109 files changed, 5768 insertions, 4349 deletions

diff --git a/.gitmodules b/.gitmodules
index 9773fb9d7..752738003 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
-[submodule "contrib/build-common"]
-        path = contrib/build-common
-        url = https://git.taler.net/build-common.git
+[submodule "contrib/gana"]
+        path = contrib/gana
+        url = git://git.gnunet.org/gana.git
diff --git a/ChangeLog b/ChangeLog
index c347c141d..bf3f089bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,227 @@
-Wed, 1 Sep 2021 10:28:09 +0200 (d51000320)
-add fix for GNUnet directory permissions by madmurphy - Christian Grothoff
+Tue, 21 Dec 2021 15:27:27 +0100 (ff714cca7)
+changed derive_secrets API - Gian Demarmels
+
+Mon, 20 Dec 2021 10:59:42 +0100 (ed65e2cac)
+BUILD: Kill build-common - Martin Schanzenbach
+
+Mon, 20 Dec 2021 10:23:14 +0100 (511058f7e)
+DOCUMENTATION: Fix link to tutorial - Martin Schanzenbach
+
+Thu, 16 Dec 2021 17:48:38 +0100 (4ec4cc9bd)
+fix GNUNET_PQ_result_spec_timestamp_nbo - Christian Grothoff
+
+Thu, 16 Dec 2021 12:51:02 +0100 (a062e1241)
+tolerate old style values (for now) - Christian Grothoff
+
+Wed, 15 Dec 2021 13:18:24 +0100 (8faf7660d)
+enable v10 backwards compatibility - Christian Grothoff
+
+Tue, 14 Dec 2021 15:59:07 +0100 (99779b455)
+introducing GNUNET_TIME_Timestamp - Christian Grothoff
+
+Mon, 6 Dec 2021 22:44:14 +0100 (67b56e366)
+add crypto_cs testing and benchmark - Lucien Heuzeveldt
+
+Mon, 6 Dec 2021 22:13:35 +0100 (2bcdfc2f9)
+add crypto_cs implementation - Lucien Heuzeveldt
+
+Mon, 6 Dec 2021 14:20:25 +0100 (1816cee64)
+fixed timeout for netjail tests, removed duplicated function declaration from header, using GNUNET_TESTING_get_trait_batch_cmds in loop, fixed tng service shutdown logic, added missing GNUNET_SERVICE_client_continue, changed default log level for udp backchannel test to debug - t3sserakt
+
+Mon, 6 Dec 2021 10:14:03 +0100 (7a7f3d5e0)
+propose barrier API - Christian Grothoff
+
+Mon, 6 Dec 2021 10:05:04 +0100 (41f26e067)
+propose barrier API - Christian Grothoff
+
+Mon, 6 Dec 2021 10:04:34 +0100 (a388fd600)
+propose barrier API - Christian Grothoff
+
+Sun, 5 Dec 2021 11:58:45 +0100 (2266d4614)
+add bool type to libgnunetpq - Christian Grothoff
+
+Fri, 3 Dec 2021 22:27:46 +0100 (f236a1f38)
+ABD: Fix build - Martin Schanzenbach
+
+Fri, 3 Dec 2021 18:22:15 +0100 (0d7bbcd3a)
+DHT: Update wire formats. - Martin Schanzenbach
+
+Fri, 3 Dec 2021 18:14:38 +0100 (a0b8084ca)
+DHT: Remove unused processing option - Martin Schanzenbach
+
+Tue, 30 Nov 2021 16:14:35 +0100 (f80d6d695)
+ignore prepared statement failures if statement is already known to enable connection pooling - Christian Grothoff
+
+Fri, 26 Nov 2021 13:11:47 +0100 (9792ef1c3)
+make LE optional - Christian Grothoff
+
+Fri, 26 Nov 2021 07:03:17 -0500 (c384f7784)
+No longer require libextractor at configure time - Thien-Thi Nguyen
+
+Fri, 26 Nov 2021 09:17:35 +0100 (b1bb98f8b)
+make sudo non-interactive - Christian Grothoff
+
+Thu, 25 Nov 2021 23:50:13 +0100 (04166afcb)
+fix configure.ac issues with autoconf 2.69 - Christian Grothoff
+
+Thu, 25 Nov 2021 23:38:58 +0100 (2a52d39a2)
+help fixing #7105 - Christian Grothoff
+
+Thu, 25 Nov 2021 14:38:48 +0100 (63854ee52)
+add pk invariant check - Christian Grothoff
+
+Thu, 25 Nov 2021 14:03:04 +0100 (b9644ee30)
+fix event loop subscriptions on DB reconnect - Christian Grothoff
+
+Tue, 23 Nov 2021 12:31:18 +0100 (5cb62b557)
+RECLAIM: Fix bug that multiple attributes with the same name are added in CLI - Martin Schanzenbach
+
+Sun, 21 Nov 2021 16:14:29 +0100 (3dbb45893)
+Fix gnunet-namestore's URI import - Alessio Vanni
+
+Sun, 21 Nov 2021 17:25:50 +0100 (71d0c6696)
+update FR translation - Christian Grothoff
+
+Thu, 11 Nov 2021 00:56:30 +0100 (20ffa0aa5)
+Update configure.ac and a few macros used by it - Alessio Vanni
+
+Fri, 5 Nov 2021 22:52:53 +0100 (d744d49e1)
+Allow gnunet-qr to read codes from PNG pictures - Alessio Vanni
+
+Sun, 21 Nov 2021 17:25:50 +0100 (71d0c6696)
+update FR translation - Christian Grothoff
+
+Thu, 14 Oct 2021 21:22:40 +0200 (48ccb35c9)
+Improve gnunet-bcd and update logo used in generated cards - Alessio Vanni
+
+Sat, 20 Nov 2021 23:22:19 +0100 (1dcc14eca)
+update fr.po - Christian Grothoff
+
+Sat, 20 Nov 2021 02:27:34 -0500 (9f0a9deef)
+Convert AC_HELP_STRING to AS_HELP_STRING - Thien-Thi Nguyen
+
+Sat, 20 Nov 2021 01:41:02 -0500 (0390da9dd)
+Convert indirect ‘AC_CHECK_FUNCS’ call to direct one - Thien-Thi Nguyen
+
+Sat, 20 Nov 2021 01:31:24 -0500 (b04f9f7a7)
+Remove unnecessary double-quotes escaping - Thien-Thi Nguyen
+
+Sat, 20 Nov 2021 01:24:05 -0500 (73550ea6e)
+Remove m4-quoting from AC_CHECK_FUNCS arg - Thien-Thi Nguyen
 
-Mon, 30 Aug 2021 09:35:40 +0200 (9eb417e72)
-exec' - Christian Grothoff
+Wed, 17 Nov 2021 08:38:55 +0100 (c5a7ce5d2)
+subscribes are not reference counted by postgres, only subscribe/unsubscribe once per connection - Christian Grothoff
+
+Thu, 28 Oct 2021 13:32:17 +0200 (6a642f8f6)
+add logging for DB perf analysis - Christian Grothoff
+
+Mon, 25 Oct 2021 14:49:05 +0200 (1609d627e)
+changes to reflect the changes in testing_api_loop.c - t3sserakt
+
+Mon, 25 Oct 2021 11:23:26 +0200 (196b6bc57)
+debian: fix path again - Florian Dold
+
+Mon, 25 Oct 2021 10:40:33 +0200 (61dd07223)
+debian: fix libexec path - Florian Dold
+
+Tue, 19 Oct 2021 13:59:42 +0200 (789268e1b)
+kdf: zero out salt correctly - Florian Dold
+
+Mon, 11 Oct 2021 17:08:46 +0200 (d190d2383)
+fixed unset port forwarding variable bug in netjail script, fixed end cmd without shutdown bug, smaller fixes - t3sserakt
+
+Tue, 19 Oct 2021 13:55:28 +0200 (2e2abc61d)
+make KDF conform to RFC 5869 - Florian Dold
+
+Thu, 14 Oct 2021 16:39:24 +0200 (d64ac2698)
+removed versioned artefacts with v2 and v3. changes to reflect the changes in testing_api_loop.c - t3sserakt
+
+Tue, 12 Oct 2021 10:04:50 +0200 (8ac2a05b3)
+BUILD: Kill infiniband - Martin Schanzenbach
+
+Tue, 12 Oct 2021 08:34:21 +0200 (786210216)
+BUILD: Attempt fix longer file names in make dist - Martin Schanzenbach
+
+Mon, 11 Oct 2021 23:56:12 +0200 (113cd7e3d)
+BUILD: Remove --disable-mysql-version-check. #7033 - Martin Schanzenbach
+
+Mon, 11 Oct 2021 23:43:04 +0200 (4e7e81f4d)
+BUILD: Remove --disable-testing. Issue #7033 - Martin Schanzenbach
+
+Mon, 11 Oct 2021 23:28:17 +0200 (65554324a)
+BUILD: Remove W32 ifdef - Martin Schanzenbach
+
+Mon, 11 Oct 2021 23:01:22 +0200 (41e8c1e21)
+BUILD: Remove EXPENSIVE_TESTS (unused). Issue #7033 - Martin Schanzenbach
+
+Mon, 11 Oct 2021 17:08:46 +0200 (d190d2383)
+fixed unset port forwarding variable bug in netjail script, fixed end cmd without shutdown bug, smaller fixes - t3sserakt
+
+Mon, 11 Oct 2021 16:30:12 +0200 (62ca5edd0)
+BUILD: Remove SuperMUC code. Issue #7033 - Martin Schanzenbach
+
+Sat, 9 Oct 2021 14:20:18 +0200 (ae41c8bcd)
+BUILD: Add version from git tags - Martin Schanzenbach
+
+Wed, 6 Oct 2021 18:53:37 +0200 (6ef071b8c)
+fix #7029 - Christian Grothoff
+
+Mon, 4 Oct 2021 21:07:21 +0000 (e173017ed)
+Fix some typos in the handbook - Christian Grothoff
+
+Mon, 4 Oct 2021 22:30:21 +0200 (961685fab)
+add missing finish cmd - Christian Grothoff
+
+Thu, 23 Sep 2021 22:52:44 +0200 (1aa0d5f34)
+PQ: implementing #7014: support testing database version is current - Christian Grothoff
+
+Wed, 22 Sep 2021 20:32:39 +0200 (369f0a0e8)
+The differences between the contrib subdirectory in the git repository and the contrib subdirectory generated by make dist have grown really big. Please find attached another patch for updating the content of: - Christian Grothoff
+
+Wed, 22 Sep 2021 11:39:25 +0200 (81d925587)
+NSE: return NaN (see #7021) - Christian Grothoff
+
+Wed, 22 Sep 2021 11:35:46 +0200 (7bf37b7ea)
+NSE: return INF, not NaN (fixes #7021) - Christian Grothoff
+
+Thu, 16 Sep 2021 22:51:28 +0200 (fc9ca33bc)
+fix typos spotted by madmurphy - Christian Grothoff
+
+Fri, 10 Sep 2021 16:38:35 +0200 (46e07ed8e)
+Include "gettext.h" even when "platform.h" is unavailable - Alessio Vanni
+
+Sun, 5 Sep 2021 22:21:40 +0200 (3da9cbd62)
+BUILD: Remove FRAMEWORK_BUILD define - Martin Schanzenbach
+
+Sun, 5 Sep 2021 18:27:53 +0200 (f9f3cbe9f)
+make backend-check a gnunet-only gnunet-config option - Christian Grothoff
+
+Sun, 5 Sep 2021 16:58:55 +0200 (b4e034d9a)
+refactor gnunet-config to make preload hacks obsolete - Christian Grothoff
+
+Fri, 3 Sep 2021 18:21:28 +0200 (00c03c7bb)
+HANDBOOK: Add pointers to CI - Martin Schanzenbach
+
+Tue, 31 Aug 2021 16:09:03 +0200 (25d8a8a26)
+Flip the value of GNUNET_EXTRA_LOGGING given when it's undefined - Alessio Vanni
+
+Tue, 31 Aug 2021 15:54:43 +0200 (382fc8faa)
+gnunet.m4: add flag to disable debug messages - Alessio Vanni
+
+Tue, 27 Jul 2021 16:27:14 +0200 (649d10b27)
+Autoconf macro to detect GNUnet installations - Alessio Vanni
+
+Sat, 24 Jul 2021 16:15:10 +0200 (9bdfda437)
+gnunet-config manpage: Document the new flags - Alessio Vanni
+
+Fri, 23 Jul 2021 18:20:33 +0200 (fd1bcccb9)
+UTIL: Allow gnunet-config to output build config informations - Alessio Vanni
+
+Wed, 1 Sep 2021 10:28:09 +0200 (d51000320)
+UTIL: add fix for GNUnet directory permissions by madmurphy - Christian Grothoff
 
 Sat, 28 Aug 2021 21:50:06 +0200 (2994fa434)
-improve error message and inherit stderr as suggested by Florian - Christian Grothoff
+UTIL: improve error message and inherit stderr as suggested by Florian - Christian Grothoff
 
 Sat, 28 Aug 2021 18:42:53 +0200 (c6528ac77)
 debian: systemd installation - Florian Dold
diff --git a/Makefile.am b/Makefile.am
index 9191107d2..30cc02bc9 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -73,3 +73,14 @@ if HAVE_AWK
 check-texinfo:
         @cd $(top_srcdir); find . -type f ! -path '*/.*' -name '*.texi' -print0 | xargs -0 ./contrib/scripts/check-texinfo.awk > $(srcdir)/texinfo_lint.log || true
 endif
+
+gana: gana-gns gana-gnunet-signatures
+
+gana-gns:
+        @cd $(top_srcdir)/contrib/gana/gnu-name-system-record-types; make; cp gnu_name_system_record_types.h ../../../src/include/
+        @cd $(top_srcdir)/contrib/gana/gnu-name-system-default-tlds; make; cp tlds.conf ../../../src/gns
+
+gana-gnunet-signatures:
+        @cd $(top_srcdir)/contrib/gana/gnunet-signatures; make; cp gnunet_signatures.h ../../../src/include
+
+
diff --git a/bootstrap b/bootstrap
index 984c56cb3..766eed237 100755
--- a/bootstrap
+++ b/bootstrap
@@ -40,8 +40,8 @@ check_uncrustify()
 {
     if existence uncrustify; then
         echo "Installing uncrustify hook and configuration"
-        ln -fs contrib/build-common/conf/uncrustify.cfg uncrustify.cfg 2> /dev/null
-        ln -fs contrib/build-common/conf/uncrustify_precommit .git/hooks/pre-commit 2> /dev/null
+        ln -fs contrib/conf/uncrustify.cfg uncrustify.cfg 2> /dev/null
+        ln -fs contrib/conf/uncrustify_precommit .git/hooks/pre-commit 2> /dev/null
     else
         echo "Uncrustify not detected, hook not installed."
         echo "Please install uncrustify if you plan on doing development"
@@ -65,7 +65,7 @@ check_yapf()
        existence yapf3.9 || \
        existence yapf4.0; then
         echo "Installing yapf symlink"
-        ln -fs contrib/build-common/conf/.style.yapf .style.yapf 2> /dev/null
+        ln -fs contrib/conf/.style.yapf .style.yapf 2> /dev/null
     else
         echo "yapf not detected, please install yapf if you plan on contributing python code"
     fi
@@ -98,21 +98,43 @@ submodules()
         echo "git not installed, skipping submodule update"
     else
         git submodule update --init || exit 1
-        git submodule update --recursive || exit 1
+        git submodule update --remote --recursive || exit 1
         git submodule sync || exit 1
     fi
 }
 
-init_buildcommon_include()
+gana_update()
 {
-    cp contrib/build-common/Makefile.inc contrib/Makefile.inc || exit 1
+    if existence recfmt; then
+      cwd=$PWD
+      cd contrib/gana || exit 1
+      # GNS
+      cd gnu-name-system-record-types && \
+         make && \
+         cp gnu_name_system_record_types.h ../../../src/include/ && \
+         make clean
+      cd ../gnu-name-system-default-tlds && \
+         make && \
+         cp tlds.conf ../../../src/gns && \
+         make clean
+
+      # Signatures
+      cd ../gnunet-signatures && \
+         make && \
+         cp gnunet_signatures.h ../../../src/include && \
+         make clean
+      cd $cwd
+    else
+      echo "ERROR: No recutils found! Unable to generate recent GANA headers and configs."
+      exit 1
+    fi
 }
 
 main()
 {
     cleanup
     submodules
-    init_buildcommon_include
+    gana_update
     check_uncrustify
     check_yapf
     check_libtool
diff --git a/configure.ac b/configure.ac
index 1e5ba403f..feee06f9f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1232,9 +1232,11 @@ AC_SUBST([JAVAPORT])
 AC_ARG_ENABLE([experimental],
   [AS_HELP_STRING([--enable-experimental],
                   [enable experimental code paths (default is no)])],
-  [enable_experimental="${enableval}"]
-  [enable_experimental="no"])
-AM_CONDITIONAL([HAVE_EXPERIMENTAL], [test "x$enable_experimental" = "xyes"])
+  [AS_IF([test "x$enableval" = "xno"],
+         [enable_experimental=0],
+         [enable_experimental=1])],
+  [enable_experimental=0])
+AM_CONDITIONAL([HAVE_EXPERIMENTAL], [test "x$enable_experimental" = "x1"])
 
 # check if malicious code should be compiled (for testing)
 AC_ARG_ENABLE([malicious],
@@ -1437,6 +1439,7 @@ src/zonemaster/Makefile
 src/zonemaster/zonemaster.conf
 src/rest/Makefile
 src/abd/Makefile
+src/abd/abd.conf
 src/abe/Makefile
 src/reclaim/Makefile
 src/messenger/Makefile
@@ -1489,13 +1492,13 @@ AS_IF([test "x$enable_java_ports" = "xyes"],
   [java_msg="no"])
 
 # experimental code is enabled
-AS_IF([test "x$enable_experimental" = "xyes"],
+AS_IF([test "x$enable_experimental" = "x1"],
   [experimental_msg="yes"],
   [experimental_msg="no"])
 
 # experimental code for transport is enabled
 transport_msg="tcp udp unix http"
-AS_IF([test "x$build_target" = "xlinux" && test "x$enable_experimental" = "xyes"],
+AS_IF([test "x$build_target" = "xlinux" && test "x$enable_experimental" = "x1"],
   [transport_msg="tcp udp unix http wlan"])
 
 # libidn version
diff --git a/contrib/Makefile.am b/contrib/Makefile.am
index e0370d3c9..4e7928c7e 100644
--- a/contrib/Makefile.am
+++ b/contrib/Makefile.am
@@ -32,8 +32,7 @@ dist_pkgdata_DATA = \
   netjail/netjail_exec.sh \
   netjail/netjail_start.sh \
   netjail/netjail_stop.sh \
-  netjail/topo.sh \
-  $(BUILDCOMMON_SHLIB_FILES)
+  netjail/topo.sh
 
 INITD_FILES = \
   services/systemd/gnunet-user.service \
@@ -221,8 +220,7 @@ EXTRA_DIST = \
   patches/lrn-indent.diff \
   test_gnunet_prefix.c \
   $(PACKAGES_FILES) \
-  $(INITD_FILES) \
-  $(BUILD_COMMON_FILES)
+  $(INITD_FILES)
 
 check_PROGRAMS = \
   test_gnunet_prefix
diff --git a/contrib/build-common b/contrib/build-common
deleted file mode 160000
-Subproject 1915a74bbb4cd2ae9bc541a382dfebc37064a2f
diff --git a/contrib/conf/uncrustify.cfg b/contrib/conf/uncrustify.cfg
index 8c9df2c43..6ced05d7a 100644
--- a/contrib/conf/uncrustify.cfg
+++ b/contrib/conf/uncrustify.cfg
@@ -4,7 +4,7 @@ output_tab_size = 2
 indent_columns = 2
 indent_with_tabs = 0
 indent_case_brace = 2
-indent_label=-16
+indent_label=0
 
 code_width=80
 #cmd_width=80
@@ -49,12 +49,8 @@ nl_assign_brace=remove
 
 # No extra newlines that cause noisy diffs
 nl_start_of_file=remove
-nl_after_func_proto = 2
-nl_after_func_body = 3
 # If there's no new line, it's not a text file!
 nl_end_of_file=add
-nl_max_blank_in_func = 3
-nl_max = 3
 
 sp_inside_paren = remove
 
@@ -73,7 +69,6 @@ sp_between_ptr_star = remove
 sp_before_sparen = add
 
 sp_inside_fparen = remove
-sp_inside_sparen = remove
 
 # add space before function call and decl: "foo (x)"
 sp_func_call_paren = add
@@ -81,15 +76,3 @@ sp_func_proto_paren = add
 sp_func_proto_paren_empty = add
 sp_func_def_paren = add
 sp_func_def_paren_empty = add
-
-# We'd want it for "if ( (foo) || (bar) )", but not for "if (m())",
-# so as uncrustify doesn't give exactly what we want => ignore
-sp_paren_paren = ignore
-sp_inside_paren = remove
-sp_bool = force
-
-nl_func_type_name = force
-#nl_branch_else = add
-nl_else_brace = add
-nl_elseif_brace = add
-nl_for_brace = add
diff --git a/contrib/conf/uncrustify_precommit b/contrib/conf/uncrustify_precommit
index 24873330f..fd29998c3 100755
--- a/contrib/conf/uncrustify_precommit
+++ b/contrib/conf/uncrustify_precommit
@@ -30,6 +30,6 @@ if [ $RET = 1 ];
 then
   echo "Run"
   echo "uncrustify --no-backup -c uncrustify.cfg ${crustified}"
-  echo "before committing."
+  echo "before commiting."
 fi
 exit $RET
diff --git a/contrib/gana b/contrib/gana
new file mode 160000
+Subproject 9b8a787580307cea5a38359c485d521cd8ece82
diff --git a/doc/handbook/chapters/developer.texi b/doc/handbook/chapters/developer.texi
index a8f9d1ec3..e3ff20dcd 100644
--- a/doc/handbook/chapters/developer.texi
+++ b/doc/handbook/chapters/developer.texi
@@ -96,7 +96,7 @@ introduction, each of the GNUnet subsystems (directories in the
 addition to this documentation, GNUnet developers should be aware of the
 services available on the GNUnet server to them.
 
-New developers can have a look a the @uref{https://docs.gnunet.org/tutorial/gnunet-tutorial.html, GNUnet C tutorial}.
+New developers can have a look a the @uref{https://docs.gnunet.org/tutorial/tutorial.html, GNUnet C tutorial}.
 
 @c ** FIXME: Link to files in source, not online.
 @c ** FIXME: Where is the Java tutorial?
diff --git a/doc/man/gnunet-identity.1 b/doc/man/gnunet-identity.1
index 599d3b269..835dfb225 100644
--- a/doc/man/gnunet-identity.1
+++ b/doc/man/gnunet-identity.1
@@ -26,7 +26,7 @@
 .Os
 .Sh NAME
 .Nm gnunet-identity
-.Nd create, delete or list egos
+.Nd maintain (create, delete or list) or perform actions with egos
 .Sh SYNOPSIS
 .Nm
 .Op Fl C Ar NAME | Fl -create= Ns Ar NAME
@@ -34,11 +34,14 @@
 .Op Fl d | -display
 .Op Fl e Ar NAME | Fl -ego= Ns Ar NAME
 .Op Fl h | -help
+.Op Fl k Ar PUBLIC_KEY | Fl -key= Ns Ar PUBLIC_KEY
 .Op Fl m | -monitor
 .Op Fl p | -private-keys
 .Op Fl q | -quiet
+.Op Fl R Ar MESSAGE | Fl -read= Ns Ar MESSAGE
 .Op Fl s Ar SUBSYSTEM | Fl -set= Ns Ar SUBSYSTEM
 .Op Fl V | -verbose
+.Op Fl W Ar MESSAGE | Fl -write= Ns Ar MESSAGE
 .Op Fl X | -eddsa
 .Sh DESCRIPTION
 .Nm
@@ -51,6 +54,9 @@ created locally, to create new egos, and to delete
 existing egos (the namespace will continue to exist, but it will
 be impossible to add additional data to it).
 .Pp
+In addition, it is possible to encrypt and decrypt messages (arbitrary strings)
+using a given public key (for encryption) or ego (for decryption).
+.Pp
 Creating a new ego requires using the
 .Fl C
 option together with an identifier (name) that is to be used for
@@ -72,6 +78,11 @@ Perform "set" operation with the respective ego or restrict "display"
 operation to the respective ego.
 .It Fl h | -help
 Print the help page.
+.It Fl k Ar PUBLIC_KEY | Fl -key= Ns Ar PUBLIC_KEY
+The public key to use for a message recipient. Use together with
+.Fl W .
+The recipient can obtain the desired ego's public key using the "display"
+operation.
 .It Fl m | -monitor
 Run in monitor mode, listing all ouf our egos until CTRL-C is pressed.
 Each ego is listed together with a unique pointer value; if
@@ -83,6 +94,12 @@ keys. The second column shows the public key, the third column shows the
 private key.
 .It Fl q | -quiet
 Be quiet, in particular outputs only the public key when listing egos.
+.It Fl R Ar MESSAGE | Fl -read= Ns Ar MESSAGE
+Decrypt (read) a message using the respective ego private key. Use together with
+.Fl e .
+The message consists of an ephemeral key and the ciphertext, separated by a dot.
+Such messages can be created with
+.Fl W .
 .It Fl s Ar SUBSYSTEM | Fl -set= Ns Ar SUBSYSTEM
 Perform "set" operation for the specified
 .Ar SUBSYSTEM
@@ -95,6 +112,13 @@ This will fail if
 does not yet exist.
 .It Fl V | -verbose
 Be verbose, in particular outputs the public key of freshly created egos.
+.It Fl W Ar MESSAGE | Fl -write= Ns Ar MESSAGE
+Encrypt (write) the given message for the identity given with
+.Fl k .
+The output contains an ephemeral message public key and the message separated
+by a dot. The entire line needs to be transferred to the recipient, who can use
+.Fl R
+to decrypt the message.
 .It Fl X | -eddsa
 Use EdDSA instead of ECDSA.
 .El
diff --git a/doc/man/produce_html.sh.in b/doc/man/produce_html.sh.in
index 8680c0106..e9581622f 100755
--- a/doc/man/produce_html.sh.in
+++ b/doc/man/produce_html.sh.in
@@ -1,13 +1,6 @@
 #!/bin/bash
 
-if test -e @PKGDATADIRECTORY@/existence.sh
-then
-    . @PKGDATADIRECTORY@/existence.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/existence.sh
-fi
-
-if existence mandoc;
+if command -v mandoc >/dev/null 2>&1;
 then
     for f in `find . -name \*\.[1-9]`;
     do
diff --git a/po/POTFILES.in b/po/POTFILES.in
index 60f758590..b456f2ad3 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -523,6 +523,7 @@ src/util/container_multishortmap.c
 src/util/container_multiuuidmap.c
 src/util/crypto_abe.c
 src/util/crypto_crc.c
+src/util/crypto_cs.c
 src/util/crypto_ecc.c
 src/util/crypto_ecc_dlog.c
 src/util/crypto_ecc_gnsrecord.c
diff --git a/src/abd/Makefile.am b/src/abd/Makefile.am
index 304469e22..ae9248b43 100644
--- a/src/abd/Makefile.am
+++ b/src/abd/Makefile.am
@@ -3,7 +3,9 @@ AM_CPPFLAGS = -I$(top_srcdir)/src/include
 
 EXTRA_DIST = \
   test_abd_defaults.conf \
-  test_abd_lookup.conf
+  test_abd_lookup.conf \
+  $(check_SCRIPTS) \
+  $(pkgdata_DATA)
 
 
 if USE_COVERAGE
@@ -51,6 +53,7 @@ libgnunet_plugin_gnsrecord_abd_la_SOURCES = \
 libgnunet_plugin_gnsrecord_abd_la_LIBADD = \
         libgnunetabd.la \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(LTLIBINTL)
 libgnunet_plugin_gnsrecord_abd_la_LDFLAGS = \
  $(GN_PLUGIN_LDFLAGS)
@@ -64,6 +67,7 @@ gnunet_service_abd_LDADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
         $(top_builddir)/src/gns/libgnunetgns.la \
         $(top_builddir)/src/namestore/libgnunetnamestore.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(top_builddir)/src/statistics/libgnunetstatistics.la \
   $(GN_LIBINTL)
 
diff --git a/src/abd/abd_serialization.c b/src/abd/abd_serialization.c
index 4c219d791..2ed24ff2f 100644
--- a/src/abd/abd_serialization.c
+++ b/src/abd/abd_serialization.c
@@ -191,8 +191,8 @@ GNUNET_ABD_delegates_serialize (
   off = 0;
   for (i = 0; i < c_count; i++)
   {
-    // c_rec.subject_attribute_len = htonl ((uint32_t) cd[i].subject_attribute_len);
-    c_rec.issuer_attribute_len = htonl ((uint32_t) cd[i].issuer_attribute_len);
+    c_rec.subject_attribute_len = htonl (cd[i].subject_attribute_len);
+    c_rec.issuer_attribute_len = htonl (cd[i].issuer_attribute_len);
     c_rec.issuer_key = cd[i].issuer_key;
     c_rec.subject_key = cd[i].subject_key;
     c_rec.signature = cd[i].signature;
diff --git a/src/abd/delegate_misc.c b/src/abd/delegate_misc.c
index d67b40088..0c5520d52 100644
--- a/src/abd/delegate_misc.c
+++ b/src/abd/delegate_misc.c
@@ -143,10 +143,20 @@ GNUNET_ABD_delegate_from_string (const char *s)
   }
   tmp_str[attr_len - 1] = '\0';
 
-  GNUNET_IDENTITY_public_key_from_string (subject_pkey,
-                                              &dele->subject_key);
-  GNUNET_IDENTITY_public_key_from_string (issuer_pkey,
-                                              &dele->issuer_key);
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_public_key_from_string (subject_pkey,
+                                              &dele->subject_key))
+  {
+    GNUNET_free (dele);
+    return NULL;
+  }
+  if (GNUNET_SYSERR ==
+      GNUNET_IDENTITY_public_key_from_string (issuer_pkey,
+                                              &dele->issuer_key))
+  {
+    GNUNET_free (dele);
+    return NULL;
+  }
   GNUNET_assert (sizeof (struct GNUNET_IDENTITY_Signature) ==
                  GNUNET_STRINGS_base64_decode (signature,
                                                strlen (signature),
diff --git a/src/abd/gnunet-abd.c b/src/abd/gnunet-abd.c
index 17671273c..cf3733abd 100644
--- a/src/abd/gnunet-abd.c
+++ b/src/abd/gnunet-abd.c
@@ -544,6 +544,10 @@ static void
 store_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 {
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct GNUNET_ABD_Delegate *cred;
+  struct GNUNET_IDENTITY_PublicKey zone_pubkey;
+  char *subject_pubkey_str;
+  char *zone_pubkey_str;
 
   el = NULL;
 
@@ -562,17 +566,23 @@ store_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   if (GNUNET_GNSRECORD_TYPE_DELEGATE == type)
   {
     // Parse import
-    struct GNUNET_ABD_Delegate *cred;
     cred = GNUNET_ABD_delegate_from_string (import);
 
+    if (NULL == cred)
+    {
+      fprintf (stderr,
+               "%s is not a valid credential\n", import);
+      GNUNET_SCHEDULER_shutdown();
+      return;
+    }
+
     // Get import subject public key string
-    char *subject_pubkey_str =
+    subject_pubkey_str =
       GNUNET_IDENTITY_public_key_to_string (&cred->subject_key);
 
     // Get zone public key string
-    struct GNUNET_IDENTITY_PublicKey zone_pubkey;
     GNUNET_IDENTITY_ego_get_public_key (ego, &zone_pubkey);
-    char *zone_pubkey_str =
+    zone_pubkey_str =
       GNUNET_IDENTITY_public_key_to_string (&zone_pubkey);
 
     // Check if the subject key in the signed import matches the zone's key it is issued to
@@ -580,6 +590,7 @@ store_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     {
       fprintf (stderr,
                "Import signed delegate does not match this ego's public key.\n");
+      GNUNET_free (cred);
       GNUNET_SCHEDULER_shutdown ();
       return;
     }
@@ -691,6 +702,13 @@ sign_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   // work on keys
   privkey = GNUNET_IDENTITY_ego_get_private_key (ego);
 
+  if (NULL == subject_pubkey_str)
+  {
+    fprintf (stderr,
+             "Subject pubkey not given\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
   if (GNUNET_OK !=
       GNUNET_IDENTITY_public_key_from_string (subject_pubkey_str,
                                                   &subject_pkey))
diff --git a/src/abd/gnunet-service-abd.c b/src/abd/gnunet-service-abd.c
index 3f9f2f924..407d5bdc3 100644
--- a/src/abd/gnunet-service-abd.c
+++ b/src/abd/gnunet-service-abd.c
@@ -512,6 +512,8 @@ send_intermediate_response (struct VerifyRequestHandle *vrh, struct
                                                  size,
                                                  (char *) &rmsg[1]));
   GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (vrh->client), env);
+
+  GNUNET_free (dd);
 }
 
 
@@ -740,12 +742,13 @@ forward_resolution (void *cls,
                     uint32_t rd_count,
                     const struct GNUNET_GNSRECORD_Data *rd)
 {
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received %d entries.\n", rd_count);
-
   struct VerifyRequestHandle *vrh;
   struct DelegationSetQueueEntry *current_set;
   struct DelegationSetQueueEntry *ds_entry;
   struct DelegationQueueEntry *dq_entry;
+  struct GNUNET_ABD_Delegate *del;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received %d entries.\n", rd_count);
 
   current_set = cls;
   // set handle to NULL (as el = NULL)
@@ -760,9 +763,11 @@ forward_resolution (void *cls,
       continue;
 
     // Start deserialize into Delegate
-    struct GNUNET_ABD_Delegate *del;
     del = GNUNET_ABD_delegate_deserialize (rd[i].data, rd[i].data_size);
 
+    if (NULL == del)
+      continue;
+
     // Start: Create DQ Entry
     dq_entry = GNUNET_new (struct DelegationQueueEntry);
     // AND delegations are not possible, only 1 solution
@@ -834,6 +839,7 @@ forward_resolution (void *cls,
                       GNUNET_IDENTITY_public_key_to_string (
                         &del->subject_key),
                       del->subject_attribute);
+          GNUNET_free (del);
           continue;
         }
         else
@@ -910,6 +916,7 @@ forward_resolution (void *cls,
           }
 
           send_lookup_response (vrh);
+          GNUNET_free (del);
           return;
         }
       }
@@ -936,6 +943,7 @@ forward_resolution (void *cls,
             GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                         "Forward: Found match with above!\n");
 
+            GNUNET_free (del);
             // one node on the path still needs solutions: return
             if (GNUNET_NO ==
                 handle_bidirectional_match (ds_entry, del_entry, vrh))
@@ -965,6 +973,7 @@ forward_resolution (void *cls,
                          GNUNET_GNS_LO_DEFAULT,
                          &forward_resolution,
                          ds_entry);
+    GNUNET_free (del);
   }
 
   if (0 == vrh->pending_lookups)
@@ -1586,34 +1595,29 @@ handle_delegate_collection_cb (void *cls,
                                const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct VerifyRequestHandle *vrh = cls;
-  struct GNUNET_ABD_Delegate *del;
   struct DelegateRecordEntry *del_entry;
-  int cred_record_count;
-  cred_record_count = 0;
   vrh->dele_qe = NULL;
 
   for (uint32_t i = 0; i < rd_count; i++)
   {
     if (GNUNET_GNSRECORD_TYPE_DELEGATE != rd[i].record_type)
       continue;
-    cred_record_count++;
-    del = GNUNET_ABD_delegate_deserialize (rd[i].data, rd[i].data_size);
-    if (NULL == del)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Invalid delegate found\n");
-      continue;
-    }
     // only add the entries that are explicitly marked as private
     // and therefore symbolize the end of a chain
-    if (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE)
+    if (0 == (rd[i].flags & GNUNET_GNSRECORD_RF_PRIVATE))
+      continue;
+    del_entry = GNUNET_new (struct DelegateRecordEntry);
+    del_entry->delegate = GNUNET_ABD_delegate_deserialize (rd[i].data, rd[i].data_size);
+    if (NULL == del_entry->delegate)
     {
-      del_entry = GNUNET_new (struct DelegateRecordEntry);
-      del_entry->delegate = del;
-      GNUNET_CONTAINER_DLL_insert_tail (vrh->del_chain_head,
-                                        vrh->del_chain_tail,
-                                        del_entry);
-      vrh->del_chain_size++;
+      GNUNET_free (del_entry);
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "Invalid delegate found\n");
+      continue;
     }
+    GNUNET_CONTAINER_DLL_insert_tail (vrh->del_chain_head,
+                                      vrh->del_chain_tail,
+                                      del_entry);
+    vrh->del_chain_size++;
   }
 
   delegate_collection_finished (vrh);
diff --git a/src/abd/plugin_gnsrecord_abd.c b/src/abd/plugin_gnsrecord_abd.c
index 24cf6a3aa..7b2f4af5b 100644
--- a/src/abd/plugin_gnsrecord_abd.c
+++ b/src/abd/plugin_gnsrecord_abd.c
@@ -207,8 +207,13 @@ abd_string_to_value (void *cls,
         matches = sscanf (token, "%s %s", subject_pkey, attr_str);
 
