePublicKeyCoefficient() {
+        MessageDigest sha512;
+        try {
+            sha512 = MessageDigest.getInstance("SHA-512");
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("crypto algorithm required but not provided");
+        }
+        byte[] h = sha512.digest(d);
+        BigInteger a = BigInteger.valueOf(2).pow(Ed25519.b - 2);
+        for (int i=3; i < (Ed25519.b - 2); i++) {
+            BigInteger apart = BigInteger.valueOf(2).pow(i).multiply(BigInteger.valueOf(bit(h,i)));
+            a = a.add(apart);
+        }
+        return a;
+    }
+
+    public EddsaPublicKey getPublicKey() {
+        BigInteger a = computePublicKeyCoefficient();
+        Ed25519 A = Ed25519.B.scalarmult(a);
+        return new EddsaPublicKey(A);
+    }
+
+    public static EddsaPrivateKey createRandom() {
+        SecureRandom sr = new SecureRandom();
+        EddsaPrivateKey privateKey = new EddsaPrivateKey();
+        privateKey.d = new byte[32];
+        sr.nextBytes(privateKey.d);
+        return privateKey;
+    }
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EddsaPublicKey.java b/src/main/java/org/gnunet/util/crypto/EddsaPublicKey.java
new file mode 100644
index 0000000..725208f
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EddsaPublicKey.java
@@ -0,0 +1,29 @@
+package org.gnunet.util.crypto;
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+import org.gnunet.construct.Message;
+
+public class EddsaPublicKey implements Message {
+    /**
+     * x-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] x;
+
+    /**
+     * y-coordinate of the point on the curve.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] y;
+
+    public EddsaPublicKey(Ed25519 a) {
+        x = Ed25519.encodeScalar(a.P0);
+        y = Ed25519.encodeScalar(a.P1);
+    }
+
+    public Ed25519 asPoint() {
+        return new Ed25519(Ed25519.decodeScalar(x), Ed25519.decodeScalar(y));
+    }
+}
diff --git a/src/main/java/org/gnunet/util/crypto/EddsaSignature.java b/src/main/java/org/gnunet/util/crypto/EddsaSignature.java
new file mode 100644
index 0000000..d0ee328
--- /dev/null
+++ b/src/main/java/org/gnunet/util/crypto/EddsaSignature.java
@@ -0,0 +1,94 @@
+/*
+ This file is part of GNUnet.
+  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+  Boston, MA 02111-1307, USA.
+ */
+
+/*
+ This file is part of GNUnet.
+  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+  Boston, MA 02111-1307, USA.
+ */
+
+package org.gnunet.util.crypto;
+
+
+import org.gnunet.construct.FixedSizeIntegerArray;
+import org.gnunet.construct.Message;
+
+import java.math.BigInteger;
+import java.nio.ByteBuffer;
+
+public class EddsaSignature implements Message {
+    /**
+     * R value of the signature in compressed form.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] r;
+
+    /**
+     * S-value of the signature.
+     * The number is stored as little endian.
+     */
+    @FixedSizeIntegerArray(bitSize = 8, signed = false, length = 32)
+    public byte[] s;
+
+    public EddsaSignature(Ed25519 r, BigInteger s) {
+        this.r = r.encode();
+        this.s = Ed25519.encodeScalar(s);
+    }
+
+    public boolean verify(byte[] m, int purpose, EddsaPublicKey publicKey) {
+        Ed25519 R = Ed25519.decompress(Ed25519.decodeScalar(r));
+        Ed25519 A = publicKey.asPoint();
+        BigInteger S = Ed25519.decodeScalar(s);
+        ByteBuffer Stemp = ByteBuffer.allocate(32 + 32 + m.length);
+        Stemp.put(R.encode()).put(A.encode()).put(m);
+        BigInteger h = Ed25519.Hint(Stemp.array());
+        Ed25519 ra = Ed25519.B.scalarmult(S);
+        Ed25519 rb = R.add(A.scalarmult(h));
+        return rb.equals(rb);
+    }
+
+    public static EddsaSignature fromString(String value) {
+        return null;
+    }
+
+    /**
+     * Return a signature that is invalid with very, very high probability.
+     *
+     * @return
+     */
+    public static EddsaSignature randomGarbage() {
+        return null;
+    }
+}
diff --git a/src/main/java/org/gnunet/voting/Ballot.java b/src/main/java/org/gnunet/voting/Ballot.java
index 0d8de27..531b662 100644
--- a/src/main/java/org/gnunet/voting/Ballot.java
+++ b/src/main/java/org/gnunet/voting/Ballot.java
@@ -26,6 +26,10 @@ import com.google.common.collect.BiMap;
 import com.google.common.collect.HashBiMap;
 import com.google.common.primitives.Longs;
 import org.gnunet.util.*;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
+import org.gnunet.util.crypto.EcdsaPublicKey;
+import org.gnunet.util.crypto.EcdsaSignature;
+import org.gnunet.util.crypto.EddsaSignature;
 
