IDENTITY

This commit is a major rework of the unclean GNUNET_IDENTITY_*Key
structures and its use in serialized objects (e.g. RPC messages).
The structures are now no longer to be used directly but instead through
their serialization helper functions whenever needed.

6 files changed, 389 insertions, 117 deletions

diff --git a/src/namestore/Makefile.am b/src/namestore/Makefile.am
index 2a1558e09..fb2a670bc 100644
--- a/src/namestore/Makefile.am
+++ b/src/namestore/Makefile.am
@@ -179,7 +179,6 @@ gnunet_namestore_fcfsd_CFLAGS = $(MHD_CFLAGS) $(AM_CFLAGS)
 
 gnunet_service_namestore_SOURCES = \
  gnunet-service-namestore.c
-
 gnunet_service_namestore_LDADD = \
   $(top_builddir)/src/namecache/libgnunetnamecache.la \
   $(top_builddir)/src/gnsrecord/libgnunetgnsrecord.la \
diff --git a/src/namestore/gnunet-namestore.c b/src/namestore/gnunet-namestore.c
index 843158c68..6444d446d 100644
--- a/src/namestore/gnunet-namestore.c
+++ b/src/namestore/gnunet-namestore.c
@@ -129,11 +129,6 @@ static struct GNUNET_IDENTITY_EgoLookup *el;
 static struct GNUNET_IDENTITY_Handle *idh;
 
 /**
- * Obtain default ego
- */
-struct GNUNET_IDENTITY_Operation *get_default;
-
-/**
  * Name of the ego controlling the zone.
  */
 static char *ego_name;
@@ -342,10 +337,10 @@ do_shutdown (void *cls)
   struct MarkedRecord *mrec;
   struct MarkedRecord *mrec_tmp;
   (void) cls;
-  if (NULL != get_default)
+  if (NULL != ego_name)
   {
-    GNUNET_IDENTITY_cancel (get_default);
-    get_default = NULL;
+    GNUNET_free (ego_name);
+    ego_name = NULL;
   }
   if (NULL != purge_task)
   {
@@ -1530,7 +1525,7 @@ run_with_zone_pkey (const struct GNUNET_CONFIGURATION_Handle *cfg)
     }
     memset (&rd, 0, sizeof(rd));
     rd.data = &pkey;
-    rd.data_size = GNUNET_IDENTITY_key_get_length (&pkey);
+    rd.data_size = GNUNET_IDENTITY_public_key_get_length (&pkey);
     rd.record_type = ntohl (pkey.type);
     rd.expiration_time = etime;
     if (GNUNET_YES == etime_is_rel)
@@ -1589,8 +1584,6 @@ identity_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     return;
   }
   zone_pkey = *GNUNET_IDENTITY_ego_get_private_key (ego);
-  GNUNET_free (ego_name);
-  ego_name = NULL;
   run_with_zone_pkey (cfg);
 }
 
diff --git a/src/namestore/gnunet-service-namestore.c b/src/namestore/gnunet-service-namestore.c
index 92c81c4eb..f0739cbeb 100644
--- a/src/namestore/gnunet-service-namestore.c
+++ b/src/namestore/gnunet-service-namestore.c
@@ -711,6 +711,7 @@ send_lookup_response_with_filter (struct NamestoreClient *nc,
   unsigned int res_count;
   unsigned int rd_nf_count;
   size_t name_len;
+  size_t key_len;
   ssize_t rd_ser_len;
   char *name_tmp;
   char *rd_ser;
@@ -778,16 +779,20 @@ send_lookup_response_with_filter (struct NamestoreClient *nc,
     GNUNET_SERVICE_client_drop (nc->client);
     return 0;
   }
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone_key);
   env = GNUNET_MQ_msg_extra (zir_msg,
-                             name_len + rd_ser_len,
+                             name_len + rd_ser_len + key_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_RESULT);
   zir_msg->gns_header.r_id = htonl (request_id);
   zir_msg->name_len = htons (name_len);
   zir_msg->rd_count = htons (res_count);
   zir_msg->rd_len = htons ((uint16_t) rd_ser_len);
-  zir_msg->private_key = *zone_key;
+  zir_msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone_key,
+                                               &zir_msg[1],
+                                               key_len);
   zir_msg->expire = GNUNET_TIME_absolute_hton (block_exp);
-  name_tmp = (char *) &zir_msg[1];
+  name_tmp = (char *) &zir_msg[1] + key_len;
   GNUNET_memcpy (name_tmp, name, name_len);
   rd_ser = &name_tmp[name_len];
   GNUNET_assert (
@@ -1309,16 +1314,17 @@ check_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
 {
   uint32_t name_len;
   size_t src_size;
+  size_t key_len;
 
   (void) cls;
   name_len = ntohl (ll_msg->label_len);
+  key_len = ntohl (ll_msg->key_len);
   src_size = ntohs (ll_msg->gns_header.header.size);
-  if (name_len != src_size - sizeof(struct LabelLookupMessage))
+  if (name_len + key_len != src_size - sizeof(struct LabelLookupMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  GNUNET_MQ_check_zero_termination (ll_msg);
   return GNUNET_OK;
 }
 
