IDENTITY

This commit is a major rework of the unclean GNUNET_IDENTITY_*Key
structures and its use in serialized objects (e.g. RPC messages).
The structures are now no longer to be used directly but instead through
their serialization helper functions whenever needed.

10 files changed, 786 insertions, 275 deletions

diff --git a/src/reclaim/Makefile.am b/src/reclaim/Makefile.am
index d29b5857a..37af360c8 100644
--- a/src/reclaim/Makefile.am
+++ b/src/reclaim/Makefile.am
@@ -138,6 +138,7 @@ libgnunetreclaim_la_SOURCES = \
  reclaim_credential.h
 libgnunetreclaim_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(GN_LIBINTL) $(XLIB)
 libgnunetreclaim_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS)   \
diff --git a/src/reclaim/gnunet-service-reclaim.c b/src/reclaim/gnunet-service-reclaim.c
index 5c484e55d..ea97f8749 100644
--- a/src/reclaim/gnunet-service-reclaim.c
+++ b/src/reclaim/gnunet-service-reclaim.c
@@ -657,18 +657,27 @@ send_ticket_result (const struct IdpClient *client,
   struct TicketResultMessage *irm;
   struct GNUNET_MQ_Envelope *env;
   size_t pres_len = 0;
+  size_t tkt_len = 0;
+  ssize_t written;
+  char *buf;
 
   if (NULL != presentations)
   {
     pres_len =
       GNUNET_RECLAIM_presentation_list_serialize_get_size (presentations);
   }
+  if (NULL != ticket)
+    tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
   env = GNUNET_MQ_msg_extra (irm,
-                             pres_len,
+                             pres_len + tkt_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
+  buf = (char*) &irm[1];
   if (NULL != ticket)
   {
-    irm->ticket = *ticket;
+    irm->tkt_len = htonl (tkt_len);
+    written = GNUNET_RECLAIM_write_ticket_to_buffer (ticket, buf, tkt_len);
+    GNUNET_assert (0 <= written);
+    buf += written;
   }
   // TODO add success member
   irm->id = htonl (r_id);
@@ -676,7 +685,7 @@ send_ticket_result (const struct IdpClient *client,
   if (NULL != presentations)
   {
     GNUNET_RECLAIM_presentation_list_serialize (presentations,
-                                                (char*) &irm[1]);
+                                                buf);
   }
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending TICKET_RESULT message\n");
   GNUNET_MQ_send (client->mq, env);
@@ -732,11 +741,15 @@ check_issue_ticket_message (void *cls, const struct IssueTicketMessage *im)
 {
   uint16_t size;
   size_t attrs_len;
+  size_t key_len;
+  size_t pkey_len;
 
   size = ntohs (im->header.size);
   attrs_len = ntohs (im->attr_len);
-
-  if (attrs_len > size - sizeof(struct IssueTicketMessage))
+  key_len = ntohl (im->key_len);
+  pkey_len = ntohl (im->pkey_len);
+  if (size != attrs_len + key_len + pkey_len + sizeof(struct
+                                                      IssueTicketMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -758,12 +771,43 @@ handle_issue_ticket_message (void *cls, const struct IssueTicketMessage *im)
   struct IdpClient *idp = cls;
   struct GNUNET_RECLAIM_AttributeList *attrs;
   struct GNUNET_RECLAIM_AttributeListEntry *le;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_IDENTITY_PublicKey rp;
   size_t attrs_len;
+  size_t key_len;
+  size_t pkey_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ISSUE_TICKET message\n");
+  key_len = ntohl (im->key_len);
+  buf = (char *) &im[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  pkey_len = ntohl (im->pkey_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_public_key_from_buffer (buf, pkey_len,
+                                                    &rp, &read)) ||
+      (read != pkey_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read public key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   tio = GNUNET_new (struct TicketIssueOperation);
   attrs_len = ntohs (im->attr_len);
-  attrs = GNUNET_RECLAIM_attribute_list_deserialize ((char *) &im[1],
+  attrs = GNUNET_RECLAIM_attribute_list_deserialize (buf,
                                                      attrs_len);
   for (le = attrs->list_head; NULL != le; le = le->next)
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -772,9 +816,9 @@ handle_issue_ticket_message (void *cls, const struct IssueTicketMessage *im)
   tio->r_id = ntohl (im->id);
   tio->client = idp;
   GNUNET_CONTAINER_DLL_insert (idp->issue_op_head, idp->issue_op_tail, tio);
-  RECLAIM_TICKETS_issue (&im->identity,
+  RECLAIM_TICKETS_issue (&identity,
                          attrs,
-                         &im->rp,
+                         &rp,
                          &issue_ticket_result_cb,
                          tio);
   GNUNET_SERVICE_client_continue (idp->client);
@@ -846,15 +890,44 @@ handle_revoke_ticket_message (void *cls, const struct RevokeTicketMessage *rm)
 {
   struct TicketRevocationOperation *rop;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t key_len;
+  size_t tkt_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received REVOKE_TICKET message\n");
+  key_len = ntohl (rm->key_len);
+  buf = (char *) &rm[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  tkt_len = ntohl (rm->tkt_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_RECLAIM_read_ticket_from_buffer (buf, key_len,
+                                               &ticket, &read)) ||
+      (read != tkt_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read ticket\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   rop = GNUNET_new (struct TicketRevocationOperation);
   rop->r_id = ntohl (rm->id);
   rop->client = idp;
   GNUNET_CONTAINER_DLL_insert (idp->revoke_op_head, idp->revoke_op_tail, rop);
   rop->rh
-    = RECLAIM_TICKETS_revoke (&rm->ticket, &rm->identity, &revoke_result_cb,
-                              rop);
+    = RECLAIM_TICKETS_revoke (&ticket, &identity, &revoke_result_cb, rop);
   GNUNET_SERVICE_client_continue (idp->client);
 }
 
@@ -882,6 +955,8 @@ consume_result_cb (void *cls,
   char *data_tmp;
   size_t attrs_len = 0;
   size_t pres_len = 0;
+  size_t key_len;
+  ssize_t written;
 
   if (GNUNET_OK != success)
   {
@@ -890,17 +965,23 @@ consume_result_cb (void *cls,
   attrs_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
   pres_len = GNUNET_RECLAIM_presentation_list_serialize_get_size (
     presentations);
+  key_len = GNUNET_IDENTITY_public_key_get_length (identity);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending CONSUME_TICKET_RESULT message\n");
   env = GNUNET_MQ_msg_extra (crm,
-                             attrs_len + pres_len,
+                             attrs_len + pres_len + key_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET_RESULT);
   crm->id = htonl (cop->r_id);
   crm->attrs_len = htons (attrs_len);
   crm->presentations_len = htons (pres_len);
-  crm->identity = *identity;
+  crm->key_len = htonl (key_len);
   crm->result = htonl (success);
   data_tmp = (char *) &crm[1];
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (0 <= written);
+  data_tmp += written;
   GNUNET_RECLAIM_attribute_list_serialize (attrs, data_tmp);
   data_tmp += attrs_len;
   GNUNET_RECLAIM_presentation_list_serialize (presentations, data_tmp);
@@ -924,7 +1005,7 @@ check_consume_ticket_message (void *cls, const struct ConsumeTicketMessage *cm)
   uint16_t size;
 
   size = ntohs (cm->header.size);
-  if (size != sizeof(struct ConsumeTicketMessage))
+  if (size <= sizeof(struct ConsumeTicketMessage))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -944,13 +1025,43 @@ handle_consume_ticket_message (void *cls, const struct ConsumeTicketMessage *cm)
 {
   struct ConsumeTicketOperation *cop;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t key_len;
+  size_t tkt_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CONSUME_TICKET message\n");
+  key_len = ntohl (cm->key_len);
+  buf = (char *) &cm[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
+  tkt_len = ntohl (cm->tkt_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_RECLAIM_read_ticket_from_buffer (buf, tkt_len,
+                                               &ticket, &read)) ||
+      (read != tkt_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read ticket\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   cop = GNUNET_new (struct ConsumeTicketOperation);
   cop->r_id = ntohl (cm->id);
   cop->client = idp;
   cop->ch
-    = RECLAIM_TICKETS_consume (&cm->identity, &cm->ticket, &consume_result_cb,
+    = RECLAIM_TICKETS_consume (&identity, &ticket, &consume_result_cb,
                                cop);
   GNUNET_CONTAINER_DLL_insert (idp->consume_op_head, idp->consume_op_tail, cop);
   GNUNET_SERVICE_client_continue (idp->client);
@@ -1077,21 +1188,37 @@ handle_attribute_store_message (void *cls,
 {
   struct AttributeStoreHandle *ash;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ATTRIBUTE_STORE message\n");
 
   data_len = ntohs (sam->attr_len);
-
+  key_len = ntohl (sam->key_len);
+  buf = (char *) &sam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   ash = GNUNET_new (struct AttributeStoreHandle);
-  GNUNET_RECLAIM_attribute_deserialize ((char *) &sam[1],
+  GNUNET_RECLAIM_attribute_deserialize (buf,
                                         data_len,
                                         &ash->claim);
 
   ash->r_id = ntohl (sam->id);
-  ash->identity = sam->identity;
+  ash->identity = identity;
   ash->exp.rel_value_us = GNUNET_ntohll (sam->exp);
-  GNUNET_IDENTITY_key_get_public (&sam->identity, &ash->identity_pkey);
+  GNUNET_IDENTITY_key_get_public (&identity, &ash->identity_pkey);
 