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -45,15 +49,15 @@ public class Ballot {
     AbsoluteTime queryTime;
     AbsoluteTime endTime;
     BiMap<String,PeerIdentity> authorities;
-    SortedMap<String,CryptoECC.Signature> registrationSigs;
-    CryptoECC.PublicSignKey caPub;
-    CryptoECC.PublicSignKey issuerPub;
-    CryptoECC.Signature issuerSig;
-    CryptoECC.PublicSignKey voterPub;
-    CryptoECC.Signature voterGroupCert;
-    CryptoECC.Signature permission;
-    CryptoECC.PublicSignKey voterSig;
-    SortedMap<String,CryptoECC.Signature> voucherSigs;
+    SortedMap<String,EddsaSignature> registrationSigs;
+    EcdsaPublicKey caPub;
+    EcdsaPublicKey issuerPub;
+    EcdsaSignature issuerSig;
+    EcdsaPublicKey voterPub;
+    EcdsaSignature voterGroupCert;
+    EcdsaSignature permission;
+    EcdsaPublicKey voterSig;
+    SortedMap<String,EddsaSignature> confirmationSigs;
 
     /**
      * Choice in plaintext.
@@ -152,22 +156,22 @@ public class Ballot {
         if (!optCaPub.isPresent()) {
             throw new InvalidBallotException("no CA pub key given");
         }
-        caPub = CryptoECC.PublicSignKey.fromString(optCaPub.get());
+        caPub = EcdsaPublicKey.fromString(optCaPub.get());
         if (null == caPub) {
             throw new InvalidBallotException("CA pub key invalid");
         }
         Optional<String> optIssuerPub = cfg.getValueString("election", "ISSUER_PUB");
         if (optIssuerPub.isPresent()) {
-            issuerPub = CryptoECC.PublicSignKey.fromString(optIssuerPub.get());
+            issuerPub = EcdsaPublicKey.fromString(optIssuerPub.get());
             Optional<String> optIssuerSig = cfg.getValueString("election", "ISSUER_SIG");
             if (!optIssuerSig.isPresent()) {
                 throw new InvalidBallotException("issuer public key present, but no signature");
             }
-            issuerSig = CryptoECC.Signature.fromString(optIssuerSig.get());
+            issuerSig = EcdsaSignature.fromString(optIssuerSig.get());
         }
-        registrationSigs = new TreeMap<String, CryptoECC.Signature>();
+        registrationSigs = new TreeMap<String, EddsaSignature>();
         for (Map.Entry<String,String> e : cfg.getSection("registration-signatures").entrySet()) {
-            CryptoECC.Signature sig = CryptoECC.Signature.fromString(e.getValue());
+            EddsaSignature sig = EddsaSignature.fromString(e.getValue());
             if (null == sig) {
                 throw new InvalidBallotException("registration signature has invalid format");
             }
@@ -176,16 +180,16 @@ public class Ballot {
             }
             registrationSigs.put(e.getKey(), sig);
         }
-        voucherSigs = new TreeMap<String, CryptoECC.Signature>();
+        confirmationSigs = new TreeMap<String, EddsaSignature>();
         for (Map.Entry<String,String> e : cfg.getSection("vouchers").entrySet()) {
-            CryptoECC.Signature sig = CryptoECC.Signature.fromString(e.getValue());
+            EddsaSignature sig = EddsaSignature.fromString(e.getValue());
             if (null == sig) {
                 throw new InvalidBallotException("voucher signature has invalid format");
             }
             if (!authorities.containsKey(e.getKey())) {
                 throw new InvalidBallotException("ballot contains superfluous voucher signature");
             }
-            voucherSigs.put(e.getKey(), sig);
+            confirmationSigs.put(e.getKey(), sig);
         }
         Optional<String> optChoiceId = cfg.getValueString("vote", "CHOICE_ID");
         if (optChoiceId.isPresent()) {
@@ -199,7 +203,7 @@ public class Ballot {
 