@@ -1332,6 +1338,7 @@ check_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
 static void
 handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct GNUNET_MQ_Envelope *env;
   struct LabelLookupResponseMessage *llr_msg;
@@ -1341,8 +1348,23 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
   char *conv_name;
   uint32_t name_len;
   int res;
-
-  name_tmp = (const char *) &ll_msg[1];
+  size_t key_len;
+  size_t kb_read;
+
+  key_len = ntohl (ll_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ll_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error reading private key\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
+  name_tmp = (const char *) &ll_msg[1] + key_len;
   GNUNET_SERVICE_client_continue (nc->client);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received NAMESTORE_RECORD_LOOKUP message for name `%s'\n",
@@ -1366,37 +1388,38 @@ handle_record_lookup (void *cls, const struct LabelLookupMessage *ll_msg)
   rlc.res_rd_count = 0;
   rlc.res_rd = NULL;
   rlc.rd_ser_len = 0;
-  rlc.nick = get_nick_record (&ll_msg->zone);
+  rlc.nick = get_nick_record (&zone);
   if (GNUNET_YES != ntohl (ll_msg->is_edit_request))
     res = nc->GSN_database->lookup_records (nc->GSN_database->cls,
-                                            &ll_msg->zone,
+                                            &zone,
                                             conv_name,
                                             &lookup_it,
                                             &rlc);
   else
     res = nc->GSN_database->edit_records (nc->GSN_database->cls,
-                                          &ll_msg->zone,
+                                          &zone,
                                           conv_name,
                                           &lookup_it,
                                           &rlc);
 
   env =
     GNUNET_MQ_msg_extra (llr_msg,
-                         name_len + rlc.rd_ser_len,
+                         key_len + name_len + rlc.rd_ser_len,
                          GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP_RESPONSE);
   llr_msg->gns_header.r_id = ll_msg->gns_header.r_id;
-  llr_msg->private_key = ll_msg->zone;
+  GNUNET_memcpy (&llr_msg[1], &ll_msg[1], key_len);
+  llr_msg->key_len = ll_msg->key_len;
   llr_msg->name_len = htons (name_len);
   llr_msg->rd_count = htons (rlc.res_rd_count);
   llr_msg->rd_len = htons (rlc.rd_ser_len);
-  res_name = (char *) &llr_msg[1];
+  res_name = ((char *) &llr_msg[1]) + key_len;
   if (GNUNET_YES == rlc.found)
     llr_msg->found = htons (GNUNET_YES);
   else if (GNUNET_SYSERR == res)
     llr_msg->found = htons (GNUNET_SYSERR);
   else
     llr_msg->found = htons (GNUNET_NO);
-  GNUNET_memcpy (&llr_msg[1], conv_name, name_len);
+  GNUNET_memcpy (res_name, conv_name, name_len);
   GNUNET_memcpy (&res_name[name_len], rlc.res_rd, rlc.rd_ser_len);
   GNUNET_MQ_send (nc->mq, env);
   GNUNET_free (rlc.res_rd);
@@ -1418,11 +1441,14 @@ check_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
   size_t msg_size;
   size_t min_size_exp;
   size_t rd_set_count;
+  size_t key_len;
 
   (void) cls;
   msg_size = ntohs (rp_msg->gns_header.header.size);
   rd_set_count = ntohs (rp_msg->rd_set_count);
-  min_size_exp = sizeof(struct RecordStoreMessage) + sizeof (struct RecordSet)
+  key_len = ntohl (rp_msg->key_len);
+
+  min_size_exp = sizeof(*rp_msg) + key_len + sizeof (struct RecordSet)
                  * rd_set_count;
   if (msg_size < min_size_exp)
   {
@@ -1701,24 +1727,40 @@ store_record_set (struct NamestoreClient *nc,
 static void
 handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   uint32_t rid;
   uint16_t rd_set_count;
   const char *buf;
   ssize_t read;
+  size_t key_len;
+  size_t kb_read;
   struct StoreActivity *sa;
   struct RecordSet *rs;
   enum GNUNET_ErrorCode res;
 