   GNUNET_SERVICE_client_continue (idp->client);
   ash->client = idp;
@@ -1262,20 +1389,36 @@ handle_credential_store_message (void *cls,
 {
   struct AttributeStoreHandle *ash;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREDENTIAL_STORE message\n");
 
   data_len = ntohs (sam->attr_len);
-
+  key_len = ntohl (sam->key_len);
+  buf = (char *) &sam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   ash = GNUNET_new (struct AttributeStoreHandle);
-  ash->credential = GNUNET_RECLAIM_credential_deserialize ((char *) &sam[1],
+  ash->credential = GNUNET_RECLAIM_credential_deserialize (buf,
                                                            data_len);
 
   ash->r_id = ntohl (sam->id);
-  ash->identity = sam->identity;
+  ash->identity = identity;
   ash->exp.rel_value_us = GNUNET_ntohll (sam->exp);
-  GNUNET_IDENTITY_key_get_public (&sam->identity, &ash->identity_pkey);
+  GNUNET_IDENTITY_key_get_public (&identity, &ash->identity_pkey);
 
   GNUNET_SERVICE_client_continue (idp->client);
   ash->client = idp;
@@ -1717,20 +1860,36 @@ handle_attribute_delete_message (void *cls,
 {
   struct AttributeDeleteHandle *adh;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ATTRIBUTE_DELETE message\n");
 
   data_len = ntohs (dam->attr_len);
-
+  key_len = ntohl (dam->key_len);
+  buf = (char *) &dam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   adh = GNUNET_new (struct AttributeDeleteHandle);
-  GNUNET_RECLAIM_attribute_deserialize ((char *) &dam[1],
+  GNUNET_RECLAIM_attribute_deserialize (buf,
                                         data_len,
                                         &adh->claim);
   adh->credential = NULL;
 
   adh->r_id = ntohl (dam->id);
-  adh->identity = dam->identity;
+  adh->identity = identity;
   adh->label
     = GNUNET_STRINGS_data_to_string_alloc (&adh->claim->id,
                                            sizeof(adh->claim->id));
@@ -1808,19 +1967,35 @@ handle_credential_delete_message (void *cls,
 {
   struct AttributeDeleteHandle *adh;
   struct IdpClient *idp = cls;
+  struct GNUNET_IDENTITY_PrivateKey identity;
   size_t data_len;
+  size_t key_len;
+  size_t read;
+  char *buf;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received CREDENTIAL_DELETE message\n");
 
   data_len = ntohs (dam->attr_len);
-
+  key_len = ntohl (dam->key_len);
+  buf = (char *) &dam[1];
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (buf, key_len,
+                                                     &identity, &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
+  buf += read;
   adh = GNUNET_new (struct AttributeDeleteHandle);
-  adh->credential = GNUNET_RECLAIM_credential_deserialize ((char *) &dam[1],
+  adh->credential = GNUNET_RECLAIM_credential_deserialize (buf,
                                                            data_len);
   adh->claim = NULL;
 
   adh->r_id = ntohl (dam->id);
-  adh->identity = dam->identity;
+  adh->identity = identity;
   adh->label
     = GNUNET_STRINGS_data_to_string_alloc (&adh->credential->id,
                                            sizeof(adh->credential->id));
@@ -1858,6 +2033,7 @@ attr_iter_finished (void *cls)
   env = GNUNET_MQ_msg (arm, GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_RESULT);
   arm->id = htonl (ai->request_id);
   arm->attr_len = htons (0);
+  arm->pkey_len = htonl (0);
   GNUNET_MQ_send (ai->client->mq, env);
   GNUNET_CONTAINER_DLL_remove (ai->client->attr_iter_head,
                                ai->client->attr_iter_tail,
@@ -1899,7 +2075,10 @@ attr_iter_cb (void *cls,
 {
   struct Iterator *ai = cls;
   struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_IDENTITY_PublicKey identity;
   char *data_tmp;
+  size_t key_len;
+  ssize_t written;
 
   if ((rd_count != 1) ||
       (GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE != rd->record_type))
@@ -1912,18 +2091,44 @@ attr_iter_cb (void *cls,
               label);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending ATTRIBUTE_RESULT message\n");
+  GNUNET_IDENTITY_key_get_public (zone, &identity);
+  key_len = GNUNET_IDENTITY_public_key_get_length (&identity);
   env = GNUNET_MQ_msg_extra (arm,
-                             rd->data_size,
+                             rd->data_size + key_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_RESULT);
   arm->id = htonl (ai->request_id);
   arm->attr_len = htons (rd->data_size);
-  GNUNET_IDENTITY_key_get_public (zone, &arm->identity);
   data_tmp = (char *) &arm[1];
+  arm->pkey_len = htonl (key_len);
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (0 <= written);
+  data_tmp += written;
   GNUNET_memcpy (data_tmp, rd->data, rd->data_size);
   GNUNET_MQ_send (ai->client->mq, env);
 }
 
 
+static enum GNUNET_GenericReturnValue
+check_iteration_start (
+  void *cls,
+  const struct AttributeIterationStartMessage *ais_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (ais_msg->header.size);
+  key_len = ntohs (ais_msg->key_len);
+
+  if (size < key_len + sizeof(*ais_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 /**
  * Iterate over zone to get attributes
  *
@@ -1936,13 +2141,29 @@ handle_iteration_start (void *cls,
 {
   struct IdpClient *idp = cls;
   struct Iterator *ai;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received ATTRIBUTE_ITERATION_START message\n");
+  key_len = ntohl (ais_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ais_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key.\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   ai = GNUNET_new (struct Iterator);
   ai->request_id = ntohl (ais_msg->id);
   ai->client = idp;
-  ai->identity = ais_msg->identity;
+  ai->identity = identity;
 
   GNUNET_CONTAINER_DLL_insert (idp->attr_iter_head, idp->attr_iter_tail, ai);
   ai->ns_it = GNUNET_NAMESTORE_zone_iteration_start (nsh,
@@ -2084,7 +2305,10 @@ cred_iter_cb (void *cls,
   struct Iterator *ai = cls;
   struct GNUNET_MQ_Envelope *env;
   struct CredentialResultMessage *arm;
+  struct GNUNET_IDENTITY_PublicKey identity;
   char *data_tmp;
+  size_t key_len;
+  ssize_t written;
 
   if ((rd_count != 1) ||
       (GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL != rd->record_type))
@@ -2096,18 +2320,42 @@ cred_iter_cb (void *cls,
               label);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending CREDENTIAL_RESULT message\n");
+  GNUNET_IDENTITY_key_get_public (zone, &identity);
+  key_len = GNUNET_IDENTITY_public_key_get_length (&identity);
   env = GNUNET_MQ_msg_extra (arm,
-                             rd->data_size,
+                             rd->data_size + key_len,
                              GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_RESULT);
   arm->id = htonl (ai->request_id);
   arm->credential_len = htons (rd->data_size);
-  GNUNET_IDENTITY_key_get_public (zone, &arm->identity);
   data_tmp = (char *) &arm[1];
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&identity,
+                                                        data_tmp,
+                                                        key_len);
+  GNUNET_assert (written >= 0);
+  data_tmp += written;
   GNUNET_memcpy (data_tmp, rd->data, rd->data_size);
-
   GNUNET_MQ_send (ai->client->mq, env);
 }
 