         Optional<String> optVoterPub = cfg.getValueString("vote", "VOTER_PUB");
         if (optVoterPub.isPresent()) {
-            voterPub = CryptoECC.PublicSignKey.fromString(optVoterPub.get());
+            voterPub = EcdsaPublicKey.fromString(optVoterPub.get());
         }
 
         startTime = getTime(cfg, "START");
@@ -250,7 +254,7 @@ public class Ballot {
      * @param choice the choice to encode the ballot
      * @param privateKey the private key to use for encoding
      */
-    public void encodeChoice(String choice, CryptoECC.PrivateKey privateKey) {
+    public void encodeChoice(String choice, EcdsaPrivateKey privateKey) {
         choiceId = -1;
         int i = 0;
         for (String possibleChoice : choices) {
@@ -259,7 +263,7 @@ public class Ballot {
             }
             i++;
         }
-        voterPub = CryptoECC.computePublicKey(privateKey);
+        voterPub = privateKey.getPublicKey();
         if (choiceId == -1) {
             throw new InvalidBallotException(String.format("choice '%s' not valid", choice));
         }
@@ -284,12 +288,12 @@ public class Ballot {
             cfg.setValueString("authorities", e.getKey(), e.getValue().toString());
         }
         if (null != registrationSigs) {
-            for (Map.Entry<String, CryptoECC.Signature> e : registrationSigs.entrySet()) {
+            for (Map.Entry<String, EddsaSignature> e : registrationSigs.entrySet()) {
                 cfg.setValueString("registration-signatures", e.getKey(), e.getValue().toString());
             }
         }
-        if (null != voucherSigs) {
-            for (Map.Entry<String, CryptoECC.Signature> e : voucherSigs.entrySet()) {
+        if (null != confirmationSigs) {
+            for (Map.Entry<String, EddsaSignature> e : confirmationSigs.entrySet()) {
                 cfg.setValueString("vouchers", e.getKey(), e.getValue().toString());
             }
         }
@@ -370,15 +374,15 @@ public class Ballot {
         }
         if (!registrationSigs.isEmpty()) {
             buf.append("ballot is registered with the following authorities:\n");
-            for (Map.Entry<String, CryptoECC.Signature> e : registrationSigs.entrySet()) {
+            for (Map.Entry<String, EddsaSignature> e : registrationSigs.entrySet()) {
                 buf.append(e.getKey());
                 buf.append(" ");
             }
             buf.append("\n");
         }
-        if (!voucherSigs.isEmpty()) {
+        if (!confirmationSigs.isEmpty()) {
             buf.append("ballot's vote has been submitted to with the following authorities:\n");
-            for (Map.Entry<String, CryptoECC.Signature> e : voucherSigs.entrySet()) {
+            for (Map.Entry<String, EddsaSignature> e : confirmationSigs.entrySet()) {
                 buf.append(e.getKey());
                 buf.append(" ");
             }
@@ -404,7 +408,7 @@ public class Ballot {
     public List<PeerIdentity> getRemainingSubmitAuthorities() {
         LinkedList<PeerIdentity> remaining = new LinkedList<PeerIdentity>();
         for (SortedMap.Entry<String,PeerIdentity> x : authorities.entrySet()) {
-            if (!voucherSigs.containsKey(x.getKey()))
+            if (!confirmationSigs.containsKey(x.getKey()))
                 remaining.add(x.getValue());
         }
         return remaining;
@@ -430,9 +434,10 @@ public class Ballot {
      *
      * @param privateKey private key of the issuer
      */
-    public void issue(CryptoECC.PrivateKey privateKey) {
-        issuerPub = CryptoECC.computePublicKey(privateKey);
-        issuerSig = CryptoECC.sign(getBallotGuid().data, privateKey, issuerPub);
+    public void issue(EcdsaPrivateKey privateKey) {
+        issuerPub = privateKey.getPublicKey();
+        // FIXME: purpose
+        issuerSig = privateKey.sign(0, getBallotGuid().data);
     }
 