         // sets the public key for the set entry
-        GNUNET_IDENTITY_public_key_from_string (subject_pkey,
-                                                    &set[i].subject_key);
+        if (GNUNET_SYSERR ==
+            GNUNET_IDENTITY_public_key_from_string (subject_pkey,
+                                                    &set[i].subject_key))
+        {
+          GNUNET_free (tmp_str);
+          return GNUNET_SYSERR;
+        }
 
         // If not just key, also set subject attribute (Not A.a <- B but A.a <- B.b)
         if (2 == matches)
@@ -252,7 +257,7 @@ abd_string_to_value (void *cls,
       cred = GNUNET_ABD_delegate_from_string (s);
 
       *data_size = GNUNET_ABD_delegate_serialize (cred, (char **) data);
-
+      GNUNET_free (cred);
       return GNUNET_OK;
     }
   default:
diff --git a/src/block/block.c b/src/block/block.c
index 975c0f747..5824946f7 100644
--- a/src/block/block.c
+++ b/src/block/block.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2010, 2017 GNUnet e.V.
+     Copyright (C) 2010, 2017, 2021 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -70,13 +70,6 @@ struct GNUNET_BLOCK_Context
 };
 
 
-/**
- * Mingle hash with the mingle_number to produce different bits.
- *
- * @param in original hash code
- * @param mingle_number number for hash permutation
- * @param hc where to store the result.
- */
 void
 GNUNET_BLOCK_mingle_hash (const struct GNUNET_HashCode *in,
                           uint32_t mingle_number,
@@ -121,12 +114,6 @@ add_plugin (void *cls,
 }
 
 
-/**
- * Create a block context.  Loads the block plugins.
- *
- * @param cfg configuration to use
- * @return NULL on error
- */
 struct GNUNET_BLOCK_Context *
 GNUNET_BLOCK_context_create (const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
@@ -143,11 +130,6 @@ GNUNET_BLOCK_context_create (const struct GNUNET_CONFIGURATION_Handle *cfg)
 }
 
 
-/**
- * Destroy the block context.
- *
- * @param ctx context to destroy
- */
 void
 GNUNET_BLOCK_context_destroy (struct GNUNET_BLOCK_Context *ctx)
 {
@@ -167,17 +149,7 @@ GNUNET_BLOCK_context_destroy (struct GNUNET_BLOCK_Context *ctx)
 }
 
 
-/**
- * Serialize state of a block group.
- *
- * @param bg group to serialize
- * @param[out] nonce set to the nonce of the @a bg
- * @param[out] raw_data set to the serialized state
- * @param[out] raw_data_size set to the number of bytes in @a raw_data
- * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
- *         supported, #GNUNET_SYSERR on error
- */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_serialize (struct GNUNET_BLOCK_Group *bg,
                               uint32_t *nonce,
                               void **raw_data,
@@ -197,11 +169,6 @@ GNUNET_BLOCK_group_serialize (struct GNUNET_BLOCK_Group *bg,
 }
 
 
-/**
- * Destroy resources used by a block group.
- *
- * @param bg group to destroy, NULL is allowed
- */
 void
 GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg)
 {
@@ -211,23 +178,11 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg)
 }
 
 
-/**
- * Try merging two block groups.  Afterwards, @a bg1 should remain
- * valid and contain the rules from both @a bg1 and @bg2, and
- * @a bg2 should be destroyed (as part of this call).  The latter
- * should happen even if merging is not supported.
- *
- * @param[in,out] bg1 first group to merge, is updated
- * @param bg2 second group to merge, is destroyed
- * @return #GNUNET_OK on success,
- *         #GNUNET_NO if merge failed due to different nonce
- *         #GNUNET_SYSERR if merging is not supported
- */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_merge (struct GNUNET_BLOCK_Group *bg1,
                           struct GNUNET_BLOCK_Group *bg2)
 {
-  int ret;
+  enum GNUNET_GenericReturnValue ret;
 
   if (NULL == bg2)
     return GNUNET_OK;
@@ -257,35 +212,18 @@ static struct GNUNET_BLOCK_PluginFunctions *
 find_plugin (struct GNUNET_BLOCK_Context *ctx,
              enum GNUNET_BLOCK_Type type)
 {
-  struct Plugin *plugin;
-  unsigned int j;
-
   for (unsigned i = 0; i < ctx->num_plugins; i++)
   {
-    plugin = ctx->plugins[i];
-    j = 0;
-    while (0 != (plugin->api->types[j]))
-    {
+    struct Plugin *plugin = ctx->plugins[i];
+
+    for (unsigned int j = 0; 0 != plugin->api->types[j]; j++)
       if (type == plugin->api->types[j])
         return plugin->api;
-      j++;
-    }
   }
   return NULL;
 }
 
 
-/**
- * Create a new block group.
- *
- * @param ctx block context in which the block group is created
- * @param type type of the block for which we are creating the group
- * @param nonce random value used to seed the group creation
- * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
- * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
- * @return block group handle, NULL if block groups are not supported
- *         by this @a type of block (this is not an error)
- */
 struct GNUNET_BLOCK_Group *
 GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
                            enum GNUNET_BLOCK_Type type,
@@ -317,24 +255,6 @@ GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
 }
 
 
-/**
- * Function called to validate a reply or a request.  For
- * request evaluation, simply pass "NULL" for the reply_block.
- * Note that it is assumed that the reply has already been
- * matched to the key (and signatures checked) as it would
- * be done with the "get_key" function.
- *
- * @param ctx block contxt
- * @param type block type
- * @param block block group to use
- * @param eo control flags
- * @param query original query (hash)
- * @param xquery extended query data (can be NULL, depending on type)
- * @param xquery_size number of bytes in @a xquery
- * @param reply_block response to validate
- * @param reply_block_size number of bytes in @a reply_block
- * @return characterization of result
- */
 enum GNUNET_BLOCK_EvaluationResult
 GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
                        enum GNUNET_BLOCK_Type type,
@@ -364,18 +284,7 @@ GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
 }
 
 
-/**
- * Function called to obtain the key for a block.
- *
- * @param ctx block context
- * @param type block type
- * @param block block to get the key for
- * @param block_size number of bytes in @a block
- * @param key set to the key (query) for the given block
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
- *         (or if extracting a key from a block of this type does not work)
- */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
                       enum GNUNET_BLOCK_Type type,
                       const void *block,
@@ -385,8 +294,8 @@ GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
   struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
                                                              type);
 
-  if (plugin == NULL)
-    return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
   return plugin->get_key (plugin->cls,
                           type,
                           block,
@@ -395,18 +304,73 @@ GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
 }
 
 
-/**
- * Update block group to filter out the given results.  Note that the
- * use of a hash for seen results implies that the caller magically
- * knows how the specific block engine hashes for filtering
- * duplicates, so this API may not always apply.
- *
- * @param bf_mutator mutation value to use
- * @param seen_results results already seen
- * @param seen_results_count number of entries in @a seen_results
- * @return #GNUNET_SYSERR if not supported, #GNUNET_OK on success
- */
-int
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
+  return plugin->check_query (plugin->cls,
+                              type,
+                              query,
+                              xquery,
+                              xquery_size);
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *block,
+                          size_t block_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_SYSERR;
+  return plugin->check_block (plugin->cls,
+                              type,
+                              query,
+                              block,
+                              block_size);
+}
+
+
+enum GNUNET_BLOCK_ReplyEvaluationResult
+GNUNET_BLOCK_check_reply (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          struct GNUNET_BLOCK_Group *group,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size,
+                          const void *reply_block,
+                          size_t reply_block_size)
+{
+  struct GNUNET_BLOCK_PluginFunctions *plugin = find_plugin (ctx,
+                                                             type);
+
+  if (NULL == plugin)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  return plugin->check_reply (plugin->cls,
+                              type,
+                              group,
+                              query,
+                              xquery,
+                              xquery_size,
+                              reply_block,
+                              reply_block_size);
+}
+
+
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
                              const struct GNUNET_HashCode *seen_results,
                              unsigned int seen_results_count)
diff --git a/src/block/plugin_block_template.c b/src/block/plugin_block_template.c
index ecd46e364..13d9adfda 100644
--- a/src/block/plugin_block_template.c
+++ b/src/block/plugin_block_template.c
@@ -135,6 +135,80 @@ block_plugin_template_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_template_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_template_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_template_check_reply (
+                                        void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -145,7 +219,7 @@ block_plugin_template_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_template_get_key (void *cls,
                                enum GNUNET_BLOCK_Type type,
                                const void *block,
@@ -164,8 +238,8 @@ block_plugin_template_get_key (void *cls,
 void *
 libgnunet_plugin_block_template_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
-    /* FIXME: insert supported block types here */
+  static const enum GNUNET_BLOCK_Type types[] = {
+    /* NOTE: insert supported block types here */
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
   struct GNUNET_BLOCK_PluginFunctions *api;
@@ -173,6 +247,9 @@ libgnunet_plugin_block_template_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_template_evaluate;
   api->get_key = &block_plugin_template_get_key;
+  api->check_query = &block_plugin_template_check_query;
+  api->check_block = &block_plugin_template_check_block;
+  api->check_reply = &block_plugin_template_check_reply;
   api->create_group = &block_plugin_template_create_group;
   api->types = types;
   return api;
diff --git a/src/block/plugin_block_test.c b/src/block/plugin_block_test.c
index 45d54d339..fd643c4dc 100644
--- a/src/block/plugin_block_test.c
+++ b/src/block/plugin_block_test.c
@@ -143,6 +143,108 @@ block_plugin_test_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  struct GNUNET_HashCode chash;
+
+  if (GNUNET_BLOCK_TYPE_TEST != type)
+  {
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  GNUNET_CRYPTO_hash (reply_block,
+                      reply_block_size,
+                      &chash);
+  if (GNUNET_YES ==
+      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                          &chash))
+    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -153,7 +255,7 @@ block_plugin_test_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_test_get_key (void *cls,
                            enum GNUNET_BLOCK_Type type,
                            const void *block,
@@ -175,7 +277,7 @@ block_plugin_test_get_key (void *cls,
 void *
 libgnunet_plugin_block_test_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_TEST,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
@@ -184,6 +286,9 @@ libgnunet_plugin_block_test_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_test_evaluate;
   api->get_key = &block_plugin_test_get_key;
+  api->check_query = &block_plugin_test_check_query;
+  api->check_block = &block_plugin_test_check_block;
+  api->check_reply = &block_plugin_test_check_reply;
   api->create_group = &block_plugin_test_create_group;
   api->types = types;
   return api;
diff --git a/src/consensus/plugin_block_consensus.c b/src/consensus/plugin_block_consensus.c
index cdac12ed5..67309bc79 100644
--- a/src/consensus/plugin_block_consensus.c
+++ b/src/consensus/plugin_block_consensus.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2017 GNUnet e.V.
+     Copyright (C) 2017, 2021 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -80,6 +80,109 @@ block_plugin_consensus_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_consensus_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  /* consensus does not use queries/DHT */
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_consensus_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  struct GNUNET_BLOCK_Context *ctx = cls;
+  const struct ConsensusElement *ce = block;
+
+  if (block_size < sizeof(*ce))
+    return GNUNET_NO;
+  if ( (0 != ce->marker) ||
+       (0 == ce->payload_type) )
+    return GNUNET_OK;
+  return GNUNET_BLOCK_check_block (ctx,
+                                   ntohl (ce->payload_type),
+                                   query,
+                                   &ce[1],
+                                   block_size - sizeof(*ce));
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_consensus_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  struct GNUNET_BLOCK_Context *ctx = cls;
+  const struct ConsensusElement *ce = reply_block;
+
+  if (reply_block_size < sizeof(struct ConsensusElement))
+    return GNUNET_NO;
+  if ( (0 != ce->marker) ||
+       (0 == ce->payload_type) )
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  return GNUNET_BLOCK_check_reply (ctx,
+                                   ntohl (ce->payload_type),
+                                   group,
+                                   query,
+                                   xquery,
+                                   xquery_size,
+                                   &ce[1],
+                                   reply_block_size - sizeof(*ce));
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -90,7 +193,7 @@ block_plugin_consensus_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_consensus_get_key (void *cls,
                                 enum GNUNET_BLOCK_Type type,
                                 const void *block,
@@ -107,15 +210,20 @@ block_plugin_consensus_get_key (void *cls,
 void *
 libgnunet_plugin_block_consensus_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
   struct GNUNET_BLOCK_PluginFunctions *api;
 
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->cls = GNUNET_BLOCK_context_create (cfg);
   api->evaluate = &block_plugin_consensus_evaluate;
   api->get_key = &block_plugin_consensus_get_key;
+  api->check_query = &block_plugin_consensus_check_query;
+  api->check_block = &block_plugin_consensus_check_block;
+  api->check_reply = &block_plugin_consensus_check_reply;
   api->types = types;
   return api;
 }
@@ -128,7 +236,9 @@ void *
 libgnunet_plugin_block_consensus_done (void *cls)
 {
   struct GNUNET_BLOCK_PluginFunctions *api = cls;
+  struct GNUNET_BLOCK_Context *bc = api->cls;
 
+  GNUNET_BLOCK_context_destroy (bc);
   GNUNET_free (api);
   return NULL;
 }
diff --git a/src/curl/curl.c b/src/curl/curl.c
index 684610101..e45612e94 100644
--- a/src/curl/curl.c
+++ b/src/curl/curl.c
@@ -201,14 +201,6 @@ struct GNUNET_CURL_Context
 };
 
 
-/**
- * Force use of the provided username and password
- * for client authentication for all operations performed
- * with @a ctx.
- *
- * @param ctx context to set authentication data for
- * @param userpass string with "$USERNAME:$PASSWORD"
- */
 void
 GNUNET_CURL_set_userpass (struct GNUNET_CURL_Context *ctx,
                           const char *userpass)
@@ -219,21 +211,6 @@ GNUNET_CURL_set_userpass (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Force use of the provided TLS client certificate
- * for client authentication for all operations performed
- * with @a ctx.
- *
- * Note that if the provided information is incorrect,
- * the earliest operation that could fail is
- * #GNUNET_CURL_job_add() or #GNUNET_CURL_job_add2()!
- *
- * @param ctx context to set authentication data for
- * @param certtype type of the certificate
- * @param certfile file with the certificate
- * @param keyfile file with the private key
- * @param keypass passphrase to decrypt @a keyfile (or NULL)
- */
 void
 GNUNET_CURL_set_tlscert (struct GNUNET_CURL_Context *ctx,
                          const char *certtype,
@@ -256,14 +233,6 @@ GNUNET_CURL_set_tlscert (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Initialise this library.  This function should be called before using any of
- * the following functions.
- *
- * @param cb function to call when rescheduling is required
- * @param cb_cls closure for @a cb
- * @return library context
- */
 struct GNUNET_CURL_Context *
 GNUNET_CURL_init (GNUNET_CURL_RescheduleCallback cb,
                   void *cb_cls)
@@ -299,12 +268,6 @@ GNUNET_CURL_init (GNUNET_CURL_RescheduleCallback cb,
 }
 
 
-/**
- * Enable sending the async scope ID as a header.
- *
- * @param ctx the context to enable this for
- * @param header_name name of the header to send.
- */
 void
 GNUNET_CURL_enable_async_scope_header (struct GNUNET_CURL_Context *ctx,
                                        const char *header_name)
@@ -313,15 +276,6 @@ GNUNET_CURL_enable_async_scope_header (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Return #GNUNET_YES if given a valid scope ID and
- * #GNUNET_NO otherwise.  See #setup_job_headers,
- * logic related to
- * #GNUNET_CURL_enable_async_scope_header() for the
- * code that generates such a @a scope_id.
- *
- * @returns #GNUNET_YES iff given a valid scope ID
- */
 int
 GNUNET_CURL_is_valid_scope_id (const char *scope_id)
 {
@@ -447,7 +401,9 @@ setup_job (CURL *eh,
   struct GNUNET_CURL_Job *job;
 
   if (CURLE_OK !=
-      curl_easy_setopt (eh, CURLOPT_HTTPHEADER, all_headers))
+      curl_easy_setopt (eh,
+                        CURLOPT_HTTPHEADER,
+                        all_headers))
   {
     GNUNET_break (0);
     curl_slist_free_all (all_headers);
@@ -491,12 +447,6 @@ setup_job (CURL *eh,
 }
 
 
-/**
- * Add @a extra_headers to the HTTP headers for @a job.
- *
- * @param[in,out] job the job to modify
- * @param extra_headers headers to append
- */
 void
 GNUNET_CURL_extend_headers (struct GNUNET_CURL_Job *job,
                             const struct curl_slist *extra_headers)
@@ -515,21 +465,6 @@ GNUNET_CURL_extend_headers (struct GNUNET_CURL_Job *job,
 }
 
 
-/**
- * Schedule a CURL request to be executed and call the given @a jcc
- * upon its completion.  Note that the context will make use of the
- * CURLOPT_PRIVATE facility of the CURL @a eh.  Used to download
- * resources that are NOT in JSON.  The raw body will be returned.
- *
- * @param ctx context to execute the job in
- * @param eh curl easy handle for the request, will
- *           be executed AND cleaned up
- * @param job_headers extra headers to add for this request
- * @param max_reply_size largest acceptable response body
- * @param jcc callback to invoke upon completion
- * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
- */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add_raw (struct GNUNET_CURL_Context *ctx,
                          CURL *eh,
@@ -554,25 +489,6 @@ GNUNET_CURL_job_add_raw (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Schedule a CURL request to be executed and call the given @a jcc
- * upon its completion.  Note that the context will make use of the
- * CURLOPT_PRIVATE facility of the CURL @a eh.
- *
- * This function modifies the CURL handle to add the
- * "Content-Type: application/json" header if @a add_json is set.
- *
- * @param ctx context to execute the job in
- * @param eh curl easy handle for the request, will be executed AND
- *           cleaned up.  NOTE: the handle should _never_ have gotten
- *           any headers list, as that would then be overridden by
- *           @a jcc.  Therefore, always pass custom headers as the
- *           @a job_headers parameter.
- * @param job_headers extra headers to add for this request
- * @param jcc callback to invoke upon completion
- * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
- */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add2 (struct GNUNET_CURL_Context *ctx,
                       CURL *eh,
@@ -624,21 +540,6 @@ GNUNET_CURL_job_add2 (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Schedule a CURL request to be executed and call the given @a jcc
- * upon its completion.  Note that the context will make use of the
- * CURLOPT_PRIVATE facility of the CURL @a eh.
- *
- * This function modifies the CURL handle to add the
- * "Content-Type: application/json" header.
- *
- * @param ctx context to execute the job in
- * @param eh curl easy handle for the request, will
- *           be executed AND cleaned up
- * @param jcc callback to invoke upon completion
- * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
- */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add_with_ct_json (struct GNUNET_CURL_Context *ctx,
                                   CURL *eh,
@@ -661,18 +562,6 @@ GNUNET_CURL_job_add_with_ct_json (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Schedule a CURL request to be executed and call the given @a jcc
- * upon its completion.  Note that the context will make use of the
- * CURLOPT_PRIVATE facility of the CURL @a eh.
- *
- * @param ctx context to execute the job in
- * @param eh curl easy handle for the request, will
- *           be executed AND cleaned up
- * @param jcc callback to invoke upon completion
- * @param jcc_cls closure for @a jcc
- * @return NULL on error (in this case, @eh is still released!)
- */
 struct GNUNET_CURL_Job *
 GNUNET_CURL_job_add (struct GNUNET_CURL_Context *ctx,
                      CURL *eh,
@@ -687,12 +576,6 @@ GNUNET_CURL_job_add (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Cancel a job.  Must only be called before the job completion
- * callback is called for the respective job.
- *
- * @param job job to cancel
- */
 void
 GNUNET_CURL_job_cancel (struct GNUNET_CURL_Job *job)
 {
@@ -746,24 +629,6 @@ is_json (const char *ct)
 }
 
 
-/**
- * Obtain information about the final result about the
- * HTTP download. If the download was successful, parses
- * the JSON in the @a db and returns it. Also returns
- * the HTTP @a response_code.  If the download failed,
- * the return value is NULL.  The response code is set
- * in any case, on download errors to zero.
- *
- * Calling this function also cleans up @a db.
- *
- * @param db download buffer
- * @param eh CURL handle (to get the response code)
- * @param[out] response_code set to the HTTP response code
- *             (or zero if we aborted the download, for example
- *              because the response was too big, or if
- *              the JSON we received was malformed).
- * @return NULL if downloading a JSON reply failed.
- */
 void *
 GNUNET_CURL_download_get_result_ (struct GNUNET_CURL_DownloadBuffer *db,
                                   CURL *eh,
@@ -838,13 +703,6 @@ GNUNET_CURL_download_get_result_ (struct GNUNET_CURL_DownloadBuffer *db,
 }
 
 
-/**
- * Add custom request header.
- *
- * @param ctx cURL context.
- * @param header header string; will be given to the context AS IS.
- * @return #GNUNET_OK if no errors occurred, #GNUNET_SYSERR otherwise.
- */
 enum GNUNET_GenericReturnValue
 GNUNET_CURL_append_header (struct GNUNET_CURL_Context *ctx,
                            const char *header)
@@ -858,14 +716,6 @@ GNUNET_CURL_append_header (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Run the main event loop for the HTTP interaction.
- *
- * @param ctx the library context
- * @param rp parses the raw response returned from
- *        the Web server.
- * @param rc cleans/frees the response
- */
 void
 GNUNET_CURL_perform2 (struct GNUNET_CURL_Context *ctx,
                       GNUNET_CURL_RawParser rp,
@@ -920,11 +770,6 @@ GNUNET_CURL_perform2 (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Run the main event loop for the HTTP interaction.
- *
- * @param ctx the library context
- */
 void
 GNUNET_CURL_perform (struct GNUNET_CURL_Context *ctx)
 {
@@ -934,34 +779,6 @@ GNUNET_CURL_perform (struct GNUNET_CURL_Context *ctx)
 }
 
 
-/**
- * Obtain the information for a select() call to wait until
- * #GNUNET_CURL_perform() is ready again.  Note that calling
- * any other GNUNET_CURL-API may also imply that the library
- * is again ready for #GNUNET_CURL_perform().
- *
- * Basically, a client should use this API to prepare for select(),
- * then block on select(), then call #GNUNET_CURL_perform() and then
- * start again until the work with the context is done.
- *
- * This function will NOT zero out the sets and assumes that @a max_fd
- * and @a timeout are already set to minimal applicable values.  It is
- * safe to give this API FD-sets and @a max_fd and @a timeout that are
- * already initialized to some other descriptors that need to go into
- * the select() call.
- *
- * @param ctx context to get the event loop information for
- * @param read_fd_set will be set for any pending read operations
- * @param write_fd_set will be set for any pending write operations
- * @param except_fd_set is here because curl_multi_fdset() has this argument
- * @param max_fd set to the highest FD included in any set;
- *        if the existing sets have no FDs in it, the initial
- *        value should be "-1". (Note that `max_fd + 1` will need
- *        to be passed to select().)
- * @param timeout set to the timeout in milliseconds (!); -1 means
- *        no timeout (NULL, blocking forever is OK), 0 means to
- *        proceed immediately with #GNUNET_CURL_perform().
- */
 void
 GNUNET_CURL_get_select_info (struct GNUNET_CURL_Context *ctx,
                              fd_set *read_fd_set,
@@ -995,13 +812,6 @@ GNUNET_CURL_get_select_info (struct GNUNET_CURL_Context *ctx,
 }
 
 
-/**
- * Cleanup library initialisation resources.  This function should be called
- * after using this library to cleanup the resources occupied during library's
- * initialisation.
- *
- * @param ctx the library context
- */
 void
 GNUNET_CURL_fini (struct GNUNET_CURL_Context *ctx)
 {
diff --git a/src/datacache/datacache.c b/src/datacache/datacache.c
index 331a9b784..8b665e705 100644
--- a/src/datacache/datacache.c
+++ b/src/datacache/datacache.c
@@ -101,7 +101,9 @@ struct GNUNET_DATACACHE_Handle
  * @param size number of bytes that were made available
  */
 static void
-env_delete_notify (void *cls, const struct GNUNET_HashCode *key, size_t size)
+env_delete_notify (void *cls,
+                   const struct GNUNET_HashCode *key,
+                   size_t size)
 {
   struct GNUNET_DATACACHE_Handle *h = cls;
 
@@ -122,13 +124,6 @@ env_delete_notify (void *cls, const struct GNUNET_HashCode *key, size_t size)
 }
 
 
-/**
- * Create a data cache.
- *
- * @param cfg configuration to use
- * @param section section in the configuration that contains our options
- * @return handle to use to access the service
- */
 struct GNUNET_DATACACHE_Handle *
 GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
                          const char *section)
@@ -193,9 +188,9 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
   ret->lib_name = libname;
   /* Load the plugin within GNUnet's default context */
   pd = GNUNET_OS_project_data_get ();
-  GNUNET_OS_init(GNUNET_OS_project_data_default ());
+  GNUNET_OS_init (GNUNET_OS_project_data_default ());
   ret->api = GNUNET_PLUGIN_load (libname, &ret->env);
-  GNUNET_OS_init(pd);
+  GNUNET_OS_init (pd);
   if (NULL == ret->api)
   {
     /* Try to load the plugin within the application's context
@@ -215,11 +210,6 @@ GNUNET_DATACACHE_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
 }
 
 
-/**
- * Destroy a data cache (and free associated resources).
- *
- * @param h handle to the datastore
- */
 void
 GNUNET_DATACACHE_destroy (struct GNUNET_DATACACHE_Handle *h)
 {
@@ -244,21 +234,7 @@ GNUNET_DATACACHE_destroy (struct GNUNET_DATACACHE_Handle *h)
 }
 
 
-/**
- * Store an item in the datastore.
- *
- * @param h handle to the datacache
- * @param key key to store data under
- * @param xor_distance distance of @a key to our PID
- * @param data_size number of bytes in @a data
- * @param data data to store
- * @param type type of the value
- * @param discard_time when to discard the value in any case
- * @param path_info_len number of entries in @a path_info
- * @param path_info a path through the network
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error, #GNUNET_NO if duplicate
- */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_DATACACHE_put (struct GNUNET_DATACACHE_Handle *h,
                       const struct GNUNET_HashCode *key,
                       uint32_t xor_distance,
@@ -310,17 +286,6 @@ GNUNET_DATACACHE_put (struct GNUNET_DATACACHE_Handle *h,
 }
 
 
-/**
- * Iterate over the results for a particular key
- * in the datacache.
- *
- * @param h handle to the datacache
- * @param key what to look up
- * @param type entries of which type are relevant?
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
 unsigned int
 GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
                       const struct GNUNET_HashCode *key,
@@ -352,42 +317,6 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 }
 
 
-/**
- * Obtain a random element from the datacache.
- *
- * @param h handle to the datacache
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found (zero or 1)
- */
-unsigned int
-GNUNET_DATACACHE_get_random (struct GNUNET_DATACACHE_Handle *h,
-                             GNUNET_DATACACHE_Iterator iter,
-                             void *iter_cls)
-{
-  GNUNET_STATISTICS_update (h->stats,
-                            gettext_noop (
-                              "# requests for random value received"),
-                            1,
-                            GNUNET_NO);
-  LOG (GNUNET_ERROR_TYPE_DEBUG, "Processing request for random value\n");
-  return h->api->get_random (h->api->cls, iter, iter_cls);
-}
-
-
-/**
- * Iterate over the results that are "close" to a particular key in
- * the datacache.  "close" is defined as numerically larger than @a
- * key (when interpreted as a circular address space), with small
- * distance.
- *
- * @param h handle to the datacache
- * @param key area of the keyspace to look into
- * @param num_results number of results that should be returned to @a iter
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
 unsigned int
 GNUNET_DATACACHE_get_closest (struct GNUNET_DATACACHE_Handle *h,
                               const struct GNUNET_HashCode *key,
diff --git a/src/datacache/plugin_datacache_heap.c b/src/datacache/plugin_datacache_heap.c
index 074437e7d..20d18458d 100644
--- a/src/datacache/plugin_datacache_heap.c
+++ b/src/datacache/plugin_datacache_heap.c
@@ -402,33 +402,6 @@ heap_plugin_del (void *cls)
 
 
 /**
- * Return a random value from the datastore.
- *
- * @param cls closure (our `struct Plugin`)
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found
- */
-static unsigned int
-heap_plugin_get_random (void *cls,
-                        GNUNET_DATACACHE_Iterator iter,
-                        void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GetContext get_ctx;
-
-  get_ctx.type = GNUNET_BLOCK_TYPE_ANY;
-  get_ctx.iter = iter;
-  get_ctx.iter_cls = iter_cls;
-  get_ctx.cnt = 0;
-  GNUNET_CONTAINER_multihashmap_get_random (plugin->map,
-                                            &get_cb,
-                                            &get_ctx);
-  return get_ctx.cnt;
-}
-
-
-/**
  * Closure for #find_closest().
  */
 struct GetClosestContext
@@ -548,7 +521,6 @@ libgnunet_plugin_datacache_heap_init (void *cls)
   api->get = &heap_plugin_get;
   api->put = &heap_plugin_put;
   api->del = &heap_plugin_del;
-  api->get_random = &heap_plugin_get_random;
   api->get_closest = &heap_plugin_get_closest;
   LOG (GNUNET_ERROR_TYPE_INFO,
        _ ("Heap datacache running\n"));
diff --git a/src/datacache/plugin_datacache_postgres.c b/src/datacache/plugin_datacache_postgres.c
index 6613ae928..070619137 100644
--- a/src/datacache/plugin_datacache_postgres.c
+++ b/src/datacache/plugin_datacache_postgres.c
@@ -67,7 +67,8 @@ static int
 init_connection (struct Plugin *plugin)
 {
   struct GNUNET_PQ_ExecuteStatement es[] = {
-    GNUNET_PQ_make_try_execute ("CREATE TEMPORARY SEQUENCE IF NOT EXISTS gn011dc_oid_seq"),
+    GNUNET_PQ_make_try_execute (
+      "CREATE TEMPORARY SEQUENCE IF NOT EXISTS gn011dc_oid_seq"),
     GNUNET_PQ_make_execute ("CREATE TEMPORARY TABLE IF NOT EXISTS gn011dc ("
                             "  oid OID NOT NULL DEFAULT nextval('gn011dc_oid_seq'),"
                             "  type INTEGER NOT NULL,"
@@ -107,11 +108,6 @@ init_connection (struct Plugin *plugin)
                             "SELECT length(value) AS len,oid,key FROM gn011dc"
                             " ORDER BY prox ASC, discard_time ASC LIMIT 1",
                             0),
-    GNUNET_PQ_make_prepare ("get_random",
-                            "SELECT discard_time,type,value,path,key FROM gn011dc"
-                            " WHERE discard_time >= $1"
-                            " ORDER BY key ASC LIMIT 1 OFFSET $2",
-                            2),
     GNUNET_PQ_make_prepare ("get_closest",
                             "SELECT discard_time,type,value,path,key FROM gn011dc "
                             "WHERE key>=$1 AND discard_time >= $2 ORDER BY key ASC LIMIT $3",
@@ -410,96 +406,6 @@ postgres_plugin_del (void *cls)
 
 
 /**
- * Obtain a random key-value pair from the datacache.
- *
- * @param cls closure (our `struct Plugin`)
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found, zero (datacache empty) or one
- */
-static unsigned int
-postgres_plugin_get_random (void *cls,
-                            GNUNET_DATACACHE_Iterator iter,
-                            void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  uint32_t off;
-  struct GNUNET_TIME_Absolute now = { 0 };
-  struct GNUNET_TIME_Absolute expiration_time;
-  size_t data_size;
-  void *data;
-  size_t path_len;
-  struct GNUNET_PeerIdentity *path;
-  struct GNUNET_HashCode key;
-  uint32_t type;
-  enum GNUNET_DB_QueryStatus res;
-  struct GNUNET_PQ_QueryParam params[] = {
-    GNUNET_PQ_query_param_absolute_time (&now),
-    GNUNET_PQ_query_param_uint32 (&off),
-    GNUNET_PQ_query_param_end
-  };
-  struct GNUNET_PQ_ResultSpec rs[] = {
-    GNUNET_PQ_result_spec_absolute_time ("discard_time",
-                                         &expiration_time),
-    GNUNET_PQ_result_spec_uint32 ("type",
-                                  &type),
-    GNUNET_PQ_result_spec_variable_size ("value",
-                                         &data,
-                                         &data_size),
-    GNUNET_PQ_result_spec_variable_size ("path",
-                                         (void **) &path,
-                                         &path_len),
-    GNUNET_PQ_result_spec_auto_from_type ("key",
-                                          &key),
-    GNUNET_PQ_result_spec_end
-  };
-
-  if (0 == plugin->num_items)
-    return 0;
-  if (NULL == iter)
-    return 1;
-  now = GNUNET_TIME_absolute_get ();
-  off = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
-                                  plugin->num_items);
-  res = GNUNET_PQ_eval_prepared_singleton_select (plugin->dbh,
-                                                  "get_random",
-                                                  params,
-                                                  rs);
-  if (0 > res)
-  {
-    GNUNET_break (0);
-    return 0;
-  }
-  if (GNUNET_DB_STATUS_SUCCESS_NO_RESULTS == res)
-  {
-    GNUNET_break (0);
-    return 0;
-  }
-  if (0 != (path_len % sizeof(struct GNUNET_PeerIdentity)))
-  {
-    GNUNET_break (0);
-    path_len = 0;
-  }
-  path_len %= sizeof(struct GNUNET_PeerIdentity);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Found random value with key %s of size %u bytes and type %u in database\n",
-       GNUNET_h2s (&key),
-       (unsigned int) data_size,
-       (unsigned int) type);
-  (void) iter (iter_cls,
-               &key,
-               data_size,
-               data,
-               (enum GNUNET_BLOCK_Type) type,
-               expiration_time,
-               path_len,
-               path);
-  GNUNET_PQ_cleanup_result (rs);
-  return 1;
-}
-
-
-/**
  * Closure for #extract_result_cb.
  */
 struct ExtractResultContext
@@ -681,7 +587,6 @@ libgnunet_plugin_datacache_postgres_init (void *cls)
   api->get = &postgres_plugin_get;
   api->put = &postgres_plugin_put;
   api->del = &postgres_plugin_del;
-  api->get_random = &postgres_plugin_get_random;
   api->get_closest = &postgres_plugin_get_closest;
   LOG (GNUNET_ERROR_TYPE_INFO,
        "Postgres datacache running\n");
diff --git a/src/datacache/plugin_datacache_sqlite.c b/src/datacache/plugin_datacache_sqlite.c
index 66ff9e82c..0c894556b 100644
--- a/src/datacache/plugin_datacache_sqlite.c
+++ b/src/datacache/plugin_datacache_sqlite.c
@@ -92,11 +92,6 @@ struct Plugin
   sqlite3_stmt *del_stmt;
 
   /**
-   * Prepared statement for #sqlite_plugin_get_random.
-   */
-  sqlite3_stmt *get_random_stmt;
-
-  /**
    * Prepared statement for #sqlite_plugin_get_closest.
    */
   sqlite3_stmt *get_closest_stmt;
@@ -452,85 +447,6 @@ sqlite_plugin_del (void *cls)
 