+static enum GNUNET_GenericReturnValue
+check_credential_iteration_start (
+  void *cls,
+  const struct CredentialIterationStartMessage *cis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (cis_msg->header.size);
+  key_len = ntohs (cis_msg->key_len);
+
+  if (size < key_len + sizeof(*cis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
 
 /**
  * Iterate over zone to get attributes
@@ -2122,13 +2370,29 @@ handle_credential_iteration_start (void *cls,
 {
   struct IdpClient *idp = cls;
   struct Iterator *ai;
+  struct GNUNET_IDENTITY_PrivateKey identity;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received CREDENTIAL_ITERATION_START message\n");
+  key_len = ntohl (ais_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&ais_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key.\n");
+    GNUNET_SERVICE_client_drop (idp->client);
+    return;
+  }
   ai = GNUNET_new (struct Iterator);
   ai->request_id = ntohl (ais_msg->id);
   ai->client = idp;
-  ai->identity = ais_msg->identity;
+  ai->identity = identity;
 
   GNUNET_CONTAINER_DLL_insert (idp->cred_iter_head, idp->cred_iter_tail,
                                ai);
@@ -2227,8 +2491,16 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket *ticket)
   struct TicketIteration *ti = cls;
   struct GNUNET_MQ_Envelope *env;
   struct TicketResultMessage *trm;
+  size_t tkt_len;
 
-  env = GNUNET_MQ_msg (trm, GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
+  if (NULL == ticket)
+    tkt_len = 0;
+  else
+    tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
+
+  env = GNUNET_MQ_msg_extra (trm,
+                             tkt_len,
+                             GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_RESULT);
   if (NULL == ticket)
   {
     /* send empty response to indicate end of list */
@@ -2238,8 +2510,11 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket *ticket)
   }
   else
   {
-    trm->ticket = *ticket;
+    GNUNET_RECLAIM_write_ticket_to_buffer (ticket,
+                                           &trm[1],
+                                           tkt_len);
   }
+  trm->tkt_len = htonl (tkt_len);
   trm->id = htonl (ti->r_id);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sending TICKET_RESULT message\n");
   GNUNET_MQ_send (ti->client->mq, env);
@@ -2247,6 +2522,24 @@ ticket_iter_cb (void *cls, struct GNUNET_RECLAIM_Ticket *ticket)
     GNUNET_free (ti);
 }
 
+static enum GNUNET_GenericReturnValue
+check_ticket_iteration_start (
+  void *cls,
+  const struct TicketIterationStartMessage *tis_msg)
+{
+  uint16_t size;
+  size_t key_len;
+
+  size = ntohs (tis_msg->header.size);
+  key_len = ntohs (tis_msg->key_len);
+
+  if (size < key_len + sizeof(*tis_msg))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
 
 /**
  * Client requests a ticket iteration
@@ -2259,20 +2552,35 @@ handle_ticket_iteration_start (
   void *cls,
   const struct TicketIterationStartMessage *tis_msg)
 {
+  struct GNUNET_IDENTITY_PrivateKey identity;
   struct IdpClient *client = cls;
   struct TicketIteration *ti;
+  size_t key_len;
+  size_t read;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received TICKET_ITERATION_START message\n");
+  key_len = ntohl (tis_msg->key_len);
+  if ((GNUNET_SYSERR ==
+       GNUNET_IDENTITY_read_private_key_from_buffer (&tis_msg[1],
+                                                     key_len,
+                                                     &identity,
+                                                     &read)) ||
+      (read != key_len))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to read private key\n");
+    GNUNET_SERVICE_client_drop (client->client);
+    return;
+  }
   ti = GNUNET_new (struct TicketIteration);
   ti->r_id = ntohl (tis_msg->id);
   ti->client = client;
-
   GNUNET_CONTAINER_DLL_insert (client->ticket_iter_head,
                                client->ticket_iter_tail,
                                ti);
   ti->iter
-    = RECLAIM_TICKETS_iteration_start (&tis_msg->identity, &ticket_iter_cb, ti);
+    = RECLAIM_TICKETS_iteration_start (&identity, &ticket_iter_cb, ti);
   GNUNET_SERVICE_client_continue (client->client);
 }
 
@@ -2451,10 +2759,10 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_DELETE,
                          struct AttributeDeleteMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (iteration_start,
-                           GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START,
-                           struct AttributeIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (iteration_start,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START,
+                         struct AttributeIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (iteration_next,
                            GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_NEXT,
                            struct AttributeIterationNextMessage,
@@ -2463,10 +2771,10 @@ GNUNET_SERVICE_MAIN (
                            GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_STOP,
                            struct AttributeIterationStopMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (credential_iteration_start,
-                           GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START,
-                           struct CredentialIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (credential_iteration_start,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START,
+                         struct CredentialIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (credential_iteration_next,
                            GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_NEXT,
                            struct CredentialIterationNextMessage,
@@ -2484,10 +2792,10 @@ GNUNET_SERVICE_MAIN (
                          GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET,
                          struct ConsumeTicketMessage,
                          NULL),
-  GNUNET_MQ_hd_fixed_size (ticket_iteration_start,
-                           GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START,
-                           struct TicketIterationStartMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (ticket_iteration_start,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START,
+                         struct TicketIterationStartMessage,
+                         NULL),
   GNUNET_MQ_hd_fixed_size (ticket_iteration_next,
                            GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_NEXT,
                            struct TicketIterationNextMessage,
diff --git a/src/reclaim/gnunet-service-reclaim_tickets.c b/src/reclaim/gnunet-service-reclaim_tickets.c
index 9552094f1..5e2a5e974 100644
--- a/src/reclaim/gnunet-service-reclaim_tickets.c
+++ b/src/reclaim/gnunet-service-reclaim_tickets.c
@@ -742,7 +742,8 @@ rvk_move_attr_cb (void *cls,
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Adding credential %s\n",
                   new_label);
       GNUNET_free (credential);
-    } else {
+    }
+    else {
       memcpy (&new_rd[i], &rd[i], sizeof (struct GNUNET_GNSRECORD_Data));
     }
   }
@@ -1197,9 +1198,11 @@ RECLAIM_TICKETS_consume (const struct GNUNET_IDENTITY_PrivateKey *id,
   label =
     GNUNET_STRINGS_data_to_string_alloc (&cth->ticket.rnd,
                                          sizeof(cth->ticket.rnd));
+  char *str = GNUNET_IDENTITY_public_key_to_string (&cth->ticket.identity);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Looking for AuthZ info under %s\n",
-              label);
+              "Looking for AuthZ info under %s in %s\n",
+              label, str);
+  GNUNET_free (str);
   cth->lookup_start_time = GNUNET_TIME_absolute_get ();
   cth->lookup_request =
     GNUNET_GNS_lookup (gns,
@@ -1289,6 +1292,7 @@ issue_ticket (struct TicketIssueHandle *ih)
   struct GNUNET_RECLAIM_PresentationListEntry *ple;
   struct GNUNET_GNSRECORD_Data *attrs_record;
   char *label;
+  char *tkt_data;
   int i;
   int j;
   int attrs_count = 0;
@@ -1376,8 +1380,13 @@ issue_ticket (struct TicketIssueHandle *ih)
       }
     }
   }
-  attrs_record[i].data = &ih->ticket;
-  attrs_record[i].data_size = sizeof(struct GNUNET_RECLAIM_Ticket);
+  attrs_record[i].data_size =
+    GNUNET_RECLAIM_ticket_serialize_get_size (&ih->ticket);
+  tkt_data = GNUNET_malloc (attrs_record[i].data_size);
+  GNUNET_RECLAIM_write_ticket_to_buffer (&ih->ticket,
+                                         tkt_data,
+                                         attrs_record[i].data_size);
+  attrs_record[i].data = tkt_data;
   attrs_record[i].expiration_time = ticket_refresh_interval.rel_value_us;
   attrs_record[i].record_type = GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET;
   attrs_record[i].flags =
@@ -1387,6 +1396,13 @@ issue_ticket (struct TicketIssueHandle *ih)
   label =
     GNUNET_STRINGS_data_to_string_alloc (&ih->ticket.rnd,
                                          sizeof(ih->ticket.rnd));
+  struct GNUNET_IDENTITY_PublicKey pub;
+  GNUNET_IDENTITY_key_get_public (&ih->identity,
+                                  &pub);
+  char *str = GNUNET_IDENTITY_public_key_to_string (&pub);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Storing AuthZ information under %s in %s\n", label, str);
+  GNUNET_free (str);
   // Publish record
   ih->ns_qe = GNUNET_NAMESTORE_records_store (nsh,
                                               &ih->identity,
@@ -1404,6 +1420,7 @@ issue_ticket (struct TicketIssueHandle *ih)
     char *ptr = (char*) attrs_record[j].data;
     GNUNET_free (ptr);
   }
+  GNUNET_free (tkt_data);
   GNUNET_free (attrs_record);
   GNUNET_free (label);
 }
@@ -1454,7 +1471,7 @@ filter_tickets_cb (void *cls,
                    const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct TicketIssueHandle *tih = cls;
-  struct GNUNET_RECLAIM_Ticket *ticket = NULL;
+  struct GNUNET_RECLAIM_Ticket ticket;
   struct GNUNET_RECLAIM_Presentation *presentation;
   struct GNUNET_RECLAIM_PresentationList *ticket_presentations;
   struct GNUNET_RECLAIM_Credential *cred;
@@ -1462,6 +1479,7 @@ filter_tickets_cb (void *cls,
   struct GNUNET_RECLAIM_AttributeListEntry *le;
   unsigned int attr_cnt = 0;
   unsigned int pres_cnt = 0;
+  int ticket_found = GNUNET_NO;
 