     /**
@@ -441,7 +446,8 @@ public class Ballot {
      * @param currentAuthority authority we registered with
      * @param registrationSignature signature over this ballot's GUID from the authority
      */
-    public void addRegistrationSignature(PeerIdentity currentAuthority, CryptoECC.Signature registrationSignature) {
+    public void addRegistrationSignature(PeerIdentity currentAuthority,
+                                         EddsaSignature registrationSignature) {
         String alias = authorities.inverse().get(currentAuthority);
         registrationSigs.put(alias, registrationSignature);
     }
@@ -451,11 +457,11 @@ public class Ballot {
      * to the list of vouchers
      *
      * @param currentAuthority authority that received the vote
-     * @param voucherSignature signature from the authority
+     * @param confirmationSignature signature from the authority
      */
-    public void addVoucher(PeerIdentity currentAuthority, CryptoECC.Signature voucherSignature) {
+    public void addConfirmation(PeerIdentity currentAuthority, EddsaSignature confirmationSignature) {
         String alias = authorities.inverse().get(currentAuthority);
-        voucherSigs.put(alias, voucherSignature);
+        confirmationSigs.put(alias, confirmationSignature);
     }
 
     /**
diff --git a/src/main/java/org/gnunet/voting/BallotTool.java b/src/main/java/org/gnunet/voting/BallotTool.java
index 1abf8fd..fe83789 100644
--- a/src/main/java/org/gnunet/voting/BallotTool.java
+++ b/src/main/java/org/gnunet/voting/BallotTool.java
@@ -25,8 +25,8 @@ import com.google.common.base.Charsets;
 import com.google.common.io.ByteStreams;
 import com.google.common.io.Files;
 import com.google.common.io.OutputSupplier;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.Program;
+import org.gnunet.util.crypto.EcdsaPrivateKey;
 import org.gnunet.util.getopt.Argument;
 import org.gnunet.util.getopt.ArgumentAction;
 
@@ -78,13 +78,6 @@ public class BallotTool {
             String select = null;
 
             @Argument(
-                    shortname = "G",
-                    longname = "certify-group",
-                    action = ArgumentAction.SET,
-                    description = "request a certificate that the voter belongs to the ballot's group")
-             boolean certifyGroup = false;
-
-            @Argument(
                     shortname = "V",
                     longname = "verify",
                     action = ArgumentAction.SET,
@@ -98,21 +91,6 @@ public class BallotTool {
                     description = "write a template ballot to the give ballot file")
             boolean template = false;
 
-            @Argument(
-                    shortname = "g",
-                    longname = "gen-key",
-                    action = ArgumentAction.SET,
-                    description = "generate a private key")
-            boolean genKey = false;
-
-            @Argument(
-                    shortname = "P",
-                    longname = "print-key",
-                    action = ArgumentAction.SET,
-                    description = "print the public key for the private key")
-            boolean printKey = false;
-
-
             @Override
             protected String makeHelpText() {
                 return "gnunet-ballot [OPTIONS]... BALLOT [PRIVKEYFILE]\n" +
@@ -146,7 +124,7 @@ public class BallotTool {
                     return;
                 }
                 Ballot b = new Ballot(ballotFilename);
-                CryptoECC.PrivateKey privateKey = CryptoECC.PrivateKey.fromFile(privKeyFilename);
+                EcdsaPrivateKey privateKey = EcdsaPrivateKey.fromFile(privKeyFilename);
                 if (privateKey == null) {
                     System.err.println("keyfile invalid");
                     return;
@@ -170,7 +148,7 @@ public class BallotTool {
                     System.err.println("private-key file does not exist");
                     return;
                 }
-                CryptoECC.PrivateKey privateKey = CryptoECC.PrivateKey.fromFile(privKeyFilename);
+                EcdsaPrivateKey privateKey = EcdsaPrivateKey.fromFile(privKeyFilename);
                 if (privateKey == null) {
                     System.err.println("keyfile invalid");
                     return;
@@ -186,38 +164,6 @@ public class BallotTool {
                 System.out.println("vote written to ballot file");
             }
 
-            public void runPermission(String ballotFilename, String privKeyFilename) {
-
-            }
-
-            public void runGenKey(String privKeyFilename) {
-                File kf = new File(privKeyFilename);
-                if (kf.exists()) {
-                    System.err.println("private key file already exists, not overwriting");
-                    return;
-                }
-                CryptoECC.PrivateKey privateKey = CryptoECC.PrivateKey.createRandom();
-                try {
-                    privateKey.write(privKeyFilename);
-                } catch (IOException e) {
-                    System.err.println("can't write to key file: " + e.getMessage());
-                }
-            }
-
-            public void runPrintKey(String privKeyFilename) {
-                File kf = new File(privKeyFilename);
-                if (!kf.exists()) {
-                    System.err.println("key file does not exist");
-                    return;
-                }
-                CryptoECC.PrivateKey privateKey = CryptoECC.PrivateKey.fromFile(privKeyFilename);
-                if (privateKey == null) {
-                    System.err.println("key invalid");
-                    return;
-                }
-                CryptoECC.PublicSignKey publicKey = CryptoECC.computePublicKey(privateKey);
-                System.out.println(publicKey.toString());
-            }
 