 
 /**
- * Obtain a random key-value pair from the datacache.
- *
- * @param cls closure (our `struct Plugin`)
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found, zero (datacache empty) or one
- */
-static unsigned int
-sqlite_plugin_get_random (void *cls,
-                          GNUNET_DATACACHE_Iterator iter,
-                          void *iter_cls)
-{
-  struct Plugin *plugin = cls;
-  struct GNUNET_TIME_Absolute exp;
-  size_t size;
-  void *dat;
-  uint32_t off = 0;
-  size_t psize;
-  uint32_t type;
-  struct GNUNET_PeerIdentity *path;
-  struct GNUNET_HashCode key;
-  struct GNUNET_SQ_QueryParam params[] = { GNUNET_SQ_query_param_uint32 (&off),
-                                           GNUNET_SQ_query_param_end };
-  struct GNUNET_SQ_ResultSpec rs[] =
-  { GNUNET_SQ_result_spec_variable_size (&dat, &size),
-    GNUNET_SQ_result_spec_absolute_time (&exp),
-    GNUNET_SQ_result_spec_variable_size ((void **) &path, &psize),
-    GNUNET_SQ_result_spec_auto_from_type (&key),
-    GNUNET_SQ_result_spec_uint32 (&type),
-    GNUNET_SQ_result_spec_end };
-
-  if (0 == plugin->num_items)
-    return 0;
-  if (NULL == iter)
-    return 1;
-  off =
-    GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, plugin->num_items);
-  if (GNUNET_OK != GNUNET_SQ_bind (plugin->get_random_stmt, params))
-  {
-    return 0;
-  }
-  if (SQLITE_ROW != sqlite3_step (plugin->get_random_stmt))
-  {
-    GNUNET_break (0);
-    GNUNET_SQ_reset (plugin->dbh, plugin->get_random_stmt);
-    return 0;
-  }
-  if (GNUNET_OK != GNUNET_SQ_extract_result (plugin->get_random_stmt, rs))
-  {
-    GNUNET_break (0);
-    GNUNET_SQ_reset (plugin->dbh, plugin->get_random_stmt);
-    return 0;
-  }
-  if (0 != psize % sizeof(struct GNUNET_PeerIdentity))
-  {
-    GNUNET_break (0);
-    psize = 0;
-    path = NULL;
-  }
-  psize /= sizeof(struct GNUNET_PeerIdentity);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Found %u-byte result with key %s when processing GET-RANDOM\n",
-       (unsigned int) size,
-       GNUNET_h2s (&key));
-  (void) iter (iter_cls,
-               &key,
-               size,
-               dat,
-               (enum GNUNET_BLOCK_Type) type,
-               exp,
-               psize,
-               path);
-  GNUNET_SQ_cleanup_result (rs);
-  GNUNET_SQ_reset (plugin->dbh, plugin->get_random_stmt);
-  return 1;
-}
-
-
-/**
  * Iterate over the results that are "close" to a particular key in
  * the datacache.  "close" is defined as numerically larger than @a
  * key (when interpreted as a circular address space), with small
@@ -714,10 +630,6 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
       (SQLITE_OK != sq_prepare (plugin->dbh,
                                 "DELETE FROM ds091 WHERE _ROWID_=?",
                                 &plugin->del_stmt)) ||
-      (SQLITE_OK != sq_prepare (plugin->dbh,
-                                "SELECT value,expire,path,key,type FROM ds091 "
-                                "ORDER BY key LIMIT 1 OFFSET ?",
-                                &plugin->get_random_stmt)) ||
       (SQLITE_OK !=
        sq_prepare (plugin->dbh,
                    "SELECT value,expire,path,type,key FROM ds091 "
@@ -737,7 +649,6 @@ libgnunet_plugin_datacache_sqlite_init (void *cls)
   api->get = &sqlite_plugin_get;
   api->put = &sqlite_plugin_put;
   api->del = &sqlite_plugin_del;
-  api->get_random = &sqlite_plugin_get_random;
   api->get_closest = &sqlite_plugin_get_closest;
   LOG (GNUNET_ERROR_TYPE_INFO, "Sqlite datacache running\n");
   return api;
@@ -772,7 +683,6 @@ libgnunet_plugin_datacache_sqlite_done (void *cls)
   sqlite3_finalize (plugin->del_select_stmt);
   sqlite3_finalize (plugin->del_expired_stmt);
   sqlite3_finalize (plugin->del_stmt);
-  sqlite3_finalize (plugin->get_random_stmt);
   sqlite3_finalize (plugin->get_closest_stmt);
   result = sqlite3_close (plugin->dbh);
 #if SQLITE_VERSION_NUMBER >= 3007000
diff --git a/src/datacache/plugin_datacache_template.c b/src/datacache/plugin_datacache_template.c
index 329bfd9a4..09279f55c 100644
--- a/src/datacache/plugin_datacache_template.c
+++ b/src/datacache/plugin_datacache_template.c
@@ -109,24 +109,6 @@ template_plugin_del (void *cls)
 
 
 /**
- * Return a random value from the datastore.
- *
- * @param cls closure (internal context for the plugin)
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found (zero or one)
- */
-static unsigned int
-template_plugin_get_random (void *cls,
-                            GNUNET_DATACACHE_Iterator iter,
-                            void *iter_cls)
-{
-  GNUNET_break (0);
-  return 0;
-}
-
-
-/**
  * Iterate over the results that are "close" to a particular key in
  * the datacache.  "close" is defined as numerically larger than @a
  * key (when interpreted as a circular address space), with small
@@ -171,7 +153,6 @@ libgnunet_plugin_datacache_template_init (void *cls)
   api->get = &template_plugin_get;
   api->put = &template_plugin_put;
   api->del = &template_plugin_del;
-  api->get_random = &template_plugin_get_random;
   api->get_closest = &template_plugin_get_closest;
   GNUNET_log_from (GNUNET_ERROR_TYPE_INFO,
                    "template",
diff --git a/src/datastore/gnunet-service-datastore.c b/src/datastore/gnunet-service-datastore.c
index 97888ce03..498a7b3e6 100644
--- a/src/datastore/gnunet-service-datastore.c
+++ b/src/datastore/gnunet-service-datastore.c
@@ -599,7 +599,8 @@ handle_reserve (void *cls, const struct ReserveMessage *msg)
        * message happens, the insertion request could be blocked
        * by less-important content from migration because it is
        * larger than 1/8th of the overall available space, and
-       * we only reserve 1/8th for "fresh" insertions */GNUNET_log (
+       * we only reserve 1/8th for "fresh" insertions */
+      GNUNET_log (
         GNUNET_ERROR_TYPE_WARNING,
         _ (
           "The requested amount (%llu bytes) is larger than the cache size (%llu bytes)\n"),
diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index 96399cb5a..727f1a1f6 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -1048,8 +1048,7 @@ GNUNET_DHT_put_cancel (struct GNUNET_DHT_PutHandle *ph)
 
 
 /**
- * Perform an asynchronous GET operation on the DHT identified. See
- * also #GNUNET_BLOCK_evaluate.
+ * Perform an asynchronous GET operation on the DHT identified.
  *
  * @param handle handle to the DHT service
  * @param type expected type of the response object
diff --git a/src/dht/gnunet-service-dht.h b/src/dht/gnunet-service-dht.h
index 6741efb4e..e9b1ff63a 100644
--- a/src/dht/gnunet-service-dht.h
+++ b/src/dht/gnunet-service-dht.h
@@ -26,10 +26,10 @@
 #ifndef GNUNET_SERVICE_DHT_H
 #define GNUNET_SERVICE_DHT_H
 
-#include "gnunet_util_lib.h"
+#include "gnunet-service-dht_datacache.h"
 #include "gnunet_statistics_service.h"
 #include "gnunet_transport_service.h"
-#include "gnunet_block_lib.h"
+
 
 #define DEBUG_DHT GNUNET_EXTRA_LOGGING
 
@@ -64,26 +64,16 @@ extern struct GNUNET_MessageHeader *GDS_my_hello;
  * matches any of our pending queries, forward it to the respective
  * client(s).
  *
- * @param expiration when will the reply expire
- * @param key the query this reply is for
- * @param get_path_length number of peers in @a get_path
- * @param get_path path the reply took on get
- * @param put_path_length number of peers in @a put_path
- * @param put_path path the reply took on put
- * @param type type of the reply
- * @param data_size number of bytes in @a data
- * @param data application payload data
+ * @param bd block details
+ * @param query_hash hash of the original query, might not match key in @a bd
+ * @param get_path_length number of entries in @a get_path
+ * @param get_path path the reply has taken
  */
 void
-GDS_CLIENTS_handle_reply (struct GNUNET_TIME_Absolute expiration,
-                          const struct GNUNET_HashCode *key,
+GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
+                          const struct GNUNET_HashCode *query_hash,
                           unsigned int get_path_length,
-                          const struct GNUNET_PeerIdentity *get_path,
-                          unsigned int put_path_length,
-                          const struct GNUNET_PeerIdentity *put_path,
-                          enum GNUNET_BLOCK_Type type,
-                          size_t data_size,
-                          const void *data);
+                          const struct GNUNET_PeerIdentity *get_path);
 
 
 /**
@@ -99,7 +89,7 @@ GDS_CLIENTS_handle_reply (struct GNUNET_TIME_Absolute expiration,
  * @param key Key of the requested data.
  */
 void
-GDS_CLIENTS_process_get (uint32_t options,
+GDS_CLIENTS_process_get (enum GNUNET_DHT_RouteOption options,
                          enum GNUNET_BLOCK_Type type,
                          uint32_t hop_count,
                          uint32_t desired_replication_level,
@@ -112,53 +102,30 @@ GDS_CLIENTS_process_get (uint32_t options,
  * Check if some client is monitoring GET RESP messages and notify
  * them in that case.
  *
- * @param type The type of data in the result.
+ * @param bd block details
  * @param get_path Peers on GET path (or NULL if not recorded).
  * @param get_path_length number of entries in @a get_path.
- * @param put_path peers on the PUT path (or NULL if not recorded).
- * @param put_path_length number of entries in @a get_path.
- * @param exp Expiration time of the data.
- * @param key Key of the @a data.
- * @param data Pointer to the result data.
- * @param size Number of bytes in @a data.
  */
 void
-GDS_CLIENTS_process_get_resp (enum GNUNET_BLOCK_Type type,
+GDS_CLIENTS_process_get_resp (const struct GDS_DATACACHE_BlockData *bd,
                               const struct GNUNET_PeerIdentity *get_path,
-                              unsigned int get_path_length,
-                              const struct GNUNET_PeerIdentity *put_path,
-                              unsigned int put_path_length,
-                              struct GNUNET_TIME_Absolute exp,
-                              const struct GNUNET_HashCode *key,
-                              const void *data,
-                              size_t size);
+                              unsigned int get_path_length);
 
 
 /**
  * Check if some client is monitoring PUT messages and notify
- * them in that case.
+ * them in that case. The @a path should include our own
+ * peer ID (if recorded).
  *
- * @param options Options, for instance RecordRoute, DemultiplexEverywhere.
- * @param type The type of data in the request.
+ * @param options routing options to apply
+ * @param bd details about the block
  * @param hop_count Hop count so far.
- * @param path_length number of entries in path (or 0 if not recorded).
- * @param path peers on the PUT path (or NULL if not recorded).
  * @param desired_replication_level Desired replication level.
- * @param exp Expiration time of the data.
- * @param key Key under which data is to be stored.
- * @param data Pointer to the data carried.
- * @param size Number of bytes in data.
  */
 void
-GDS_CLIENTS_process_put (uint32_t options,
-                         enum GNUNET_BLOCK_Type type,
+GDS_CLIENTS_process_put (enum GNUNET_DHT_RouteOption options,
+                         const struct GDS_DATACACHE_BlockData *bd,
                          uint32_t hop_count,
-                         uint32_t desired_replication_level,
-                         unsigned int path_length,
-                         const struct GNUNET_PeerIdentity *path,
-                         struct GNUNET_TIME_Absolute exp,
-                         const struct GNUNET_HashCode *key,
-                         const void *data,
-                         size_t size);
+                         uint32_t desired_replication_level);
 
 #endif
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index cfcb25336..245130dbc 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011, 2016, 2017 GNUnet e.V.
+     Copyright (C) 2009, 2010, 2011, 2016, 2017, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -83,7 +83,7 @@ struct ClientQueryRecord
   const void *xquery;
 
   /**
-   * Replies we have already seen for this request.
+   * Array of (hashes of) replies we have already seen for this request.
    */
   struct GNUNET_HashCode *seen_replies;
 
@@ -114,7 +114,7 @@ struct ClientQueryRecord
   size_t xquery_size;
 
   /**
-   * Number of entries in 'seen_replies'.
+   * Number of entries in @e seen_replies.
    */
   unsigned int seen_replies_count;
 
@@ -126,7 +126,7 @@ struct ClientQueryRecord
   /**
    * Any message options for this request
    */
-  uint32_t msg_options;
+  enum GNUNET_DHT_RouteOption msg_options;
 
   /**
    * The type for the data for the GET request.
@@ -151,14 +151,19 @@ struct ClientMonitorRecord
   struct ClientMonitorRecord *prev;
 
   /**
-   * Type of blocks that are of interest
+   * Client to notify of these requests.
    */
-  enum GNUNET_BLOCK_Type type;
+  struct ClientHandle *ch;
+
+  /**
+   * Key of data of interest. All bits zero for 'all'.
+   */
+  struct GNUNET_HashCode key;
 
   /**
-   * Key of data of interest, NULL for all.
+   * Type of blocks that are of interest
    */
-  struct GNUNET_HashCode *key;
+  enum GNUNET_BLOCK_Type type;
 
   /**
    * Flag whether to notify about GET messages.
@@ -175,10 +180,6 @@ struct ClientMonitorRecord
    */
   uint16_t put;
 
-  /**
-   * Client to notify of these requests.
-   */
-  struct ClientHandle *ch;
 };
 
 
@@ -210,6 +211,7 @@ struct ClientHandle
   struct GNUNET_MQ_Handle *mq;
 };
 
+
 /**
  * Our handle to the BLOCK library.
  */
@@ -262,7 +264,7 @@ static struct GNUNET_SCHEDULER_Task *retry_task;
  * @param record record to remove
  */
 static void
-remove_client_record (struct ClientQueryRecord *record)
+remove_client_query_record (struct ClientQueryRecord *record)
 {
   struct ClientHandle *ch = record->ch;
 
@@ -298,6 +300,7 @@ client_connect_cb (void *cls,
 {
   struct ClientHandle *ch;
 
+  (void) cls;
   ch = GNUNET_new (struct ClientHandle);
   ch->client = client;
   ch->mq = mq;
@@ -319,34 +322,35 @@ client_disconnect_cb (void *cls,
                       void *app_ctx)
 {
   struct ClientHandle *ch = app_ctx;
-  struct ClientQueryRecord *cqr;
-  struct ClientMonitorRecord *monitor;
 
+  (void) cls;
+  (void) client;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Local client %p disconnects\n",
               ch);
-  monitor = monitor_head;
-  while (NULL != monitor)
   {
-    if (monitor->ch == ch)
-    {
-      struct ClientMonitorRecord *next;
+    struct ClientMonitorRecord *next;
 
+    for (struct ClientMonitorRecord *monitor = monitor_head;
+         NULL != monitor;
+         monitor = next)
+    {
       next = monitor->next;
-      GNUNET_free (monitor->key);
+      if (monitor->ch != ch)
+        continue;
       GNUNET_CONTAINER_DLL_remove (monitor_head,
                                    monitor_tail,
                                    monitor);
       GNUNET_free (monitor);
-      monitor = next;
-    }
-    else
-    {
-      monitor = monitor->next;
     }
   }
-  while (NULL != (cqr = ch->cqr_head))
-    remove_client_record (cqr);
+
+  {
+    struct ClientQueryRecord *cqr;
+
+    while (NULL != (cqr = ch->cqr_head))
+      remove_client_query_record (cqr);
+  }
   GNUNET_free (ch);
 }
 
@@ -355,6 +359,8 @@ client_disconnect_cb (void *cls,
  * Route the given request via the DHT.  This includes updating
  * the bloom filter and retransmission times, building the P2P
  * message and initiating the routing operation.
+ *
+ * @param cqr request to transmit
  */
 static void
 transmit_request (struct ClientQueryRecord *cqr)
@@ -363,8 +369,7 @@ transmit_request (struct ClientQueryRecord *cqr)
   struct GNUNET_CONTAINER_BloomFilter *peer_bf;
 
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop (
-                              "# GET requests from clients injected"),
+                            "# GET requests from clients injected",
                             1,
                             GNUNET_NO);
   bg = GNUNET_BLOCK_group_create (GDS_block_context,
@@ -372,8 +377,8 @@ transmit_request (struct ClientQueryRecord *cqr)
                                   GNUNET_CRYPTO_random_u32 (
                                     GNUNET_CRYPTO_QUALITY_WEAK,
                                     UINT32_MAX),
-                                  NULL,
-                                  0,
+                                  NULL, /* raw data */
+                                  0, /* raw data size */
                                   "seen-set-size",
                                   cqr->seen_replies_count,
                                   NULL);
@@ -401,8 +406,8 @@ transmit_request (struct ClientQueryRecord *cqr)
   GNUNET_BLOCK_group_destroy (bg);
   GNUNET_CONTAINER_bloomfilter_free (peer_bf);
 
-  /* exponential back-off for retries.
-   * max GNUNET_TIME_STD_EXPONENTIAL_BACKOFF_THRESHOLD (15 min) */
+  /* Exponential back-off for retries.
+   * max. is #GNUNET_TIME_STD_EXPONENTIAL_BACKOFF_THRESHOLD (15 min) */
   cqr->retry_frequency = GNUNET_TIME_STD_BACKOFF (cqr->retry_frequency);
   cqr->retry_time = GNUNET_TIME_relative_to_absolute (cqr->retry_frequency);
 }
@@ -419,14 +424,13 @@ static void
 transmit_next_request_task (void *cls)
 {
   struct ClientQueryRecord *cqr;
-  struct GNUNET_TIME_Relative delay;
 
+  (void) cls;
   retry_task = NULL;
   while (NULL != (cqr = GNUNET_CONTAINER_heap_remove_root (retry_heap)))
   {
     cqr->hnode = NULL;
-    delay = GNUNET_TIME_absolute_get_remaining (cqr->retry_time);
-    if (delay.rel_value_us > 0)
+    if (! GNUNET_TIME_absolute_is_past (cqr->retry_time))
     {
       cqr->hnode
         = GNUNET_CONTAINER_heap_insert (retry_heap,
@@ -454,11 +458,18 @@ transmit_next_request_task (void *cls)
  * @param dht_msg the actual message received
  * @return #GNUNET_OK (always)
  */
-static int
+static enum GNUNET_GenericReturnValue
 check_dht_local_put (void *cls,
                      const struct GNUNET_DHT_ClientPutMessage *dht_msg)
 {
-  /* always well-formed */
+  uint32_t replication_level = ntohl (dht_msg->desired_replication_level);
+
+  (void) cls;
+  if (replication_level > GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
   return GNUNET_OK;
 }
 
@@ -474,125 +485,108 @@ handle_dht_local_put (void *cls,
                       const struct GNUNET_DHT_ClientPutMessage *dht_msg)
 {
   struct ClientHandle *ch = cls;
-  struct GNUNET_CONTAINER_BloomFilter *peer_bf;
-  uint16_t size;
+  uint16_t size = ntohs (dht_msg->header.size);
+  enum GNUNET_DHT_RouteOption options
+    = (enum GNUNET_DHT_RouteOption) ntohl (dht_msg->options);
+  uint32_t replication_level
+    = ntohl (dht_msg->desired_replication_level);
+  struct GDS_DATACACHE_BlockData bd = {
+    .key = dht_msg->key,
+    .expiration_time = GNUNET_TIME_absolute_ntoh (dht_msg->expiration),
+    .data = &dht_msg[1],
+    .data_size = size - sizeof (*dht_msg),
+    .type = ntohl (dht_msg->type)
+  };
 
-  size = ntohs (dht_msg->header.size);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Handling local PUT of %lu-bytes for query %s of type %u\n",
+       (unsigned long) (size - sizeof(struct GNUNET_DHT_ClientPutMessage)),
+       GNUNET_h2s (&dht_msg->key),
+       (unsigned int) bd.type);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop (
-                              "# PUT requests received from clients"),
+                            "# PUT requests received from clients",
                             1,
                             GNUNET_NO);
   LOG_TRAFFIC (GNUNET_ERROR_TYPE_DEBUG,
                "CLIENT-PUT %s\n",
                GNUNET_h2s_full (&dht_msg->key));
   /* give to local clients */
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Handling local PUT of %lu-bytes for query %s\n",
-       (unsigned long) (size - sizeof(struct GNUNET_DHT_ClientPutMessage)),
-       GNUNET_h2s (&dht_msg->key));
-  GDS_CLIENTS_handle_reply (GNUNET_TIME_absolute_ntoh (dht_msg->expiration),
-                            &dht_msg->key,
-                            0,
-                            NULL,
-                            0,
-                            NULL,
-                            ntohl (dht_msg->type),
-                            size - sizeof(struct GNUNET_DHT_ClientPutMessage),
-                            &dht_msg[1]);
-  /* store locally */
-  GDS_DATACACHE_handle_put (GNUNET_TIME_absolute_ntoh (dht_msg->expiration),
-                            &dht_msg->key,
-                            0,
-                            NULL,
-                            ntohl (dht_msg->type),
-                            size - sizeof(struct GNUNET_DHT_ClientPutMessage),
-                            &dht_msg[1]);
-  /* route to other peers */
-  peer_bf
-    = GNUNET_CONTAINER_bloomfilter_init (NULL,
-                                         DHT_BLOOM_SIZE,
-                                         GNUNET_CONSTANTS_BLOOMFILTER_K);
-  GDS_NEIGHBOURS_handle_put (ntohl (dht_msg->type),
-                             ntohl (dht_msg->options),
-                             ntohl (dht_msg->desired_replication_level),
-                             GNUNET_TIME_absolute_ntoh (dht_msg->expiration),
-                             0 /* hop count */,
-                             peer_bf,
-                             &dht_msg->key,
-                             0,
-                             NULL,
-                             &dht_msg[1],
-                             size - sizeof(struct GNUNET_DHT_ClientPutMessage));
-  GDS_CLIENTS_process_put (ntohl (dht_msg->options),
-                           ntohl (dht_msg->type),
-                           0,
-                           ntohl (dht_msg->desired_replication_level),
-                           1,
-                           GDS_NEIGHBOURS_get_id (),
-                           GNUNET_TIME_absolute_ntoh (dht_msg->expiration),
-                           &dht_msg->key,
-                           &dht_msg[1],
-                           size - sizeof(struct GNUNET_DHT_ClientPutMessage));
-  GNUNET_CONTAINER_bloomfilter_free (peer_bf);
+  GDS_CLIENTS_handle_reply (&bd,
+                            &bd.key,
+                            0, NULL /* get path */);
+
+  {
+    struct GNUNET_CONTAINER_BloomFilter *peer_bf;
+
+    peer_bf
+      = GNUNET_CONTAINER_bloomfilter_init (NULL,
+                                           DHT_BLOOM_SIZE,
+                                           GNUNET_CONSTANTS_BLOOMFILTER_K);
+    /* store locally */
+    if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
+         (GDS_am_closest_peer (&dht_msg->key,
+                               peer_bf)))
+      GDS_DATACACHE_handle_put (&bd);
+    /* route to other peers */
+    if (GNUNET_OK !=
+        GDS_NEIGHBOURS_handle_put (&bd,
+                                   options,
+                                   replication_level,
+                                   0 /* hop count */,
+                                   peer_bf))
+    {
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# Local PUT requests not routed",
+                                1,
+                                GNUNET_NO);
+    }
+    GNUNET_CONTAINER_bloomfilter_free (peer_bf);
+  }
+  GDS_CLIENTS_process_put (
+    options,
+    &bd,
+    0,  /* hop count */
+    replication_level);
   GNUNET_SERVICE_client_continue (ch->client);
 }
 
 
 /**
+ * Handle a result from local datacache for a GET operation.
+ *
+ * @param cls the `struct ClientHandle` of the client doing the query
+ * @param bd details about the block that was found
+ */
+static void
+handle_local_result (void *cls,
+                     const struct GDS_DATACACHE_BlockData *bd)
+{
+  /* FIXME: use 'cls' instead of looking up the client? */
+  GDS_CLIENTS_handle_reply (bd,
+                            &bd->key,
+                            0, NULL /* get_path */);
+}
+
+
+/**
  * Check DHT GET messages from the client.
  *
  * @param cls the client we received this message from
  * @param message the actual message received
  * @return #GNUNET_OK (always)
  */
-static int
+static enum GNUNET_GenericReturnValue
 check_dht_local_get (void *cls,
                      const struct GNUNET_DHT_ClientGetMessage *get)
 {
+  (void) cls;
+  (void) get;
   /* always well-formed */
   return GNUNET_OK;
 }
 
 
 /**
- * Handle a result from local datacache for a GET operation.
- *
- * @param cls the `struct ClientHandle` of the client doing the query
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
- * @param get_path_length number of entries in @a get_path
- * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in @a data
- */
-static void
-handle_local_result (void *cls,
-                     enum GNUNET_BLOCK_Type type,
-                     struct GNUNET_TIME_Absolute expiration_time,
-                     const struct GNUNET_HashCode *key,
-                     unsigned int put_path_length,
-                     const struct GNUNET_PeerIdentity *put_path,
-                     unsigned int get_path_length,
-                     const struct GNUNET_PeerIdentity *get_path,
-                     const void *data,
-                     size_t data_size)
-{
-  // FIXME: this needs some clean up: inline the function,
-  // possibly avoid even looking up the client!
-  GDS_CLIENTS_handle_reply (expiration_time,
-                            key,
-                            0, NULL,
-                            put_path_length, put_path,
-                            type,
-                            data_size, data);
-}
-
-
-/**
  * Handler for DHT GET messages from the client.
  *
  * @param cls the client we received this message from
@@ -604,23 +598,20 @@ handle_dht_local_get (void *cls,
 {
   struct ClientHandle *ch = cls;
   struct ClientQueryRecord *cqr;
-  size_t xquery_size;
-  const char *xquery;
-  uint16_t size;
+  uint16_t size = ntohs (get->header.size);
+  const char *xquery = (const char *) &get[1];
+  size_t xquery_size = size - sizeof(struct GNUNET_DHT_ClientGetMessage);
 
-  size = ntohs (get->header.size);
-  xquery_size = size - sizeof(struct GNUNET_DHT_ClientGetMessage);
-  xquery = (const char *) &get[1];
-  GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop
-                              ("# GET requests received from clients"), 1,
-                            GNUNET_NO);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Received GET request for %s from local client %p, xq: %.*s\n",
        GNUNET_h2s (&get->key),
        ch->client,
        (int) xquery_size,
        xquery);
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# GET requests received from clients",
+                            1,
+                            GNUNET_NO);
   LOG_TRAFFIC (GNUNET_ERROR_TYPE_DEBUG,
                "CLIENT-GET %s\n",
                GNUNET_h2s_full (&get->key));
@@ -628,15 +619,19 @@ handle_dht_local_get (void *cls,
   cqr = GNUNET_malloc (sizeof(struct ClientQueryRecord) + xquery_size);
   cqr->key = get->key;
   cqr->ch = ch;
-  cqr->xquery = (void *) &cqr[1];
-  GNUNET_memcpy (&cqr[1], xquery, xquery_size);
-  cqr->hnode = GNUNET_CONTAINER_heap_insert (retry_heap, cqr, 0);
+  cqr->xquery = (const void *) &cqr[1];
+  GNUNET_memcpy (&cqr[1],
+                 xquery,
+                 xquery_size);
+  cqr->hnode = GNUNET_CONTAINER_heap_insert (retry_heap,
+                                             cqr,
+                                             0);
   cqr->retry_frequency = GNUNET_TIME_UNIT_SECONDS;
   cqr->retry_time = GNUNET_TIME_absolute_get ();
   cqr->unique_id = get->unique_id;
   cqr->xquery_size = xquery_size;
   cqr->replication = ntohl (get->desired_replication_level);
-  cqr->msg_options = ntohl (get->options);
+  cqr->msg_options = (enum GNUNET_DHT_RouteOption) ntohl (get->options);
   cqr->type = ntohl (get->type);
   GNUNET_CONTAINER_DLL_insert (ch->cqr_head,
                                ch->cqr_tail,
@@ -645,11 +640,11 @@ handle_dht_local_get (void *cls,
                                      &cqr->key,
                                      cqr,
                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
-  GDS_CLIENTS_process_get (ntohl (get->options),
-                           ntohl (get->type),
-                           0,
-                           ntohl (get->desired_replication_level),
-                           1,
+  GDS_CLIENTS_process_get (cqr->msg_options,
+                           cqr->type,
+                           0, /* hop count */
+                           cqr->replication,
+                           1, /* path length */
                            GDS_NEIGHBOURS_get_id (),
                            &get->key);
   /* start remote requests */
@@ -679,6 +674,9 @@ struct FindByUniqueIdContext
    */
   struct ClientQueryRecord *cqr;
 
+  /**
+   * Unique ID to look for.
+   */
   uint64_t unique_id;
 };
 
@@ -693,7 +691,7 @@ struct FindByUniqueIdContext
  * @param value the `struct ClientQueryRecord`
  * @return #GNUNET_YES to continue iteration (result not yet found)
  */
-static int
+static enum GNUNET_GenericReturnValue
 find_by_unique_id (void *cls,
                    const struct GNUNET_HashCode *key,
                    void *value)
@@ -715,19 +713,17 @@ find_by_unique_id (void *cls,
  * @param message the actual message received
  * @return #GNUNET_OK if @a seen is well-formed
  */
-static int
-check_dht_local_get_result_seen (void *cls,
-                                 const struct
-                                 GNUNET_DHT_ClientGetResultSeenMessage *seen)
+static enum GNUNET_GenericReturnValue
+check_dht_local_get_result_seen (
+  void *cls,
+  const struct GNUNET_DHT_ClientGetResultSeenMessage *seen)
 {
-  uint16_t size;
-  unsigned int hash_count;
-
-  size = ntohs (seen->header.size);
-  hash_count = (size - sizeof(struct GNUNET_DHT_ClientGetResultSeenMessage))
-               / sizeof(struct GNUNET_HashCode);
-  if (size != sizeof(struct GNUNET_DHT_ClientGetResultSeenMessage)
-      + hash_count * sizeof(struct GNUNET_HashCode))
+  uint16_t size = ntohs (seen->header.size);
+  unsigned int hash_count =
+    (size - sizeof(*seen))
+    / sizeof(struct GNUNET_HashCode);
+
+  if (size != sizeof(*seen) + hash_count * sizeof(struct GNUNET_HashCode))
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -743,24 +739,21 @@ check_dht_local_get_result_seen (void *cls,
  * @param message the actual message received
  */
 static void
-handle_dht_local_get_result_seen (void *cls,
-                                  const struct
-                                  GNUNET_DHT_ClientGetResultSeenMessage *seen)
+handle_dht_local_get_result_seen (
+  void *cls,
+  const struct GNUNET_DHT_ClientGetResultSeenMessage *seen)
 {
   struct ClientHandle *ch = cls;
-  uint16_t size;
-  unsigned int hash_count;
+  uint16_t size = ntohs (seen->header.size);
+  unsigned int hash_count = (size - sizeof(*seen))
+                            / sizeof(struct GNUNET_HashCode);
+  const struct GNUNET_HashCode *hc = (const struct GNUNET_HashCode*) &seen[1];
+  struct FindByUniqueIdContext fui_ctx = {
+    .unique_id = seen->unique_id
+  };
   unsigned int old_count;
-  const struct GNUNET_HashCode *hc;
-  struct FindByUniqueIdContext fui_ctx;
   struct ClientQueryRecord *cqr;
 
-  size = ntohs (seen->header.size);
-  hash_count = (size - sizeof(struct GNUNET_DHT_ClientGetResultSeenMessage))
-               / sizeof(struct GNUNET_HashCode);
-  hc = (const struct GNUNET_HashCode*) &seen[1];
-  fui_ctx.unique_id = seen->unique_id;
-  fui_ctx.cqr = NULL;
   GNUNET_CONTAINER_multihashmap_get_multiple (forward_map,
                                               &seen->key,
                                               &find_by_unique_id,
@@ -808,7 +801,7 @@ struct RemoveByUniqueIdContext
  * @param value value in the hash map, a ClientQueryRecord
  * @return #GNUNET_YES (we should continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 remove_by_unique_id (void *cls,
                      const struct GNUNET_HashCode *key,
                      void *value)
@@ -822,7 +815,7 @@ remove_by_unique_id (void *cls,
               "Removing client %p's record for key %s (by unique id)\n",
               ctx->ch->client,
               GNUNET_h2s (key));
-  remove_client_record (cqr);
+  remove_client_query_record (cqr);
   return GNUNET_YES;
 }
 
@@ -836,16 +829,16 @@ remove_by_unique_id (void *cls,
  *
  */
 static void
-handle_dht_local_get_stop (void *cls,
-                           const struct
-                           GNUNET_DHT_ClientGetStopMessage *dht_stop_msg)
+handle_dht_local_get_stop (
+  void *cls,
+  const struct GNUNET_DHT_ClientGetStopMessage *dht_stop_msg)
 {
   struct ClientHandle *ch = cls;
   struct RemoveByUniqueIdContext ctx;
 
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop
-                              ("# GET STOP requests received from clients"), 1,
+                            "# GET STOP requests received from clients",
+                            1,
                             GNUNET_NO);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Received GET STOP request for %s from local client %p\n",
@@ -862,99 +855,14 @@ handle_dht_local_get_stop (void *cls,
 
 
 /**
- * Handler for monitor start messages
- *
- * @param cls the client we received this message from
- * @param msg the actual message received
- *
- */
-static void
-handle_dht_local_monitor (void *cls,
-                          const struct GNUNET_DHT_MonitorStartStopMessage *msg)
-{
-  struct ClientHandle *ch = cls;
-  struct ClientMonitorRecord *r;
-
-  r = GNUNET_new (struct ClientMonitorRecord);
-  r->ch = ch;
-  r->type = ntohl (msg->type);
-  r->get = ntohs (msg->get);
-  r->get_resp = ntohs (msg->get_resp);
-  r->put = ntohs (msg->put);
-  if (0 == ntohs (msg->filter_key))
-  {
-    r->key = NULL;
-  }
-  else
-  {
-    r->key = GNUNET_new (struct GNUNET_HashCode);
-    GNUNET_memcpy (r->key,
-                   &msg->key,
-                   sizeof(struct GNUNET_HashCode));
-  }
-  GNUNET_CONTAINER_DLL_insert (monitor_head,
-                               monitor_tail,
-                               r);
-  GNUNET_SERVICE_client_continue (ch->client);
-}
-
-
-/**
- * Handler for monitor stop messages
- *
- * @param cls the client we received this message from
- * @param msg the actual message received
- */
-static void
-handle_dht_local_monitor_stop (void *cls,
-                               const struct
-                               GNUNET_DHT_MonitorStartStopMessage *msg)
-{
-  struct ClientHandle *ch = cls;
-  struct ClientMonitorRecord *r;
-  int keys_match;
-
-  GNUNET_SERVICE_client_continue (ch->client);
-  for (r = monitor_head; NULL != r; r = r->next)
-  {
-    if (NULL == r->key)
-    {
-      keys_match = (0 == ntohs (msg->filter_key));
-    }
-    else
-    {
-      keys_match = ((0 != ntohs (msg->filter_key)) &&
-                    (! memcmp (r->key,
-                               &msg->key,
-                               sizeof(struct GNUNET_HashCode))));
-    }
-    if ((ch == r->ch) &&
-        (ntohl (msg->type) == r->type) &&
-        (r->get == msg->get) &&
-        (r->get_resp == msg->get_resp) &&
-        (r->put == msg->put) &&
-        keys_match)
-    {
-      GNUNET_CONTAINER_DLL_remove (monitor_head,
-                                   monitor_tail,
-                                   r);
-      GNUNET_free (r->key);
-      GNUNET_free (r);
-      return;     /* Delete only ONE entry */
-    }
-  }
-}
-
-
-/**
  * Closure for #forward_reply()
  */
 struct ForwardReplyContext
 {
   /**
-   * Expiration time of the reply.
+   * Block details.
    */
-  struct GNUNET_TIME_Absolute expiration;
+  const struct GDS_DATACACHE_BlockData *bd;
 
   /**
    * GET path taken.
@@ -962,34 +870,10 @@ struct ForwardReplyContext
   const struct GNUNET_PeerIdentity *get_path;
 
   /**
-   * PUT path taken.
-   */
-  const struct GNUNET_PeerIdentity *put_path;
-
-  /**
-   * Embedded payload.
-   */
-  const void *data;
-
-  /**
-   * Number of bytes in data.
-   */
-  size_t data_size;
-
-  /**
    * Number of entries in @e get_path.
    */
   unsigned int get_path_length;
 
-  /**
-   * Number of entries in @e put_path.
-   */
-  unsigned int put_path_length;
-
-  /**
-   * Type of the data.
-   */
-  enum GNUNET_BLOCK_Type type;
 };
 
 
@@ -998,334 +882,298 @@ struct ForwardReplyContext
  * each of the matching clients.  With some tricky recycling
  * of the buffer.
  *
- * @param cls the 'struct ForwardReplyContext'
- * @param key current key
+ * @param cls the `struct ForwardReplyContext`
+ * @param query_hash hash of the query for which this may be a reply
  * @param value value in the hash map, a ClientQueryRecord
  * @return #GNUNET_YES (we should continue to iterate),
  *         if the result is mal-formed, #GNUNET_NO
  */
-static int
+static enum GNUNET_GenericReturnValue
 forward_reply (void *cls,
-               const struct GNUNET_HashCode *key,
+               const struct GNUNET_HashCode *query_hash,
                void *value)
 {
   struct ForwardReplyContext *frc = cls;
   struct ClientQueryRecord *record = value;
   struct GNUNET_MQ_Envelope *env;
   struct GNUNET_DHT_ClientResultMessage *reply;
-  enum GNUNET_BLOCK_EvaluationResult eval;
-  int do_free;
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
+  bool do_free;
   struct GNUNET_HashCode ch;
   struct GNUNET_PeerIdentity *paths;
 