   for (le = tih->attrs->list_head; NULL != le; le = le->next)
   {
@@ -1473,6 +1491,7 @@ filter_tickets_cb (void *cls,
   // ticket search
   unsigned int found_attrs_cnt = 0;
   unsigned int found_pres_cnt = 0;
+  size_t read;
   ticket_presentations = GNUNET_new (struct GNUNET_RECLAIM_PresentationList);
 
   for (int i = 0; i < rd_count; i++)
@@ -1480,16 +1499,28 @@ filter_tickets_cb (void *cls,
     // found ticket
     if (GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET == rd[i].record_type)
     {
-      ticket = (struct GNUNET_RECLAIM_Ticket *) rd[i].data;
+      if ((GNUNET_SYSERR ==
+           GNUNET_RECLAIM_read_ticket_from_buffer (rd[i].data,
+                                                   rd[i].data_size,
+                                                   &ticket,
+                                                   &read)) ||
+          (read != rd[i].data_size))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Failed to deserialize ticket from record\n");
+        continue;
+      }
       // cmp audience
+      // FIXME this is ugly, GNUNET_IDENTITY_PublicKey cannot be compared
+      // like this
       if (0 == memcmp (&tih->ticket.audience,
-                       &ticket->audience,
+                       &ticket.audience,
                        sizeof(struct GNUNET_IDENTITY_PublicKey)))
       {
-        tih->ticket = *ticket;
+        tih->ticket = ticket;
+        ticket_found = GNUNET_YES;
         continue;
       }
-      ticket = NULL;
     }
 
     // cmp requested attributes with ticket attributes
@@ -1573,7 +1604,7 @@ filter_tickets_cb (void *cls,
    */
   if ((attr_cnt == found_attrs_cnt) &&
       (pres_cnt == found_pres_cnt) &&
-      (NULL != ticket))
+      (GNUNET_YES == ticket_found))
   {
     GNUNET_NAMESTORE_zone_iteration_stop (tih->ns_it);
     tih->cb (tih->cb_cls, &tih->ticket, ticket_presentations, GNUNET_OK, NULL);
@@ -1683,12 +1714,25 @@ collect_tickets_cb (void *cls,
                     const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct RECLAIM_TICKETS_Iterator *iter = cls;
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t read;
 
   for (int i = 0; i < rd_count; i++)
   {
     if (GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET != rd[i].record_type)
       continue;
-    iter->cb (iter->cb_cls, (struct GNUNET_RECLAIM_Ticket *) rd[i].data);
+    if ((GNUNET_SYSERR ==
+         GNUNET_RECLAIM_read_ticket_from_buffer (rd[i].data,
+                                                 rd[i].data_size,
+                                                 &ticket,
+                                                 &read)) ||
+        (read != rd[i].data_size))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to deserialize ticket from record\n");
+      continue;
+    }
+    iter->cb (iter->cb_cls, &ticket);
     return;
   }
   GNUNET_NAMESTORE_zone_iterator_next (iter->ns_it, 1);
diff --git a/src/reclaim/reclaim.h b/src/reclaim/reclaim.h
index aae8ee89a..5813beaf7 100644
--- a/src/reclaim/reclaim.h
+++ b/src/reclaim/reclaim.h
@@ -45,6 +45,11 @@ struct AttributeStoreMessage
   struct GNUNET_MessageHeader header;
 
   /**
+   * The expiration interval of the attribute
+   */
+  uint64_t exp GNUNET_PACKED;
+
+  /**
    * Unique identifier for this request (for key collisions).
    */
   uint32_t id GNUNET_PACKED;
@@ -55,16 +60,13 @@ struct AttributeStoreMessage
   uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * The expiration interval of the attribute
-   */
-  uint64_t exp GNUNET_PACKED;
-
-  /**
-   * Identity
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by the serialized attribute */
+  /*
+   * followed by the zone private key
+   * followed by the serialized attribute */
 };
 
 
@@ -89,9 +91,9 @@ struct AttributeDeleteMessage
   uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * Identity
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /* followed by the serialized attribute */
 };
@@ -149,11 +151,13 @@ struct AttributeResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the public key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t pkey_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * followed by the public key key.
+   * followed by:
    * serialized attribute data
    */
 };
@@ -184,11 +188,13 @@ struct CredentialResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the public key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * followed by the private key.
+   * followed by:
    * serialized credential data
    */
 };
@@ -210,9 +216,13 @@ struct AttributeIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -249,9 +259,13 @@ struct CredentialIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -321,9 +335,13 @@ struct TicketIterationStartMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
+   */
+  uint32_t key_len GNUNET_PACKED;
+
+  /**
+   * followed by the private key.
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
 };
 
 
@@ -377,21 +395,25 @@ struct IssueTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * length of serialized attribute list
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t attr_len GNUNET_PACKED;
 
   /**
-   * Requesting party.
+   * The length of the identity private key
    */
-  struct GNUNET_IDENTITY_PublicKey rp;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * length of serialized attribute list
+   * The length of the relying party public key
    */
-  uint32_t attr_len GNUNET_PACKED;
+  uint32_t pkey_len GNUNET_PACKED;
 
-  // Followed by a serialized attribute list
+  /**
+   * Followed by the private key.
+   * Followed by the public key.
+   * Followed by a serialized attribute list
+   */
 };
 
 /**
@@ -410,19 +432,20 @@ struct RevokeTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * length of serialized attribute list
+   * The length of the ticket
    */
-  uint32_t attrs_len GNUNET_PACKED;
+  uint32_t tkt_len GNUNET_PACKED;
 
   /**
-   * The ticket to revoke
+   * Followed by the serialized ticket.
+   * Followed by the private key.
+   * Followed by a serialized attribute list
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
 };
 
 /**
@@ -463,16 +486,19 @@ struct TicketResultMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Length of new presentations created
+   * Ticket length
    */
-  uint32_t presentations_len GNUNET_PACKED;
+  uint32_t tkt_len GNUNET_PACKED;
 
   /**
-   * The new ticket
+   * Length of new presentations created
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
+  uint32_t presentations_len GNUNET_PACKED;
 
-  /* Followed by the serialized GNUNET_RECLAIM_PresentationList */
+  /*
+   * Followed by the serialized ticket
+   * Followed by the serialized GNUNET_RECLAIM_PresentationList
+   */
 };
 
 /**
@@ -491,14 +517,19 @@ struct ConsumeTicketMessage
   uint32_t id GNUNET_PACKED;
 
   /**
-   * Identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PrivateKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
   /**
-   * The ticket to consume
+   * The length of the ticket
+   */
+  uint32_t tkt_len GNUNET_PACKED;
+
+  /**
+   * Followed by the private key.
+   * Followed by the serialized ticket.
    */
-  struct GNUNET_RECLAIM_Ticket ticket;
 };
 