             public void runVerify(String ballotFilename) {
                 File bf = new File(ballotFilename);
@@ -291,30 +237,6 @@ public class BallotTool {
                     c.run();
                     return;
                 }
-                if (certifyGroup) {
-                    if (this.unprocessedArgs.length != 2) {
-                        System.err.println("-G/--certify-group requires exactly two positional arguments");
-                        return;
-                    }
-                    CertifyGroupCommand c = new CertifyGroupCommand(getConfiguration(),
-                            unprocessedArgs[0], unprocessedArgs[1]);
-                    c.run();
-                    return;
-                }
-                if (genKey) {
-                    if (this.unprocessedArgs.length != 1) {
-                        System.err.println("-g/--gen-key requires exactly one positional argument");
-                        return;
-                    }
-                    runGenKey(unprocessedArgs[0]);
-                }
-                if (printKey) {
-                    if (this.unprocessedArgs.length != 1) {
-                        System.err.println("-P/--print-key requires exactly one positional argument");
-                        return;
-                    }
-                    runPrintKey(unprocessedArgs[0]);
-                }
             }
         }.start();
 
diff --git a/src/main/java/org/gnunet/voting/CertificateAuthorityDaemon.java b/src/main/java/org/gnunet/voting/CertificateAuthorityDaemon.java
deleted file mode 100644
index fc54bbf..0000000
--- a/src/main/java/org/gnunet/voting/CertificateAuthorityDaemon.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- This file is part of GNUnet.
-  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
-
-  GNUnet is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published
-  by the Free Software Foundation; either version 3, or (at your
-  option) any later version.
-
-  GNUnet is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with GNUnet; see the file COPYING.  If not, write to the
-  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-  Boston, MA 02111-1307, USA.
- */
-package org.gnunet.voting;
-
-import com.google.common.collect.Maps;
-import org.gnunet.mesh.Mesh;
-import org.gnunet.mesh.MeshRunabout;
-import org.gnunet.testbed.CompressedConfig;
-import org.gnunet.util.*;
-import org.gnunet.voting.messages.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * Gives a voter a certificate that acknowledges that he belongs to a certain group
- * (e.g. all people from bavaria over 18 years old)
- */
-public class CertificateAuthorityDaemon extends Program {
-    private static final Logger logger = LoggerFactory
-            .getLogger(CertificateAuthorityDaemon.class);
-
-    public static final int MESH_PORT = 1002;
-    private Mesh mesh;
-
-    public class CaMeshReceiver extends MeshRunabout {
-        public void visit(CertificateRequestMessage m) {
-            logger.info("granting group cert for '" + m.group + "'");
-            CertificateGrantMessage gm = new CertificateGrantMessage();
-            gm.expiration = AbsoluteTime.FOREVER.asMessage();
-            gm.groupCertificate = CryptoECC.Signature.randomSignature();
-            getSender().receiveDone();
-        }
-    }
-
-    public CertificateAuthorityDaemon(String[] args) {
-        super(args);
-    }
-
-    public static void main(String[] args) {
-        CertificateAuthorityDaemon daemon = new CertificateAuthorityDaemon(args);
-        daemon.start();
-    }
-
-    @Override
-    public void run() {
-        logger.info("running ca daemon");
-        mesh = new Mesh(getConfiguration(), null, null, new CaMeshReceiver(), MESH_PORT);
-    }
-}
diff --git a/src/main/java/org/gnunet/voting/CertifyGroupCommand.java b/src/main/java/org/gnunet/voting/CertifyGroupCommand.java
deleted file mode 100644
index e76ba1f..0000000
--- a/src/main/java/org/gnunet/voting/CertifyGroupCommand.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- This file is part of GNUnet.
-  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
-
-  GNUnet is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published
-  by the Free Software Foundation; either version 3, or (at your
-  option) any later version.
-
-  GNUnet is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with GNUnet; see the file COPYING.  If not, write to the
-  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-  Boston, MA 02111-1307, USA.
- */
-
-/*
- This file is part of GNUnet.
-  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
-
-  GNUnet is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published
-  by the Free Software Foundation; either version 3, or (at your
-  option) any later version.
-
-  GNUnet is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with GNUnet; see the file COPYING.  If not, write to the
-  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-  Boston, MA 02111-1307, USA.
- */
-
-/*
- This file is part of GNUnet.
-  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
-
-  GNUnet is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published
-  by the Free Software Foundation; either version 3, or (at your
-  option) any later version.
-
-  GNUnet is distributed in the hope that it will be useful, but
-  WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-  General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with GNUnet; see the file COPYING.  If not, write to the
-  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-  Boston, MA 02111-1307, USA.
- */
-