   LOG_TRAFFIC (GNUNET_ERROR_TYPE_DEBUG,
                "CLIENT-RESULT %s\n",
-               GNUNET_h2s_full (key));
-  if ((record->type != GNUNET_BLOCK_TYPE_ANY) &&
-      (record->type != frc->type))
+               GNUNET_h2s_full (&frc->bd->key));
+  if ( (record->type != GNUNET_BLOCK_TYPE_ANY) &&
+       (record->type != frc->bd->type) )
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "Record type mismatch, not passing request for key %s to local client\n",
-         GNUNET_h2s (key));
+         GNUNET_h2s (&frc->bd->key));
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                              (
-                                "# Key match, type mismatches in REPLY to CLIENT"),
-                              1, GNUNET_NO);
+                              "# Key match, type mismatches in REPLY to CLIENT",
+                              1,
+                              GNUNET_NO);
     return GNUNET_YES;          /* type mismatch */
   }
-  GNUNET_CRYPTO_hash (frc->data, frc->data_size, &ch);
+  if ( (0 == (record->msg_options & GNUNET_DHT_RO_FIND_PEER)) &&
+       (0 != GNUNET_memcmp (&frc->bd->key,
+                            query_hash)) )
+  {
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# Inexact key match, but exact match required",
+                              1,
+                              GNUNET_NO);
+    return GNUNET_YES;          /* type mismatch */
+  }
+  GNUNET_CRYPTO_hash (frc->bd->data,
+                      frc->bd->data_size,
+                      &ch);
   for (unsigned int i = 0; i < record->seen_replies_count; i++)
-    if (0 == memcmp (&record->seen_replies[i],
-                     &ch,
-                     sizeof(struct GNUNET_HashCode)))
+    if (0 ==
+        GNUNET_memcmp (&record->seen_replies[i],
+                       &ch))
     {
       LOG (GNUNET_ERROR_TYPE_DEBUG,
            "Duplicate reply, not passing request for key %s to local client\n",
-           GNUNET_h2s (key));
+           GNUNET_h2s (&frc->bd->key));
       GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop
-                                (
-                                  "# Duplicate REPLIES to CLIENT request dropped"),
-                                1, GNUNET_NO);
+                                "# Duplicate REPLIES to CLIENT request dropped",
+                                1,
+                                GNUNET_NO);
       return GNUNET_YES;        /* duplicate */
     }
   eval
-    = GNUNET_BLOCK_evaluate (GDS_block_context,
-                             record->type,
-                             NULL,
-                             GNUNET_BLOCK_EO_NONE,
-                             key,
-                             record->xquery,
-                             record->xquery_size,
-                             frc->data,
-                             frc->data_size);
+    = GNUNET_BLOCK_check_reply (GDS_block_context,
+                                record->type,
+                                NULL,
+                                &frc->bd->key,
+                                record->xquery,
+                                record->xquery_size,
+                                frc->bd->data,
+                                frc->bd->data_size);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Evaluation result is %d for key %s for local client's query\n",
        (int) eval,
-       GNUNET_h2s (key));
+       GNUNET_h2s (&frc->bd->key));
   switch (eval)
   {
-  case GNUNET_BLOCK_EVALUATION_OK_LAST:
-    do_free = GNUNET_YES;
+  case GNUNET_BLOCK_REPLY_OK_LAST:
+    do_free = true;
     break;
-
-  case GNUNET_BLOCK_EVALUATION_OK_MORE:
+  case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
+  case GNUNET_BLOCK_REPLY_OK_MORE:
     GNUNET_array_append (record->seen_replies,
                          record->seen_replies_count,
                          ch);
-    do_free = GNUNET_NO;
+    do_free = false;
     break;
-
-  case GNUNET_BLOCK_EVALUATION_OK_DUPLICATE:
+  case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
     /* should be impossible to encounter here */
     GNUNET_break (0);
     return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_INVALID:
+  case GNUNET_BLOCK_REPLY_INVALID:
     GNUNET_break_op (0);
     return GNUNET_NO;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_VALID:
-    GNUNET_break (0);
-    return GNUNET_NO;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_INVALID:
-    GNUNET_break (0);
-    return GNUNET_NO;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT:
+  case GNUNET_BLOCK_REPLY_IRRELEVANT:
     return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED:
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("Unsupported block type (%u) in request!\n"), record->type);
-    return GNUNET_NO;
-
   default:
     GNUNET_break (0);
     return GNUNET_NO;
   }
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# RESULTS queued for clients"),
+                            "# RESULTS queued for clients",
                             1,
                             GNUNET_NO);
   env = GNUNET_MQ_msg_extra (reply,
-                             frc->data_size
-                             + (frc->get_path_length + frc->put_path_length)
+                             frc->bd->data_size
+                             + (frc->get_path_length + frc->bd->put_path_length)
                              * sizeof(struct GNUNET_PeerIdentity),
                              GNUNET_MESSAGE_TYPE_DHT_CLIENT_RESULT);
-  reply->type = htonl (frc->type);
+  reply->type = htonl (frc->bd->type);
   reply->get_path_length = htonl (frc->get_path_length);
-  reply->put_path_length = htonl (frc->put_path_length);
+  reply->put_path_length = htonl (frc->bd->put_path_length);
   reply->unique_id = record->unique_id;
-  reply->expiration = GNUNET_TIME_absolute_hton (frc->expiration);
-  reply->key = *key;
+  reply->expiration = GNUNET_TIME_absolute_hton (frc->bd->expiration_time);
+  reply->key = frc->bd->key;
   paths = (struct GNUNET_PeerIdentity *) &reply[1];
   GNUNET_memcpy (paths,
-                 frc->put_path,
-                 sizeof(struct GNUNET_PeerIdentity) * frc->put_path_length);
-  GNUNET_memcpy (&paths[frc->put_path_length],
+                 frc->bd->put_path,
+                 sizeof(struct GNUNET_PeerIdentity) * frc->bd->put_path_length);
+  GNUNET_memcpy (&paths[frc->bd->put_path_length],
                  frc->get_path,
                  sizeof(struct GNUNET_PeerIdentity) * frc->get_path_length);
-  GNUNET_memcpy (&paths[frc->get_path_length + frc->put_path_length],
-                 frc->data,
-                 frc->data_size);
+  GNUNET_memcpy (&paths[frc->get_path_length + frc->bd->put_path_length],
+                 frc->bd->data,
+                 frc->bd->data_size);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "Sending reply to query %s for client %p\n",
-       GNUNET_h2s (key),
+       GNUNET_h2s (query_hash),
        record->ch->client);
   GNUNET_MQ_send (record->ch->mq,
                   env);
   if (GNUNET_YES == do_free)
-    remove_client_record (record);
+    remove_client_query_record (record);
   return GNUNET_YES;
 }
 
 
-/**
- * Handle a reply we've received from another peer.  If the reply
- * matches any of our pending queries, forward it to the respective
- * client(s).
- *
- * @param expiration when will the reply expire
- * @param key the query this reply is for
- * @param get_path_length number of peers in @a get_path
- * @param get_path path the reply took on get
- * @param put_path_length number of peers in @a put_path
- * @param put_path path the reply took on put
- * @param type type of the reply
- * @param data_size number of bytes in @a data
- * @param data application payload data
- */
 void
-GDS_CLIENTS_handle_reply (struct GNUNET_TIME_Absolute expiration,
-                          const struct GNUNET_HashCode *key,
+GDS_CLIENTS_handle_reply (const struct GDS_DATACACHE_BlockData *bd,
+                          const struct GNUNET_HashCode *query_hash,
                           unsigned int get_path_length,
-                          const struct GNUNET_PeerIdentity *get_path,
-                          unsigned int put_path_length,
-                          const struct GNUNET_PeerIdentity *put_path,
-                          enum GNUNET_BLOCK_Type type,
-                          size_t data_size,
-                          const void *data)
+                          const struct GNUNET_PeerIdentity *get_path)
 {
   struct ForwardReplyContext frc;
-  size_t msize;
+  size_t msize = sizeof (struct GNUNET_DHT_ClientResultMessage)
+                 + bd->data_size
+                 + (get_path_length + bd->put_path_length)
+                 * sizeof(struct GNUNET_PeerIdentity);
 
-  msize = sizeof(struct GNUNET_DHT_ClientResultMessage) + data_size
-          + (get_path_length + put_path_length) * sizeof(struct
-                                                         GNUNET_PeerIdentity);
   if (msize >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
     return;
   }
-  if (NULL == GNUNET_CONTAINER_multihashmap_get (forward_map,
-                                                 key))
+  frc.bd = bd;
+  frc.get_path = get_path;
+  frc.get_path_length = get_path_length;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Forwarding reply for query hash %s to client\n",
+       GNUNET_h2s (query_hash));
+  if (0 ==
+      GNUNET_CONTAINER_multihashmap_get_multiple (forward_map,
+                                                  query_hash,
+                                                  &forward_reply,
+                                                  &frc))
   {
     LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "No matching client for reply for key %s\n",
-         GNUNET_h2s (key));
+         "No matching client for reply for query %s\n",
+         GNUNET_h2s (query_hash));
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# REPLIES ignored for CLIENTS (no match)"),
+                              "# REPLIES ignored for CLIENTS (no match)",
                               1,
                               GNUNET_NO);
-    return;                     /* no matching request, fast exit! */
   }
-  frc.expiration = expiration;
-  frc.get_path = get_path;
-  frc.put_path = put_path;
-  frc.data = data;
-  frc.data_size = data_size;
-  frc.get_path_length = get_path_length;
-  frc.put_path_length = put_path_length;
-  frc.type = type;
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Forwarding reply for key %s to client\n",
-       GNUNET_h2s (key));
-  GNUNET_CONTAINER_multihashmap_get_multiple (forward_map,
-                                              key,
-                                              &forward_reply,
-                                              &frc);
 }
 
 
+/* ************* logic for monitors ************** */
+
+
 /**
- * Check if some client is monitoring GET messages and notify
- * them in that case.
+ * Handler for monitor start messages
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
  *
- * @param options Options, for instance RecordRoute, DemultiplexEverywhere.
- * @param type The type of data in the request.
- * @param hop_count Hop count so far.
- * @param path_length number of entries in path (or 0 if not recorded).
- * @param path peers on the GET path (or NULL if not recorded).
- * @param desired_replication_level Desired replication level.
- * @param key Key of the requested data.
  */
-void
-GDS_CLIENTS_process_get (uint32_t options,
-                         enum GNUNET_BLOCK_Type type,
-                         uint32_t hop_count,
-                         uint32_t desired_replication_level,
-                         unsigned int path_length,
-                         const struct GNUNET_PeerIdentity *path,
-                         const struct GNUNET_HashCode *key)
+static void
+handle_dht_local_monitor (void *cls,
+                          const struct GNUNET_DHT_MonitorStartStopMessage *msg)
 {
-  struct ClientMonitorRecord *m;
-  struct ClientHandle **cl;
-  unsigned int cl_size;
+  struct ClientHandle *ch = cls;
+  struct ClientMonitorRecord *r;
 
-  cl = NULL;
-  cl_size = 0;
-  for (m = monitor_head; NULL != m; m = m->next)
-  {
-    if (((GNUNET_BLOCK_TYPE_ANY == m->type) ||
-         (m->type == type)) &&
-        ((NULL == m->key) ||
-         (0 == memcmp (key,
-                       m->key,
-                       sizeof(struct GNUNET_HashCode)))))
-    {
-      struct GNUNET_MQ_Envelope *env;
-      struct GNUNET_DHT_MonitorGetMessage *mmsg;
-      struct GNUNET_PeerIdentity *msg_path;
-      size_t msize;
-      unsigned int i;
+  r = GNUNET_new (struct ClientMonitorRecord);
+  r->ch = ch;
+  r->type = ntohl (msg->type);
+  r->get = ntohs (msg->get);
+  r->get_resp = ntohs (msg->get_resp);
+  r->put = ntohs (msg->put);
+  if (0 != ntohs (msg->filter_key))
+    r->key = msg->key;
+  GNUNET_CONTAINER_DLL_insert (monitor_head,
+                               monitor_tail,
+                               r);
+  GNUNET_SERVICE_client_continue (ch->client);
+}
 
-      /* Don't send duplicates */
-      for (i = 0; i < cl_size; i++)
-        if (cl[i] == m->ch)
-          break;
-      if (i < cl_size)
-        continue;
-      GNUNET_array_append (cl,
-                           cl_size,
-                           m->ch);
 
-      msize = path_length * sizeof(struct GNUNET_PeerIdentity);
-      env = GNUNET_MQ_msg_extra (mmsg,
-                                 msize,
-                                 GNUNET_MESSAGE_TYPE_DHT_MONITOR_GET);
-      mmsg->options = htonl (options);
-      mmsg->type = htonl (type);
-      mmsg->hop_count = htonl (hop_count);
-      mmsg->desired_replication_level = htonl (desired_replication_level);
-      mmsg->get_path_length = htonl (path_length);
-      mmsg->key = *key;
-      msg_path = (struct GNUNET_PeerIdentity *) &mmsg[1];
-      GNUNET_memcpy (msg_path,
-                     path,
-                     path_length * sizeof(struct GNUNET_PeerIdentity));
-      GNUNET_MQ_send (m->ch->mq,
-                      env);
+/**
+ * Handler for monitor stop messages
+ *
+ * @param cls the client we received this message from
+ * @param msg the actual message received
+ */
+static void
+handle_dht_local_monitor_stop (
+  void *cls,
+  const struct GNUNET_DHT_MonitorStartStopMessage *msg)
+{
+  struct ClientHandle *ch = cls;
+
+  GNUNET_SERVICE_client_continue (ch->client);
+  for (struct ClientMonitorRecord *r = monitor_head;
+       NULL != r;
+       r = r->next)
+  {
+    bool keys_match;
+
+    keys_match =
+      (GNUNET_is_zero (&r->key))
+      ? (0 == ntohs (msg->filter_key))
+      : ( (0 != ntohs (msg->filter_key)) &&
+          (! GNUNET_memcmp (&r->key,
+                            &msg->key)) );
+    if ( (ch == r->ch) &&
+         (ntohl (msg->type) == r->type) &&
+         (r->get == msg->get) &&
+         (r->get_resp == msg->get_resp) &&
+         (r->put == msg->put) &&
+         keys_match)
+    {
+      GNUNET_CONTAINER_DLL_remove (monitor_head,
+                                   monitor_tail,
+                                   r);
+      GNUNET_free (r);
+      return;     /* Delete only ONE entry */
     }
   }
-  GNUNET_free (cl);
 }
 
 
 /**
- * Check if some client is monitoring GET RESP messages and notify
- * them in that case.
+ * Function to call by #for_matching_monitors().
  *
- * @param type The type of data in the result.
- * @param get_path Peers on GET path (or NULL if not recorded).
- * @param get_path_length number of entries in get_path.
- * @param put_path peers on the PUT path (or NULL if not recorded).
- * @param put_path_length number of entries in get_path.
- * @param exp Expiration time of the data.
- * @param key Key of the data.
- * @param data Pointer to the result data.
- * @param size Number of bytes in @a data.
+ * @param cls closure
+ * @param m a matching monitor
  */
-void
-GDS_CLIENTS_process_get_resp (enum GNUNET_BLOCK_Type type,
-                              const struct GNUNET_PeerIdentity *get_path,
-                              unsigned int get_path_length,
-                              const struct GNUNET_PeerIdentity *put_path,
-                              unsigned int put_path_length,
-                              struct GNUNET_TIME_Absolute exp,
-                              const struct GNUNET_HashCode *key,
-                              const void *data,
-                              size_t size)
+typedef void
+(*MonitorAction)(void *cls,
+                 struct ClientMonitorRecord *m);
+
+
+/**
+ * Call @a cb on all monitors that watch for blocks of @a type
+ * and key @a key.
+ *
+ * @param type the type to match
+ * @param key the key to match
+ * @param cb function to call
+ * @param cb_cls closure for @a cb
+ */
+static void
+for_matching_monitors (enum GNUNET_BLOCK_Type type,
+                       const struct GNUNET_HashCode *key,
+                       MonitorAction cb,
+                       void *cb_cls)
 {
-  struct ClientMonitorRecord *m;
-  struct ClientHandle **cl;
-  unsigned int cl_size;
+  struct ClientHandle **cl = NULL;
+  unsigned int cl_size = 0;
 
-  cl = NULL;
-  cl_size = 0;
-  for (m = monitor_head; NULL != m; m = m->next)
+  for (struct ClientMonitorRecord *m = monitor_head;
+       NULL != m;
+       m = m->next)
   {
-    if (((GNUNET_BLOCK_TYPE_ANY == m->type) || (m->type == type) ) &&
-        ((NULL == m->key) ||
-         (memcmp (key, m->key, sizeof(struct GNUNET_HashCode)) == 0) ))
+    if ( ( (GNUNET_BLOCK_TYPE_ANY == m->type) ||
+           (m->type == type) ) &&
+         ( (GNUNET_is_zero (&m->key)) ||
+           (0 ==
+            GNUNET_memcmp (key,
+                           &m->key)) ) )
     {
-      struct GNUNET_MQ_Envelope *env;
-      struct GNUNET_DHT_MonitorGetRespMessage *mmsg;
-      struct GNUNET_PeerIdentity *path;
-      size_t msize;
       unsigned int i;
 
       /* Don't send duplicates */
@@ -1337,30 +1185,8 @@ GDS_CLIENTS_process_get_resp (enum GNUNET_BLOCK_Type type,
       GNUNET_array_append (cl,
                            cl_size,
                            m->ch);
-
-      msize = size;
-      msize += (get_path_length + put_path_length)
-               * sizeof(struct GNUNET_PeerIdentity);
-      env = GNUNET_MQ_msg_extra (mmsg,
-                                 msize,
-                                 GNUNET_MESSAGE_TYPE_DHT_MONITOR_GET_RESP);
-      mmsg->type = htonl (type);
-      mmsg->put_path_length = htonl (put_path_length);
-      mmsg->get_path_length = htonl (get_path_length);
-      mmsg->expiration_time = GNUNET_TIME_absolute_hton (exp);
-      mmsg->key = *key;
-      path = (struct GNUNET_PeerIdentity *) &mmsg[1];
-      GNUNET_memcpy (path,
-                     put_path,
-                     put_path_length * sizeof(struct GNUNET_PeerIdentity));
-      GNUNET_memcpy (path,
-                     get_path,
-                     get_path_length * sizeof(struct GNUNET_PeerIdentity));
-      GNUNET_memcpy (&path[get_path_length],
-                     data,
-                     size);
-      GNUNET_MQ_send (m->ch->mq,
-                      env);
+      cb (cb_cls,
+          m);
     }
   }
   GNUNET_free (cl);
@@ -1368,94 +1194,254 @@ GDS_CLIENTS_process_get_resp (enum GNUNET_BLOCK_Type type,
 
 
 /**
- * Check if some client is monitoring PUT messages and notify
- * them in that case.
+ * Closure for #get_action();
+ */
+struct GetActionContext
+{
+  enum GNUNET_DHT_RouteOption options;
+  enum GNUNET_BLOCK_Type type;
+  uint32_t hop_count;
+  uint32_t desired_replication_level;
+  unsigned int get_path_length;
+  const struct GNUNET_PeerIdentity *get_path;
+  const struct GNUNET_HashCode *key;
+};
+
+
+/**
+ * Function called on monitors that match a GET.
+ * Sends the GET notification to the monitor.
+ *
+ * @param cls a `struct GetActionContext`
+ * @param m a matching monitor
+ */
+static void
+get_action (void *cls,
+            struct ClientMonitorRecord *m)
+{
+  struct GetActionContext *gac = cls;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_DHT_MonitorGetMessage *mmsg;
+  struct GNUNET_PeerIdentity *msg_path;
+  size_t msize;
+
+  msize = gac->get_path_length * sizeof(struct GNUNET_PeerIdentity);
+  env = GNUNET_MQ_msg_extra (mmsg,
+                             msize,
+                             GNUNET_MESSAGE_TYPE_DHT_MONITOR_GET);
+  mmsg->options = htonl (gac->options);
+  mmsg->type = htonl (gac->type);
+  mmsg->hop_count = htonl (gac->hop_count);
+  mmsg->desired_replication_level = htonl (gac->desired_replication_level);
+  mmsg->get_path_length = htonl (gac->get_path_length);
+  mmsg->key = *gac->key;
+  msg_path = (struct GNUNET_PeerIdentity *) &mmsg[1];
+  GNUNET_memcpy (msg_path,
+                 gac->get_path,
+                 gac->get_path_length * sizeof(struct GNUNET_PeerIdentity));
+  GNUNET_MQ_send (m->ch->mq,
+                  env);
+}
+
+
+/**
+ * Check if some client is monitoring GET messages and notify
+ * them in that case.  If tracked, @a path should include the local peer.
  *
  * @param options Options, for instance RecordRoute, DemultiplexEverywhere.
  * @param type The type of data in the request.
  * @param hop_count Hop count so far.
  * @param path_length number of entries in path (or 0 if not recorded).
- * @param path peers on the PUT path (or NULL if not recorded).
+ * @param path peers on the GET path (or NULL if not recorded).
  * @param desired_replication_level Desired replication level.
- * @param exp Expiration time of the data.
- * @param key Key under which data is to be stored.
- * @param data Pointer to the data carried.
- * @param size Number of bytes in data.
+ * @param key Key of the requested data.
  */
 void
-GDS_CLIENTS_process_put (uint32_t options,
+GDS_CLIENTS_process_get (enum GNUNET_DHT_RouteOption options,
                          enum GNUNET_BLOCK_Type type,
                          uint32_t hop_count,
                          uint32_t desired_replication_level,
                          unsigned int path_length,
                          const struct GNUNET_PeerIdentity *path,
-                         struct GNUNET_TIME_Absolute exp,
-                         const struct GNUNET_HashCode *key,
-                         const void *data,
-                         size_t size)
+                         const struct GNUNET_HashCode *key)
 {
-  struct ClientMonitorRecord *m;
-  struct ClientHandle **cl;
-  unsigned int cl_size;
+  struct GetActionContext gac = {
+    .options = options,
+    .type = type,
+    .hop_count = hop_count,
+    .desired_replication_level = desired_replication_level,
+    .get_path_length = path_length,
+    .get_path = path,
+    .key = key
+  };
+
+  for_matching_monitors (type,
+                         key,
+                         &get_action,
+                         &gac);
+}
 
-  cl = NULL;
-  cl_size = 0;
-  for (m = monitor_head; NULL != m; m = m->next)
-  {
-    if (((GNUNET_BLOCK_TYPE_ANY == m->type) || (m->type == type) ) &&
-        ((NULL == m->key) ||
-         (memcmp (key, m->key, sizeof(struct GNUNET_HashCode)) == 0) ))
-    {
-      struct GNUNET_MQ_Envelope *env;
-      struct GNUNET_DHT_MonitorPutMessage *mmsg;
-      struct GNUNET_PeerIdentity *msg_path;
-      size_t msize;
-      unsigned int i;
 
-      /* Don't send duplicates */
-      for (i = 0; i < cl_size; i++)
-        if (cl[i] == m->ch)
-          break;
-      if (i < cl_size)
-        continue;
-      GNUNET_array_append (cl,
-                           cl_size,
-                           m->ch);
+/**
+ * Closure for response_action().
+ */
+struct ResponseActionContext
+{
+  const struct GDS_DATACACHE_BlockData *bd;
+  const struct GNUNET_PeerIdentity *get_path;
+  unsigned int get_path_length;
+};
 
-      msize = size;
-      msize += path_length * sizeof(struct GNUNET_PeerIdentity);
-      env = GNUNET_MQ_msg_extra (mmsg,
-                                 msize,
-                                 GNUNET_MESSAGE_TYPE_DHT_MONITOR_PUT);
-      mmsg->options = htonl (options);
-      mmsg->type = htonl (type);
-      mmsg->hop_count = htonl (hop_count);
-      mmsg->desired_replication_level = htonl (desired_replication_level);
-      mmsg->put_path_length = htonl (path_length);
-      mmsg->key = *key;
-      mmsg->expiration_time = GNUNET_TIME_absolute_hton (exp);
-      msg_path = (struct GNUNET_PeerIdentity *) &mmsg[1];
-      GNUNET_memcpy (msg_path,
-                     path,
-                     path_length * sizeof(struct GNUNET_PeerIdentity));
-      GNUNET_memcpy (&msg_path[path_length],
-                     data,
-                     size);
-      GNUNET_MQ_send (m->ch->mq,
-                      env);
-    }
-  }
-  GNUNET_free (cl);
+
+/**
+ * Function called on monitors that match a response.
+ * Sends the response notification to the monitor.
+ *
+ * @param cls a `struct ResponseActionContext`
+ * @param m a matching monitor
+ */
+static void
+response_action (void *cls,
+                 struct ClientMonitorRecord *m)
+{
+  const struct ResponseActionContext *resp_ctx = cls;
+  const struct GDS_DATACACHE_BlockData *bd = resp_ctx->bd;
+
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_DHT_MonitorGetRespMessage *mmsg;
+  struct GNUNET_PeerIdentity *path;
+  size_t msize;
+
+  msize = bd->data_size;
+  msize += (resp_ctx->get_path_length + bd->put_path_length)
+           * sizeof(struct GNUNET_PeerIdentity);
+  env = GNUNET_MQ_msg_extra (mmsg,
+                             msize,
+                             GNUNET_MESSAGE_TYPE_DHT_MONITOR_GET_RESP);
+  mmsg->type = htonl (bd->type);
+  mmsg->put_path_length = htonl (bd->put_path_length);
+  mmsg->get_path_length = htonl (resp_ctx->get_path_length);
+  mmsg->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
+  mmsg->key = bd->key;
+  path = (struct GNUNET_PeerIdentity *) &mmsg[1];
+  GNUNET_memcpy (path,
+                 bd->put_path,
+                 bd->put_path_length * sizeof(struct GNUNET_PeerIdentity));
+  GNUNET_memcpy (path,
+                 resp_ctx->get_path,
+                 resp_ctx->get_path_length * sizeof(struct
+                                                    GNUNET_PeerIdentity));
+  GNUNET_memcpy (&path[resp_ctx->get_path_length],
+                 bd->data,
+                 bd->data_size);
+  GNUNET_MQ_send (m->ch->mq,
+                  env);
+}
+
+
+void
+GDS_CLIENTS_process_get_resp (const struct GDS_DATACACHE_BlockData *bd,
+                              const struct GNUNET_PeerIdentity *get_path,
+                              unsigned int get_path_length)
+{
+  struct ResponseActionContext rac = {
+    .bd = bd,
+    .get_path = get_path,
+    .get_path_length = get_path_length
+  };
+
+  for_matching_monitors (bd->type,
+                         &bd->key,
+                         &response_action,
+                         &rac);
+}
+
+
+/**
+ * Closure for put_action().
+ */
+struct PutActionContext
+{
+  const struct GDS_DATACACHE_BlockData *bd;
+  enum GNUNET_DHT_RouteOption options;
+  uint32_t hop_count;
+  uint32_t desired_replication_level;
+};
+
+
+/**
+ * Function called on monitors that match a PUT.
+ * Sends the PUT notification to the monitor.
+ *
+ * @param cls a `struct PutActionContext`
+ * @param m a matching monitor
+ */
+static void
+put_action (void *cls,
+            struct ClientMonitorRecord *m)
+{
+  const struct PutActionContext *put_ctx = cls;
+  const struct GDS_DATACACHE_BlockData *bd = put_ctx->bd;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_DHT_MonitorPutMessage *mmsg;
+  struct GNUNET_PeerIdentity *msg_path;
+  size_t msize;
+
+  msize = bd->data_size
+          + bd->put_path_length
+          * sizeof(struct GNUNET_PeerIdentity);
+  env = GNUNET_MQ_msg_extra (mmsg,
+                             msize,
+                             GNUNET_MESSAGE_TYPE_DHT_MONITOR_PUT);
+  mmsg->options = htonl (put_ctx->options);
+  mmsg->type = htonl (bd->type);
+  mmsg->hop_count = htonl (put_ctx->hop_count);
+  mmsg->desired_replication_level = htonl (put_ctx->desired_replication_level);
+  mmsg->put_path_length = htonl (bd->put_path_length);
+  mmsg->key = bd->key;
+  mmsg->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
+  msg_path = (struct GNUNET_PeerIdentity *) &mmsg[1];
+  GNUNET_memcpy (msg_path,
+                 bd->put_path,
+                 bd->put_path_length * sizeof(struct GNUNET_PeerIdentity));
+  GNUNET_memcpy (&msg_path[bd->put_path_length],
+                 bd->data,
+                 bd->data_size);
+  GNUNET_MQ_send (m->ch->mq,
+                  env);
 }
 
 
+void
+GDS_CLIENTS_process_put (enum GNUNET_DHT_RouteOption options,
+                         const struct GDS_DATACACHE_BlockData *bd,
+                         uint32_t hop_count,
+                         uint32_t desired_replication_level)
+{
+  struct PutActionContext put_ctx = {
+    .bd = bd,
+    .hop_count = hop_count,
+    .desired_replication_level = desired_replication_level,
+    .options = options
+  };
+
+  for_matching_monitors (bd->type,
+                         &bd->key,
+                         &put_action,
+                         &put_ctx);
+}
+
+
+/* ********************** Initialization logic ***************** */
+
+
 /**
  * Initialize client subsystem.
  *
  * @param server the initialized server
  */
 static void
-GDS_CLIENTS_init ()
+GDS_CLIENTS_init (void)
 {
   forward_map
     = GNUNET_CONTAINER_multihashmap_create (1024,
@@ -1469,7 +1455,7 @@ GDS_CLIENTS_init ()
  * Shutdown client subsystem.
  */
 static void
-GDS_CLIENTS_stop ()
+GDS_CLIENTS_stop (void)
 {
   if (NULL != retry_task)
   {
diff --git a/src/dht/gnunet-service-dht_datacache.c b/src/dht/gnunet-service-dht_datacache.c
index 7eded2152..214c4a3f4 100644
--- a/src/dht/gnunet-service-dht_datacache.c
+++ b/src/dht/gnunet-service-dht_datacache.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011, 2015, 2017 GNUnet e.V.
+     Copyright (C) 2009, 2010, 2011, 2015, 2017, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -38,67 +38,53 @@
  */
 #define NUM_CLOSEST 42
 
+
 /**
  * Handle to the datacache service (for inserting/retrieving data)
  */
 static struct GNUNET_DATACACHE_Handle *datacache;
 
 
-/**
- * Handle a datum we've received from another peer.  Cache if
- * possible.
- *
- * @param expiration when will the reply expire
- * @param key the query this reply is for
- * @param put_path_length number of peers in @a put_path
- * @param put_path path the reply took on put
- * @param type type of the reply
- * @param data_size number of bytes in @a data
- * @param data application payload data
- */
 void
-GDS_DATACACHE_handle_put (struct GNUNET_TIME_Absolute expiration,
-                          const struct GNUNET_HashCode *key,
-                          unsigned int put_path_length,
-                          const struct GNUNET_PeerIdentity *put_path,
-                          enum GNUNET_BLOCK_Type type,
-                          size_t data_size,
-                          const void *data)
+GDS_DATACACHE_handle_put (const struct GDS_DATACACHE_BlockData *bd)
 {
-  int r;
+  struct GNUNET_HashCode xor;
+  enum GNUNET_GenericReturnValue r;
 
   if (NULL == datacache)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("%s request received, but have no datacache!\n"), "PUT");
+                "PUT request received, but have no datacache!\n");
     return;
   }
-  if (data_size >= GNUNET_MAX_MESSAGE_SIZE)
+  if (bd->data_size >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
     return;
   }
   /* Put size is actual data size plus struct overhead plus path length (if any) */
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# ITEMS stored in datacache"),
+                            "# ITEMS stored in datacache",
                             1,
                             GNUNET_NO);
+  GNUNET_CRYPTO_hash_xor (&bd->key,
+                          &my_identity_hash,
+                          &xor);
   r = GNUNET_DATACACHE_put (datacache,
-                            key,
-                            GNUNET_CRYPTO_hash_matching_bits (key,
-                                                              &my_identity_hash),
-                            data_size,
-                            data,
-                            type,
-                            expiration,
-                            put_path_length,
-                            put_path);
+                            &bd->key,
+                            GNUNET_CRYPTO_hash_count_leading_zeros (&xor),
+                            bd->data_size,
+                            bd->data,
+                            bd->type,
+                            bd->expiration_time,
+                            bd->put_path_length,
+                            bd->put_path);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
        "DATACACHE PUT for key %s [%lu] completed (%d) after %u hops\n",
-       GNUNET_h2s (key),
-       (unsigned long) data_size,
+       GNUNET_h2s (&bd->key),
+       (unsigned long) bd->data_size,
        r,
-       put_path_length);
+       bd->put_path_length);
 }
 
 
@@ -158,7 +144,7 @@ struct GetRequestContext
  * @return #GNUNET_OK to continue iteration, anything else
  * to stop iteration.
  */
-static int
+static enum GNUNET_GenericReturnValue
 datacache_get_iterator (void *cls,
                         const struct GNUNET_HashCode *key,
                         size_t data_size,
@@ -168,111 +154,74 @@ datacache_get_iterator (void *cls,
                         unsigned int put_path_length,
                         const struct GNUNET_PeerIdentity *put_path)
 {
-  static char non_null;
   struct GetRequestContext *ctx = cls;
-  enum GNUNET_BLOCK_EvaluationResult eval;
-
-  if (0 == GNUNET_TIME_absolute_get_remaining (exp).rel_value_us)
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
+  struct GDS_DATACACHE_BlockData bd = {
+    .key = *key,
+    .expiration_time = exp,
+    .put_path = put_path,
+    .data = data,
+    .data_size = data_size,
+    .put_path_length = put_path_length,
+    .type = type
+  };
+
+  if (GNUNET_TIME_absolute_is_past (exp))
   {
     GNUNET_break (0);  /* why does datacache return expired values? */
     return GNUNET_OK;   /* skip expired record */
   }
-  if ((NULL == data) &&
-      (0 == data_size))
-    data = &non_null; /* point anywhere, but not to NULL */
-
   eval
-    = GNUNET_BLOCK_evaluate (GDS_block_context,
-                             type,
-                             ctx->bg,
-                             GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO,
-                             key,
-                             ctx->xquery,
-                             ctx->xquery_size,
-                             data,
-                             data_size);
+    = GNUNET_BLOCK_check_reply (GDS_block_context,
+                                bd.type,
+                                ctx->bg,
+                                &bd.key,
+                                ctx->xquery,
+                                ctx->xquery_size,
+                                bd.data,
+                                bd.data_size);
   LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Found reply for query %s in datacache, evaluation result is %d\n",
+       "Evaluated reply for query %s in datacache, result is %d\n",
        GNUNET_h2s (key),
        (int) eval);
   ctx->eval = eval;
   switch (eval)
   {
-  case GNUNET_BLOCK_EVALUATION_OK_MORE:
-  case GNUNET_BLOCK_EVALUATION_OK_LAST:
-    /* forward to local clients */
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                                ("# Good RESULTS found in datacache"), 1,
-                              GNUNET_NO);
-    ctx->gc (ctx->gc_cls,
-             type,
-             exp,
-             key,
-             put_path_length, put_path,
-             0, NULL,
-             data, data_size);
-    break;
-
-  case GNUNET_BLOCK_EVALUATION_OK_DUPLICATE:
+  case GNUNET_BLOCK_REPLY_OK_MORE:
+  case GNUNET_BLOCK_REPLY_OK_LAST:
+  case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
+    /* forward to initiator */
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# Duplicate RESULTS found in datacache"),
+                              "# Good RESULTS found in datacache",
                               1,
                               GNUNET_NO);
+    ctx->gc (ctx->gc_cls,
+             &bd);
     break;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_INVALID:
+  case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# Invalid RESULTS found in datacache"),
+                              "# Duplicate RESULTS found in datacache",
                               1,
                               GNUNET_NO);
     break;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT:
+  case GNUNET_BLOCK_REPLY_INVALID:
+    /* maybe it expired? */
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# Irrelevant RESULTS found in datacache"),
+                              "# Invalid RESULTS found in datacache",
                               1,
                               GNUNET_NO);
     break;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_VALID:
-    GNUNET_break (0);
-    break;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_INVALID:
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-
-  case GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED:
+  case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# Unsupported RESULTS found in datacache"),
+                              "# Irrelevant RESULTS found in datacache",
                               1,
                               GNUNET_NO);
-    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                _ ("Unsupported block type (%u) in local response!\n"),
-                type);
     break;
   }
-  return (eval == GNUNET_BLOCK_EVALUATION_OK_LAST) ? GNUNET_NO : GNUNET_OK;
+  return (eval == GNUNET_BLOCK_REPLY_OK_LAST) ? GNUNET_NO : GNUNET_OK;
 }
 
 
-/**
- * Handle a GET request we've received from another peer.
- *
- * @param key the query
- * @param type requested data type
- * @param xquery extended query
- * @param xquery_size number of bytes in @a xquery
- * @param bg block group to use for reply evaluation
- * @param gc function to call on the results
- * @param gc_cls closure for @a gc
- * @return evaluation result for the local replies
- */
 enum GNUNET_BLOCK_EvaluationResult
 GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
                           enum GNUNET_BLOCK_Type type,
@@ -288,7 +237,7 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
   if (NULL == datacache)
     return GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# GET requests given to datacache"),
+                            "# GET requests given to datacache",
                             1,
                             GNUNET_NO);
   ctx.eval = GNUNET_BLOCK_EVALUATION_REQUEST_VALID;
@@ -313,62 +262,6 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
 