+  key_len = ntohl (rp_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&rp_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Error reading private key\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    return;
+  }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received NAMESTORE_RECORD_STORE message\n");
   rid = ntohl (rp_msg->gns_header.r_id);
   rd_set_count = ntohs (rp_msg->rd_set_count);
-  buf = (const char *) &rp_msg[1];
+  buf = (const char *) &rp_msg[1] + key_len;
   for (int i = 0; i < rd_set_count; i++)
   {
     rs = (struct RecordSet *) buf;
-    res = store_record_set (nc, &rp_msg->private_key,
+    res = store_record_set (nc, &zone,
                             rs, &read);
     if (GNUNET_EC_NONE != res)
     {
@@ -1735,11 +1777,11 @@ handle_record_store (void *cls, const struct RecordStoreMessage *rp_msg)
   sa->nc = nc;
   sa->rs = (struct RecordSet *) &sa[1];
   sa->rd_set_count = rd_set_count;
-  GNUNET_memcpy (&sa[1], (char *) &rp_msg[1],
+  GNUNET_memcpy (&sa[1], (char *) &rp_msg[1] + key_len,
                  ntohs (rp_msg->gns_header.header.size) - sizeof (*rp_msg));
   sa->rid = rid;
   sa->rd_set_pos = 0;
-  sa->private_key = rp_msg->private_key;
+  sa->private_key = zone;
   sa->zm_pos = monitor_head;
   sa->uncommited = nc->in_transaction;
   continue_store_activity (sa, GNUNET_YES);
@@ -1913,6 +1955,7 @@ handle_zone_to_name_it (void *cls,
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameResponseMessage *ztnr_msg;
   size_t name_len;
+  size_t key_len;
   ssize_t rd_ser_len;
   size_t msg_size;
   char *name_tmp;
@@ -1931,7 +1974,9 @@ handle_zone_to_name_it (void *cls,
     ztn_ctx->ec = htonl (GNUNET_EC_NAMESTORE_UNKNOWN);
     return;
   }
-  msg_size = sizeof(struct ZoneToNameResponseMessage) + name_len + rd_ser_len;
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone_key);
+  msg_size = sizeof(struct ZoneToNameResponseMessage)
+             + name_len + rd_ser_len + key_len;
   if (msg_size >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
@@ -1940,7 +1985,7 @@ handle_zone_to_name_it (void *cls,
   }
   env =
     GNUNET_MQ_msg_extra (ztnr_msg,
-                         name_len + rd_ser_len,
+                         key_len + name_len + rd_ser_len,
                          GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME_RESPONSE);
   ztnr_msg->gns_header.header.size = htons (msg_size);
   ztnr_msg->gns_header.r_id = htonl (ztn_ctx->rid);
@@ -1948,8 +1993,11 @@ handle_zone_to_name_it (void *cls,
   ztnr_msg->rd_len = htons (rd_ser_len);
   ztnr_msg->rd_count = htons (rd_count);
   ztnr_msg->name_len = htons (name_len);
-  ztnr_msg->zone = *zone_key;
-  name_tmp = (char *) &ztnr_msg[1];
+  ztnr_msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone_key,
+                                               &ztnr_msg[1],
+                                               key_len);
+  name_tmp = (char *) &ztnr_msg[1] + key_len;
   GNUNET_memcpy (name_tmp, name, name_len);
   rd_tmp = &name_tmp[name_len];
   GNUNET_assert (
@@ -1959,6 +2007,13 @@ handle_zone_to_name_it (void *cls,
   GNUNET_MQ_send (ztn_ctx->nc->mq, env);
 }
 
+static enum GNUNET_GenericReturnValue
+check_zone_to_name (void *cls,
+                    const struct ZoneToNameMessage *zis_msg)
+{
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME message
@@ -1969,18 +2024,52 @@ handle_zone_to_name_it (void *cls,
 static void
 handle_zone_to_name (void *cls, const struct ZoneToNameMessage *ztn_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
+  struct GNUNET_IDENTITY_PublicKey value_zone;
   struct NamestoreClient *nc = cls;
   struct ZoneToNameCtx ztn_ctx;
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameResponseMessage *ztnr_msg;
+  size_t key_len;
+  size_t pkey_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ZONE_TO_NAME message\n");
   ztn_ctx.rid = ntohl (ztn_msg->gns_header.r_id);
   ztn_ctx.nc = nc;
   ztn_ctx.ec = GNUNET_EC_NAMESTORE_ZONE_NOT_FOUND;
+  key_len = ntohl (ztn_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ztn_msg[1],
+                                                     key_len,
+                                                     &zone,
+                                                     &kb_read)) ||
+      (kb_read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Error parsing private key.\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    GNUNET_break (0);
+    return;
+  }
+  pkey_len = ntohl (ztn_msg->pkey_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_public_key_from_buffer ((char*) &ztn_msg[1]
+                                                    + key_len,
+                                                    pkey_len,
+                                                    &value_zone,
+                                                    &kb_read)) ||
+      (kb_read != pkey_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Error parsing public key.\n");
+    GNUNET_SERVICE_client_drop (nc->client);
+    GNUNET_break (0);
+    return;
+  }
   if (GNUNET_SYSERR == nc->GSN_database->zone_to_name (nc->GSN_database->cls,
-                                                       &ztn_msg->zone,
-                                                       &ztn_msg->value_zone,
+                                                       &zone,
+                                                       &value_zone,
                                                        &handle_zone_to_name_it,
                                                        &ztn_ctx))
   {
@@ -2133,6 +2222,24 @@ run_zone_iteration_round (struct ZoneIteration *zi, uint64_t limit)
     zone_iteration_done_client_continue (zi);
 }
 