-package org.gnunet.voting;
-
-
-import org.gnunet.mesh.Mesh;
-import org.gnunet.mesh.MeshRunabout;
-import org.gnunet.mesh.TunnelEndHandler;
-import org.gnunet.util.Configuration;
-import org.gnunet.util.CryptoECC;
-import org.gnunet.voting.messages.CertificateGrantMessage;
-import org.gnunet.voting.messages.CertificateRequestMessage;
-import org.gnunet.voting.messages.QueryFailureMessage;
-
-import java.io.File;
-import java.util.Random;
-
-public class CertifyGroupCommand extends MeshRunabout implements TunnelEndHandler {
-    private final String ballotFilename;
-    private final String pubKeyString;
-    private Ballot ballot;
-    private final Configuration cfg;
-    private Mesh mesh;
-    private Mesh.Tunnel<Void> tunnel;
-    private boolean submitted = false;
-
-    @Override
-    public void onTunnelEnd(Mesh.Tunnel tunnel) {
-        if (!submitted)
-            throw new AssertionError();
-    }
-
-    public void visit(CertificateGrantMessage m) {
-        submitted = true;
-        System.out.println("certificate granted");
-
-        tunnel.destroy();
-        mesh.destroy();
-    }
-
-
-    public void visit(QueryFailureMessage m) {
-        submitted = true;
-        System.out.println("failure to query result: authority refused");
-        tunnel.destroy();
-        mesh.destroy();
-    }
-
-    public CertifyGroupCommand(Configuration cfg, String ballotFilename, String pubKeyString) {
-        this.cfg = cfg;
-        this.ballotFilename = ballotFilename;
-        this.pubKeyString = pubKeyString;
-    }
-
-    public void run() {
-        File bf = new File(ballotFilename);
-        if (!bf.exists()) {
-            System.err.println("ballot file does not exist");
-            return;
-        }
-        ballot = new Ballot(ballotFilename);
-
-        Random r = new Random();
-        mesh = new Mesh(cfg, this, this);
-        tunnel = mesh.createTunnel(null /* FIXME */, CertificateAuthorityDaemon.MESH_PORT, true, true, null);
-        CertificateRequestMessage m = new CertificateRequestMessage();
-        m.group = ballot.group;
-        m.publicKey = CryptoECC.PublicSignKey.fromString(pubKeyString);
-        tunnel.send(m);
-    }
-}
diff --git a/src/main/java/org/gnunet/voting/CertifyGroupTool.java b/src/main/java/org/gnunet/voting/CertifyGroupTool.java
new file mode 100644
index 0000000..0403c02
--- /dev/null
+++ b/src/main/java/org/gnunet/voting/CertifyGroupTool.java
@@ -0,0 +1,25 @@
+/*
+ This file is part of GNUnet.
+  (C) 2012, 2013 Christian Grothoff (and other contributing authors)
+
+  GNUnet is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published
+  by the Free Software Foundation; either version 3, or (at your
+  option) any later version.
+
+  GNUnet is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with GNUnet; see the file COPYING.  If not, write to the
+  Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+  Boston, MA 02111-1307, USA.
+ */
+
+package org.gnunet.voting;
+
+
+public class CertifyGroupTool {
+}
diff --git a/src/main/java/org/gnunet/voting/SubmitCommand.java b/src/main/java/org/gnunet/voting/SubmitCommand.java
index 43e10c9..b8e018a 100644
--- a/src/main/java/org/gnunet/voting/SubmitCommand.java
+++ b/src/main/java/org/gnunet/voting/SubmitCommand.java
@@ -28,8 +28,8 @@ import org.gnunet.mesh.MeshRunabout;
 import org.gnunet.mesh.TunnelEndHandler;
 import org.gnunet.util.AbsoluteTime;
 import org.gnunet.util.Configuration;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.PeerIdentity;
+import org.gnunet.util.crypto.EddsaSignature;
 import org.gnunet.voting.messages.SubmitFailureMessage;
 import org.gnunet.voting.messages.SubmitMessage;
 import org.gnunet.voting.messages.SubmitSuccessMessage;
@@ -60,7 +60,7 @@ public class SubmitCommand extends MeshRunabout implements TunnelEndHandler {
     public void visit(SubmitSuccessMessage m) {
         submitted = true;
         System.out.println("vote successfully submitted");
-        ballot.addVoucher(currentAuthority, m.voucherSig);
+        ballot.addConfirmation(currentAuthority, m.confirmationSig);
         try {
             Files.write(ballot.serialize(), new File(ballotFilename), Charsets.UTF_8);
         } catch (IOException e) {
@@ -108,7 +108,7 @@ public class SubmitCommand extends MeshRunabout implements TunnelEndHandler {
         m.voterPub = ballot.voterPub;
         // FIXME: implement certs
         m.groupCertExpiration = AbsoluteTime.FOREVER.asMessage();
-        m.groupCert = CryptoECC.Signature.randomSignature();
+        m.groupCert = EddsaSignature.randomGarbage();
         m.ballotGuid = ballot.getBallotGuid();
         m.choiceId = ballot.choiceId;
         tunnel.send(m);
diff --git a/src/main/java/org/gnunet/voting/TallyAuthorityDaemon.java b/src/main/java/org/gnunet/voting/TallyAuthorityDaemon.java
index aa27f9c..ace3f38 100644
--- a/src/main/java/org/gnunet/voting/TallyAuthorityDaemon.java
+++ b/src/main/java/org/gnunet/voting/TallyAuthorityDaemon.java
@@ -25,6 +25,8 @@ import org.gnunet.mesh.Mesh;
 import org.gnunet.mesh.MeshRunabout;
 import org.gnunet.testbed.CompressedConfig;
 import org.gnunet.util.*;
+import org.gnunet.util.crypto.EcdsaPublicKey;
+import org.gnunet.util.crypto.EddsaSignature;
 import org.gnunet.voting.messages.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -58,7 +60,7 @@ public class TallyAuthorityDaemon extends Program {
         /**
          * Set of voters that have submitted their ballot.
          */
-        Set<CryptoECC.PublicSignKey> voters = new HashSet<CryptoECC.PublicSignKey>();
+        Set<EcdsaPublicKey> voters = new HashSet<EcdsaPublicKey>();
 