 
 /**
- * Function called with a random element from the datacache.
- * Stores the key in the closure.
- *
- * @param cls a `struct GNUNET_HashCode *`, where to store the @a key
- * @param key key for the content
- * @param data_size number of bytes in @a data
- * @param data content stored
- * @param type type of the content
- * @param exp when will the content expire?
- * @param path_info_len number of entries in @a path_info
- * @param path_info a path through the network
- * @return #GNUNET_OK to continue iterating, #GNUNET_SYSERR to abort
- */
-static int
-datacache_random_iterator (void *cls,
-                           const struct GNUNET_HashCode *key,
-                           size_t data_size,
-                           const char *data,
-                           enum GNUNET_BLOCK_Type type,
-                           struct GNUNET_TIME_Absolute exp,
-                           unsigned int path_info_len,
-                           const struct GNUNET_PeerIdentity *path_info)
-{
-  struct GNUNET_HashCode *dest = cls;
-
-  *dest = *key;
-  return GNUNET_OK; /* should actually not matter which we return */
-}
-
-
-/**
- * Obtain a random key from the datacache.
- * Used by Whanau for load-balancing.
- *
- * @param[out] key where to store the key of a random element,
- *             randomized by PRNG if datacache is empty
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the datacache is empty
- */
-int
-GDS_DATACACHE_get_random_key (struct GNUNET_HashCode *key)
-{
-  if (0 ==
-      GNUNET_DATACACHE_get_random (datacache,
-                                   &datacache_random_iterator,
-                                   key))
-  {
-    /* randomize key in this case */
-    GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_NONCE,
-                                      key);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
-}
-
-
-/**
  * Closure for #datacache_get_successors_iterator().
  */
 struct SuccContext
@@ -376,12 +269,13 @@ struct SuccContext
   /**
    * Function to call on the result
    */
-  GDS_DATACACHE_SuccessorCallback cb;
+  GDS_DATACACHE_GetCallback cb;
 
   /**
    * Closure for @e cb.
    */
   void *cb_cls;
+
 };
 
 
@@ -399,7 +293,7 @@ struct SuccContext
  * @return #GNUNET_OK to continue iteration, anything else
  * to stop iteration.
  */
-static int
+static enum GNUNET_GenericReturnValue
 datacache_get_successors_iterator (void *cls,
                                    const struct GNUNET_HashCode *key,
                                    size_t size,
@@ -410,40 +304,36 @@ datacache_get_successors_iterator (void *cls,
                                    const struct GNUNET_PeerIdentity *put_path)
 {
   const struct SuccContext *sc = cls;
+  struct GDS_DATACACHE_BlockData bd = {
+    .key = *key,
+    .expiration_time = exp,
+    .put_path = put_path,
+    .data = data,
+    .data_size = size,
+    .put_path_length = put_path_length,
+    .type = type
+  };
 
   /* NOTE: The datacache currently does not store the RO from
      the original 'put', so we don't know the 'correct' option
      at this point anymore.  Thus, we conservatively assume
      that recording is desired (for now). */
   sc->cb (sc->cb_cls,
-          GNUNET_DHT_RO_RECORD_ROUTE,
-          key,
-          type,
-          put_path_length, put_path,
-          exp,
-          data,
-          size);
+          &bd);
   return GNUNET_OK;
 }
 
 
-/**
- * Handle a request for data close to a key that we have received from
- * another peer.
- *
- * @param key the location at which the peer is looking for data that is close
- * @param cb function to call with the result
- * @param cb_cls closure for @a cb
- */
 void
-GDS_DATACACHE_get_successors (const struct GNUNET_HashCode *key,
-                              GDS_DATACACHE_SuccessorCallback cb,
-                              void *cb_cls)
+GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           GDS_DATACACHE_GetCallback cb,
+                           void *cb_cls)
 {
-  struct SuccContext sc;
+  struct SuccContext sc = {
+    .cb = cb,
+    .cb_cls = cb_cls
+  };
 
-  sc.cb = cb;
-  sc.cb_cls = cb_cls;
   (void) GNUNET_DATACACHE_get_closest (datacache,
                                        key,
                                        NUM_CLOSEST,
@@ -452,19 +342,14 @@ GDS_DATACACHE_get_successors (const struct GNUNET_HashCode *key,
 }
 
 
-/**
- * Initialize datacache subsystem.
- */
 void
 GDS_DATACACHE_init ()
 {
-  datacache = GNUNET_DATACACHE_create (GDS_cfg, "dhtcache");
+  datacache = GNUNET_DATACACHE_create (GDS_cfg,
+                                       "dhtcache");
 }
 
 
-/**
- * Shutdown datacache subsystem.
- */
 void
 GDS_DATACACHE_done ()
 {
diff --git a/src/dht/gnunet-service-dht_datacache.h b/src/dht/gnunet-service-dht_datacache.h
index 5be59c90e..249bb8ee3 100644
--- a/src/dht/gnunet-service-dht_datacache.h
+++ b/src/dht/gnunet-service-dht_datacache.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
+     Copyright (C) 2009, 2010, 2011, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -31,53 +31,68 @@
 #include "gnunet_block_lib.h"
 #include "gnunet_dht_service.h"
 
+
+/**
+ * Information about a block stored in the datacache.
+ */
+struct GDS_DATACACHE_BlockData
+{
+  /**
+   * Key of the block.
+   */
+  struct GNUNET_HashCode key;
+
+  /**
+   * When does the block expire?
+   */
+  struct GNUNET_TIME_Absolute expiration_time;
+
+  /**
+   * PUT path taken by the block, array of peer identities.
+   */
+  const struct GNUNET_PeerIdentity *put_path;
+
+  /**
+   * Actual block data.
+   */
+  const void *data;
+
+  /**
+   * Number of bytes in @a data.
+   */
+  size_t data_size;
+
+  /**
+   * Length of the @e put_path array.
+   */
+  unsigned int put_path_length;
+
+  /**
+   * Type of the block.
+   */
+  enum GNUNET_BLOCK_Type type;
+};
+
+
 /**
  * Handle a datum we've received from another peer.  Cache if
  * possible.
  *
- * @param expiration when will the reply expire
- * @param key the query this reply is for
- * @param put_path_length number of peers in 'put_path'
- * @param put_path path the reply took on put
- * @param type type of the reply
- * @param data_size number of bytes in 'data'
- * @param data application payload data
+ * @param bd block data to cache
  */
 void
-GDS_DATACACHE_handle_put (struct GNUNET_TIME_Absolute expiration,
-                          const struct GNUNET_HashCode *key,
-                          unsigned int put_path_length,
-                          const struct GNUNET_PeerIdentity *put_path,
-                          enum GNUNET_BLOCK_Type type,
-                          size_t data_size,
-                          const void *data);
+GDS_DATACACHE_handle_put (const struct GDS_DATACACHE_BlockData *bd);
 
 
 /**
  * Handle a result for a GET operation.
  *
  * @param cls closure
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
- * @param get_path_length number of entries in @a get_path
- * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in @a data
+ * @param bd block details
  */
 typedef void
 (*GDS_DATACACHE_GetCallback)(void *cls,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_TIME_Absolute expiration_time,
-                             const struct GNUNET_HashCode *key,
-                             unsigned int put_path_length,
-                             const struct GNUNET_PeerIdentity *put_path,
-                             unsigned int get_path_length,
-                             const struct GNUNET_PeerIdentity *get_path,
-                             const void *data,
-                             size_t data_size);
+                             const struct GDS_DATACACHE_BlockData *bd);
 
 
 /**
@@ -103,43 +118,6 @@ GDS_DATACACHE_handle_get (const struct GNUNET_HashCode *key,
 
 
 /**
- * Obtain a random key from the datacache.
- * Used by Whanau for load-balancing.
- *
- * @param[out] key where to store the key of a random element,
- *             randomized by PRNG if datacache is empty
- * @return #GNUNET_OK on success, #GNUNET_SYSERR if the datacache is empty
- */
-int
-GDS_DATACACHE_get_random_key (struct GNUNET_HashCode *key);
-
-
-/**
- * Send the get result to requesting client.
- *
- * @param cls closure
- * @param options routing options (from GET request)
- * @param key key of the requested data.
- * @param type block type
- * @param put_path_length number of peers in @a put_path
- * @param put_path path taken to put the data at its stored location.
- * @param expiration when will this result expire?
- * @param data payload to store
- * @param data_size size of the @a data
- */
-typedef void
-(*GDS_DATACACHE_SuccessorCallback)(void *cls,
-                                   enum GNUNET_DHT_RouteOption options,
-                                   const struct GNUNET_HashCode *key,
-                                   enum GNUNET_BLOCK_Type type,
-                                   unsigned int put_path_length,
-                                   const struct GNUNET_PeerIdentity *put_path,
-                                   struct GNUNET_TIME_Absolute expiration,
-                                   const void *data,
-                                   size_t data_size);
-
-
-/**
  * Handle a request for data close to a key that we have received from
  * another peer.
  *
@@ -148,9 +126,9 @@ typedef void
  * @param cb_cls closure for @a cb
  */
 void
-GDS_DATACACHE_get_successors (const struct GNUNET_HashCode *key,
-                              GDS_DATACACHE_SuccessorCallback cb,
-                              void *cb_cls);
+GDS_DATACACHE_get_closest (const struct GNUNET_HashCode *key,
+                           GDS_DATACACHE_GetCallback cb,
+                           void *cb_cls);
 
 
 /**
diff --git a/src/dht/gnunet-service-dht_hello.c b/src/dht/gnunet-service-dht_hello.c
index 906391334..949456575 100644
--- a/src/dht/gnunet-service-dht_hello.c
+++ b/src/dht/gnunet-service-dht_hello.c
@@ -54,7 +54,8 @@ GDS_HELLO_get (const struct GNUNET_PeerIdentity *peer)
 {
   if (NULL == peer_to_hello)
     return NULL;
-  return GNUNET_CONTAINER_multipeermap_get (peer_to_hello, peer);
+  return GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
+                                            peer);
 }
 
 
@@ -83,15 +84,20 @@ process_hello (void *cls,
   if (0 == GNUNET_TIME_absolute_get_remaining (ex).rel_value_us)
     return;
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# HELLOs obtained from peerinfo"), 1,
+                            "# HELLOs obtained from peerinfo",
+                            1,
                             GNUNET_NO);
-  hm = GNUNET_CONTAINER_multipeermap_get (peer_to_hello, peer);
+  hm = GNUNET_CONTAINER_multipeermap_get (peer_to_hello,
+                                          peer);
   GNUNET_free (hm);
   hm = GNUNET_malloc (GNUNET_HELLO_size (hello));
-  GNUNET_memcpy (hm, hello, GNUNET_HELLO_size (hello));
+  GNUNET_memcpy (hm,
+                 hello,
+                 GNUNET_HELLO_size (hello));
   GNUNET_assert (GNUNET_SYSERR !=
                  GNUNET_CONTAINER_multipeermap_put (peer_to_hello,
-                                                    peer, hm,
+                                                    peer,
+                                                    hm,
                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
 }
 
@@ -114,7 +120,7 @@ GDS_HELLO_init ()
 /**
  * Free memory occopied by the HELLO.
  */
-static int
+static enum GNUNET_GenericReturnValue
 free_hello (void *cls,
             const struct GNUNET_PeerIdentity *key,
             void *hello)
diff --git a/src/dht/gnunet-service-dht_neighbours.c b/src/dht/gnunet-service-dht_neighbours.c
index 02dab849b..35502e0f5 100644
--- a/src/dht/gnunet-service-dht_neighbours.c
+++ b/src/dht/gnunet-service-dht_neighbours.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009-2017, 2021 GNUnet e.V.
+     Copyright (C) 2009-2017, 2021, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -25,21 +25,12 @@
  * @author Nathan Evans
  */
 #include "platform.h"
-#include "gnunet_util_lib.h"
-#include "gnunet_block_lib.h"
-#include "gnunet_hello_lib.h"
 #include "gnunet_constants.h"
 #include "gnunet_protocols.h"
-#include "gnunet_nse_service.h"
 #include "gnunet_ats_service.h"
 #include "gnunet_core_service.h"
-#include "gnunet_datacache_lib.h"
-#include "gnunet_transport_service.h"
 #include "gnunet_hello_lib.h"
-#include "gnunet_dht_service.h"
-#include "gnunet_statistics_service.h"
 #include "gnunet-service-dht.h"
-#include "gnunet-service-dht_datacache.h"
 #include "gnunet-service-dht_hello.h"
 #include "gnunet-service-dht_neighbours.h"
 #include "gnunet-service-dht_nse.h"
@@ -55,7 +46,7 @@
 #define SANITY_CHECKS 1
 
 /**
- * How many buckets will we allow total.
+ * How many buckets will we allow in total.
  */
 #define MAX_BUCKETS sizeof(struct GNUNET_HashCode) * 8
 
@@ -70,26 +61,29 @@
 #define FIND_PEER_REPLICATION_LEVEL 4
 
 /**
- * Maximum allowed replication level for all requests.
- */
-#define MAXIMUM_REPLICATION_LEVEL 16
-
-/**
  * Maximum allowed number of pending messages per peer.
  */
 #define MAXIMUM_PENDING_PER_PEER 64
 
 /**
  * How long at least to wait before sending another find peer request.
+ * This is basically the frequency at which we will usually send out
+ * requests when we are 'perfectly' connected.
  */
 #define DHT_MINIMUM_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
-    GNUNET_TIME_UNIT_SECONDS, 30)
+    GNUNET_TIME_UNIT_MINUTES, 2)
 
 /**
- * How long at most to wait before sending another find peer request.
+ * How long to additionally wait on average per #bucket_size to send out the
+ * FIND PEER requests if we did successfully connect (!) to a a new peer and
+ * added it to a bucket (as counted in #newly_found_peers).  This time is
+ * Multiplied by 100 * newly_found_peers / bucket_size to get the new delay
+ * for finding peers (the #DHT_MINIMUM_FIND_PEER_INTERVAL is still added on
+ * top).  Also the range in which we randomize, so the effective value
+ * is half of the number given here.
  */
-#define DHT_MAXIMUM_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
-    GNUNET_TIME_UNIT_MINUTES, 10)
+#define DHT_AVG_FIND_PEER_INTERVAL GNUNET_TIME_relative_multiply ( \
+    GNUNET_TIME_UNIT_SECONDS, 6)
 
 /**
  * How long at most to wait for transmission of a GET request to another peer?
@@ -424,20 +418,24 @@ static struct GNUNET_ATS_ConnectivityHandle *ats_ch;
  * Find the optimal bucket for this key.
  *
  * @param hc the hashcode to compare our identity to
- * @return the proper bucket index, or #GNUNET_SYSERR
+ * @return the proper bucket index, or -1
  *         on error (same hashcode)
  */
 static int
 find_bucket (const struct GNUNET_HashCode *hc)
 {
+  struct GNUNET_HashCode xor;
   unsigned int bits;
 
-  bits = GNUNET_CRYPTO_hash_matching_bits (&my_identity_hash, hc);
+  GNUNET_CRYPTO_hash_xor (hc,
+                          &my_identity_hash,
+                          &xor);
+  bits = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
   if (bits == MAX_BUCKETS)
   {
     /* How can all bits match? Got my own ID? */
     GNUNET_break (0);
-    return GNUNET_SYSERR;
+    return -1;
   }
   return MAX_BUCKETS - bits - 1;
 }
@@ -466,7 +464,7 @@ offer_hello_done (void *cls)
  * @param value the value to remove
  * @return #GNUNET_YES
  */
-static int
+static enum GNUNET_GenericReturnValue
 free_connect_info (void *cls,
                    const struct GNUNET_PeerIdentity *peer,
                    void *value)
@@ -505,33 +503,34 @@ static void
 try_connect (const struct GNUNET_PeerIdentity *pid,
              const struct GNUNET_MessageHeader *h)
 {
-  int bucket;
+  int bucket_idx;
   struct GNUNET_HashCode pid_hash;
   struct ConnectInfo *ci;
   uint32_t strength;
+  struct PeerBucket *bucket;
 
   GNUNET_CRYPTO_hash (pid,
                       sizeof(struct GNUNET_PeerIdentity),
                       &pid_hash);
-  bucket = find_bucket (&pid_hash);
-  if (bucket < 0)
-    return; /* self? */
+  bucket_idx = find_bucket (&pid_hash);
+  if (bucket_idx < 0)
+  {
+    GNUNET_break (0);
+    return; /* self!? */
+  }
+  bucket = &k_buckets[bucket_idx];
   ci = GNUNET_CONTAINER_multipeermap_get (all_desired_peers,
                                           pid);
-
-  if (k_buckets[bucket].peers_size < bucket_size)
-    strength = (bucket_size - k_buckets[bucket].peers_size) * bucket;
+  if (bucket->peers_size < bucket_size)
+    strength = (bucket_size - bucket->peers_size) * bucket_idx;
   else
-    strength = bucket; /* minimum value of connectivity */
+    strength = 0;
   if (GNUNET_YES ==
       GNUNET_CONTAINER_multipeermap_contains (all_connected_peers,
                                               pid))
     strength *= 2; /* double for connected peers */
-  else if (k_buckets[bucket].peers_size > bucket_size)
-    strength = 0; /* bucket full, we really do not care about more */
-
-  if ((0 == strength) &&
-      (NULL != ci))
+  if ( (0 == strength) &&
+       (NULL != ci) )
   {
     /* release request */
     GNUNET_assert (GNUNET_YES ==
@@ -549,22 +548,24 @@ try_connect (const struct GNUNET_PeerIdentity *pid,
                                                       ci,
                                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
   }
-  if ((NULL != ci->oh) &&
-      (NULL != h))
+  if ( (NULL != ci->oh) &&
+       (NULL != h) )
     GNUNET_TRANSPORT_offer_hello_cancel (ci->oh);
   if (NULL != h)
     ci->oh = GNUNET_TRANSPORT_offer_hello (GDS_cfg,
                                            h,
                                            &offer_hello_done,
                                            ci);
-  if ((NULL != ci->sh) &&
-      (ci->strength != strength))
+  if ( (NULL != ci->sh) &&
+       (ci->strength != strength) )
     GNUNET_ATS_connectivity_suggest_cancel (ci->sh);
   if (ci->strength != strength)
+  {
     ci->sh = GNUNET_ATS_connectivity_suggest (ats_ch,
                                               pid,
                                               strength);
-  ci->strength = strength;
+    ci->strength = strength;
+  }
 }
 
 
@@ -580,7 +581,7 @@ try_connect (const struct GNUNET_PeerIdentity *pid,
  * @param value unused
  * @return #GNUNET_YES (continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 update_desire_strength (void *cls,
                         const struct GNUNET_PeerIdentity *pid,
                         void *value)
@@ -595,12 +596,9 @@ update_desire_strength (void *cls,
 
 /**
  * Update our preferences for connectivity as given to ATS.
- *
- * @param cls the `struct PeerInfo` of the peer
- * @param tc scheduler context.
  */
 static void
-update_connect_preferences ()
+update_connect_preferences (void)
 {
   GNUNET_CONTAINER_multipeermap_iterate (all_desired_peers,
                                          &update_desire_strength,
@@ -609,32 +607,27 @@ update_connect_preferences ()
 
 
 /**
- * Add each of the peers we already know to the bloom filter of
+ * Add each of the peers we already know to the Bloom filter of
  * the request so that we don't get duplicate HELLOs.
  *
  * @param cls the `struct GNUNET_BLOCK_Group`
  * @param key peer identity to add to the bloom filter
- * @param value value the peer information (unused)
+ * @param value the peer information
  * @return #GNUNET_YES (we should continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 add_known_to_bloom (void *cls,
                     const struct GNUNET_PeerIdentity *key,
                     void *value)
 {
   struct GNUNET_BLOCK_Group *bg = cls;
-  struct GNUNET_HashCode key_hash;
+  struct PeerInfo *pi = value;
 
-  (void) cls;
-  (void) value;
-  GNUNET_CRYPTO_hash (key,
-                      sizeof(struct GNUNET_PeerIdentity),
-                      &key_hash);
   GNUNET_BLOCK_group_set_seen (bg,
-                               &key_hash,
+                               &pi->phash,
                                1);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Adding known peer (%s) to bloomfilter for FIND PEER\n",
+              "Adding known peer (%s) to Bloom filter for FIND PEER\n",
               GNUNET_i2s (key));
   return GNUNET_YES;
 }
@@ -645,73 +638,88 @@ add_known_to_bloom (void *cls,
  * so that we can find the closest peers in the network to ourselves
  * and attempt to connect to them.
  *
- * @param cls closure for this task
+ * @param cls closure for this task, NULL
  */
 static void
 send_find_peer_message (void *cls)
 {
-  struct GNUNET_TIME_Relative next_send_time;
-  struct GNUNET_BLOCK_Group *bg;
-  struct GNUNET_CONTAINER_BloomFilter *peer_bf;
-
   (void) cls;
-  find_peer_task = NULL;
-  if (newly_found_peers > bucket_size)
+
+  /* Compute when to do this again (and if we should
+     even send a message right now) */
   {
-    /* If we are finding many peers already, no need to send out our request right now! */
+    struct GNUNET_TIME_Relative next_send_time;
+    bool done_early;
+
+    find_peer_task = NULL;
+    done_early = (newly_found_peers > bucket_size);
+    /* schedule next round, taking longer if we found more peers
+       in the last round. */
+    next_send_time.rel_value_us =
+      DHT_MINIMUM_FIND_PEER_INTERVAL.rel_value_us
+      + GNUNET_CRYPTO_random_u64 (
+        GNUNET_CRYPTO_QUALITY_WEAK,
+        GNUNET_TIME_relative_multiply (
+          DHT_AVG_FIND_PEER_INTERVAL,
+          100 * (1 + newly_found_peers) / bucket_size).rel_value_us);
+    newly_found_peers = 0;
+    GNUNET_assert (NULL == find_peer_task);
     find_peer_task =
-      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_MINUTES,
+      GNUNET_SCHEDULER_add_delayed (next_send_time,
                                     &send_find_peer_message,
                                     NULL);
-    newly_found_peers = 0;
-    return;
+    if (done_early)
+      return;
+  }
+
+  /* actually send 'find peer' request */
+  {
+    struct GNUNET_BLOCK_Group *bg;
+    struct GNUNET_CONTAINER_BloomFilter *peer_bf;
+
+    bg = GNUNET_BLOCK_group_create (GDS_block_context,
+                                    GNUNET_BLOCK_TYPE_DHT_HELLO,
+                                    GNUNET_CRYPTO_random_u32 (
+                                      GNUNET_CRYPTO_QUALITY_WEAK,
+                                      UINT32_MAX),
+                                    NULL,
+                                    0,
+                                    "filter-size",
+                                    DHT_BLOOM_SIZE,
+                                    NULL);
+    GNUNET_CONTAINER_multipeermap_iterate (all_connected_peers,
+                                           &add_known_to_bloom,
+                                           bg);
+    peer_bf
+      = GNUNET_CONTAINER_bloomfilter_init (NULL,
+                                           DHT_BLOOM_SIZE,
+                                           GNUNET_CONSTANTS_BLOOMFILTER_K);
+    if (GNUNET_OK !=
+        GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_HELLO,
+                                   GNUNET_DHT_RO_FIND_PEER
+                                   | GNUNET_DHT_RO_RECORD_ROUTE,
+                                   FIND_PEER_REPLICATION_LEVEL,
+                                   0, /* hop count */
+                                   &my_identity_hash,
+                                   NULL, 0, /* xquery */
+                                   bg,
+                                   peer_bf))
+    {
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# Failed to initiate FIND PEER lookup",
+                                1,
+                                GNUNET_NO);
+    }
+    else
+    {
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# FIND PEER messages initiated",
+                                1,
+                                GNUNET_NO);
+    }
+    GNUNET_CONTAINER_bloomfilter_free (peer_bf);
+    GNUNET_BLOCK_group_destroy (bg);
   }
-  bg = GNUNET_BLOCK_group_create (GDS_block_context,
-                                  GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                  GNUNET_CRYPTO_random_u32 (
-                                    GNUNET_CRYPTO_QUALITY_WEAK,
-                                    UINT32_MAX),
-                                  NULL,
-                                  0,
-                                  "filter-size",
-                                  DHT_BLOOM_SIZE,
-                                  NULL);
-  GNUNET_CONTAINER_multipeermap_iterate (all_connected_peers,
-                                         &add_known_to_bloom,
-                                         bg);
-  GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# FIND PEER messages initiated"),
-                            1,
-                            GNUNET_NO);
-  peer_bf
-    = GNUNET_CONTAINER_bloomfilter_init (NULL,
-                                         DHT_BLOOM_SIZE,
-                                         GNUNET_CONSTANTS_BLOOMFILTER_K);
-  // FIXME: pass priority!?
-  GDS_NEIGHBOURS_handle_get (GNUNET_BLOCK_TYPE_DHT_HELLO,
-                             GNUNET_DHT_RO_FIND_PEER
-                             | GNUNET_DHT_RO_RECORD_ROUTE,
-                             FIND_PEER_REPLICATION_LEVEL,
-                             0,
-                             &my_identity_hash,
-                             NULL,
-                             0,
-                             bg,
-                             peer_bf);
-  GNUNET_CONTAINER_bloomfilter_free (peer_bf);
-  GNUNET_BLOCK_group_destroy (bg);
-  /* schedule next round */
-  next_send_time.rel_value_us =
-    DHT_MINIMUM_FIND_PEER_INTERVAL.rel_value_us
-    + GNUNET_CRYPTO_random_u64 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                DHT_MAXIMUM_FIND_PEER_INTERVAL.rel_value_us
-                                / (newly_found_peers + 1));
-  newly_found_peers = 0;
-  GNUNET_assert (NULL == find_peer_task);
-  find_peer_task =
-    GNUNET_SCHEDULER_add_delayed (next_send_time,
-                                  &send_find_peer_message,
-                                  NULL);
 }
 
 
@@ -729,6 +737,7 @@ handle_core_connect (void *cls,
                      struct GNUNET_MQ_Handle *mq)
 {
   struct PeerInfo *pi;
+  struct PeerBucket *bucket;
 
   (void) cls;
   /* Check for connect to self message */
@@ -736,13 +745,13 @@ handle_core_connect (void *cls,
                           peer))
     return NULL;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Connected to %s\n",
+              "Connected to peer %s\n",
               GNUNET_i2s (peer));
-  GNUNET_assert (GNUNET_NO ==
+  GNUNET_assert (NULL ==
                  GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
                                                     peer));
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# peers connected"),
+                            "# peers connected",
                             1,
                             GNUNET_NO);
   pi = GNUNET_new (struct PeerInfo);
@@ -752,27 +761,27 @@ handle_core_connect (void *cls,
                       sizeof(struct GNUNET_PeerIdentity),
                       &pi->phash);
   pi->peer_bucket = find_bucket (&pi->phash);
-  GNUNET_assert ((pi->peer_bucket >= 0) &&
-                 ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
-  GNUNET_CONTAINER_DLL_insert_tail (k_buckets[pi->peer_bucket].head,
-                                    k_buckets[pi->peer_bucket].tail,
+  GNUNET_assert ( (pi->peer_bucket >= 0) &&
+                  ((unsigned int) pi->peer_bucket < MAX_BUCKETS));
+  bucket = &k_buckets[pi->peer_bucket];
+  GNUNET_CONTAINER_DLL_insert_tail (bucket->head,
+                                    bucket->tail,
                                     pi);
-  k_buckets[pi->peer_bucket].peers_size++;
+  bucket->peers_size++;
   closest_bucket = GNUNET_MAX (closest_bucket,
-                               (unsigned int) pi->peer_bucket);
+                               (unsigned int) pi->peer_bucket + 1);
   GNUNET_assert (GNUNET_OK ==
                  GNUNET_CONTAINER_multipeermap_put (all_connected_peers,
                                                     pi->id,
                                                     pi,
                                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
-  if ((pi->peer_bucket > 0) &&
-      (k_buckets[pi->peer_bucket].peers_size <= bucket_size))
+  if (bucket->peers_size <= bucket_size)
   {
     update_connect_preferences ();
     newly_found_peers++;
   }
-  if ((1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
-      (GNUNET_YES != disable_try_connect))
+  if ( (1 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
+       (GNUNET_YES != disable_try_connect) )
   {
     /* got a first connection, good time to start with FIND PEER requests... */
     GNUNET_assert (NULL == find_peer_task);
@@ -796,38 +805,40 @@ handle_core_disconnect (void *cls,
                         void *internal_cls)
 {
   struct PeerInfo *to_remove = internal_cls;
+  struct PeerBucket *bucket;
 
   (void) cls;
-  /* Check for disconnect from self message */
+  /* Check for disconnect from self message (on shutdown) */
   if (NULL == to_remove)
     return;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Disconnected %s\n",
+              "Disconnected from peer %s\n",
               GNUNET_i2s (peer));
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# peers connected"),
+                            "# peers connected",
                             -1,
                             GNUNET_NO);
   GNUNET_assert (GNUNET_YES ==
                  GNUNET_CONTAINER_multipeermap_remove (all_connected_peers,
                                                        peer,
                                                        to_remove));
-  if ((0 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
-      (GNUNET_YES != disable_try_connect))
+  if ( (0 == GNUNET_CONTAINER_multipeermap_size (all_connected_peers)) &&
+       (GNUNET_YES != disable_try_connect))
   {
     GNUNET_SCHEDULER_cancel (find_peer_task);
     find_peer_task = NULL;
   }
   GNUNET_assert (to_remove->peer_bucket >= 0);
-  GNUNET_CONTAINER_DLL_remove (k_buckets[to_remove->peer_bucket].head,
-                               k_buckets[to_remove->peer_bucket].tail,
+  bucket = &k_buckets[to_remove->peer_bucket];
+  GNUNET_CONTAINER_DLL_remove (bucket->head,
+                               bucket->tail,
                                to_remove);
-  GNUNET_assert (k_buckets[to_remove->peer_bucket].peers_size > 0);
-  k_buckets[to_remove->peer_bucket].peers_size--;
-  while ((closest_bucket > 0) &&
-         (0 == k_buckets[to_remove->peer_bucket].peers_size))
+  GNUNET_assert (bucket->peers_size > 0);
+  bucket->peers_size--;
+  while ( (closest_bucket > 0) &&
+          (0 == k_buckets[closest_bucket - 1].peers_size))
     closest_bucket--;
-  if (k_buckets[to_remove->peer_bucket].peers_size < bucket_size)
+  if (bucket->peers_size < bucket_size)
     update_connect_preferences ();
   GNUNET_free (to_remove);
 }
@@ -851,14 +862,15 @@ get_forward_count (uint32_t hop_count,
 
   if (0 == target_replication)
     target_replication = 1; /* 0 is verboten */
-  if (target_replication > MAXIMUM_REPLICATION_LEVEL)
-    target_replication = MAXIMUM_REPLICATION_LEVEL;
+  if (target_replication > GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL)
+    target_replication = GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL;
   if (hop_count > GDS_NSE_get () * 4.0)
   {
     /* forcefully terminate */
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop ("# requests TTL-dropped"),
-                              1, GNUNET_NO);
+                              "# requests TTL-dropped",
+                              1,
+                              GNUNET_NO);
     return 0;
   }
   if (hop_count > GDS_NSE_get () * 2.0)
@@ -868,7 +880,8 @@ get_forward_count (uint32_t hop_count,
   }
   /* bound by system-wide maximum */
   target_replication =
-    GNUNET_MIN (MAXIMUM_REPLICATION_LEVEL, target_replication);
+    GNUNET_MIN (GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL,
+                target_replication);
   target_value =
     1 + (target_replication - 1.0) / (GDS_NSE_get ()
                                       + ((float) (target_replication - 1.0)
@@ -879,46 +892,12 @@ get_forward_count (uint32_t hop_count,
   forward_count = (uint32_t) target_value;
   /* Subtract forward_count (floor) from target_value (yields value between 0 and 1) */
   target_value = target_value - forward_count;
-  random_value =
-    GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK, UINT32_MAX);
+  random_value = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                           UINT32_MAX);
   if (random_value < (target_value * UINT32_MAX))
     forward_count++;
   return GNUNET_MIN (forward_count,
-                     MAXIMUM_REPLICATION_LEVEL);
-}
-
-
-/**
- * Compute the distance between have and target as a 64-bit value.
- * Differences in the lower bits must count stronger than differences
- * in the higher bits.
- *
- * @param target
- * @param have
- * @param bucket up to which offset are @a target and @a have identical and thus those bits should not be considered
- * @return 0 if have==target, otherwise a number
- *           that is larger as the distance between
- *           the two hash codes increases
- */
-static uint64_t
-get_distance (const struct GNUNET_HashCode *target,
-              const struct GNUNET_HashCode *have,
-              unsigned int bucket)
-{
-  uint64_t lsb = 0;
-
-  for (unsigned int i = bucket + 1;
-       (i < sizeof(struct GNUNET_HashCode) * 8) &&
-       (i < bucket + 1 + 64);
-       i++)
-  {
-    if (GNUNET_CRYPTO_hash_get_bit_rtl (target, i) !=
-        GNUNET_CRYPTO_hash_get_bit_rtl (have, i))
-      lsb |= (1LLU << (bucket + 64 - i));      /* first bit set will be 1,
-                                             * last bit set will be 63 -- if
-                                             * i does not reach 512 first... */
-  }
-  return lsb;
+                     GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL);
 }
 
 
@@ -932,60 +911,74 @@ get_distance (const struct GNUNET_HashCode *target,
  * @return #GNUNET_YES if node location is closest,
  *         #GNUNET_NO otherwise.
  */
-int
+enum GNUNET_GenericReturnValue
 GDS_am_closest_peer (const struct GNUNET_HashCode *key,
                      const struct GNUNET_CONTAINER_BloomFilter *bloom)
 {
-  int bits;
-  int other_bits;
-  int bucket_num;
-  struct PeerInfo *pos;
-
   if (0 == GNUNET_memcmp (&my_identity_hash,
                           key))
     return GNUNET_YES;
-  bucket_num = find_bucket (key);
-  GNUNET_assert (bucket_num >= 0);
-  bits = GNUNET_CRYPTO_hash_matching_bits (&my_identity_hash,
-                                           key);
-  pos = k_buckets[bucket_num].head;
-  while (NULL != pos)
+  for (int bucket_num = find_bucket (key);
+       bucket_num < closest_bucket;
+       bucket_num++)
   {
-    if ((NULL != bloom) &&
-        (GNUNET_YES ==
-         GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                            &pos->phash)))
+    unsigned int count = 0;
+
+    GNUNET_assert (bucket_num >= 0);
+    for (struct PeerInfo *pos = k_buckets[bucket_num].head;
+         NULL != pos;
+         pos = pos->next)
     {
-      pos = pos->next;
-      continue;                 /* Skip already checked entries */
+      if (count >= bucket_size)
+        break; /* we only consider first #bucket_size entries per bucket */
+      count++;
+      if ( (NULL != bloom) &&
+           (GNUNET_YES ==
+            GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                               &pos->phash)) )
+        continue;               /* Ignore filtered peers */
+      /* All peers in this bucket must be closer than us, as
+         they mismatch with our PID on the pivotal bit. So
+         because an unfiltered peer exists, we are not the
+         closest. */
+      int delta = GNUNET_CRYPTO_hash_xorcmp (&pos->phash,
+                                             &my_identity_hash,
+                                             key);
+      switch (delta)
+      {
+      case -1: /* pos closer */
+        return GNUNET_NO;
+      case 0: /* identical, impossible! */
+        GNUNET_assert (0);
+        break;
+      case 1: /* I am closer */
+        break;
+      }
     }
-    other_bits = GNUNET_CRYPTO_hash_matching_bits (&pos->phash,
-                                                   key);
-    if (other_bits > bits)
-      return GNUNET_NO;
-    if (other_bits == bits)     /* We match the same number of bits */
-      return GNUNET_YES;
-    pos = pos->next;
   }
-  /* No peers closer, we are the closest! */
+  /* No closer (unfiltered) peers found; we must be the closest! */
   return GNUNET_YES;
 }
 
 
 /**
  * Select a peer from the routing table that would be a good routing
- * destination for sending a message for "key".  The resulting peer
- * must not be in the set of blocked peers.<p>
+ * destination for sending a message for @a key.  The resulting peer
+ * must not be in the set of @a bloom blocked peers.
  *
  * Note that we should not ALWAYS select the closest peer to the
- * target, peers further away from the target should be chosen with
- * exponentially declining probability.
- *
- * FIXME: double-check that this is fine
+ * target, we do a "random" peer selection if the number of @a hops
+ * is below the logarithm of the network size estimate.
  *
+ * In all cases, we only consider at most the first #bucket_size peers of any
+ * #k_buckets. The other peers in the bucket are there because GNUnet doesn't
+ * really allow the DHT to "reject" connections, but we only use the first
+ * #bucket_size, even if more exist. (The idea is to ensure that those
+ * connections are frequently used, and for others to be not used by the DHT,
+ * and thus possibly dropped by transport due to disuse).
  *
  * @param key the key we are selecting a peer to route to
- * @param bloom a bloomfilter containing entries this request has seen already
+ * @param bloom a Bloom filter containing entries this request has seen already
  * @param hops how many hops has this message traversed thus far
  * @return Peer to route to, or NULL on error
  */
@@ -994,139 +987,194 @@ select_peer (const struct GNUNET_HashCode *key,
              const struct GNUNET_CONTAINER_BloomFilter *bloom,
              uint32_t hops)
 {
-  unsigned int bc;
-  unsigned int count;
-  unsigned int selected;
-  struct PeerInfo *pos;
-  struct PeerInfo *chosen;
-
+  if (0 == closest_bucket)
+  {
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# Peer selection failed",
+                              1,
+                              GNUNET_NO);
+    return NULL; /* we have zero connections */
+  }
   if (hops >= GDS_NSE_get ())
   {
-    /* greedy selection (closest peer that is not in bloomfilter) */
-    unsigned int best_bucket = 0;
-    uint64_t best_in_bucket = UINT64_MAX;
+    /* greedy selection (closest peer that is not in Bloom filter) */
+    struct PeerInfo *chosen = NULL;
+    int best_bucket;
+    int bucket_offset;
 