+static enum GNUNET_GenericReturnValue
+check_iteration_start (void *cls,
+                       const struct ZoneIterationStartMessage *zis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (zis_msg->gns_header.header.size);
+  key_len = ntohs (zis_msg->key_len);
+
+  if (size < key_len + sizeof(*zis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START message
@@ -2144,18 +2251,35 @@ static void
 handle_iteration_start (void *cls,
                         const struct ZoneIterationStartMessage *zis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct ZoneIteration *zi;
+  size_t key_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_ITERATION_START message\n");
+  key_len = ntohl (zis_msg->key_len);
   zi = GNUNET_new (struct ZoneIteration);
+  if (0 < key_len)
+  {
+    if ((GNUNET_SYSERR ==
+         GNUNET_IDENTITY_read_private_key_from_buffer (&zis_msg[1],
+                                                       key_len,
+                                                       &zone,
+                                                       &kb_read)) ||
+        (kb_read != key_len))
+    {
+      GNUNET_SERVICE_client_drop (nc->client);
+      GNUNET_free (zi);
+      return;
+    }
+    zi->zone = zone;
+  }
   zi->request_id = ntohl (zis_msg->gns_header.r_id);
   zi->filter = ntohs (zis_msg->filter);
   zi->offset = 0;
   zi->nc = nc;
-  zi->zone = zis_msg->zone;
-
   GNUNET_CONTAINER_DLL_insert (nc->op_head, nc->op_tail, zi);
   run_zone_iteration_round (zi, 1);
 }
@@ -2349,6 +2473,24 @@ monitor_iterate_cb (void *cls,
   }
 }
 
+static enum GNUNET_GenericReturnValue
+check_monitor_start (void *cls,
+                     const struct ZoneMonitorStartMessage *zis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (zis_msg->header.size);
+  key_len = ntohs (zis_msg->key_len);
+
+  if (size < key_len + sizeof(*zis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Handles a #GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START message
@@ -2360,14 +2502,33 @@ static void
 handle_monitor_start (void *cls, const struct
                       ZoneMonitorStartMessage *zis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey zone;
   struct NamestoreClient *nc = cls;
   struct ZoneMonitor *zm;
+  size_t key_len;
+  size_t kb_read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ZONE_MONITOR_START message\n");
   zm = GNUNET_new (struct ZoneMonitor);
   zm->nc = nc;
-  zm->zone = zis_msg->zone;
+  key_len = ntohl (zis_msg->key_len);
+  if (0 < key_len)
+  {
+    if ((GNUNET_SYSERR ==
+         GNUNET_IDENTITY_read_private_key_from_buffer (&zis_msg[1],
+                                                       key_len,
+                                                       &zone,
+                                                       &kb_read)) ||
+        (kb_read != key_len))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Error reading private key\n");
+      GNUNET_SERVICE_client_drop (nc->client);
+      return;
+    }
+    zm->zone = zone;
+  }
   zm->limit = 1;
   zm->filter = ntohs (zis_msg->filter);
   zm->in_first_iteration = (GNUNET_YES == ntohl (zis_msg->iterate_first));
@@ -2557,14 +2718,14 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP,
                          struct LabelLookupMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (zone_to_name,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME,
-                           struct ZoneToNameMessage,
-                           NULL),
-  GNUNET_MQ_hd_fixed_size (iteration_start,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START,
-                           struct ZoneIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (zone_to_name,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME,
+                         struct ZoneToNameMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (iteration_start,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START,
+                         struct ZoneIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (iteration_next,
                            GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_NEXT,
                            struct ZoneIterationNextMessage,
@@ -2573,10 +2734,10 @@ GNUNET_SERVICE_MAIN (
                            GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_STOP,
                            struct ZoneIterationStopMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (monitor_start,
-                           GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START,
-                           struct ZoneMonitorStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (monitor_start,
+                         GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START,
+                         struct ZoneMonitorStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (monitor_next,
                            GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_NEXT,
                            struct ZoneMonitorNextMessage,
diff --git a/src/namestore/namestore.h b/src/namestore/namestore.h
index 37c1576bc..0b50ac1ab 100644
--- a/src/namestore/namestore.h
+++ b/src/namestore/namestore.h
@@ -91,16 +91,17 @@ struct RecordStoreMessage
   struct GNUNET_NAMESTORE_Header gns_header;
 
   /**
-   * The private key of the authority.
+   * Number of record sets
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint16_t rd_set_count;
 
   /**
-   * Number of record sets
+   * Length of the zone key
    */
-  uint16_t rd_set_count;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
+   * Followed by the private zone key
    * Followed by rd_set_count RecordSets
    */
 };
@@ -150,11 +151,12 @@ struct LabelLookupMessage
   uint16_t filter;
 
   /**
-   * The private key of the zone to look up in
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    */
 };
@@ -192,11 +194,12 @@ struct LabelLookupResponseMessage
   int16_t found GNUNET_PACKED;
 
   /**
-   * The private key of the authority.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -214,14 +217,20 @@ struct ZoneToNameMessage
   struct GNUNET_NAMESTORE_Header gns_header;
 
   /**
-   * The private key of the zone to look up in
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Length of the public value zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t pkey_len GNUNET_PACKED;
 
   /**
-   * The public key of the target zone
+   * Followed by
+   * - the private zone key to look up in
+   * - the public key of the target zone
    */
-  struct GNUNET_IDENTITY_PublicKey value_zone;
 };
 