 /**
@@ -537,11 +568,13 @@ struct ConsumeTicketResultMessage
   uint16_t reserved GNUNET_PACKED;
 
   /**
-   * The public key of the identity.
+   * The length of the private key
    */
-  struct GNUNET_IDENTITY_PublicKey identity;
+  uint32_t key_len GNUNET_PACKED;
 
-  /* followed by:
+  /**
+   * Followed by the private key.
+   * followed by:
    * serialized attributes data
    */
 };
diff --git a/src/reclaim/reclaim_api.c b/src/reclaim/reclaim_api.c
index 6f55d62e4..efc45e616 100644
--- a/src/reclaim/reclaim_api.c
+++ b/src/reclaim/reclaim_api.c
@@ -567,12 +567,13 @@ check_consume_ticket_result (void *cls,
   size_t msg_len;
   size_t attrs_len;
   size_t pl_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   attrs_len = ntohs (msg->attrs_len);
+  key_len = ntohl (msg->key_len);
   pl_len = ntohs (msg->presentations_len);
-  if (msg_len !=
-      sizeof(struct ConsumeTicketResultMessage) + attrs_len + pl_len)
+  if (msg_len != sizeof(*msg) + attrs_len + pl_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -592,14 +593,18 @@ static void
 handle_consume_ticket_result (void *cls,
                               const struct ConsumeTicketResultMessage *msg)
 {
+  struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_Operation *op;
   size_t attrs_len;
   size_t pl_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
   char *read_ptr;
 
   attrs_len = ntohs (msg->attrs_len);
+  key_len = ntohl (msg->key_len);
   pl_len = ntohs (msg->presentations_len);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Processing ticket result.\n");
 
@@ -615,15 +620,22 @@ handle_consume_ticket_result (void *cls,
     struct GNUNET_RECLAIM_AttributeListEntry *le;
     struct GNUNET_RECLAIM_PresentationList *pl;
     struct GNUNET_RECLAIM_PresentationListEntry *ple;
+    read_ptr = (char *) &msg[1];
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (read_ptr,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    read_ptr += read;
     attrs =
-      GNUNET_RECLAIM_attribute_list_deserialize ((char *) &msg[1], attrs_len);
-    read_ptr = ((char *) &msg[1]) + attrs_len;
+      GNUNET_RECLAIM_attribute_list_deserialize (read_ptr, attrs_len);
+    read_ptr += attrs_len;
     pl = GNUNET_RECLAIM_presentation_list_deserialize (read_ptr, pl_len);
     if (NULL != op->atr_cb)
     {
       if (NULL == attrs)
       {
-        op->atr_cb (op->cls, &msg->identity, NULL, NULL);
+        op->atr_cb (op->cls, &identity, NULL, NULL);
       }
       else
       {
@@ -638,7 +650,7 @@ handle_consume_ticket_result (void *cls,
                   GNUNET_RECLAIM_id_is_equal (&le->attribute->credential,
                                               &ple->presentation->credential_id))
               {
-                op->atr_cb (op->cls, &msg->identity,
+                op->atr_cb (op->cls, &identity,
                             le->attribute, ple->presentation);
                 break;
               }
@@ -647,7 +659,7 @@ handle_consume_ticket_result (void *cls,
           }
           else     // No credentials
           {
-            op->atr_cb (op->cls, &msg->identity,
+            op->atr_cb (op->cls, &identity,
                         le->attribute, NULL);
           }
         }
@@ -679,10 +691,12 @@ check_attribute_result (void *cls, const struct AttributeResultMessage *msg)
 {
   size_t msg_len;
   size_t attr_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   attr_len = ntohs (msg->attr_len);
-  if (msg_len != sizeof(struct AttributeResultMessage) + attr_len)
+  key_len = ntohl (msg->pkey_len);
+  if (msg_len != sizeof(*msg) + attr_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -701,17 +715,20 @@ check_attribute_result (void *cls, const struct AttributeResultMessage *msg)
 static void
 handle_attribute_result (void *cls, const struct AttributeResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey identity_dummy;
+  static struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_AttributeIterator *it;
   struct GNUNET_RECLAIM_Operation *op;
   size_t attr_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
+  char *buf;
 
   attr_len = ntohs (msg->attr_len);
+  key_len = ntohl (msg->pkey_len);
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Processing attribute result.\n");
 
-
   for (it = h->it_head; NULL != it; it = it->next)
     if (it->r_id == r_id)
       break;
@@ -721,8 +738,8 @@ handle_attribute_result (void *cls, const struct AttributeResultMessage *msg)
   if ((NULL == it) && (NULL == op))
     return;
 
-  if ((0 ==
-       (memcmp (&msg->identity, &identity_dummy, sizeof(identity_dummy)))))
+  buf = (char *) &msg[1];
+  if (0 == key_len)
   {
     if ((NULL == it) && (NULL == op))
     {
@@ -748,17 +765,22 @@ handle_attribute_result (void *cls, const struct AttributeResultMessage *msg)
 
   {
     struct GNUNET_RECLAIM_Attribute *attr;
-    GNUNET_RECLAIM_attribute_deserialize ((char *) &msg[1], attr_len,
-                                          &attr);
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (buf,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    buf += read;
+    GNUNET_RECLAIM_attribute_deserialize (buf, attr_len, &attr);
     if (NULL != it)
     {
       if (NULL != it->proc)
-        it->proc (it->proc_cls, &msg->identity, attr);
+        it->proc (it->proc_cls, &identity, attr);
     }
     else if (NULL != op)
     {
       if (NULL != op->ar_cb)
-        op->ar_cb (op->cls, &msg->identity, attr);
+        op->ar_cb (op->cls, &identity, attr);
     }
     GNUNET_free (attr);
     return;
@@ -780,10 +802,12 @@ check_credential_result (void *cls, const struct CredentialResultMessage *msg)
 {
   size_t msg_len;
   size_t cred_len;
+  size_t key_len;
 
   msg_len = ntohs (msg->header.size);
   cred_len = ntohs (msg->credential_len);
-  if (msg_len != sizeof(struct CredentialResultMessage) + cred_len)
+  key_len = ntohl (msg->key_len);
+  if (msg_len != sizeof(*msg) + cred_len + key_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -803,13 +827,17 @@ static void
 handle_credential_result (void *cls, const struct
                           CredentialResultMessage *msg)
 {
-  static struct GNUNET_IDENTITY_PrivateKey identity_dummy;
+  struct GNUNET_IDENTITY_PublicKey identity;
   struct GNUNET_RECLAIM_Handle *h = cls;
   struct GNUNET_RECLAIM_CredentialIterator *it;
   struct GNUNET_RECLAIM_Operation *op;
   size_t att_len;
+  size_t key_len;
+  size_t read;
   uint32_t r_id = ntohl (msg->id);
+  char *buf;
 
+  key_len = ntohl (msg->key_len);
   att_len = ntohs (msg->credential_len);
   LOG (GNUNET_ERROR_TYPE_DEBUG, "Processing credential result.\n");
 
@@ -823,8 +851,17 @@ handle_credential_result (void *cls, const struct
   if ((NULL == it) && (NULL == op))
     return;
 
-  if ((0 ==
-       (memcmp (&msg->identity, &identity_dummy, sizeof(identity_dummy)))))
+  buf = (char *) &msg[1];
+  if (0 < key_len)
+  {
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_IDENTITY_read_public_key_from_buffer (buf,
+                                                                key_len,
+                                                                &identity,
+                                                                &read));
+    buf += read;
+  }
+  if (0 == key_len)
   {
     if ((NULL == it) && (NULL == op))
     {
@@ -850,17 +887,17 @@ handle_credential_result (void *cls, const struct
 