-    chosen = NULL;
-    for (bc = 0; bc <= closest_bucket; bc++)
     {
-      count = 0;
-      for (pos = k_buckets[bc].head;
-           (pos != NULL) &&
-           (count < bucket_size);
+      struct GNUNET_HashCode xor;
+
+      GNUNET_CRYPTO_hash_xor (key,
+                              &my_identity_hash,
+                              &xor);
+      best_bucket = GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
+    }
+    if (best_bucket >= closest_bucket)
+      bucket_offset = closest_bucket - 1;
+    else
+      bucket_offset = best_bucket;
+    while (-1 != bucket_offset)
+    {
+      struct PeerBucket *bucket = &k_buckets[bucket_offset];
+      unsigned int count = 0;
+
+      for (struct PeerInfo *pos = bucket->head;
+           NULL != pos;
            pos = pos->next)
       {
-        unsigned int bucket;
-        uint64_t dist;
-
-        bucket = GNUNET_CRYPTO_hash_matching_bits (key,
-                                                   &pos->phash);
-        dist = get_distance (key,
-                             &pos->phash,
-                             bucket);
-        if (bucket < best_bucket)
-          continue;
-        if (dist > best_in_bucket)
+        if (count >= bucket_size)
+          break; /* we only consider first #bucket_size entries per bucket */
+        count++;
+        if (GNUNET_YES ==
+            GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                               &pos->phash))
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "Excluded peer `%s' due to BF match in greedy routing for %s\n",
+                      GNUNET_i2s (pos->id),
+                      GNUNET_h2s (key));
           continue;
-        best_bucket = bucket;
-        best_in_bucket = dist;
-        if ( (NULL == bloom) ||
-             (GNUNET_NO ==
-              GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                                 &pos->phash)) )
+        }
+        if (NULL == chosen)
         {
+          /* First candidate */
           chosen = pos;
         }
         else
         {
-          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                      "Excluded peer `%s' due to BF match in greedy routing for %s\n",
-                      GNUNET_i2s (pos->id),
-                      GNUNET_h2s (key));
-          GNUNET_STATISTICS_update (GDS_stats,
-                                    gettext_noop (
-                                      "# Peers excluded from routing due to Bloomfilter"),
-                                    1,
-                                    GNUNET_NO);
-          chosen = NULL;
+          int delta = GNUNET_CRYPTO_hash_xorcmp (&pos->phash,
+                                                 &chosen->phash,
+                                                 key);
+          switch (delta)
+          {
+          case -1: /* pos closer */
+            chosen = pos;
+            break;
+          case 0: /* identical, impossible! */
+            GNUNET_assert (0);
+            break;
+          case 1: /* chosen closer */
+            break;
+          }
         }
         count++;
+      } /* for all (#bucket_size) peers in bucket */
+      if (NULL != chosen)
+        break;
+
+      /* If we chose nothing in first iteration, first go through deeper
+         buckets (best chance to find a good match), and if we still found
+         nothing, then to shallower buckets.  Terminate on any match in the
+         current bucket, as this search order guarantees that it can only get
+         worse as we keep going. */
+      if (bucket_offset > best_bucket)
+      {
+        /* Go through more deeper buckets */
+        bucket_offset++;
+        if (bucket_offset == closest_bucket)
+        {
+          /* Can't go any deeper, if nothing selected,
+             go for shallower buckets */
+          bucket_offset = best_bucket - 1;
+        }
       }
-    }
+      else
+      {
+        /* We're either at the 'best_bucket' or already moving
+           on to shallower buckets. */
+        if (bucket_offset == best_bucket)
+          bucket_offset++; /* go for deeper buckets */
+        else
+          bucket_offset--; /* go for shallower buckets */
+      }
+    } /* for applicable buckets (starting at best match) */
     if (NULL == chosen)
+    {
       GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop ("# Peer selection failed"),
+                                "# Peer selection failed",
                                 1,
                                 GNUNET_NO);
-    else
-      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                  "Selected peer `%s' in greedy routing for %s\n",
-                  GNUNET_i2s (chosen->id),
-                  GNUNET_h2s (key));
+      return NULL;
+    }
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Selected peer `%s' in greedy routing for %s\n",
+                GNUNET_i2s (chosen->id),
+                GNUNET_h2s (key));
     return chosen;
-  }
+  } /* end of 'greedy' peer selection */
 
   /* select "random" peer */
-  /* count number of peers that are available and not filtered */
-  count = 0;
-  for (bc = 0; bc <= closest_bucket; bc++)
+  /* count number of peers that are available and not filtered,
+     but limit to at most #bucket_size peers, starting with
+     those 'furthest' from us. */
   {
-    pos = k_buckets[bc].head;
-    while ((NULL != pos) && (count < bucket_size))
+    unsigned int total = 0;
+    unsigned int selected;
+
+    for (unsigned int bc = 0; bc < closest_bucket; bc++)
     {
-      if ((NULL != bloom) &&
-          (GNUNET_YES ==
-           GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                              &pos->phash)))
+      unsigned int count = 0;
+
+      for (struct PeerInfo *pos = k_buckets[bc].head;
+           NULL != pos;
+           pos = pos->next)
       {
-        GNUNET_STATISTICS_update (GDS_stats,
-                                  gettext_noop
-                                  (
-                                    "# Peers excluded from routing due to Bloomfilter"),
-                                  1, GNUNET_NO);
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                    "Excluded peer `%s' due to BF match in random routing for %s\n",
-                    GNUNET_i2s (pos->id),
-                    GNUNET_h2s (key));
-        pos = pos->next;
-        continue;               /* Ignore bloomfiltered peers */
-      }
-      count++;
-      pos = pos->next;
+        count++;
+        if (count > bucket_size)
+          break; /* limits search to #bucket_size peers per bucket */
+        if (GNUNET_YES ==
+            GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                               &pos->phash))
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "Excluded peer `%s' due to BF match in random routing for %s\n",
+                      GNUNET_i2s (pos->id),
+                      GNUNET_h2s (key));
+          continue;             /* Ignore filtered peers */
+        }
+        total++;
+      } /* for all peers in bucket */
+    } /* for all buckets */
+    if (0 == total)             /* No peers to select from! */
+    {
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# Peer selection failed",
+                                1,
+                                GNUNET_NO);
+      return NULL;
     }
-  }
-  if (0 == count)               /* No peers to select from! */
-  {
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop ("# Peer selection failed"), 1,
-                              GNUNET_NO);
-    return NULL;
-  }
-  /* Now actually choose a peer */
-  selected = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
-                                       count);
-  count = 0;
-  for (bc = 0; bc <= closest_bucket; bc++)
-  {
-    for (pos = k_buckets[bc].head; ((pos != NULL) && (count < bucket_size));
-         pos = pos->next)
+
+    /* Now actually choose a peer */
+    selected = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+                                         total);
+    for (unsigned int bc = 0; bc < closest_bucket; bc++)
     {
-      if ((bloom != NULL) &&
-          (GNUNET_YES ==
-           GNUNET_CONTAINER_bloomfilter_test (bloom,
-                                              &pos->phash)))
-      {
-        continue;               /* Ignore bloomfiltered peers */
-      }
-      if (0 == selected--)
+      unsigned int count = 0;
+
+      for (struct PeerInfo *pos = k_buckets[bc].head;
+           pos != NULL;
+           pos = pos->next)
       {
-        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                    "Selected peer `%s' in random routing for %s\n",
-                    GNUNET_i2s (pos->id),
-                    GNUNET_h2s (key));
-        return pos;
-      }
-    }
-  }
+        count++;
+        if (count > bucket_size)
+          break; /* limits search to #bucket_size peers per bucket */
+
+        if (GNUNET_YES ==
+            GNUNET_CONTAINER_bloomfilter_test (bloom,
+                                               &pos->phash))
+          continue;             /* Ignore bloomfiltered peers */
+        if (0 == selected--)
+        {
+          GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                      "Selected peer `%s' in random routing for %s\n",
+                      GNUNET_i2s (pos->id),
+                      GNUNET_h2s (key));
+          return pos;
+        }
+      } /* for peers in bucket */
+    } /* for all buckets */
+  } /* random peer selection scope */
   GNUNET_break (0);
   return NULL;
 }
@@ -1137,13 +1185,13 @@ select_peer (const struct GNUNET_HashCode *key,
  * forwarded to.
  *
  * @param key routing key
- * @param bloom bloom filter excluding peers as targets, all selected
- *        peers will be added to the bloom filter
+ * @param[in,out] bloom Bloom filter excluding peers as targets,
+ *        all selected peers will be added to the Bloom filter
  * @param hop_count number of hops the request has traversed so far
  * @param target_replication desired number of replicas
- * @param targets where to store an array of target peers (to be
- *         free'd by the caller)
- * @return number of peers returned in 'targets'.
+ * @param[out] targets where to store an array of target peers (to be
+ *         free()ed by the caller)
+ * @return number of peers returned in @a targets.
  */
 static unsigned int
 get_target_peers (const struct GNUNET_HashCode *key,
@@ -1152,23 +1200,24 @@ get_target_peers (const struct GNUNET_HashCode *key,
                   uint32_t target_replication,
                   struct PeerInfo ***targets)
 {
-  unsigned int ret;
+  unsigned int target;
   unsigned int off;
   struct PeerInfo **rtargets;
-  struct PeerInfo *nxt;
 
   GNUNET_assert (NULL != bloom);
-  ret = get_forward_count (hop_count,
-                           target_replication);
-  if (0 == ret)
+  target = get_forward_count (hop_count,
+                              target_replication);
+  if (0 == target)
   {
     *targets = NULL;
     return 0;
   }
-  rtargets = GNUNET_new_array (ret,
+  rtargets = GNUNET_new_array (target,
                                struct PeerInfo *);
-  for (off = 0; off < ret; off++)
+  for (off = 0; off < target; off++)
   {
+    struct PeerInfo *nxt;
+
     nxt = select_peer (key,
                        bloom,
                        hop_count);
@@ -1187,7 +1236,7 @@ get_target_peers (const struct GNUNET_HashCode *key,
               GNUNET_CONTAINER_multipeermap_size (all_connected_peers),
               (unsigned int) hop_count,
               GNUNET_h2s (key),
-              ret);
+              target);
   if (0 == off)
   {
     GNUNET_free (rtargets);
@@ -1199,67 +1248,37 @@ get_target_peers (const struct GNUNET_HashCode *key,
               "Forwarding query `%s' to %u peers (goal was %u peers)\n",
               GNUNET_h2s (key),
               off,
-              ret);
+              target);
   return off;
 }
 
 
-/**
- * Perform a PUT operation.   Forwards the given request to other
- * peers.   Does not store the data locally.  Does not give the
- * data to local clients.  May do nothing if this is the only
- * peer in the network (or if we are the closest peer in the
- * network).
- *
- * @param type type of the block
- * @param options routing options
- * @param desired_replication_level desired replication count
- * @param expiration_time when does the content expire
- * @param hop_count how many hops has this message traversed so far
- * @param bf Bloom filter of peers this PUT has already traversed
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers this request has traversed so far (if tracked)
- * @param data payload to store
- * @param data_size number of bytes in @a data
- * @return #GNUNET_OK if the request was forwarded, #GNUNET_NO if not
- */
-int
-GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
+enum GNUNET_GenericReturnValue
+GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                            enum GNUNET_DHT_RouteOption options,
                            uint32_t desired_replication_level,
-                           struct GNUNET_TIME_Absolute expiration_time,
                            uint32_t hop_count,
-                           struct GNUNET_CONTAINER_BloomFilter *bf,
-                           const struct GNUNET_HashCode *key,
-                           unsigned int put_path_length,
-                           struct GNUNET_PeerIdentity *put_path,
-                           const void *data,
-                           size_t data_size)
+                           struct GNUNET_CONTAINER_BloomFilter *bf)
 {
   unsigned int target_count;
-  unsigned int i;
   struct PeerInfo **targets;
-  struct PeerInfo *target;
   size_t msize;
-  struct GNUNET_MQ_Envelope *env;
-  struct PeerPutMessage *ppm;
-  struct GNUNET_PeerIdentity *pp;
   unsigned int skip_count;
+  unsigned int put_path_length = bd->put_path_length;
 
   GNUNET_assert (NULL != bf);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Adding myself (%s) to PUT bloomfilter for %s\n",
               GNUNET_i2s (&my_identity),
-              GNUNET_h2s (key));
+              GNUNET_h2s (&bd->key));
   GNUNET_CONTAINER_bloomfilter_add (bf,
                                     &my_identity_hash);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# PUT requests routed"),
+                            "# PUT requests routed",
                             1,
                             GNUNET_NO);
   target_count
-    = get_target_peers (key,
+    = get_target_peers (&bd->key,
                         bf,
                         hop_count,
                         desired_replication_level,
@@ -1268,17 +1287,18 @@ GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Routing PUT for %s terminates after %u hops at %s\n",
-                GNUNET_h2s (key),
+                GNUNET_h2s (&bd->key),
                 (unsigned int) hop_count,
                 GNUNET_i2s (&my_identity));
     return GNUNET_NO;
   }
-  msize = put_path_length * sizeof(struct GNUNET_PeerIdentity) + data_size;
+  msize = bd->put_path_length * sizeof(struct GNUNET_PeerIdentity)
+          + bd->data_size;
   if (msize + sizeof(struct PeerPutMessage)
       >= GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE)
   {
     put_path_length = 0;
-    msize = data_size;
+    msize = bd->data_size;
   }
   if (msize + sizeof(struct PeerPutMessage)
       >= GNUNET_CONSTANTS_MAX_ENCRYPTED_MESSAGE_SIZE)
@@ -1287,21 +1307,19 @@ GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
     GNUNET_free (targets);
     return GNUNET_NO;
   }
-  GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop (
-                              "# PUT messages queued for transmission"),
-                            target_count,
-                            GNUNET_NO);
   skip_count = 0;
-  for (i = 0; i < target_count; i++)
+  for (unsigned int i = 0; i < target_count; i++)
   {
-    target = targets[i];
+    struct PeerInfo *target = targets[i];
+    struct GNUNET_MQ_Envelope *env;
+    struct PeerPutMessage *ppm;
+    struct GNUNET_PeerIdentity *pp;
+
     if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
     {
       /* skip */
       GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop (
-                                  "# P2P messages dropped due to full queue"),
+                                "# P2P messages dropped due to full queue",
                                 1,
                                 GNUNET_NO);
       skip_count++;
@@ -1309,18 +1327,18 @@ GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
     }
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Routing PUT for %s after %u hops to %s\n",
-                GNUNET_h2s (key),
+                GNUNET_h2s (&bd->key),
                 (unsigned int) hop_count,
                 GNUNET_i2s (target->id));
     env = GNUNET_MQ_msg_extra (ppm,
                                msize,
                                GNUNET_MESSAGE_TYPE_DHT_P2P_PUT);
     ppm->options = htonl (options);
-    ppm->type = htonl (type);
+    ppm->type = htonl (bd->type);
     ppm->hop_count = htonl (hop_count + 1);
     ppm->desired_replication_level = htonl (desired_replication_level);
     ppm->put_path_length = htonl (put_path_length);
-    ppm->expiration_time = GNUNET_TIME_absolute_hton (expiration_time);
+    ppm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
     GNUNET_break (GNUNET_YES ==
                   GNUNET_CONTAINER_bloomfilter_test (bf,
                                                      &target->phash));
@@ -1328,40 +1346,27 @@ GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
                    GNUNET_CONTAINER_bloomfilter_get_raw_data (bf,
                                                               ppm->bloomfilter,
                                                               DHT_BLOOM_SIZE));
-    ppm->key = *key;
+    ppm->key = bd->key;
     pp = (struct GNUNET_PeerIdentity *) &ppm[1];
     GNUNET_memcpy (pp,
-                   put_path,
+                   bd->put_path,
                    sizeof(struct GNUNET_PeerIdentity) * put_path_length);
     GNUNET_memcpy (&pp[put_path_length],
-                   data,
-                   data_size);
+                   bd->data,
+                   bd->data_size);
     GNUNET_MQ_send (target->mq,
                     env);
   }
   GNUNET_free (targets);
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# PUT messages queued for transmission",
+                            target_count - skip_count,
+                            GNUNET_NO);
   return (skip_count < target_count) ? GNUNET_OK : GNUNET_NO;
 }
 
 
-/**
- * Perform a GET operation.  Forwards the given request to other
- * peers.  Does not lookup the key locally.  May do nothing if this is
- * the only peer in the network (or if we are the closest peer in the
- * network).
- *
- * @param type type of the block
- * @param options routing options
- * @param desired_replication_level desired replication count
- * @param hop_count how many hops did this request traverse so far?
- * @param key key for the content
- * @param xquery extended query
- * @param xquery_size number of bytes in @a xquery
- * @param bg group to use for filtering replies
- * @param peer_bf filter for peers not to select (again)
- * @return #GNUNET_OK if the request was forwarded, #GNUNET_NO if not
- */
-int
+enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                            enum GNUNET_DHT_RouteOption options,
                            uint32_t desired_replication_level,
@@ -1374,11 +1379,7 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
 {
   unsigned int target_count;
   struct PeerInfo **targets;
-  struct PeerInfo *target;
-  struct GNUNET_MQ_Envelope *env;
   size_t msize;
-  struct PeerGetMessage *pgm;
-  char *xq;
   size_t reply_bf_size;
   void *reply_bf;
   unsigned int skip_count;
@@ -1386,7 +1387,7 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
 
   GNUNET_assert (NULL != peer_bf);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# GET requests routed"),
+                            "# GET requests routed",
                             1,
                             GNUNET_NO);
   target_count = get_target_peers (key,
@@ -1428,23 +1429,22 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
     GNUNET_free (targets);
     return GNUNET_NO;
   }
-  GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop (
-                              "# GET messages queued for transmission"),
-                            target_count,
-                            GNUNET_NO);
   /* forward request */
   skip_count = 0;
   for (unsigned int i = 0; i < target_count; i++)
   {
-    target = targets[i];
+    struct PeerInfo *target = targets[i];
+    struct GNUNET_MQ_Envelope *env;
+    struct PeerGetMessage *pgm;
+    char *xq;
+    
     if (GNUNET_MQ_get_length (target->mq) >= MAXIMUM_PENDING_PER_PEER)
     {
       /* skip */
       GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop (
-                                  "# P2P messages dropped due to full queue"),
-                                1, GNUNET_NO);
+                                "# P2P messages dropped due to full queue",
+                                1,
+                                GNUNET_NO);
       skip_count++;
       continue;
     }
@@ -1480,115 +1480,94 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
     GNUNET_MQ_send (target->mq,
                     env);
   }
+  GNUNET_STATISTICS_update (GDS_stats,
+                            "# GET messages queued for transmission",
+                            target_count - skip_count,
+                            GNUNET_NO);
   GNUNET_free (targets);
   GNUNET_free (reply_bf);
   return (skip_count < target_count) ? GNUNET_OK : GNUNET_NO;
 }
 
 
-/**
- * Handle a reply (route to origin).  Only forwards the reply back to
- * the given peer.  Does not do local caching or forwarding to local
- * clients.
- *
- * @param target neighbour that should receive the block (if still connected)
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
- * @param get_path_length number of entries in @a get_path
- * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in @a data
- */
+struct PeerInfo *
+GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target)
+{
+  return GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
+                                            target);
+}
+
+
 void
-GDS_NEIGHBOURS_handle_reply (const struct GNUNET_PeerIdentity *target,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_TIME_Absolute expiration_time,
-                             const struct GNUNET_HashCode *key,
-                             unsigned int put_path_length,
-                             const struct GNUNET_PeerIdentity *put_path,
+GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
+                             const struct GDS_DATACACHE_BlockData *bd,
+                             const struct GNUNET_HashCode *query_hash,
                              unsigned int get_path_length,
-                             const struct GNUNET_PeerIdentity *get_path,
-                             const void *data,
-                             size_t data_size)
+                             const struct GNUNET_PeerIdentity *get_path)
 {
-  struct PeerInfo *pi;
   struct GNUNET_MQ_Envelope *env;
-  size_t msize;
   struct PeerResultMessage *prm;
   struct GNUNET_PeerIdentity *paths;
+  size_t msize;
 
-  msize = data_size + (get_path_length + put_path_length)
+  msize = bd->data_size + (get_path_length + bd->put_path_length)
           * sizeof(struct GNUNET_PeerIdentity);
-  if ((msize + sizeof(struct PeerResultMessage) >= GNUNET_MAX_MESSAGE_SIZE) ||
-      (get_path_length >
-       GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
-      (put_path_length >
-       GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
-      (data_size > GNUNET_MAX_MESSAGE_SIZE))
+  if ( (msize + sizeof(struct PeerResultMessage) >= GNUNET_MAX_MESSAGE_SIZE) ||
+       (get_path_length >
+        GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
+       (bd->put_path_length >
+        GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
+       (bd->data_size > GNUNET_MAX_MESSAGE_SIZE))
   {
     GNUNET_break (0);
     return;
   }
-  pi = GNUNET_CONTAINER_multipeermap_get (all_connected_peers,
-                                          target);
-  if (NULL == pi)
-  {
-    /* peer disconnected in the meantime, drop reply */
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "No matching peer for reply for key %s\n",
-                GNUNET_h2s (key));
-    return;
-  }
   if (GNUNET_MQ_get_length (pi->mq) >= MAXIMUM_PENDING_PER_PEER)
   {
     /* skip */
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# P2P messages dropped due to full queue"),
+                              "# P2P messages dropped due to full queue",
                               1,
                               GNUNET_NO);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Peer queue full, ignoring reply for key %s\n",
-                GNUNET_h2s (key));
+                GNUNET_h2s (&bd->key));
     return;
   }
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Forwarding reply for key %s to peer %s\n",
-              GNUNET_h2s (key),
-              GNUNET_i2s (target));
+              GNUNET_h2s (query_hash),
+              GNUNET_i2s (pi->id));
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop
-                              ("# RESULT messages queued for transmission"), 1,
+                            "# RESULT messages queued for transmission",
+                            1,
                             GNUNET_NO);
   env = GNUNET_MQ_msg_extra (prm,
                              msize,
                              GNUNET_MESSAGE_TYPE_DHT_P2P_RESULT);
-  prm->type = htonl (type);
-  prm->put_path_length = htonl (put_path_length);
+  prm->type = htonl (bd->type);
+  prm->put_path_length = htonl (bd->put_path_length);
   prm->get_path_length = htonl (get_path_length);
-  prm->expiration_time = GNUNET_TIME_absolute_hton (expiration_time);
-  prm->key = *key;
+  prm->expiration_time = GNUNET_TIME_absolute_hton (bd->expiration_time);
+  prm->key = *query_hash;
   paths = (struct GNUNET_PeerIdentity *) &prm[1];
   GNUNET_memcpy (paths,
-                 put_path,
-                 put_path_length * sizeof(struct GNUNET_PeerIdentity));
-  GNUNET_memcpy (&paths[put_path_length],
+                 bd->put_path,
+                 bd->put_path_length * sizeof(struct GNUNET_PeerIdentity));
+  GNUNET_memcpy (&paths[bd->put_path_length],
                  get_path,
                  get_path_length * sizeof(struct GNUNET_PeerIdentity));
-  GNUNET_memcpy (&paths[put_path_length + get_path_length],
-                 data,
-                 data_size);
+  GNUNET_memcpy (&paths[bd->put_path_length + get_path_length],
+                 bd->data,
+                 bd->data_size);
   GNUNET_MQ_send (pi->mq,
                   env);
 }
 
 
 /**
- * To be called on core init/fail.
+ * To be called on core init.
  *
  * @param cls service closure
  * @param identity the public identity of this peer
@@ -1603,7 +1582,7 @@ core_init (void *cls,
               GNUNET_i2s (identity));
   my_identity = *identity;
   GNUNET_CRYPTO_hash (identity,
-                      sizeof(struct GNUNET_PeerIdentity),
+                       sizeof(struct GNUNET_PeerIdentity),
                       &my_identity_hash);
   GNUNET_SERVICE_resume (GDS_service);
 }
@@ -1616,21 +1595,19 @@ core_init (void *cls,
  * @param message message
  * @return #GNUNET_OK if the message is valid
  */
-static int
+static enum GNUNET_GenericReturnValue
 check_dht_p2p_put (void *cls,
                    const struct PeerPutMessage *put)
 {
-  uint32_t putlen;
-  uint16_t msize;
+  uint16_t msize = ntohs (put->header.size);
+  uint32_t putlen = ntohl (put->put_path_length);
 
   (void) cls;
-  msize = ntohs (put->header.size);
-  putlen = ntohl (put->put_path_length);
-  if ((msize <
-       sizeof(struct PeerPutMessage)
-       + putlen * sizeof(struct GNUNET_PeerIdentity)) ||
-      (putlen >
-       GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)))
+  if ( (msize <
+        sizeof(struct PeerPutMessage)
+        + putlen * sizeof(struct GNUNET_PeerIdentity)) ||
+       (putlen >
+        GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) )
   {
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
@@ -1650,51 +1627,55 @@ handle_dht_p2p_put (void *cls,
                     const struct PeerPutMessage *put)
 {
   struct PeerInfo *peer = cls;
-  const struct GNUNET_PeerIdentity *put_path;
-  const void *payload;
-  uint32_t putlen;
-  uint16_t msize;
-  size_t payload_size;
-  enum GNUNET_DHT_RouteOption options;
-  struct GNUNET_CONTAINER_BloomFilter *bf;
-  struct GNUNET_HashCode test_key;
-  int forwarded;
-  struct GNUNET_TIME_Absolute exp_time;
-
-  exp_time = GNUNET_TIME_absolute_ntoh (put->expiration_time);
-  if (0 == GNUNET_TIME_absolute_get_remaining (exp_time).rel_value_us)
+  uint16_t msize = ntohs (put->header.size);
+  enum GNUNET_DHT_RouteOption options
+    = (enum GNUNET_DHT_RouteOption) ntohl (put->options);
+  struct GDS_DATACACHE_BlockData bd = {
+    .key = put->key,
+    .expiration_time = GNUNET_TIME_absolute_ntoh (put->expiration_time),
+    .type = ntohl (put->type)
+  };
+  const struct GNUNET_PeerIdentity *put_path
+    = (const struct GNUNET_PeerIdentity *) &put[1];
+  uint32_t putlen
+    = ntohl (put->put_path_length);
+
+  bd.data_size = msize - (sizeof(*put)
+                          + putlen * sizeof(struct GNUNET_PeerIdentity));
+  bd.data = &put_path[putlen];
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "PUT for `%s' from %s\n",
+              GNUNET_h2s (&put->key),
+              GNUNET_i2s (peer->id));
+  if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
   {
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop ("# Expired PUTs discarded"),
+                              "# Expired PUTs discarded",
                               1,
                               GNUNET_NO);
     return;
   }
-  msize = ntohs (put->header.size);
-  putlen = ntohl (put->put_path_length);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P PUT requests received"),
+                            "# P2P PUT requests received",
                             1,
                             GNUNET_NO);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P PUT bytes received"),
+                            "# P2P PUT bytes received",
                             msize,
                             GNUNET_NO);
-  put_path = (const struct GNUNET_PeerIdentity *) &put[1];
-  payload = &put_path[putlen];
-  options = ntohl (put->options);
-  payload_size = msize - (sizeof(struct PeerPutMessage)
-                          + putlen * sizeof(struct GNUNET_PeerIdentity));
-
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "PUT for `%s' from %s\n",
-              GNUNET_h2s (&put->key),
-              GNUNET_i2s (peer->id));
   if (GNUNET_YES == log_route_details_stderr)
   {
     char *tmp;
     char *pp;
-
+    struct GNUNET_HashCode mxor;
+    struct GNUNET_HashCode pxor;
+
+    GNUNET_CRYPTO_hash_xor (&my_identity_hash,
+                            &put->key,
+                            &mxor);
+    GNUNET_CRYPTO_hash_xor (&peer->phash,
+                            &put->key,
+                            &pxor);
     pp = GNUNET_STRINGS_pp2s (put_path,
                               putlen);
     tmp = GNUNET_strdup (GNUNET_i2s (&my_identity));
@@ -1704,83 +1685,65 @@ handle_dht_p2p_put (void *cls,
                  GNUNET_i2s (peer->id),
                  tmp,
                  ntohl (put->hop_count),
-                 GNUNET_CRYPTO_hash_matching_bits (&peer->phash,
-                                                   &put->key),
-                 GNUNET_CRYPTO_hash_matching_bits (&my_identity_hash,
-                                                   &put->key),
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&pxor),
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&mxor),
                  pp);
     GNUNET_free (pp);
     GNUNET_free (tmp);
   }
-  switch (GNUNET_BLOCK_get_key
-            (GDS_block_context,
-            ntohl (put->type),
-            payload,
-            payload_size,
-            &test_key))
+
   {
-  case GNUNET_YES:
-    if (0 != memcmp (&test_key,
-                     &put->key,
-                     sizeof(struct GNUNET_HashCode)))
+    struct GNUNET_HashCode test_key;
+    enum GNUNET_GenericReturnValue ret;
+
+    ret = GNUNET_BLOCK_get_key (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size,
+                                &test_key);
+    switch (ret)
     {
-      char *put_s = GNUNET_strdup (GNUNET_h2s_full (&put->key));
-
+    case GNUNET_YES:
+      if (0 != GNUNET_memcmp (&test_key,
+                              &bd.key))
+      {
+        GNUNET_break_op (0);
+        return;
+      }
+      break;
+    case GNUNET_NO:
       GNUNET_break_op (0);
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                  "PUT with key `%s' for block with key %s\n",
-                  put_s,
-                  GNUNET_h2s_full (&test_key));
-      GNUNET_free (put_s);
       return;
+    case GNUNET_SYSERR:
+      /* cannot verify, good luck */
+      break;
     }
-    break;
+  }
 
-  case GNUNET_NO:
+  if (GNUNET_NO ==
+      GNUNET_BLOCK_check_block (GDS_block_context,
+                                bd.type,
+                                &bd.key,
+                                bd.data,
+                                bd.data_size))
+  {
     GNUNET_break_op (0);
     return;
-
-  case GNUNET_SYSERR:
-    /* cannot verify, good luck */
-    break;
-  }
-  if (ntohl (put->type) == GNUNET_BLOCK_TYPE_REGEX)  /* FIXME: do for all tpyes */
-  {
-    switch (GNUNET_BLOCK_evaluate (GDS_block_context,
-                                   ntohl (put->type),
-                                   NULL,  /* query group */
-                                   GNUNET_BLOCK_EO_NONE,
-                                   NULL,    /* query */
-                                   NULL, 0,  /* xquery */
-                                   payload,
-                                   payload_size))
-    {
-    case GNUNET_BLOCK_EVALUATION_OK_MORE:
-    case GNUNET_BLOCK_EVALUATION_OK_LAST:
-      break;
-
-    case GNUNET_BLOCK_EVALUATION_OK_DUPLICATE:
-    case GNUNET_BLOCK_EVALUATION_RESULT_INVALID:
-    case GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT:
-    case GNUNET_BLOCK_EVALUATION_REQUEST_VALID:
-    case GNUNET_BLOCK_EVALUATION_REQUEST_INVALID:
-    case GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED:
-    default:
-      GNUNET_break_op (0);
-      return;
-    }
   }
 
-  bf = GNUNET_CONTAINER_bloomfilter_init (put->bloomfilter,
-                                          DHT_BLOOM_SIZE,
-                                          GNUNET_CONSTANTS_BLOOMFILTER_K);
-  GNUNET_break_op (GNUNET_YES ==
-                   GNUNET_CONTAINER_bloomfilter_test (bf,
-                                                      &peer->phash));
   {
+    struct GNUNET_CONTAINER_BloomFilter *bf;
     struct GNUNET_PeerIdentity pp[putlen + 1];
 
+    bf = GNUNET_CONTAINER_bloomfilter_init (put->bloomfilter,
+                                            DHT_BLOOM_SIZE,
+                                            GNUNET_CONSTANTS_BLOOMFILTER_K);
+    GNUNET_break_op (GNUNET_YES ==
+                     GNUNET_CONTAINER_bloomfilter_test (bf,
+                                                        &peer->phash));
     /* extend 'put path' by sender */
+    bd.put_path = (const struct GNUNET_PeerIdentity *) pp;
+    bd.put_path_length = putlen + 1;
     if (0 != (options & GNUNET_DHT_RO_RECORD_ROUTE))
     {
 #if SANITY_CHECKS
@@ -1788,13 +1751,13 @@ handle_dht_p2p_put (void *cls,
       {
         for (unsigned int j = 0; j < i; j++)
         {
-          GNUNET_break (0 != memcmp (&pp[i],
-                                     &pp[j],
-                                     sizeof(struct GNUNET_PeerIdentity)));
+          GNUNET_break (0 !=
+                        GNUNET_memcmp (&pp[i],
+                                       &pp[j]));
         }
-        GNUNET_break (0 != memcmp (&pp[i],
-                                   peer->id,
-                                   sizeof(struct GNUNET_PeerIdentity)));
+        GNUNET_break (0 !=
+                      GNUNET_memcmp (&pp[i],
+                                     peer->id));
       }
 #endif
       GNUNET_memcpy (pp,
@@ -1804,56 +1767,41 @@ handle_dht_p2p_put (void *cls,
       putlen++;
     }
     else
-      putlen = 0;
+    {
+      bd.put_path_length = 0;
+    }
 
     /* give to local clients */
-    GDS_CLIENTS_handle_reply (exp_time,
-                              &put->key,
-                              0,
-                              NULL,
-                              putlen,
-                              pp,
-                              ntohl (put->type),
-                              payload_size,
-                              payload);
+    GDS_CLIENTS_handle_reply (&bd,
+                              &bd.key,
+                              0, NULL /* get path */);
+
     /* store locally */
-    if ((0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
-        (GDS_am_closest_peer (&put->key, bf)))
-      GDS_DATACACHE_handle_put (exp_time,
-                                &put->key,
-                                putlen,
-                                pp,
-                                ntohl (put->type),
-                                payload_size,
-                                payload);
-    /* route to other peers */
-    forwarded = GDS_NEIGHBOURS_handle_put (ntohl (put->type),
-                                           options,
-                                           ntohl (
-                                             put->desired_replication_level),
-                                           exp_time,
-                                           ntohl (put->hop_count),
-                                           bf,
-                                           &put->key,
-                                           putlen,
-                                           pp,
-                                           payload,
-                                           payload_size);
-    /* notify monitoring clients */
-    GDS_CLIENTS_process_put (options
-                             | ((GNUNET_OK == forwarded)
+    if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
+         (GDS_am_closest_peer (&put->key,
+                               bf)) )
+      GDS_DATACACHE_handle_put (&bd);
+    {
+      enum GNUNET_GenericReturnValue forwarded;
+
+      /* route to other peers */
+      forwarded
+        = GDS_NEIGHBOURS_handle_put (&bd,
+                                     options,
+                                     ntohl (put->desired_replication_level),
+                                     ntohl (put->hop_count),
+                                     bf);
+      /* notify monitoring clients */
+      GDS_CLIENTS_process_put (options
+                               | ((GNUNET_OK == forwarded)
                                 ? GNUNET_DHT_RO_LAST_HOP
                                 : 0),
-                             ntohl (put->type),
-                             ntohl (put->hop_count),
-                             ntohl (put->desired_replication_level),
-                             putlen, pp,
-                             exp_time,
-                             &put->key,
-                             payload,
-                             payload_size);
+                               &bd,
+                               ntohl (put->hop_count),
+                               ntohl (put->desired_replication_level));
+    }
+    GNUNET_CONTAINER_bloomfilter_free (bf);
   }
-  GNUNET_CONTAINER_bloomfilter_free (bf);
 }
 
 
@@ -1861,55 +1809,51 @@ handle_dht_p2p_put (void *cls,
  * We have received a FIND PEER request.  Send matching
  * HELLOs back.
  *
- * @param sender sender of the FIND PEER request
+ * @param pi sender of the FIND PEER request
  * @param key peers close to this key are desired
  * @param bg group for filtering peers
  */
 static void
-handle_find_peer (const struct GNUNET_PeerIdentity *sender,
-                  const struct GNUNET_HashCode *key,
+handle_find_peer (struct PeerInfo *pi,
+                  const struct GNUNET_HashCode *query_hash,
                   struct GNUNET_BLOCK_Group *bg)
 {
   int bucket_idx;
   struct PeerBucket *bucket;
   struct PeerInfo *peer;
   unsigned int choice;
-  const struct GNUNET_HELLO_Message *hello;
-  size_t hello_size;
+  struct GDS_DATACACHE_BlockData bd = {
+    .type = GNUNET_BLOCK_TYPE_DHT_HELLO
+  };
 