 
@@ -259,11 +268,12 @@ struct ZoneToNameResponseMessage
   int32_t ec GNUNET_PACKED;
 
   /**
-   * The private key of the zone that contained the name.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private zone key
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -307,11 +317,12 @@ struct RecordResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The private key of the authority.
+   * Length of the zone key
    */
-  struct GNUNET_IDENTITY_PrivateKey private_key;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by:
+   * the private key of the authority
    * name with length name_len
    * serialized record data with rd_count records
    */
@@ -386,9 +397,13 @@ struct ZoneMonitorStartMessage
   uint16_t reserved;
 
   /**
-   * Zone key.
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private zone key.
    */
-  struct GNUNET_IDENTITY_PrivateKey zone;
 };
 
 
@@ -427,11 +442,6 @@ struct ZoneIterationStartMessage
   struct GNUNET_NAMESTORE_Header gns_header;
 
   /**
-   * Zone key.  All zeros for "all zones".
-   */
-  struct GNUNET_IDENTITY_PrivateKey zone;
-
-  /**
    * Record set filter control flags.
    * See GNUNET_NAMESTORE_Filter enum.
    */
@@ -441,6 +451,15 @@ struct ZoneIterationStartMessage
    * Reserved for alignment
    */
   uint16_t reserved;
+
+  /**
+   * Length of the zone key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private zone key (optional)
+   */
 };
 
 
diff --git a/src/namestore/namestore_api.c b/src/namestore/namestore_api.c
index 41c1fcc73..e020b9e42 100644
--- a/src/namestore/namestore_api.c
+++ b/src/namestore/namestore_api.c
@@ -401,18 +401,20 @@ check_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
   size_t msg_len;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
 
   (void) cls;
   rd_len = ntohs (msg->rd_len);
   msg_len = ntohs (msg->gns_header.header.size);
   name_len = ntohs (msg->name_len);
-  exp_msg_len = sizeof(*msg) + name_len + rd_len;
+  key_len = ntohl (msg->key_len);
+  exp_msg_len = sizeof(*msg) + name_len + rd_len + key_len;
   if (msg_len != exp_msg_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
   if ((name_len > 0) && ('\0' != name[name_len - 1]))
   {
     GNUNET_break (0);
@@ -443,10 +445,13 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
 {
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   const char *name;
   const char *rd_tmp;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned int rd_count;
   int16_t found = (int16_t) ntohs (msg->found);
 
@@ -458,12 +463,19 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
   rd_len = ntohs (msg->rd_len);
   rd_count = ntohs (msg->rd_count);
   name_len = ntohs (msg->name_len);
-  name = (const char *) &msg[1];
+  key_len = ntohl (msg->key_len);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
+  name = (const char *) &msg[1] + key_len;
   if (GNUNET_NO == found)
   {
     /* label was not in namestore */
     if (NULL != qe->proc)
-      qe->proc (qe->proc_cls, &msg->private_key, name, 0, NULL);
+      qe->proc (qe->proc_cls, &private_key, name, 0, NULL);
     free_qe (qe);
     return;
   }
@@ -486,7 +498,7 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
       name = NULL;
     if (NULL != qe->proc)
       qe->proc (qe->proc_cls,
-                &msg->private_key,
+                &private_key,
                 name,
                 rd_count,
                 (rd_count > 0) ? rd : NULL);
@@ -506,33 +518,35 @@ handle_lookup_result (void *cls, const struct LabelLookupResponseMessage *msg)
 static int
 check_record_result (void *cls, const struct RecordResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey priv_dummy;
   const char *name;
   size_t msg_len;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
 
   (void) cls;
   rd_len = ntohs (msg->rd_len);
   msg_len = ntohs (msg->gns_header.header.size);
+  key_len = ntohl (msg->key_len);
   name_len = ntohs (msg->name_len);
   if (0 != ntohs (msg->reserved))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if (msg_len != sizeof(struct RecordResultMessage) + name_len + rd_len)
+  if (msg_len != sizeof(struct RecordResultMessage) + key_len + name_len
+      + rd_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
   if ((0 == name_len) || ('\0' != name[name_len - 1]))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  if (0 == GNUNET_memcmp (&msg->private_key, &priv_dummy))
+  if (0 == key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -554,16 +568,20 @@ handle_record_result (void *cls, const struct RecordResultMessage *msg)
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
   struct GNUNET_NAMESTORE_ZoneIterator *ze;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   const char *name;
   const char *rd_tmp;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned int rd_count;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Received RECORD_RESULT\n");
   rd_len = ntohs (msg->rd_len);
   rd_count = ntohs (msg->rd_count);
   name_len = ntohs (msg->name_len);
+  key_len = ntohl (msg->key_len);
   ze = find_zi (h, ntohl (msg->gns_header.r_id));
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
   if ((NULL == ze) && (NULL == qe))
@@ -574,7 +592,13 @@ handle_record_result (void *cls, const struct RecordResultMessage *msg)
     force_reconnect (h);
     return;
   }
-  name = (const char *) &msg[1];
+  name = (const char *) &msg[1] + key_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   rd_tmp = &name[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -588,7 +612,7 @@ handle_record_result (void *cls, const struct RecordResultMessage *msg)
     {
       if (NULL != qe->proc)
         qe->proc (qe->proc_cls,
-                  &msg->private_key,
+                  &private_key,
                   name,
                   rd_count,
                   (rd_count > 0) ? rd : NULL);
@@ -598,9 +622,9 @@ handle_record_result (void *cls, const struct RecordResultMessage *msg)
     if (NULL != ze)
     {
       if (NULL != ze->proc)
-        ze->proc (ze->proc_cls, &msg->private_key, name, rd_count, rd);
+        ze->proc (ze->proc_cls, &private_key, name, rd_count, rd);
       if (NULL != ze->proc2)
-        ze->proc2 (ze->proc_cls, &msg->private_key, name,
+        ze->proc2 (ze->proc_cls, &private_key, name,
                    rd_count, rd, GNUNET_TIME_absolute_ntoh (msg->expire));
       return;
     }
@@ -680,20 +704,23 @@ check_zone_to_name_response (void *cls,
 {
   size_t name_len;
   size_t rd_ser_len;
+  size_t key_len;
   const char *name_tmp;
 