   {
     struct GNUNET_RECLAIM_Credential *att;
-    att = GNUNET_RECLAIM_credential_deserialize ((char *) &msg[1], att_len);
+    att = GNUNET_RECLAIM_credential_deserialize (buf, att_len);
 
     if (NULL != it)
     {
       if (NULL != it->proc)
-        it->proc (it->proc_cls, &msg->identity, att);
+        it->proc (it->proc_cls, &identity, att);
     }
     else if (NULL != op)
     {
       if (NULL != op->at_cb)
-        op->at_cb (op->cls, &msg->identity, att);
+        op->at_cb (op->cls, &identity, att);
     }
     GNUNET_free (att);
     return;
@@ -882,10 +919,12 @@ check_ticket_result (void *cls, const struct TicketResultMessage *msg)
 {
   size_t msg_len;
   size_t pres_len;
+  size_t tkt_len;
 
   msg_len = ntohs (msg->header.size);
   pres_len = ntohs (msg->presentations_len);
-  if (msg_len != sizeof(struct TicketResultMessage) + pres_len)
+  tkt_len = ntohl (msg->tkt_len);
+  if (msg_len != sizeof(*msg) + pres_len + tkt_len)
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -909,9 +948,14 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
   struct GNUNET_RECLAIM_TicketIterator *it;
   struct GNUNET_RECLAIM_PresentationList *presentation;
   uint32_t r_id = ntohl (msg->id);
-  static const struct GNUNET_RECLAIM_Ticket ticket;
-  uint32_t pres_len = ntohs (msg->presentations_len);
+  struct GNUNET_RECLAIM_Ticket ticket;
+  size_t pres_len;
+  size_t tkt_len;
+  size_t tb_read;
+  char *buf;
 
+  tkt_len = ntohl (msg->tkt_len);
+  pres_len = ntohs (msg->presentations_len);
   for (op = handle->op_head; NULL != op; op = op->next)
     if (op->r_id == r_id)
       break;
@@ -920,15 +964,21 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
       break;
   if ((NULL == op) && (NULL == it))
     return;
+  buf = (char*) &msg[1];
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_RECLAIM_read_ticket_from_buffer (buf,
+                                                         tkt_len,
+                                                         &ticket,
+                                                         &tb_read));
+  buf += tb_read;
   if (NULL != op)
   {
     if (0 < pres_len)
       presentation = GNUNET_RECLAIM_presentation_list_deserialize (
-        (char*) &msg[1],
+        buf,
         pres_len);
     GNUNET_CONTAINER_DLL_remove (handle->op_head, handle->op_tail, op);
-    if (0 ==
-        memcmp (&msg->ticket, &ticket, sizeof(struct GNUNET_RECLAIM_Ticket)))
+    if (0 == tb_read)
     {
       if (NULL != op->ti_cb)
         op->ti_cb (op->cls, NULL, NULL);
@@ -937,7 +987,7 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
     {
       if (NULL != op->ti_cb)
         op->ti_cb (op->cls,
-                   &msg->ticket,
+                   &ticket,
                    (0 < pres_len) ? presentation : NULL);
     }
     if (0 < pres_len)
@@ -947,8 +997,7 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
   }
   else if (NULL != it)
   {
-    if (0 ==
-        memcmp (&msg->ticket, &ticket, sizeof(struct GNUNET_RECLAIM_Ticket)))
+    if (0 == tkt_len)
     {
       GNUNET_CONTAINER_DLL_remove (handle->ticket_it_head,
                                    handle->ticket_it_tail,
@@ -959,7 +1008,7 @@ handle_ticket_result (void *cls, const struct TicketResultMessage *msg)
     else
     {
       if (NULL != it->tr_cb)
-        it->tr_cb (it->cls, &msg->ticket);
+        it->tr_cb (it->cls, &ticket);
     }
     return;
   }
@@ -1110,18 +1159,6 @@ GNUNET_RECLAIM_disconnect (struct GNUNET_RECLAIM_Handle *h)
 }
 
 
-/**
- * Store an attribute.  If the attribute is already present,
- * it is replaced with the new attribute.
- *
- * @param h handle to the re:claimID service
- * @param pkey private key of the identity
- * @param attr the attribute value
- * @param exp_interval the relative expiration interval for the attribute
- * @param cont continuation to call when done
- * @param cont_cls closure for @a cont
- * @return handle to abort the request
- */
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_store (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1134,6 +1171,9 @@ GNUNET_RECLAIM_attribute_store (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeStoreMessage *sam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
@@ -1141,15 +1181,20 @@ GNUNET_RECLAIM_attribute_store (
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   attr_len = GNUNET_RECLAIM_attribute_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (sam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_STORE);
-  sam->identity = *pkey;
+  sam->key_len = htonl (key_len);
+  buf = (char *) &sam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 < written);
+  buf += written;
   sam->id = htonl (op->r_id);
   sam->exp = GNUNET_htonll (exp_interval->rel_value_us);
 
-  GNUNET_RECLAIM_attribute_serialize (attr, (char *) &sam[1]);
+  GNUNET_RECLAIM_attribute_serialize (attr, buf);
 
   sam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1158,17 +1203,6 @@ GNUNET_RECLAIM_attribute_store (
 }
 
 
-/**
- * Delete an attribute. Tickets used to share this attribute are updated
- * accordingly.
- *
- * @param h handle to the re:claimID service
- * @param pkey Private key of the identity to add an attribute to
- * @param attr The attribute
- * @param cont Continuation to call when done
- * @param cont_cls Closure for @a cont
- * @return handle Used to to abort the request
- */
 struct GNUNET_RECLAIM_Operation *
 GNUNET_RECLAIM_attribute_delete (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1180,6 +1214,9 @@ GNUNET_RECLAIM_attribute_delete (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeDeleteMessage *dam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
@@ -1187,13 +1224,18 @@ GNUNET_RECLAIM_attribute_delete (
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   attr_len = GNUNET_RECLAIM_attribute_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (dam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_DELETE);
-  dam->identity = *pkey;
+  dam->key_len = htonl (key_len);
+  buf = (char *) &dam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 < written);
+  buf += written;
   dam->id = htonl (op->r_id);
-  GNUNET_RECLAIM_attribute_serialize (attr, (char *) &dam[1]);
+  GNUNET_RECLAIM_attribute_serialize (attr, buf);
 
   dam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1214,22 +1256,30 @@ GNUNET_RECLAIM_credential_store (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeStoreMessage *sam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->as_cb = cont;
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_credential_serialize_get_size (credential);
   op->env = GNUNET_MQ_msg_extra (sam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_STORE);
-  sam->identity = *pkey;
+  sam->key_len = htonl (key_len);
+  buf = (char *) &sam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   sam->id = htonl (op->r_id);
   sam->exp = GNUNET_htonll (exp_interval->rel_value_us);
 
-  GNUNET_RECLAIM_credential_serialize (credential, (char *) &sam[1]);
+  GNUNET_RECLAIM_credential_serialize (credential, buf);
 
   sam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1249,20 +1299,28 @@ GNUNET_RECLAIM_credential_delete (
   struct GNUNET_RECLAIM_Operation *op;
   struct AttributeDeleteMessage *dam;
   size_t attr_len;
+  size_t key_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->as_cb = cont;
   op->cls = cont_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (pkey);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_credential_serialize_get_size (attr);
   op->env = GNUNET_MQ_msg_extra (dam,
-                                 attr_len,
+                                 attr_len + key_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_DELETE);
-  dam->identity = *pkey;
+  dam->key_len = htonl (key_len);
+  buf = (char *) &dam[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (pkey, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   dam->id = htonl (op->r_id);
-  GNUNET_RECLAIM_credential_serialize (attr, (char *) &dam[1]);
+  GNUNET_RECLAIM_credential_serialize (attr, buf);
 
   dam->attr_len = htons (attr_len);
   if (NULL != h->mq)
@@ -1271,30 +1329,6 @@ GNUNET_RECLAIM_credential_delete (
 }
 
 
-/**
- * List all attributes for a local identity.
- * This MUST lock the `struct GNUNET_RECLAIM_Handle`
- * for any other calls than #GNUNET_RECLAIM_get_attributes_next() and
- * #GNUNET_RECLAIM_get_attributes_stop. @a proc will be called once
- * immediately, and then again after
- * #GNUNET_RECLAIM_get_attributes_next() is invoked.
- *
- * On error (disconnect), @a error_cb will be invoked.
- * On normal completion, @a finish_cb proc will be
- * invoked.
- *
- * @param h Handle to the re:claimID service
- * @param identity Identity to iterate over
- * @param error_cb Function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls Closure for @a error_cb
- * @param proc Function to call on each attribute
- * @param proc_cls Closure for @a proc
- * @param finish_cb Function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls Closure for @a finish_cb
- * @return an iterator Handle to use for iteration
- */
 struct GNUNET_RECLAIM_AttributeIterator *
 GNUNET_RECLAIM_get_attributes_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1310,6 +1344,7 @@ GNUNET_RECLAIM_get_attributes_start (
   struct GNUNET_MQ_Envelope *env;
   struct AttributeIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   it = GNUNET_new (struct GNUNET_RECLAIM_AttributeIterator);
@@ -1322,11 +1357,15 @@ GNUNET_RECLAIM_get_attributes_start (
   it->proc_cls = proc_cls;
   it->r_id = rid;
   it->identity = *identity;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->it_head, h->it_tail, it);
   env =
-    GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START);
+    GNUNET_MQ_msg_extra (msg,
+                         key_len,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_ATTRIBUTE_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, &msg[1], key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1349,13 +1388,6 @@ GNUNET_RECLAIM_get_attributes_next (struct GNUNET_RECLAIM_AttributeIterator *it)
 }
 