   /* first, check about our own HELLO */
   if (NULL != GDS_my_hello)
   {
-    hello_size = GNUNET_HELLO_size ((const struct
-                                     GNUNET_HELLO_Message *) GDS_my_hello);
-    GNUNET_break (hello_size >= sizeof(struct GNUNET_MessageHeader));
-    if (GNUNET_BLOCK_EVALUATION_OK_MORE ==
-        GNUNET_BLOCK_evaluate (GDS_block_context,
-                               GNUNET_BLOCK_TYPE_DHT_HELLO,
-                               bg,
-                               GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO,
-                               &my_identity_hash,
-                               NULL, 0,
-                               GDS_my_hello,
-                               hello_size))
+    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
+      hello_expiration),
+    bd.key = my_identity_hash,
+    bd.data = GDS_my_hello;
+    bd.data_size = GNUNET_HELLO_size (
+      (const struct GNUNET_HELLO_Message *) GDS_my_hello);
+    GNUNET_break (bd.data_size >= sizeof(struct GNUNET_MessageHeader));
+    if (GNUNET_BLOCK_REPLY_OK_MORE ==
+        GNUNET_BLOCK_check_reply (GDS_block_context,
+                                  GNUNET_BLOCK_TYPE_DHT_HELLO,
+                                  bg,
+                                  &my_identity_hash,
+                                  NULL, 0,
+                                  bd.data,
+                                  bd.data_size))
     {
-      GDS_NEIGHBOURS_handle_reply (sender,
-                                   GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                   GNUNET_TIME_relative_to_absolute (
-                                     hello_expiration),
-                                   key,
-                                   0,
-                                   NULL,
-                                   0,
-                                   NULL,
-                                   GDS_my_hello,
-                                   hello_size);
+      GDS_NEIGHBOURS_handle_reply (pi,
+                                   &bd,
+                                   query_hash,
+                                   0, NULL /* get path */);
     }
     else
     {
       GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop (
-                                  "# FIND PEER requests ignored due to Bloomfilter"),
+                                "# FIND PEER requests ignored due to Bloomfilter",
                                 1,
                                 GNUNET_NO);
     }
@@ -1917,20 +1861,20 @@ handle_find_peer (const struct GNUNET_PeerIdentity *sender,
   else
   {
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop (
-                                "# FIND PEER requests ignored due to lack of HELLO"),
+                              "# FIND PEER requests ignored due to lack of HELLO",
                               1,
                               GNUNET_NO);
   }
 
   /* then, also consider sending a random HELLO from the closest bucket */
-  if (0 == memcmp (&my_identity_hash,
-                   key,
-                   sizeof(struct GNUNET_HashCode)))
-    bucket_idx = closest_bucket;
+  /* FIXME: How can this be true? Shouldnt we just do find_bucket() ? */
+  if (0 ==
+      GNUNET_memcmp (&my_identity_hash,
+                     query_hash))
+    bucket_idx = closest_bucket - 1;
   else
-    bucket_idx = GNUNET_MIN ((int) closest_bucket,
-                             find_bucket (key));
+    bucket_idx = GNUNET_MIN ((int) closest_bucket - 1,
+                             find_bucket (query_hash));
   if (bucket_idx < 0)
     return;
   bucket = &k_buckets[bucket_idx];
@@ -1946,82 +1890,69 @@ handle_find_peer (const struct GNUNET_PeerIdentity *sender,
     choice--;
   }
   choice = bucket->peers_size;
-  do
+
   {
-    peer = peer->next;
-    if (0 == choice--)
-      return;                   /* no non-masked peer available */
-    if (NULL == peer)
-      peer = bucket->head;
-    hello = GDS_HELLO_get (peer->id);
+    const struct GNUNET_HELLO_Message *hello;
+    size_t hello_size;
+
+    do
+    {
+      peer = peer->next;
+      if (0 == choice--)
+        return;                 /* no non-masked peer available */
+      if (NULL == peer)
+        peer = bucket->head;
+      hello = GDS_HELLO_get (peer->id);
+    } while ( (NULL == hello) ||
+              (GNUNET_BLOCK_REPLY_OK_MORE !=
+               GNUNET_BLOCK_check_reply (
+                 GDS_block_context,
+                 GNUNET_BLOCK_TYPE_DHT_HELLO,
+                 bg,
+                 &peer->phash,
+                 NULL, 0, /* xquery */
+                 hello,
+                 (hello_size = GNUNET_HELLO_size (hello)))));
+    bd.expiration_time = GNUNET_TIME_relative_to_absolute (
+      GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION);
+    bd.key = peer->phash;
+    bd.data = hello;
+    bd.data_size = hello_size;
+    GDS_NEIGHBOURS_handle_reply (pi,
+                                 &bd,
+                                 query_hash,
+                                 0, NULL /* get path */);
   }
-  while ((NULL == hello) ||
-         (GNUNET_BLOCK_EVALUATION_OK_MORE !=
-          GNUNET_BLOCK_evaluate (GDS_block_context,
-                                 GNUNET_BLOCK_TYPE_DHT_HELLO,
-                                 bg,
-                                 GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO,
-                                 &peer->phash,
-                                 NULL, 0,
-                                 hello,
-                                 (hello_size = GNUNET_HELLO_size (hello)))));
-  GDS_NEIGHBOURS_handle_reply (sender,
-                               GNUNET_BLOCK_TYPE_DHT_HELLO,
-                               GNUNET_TIME_relative_to_absolute
-                                 (GNUNET_CONSTANTS_HELLO_ADDRESS_EXPIRATION),
-                               key,
-                               0,
-                               NULL,
-                               0,
-                               NULL,
-                               hello,
-                               hello_size);
 }
 
 
 /**
- * Handle a result from local datacache for a GET operation.
+ * Handle an exact result from local datacache for a GET operation.
  *
  * @param cls the `struct PeerInfo` for which this is a reply
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
- * @param get_path_length number of entries in @a get_path
- * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in @a data
+ * @param bd details about the block we found locally
  */
 static void
 handle_local_result (void *cls,
-                     enum GNUNET_BLOCK_Type type,
-                     struct GNUNET_TIME_Absolute expiration_time,
-                     const struct GNUNET_HashCode *key,
-                     unsigned int put_path_length,
-                     const struct GNUNET_PeerIdentity *put_path,
-                     unsigned int get_path_length,
-                     const struct GNUNET_PeerIdentity *get_path,
-                     const void *data,
-                     size_t data_size)
+                     const struct GDS_DATACACHE_BlockData *bd)
 {
   struct PeerInfo *peer = cls;
-  char *pp;
 
-  pp = GNUNET_STRINGS_pp2s (put_path,
-                            put_path_length);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "Found local result for %s (PP: %s)\n",
-              GNUNET_h2s (key),
-              pp);
-  GNUNET_free (pp);
-  GDS_NEIGHBOURS_handle_reply (peer->id,
-                               type,
-                               expiration_time,
-                               key,
-                               put_path_length, put_path,
-                               get_path_length, get_path,
-                               data, data_size);
+  {
+    char *pp;
+
+    pp = GNUNET_STRINGS_pp2s (bd->put_path,
+                              bd->put_path_length);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Found local result for %s (PP: %s)\n",
+                GNUNET_h2s (&bd->key),
+                pp);
+    GNUNET_free (pp);
+  }
+  GDS_NEIGHBOURS_handle_reply (peer,
+                               bd,
+                               &bd->key,
+                               0, NULL /* get path */);
 }
 
 
@@ -2032,17 +1963,15 @@ handle_local_result (void *cls,
  * @param get the message
  * @return #GNUNET_OK if the message is well-formed
  */
-static int
+static enum GNUNET_GenericReturnValue
 check_dht_p2p_get (void *cls,
                    const struct PeerGetMessage *get)
 {
-  uint32_t xquery_size;
-  uint16_t msize;
+  uint16_t msize = ntohs (get->header.size);
+  uint32_t xquery_size = ntohl (get->xquery_size);
 
   (void) cls;
-  msize = ntohs (get->header.size);
-  xquery_size = ntohl (get->xquery_size);
-  if (msize < sizeof(struct PeerGetMessage) + xquery_size)
+  if (msize < sizeof(*get) + xquery_size)
   {
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
@@ -2062,265 +1991,236 @@ handle_dht_p2p_get (void *cls,
                     const struct PeerGetMessage *get)
 {
   struct PeerInfo *peer = cls;
-  uint32_t xquery_size;
-  size_t reply_bf_size;
-  uint16_t msize;
-  enum GNUNET_BLOCK_Type type;
-  enum GNUNET_DHT_RouteOption options;
-  enum GNUNET_BLOCK_EvaluationResult eval;
-  struct GNUNET_BLOCK_Group *bg;
-  struct GNUNET_CONTAINER_BloomFilter *peer_bf;
-  const char *xquery;
-  int forwarded;
+  uint16_t msize = ntohs (get->header.size);
+  uint32_t xquery_size = ntohl (get->xquery_size);
+  uint32_t hop_count = ntohl (get->hop_count);
+  size_t reply_bf_size = msize - (sizeof(*get) + xquery_size);
+  enum GNUNET_BLOCK_Type type = (enum GNUNET_BLOCK_Type) ntohl (get->type);
+  enum GNUNET_DHT_RouteOption options = (enum GNUNET_DHT_RouteOption)  ntohl (get->options);
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval = GNUNET_BLOCK_REPLY_OK_MORE;
+  const void *xquery = (const void *) &get[1];
 
   /* parse and validate message */
-  msize = ntohs (get->header.size);
-  xquery_size = ntohl (get->xquery_size);
-  reply_bf_size = msize - (sizeof(struct PeerGetMessage) + xquery_size);
-  type = ntohl (get->type);
-  options = ntohl (get->options);
-  xquery = (const char *) &get[1];
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P GET requests received"),
+                            "# P2P GET requests received",
                             1,
                             GNUNET_NO);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P GET bytes received"),
+                            "# P2P GET bytes received",
                             msize,
                             GNUNET_NO);
   if (GNUNET_YES == log_route_details_stderr)
   {
     char *tmp;
-
+    struct GNUNET_HashCode mxor;
+    struct GNUNET_HashCode pxor;
+
+    GNUNET_CRYPTO_hash_xor (&my_identity_hash,
+                            &get->key,
+                            &mxor);
+    GNUNET_CRYPTO_hash_xor (&peer->phash,
+                            &get->key,
+                            &pxor);
     tmp = GNUNET_strdup (GNUNET_i2s (&my_identity));
     LOG_TRAFFIC (GNUNET_ERROR_TYPE_DEBUG,
                  "R5N GET %s: %s->%s (%u, %u=>%u) xq: %.*s\n",
                  GNUNET_h2s (&get->key),
                  GNUNET_i2s (peer->id),
                  tmp,
-                 ntohl (get->hop_count),
-                 GNUNET_CRYPTO_hash_matching_bits (&peer->phash,
-                                                   &get->key),
-                 GNUNET_CRYPTO_hash_matching_bits (&my_identity_hash,
-                                                   &get->key),
+                 hop_count,
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&pxor),
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&mxor),
                  ntohl (get->xquery_size),
-                 xquery);
+                 (const char *) xquery);
     GNUNET_free (tmp);
   }
-  eval
-    = GNUNET_BLOCK_evaluate (GDS_block_context,
-                             type,
-                             NULL,
-                             GNUNET_BLOCK_EO_NONE,
-                             &get->key,
-                             xquery,
-                             xquery_size,
-                             NULL,
-                             0);
-  if (eval != GNUNET_BLOCK_EVALUATION_REQUEST_VALID)
+  if (GNUNET_NO ==
+      GNUNET_BLOCK_check_query (GDS_block_context,
+                                type,
+                                &get->key,
+                                xquery,
+                                xquery_size))
   {
-    /* request invalid or block type not supported */
-    GNUNET_break_op (eval == GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED);
+    /* request invalid */
+    GNUNET_break_op (0);
     return;
   }
-  peer_bf = GNUNET_CONTAINER_bloomfilter_init (get->bloomfilter,
-                                               DHT_BLOOM_SIZE,
-                                               GNUNET_CONSTANTS_BLOOMFILTER_K);
-  GNUNET_break_op (GNUNET_YES ==
-                   GNUNET_CONTAINER_bloomfilter_test (peer_bf,
-                                                      &peer->phash));
-  bg = GNUNET_BLOCK_group_create (GDS_block_context,
-                                  type,
-                                  get->bf_mutator,
-                                  &xquery[xquery_size],
-                                  reply_bf_size,
-                                  "filter-size",
-                                  reply_bf_size,
-                                  NULL);
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-              "GET for %s at %s after %u hops\n",
-              GNUNET_h2s (&get->key),
-              GNUNET_i2s (&my_identity),
-              (unsigned int) ntohl (get->hop_count));
-  /* local lookup (this may update the reply_bf) */
-  if ((0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
-      (GDS_am_closest_peer (&get->key,
-                            peer_bf)))
+
   {
-    if ((0 != (options & GNUNET_DHT_RO_FIND_PEER)))
+    struct GNUNET_BLOCK_Group *bg;
+    struct GNUNET_CONTAINER_BloomFilter *peer_bf;
+
+    peer_bf = GNUNET_CONTAINER_bloomfilter_init (get->bloomfilter,
+                                                 DHT_BLOOM_SIZE,
+                                                 GNUNET_CONSTANTS_BLOOMFILTER_K);
+    GNUNET_break_op (GNUNET_YES ==
+                     GNUNET_CONTAINER_bloomfilter_test (peer_bf,
+                                                        &peer->phash));
+    bg = GNUNET_BLOCK_group_create (GDS_block_context,
+                                    type,
+                                    get->bf_mutator,
+                                    xquery + xquery_size,
+                                    reply_bf_size,
+                                    "filter-size",
+                                    reply_bf_size,
+                                    NULL);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "GET for %s at %s after %u hops\n",
+                GNUNET_h2s (&get->key),
+                GNUNET_i2s (&my_identity),
+                (unsigned int) hop_count);
+    /* local lookup (this may update the reply_bf) */
+    if ( (0 != (options & GNUNET_DHT_RO_DEMULTIPLEX_EVERYWHERE)) ||
+         (GDS_am_closest_peer (&get->key,
+                               peer_bf)) )
     {
-      GNUNET_STATISTICS_update (GDS_stats,
-                                gettext_noop (
-                                  "# P2P FIND PEER requests processed"),
-                                1,
-                                GNUNET_NO);
-      handle_find_peer (peer->id,
-                        &get->key,
-                        bg);
+      if ((0 != (options & GNUNET_DHT_RO_FIND_PEER)))
+      {
+        GNUNET_STATISTICS_update (GDS_stats,
+                                  "# P2P FIND PEER requests processed",
+                                  1,
+                                  GNUNET_NO);
+        handle_find_peer (peer,
+                          &get->key,
+                          bg);
+      }
+      else
+      {
+        eval = GDS_DATACACHE_handle_get (&get->key,
+                                         type,
+                                         xquery,
+                                         xquery_size,
+                                         bg,
+                                         &handle_local_result,
+                                         peer);
+      }
     }
     else
+      {
+        GNUNET_STATISTICS_update (GDS_stats,
+                                  "# P2P GET requests ONLY routed",
+                                  1,
+                                  GNUNET_NO);
+      }
+    
+    /* remember request for routing replies */
+    GDS_ROUTING_add (peer->id,
+                     type,
+                     bg,      /* bg now owned by routing, but valid at least until end of this function! */
+                     options,
+                     &get->key,
+                     xquery,
+                     xquery_size);
+
+    /* P2P forwarding */
     {
-      eval = GDS_DATACACHE_handle_get (&get->key,
-                                       type,
-                                       xquery,
-                                       xquery_size,
-                                       bg,
-                                       &handle_local_result,
-                                       peer);
+      bool forwarded = false;
+      uint32_t desired_replication_level = ntohl (get->desired_replication_level);
+
+      if (eval != GNUNET_BLOCK_REPLY_OK_LAST)
+        forwarded = (GNUNET_OK ==
+                     GDS_NEIGHBOURS_handle_get (type,
+                                                options,
+                                                desired_replication_level,
+                                                hop_count,
+                                                &get->key,
+                                                xquery,
+                                                xquery_size,
+                                                bg,
+                                                peer_bf));
+      GDS_CLIENTS_process_get (
+        options |
+        (forwarded
+         ? 0
+         : GNUNET_DHT_RO_LAST_HOP),
+        type,
+        hop_count,
+        desired_replication_level,
+        0,
+        NULL,
+        &get->key);
     }
+    /* clean up; note that 'bg' is owned by routing now! */
+    GNUNET_CONTAINER_bloomfilter_free (peer_bf);
   }
-  else
-  {
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop ("# P2P GET requests ONLY routed"),
-                              1,
-                              GNUNET_NO);
-  }
-
-  /* remember request for routing replies */
-  GDS_ROUTING_add (peer->id,
-                   type,
-                   bg,      /* bg now owned by routing, but valid at least until end of this function! */
-                   options,
-                   &get->key,
-                   xquery,
-                   xquery_size);
-
-  /* P2P forwarding */
-  forwarded = GNUNET_NO;
-  if (eval != GNUNET_BLOCK_EVALUATION_OK_LAST)
-    forwarded = GDS_NEIGHBOURS_handle_get (type,
-                                           options,
-                                           ntohl (
-                                             get->desired_replication_level),
-                                           ntohl (get->hop_count),
-                                           &get->key,
-                                           xquery,
-                                           xquery_size,
-                                           bg,
-                                           peer_bf);
-  GDS_CLIENTS_process_get (options
-                           | ((GNUNET_OK == forwarded)
-                           ? GNUNET_DHT_RO_LAST_HOP : 0),
-                           type,
-                           ntohl (get->hop_count),
-                           ntohl (get->desired_replication_level),
-                           0,
-                           NULL,
-                           &get->key);
-
-  /* clean up; note that 'bg' is owned by routing now! */
-  GNUNET_CONTAINER_bloomfilter_free (peer_bf);
-}
-
-
-/**
- * Check validity of p2p result message.
- *
- * @param cls closure
- * @param message message
- * @return #GNUNET_YES if the message is well-formed
- */
-static int
-check_dht_p2p_result (void *cls,
-                      const struct PeerResultMessage *prm)
-{
-  uint32_t get_path_length;
-  uint32_t put_path_length;
-  uint16_t msize;
-
-  (void) cls;
-  msize = ntohs (prm->header.size);
-  put_path_length = ntohl (prm->put_path_length);
-  get_path_length = ntohl (prm->get_path_length);
-  if ((msize <
-       sizeof(struct PeerResultMessage) + (get_path_length
-                                           + put_path_length)
-       * sizeof(struct GNUNET_PeerIdentity)) ||
-      (get_path_length >
-       GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
-      (put_path_length >
-       GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)))
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
 }
 
 
 /**
  * Process a reply, after the @a get_path has been updated.
  *
- * @param expiration_time when does the reply expire
- * @param key key matching the query
+ * @param bd block details
+ * @param query_hash hash of the original query, might not match key in @a bd
  * @param get_path_length number of entries in @a get_path
  * @param get_path path the reply has taken
- * @param put_path_length number of entries in @a put_path
- * @param put_path path the PUT has taken
- * @param type type of the block
- * @param data_size number of bytes in @a data
- * @param data payload of the reply
  */
 static void
-process_reply_with_path (struct GNUNET_TIME_Absolute expiration_time,
-                         const struct GNUNET_HashCode *key,
+process_reply_with_path (const struct GDS_DATACACHE_BlockData *bd,
+                         const struct GNUNET_HashCode *query_hash,
                          unsigned int get_path_length,
-                         const struct GNUNET_PeerIdentity *get_path,
-                         unsigned int put_path_length,
-                         const struct GNUNET_PeerIdentity *put_path,
-                         enum GNUNET_BLOCK_Type type,
-                         size_t data_size,
-                         const void *data)
+                         const struct GNUNET_PeerIdentity *get_path)
 {
   /* forward to local clients */
-  GDS_CLIENTS_handle_reply (expiration_time,
-                            key,
+  GDS_CLIENTS_handle_reply (bd,
+                            query_hash,
                             get_path_length,
-                            get_path,
-                            put_path_length,
-                            put_path,
-                            type,
-                            data_size,
-                            data);
-  GDS_CLIENTS_process_get_resp (type,
+                            get_path);
+  GDS_CLIENTS_process_get_resp (bd,
                                 get_path,
-                                get_path_length,
-                                put_path,
-                                put_path_length,
-                                expiration_time,
-                                key,
-                                data,
-                                data_size);
+                                get_path_length);
   if (GNUNET_YES == cache_results)
   {
-    struct GNUNET_PeerIdentity xput_path[get_path_length + 1 + put_path_length];
+    struct GNUNET_PeerIdentity xput_path[GNUNET_NZL (get_path_length
+                                                     + bd->put_path_length)];
+    struct GDS_DATACACHE_BlockData bdx = *bd;
 
     GNUNET_memcpy (xput_path,
-                   put_path,
-                   put_path_length * sizeof(struct GNUNET_PeerIdentity));
-    GNUNET_memcpy (&xput_path[put_path_length],
+                   bd->put_path,
+                   bd->put_path_length * sizeof(struct GNUNET_PeerIdentity));
+    GNUNET_memcpy (&xput_path[bd->put_path_length],
                    get_path,
                    get_path_length * sizeof(struct GNUNET_PeerIdentity));
-
-    GDS_DATACACHE_handle_put (expiration_time,
-                              key,
-                              get_path_length + put_path_length,
-                              xput_path,
-                              type,
-                              data_size,
-                              data);
+    bdx.put_path = xput_path;
+    bdx.put_path_length += get_path_length;
+    GDS_DATACACHE_handle_put (&bdx);
   }
   /* forward to other peers */
-  GDS_ROUTING_process (type,
-                       expiration_time,
-                       key,
-                       put_path_length,
-                       put_path,
+  GDS_ROUTING_process (bd,
+                       query_hash,
                        get_path_length,
-                       get_path,
-                       data,
-                       data_size);
+                       get_path);
+}
+
+
+/**
+ * Check validity of p2p result message.
+ *
+ * @param cls closure
+ * @param message message
+ * @return #GNUNET_YES if the message is well-formed
+ */
+static enum GNUNET_GenericReturnValue
+check_dht_p2p_result (void *cls,
+                      const struct PeerResultMessage *prm)
+{
+  uint32_t get_path_length = ntohl (prm->get_path_length);
+  uint32_t put_path_length = ntohl (prm->put_path_length);
+  uint16_t msize = ntohs (prm->header.size);
+
+  (void) cls;
+  if ( (msize <
+        sizeof(struct PeerResultMessage)
+        + (get_path_length + put_path_length)
+        * sizeof(struct GNUNET_PeerIdentity)) ||
+       (get_path_length >
+        GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) ||
+       (put_path_length >
+        GNUNET_MAX_MESSAGE_SIZE / sizeof(struct GNUNET_PeerIdentity)) )
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
 }
 
 
@@ -2335,45 +2235,66 @@ handle_dht_p2p_result (void *cls,
                        const struct PeerResultMessage *prm)
 {
   struct PeerInfo *peer = cls;
-  const struct GNUNET_PeerIdentity *put_path;
-  const struct GNUNET_PeerIdentity *get_path;
-  const void *data;
-  uint32_t get_path_length;
-  uint32_t put_path_length;
-  uint16_t msize;
-  size_t data_size;
-  enum GNUNET_BLOCK_Type type;
-  struct GNUNET_TIME_Absolute exp_time;
+  uint16_t msize = ntohs (prm->header.size);
+  uint32_t get_path_length = ntohl (prm->get_path_length);
+  struct GDS_DATACACHE_BlockData bd = {
+    .expiration_time  = GNUNET_TIME_absolute_ntoh (prm->expiration_time),
+    .put_path = (const struct GNUNET_PeerIdentity *) &prm[1],
+    .put_path_length = ntohl (prm->put_path_length),
+    .type = ntohl (prm->type)
+  };
+  const struct GNUNET_PeerIdentity *get_path
+    = &bd.put_path[bd.put_path_length];
 
   /* parse and validate message */
-  exp_time = GNUNET_TIME_absolute_ntoh (prm->expiration_time);
-  if (0 == GNUNET_TIME_absolute_get_remaining (exp_time).rel_value_us)
+  if (GNUNET_TIME_absolute_is_past (bd.expiration_time))
   {
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop ("# Expired results discarded"),
+                              "# Expired results discarded",
                               1,
                               GNUNET_NO);
     return;
   }
-  msize = ntohs (prm->header.size);
-  put_path_length = ntohl (prm->put_path_length);
-  get_path_length = ntohl (prm->get_path_length);
-  put_path = (const struct GNUNET_PeerIdentity *) &prm[1];
-  get_path = &put_path[put_path_length];
-  type = ntohl (prm->type);
-  data = (const void *) &get_path[get_path_length];
-  data_size = msize - (sizeof(struct PeerResultMessage)
-                       + (get_path_length
-                          + put_path_length) * sizeof(struct
-                                                      GNUNET_PeerIdentity));
+  get_path = &bd.put_path[bd.put_path_length];
+  bd.data = (const void *) &get_path[get_path_length];
+  bd.data_size = msize - (sizeof(struct PeerResultMessage)
+                          + (get_path_length + bd.put_path_length)
+                          * sizeof(struct GNUNET_PeerIdentity));
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P RESULTS received"),
+                            "# P2P RESULTS received",
                             1,
                             GNUNET_NO);
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# P2P RESULT bytes received"),
+                            "# P2P RESULT bytes received",
                             msize,
                             GNUNET_NO);
+  {
+    enum GNUNET_GenericReturnValue ret;
+    const struct GNUNET_HashCode *pquery;
+
+    ret = GNUNET_BLOCK_get_key (GDS_block_context,
+                                bd.type,
+                                bd.data,
+                                bd.data_size,
+                                &bd.key);
+    if (GNUNET_NO == ret)
+    {
+      GNUNET_break_op (0);
+      return;
+    }
+    pquery = (GNUNET_OK == ret) ? &bd.key : &prm->key;
+    if (GNUNET_OK !=
+        GNUNET_BLOCK_check_block (GDS_block_context,
+                                  bd.type,
+                                  pquery,
+                                  bd.data,
+                                  bd.data_size))
+    {
+      GNUNET_break_op (0);
+      return;
+    }
+  }
+
   if (GNUNET_YES == log_route_details_stderr)
   {
     char *tmp;
@@ -2382,8 +2303,8 @@ handle_dht_p2p_result (void *cls,
 
     gp = GNUNET_STRINGS_pp2s (get_path,
                               get_path_length);
-    pp = GNUNET_STRINGS_pp2s (put_path,
-                              put_path_length);
+    pp = GNUNET_STRINGS_pp2s (bd.put_path,
+                              bd.put_path_length);
     tmp = GNUNET_strdup (GNUNET_i2s (&my_identity));
     LOG_TRAFFIC (GNUNET_ERROR_TYPE_DEBUG,
                  "R5N RESULT %s: %s->%s (GP: %s, PP: %s)\n",
@@ -2396,22 +2317,22 @@ handle_dht_p2p_result (void *cls,
     GNUNET_free (pp);
     GNUNET_free (tmp);
   }
+
   /* if we got a HELLO, consider it for our own routing table */
-  if (GNUNET_BLOCK_TYPE_DHT_HELLO == type)
+  if (GNUNET_BLOCK_TYPE_DHT_HELLO == bd.type)
   {
-    const struct GNUNET_MessageHeader *h;
+    const struct GNUNET_MessageHeader *h = bd.data;
     struct GNUNET_PeerIdentity pid;
 
     /* Should be a HELLO, validate and consider using it! */
-    if (data_size < sizeof(struct GNUNET_HELLO_Message))
+    if (bd.data_size < sizeof(struct GNUNET_HELLO_Message))
     {
-      GNUNET_break_op (0);
+      GNUNET_break (0);
       return;
     }
-    h = data;
-    if (data_size != ntohs (h->size))
+    if (bd.data_size != ntohs (h->size))
     {
-      GNUNET_break_op (0);
+      GNUNET_break (0);
       return;
     }
     if (GNUNET_OK !=
@@ -2421,10 +2342,9 @@ handle_dht_p2p_result (void *cls,
       GNUNET_break_op (0);
       return;
     }
-    if ((GNUNET_YES != disable_try_connect) &&
-        (0 != memcmp (&my_identity,
-                      &pid,
-                      sizeof(struct GNUNET_PeerIdentity))))
+    if ( (GNUNET_YES != disable_try_connect) &&
+         (0 != GNUNET_memcmp (&my_identity,
+                              &pid)) )
       try_connect (&pid,
                    h);
   }
@@ -2432,19 +2352,12 @@ handle_dht_p2p_result (void *cls,
   /* First, check if 'peer' is already on the path, and if
      so, truncate it instead of expanding. */
   for (unsigned int i = 0; i <= get_path_length; i++)
-    if (0 == memcmp (&get_path[i],
-                     peer->id,
-                     sizeof(struct GNUNET_PeerIdentity)))
+    if (0 == GNUNET_memcmp (&get_path[i],
+                            peer->id))
     {
-      process_reply_with_path (exp_time,
+      process_reply_with_path (&bd,
                                &prm->key,
-                               i,
-                               get_path,
-                               put_path_length,
-                               put_path,
-                               type,
-                               data_size,
-                               data);
+                               i, get_path);
       return;
     }
 
@@ -2456,26 +2369,14 @@ handle_dht_p2p_result (void *cls,
                    get_path,
                    get_path_length * sizeof(struct GNUNET_PeerIdentity));
     xget_path[get_path_length] = *peer->id;
-
-    process_reply_with_path (exp_time,
+    process_reply_with_path (&bd,
                              &prm->key,
-                             get_path_length + 1,
-                             xget_path,
-                             put_path_length,
-                             put_path,
-                             type,
-                             data_size,
-                             data);
+                             get_path_length + 1, xget_path);
   }
 }
 
 
-/**
- * Initialize neighbours subsystem.
- *
- * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
- */
-int
+enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_init ()
 {
   struct GNUNET_MQ_MessageHandler core_handlers[] = {
@@ -2529,9 +2430,6 @@ GDS_NEIGHBOURS_init ()
 }
 
 
-/**
- * Shutdown neighbours subsystem.
- */
 void
 GDS_NEIGHBOURS_done ()
 {
@@ -2554,11 +2452,6 @@ GDS_NEIGHBOURS_done ()
 }
 
 
-/**
- * Get the ID of the local node.
- *
- * @return identity of the local node
- */
 struct GNUNET_PeerIdentity *
 GDS_NEIGHBOURS_get_id ()
 {
diff --git a/src/dht/gnunet-service-dht_neighbours.h b/src/dht/gnunet-service-dht_neighbours.h
index 55cc5b135..28468c740 100644
--- a/src/dht/gnunet-service-dht_neighbours.h
+++ b/src/dht/gnunet-service-dht_neighbours.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009, 2010, 2011 GNUnet e.V.
+     Copyright (C) 2009, 2010, 2011, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -30,6 +30,7 @@
 #include "gnunet_util_lib.h"
 #include "gnunet_block_lib.h"
 #include "gnunet_dht_service.h"
+#include "gnunet-service-dht_datacache.h"
 
 /**
  * Hash of the identity of this peer.
@@ -37,6 +38,18 @@
 extern struct GNUNET_HashCode my_identity_hash;
 
 
+struct PeerInfo;
+
+/**
+ * Lookup peer by peer's identity.
+ * 
+ * @param target peer to look up
+ * @return NULL if we are not connected to @a target
+ */
+struct PeerInfo *
+GDS_NEIGHBOURS_lookup_peer (const struct GNUNET_PeerIdentity *target);
+
+
 /**
  * Perform a PUT operation.  Forwards the given request to other
  * peers.   Does not store the data locally.  Does not give the
@@ -44,30 +57,19 @@ extern struct GNUNET_HashCode my_identity_hash;
  * peer in the network (or if we are the closest peer in the
  * network).
  *
- * @param type type of the block
+ * @param bd data about the block
  * @param options routing options
  * @param desired_replication_level desired replication level
- * @param expiration_time when does the content expire
  * @param hop_count how many hops has this message traversed so far
  * @param bf Bloom filter of peers this PUT has already traversed
- * @param key key for the content
- * @param put_path_length number of entries in put_path
- * @param put_path peers this request has traversed so far (if tracked)
- * @param data payload to store
- * @param data_size number of bytes in data
  * @return #GNUNET_OK if the request was forwarded, #GNUNET_NO if not
  */
-int
-GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
+enum GNUNET_GenericReturnValue
+GDS_NEIGHBOURS_handle_put (const struct GDS_DATACACHE_BlockData *bd,
                            enum GNUNET_DHT_RouteOption options,
                            uint32_t desired_replication_level,
-                           struct GNUNET_TIME_Absolute expiration_time,
                            uint32_t hop_count,
-                           struct GNUNET_CONTAINER_BloomFilter *bf,
-                           const struct GNUNET_HashCode *key,
-                           unsigned int put_path_length,
-                           struct GNUNET_PeerIdentity *put_path,
-                           const void *data, size_t data_size);
+                           struct GNUNET_CONTAINER_BloomFilter *bf);
 
 
 /**
@@ -87,7 +89,7 @@ GDS_NEIGHBOURS_handle_put (enum GNUNET_BLOCK_Type type,
  * @param peer_bf filter for peers not to select (again, updated)
  * @return #GNUNET_OK if the request was forwarded, #GNUNET_NO if not
  */
-int
+enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
                            enum GNUNET_DHT_RouteOption options,
                            uint32_t desired_replication_level,
@@ -104,28 +106,19 @@ GDS_NEIGHBOURS_handle_get (enum GNUNET_BLOCK_Type type,
  * other peers waiting for it.  Does not do local caching or
  * forwarding to local clients.
  *
- * @param target neighbour that should receive the block (if still connected)
+ * @param pi neighbour that should receive the block
  * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in put_path
- * @param put_path peers the original PUT traversed (if tracked)
+ * @param bd details about the reply
+ * @param query_hash query that was used for the request
  * @param get_path_length number of entries in put_path
  * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in data
  */
 void
-GDS_NEIGHBOURS_handle_reply (const struct GNUNET_PeerIdentity *target,
-                             enum GNUNET_BLOCK_Type type,
-                             struct GNUNET_TIME_Absolute expiration_time,
-                             const struct GNUNET_HashCode *key,
-                             unsigned int put_path_length,
-                             const struct GNUNET_PeerIdentity *put_path,
+GDS_NEIGHBOURS_handle_reply (struct PeerInfo *pi,
+                             const struct GDS_DATACACHE_BlockData *bd,
+                             const struct GNUNET_HashCode *query_hash,
                              unsigned int get_path_length,
-                             const struct GNUNET_PeerIdentity *get_path,
-                             const void *data,
-                             size_t data_size);
+                             const struct GNUNET_PeerIdentity *get_path);
 
 
 /**
@@ -138,7 +131,7 @@ GDS_NEIGHBOURS_handle_reply (const struct GNUNET_PeerIdentity *target,
  * @return #GNUNET_YES if node location is closest,
  *         #GNUNET_NO otherwise.
  */
-int
+enum GNUNET_GenericReturnValue
 GDS_am_closest_peer (const struct GNUNET_HashCode *key,
                      const struct GNUNET_CONTAINER_BloomFilter *bloom);
 
@@ -148,7 +141,7 @@ GDS_am_closest_peer (const struct GNUNET_HashCode *key,
  *
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GDS_NEIGHBOURS_init (void);
 
 
diff --git a/src/dht/gnunet-service-dht_nse.c b/src/dht/gnunet-service-dht_nse.c
index 7f411cf71..58f18816a 100644
--- a/src/dht/gnunet-service-dht_nse.c
+++ b/src/dht/gnunet-service-dht_nse.c
@@ -52,11 +52,13 @@ static struct GNUNET_NSE_Handle *nse;
  *
  */
 static void
-update_network_size_estimate (void *cls, struct GNUNET_TIME_Absolute timestamp,
-                              double logestimate, double std_dev)
+update_network_size_estimate (void *cls,
+                              struct GNUNET_TIME_Absolute timestamp,
+                              double logestimate,
+                              double std_dev)
 {
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# Network size estimates received"),
+                            "# Network size estimates received",
                             1, GNUNET_NO);
   /* do not allow estimates < 0.5 */
   log_of_network_size_estimate = GNUNET_MAX (0.5, logestimate);
@@ -83,20 +85,22 @@ GDS_NSE_init ()
 {
   unsigned long long hops;
 
-  if ((GNUNET_YES ==
-       GNUNET_CONFIGURATION_have_value (GDS_cfg,
-                                        "dht",
-                                        "FORCE_NSE")) &&
-      (GNUNET_OK ==
-       GNUNET_CONFIGURATION_get_value_number (GDS_cfg,
-                                              "dht",
-                                              "FORCE_NSE",
-                                              &hops)))
+  if ( (GNUNET_YES ==
+        GNUNET_CONFIGURATION_have_value (GDS_cfg,
+                                         "dht",
+                                         "FORCE_NSE")) &&
+       (GNUNET_OK ==
+        GNUNET_CONFIGURATION_get_value_number (GDS_cfg,
+                                               "dht",
+                                               "FORCE_NSE",
+                                               &hops)) )
   {
     log_of_network_size_estimate = (double) hops;
     return;
   }
-  nse = GNUNET_NSE_connect (GDS_cfg, &update_network_size_estimate, NULL);
+  nse = GNUNET_NSE_connect (GDS_cfg,
+                            &update_network_size_estimate,
+                            NULL);
 }
 
 
diff --git a/src/dht/gnunet-service-dht_routing.c b/src/dht/gnunet-service-dht_routing.c
index b05fb76d3..ec36eae75 100644
--- a/src/dht/gnunet-service-dht_routing.c
+++ b/src/dht/gnunet-service-dht_routing.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
+     Copyright (C) 2011, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -31,8 +31,9 @@
 