   (void) cls;
   if (GNUNET_EC_NONE != ntohl (msg->ec))
     return GNUNET_OK;
+  key_len = ntohl (msg->key_len);
   name_len = ntohs (msg->name_len);
   rd_ser_len = ntohs (msg->rd_len);
   if (ntohs (msg->gns_header.header.size) !=
-      sizeof(struct ZoneToNameResponseMessage) + name_len + rd_ser_len)
+      sizeof(struct ZoneToNameResponseMessage) + key_len + name_len
+      + rd_ser_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name_tmp = (const char *) &msg[1];
+  name_tmp = (const char *) &msg[1] + key_len;
   if ((name_len > 0) && ('\0' != name_tmp[name_len - 1]))
   {
     GNUNET_break (0);
@@ -716,12 +743,15 @@ handle_zone_to_name_response (void *cls,
 {
   struct GNUNET_NAMESTORE_Handle *h = cls;
   struct GNUNET_NAMESTORE_QueueEntry *qe;
+  struct GNUNET_IDENTITY_PrivateKey zone;
   enum GNUNET_ErrorCode res;
   size_t name_len;
   size_t rd_ser_len;
   unsigned int rd_count;
   const char *name_tmp;
   const char *rd_tmp;
+  size_t key_len;
+  size_t kbytes_read;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Received ZONE_TO_NAME_RESPONSE\n");
   qe = find_qe (h, ntohl (msg->gns_header.r_id));
@@ -732,6 +762,13 @@ handle_zone_to_name_response (void *cls,
     return;
   }
   res = ntohl (msg->ec);
+  key_len = ntohl (msg->key_len);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&msg[1],
+                                                               key_len,
+                                                               &zone,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   switch (res)
   {
   break;
@@ -740,7 +777,7 @@ handle_zone_to_name_response (void *cls,
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Namestore has no result for zone to name mapping \n");
     if (NULL != qe->proc)
-      qe->proc (qe->proc_cls, &msg->zone, NULL, 0, NULL);
+      qe->proc (qe->proc_cls, &zone, NULL, 0, NULL);
     free_qe (qe);
     return;
 
@@ -750,7 +787,7 @@ handle_zone_to_name_response (void *cls,
     name_len = ntohs (msg->name_len);
     rd_count = ntohs (msg->rd_count);
     rd_ser_len = ntohs (msg->rd_len);
-    name_tmp = (const char *) &msg[1];
+    name_tmp = (const char *) &msg[1] + key_len;
     rd_tmp = &name_tmp[name_len];
     {
       struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -762,7 +799,7 @@ handle_zone_to_name_response (void *cls,
                                                            rd));
       /* normal end, call continuation with result */
       if (NULL != qe->proc)
-        qe->proc (qe->proc_cls, &msg->zone, name_tmp, rd_count, rd);
+        qe->proc (qe->proc_cls, &zone, name_tmp, rd_count, rd);
       /* return is important here: break would call continuation with error! */
       free_qe (qe);
       return;
@@ -1050,7 +1087,10 @@ GNUNET_NAMESTORE_records_store2 (
   ssize_t sret;
   int i;
   size_t rd_set_len = 0;
-  size_t max_len = UINT16_MAX - sizeof (struct RecordStoreMessage);
+  size_t key_len = 0;
+  size_t max_len;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
+  max_len = UINT16_MAX - key_len - sizeof (struct RecordStoreMessage);
 