 
-/**
- * Stops iteration and releases the handle for further calls. Must
- * be called on any iteration that has not yet completed prior to calling
- * #GNUNET_RECLAIM_disconnect.
- *
- * @param it the iterator
- */
 void
 GNUNET_RECLAIM_get_attributes_stop (struct GNUNET_RECLAIM_AttributeIterator *it)
 {
@@ -1374,30 +1406,6 @@ GNUNET_RECLAIM_get_attributes_stop (struct GNUNET_RECLAIM_AttributeIterator *it)
 }
 
 
-/**
- * List all credentials for a local identity.
- * This MUST lock the `struct GNUNET_RECLAIM_Handle`
- * for any other calls than #GNUNET_RECLAIM_get_credentials_next() and
- * #GNUNET_RECLAIM_get_credentials_stop. @a proc will be called once
- * immediately, and then again after
- * #GNUNET_RECLAIM_get_credentials_next() is invoked.
- *
- * On error (disconnect), @a error_cb will be invoked.
- * On normal completion, @a finish_cb proc will be
- * invoked.
- *
- * @param h Handle to the re:claimID service
- * @param identity Identity to iterate over
- * @param error_cb Function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls Closure for @a error_cb
- * @param proc Function to call on each credential
- * @param proc_cls Closure for @a proc
- * @param finish_cb Function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls Closure for @a finish_cb
- * @return an iterator Handle to use for iteration
- */
 struct GNUNET_RECLAIM_CredentialIterator *
 GNUNET_RECLAIM_get_credentials_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1413,6 +1421,7 @@ GNUNET_RECLAIM_get_credentials_start (
   struct GNUNET_MQ_Envelope *env;
   struct CredentialIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   ait = GNUNET_new (struct GNUNET_RECLAIM_CredentialIterator);
@@ -1425,12 +1434,15 @@ GNUNET_RECLAIM_get_credentials_start (
   ait->proc_cls = proc_cls;
   ait->r_id = rid;
   ait->identity = *identity;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->ait_head, h->ait_tail, ait);
   env =
-    GNUNET_MQ_msg (msg,
-                   GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START);
+    GNUNET_MQ_msg_extra (msg,
+                         key_len,
+                         GNUNET_MESSAGE_TYPE_RECLAIM_CREDENTIAL_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, &msg[1], key_len);
   if (NULL == h->mq)
     ait->env = env;
   else
@@ -1486,23 +1498,35 @@ GNUNET_RECLAIM_ticket_issue (
   struct GNUNET_RECLAIM_Operation *op;
   struct IssueTicketMessage *tim;
   size_t attr_len;
+  size_t key_len;
+  size_t rpk_len;
+  ssize_t written;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->ti_cb = cb;
   op->cls = cb_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (iss);
+  rpk_len = GNUNET_IDENTITY_public_key_get_length (rp);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
   attr_len = GNUNET_RECLAIM_attribute_list_serialize_get_size (attrs);
   op->env = GNUNET_MQ_msg_extra (tim,
-                                 attr_len,
+                                 attr_len + key_len + rpk_len,
                                  GNUNET_MESSAGE_TYPE_RECLAIM_ISSUE_TICKET);
-  tim->identity = *iss;
-  tim->rp = *rp;
+  tim->key_len = htonl (key_len);
+  tim->pkey_len = htonl (rpk_len);
+  buf = (char *) &tim[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (iss, buf, key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (rp, buf, rpk_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
   tim->id = htonl (op->r_id);
 
-  GNUNET_RECLAIM_attribute_list_serialize (attrs, (char *) &tim[1]);
-
+  GNUNET_RECLAIM_attribute_list_serialize (attrs, buf);
   tim->attr_len = htons (attr_len);
   if (NULL != h->mq)
     GNUNET_MQ_send_copy (h->mq, op->env);
@@ -1532,17 +1556,28 @@ GNUNET_RECLAIM_ticket_consume (
 {
   struct GNUNET_RECLAIM_Operation *op;
   struct ConsumeTicketMessage *ctm;
+  size_t key_len;
+  size_t tkt_len;
+  char *buf;
 
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
   op->h = h;
   op->atr_cb = cb;
   op->cls = cb_cls;
   op->r_id = h->r_id_gen++;
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
+  tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
-  op->env = GNUNET_MQ_msg (ctm, GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET);
-  ctm->identity = *identity;
+  op->env = GNUNET_MQ_msg_extra (ctm,
+                                 key_len + tkt_len,
+                                 GNUNET_MESSAGE_TYPE_RECLAIM_CONSUME_TICKET);
+  ctm->key_len = htonl (key_len);
+  buf = (char*) &ctm[1];
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity, buf, key_len);
+  buf += key_len;
+  ctm->tkt_len = htonl (tkt_len);
+  GNUNET_RECLAIM_write_ticket_to_buffer (ticket, buf, tkt_len);
   ctm->id = htonl (op->r_id);
-  ctm->ticket = *ticket;
   if (NULL != h->mq)
     GNUNET_MQ_send_copy (h->mq, op->env);
   else
@@ -1551,23 +1586,6 @@ GNUNET_RECLAIM_ticket_consume (
 }
 
 
-/**
- * Lists all tickets that have been issued to remote
- * identites (relying parties)
- *
- * @param h the reclaim to use
- * @param identity the issuing identity
- * @param error_cb function to call on error (i.e. disconnect),
- *        the handle is afterwards invalid
- * @param error_cb_cls closure for @a error_cb
- * @param proc function to call on each ticket; it
- *        will be called repeatedly with a value (if available)
- * @param proc_cls closure for @a proc
- * @param finish_cb function to call on completion
- *        the handle is afterwards invalid
- * @param finish_cb_cls closure for @a finish_cb
- * @return an iterator handle to use for iteration
- */
 struct GNUNET_RECLAIM_TicketIterator *
 GNUNET_RECLAIM_ticket_iteration_start (
   struct GNUNET_RECLAIM_Handle *h,
@@ -1583,6 +1601,7 @@ GNUNET_RECLAIM_ticket_iteration_start (
   struct GNUNET_MQ_Envelope *env;
   struct TicketIterationStartMessage *msg;
   uint32_t rid;
+  size_t key_len;
 
   rid = h->r_id_gen++;
   it = GNUNET_new (struct GNUNET_RECLAIM_TicketIterator);
@@ -1594,10 +1613,17 @@ GNUNET_RECLAIM_ticket_iteration_start (
   it->tr_cb = proc;
   it->cls = proc_cls;
   it->r_id = rid;
+
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
   GNUNET_CONTAINER_DLL_insert_tail (h->ticket_it_head, h->ticket_it_tail, it);
-  env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START);
+  env = GNUNET_MQ_msg_extra (msg,
+                             key_len,
+                             GNUNET_MESSAGE_TYPE_RECLAIM_TICKET_ITERATION_START);
   msg->id = htonl (rid);
-  msg->identity = *identity;
+  msg->key_len = htonl (key_len);
+  GNUNET_IDENTITY_write_private_key_to_buffer (identity,
+                                               &msg[1],
+                                               key_len);
   if (NULL == h->mq)
     it->env = env;
   else
@@ -1674,6 +1700,10 @@ GNUNET_RECLAIM_ticket_revoke (
   struct GNUNET_RECLAIM_Operation *op;
   struct RevokeTicketMessage *msg;
   uint32_t rid;
+  size_t key_len;
+  size_t tkt_len;
+  ssize_t written;
+  char *buf;
 