         /**
          * Maping from choice to number of votes for that choice.
@@ -98,7 +100,7 @@ public class TallyAuthorityDaemon extends Program {
                 electionState.voters.add(m.voterPub);
                 electionState.tally[m.choiceId] += 1;
                 SubmitSuccessMessage sm = new SubmitSuccessMessage();
-                sm.voucherSig = CryptoECC.Signature.randomSignature();
+                sm.confirmationSig = EddsaSignature.randomGarbage();
                 getSender().send(sm);
             }
 
@@ -130,7 +132,7 @@ public class TallyAuthorityDaemon extends Program {
                 electionState.ballot = b;
                 elections.put(guid, electionState);
                 BallotRegisterSuccessMessage rm = new BallotRegisterSuccessMessage();
-                rm.registrationSignature = CryptoECC.Signature.randomSignature();
+                rm.registrationSignature = EddsaSignature.randomGarbage();
                 getSender().send(rm);
             }
 
diff --git a/src/main/java/org/gnunet/voting/messages/BallotRegisterFailureMessage.java b/src/main/java/org/gnunet/voting/messages/BallotRegisterFailureMessage.java
index ecce92d..8986970 100644
--- a/src/main/java/org/gnunet/voting/messages/BallotRegisterFailureMessage.java
+++ b/src/main/java/org/gnunet/voting/messages/BallotRegisterFailureMessage.java
@@ -20,10 +20,8 @@
 
 package org.gnunet.voting.messages;
 
-import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.construct.ZeroTerminatedString;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
 
 
diff --git a/src/main/java/org/gnunet/voting/messages/BallotRegisterSuccessMessage.java b/src/main/java/org/gnunet/voting/messages/BallotRegisterSuccessMessage.java
index 8ce007b..040c9b3 100644
--- a/src/main/java/org/gnunet/voting/messages/BallotRegisterSuccessMessage.java
+++ b/src/main/java/org/gnunet/voting/messages/BallotRegisterSuccessMessage.java
@@ -2,8 +2,8 @@ package org.gnunet.voting.messages;
 
 import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UnionCase;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
+import org.gnunet.util.crypto.EddsaSignature;
 