   *rds_sent = 0;
   for (i = 0; i < rd_set_count; i++)
@@ -1093,17 +1133,19 @@ GNUNET_NAMESTORE_records_store2 (
   qe->cont_cls = cont_cls;
   qe->op_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
-
   /* setup msg */
   env = GNUNET_MQ_msg_extra (msg,
-                             rd_set_len,
+                             key_len + rd_set_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_STORE);
   GNUNET_assert (NULL != msg);
   GNUNET_assert (NULL != env);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   msg->rd_set_count = htons ((uint16_t) (*rds_sent));
-  msg->private_key = *pkey;
-  rd_set = (struct RecordSet*) &msg[1];
+  GNUNET_IDENTITY_write_private_key_to_buffer (pkey,
+                                               &msg[1],
+                                               key_len);
+  rd_set = (struct RecordSet*) (((char*) &msg[1]) + key_len);
   for (int i = 0; i < *rds_sent; i++)
   {
     label = record_info[i].a_label;
@@ -1162,6 +1204,7 @@ records_lookup (
   struct GNUNET_MQ_Envelope *env;
   struct LabelLookupMessage *msg;
   size_t label_len;
+  size_t key_len;
 
   if (1 == (label_len = strlen (label) + 1))
   {
@@ -1178,15 +1221,20 @@ records_lookup (
   qe->op_id = get_op_id (h);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
 
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   env = GNUNET_MQ_msg_extra (msg,
-                             label_len,
+                             label_len +  key_len,
                              GNUNET_MESSAGE_TYPE_NAMESTORE_RECORD_LOOKUP);
   msg->gns_header.r_id = htonl (qe->op_id);
-  msg->zone = *pkey;
+  GNUNET_IDENTITY_write_private_key_to_buffer (pkey,
+                                               &msg[1],
+                                               key_len);
+
+  msg->key_len = htonl (key_len);
   msg->is_edit_request = htonl (is_edit_request);
   msg->label_len = htonl (label_len);
   msg->filter = htons (filter);
-  GNUNET_memcpy (&msg[1], label, label_len);
+  GNUNET_memcpy (((char*) &msg[1]) + key_len, label, label_len);
   if (NULL == h->mq)
     qe->env = env;
   else
@@ -1257,6 +1305,8 @@ GNUNET_NAMESTORE_zone_to_name (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneToNameMessage *msg;
   uint32_t rid;
+  size_t key_len;
+  ssize_t pkey_len;
 
   rid = get_op_id (h);
   qe = GNUNET_new (struct GNUNET_NAMESTORE_QueueEntry);
@@ -1268,10 +1318,17 @@ GNUNET_NAMESTORE_zone_to_name (
   qe->op_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, qe);
 
-  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME);
+  key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  pkey_len = GNUNET_IDENTITY_public_key_get_length (value_zone);
+  env = GNUNET_MQ_msg_extra (msg, key_len + pkey_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_TO_NAME);
   msg->gns_header.r_id = htonl (rid);
-  msg->zone = *zone;
-  msg->value_zone = *value_zone;
+  msg->key_len = htonl (key_len);
+  msg->pkey_len = htonl (pkey_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
+  GNUNET_IDENTITY_write_public_key_to_buffer (value_zone,
+                                              (char*) &msg[1] + key_len,
+                                              pkey_len);
   if (NULL == h->mq)
     qe->env = env;
   else
@@ -1295,6 +1352,7 @@ GNUNET_NAMESTORE_zone_iteration_start (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len = 0;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Sending ZONE_ITERATION_START message\n");
   rid = get_op_id (h);
@@ -1308,12 +1366,18 @@ GNUNET_NAMESTORE_zone_iteration_start (
   it->proc_cls = proc_cls;
   it->op_id = rid;
   if (NULL != zone)
+  {
     it->zone = *zone;
+    key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  }
   GNUNET_CONTAINER_DLL_insert_tail (h->z_head, h->z_tail, it);
-  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   if (NULL != zone)
-    msg->zone = *zone;
+    GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1337,6 +1401,7 @@ GNUNET_NAMESTORE_zone_iteration_start2 (
   struct GNUNET_MQ_Envelope *env;
   struct ZoneIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len = 0;
 
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Sending ZONE_ITERATION_START message\n");
   rid = get_op_id (h);
@@ -1350,13 +1415,19 @@ GNUNET_NAMESTORE_zone_iteration_start2 (
   it->proc_cls = proc_cls;
   it->op_id = rid;
   if (NULL != zone)
+  {
     it->zone = *zone;
+    key_len = GNUNET_IDENTITY_private_key_get_length (zone);
+  }
   GNUNET_CONTAINER_DLL_insert_tail (h->z_head, h->z_tail, it);
-  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_ZONE_ITERATION_START);
   msg->gns_header.r_id = htonl (rid);
+  msg->key_len = htonl (key_len);
   msg->filter = htons ((uint16_t) filter);
   if (NULL != zone)
-    msg->zone = *zone;
+    GNUNET_IDENTITY_write_private_key_to_buffer (zone, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
diff --git a/src/namestore/namestore_api_monitor.c b/src/namestore/namestore_api_monitor.c
index 56ae8cb53..81ea41f7d 100644
--- a/src/namestore/namestore_api_monitor.c
+++ b/src/namestore/namestore_api_monitor.c
@@ -98,6 +98,11 @@ struct GNUNET_NAMESTORE_ZoneMonitor
    * Do we first iterate over all existing records?
    */
   int iterate_first;
+
+  /**
+   * Zone key length
+   */
+  uint32_t key_len;
 };
 