   rid = h->r_id_gen++;
   op = GNUNET_new (struct GNUNET_RECLAIM_Operation);
@@ -1682,10 +1712,23 @@ GNUNET_RECLAIM_ticket_revoke (
   op->cls = cb_cls;
   op->r_id = rid;
   GNUNET_CONTAINER_DLL_insert_tail (h->op_head, h->op_tail, op);
-  op->env = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_RECLAIM_REVOKE_TICKET);
+  key_len = GNUNET_IDENTITY_private_key_get_length (identity);
+  tkt_len = GNUNET_RECLAIM_ticket_serialize_get_size (ticket);
+  op->env = GNUNET_MQ_msg_extra (msg,
+                                 key_len + tkt_len,
+                                 GNUNET_MESSAGE_TYPE_RECLAIM_REVOKE_TICKET);
   msg->id = htonl (rid);
-  msg->identity = *identity;
-  msg->ticket = *ticket;
+  msg->key_len = htonl (key_len);
+  msg->tkt_len = htonl (tkt_len);
+  buf = (char*) &msg[1];
+  written = GNUNET_IDENTITY_write_private_key_to_buffer (identity,
+                                                         buf,
+                                                         key_len);
+  GNUNET_assert (0 <= written);
+  buf += written;
+  GNUNET_RECLAIM_write_ticket_to_buffer (ticket,
+                                         buf,
+                                         tkt_len);
   if (NULL != h->mq)
   {
     GNUNET_MQ_send (h->mq, op->env);
@@ -1694,5 +1737,78 @@ GNUNET_RECLAIM_ticket_revoke (
   return op;
 }
 
+size_t
+GNUNET_RECLAIM_ticket_serialize_get_size (const struct
+                                          GNUNET_RECLAIM_Ticket *tkt)
+{
+  size_t size = sizeof (tkt->rnd);
+  size += GNUNET_IDENTITY_public_key_get_length (&tkt->identity);
+  size += GNUNET_IDENTITY_public_key_get_length (&tkt->audience);
+  return size;
+}
+
+enum GNUNET_GenericReturnValue
+GNUNET_RECLAIM_read_ticket_from_buffer (const void *buffer,
+                                        size_t len,
+                                        struct GNUNET_RECLAIM_Ticket *tkt,
+                                        size_t *tb_read)
+{
+  const char *tmp = buffer;
+  size_t read = 0;
+  size_t left = len;
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_read_public_key_from_buffer (tmp,
+                                                   left,
+                                                   &tkt->identity,
+                                                   &read))
+    return GNUNET_SYSERR;
+  left -= read;
+  tmp += read;
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_read_public_key_from_buffer (tmp,
+                                                   left,
+                                                   &tkt->audience,
+                                                   &read))
+    return GNUNET_SYSERR;
+  left -= read;
+  tmp += read;
+  if (left < sizeof (tkt->rnd))
+    return GNUNET_SYSERR;
+  memcpy (&tkt->rnd, tmp, sizeof (tkt->rnd));
+  *tb_read = tmp - (char*) buffer + sizeof (tkt->rnd);
+  return GNUNET_OK;
+}
+
+
+ssize_t
+GNUNET_RECLAIM_write_ticket_to_buffer (const struct
+                                       GNUNET_RECLAIM_Ticket *tkt,
+                                       void *buffer,
+                                       size_t len)
+{
+  char *tmp = buffer;
+  size_t left = len;
+  ssize_t written = 0;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&tkt->identity,
+                                                        buffer,
+                                                        left);
+  if (0 > written)
+    return written;
+  left -= written;
+  tmp += written;
+  written = GNUNET_IDENTITY_write_public_key_to_buffer (&tkt->audience,
+                                                        tmp,
+                                                        left);
+  if (0 > written)
+    return written;
+  left -= written;
+  tmp += written;
+  if (left < sizeof (tkt->rnd))
+    return -1;
+  memcpy (tmp, &tkt->rnd, sizeof (tkt->rnd));
+  return tmp - (char*) buffer + sizeof (tkt->rnd);
+}
+
+
 
 /* end of reclaim_api.c */
diff --git a/src/reclaim/test_did_helper.c b/src/reclaim/test_did_helper.c
index 698edf180..446c199fc 100644
--- a/src/reclaim/test_did_helper.c
+++ b/src/reclaim/test_did_helper.c
@@ -78,8 +78,9 @@ test_GNUNET_DID_did_to_pkey ()
   DID_did_to_pkey ((char *) test_did, &pkey);
 
   GNUNET_assert (test_pkey.type = pkey.type);
-  GNUNET_assert (strcmp (pkey.eddsa_key.q_y,
-                         test_pkey.eddsa_key.q_y) == 0);
+  GNUNET_assert (memcmp (&pkey.eddsa_key,
+                         &test_pkey.eddsa_key,
+                         sizeof (test_pkey.eddsa_key)) == 0);
 }
 
 // void
diff --git a/src/reclaim/test_reclaim.conf b/src/reclaim/test_reclaim.conf
index 2dc53fe81..faa195ae1 100644
--- a/src/reclaim/test_reclaim.conf
+++ b/src/reclaim/test_reclaim.conf
@@ -13,9 +13,13 @@ PREFIX = valgrind --leak-check=full --track-origins=yes --log-file=$GNUNET_TMP/r
 [transport]
 PLUGINS =
 
+[zonemaster]
+START_ON_DEMAND = YES
+IMMEDIATE_START = YES
+
 [reclaim]
 START_ON_DEMAND = YES
-TICKET_REFRESH_INTERVAL = 30 s
+TICKET_REFRESH_INTERVAL = 1 h
 #PREFIX = valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --log-file=$GNUNET_TMP/idplog
 
 [gns]
diff --git a/src/reclaim/test_reclaim_attribute.sh b/src/reclaim/test_reclaim_attribute.sh
index 744c898ed..17f7863d4 100755
--- a/src/reclaim/test_reclaim_attribute.sh
+++ b/src/reclaim/test_reclaim_attribute.sh
@@ -29,7 +29,7 @@ gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
-gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf > /dev/null 2>&1
+gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 if test $? != 0
 then
   echo "Failed."
diff --git a/src/reclaim/test_reclaim_consume.sh b/src/reclaim/test_reclaim_consume.sh
index c012862c3..8a88136c6 100755
--- a/src/reclaim/test_reclaim_consume.sh
+++ b/src/reclaim/test_reclaim_consume.sh
@@ -25,6 +25,7 @@ which timeout >/dev/null 2>&1 && DO_TIMEOUT="timeout 30"
 TEST_ATTR="test"
 gnunet-arm -s -c test_reclaim.conf
 #gnunet-arm -i rest -c test_reclaim.conf
+gnunet-arm -I
 gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 SUBJECT_KEY=$(gnunet-identity -d -e rpego -q -c test_reclaim.conf)
@@ -32,7 +33,10 @@ TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
 gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
 gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 TICKET=$(gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c test_reclaim.conf | awk '{print $1}')
-gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf #>/dev/null 2>&1
+gnunet-namestore -z testego -D -c test_reclaim.conf
+gnunet-identity -d -c test_reclaim.conf
+sleep 1
+gnunet-reclaim -e rpego -C $TICKET -c test_reclaim.conf
 
 RES=$?
 gnunet-identity -D testego -c test_reclaim.conf
diff --git a/src/reclaim/test_reclaim_issue.sh b/src/reclaim/test_reclaim_issue.sh
index cfddc9407..63140e54c 100755
--- a/src/reclaim/test_reclaim_issue.sh
+++ b/src/reclaim/test_reclaim_issue.sh
@@ -29,8 +29,8 @@ gnunet-identity -C testego -c test_reclaim.conf
 gnunet-identity -C rpego -c test_reclaim.conf
 SUBJECT_KEY=$(gnunet-identity -d -e rpego -q -c test_reclaim.conf)
 TEST_KEY=$(gnunet-identity -d -e testego -q -c test_reclaim.conf)
-gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf > /dev/null 2>&1
-gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf > /dev/null 2>&1
+gnunet-reclaim -e testego -a email -V john@doe.gnu -c test_reclaim.conf
+gnunet-reclaim -e testego -a name -V John -c test_reclaim.conf
 #gnunet-reclaim -e testego -D -c test_reclaim.conf
 gnunet-reclaim -e testego -i "email,name" -r $SUBJECT_KEY -c test_reclaim.conf > /dev/null 2>&1
 if test $? != 0