 
 /**
@@ -12,5 +12,5 @@ import org.gnunet.util.GnunetMessage;
 @UnionCase(42012)
 public class BallotRegisterSuccessMessage implements GnunetMessage.Body {
     @NestedMessage
-    public CryptoECC.Signature registrationSignature;
+    public EddsaSignature registrationSignature;
 }
diff --git a/src/main/java/org/gnunet/voting/messages/CertificateGrantMessage.java b/src/main/java/org/gnunet/voting/messages/CertificateGrantMessage.java
deleted file mode 100644
index f209b7a..0000000
--- a/src/main/java/org/gnunet/voting/messages/CertificateGrantMessage.java
+++ /dev/null
@@ -1,19 +0,0 @@
-package org.gnunet.voting.messages;
-
-
-import org.gnunet.construct.NestedMessage;
-import org.gnunet.construct.UInt32;
-import org.gnunet.construct.UInt64;
-import org.gnunet.construct.UnionCase;
-import org.gnunet.util.AbsoluteTime;
-import org.gnunet.util.AbsoluteTimeMessage;
-import org.gnunet.util.CryptoECC;
-import org.gnunet.util.GnunetMessage;
-
-@UnionCase(42004)
-public class CertificateGrantMessage implements GnunetMessage.Body {
-    @NestedMessage
-    public CryptoECC.Signature groupCertificate;
-    @NestedMessage
-    public AbsoluteTimeMessage expiration;
-}
diff --git a/src/main/java/org/gnunet/voting/messages/CertificateRequestMessage.java b/src/main/java/org/gnunet/voting/messages/CertificateRequestMessage.java
deleted file mode 100644
index 1b4514e..0000000
--- a/src/main/java/org/gnunet/voting/messages/CertificateRequestMessage.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package org.gnunet.voting.messages;
-
-import org.gnunet.construct.NestedMessage;
-import org.gnunet.construct.UnionCase;
-import org.gnunet.util.CryptoECC;
-import org.gnunet.util.GnunetMessage;
-
-/**
- * Request a certificate that allows a voter to submit a ballot.
- * Sent by the voter to the certificate authority.
- */
-@UnionCase(42003)
-public class CertificateRequestMessage implements GnunetMessage.Body {
-    /**
-     * Public Key of the voter that requests group certification.
-     */
-    @NestedMessage
-    public CryptoECC.PublicSignKey publicKey;
-    /**
-     * Group that the voter wants to be certified for.
-     */
-    public String group;
-}
diff --git a/src/main/java/org/gnunet/voting/messages/SubmitMessage.java b/src/main/java/org/gnunet/voting/messages/SubmitMessage.java
index 1b71d3e..a47abfa 100644
--- a/src/main/java/org/gnunet/voting/messages/SubmitMessage.java
+++ b/src/main/java/org/gnunet/voting/messages/SubmitMessage.java
@@ -4,6 +4,8 @@ import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UInt32;
 import org.gnunet.construct.UnionCase;
 import org.gnunet.util.*;
+import org.gnunet.util.crypto.EcdsaPublicKey;
+import org.gnunet.util.crypto.EddsaSignature;
 
 /**
  * Message send by the voter to the election authority to submit a vote.
@@ -19,12 +21,12 @@ public class SubmitMessage implements GnunetMessage.Body {
      * Public key of the voter.
      */
     @NestedMessage
-    public CryptoECC.PublicSignKey voterPub;
+    public EcdsaPublicKey voterPub;
     /**
      * Group certificate of the voter.
      */
     @NestedMessage
-    public CryptoECC.Signature groupCert;
+    public EddsaSignature groupCert;
     /**
      * Expiration time of the group certificate, checked by the authority.
      */
diff --git a/src/main/java/org/gnunet/voting/messages/SubmitSuccessMessage.java b/src/main/java/org/gnunet/voting/messages/SubmitSuccessMessage.java
index 0c0e9e1..9e28b96 100644
--- a/src/main/java/org/gnunet/voting/messages/SubmitSuccessMessage.java
+++ b/src/main/java/org/gnunet/voting/messages/SubmitSuccessMessage.java
@@ -3,11 +3,11 @@ package org.gnunet.voting.messages;
 
 import org.gnunet.construct.NestedMessage;
 import org.gnunet.construct.UnionCase;
-import org.gnunet.util.CryptoECC;
 import org.gnunet.util.GnunetMessage;
+import org.gnunet.util.crypto.EddsaSignature;
 
 @UnionCase(42008)
 public class SubmitSuccessMessage implements GnunetMessage.Body {
     @NestedMessage
-    public CryptoECC.Signature voucherSig;
+    public EddsaSignature confirmationSig;
 }