 
@@ -146,10 +151,12 @@ check_result (void *cls, const struct RecordResultMessage *lrm)
   unsigned rd_count;
   const char *name_tmp;
   const char *rd_ser_tmp;
+  size_t key_len;
 
+  (void) zm;
+  key_len = ntohl (lrm->key_len);
   (void) cls;
-  if ((0 != GNUNET_memcmp (&lrm->private_key, &zm->zone)) &&
-      (GNUNET_NO == GNUNET_is_zero (&zm->zone)))
+  if (0 == key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -163,7 +170,7 @@ check_result (void *cls, const struct RecordResultMessage *lrm)
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  exp_lrm_len = sizeof(struct RecordResultMessage) + name_len + rd_len;
+  exp_lrm_len = sizeof(struct RecordResultMessage) + name_len + rd_len + key_len;
   if (lrm_len != exp_lrm_len)
   {
     GNUNET_break (0);
@@ -174,7 +181,7 @@ check_result (void *cls, const struct RecordResultMessage *lrm)
     GNUNET_break (0);
     return GNUNET_SYSERR;
   }
-  name_tmp = (const char *) &lrm[1];
+  name_tmp = (const char *) &lrm[1] + key_len;
   if (name_tmp[name_len - 1] != '\0')
   {
     GNUNET_break (0);
@@ -206,16 +213,26 @@ static void
 handle_result (void *cls, const struct RecordResultMessage *lrm)
 {
   struct GNUNET_NAMESTORE_ZoneMonitor *zm = cls;
+  struct GNUNET_IDENTITY_PrivateKey private_key;
   size_t name_len;
   size_t rd_len;
+  size_t key_len;
+  size_t kbytes_read;
   unsigned rd_count;
   const char *name_tmp;
   const char *rd_ser_tmp;
 
+  key_len = ntohl (lrm->key_len);
   rd_len = ntohs (lrm->rd_len);
   rd_count = ntohs (lrm->rd_count);
   name_len = ntohs (lrm->name_len);
-  name_tmp = (const char *) &lrm[1];
+  name_tmp = (const char *) &lrm[1] + key_len;
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_IDENTITY_read_private_key_from_buffer (&lrm[1],
+                                                               key_len,
+                                                               &private_key,
+                                                               &kbytes_read));
+  GNUNET_assert (kbytes_read == key_len);
   rd_ser_tmp = (const char *) &name_tmp[name_len];
   {
     struct GNUNET_GNSRECORD_Data rd[rd_count];
@@ -224,10 +241,10 @@ handle_result (void *cls, const struct RecordResultMessage *lrm)
       GNUNET_OK ==
       GNUNET_GNSRECORD_records_deserialize (rd_len, rd_ser_tmp, rd_count, rd));
     if (NULL != zm->monitor2)
-      zm->monitor2 (zm->monitor_cls, &lrm->private_key, name_tmp,
+      zm->monitor2 (zm->monitor_cls, &private_key, name_tmp,
                     rd_count, rd, GNUNET_TIME_absolute_ntoh (lrm->expire));
     else
-      zm->monitor (zm->monitor_cls, &lrm->private_key, name_tmp, rd_count, rd);
+      zm->monitor (zm->monitor_cls, &private_key, name_tmp, rd_count, rd);
   }
 }
 
@@ -283,9 +300,15 @@ reconnect (struct GNUNET_NAMESTORE_ZoneMonitor *zm)
                                   zm);
   if (NULL == zm->mq)
     return;
-  env = GNUNET_MQ_msg (sm, GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START);
+  env = GNUNET_MQ_msg_extra (sm,
+                             zm->key_len,
+                             GNUNET_MESSAGE_TYPE_NAMESTORE_MONITOR_START);
   sm->iterate_first = htonl (zm->iterate_first);
-  sm->zone = zm->zone;
+  if (0 < zm->key_len)
+    GNUNET_IDENTITY_write_private_key_to_buffer (&zm->zone,
+                                               &sm[1],
+                                               zm->key_len);
+  sm->key_len = htonl (zm->key_len);
   sm->filter = htons (zm->filter);
   GNUNET_MQ_send (zm->mq, env);
 }
@@ -307,7 +330,10 @@ GNUNET_NAMESTORE_zone_monitor_start (
 
   zm = GNUNET_new (struct GNUNET_NAMESTORE_ZoneMonitor);
   if (NULL != zone)
+  {
+    zm->key_len = GNUNET_IDENTITY_private_key_get_length (zone);
     zm->zone = *zone;
+  }
   zm->iterate_first = iterate_first;
   zm->error_cb = error_cb;
   zm->error_cb_cls = error_cb_cls;
@@ -342,7 +368,10 @@ GNUNET_NAMESTORE_zone_monitor_start2 (
 
   zm = GNUNET_new (struct GNUNET_NAMESTORE_ZoneMonitor);
   if (NULL != zone)
+  {
+    zm->key_len = GNUNET_IDENTITY_private_key_get_length (zone);
     zm->zone = *zone;
+  }
   zm->iterate_first = iterate_first;
   zm->error_cb = error_cb;
   zm->error_cb_cls = error_cb_cls;