 /**
  * Number of requests we track at most (for routing replies).
+ * TODO: make configurable!
  */
-#define DHT_MAX_RECENT (1024 * 16)
+#define DHT_MAX_RECENT (1024 * 128)
 
 
 /**
@@ -62,11 +63,6 @@ struct RecentRequest
   struct GNUNET_BLOCK_Group *bg;
 
   /**
-   * Type of the requested block.
-   */
-  enum GNUNET_BLOCK_Type type;
-
-  /**
    * extended query (see gnunet_block_lib.h).  Allocated at the
    * end of this struct.
    */
@@ -78,6 +74,11 @@ struct RecentRequest
   size_t xquery_size;
 
   /**
+   * Type of the requested block.
+   */
+  enum GNUNET_BLOCK_Type type;
+
+  /**
    * Request options.
    */
   enum GNUNET_DHT_RouteOption options;
@@ -96,14 +97,14 @@ static struct GNUNET_CONTAINER_MultiHashMap *recent_map;
 
 
 /**
- * Closure for the 'process' function.
+ * Closure for the process() function.
  */
 struct ProcessContext
 {
   /**
-   * Path of the original PUT
+   * Block data.
    */
-  const struct GNUNET_PeerIdentity *put_path;
+  const struct GDS_DATACACHE_BlockData *bd;
 
   /**
    * Path of the reply.
@@ -111,34 +112,10 @@ struct ProcessContext
   const struct GNUNET_PeerIdentity *get_path;
 
   /**
-   * Payload of the reply.
-   */
-  const void *data;
-
-  /**
-   * Expiration time of the result.
-   */
-  struct GNUNET_TIME_Absolute expiration_time;
-
-  /**
-   * Number of entries in @e put_path.
-   */
-  unsigned int put_path_length;
-
-  /**
    * Number of entries in @e get_path.
    */
   unsigned int get_path_length;
 
-  /**
-   * Number of bytes in @e data.
-   */
-  size_t data_size;
-
-  /**
-   * Type of the reply.
-   */
-  enum GNUNET_BLOCK_Type type;
 };
 
 
@@ -146,132 +123,106 @@ struct ProcessContext
  * Forward the result to the given peer if it matches the request.
  *
  * @param cls the `struct ProcessContext` with the result
- * @param key the query
+ * @param query_hash the hash from the original query
  * @param value the `struct RecentRequest` with the request
- * @return #GNUNET_OK (continue to iterate),
- *         #GNUNET_SYSERR if the result is malformed or type unsupported
+ * @return #GNUNET_OK (continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 process (void *cls,
-         const struct GNUNET_HashCode *key,
+         const struct GNUNET_HashCode *query_hash,
          void *value)
 {
   struct ProcessContext *pc = cls;
   struct RecentRequest *rr = value;
-  enum GNUNET_BLOCK_EvaluationResult eval;
-  unsigned int gpl;
-  unsigned int ppl;
-  struct GNUNET_HashCode hc;
-  const struct GNUNET_HashCode *eval_key;
-
-  if ((rr->type != GNUNET_BLOCK_TYPE_ANY) &&
-      (rr->type != pc->type))
-    return GNUNET_OK;           /* type mismatch */
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
+  unsigned int get_path_length;
+  struct GDS_DATACACHE_BlockData bdx = *pc->bd;
 
+  if ( (rr->type != GNUNET_BLOCK_TYPE_ANY) &&
+       (rr->type != pc->bd->type) )
+    return GNUNET_OK;           /* type mismatch */
   if (0 != (rr->options & GNUNET_DHT_RO_RECORD_ROUTE))
   {
-    gpl = pc->get_path_length;
-    ppl = pc->put_path_length;
+    get_path_length = pc->get_path_length;
   }
   else
   {
-    gpl = 0;
-    ppl = 0;
+    get_path_length = 0;
+    bdx.put_path_length = 0;
+    bdx.put_path = NULL;
   }
-  if ((0 != (rr->options & GNUNET_DHT_RO_FIND_PEER)) &&
-      (pc->type == GNUNET_BLOCK_TYPE_DHT_HELLO))
+  if ( (0 == (rr->options & GNUNET_DHT_RO_FIND_PEER)) &&
+       (0 != GNUNET_memcmp (query_hash,
+                            &bdx.key)) )
   {
-    /* key may not match HELLO, which is OK since
-     * the search is approximate.  Still, the evaluation
-     * would fail since the match is not exact.  So
-     * we fake it by changing the key to the actual PID ... */
-    GNUNET_BLOCK_get_key (GDS_block_context,
-                          GNUNET_BLOCK_TYPE_DHT_HELLO,
-                          pc->data,
-                          pc->data_size,
-                          &hc);
-    eval_key = &hc;
-  }
-  else
-  {
-    eval_key = key;
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# Inexact matches discarded in exact search",
+                              1,
+                              GNUNET_NO);
+    return GNUNET_OK; /* exact search, but inexact match */
   }
-  eval
-    = GNUNET_BLOCK_evaluate (GDS_block_context,
-                             pc->type,
-                             rr->bg,
-                             GNUNET_BLOCK_EO_NONE,
-                             eval_key,
-                             rr->xquery,
-                             rr->xquery_size,
-                             pc->data,
-                             pc->data_size);
+  eval = GNUNET_BLOCK_check_reply (GDS_block_context,
+                                   bdx.type,
+                                   rr->bg,
+                                   &bdx.key,
+                                   rr->xquery,
+                                   rr->xquery_size,
+                                   bdx.data,
+                                   bdx.data_size);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Result for %s of type %d was evaluated as %d\n",
-              GNUNET_h2s (key),
-              pc->type,
+              GNUNET_h2s (&bdx.key),
+              bdx.type,
               eval);
   switch (eval)
   {
-  case GNUNET_BLOCK_EVALUATION_OK_MORE:
-  case GNUNET_BLOCK_EVALUATION_OK_LAST:
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                                ("# Good REPLIES matched against routing table"),
-                              1, GNUNET_NO);
-    GDS_NEIGHBOURS_handle_reply (&rr->peer,
-                                 pc->type,
-                                 pc->expiration_time,
-                                 key,
-                                 ppl, pc->put_path,
-                                 gpl, pc->get_path,
-                                 pc->data,
-                                 pc->data_size);
+  case GNUNET_BLOCK_REPLY_OK_MORE:
+  case GNUNET_BLOCK_REPLY_OK_LAST:
+  case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
+    {
+      struct PeerInfo *pi;
+      
+      GNUNET_STATISTICS_update (GDS_stats,
+                                "# Good REPLIES matched against routing table",
+                                1,
+                                GNUNET_NO);
+      pi = GDS_NEIGHBOURS_lookup_peer (&rr->peer);
+      if (NULL == pi)
+      {
+        /* peer disconnected in the meantime, drop reply */
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "No matching peer for reply for key %s\n",
+                    GNUNET_h2s (query_hash));
+        return GNUNET_OK;
+      }
+      GDS_NEIGHBOURS_handle_reply (pi,
+                                   &bdx,
+                                   query_hash,
+                                   get_path_length, pc->get_path);
+    }
     break;
-
-  case GNUNET_BLOCK_EVALUATION_OK_DUPLICATE:
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                              (
-                                "# Duplicate REPLIES matched against routing table"),
-                              1, GNUNET_NO);
-    return GNUNET_OK;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_INVALID:
+  case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                              (
-                                "# Invalid REPLIES matched against routing table"),
-                              1, GNUNET_NO);
-    return GNUNET_SYSERR;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT:
-    GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                              (
-                                "# Irrelevant REPLIES matched against routing table"),
-                              1, GNUNET_NO);
-    return GNUNET_OK;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_VALID:
-    GNUNET_break (0);
+                              "# Duplicate REPLIES matched against routing table",
+                              1,
+                              GNUNET_NO);
     return GNUNET_OK;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_INVALID:
+  case GNUNET_BLOCK_REPLY_INVALID:
     GNUNET_break (0);
+    GNUNET_STATISTICS_update (GDS_stats,
+                              "# Invalid REPLIES matched against routing table",
+                              1,
+                              GNUNET_NO);
     return GNUNET_OK;
-
-  case GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED:
+  case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                              (
-                                "# Unsupported REPLIES matched against routing table"),
-                              1, GNUNET_NO);
-    return GNUNET_SYSERR;
-
+                              "# Irrelevant REPLIES matched against routing table",
+                              1,
+                              GNUNET_NO);
+    return GNUNET_OK;
   default:
     GNUNET_break (0);
-    return GNUNET_SYSERR;
+    return GNUNET_OK;
   }
   return GNUNET_OK;
 }
@@ -281,52 +232,28 @@ process (void *cls,
  * Handle a reply (route to origin).  Only forwards the reply back to
  * other peers waiting for it.  Does not do local caching or
  * forwarding to local clients.  Essentially calls
- * GDS_NEIGHBOURS_handle_reply for all peers that sent us a matching
+ * GDS_NEIGHBOURS_handle_reply() for all peers that sent us a matching
  * request recently.
  *
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
+ * @param bd block details
+ * @param query_hash query used in the inquiry
  * @param get_path_length number of entries in @a get_path
  * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in data
  */
 void
-GDS_ROUTING_process (enum GNUNET_BLOCK_Type type,
-                     struct GNUNET_TIME_Absolute expiration_time,
-                     const struct GNUNET_HashCode *key,
-                     unsigned int put_path_length,
-                     const struct GNUNET_PeerIdentity *put_path,
+GDS_ROUTING_process (const struct GDS_DATACACHE_BlockData *bd,
+                     const struct GNUNET_HashCode *query_hash,
                      unsigned int get_path_length,
-                     const struct GNUNET_PeerIdentity *get_path,
-                     const void *data,
-                     size_t data_size)
+                     const struct GNUNET_PeerIdentity *get_path)
 {
-  struct ProcessContext pc;
-
-  pc.type = type;
-  pc.expiration_time = expiration_time;
-  pc.put_path_length = put_path_length;
-  pc.put_path = put_path;
-  pc.get_path_length = get_path_length;
-  pc.get_path = get_path;
-  pc.data = data;
-  pc.data_size = data_size;
-  if (NULL == data)
-  {
-    /* Some apps might have an 'empty' reply as a valid reply; however,
-       'process' will call GNUNET_BLOCK_evaluate' which treats a 'NULL'
-       reply as request-validation (but we need response-validation).
-       So we set 'data' to a 0-byte non-NULL value just to be sure */
-    GNUNET_break (0 == data_size);
-    pc.data_size = 0;
-    pc.data = "";   /* something not null */
-  }
+  struct ProcessContext pc = {
+    .bd = bd,
+    .get_path = get_path,
+    .get_path_length = get_path_length
+  };
+
   GNUNET_CONTAINER_multihashmap_get_multiple (recent_map,
-                                              key,
+                                              query_hash,
                                               &process,
                                               &pc);
 }
@@ -338,13 +265,13 @@ GDS_ROUTING_process (enum GNUNET_BLOCK_Type type,
  * in the heap and hashmap.
  */
 static void
-expire_oldest_entry ()
+expire_oldest_entry (void)
 {
   struct RecentRequest *recent_req;
 
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop
-                              ("# Entries removed from routing table"), 1,
+                            "# Old entries removed from routing table",
+                            1,
                             GNUNET_NO);
   recent_req = GNUNET_CONTAINER_heap_peek (recent_heap);
   GNUNET_assert (recent_req != NULL);
@@ -362,13 +289,13 @@ expire_oldest_entry ()
  * Try to combine multiple recent requests for the same value
  * (if they come from the same peer).
  *
- * @param cls the new 'struct RecentRequest' (to discard upon successful combination)
+ * @param cls the new `struct RecentRequest` (to discard upon successful combination)
  * @param key the query
- * @param value the existing 'struct RecentRequest' (to update upon successful combination)
+ * @param value the existing `struct RecentRequest` (to update upon successful combination)
  * @return #GNUNET_OK (continue to iterate),
  *         #GNUNET_SYSERR if the request was successfully combined
  */
-static int
+static enum GNUNET_GenericReturnValue
 try_combine_recent (void *cls,
                     const struct GNUNET_HashCode *key,
                     void *value)
@@ -376,13 +303,13 @@ try_combine_recent (void *cls,
   struct RecentRequest *in = cls;
   struct RecentRequest *rr = value;
 
-  if ((0 != GNUNET_memcmp (&in->peer,
-                           &rr->peer)) ||
-      (in->type != rr->type) ||
-      (in->xquery_size != rr->xquery_size) ||
-      (0 != memcmp (in->xquery,
-                    rr->xquery,
-                    in->xquery_size)))
+  if ( (0 != GNUNET_memcmp (&in->peer,
+                            &rr->peer)) ||
+       (in->type != rr->type) ||
+       (in->xquery_size != rr->xquery_size) ||
+       (0 != memcmp (in->xquery,
+                     rr->xquery,
+                     in->xquery_size) ) )
     return GNUNET_OK;
   GNUNET_break (GNUNET_SYSERR !=
                 GNUNET_BLOCK_group_merge (in->bg,
@@ -419,7 +346,7 @@ GDS_ROUTING_add (const struct GNUNET_PeerIdentity *sender,
   while (GNUNET_CONTAINER_heap_get_size (recent_heap) >= DHT_MAX_RECENT)
     expire_oldest_entry ();
   GNUNET_STATISTICS_update (GDS_stats,
-                            gettext_noop ("# Entries added to routing table"),
+                            "# Entries added to routing table",
                             1,
                             GNUNET_NO);
   recent_req = GNUNET_malloc (sizeof(struct RecentRequest) + xquery_size);
@@ -440,19 +367,21 @@ GDS_ROUTING_add (const struct GNUNET_PeerIdentity *sender,
                                                   recent_req))
   {
     GNUNET_STATISTICS_update (GDS_stats,
-                              gettext_noop
-                                ("# DHT requests combined"),
-                              1, GNUNET_NO);
+                              "# DHT requests combined",
+                              1,
+                              GNUNET_NO);
     return;
   }
   recent_req->heap_node
-    = GNUNET_CONTAINER_heap_insert (recent_heap,
-                                    recent_req,
-                                    GNUNET_TIME_absolute_get ().abs_value_us);
-  GNUNET_CONTAINER_multihashmap_put (recent_map,
-                                     key,
-                                     recent_req,
-                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+    = GNUNET_CONTAINER_heap_insert (
+        recent_heap,
+        recent_req,
+        GNUNET_TIME_absolute_get ().abs_value_us);
+  (void) GNUNET_CONTAINER_multihashmap_put (
+    recent_map,
+    key,
+    recent_req,
+    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
 }
 
 
@@ -476,10 +405,12 @@ GDS_ROUTING_done ()
 {
   while (GNUNET_CONTAINER_heap_get_size (recent_heap) > 0)
     expire_oldest_entry ();
-  GNUNET_assert (0 == GNUNET_CONTAINER_heap_get_size (recent_heap));
+  GNUNET_assert (0 ==
+                 GNUNET_CONTAINER_heap_get_size (recent_heap));
   GNUNET_CONTAINER_heap_destroy (recent_heap);
   recent_heap = NULL;
-  GNUNET_assert (0 == GNUNET_CONTAINER_multihashmap_size (recent_map));
+  GNUNET_assert (0 ==
+                 GNUNET_CONTAINER_multihashmap_size (recent_map));
   GNUNET_CONTAINER_multihashmap_destroy (recent_map);
   recent_map = NULL;
 }
diff --git a/src/dht/gnunet-service-dht_routing.h b/src/dht/gnunet-service-dht_routing.h
index 7fea01bae..1a1514cc5 100644
--- a/src/dht/gnunet-service-dht_routing.h
+++ b/src/dht/gnunet-service-dht_routing.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2011 GNUnet e.V.
+     Copyright (C) 2011, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -35,29 +35,19 @@
  * Handle a reply (route to origin).  Only forwards the reply back to
  * other peers waiting for it.  Does not do local caching or
  * forwarding to local clients.  Essentially calls
- * #GDS_NEIGHBOURS_handle_reply() for all peers that sent us a matching
+ * GDS_NEIGHBOURS_handle_reply() for all peers that sent us a matching
  * request recently.
  *
- * @param type type of the block
- * @param expiration_time when does the content expire
- * @param key key for the content
- * @param put_path_length number of entries in @a put_path
- * @param put_path peers the original PUT traversed (if tracked)
+ * @param bd block details
+ * @param query_hash query used in the inquiry
  * @param get_path_length number of entries in @a get_path
  * @param get_path peers this reply has traversed so far (if tracked)
- * @param data payload of the reply
- * @param data_size number of bytes in @a data
  */
 void
-GDS_ROUTING_process (enum GNUNET_BLOCK_Type type,
-                     struct GNUNET_TIME_Absolute expiration_time,
-                     const struct GNUNET_HashCode *key,
-                     unsigned int put_path_length,
-                     const struct GNUNET_PeerIdentity *put_path,
+GDS_ROUTING_process (const struct GDS_DATACACHE_BlockData *bd,
+                     const struct GNUNET_HashCode *query_hash,
                      unsigned int get_path_length,
-                     const struct GNUNET_PeerIdentity *get_path,
-                     const void *data,
-                     size_t data_size);
+                     const struct GNUNET_PeerIdentity *get_path);
 
 
 /**
diff --git a/src/dht/plugin_block_dht.c b/src/dht/plugin_block_dht.c
index a9f336240..7c6fb9ed6 100644
--- a/src/dht/plugin_block_dht.c
+++ b/src/dht/plugin_block_dht.c
@@ -159,6 +159,145 @@ block_plugin_dht_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dht_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
+    return GNUNET_SYSERR;
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dht_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  const struct GNUNET_HELLO_Message *hello;
+  struct GNUNET_PeerIdentity pid;
+  const struct GNUNET_MessageHeader *msg;
+
+  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
+    return GNUNET_SYSERR;
+  if (block_size < sizeof(struct GNUNET_MessageHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  msg = block;
+  if (block_size != ntohs (msg->size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  hello = block;
+  if (GNUNET_OK !=
+      GNUNET_HELLO_get_id (hello,
+                           &pid))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_dht_check_reply (
+                                        void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  const struct GNUNET_HELLO_Message *hello;
+  struct GNUNET_PeerIdentity pid;
+  const struct GNUNET_MessageHeader *msg;
+  struct GNUNET_HashCode phash;
+
+  if (type != GNUNET_BLOCK_TYPE_DHT_HELLO)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  if (reply_block_size < sizeof(struct GNUNET_MessageHeader))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_REPLY_INVALID;
+  }
+  msg = reply_block;
+  if (reply_block_size != ntohs (msg->size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_REPLY_INVALID;
+  }
+  hello = reply_block;
+  if (GNUNET_OK !=
+      GNUNET_HELLO_get_id (hello,
+                           &pid))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_REPLY_INVALID;
+  }
+  GNUNET_CRYPTO_hash (&pid,
+                      sizeof(pid),
+                      &phash);
+  if (GNUNET_YES ==
+      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                          &phash))
+    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -169,7 +308,7 @@ block_plugin_dht_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_dht_get_key (void *cls,
                           enum GNUNET_BLOCK_Type type,
                           const void *block,
@@ -229,6 +368,9 @@ libgnunet_plugin_block_dht_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_dht_evaluate;
   api->get_key = &block_plugin_dht_get_key;
+  api->check_query = &block_plugin_dht_check_query;
+  api->check_block = &block_plugin_dht_check_block;
+  api->check_reply = &block_plugin_dht_check_reply;
   api->create_group = &block_plugin_dht_create_group;
   api->types = types;
   return api;
diff --git a/src/dns/plugin_block_dns.c b/src/dns/plugin_block_dns.c
index e0beccb52..d3eb7d2b9 100644
--- a/src/dns/plugin_block_dns.c
+++ b/src/dns/plugin_block_dns.c
@@ -177,6 +177,141 @@ block_plugin_dns_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dns_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    if (0 != xquery_size)
+      return GNUNET_NO;
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_dns_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  const struct GNUNET_DNS_Advertisement *ad;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    if (sizeof(struct GNUNET_DNS_Advertisement) != block_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    ad = block;
+
+    if (ntohl (ad->purpose.size) !=
+        sizeof(struct GNUNET_DNS_Advertisement)
+        - sizeof(struct GNUNET_CRYPTO_EddsaSignature))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    if (GNUNET_TIME_absolute_is_past (
+         GNUNET_TIME_absolute_ntoh (ad->expiration_time)))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "DNS advertisement has expired\n");
+      return GNUNET_NO;
+    }
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_DNS_RECORD,
+                                     &ad->purpose,
+                                     &ad->signature,
+                                     &ad->peer.public_key))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_dns_check_reply (
+                                   void *cls,
+                                   enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  struct GNUNET_HashCode phash;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_DNS:
+    GNUNET_CRYPTO_hash (reply_block,
+                        reply_block_size,
+                        &phash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                            &phash))
+      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  default:
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -187,7 +322,7 @@ block_plugin_dns_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_dns_get_key (void *cls,
                           enum GNUNET_BLOCK_Type type,
                           const void *block,
@@ -214,6 +349,9 @@ libgnunet_plugin_block_dns_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_dns_evaluate;
   api->get_key = &block_plugin_dns_get_key;
+  api->check_query = &block_plugin_dns_check_query;
+  api->check_block = &block_plugin_dns_check_block;
+  api->check_reply = &block_plugin_dns_check_reply;
   api->create_group = &block_plugin_dns_create_group;
   api->types = types;
   return api;
diff --git a/src/fs/gnunet-service-fs.c b/src/fs/gnunet-service-fs.c
index e90ba4c8b..8c6c39885 100644
--- a/src/fs/gnunet-service-fs.c
+++ b/src/fs/gnunet-service-fs.c
@@ -395,7 +395,7 @@ client_request_destroy (void *cls)
  */
 static void
 client_response_handler (void *cls,
-                         enum GNUNET_BLOCK_EvaluationResult eval,
+                         enum GNUNET_BLOCK_ReplyEvaluationResult eval,
                          struct GSF_PendingRequest *pr,
                          uint32_t reply_anonymity_level,
                          struct GNUNET_TIME_Absolute expiration,
@@ -447,7 +447,7 @@ client_response_handler (void *cls,
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Queued reply to query `%s' for local client\n",
               GNUNET_h2s (&prd->query));
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST != eval)
+  if (GNUNET_BLOCK_REPLY_OK_LAST != eval)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Evaluation %d - keeping query alive\n",
@@ -668,9 +668,9 @@ consider_request_for_forwarding (void *cls,
 void
 GSF_consider_forwarding (void *cls,
                          struct GSF_PendingRequest *pr,
-                         enum GNUNET_BLOCK_EvaluationResult result)
+                         enum GNUNET_BLOCK_ReplyEvaluationResult result)
 {
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST == result)
+  if (GNUNET_BLOCK_REPLY_OK_LAST == result)
     return;                     /* we're done... */
   if (GNUNET_YES !=
       GSF_pending_request_test_active_ (pr))
@@ -737,13 +737,13 @@ check_p2p_get (void *cls,
 static void
 start_p2p_processing (void *cls,
                       struct GSF_PendingRequest *pr,
-                      enum GNUNET_BLOCK_EvaluationResult result)
+                      enum GNUNET_BLOCK_ReplyEvaluationResult result)
 {
   struct GSF_LocalClient *lc = cls;
   struct GSF_PendingRequestData *prd;
 
   GNUNET_SERVICE_client_continue (lc->client);
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST == result)
+  if (GNUNET_BLOCK_REPLY_OK_LAST == result)
     return;                     /* we're done, 'pr' was already destroyed... */
   prd = GSF_pending_request_get_data_ (pr);
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
diff --git a/src/fs/gnunet-service-fs.h b/src/fs/gnunet-service-fs.h
index 9c87115ed..a6b73db09 100644
--- a/src/fs/gnunet-service-fs.h
+++ b/src/fs/gnunet-service-fs.h
@@ -280,7 +280,7 @@ extern unsigned int GSF_datastore_queue_size;
 void
 GSF_consider_forwarding (void *cls,
                          struct GSF_PendingRequest *pr,
-                         enum GNUNET_BLOCK_EvaluationResult result);
+                         enum GNUNET_BLOCK_ReplyEvaluationResult result);
 
 
 /**
diff --git a/src/fs/gnunet-service-fs_cp.c b/src/fs/gnunet-service-fs_cp.c
index c174ad611..5476aa2be 100644
--- a/src/fs/gnunet-service-fs_cp.c
+++ b/src/fs/gnunet-service-fs_cp.c
@@ -836,7 +836,7 @@ get_randomized_delay ()
  */
 static void
 handle_p2p_reply (void *cls,
-                  enum GNUNET_BLOCK_EvaluationResult eval,
+                  enum GNUNET_BLOCK_ReplyEvaluationResult eval,
                   struct GSF_PendingRequest *pr,
                   uint32_t reply_anonymity_level,
                   struct GNUNET_TIME_Absolute expiration,
@@ -862,11 +862,11 @@ handle_p2p_reply (void *cls,
     return;
   }
   GNUNET_break (GNUNET_BLOCK_TYPE_ANY != type);
-  if ((prd->type != type) && (GNUNET_BLOCK_TYPE_ANY != prd->type))
+  if ( (prd->type != type) &&
+       (GNUNET_BLOCK_TYPE_ANY != prd->type) )
   {
     GNUNET_STATISTICS_update (GSF_stats,
-                              gettext_noop
-                                ("# replies dropped due to type mismatch"),
+                              "# replies dropped due to type mismatch",
                               1, GNUNET_NO);
     return;
   }
@@ -874,22 +874,22 @@ handle_p2p_reply (void *cls,
               "Transmitting result for query `%s' to peer\n",
               GNUNET_h2s (&prd->query));
   GNUNET_STATISTICS_update (GSF_stats,
-                            gettext_noop ("# replies received for other peers"),
-                            1, GNUNET_NO);
+                            "# replies received for other peers",
+                            1,
+                            GNUNET_NO);
   msize = sizeof(struct PutMessage) + data_len;
   if (msize >= GNUNET_MAX_MESSAGE_SIZE)
   {
     GNUNET_break (0);
     return;
   }
-  if ((UINT32_MAX != reply_anonymity_level) && (reply_anonymity_level > 1))
+  if ( (UINT32_MAX != reply_anonymity_level) &&
+       (reply_anonymity_level > 1) )
   {
     if (reply_anonymity_level - 1 > GSF_cover_content_count)
     {
       GNUNET_STATISTICS_update (GSF_stats,
-                                gettext_noop
-                                (
-                                  "# replies dropped due to insufficient cover traffic"),
+                                "# replies dropped due to insufficient cover traffic",
                                 1, GNUNET_NO);
       return;
     }
@@ -930,14 +930,12 @@ handle_p2p_reply (void *cls,
                         UINT32_MAX,
                         env);
   }
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST != eval)
+  if (GNUNET_BLOCK_REPLY_OK_LAST != eval)
     return;
   if (NULL == peerreq->kill_task)
   {
     GNUNET_STATISTICS_update (GSF_stats,
-                              gettext_noop
-                              (
-                                "# P2P searches destroyed due to ultimate reply"),
+                              "# P2P searches destroyed due to ultimate reply",
                               1,
                               GNUNET_NO);
     peerreq->kill_task =
diff --git a/src/fs/gnunet-service-fs_pr.c b/src/fs/gnunet-service-fs_pr.c
index a5db4b6b7..c3fe5ff58 100644
--- a/src/fs/gnunet-service-fs_pr.c
+++ b/src/fs/gnunet-service-fs_pr.c
@@ -135,7 +135,7 @@ struct GSF_PendingRequest
   /**
    * Last result from the local datastore lookup evaluation.
    */
-  enum GNUNET_BLOCK_EvaluationResult local_result;
+  enum GNUNET_BLOCK_ReplyEvaluationResult local_result;
 
   /**
    * Identity of the peer that we should use for the 'sender'
@@ -619,7 +619,9 @@ clean_request (void *cls, const struct GNUNET_HashCode *key, void *value)
   if (NULL != (cont = pr->llc_cont))
   {
     pr->llc_cont = NULL;
-    cont (pr->llc_cont_cls, pr, pr->local_result);
+    cont (pr->llc_cont_cls,
+          pr,
+          pr->local_result);
   }
   GSF_plan_notify_request_done_ (pr);
   GNUNET_free (pr->replies_seen);
@@ -689,7 +691,9 @@ GSF_pending_request_cancel_ (struct GSF_PendingRequest *pr, int full_cleanup)
     if (NULL != (cont = pr->llc_cont))
     {
       pr->llc_cont = NULL;
-      cont (pr->llc_cont_cls, pr, pr->local_result);
+      cont (pr->llc_cont_cls,
+            pr,
+            pr->local_result);
     }
     GSF_plan_notify_request_done_ (pr);
     if (NULL != pr->qe)
@@ -778,7 +782,7 @@ struct ProcessReplyClosure
   /**
    * Evaluation result (returned).
    */
-  enum GNUNET_BLOCK_EvaluationResult eval;
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval;
 
   /**
    * Did we find a matching request?
@@ -814,8 +818,10 @@ update_request_performance_data (struct ProcessReplyClosure *prq,
  * @param value value in the hash map (info about the query)
  * @return #GNUNET_YES (we should continue to iterate)
  */
-static int
-process_reply (void *cls, const struct GNUNET_HashCode *key, void *value)
+static enum GNUNET_GenericReturnValue
+process_reply (void *cls,
+               const struct GNUNET_HashCode *key,
+               void *value)
 {
   struct ProcessReplyClosure *prq = cls;
   struct GSF_PendingRequest *pr = value;
@@ -832,22 +838,20 @@ process_reply (void *cls, const struct GNUNET_HashCode *key, void *value)
                             gettext_noop ("# replies received and matched"),
                             1,
                             GNUNET_NO);
-  prq->eval = GNUNET_BLOCK_evaluate (GSF_block_ctx,
-                                     prq->type,
-                                     pr->bg,
-                                     prq->eo,
-                                     key,
-                                     NULL,
-                                     0,
-                                     prq->data,
-                                     prq->size);
+  prq->eval = GNUNET_BLOCK_check_reply (GSF_block_ctx,
+                                        prq->type,
+                                        pr->bg,
+                                        key,
+                                        NULL, 0,
+                                        prq->data,
+                                        prq->size);
   switch (prq->eval)
   {
-  case GNUNET_BLOCK_EVALUATION_OK_MORE:
+  case GNUNET_BLOCK_REPLY_OK_MORE:
     update_request_performance_data (prq, pr);
     break;
 
-  case GNUNET_BLOCK_EVALUATION_OK_LAST:
+  case GNUNET_BLOCK_REPLY_OK_LAST:
     /* short cut: stop processing early, no BF-update, etc. */
     update_request_performance_data (prq, pr);
     GNUNET_LOAD_update (GSF_rt_entry_lifetime,
@@ -859,8 +863,7 @@ process_reply (void *cls, const struct GNUNET_HashCode *key, void *value)
                                                            .pr_head,
                                                            prq->sender,
                                                            &last_transmission))
-      last_transmission.abs_value_us =
-        GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us;
+      last_transmission = GNUNET_TIME_UNIT_FOREVER_ABS;
     /* pass on to other peers / local clients */
     pr->rh (pr->rh_cls,
             prq->eval,
@@ -872,46 +875,38 @@ process_reply (void *cls, const struct GNUNET_HashCode *key, void *value)
             prq->data,
             prq->size);
     return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_OK_DUPLICATE:
+  case GNUNET_BLOCK_REPLY_OK_DUPLICATE:
 #if INSANE_STATISTICS
     GNUNET_STATISTICS_update (GSF_stats,
-                              gettext_noop (
-                                "# duplicate replies discarded (bloomfilter)"),
+                              "# duplicate replies discarded (bloomfilter)",
                               1,
                               GNUNET_NO);
 #endif
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Duplicate response, discarding.\n");
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Duplicate response, discarding.\n");
     return GNUNET_YES;   /* duplicate */
 
-  case GNUNET_BLOCK_EVALUATION_RESULT_IRRELEVANT:
+  case GNUNET_BLOCK_REPLY_IRRELEVANT:
     GNUNET_STATISTICS_update (GSF_stats,
-                              gettext_noop ("# irrelevant replies discarded"),
+                              "# irrelevant replies discarded",
                               1,
                               GNUNET_NO);
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Irrelevant response, ignoring.\n");
-    return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_RESULT_INVALID:
-    return GNUNET_YES;   /* wrong namespace */
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_VALID:
-    GNUNET_break (0);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Irrelevant response, ignoring.\n");
     return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_REQUEST_INVALID:
-    GNUNET_break (0);
+  case GNUNET_BLOCK_REPLY_INVALID:
     return GNUNET_YES;
-
-  case GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED:
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                _ ("Unsupported block type %u\n"),
-                prq->type);
+  case GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED:
+    GNUNET_break (0); /* bad installation? */
     return GNUNET_NO;
   }
   /* update bloomfilter */
-  GNUNET_CRYPTO_hash (prq->data, prq->size, &chash);
-  GSF_pending_request_update_ (pr, &chash, 1);
+  GNUNET_CRYPTO_hash (prq->data,
+                      prq->size,
+                      &chash);
+  GSF_pending_request_update_ (pr,
+                               &chash,
+                               1);
   if (NULL == prq->sender)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
@@ -936,7 +931,7 @@ process_reply (void *cls, const struct GNUNET_HashCode *key, void *value)
                                                            .pr_head,
                                                            prq->sender,
                                                            &last_transmission))
-    last_transmission.abs_value_us = GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us;
+    last_transmission = GNUNET_TIME_UNIT_FOREVER_ABS;
   pr->rh (pr->rh_cls,
           prq->eval,
           pr,
@@ -1363,12 +1358,12 @@ call_continuation (struct GSF_PendingRequest *pr)
   pr->llc_cont = NULL;
   if (0 != (GSF_PRO_LOCAL_ONLY & pr->public_data.options))
   {
-    if (GNUNET_BLOCK_EVALUATION_OK_LAST != pr->local_result)
+    if (GNUNET_BLOCK_REPLY_OK_LAST != pr->local_result)
     {
       /* Signal that we are done and that there won't be any
          additional results to allow client to clean up state. */
       pr->rh (pr->rh_cls,
-              GNUNET_BLOCK_EVALUATION_OK_LAST,
+              GNUNET_BLOCK_REPLY_OK_LAST,
               pr,
               UINT32_MAX,
               GNUNET_TIME_UNIT_ZERO_ABS,
@@ -1380,11 +1375,15 @@ call_continuation (struct GSF_PendingRequest *pr)
     /* Finally, call our continuation to signal that we are
        done with local processing of this request; i.e. to
        start reading again from the client. */
-    cont (pr->llc_cont_cls, NULL, GNUNET_BLOCK_EVALUATION_OK_LAST);
+    cont (pr->llc_cont_cls,
+          NULL,
+          GNUNET_BLOCK_REPLY_OK_LAST);
     return;
   }
 
-  cont (pr->llc_cont_cls, pr, pr->local_result);
+  cont (pr->llc_cont_cls,
+        pr,
+        pr->local_result);
 }
 
 
@@ -1635,7 +1634,7 @@ called_from_on_demand:
   prq.eo = GNUNET_BLOCK_EO_LOCAL_SKIP_CRYPTO;
   process_reply (&prq, key, pr);
   pr->local_result = prq.eval;
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST == prq.eval)
+  if (GNUNET_BLOCK_REPLY_OK_LAST == prq.eval)
   {
     GNUNET_STATISTICS_update (
       GSF_stats,
diff --git a/src/fs/gnunet-service-fs_pr.h b/src/fs/gnunet-service-fs_pr.h
index 58fdd334e..a10fb9b4c 100644
--- a/src/fs/gnunet-service-fs_pr.h
+++ b/src/fs/gnunet-service-fs_pr.h
@@ -184,16 +184,17 @@ struct GSF_PendingRequestData
  * @param data_len number of bytes in @a data
  */
 typedef void
-(*GSF_PendingRequestReplyHandler) (void *cls,
-                                   enum GNUNET_BLOCK_EvaluationResult eval,
-                                   struct GSF_PendingRequest *pr,
-                                   uint32_t reply_anonymity_level,
-                                   struct GNUNET_TIME_Absolute expiration,
-                                   struct GNUNET_TIME_Absolute
-                                   last_transmission,
-                                   enum GNUNET_BLOCK_Type type,
-                                   const void *data,
-                                   size_t data_len);
+(*GSF_PendingRequestReplyHandler) (
+  void *cls,
+  enum GNUNET_BLOCK_ReplyEvaluationResult eval,
+  struct GSF_PendingRequest *pr,
+  uint32_t reply_anonymity_level,
+  struct GNUNET_TIME_Absolute expiration,
+  struct GNUNET_TIME_Absolute
+  last_transmission,
+  enum GNUNET_BLOCK_Type type,
+  const void *data,
+  size_t data_len);
 
 
 /**
@@ -374,9 +375,10 @@ GSF_cadet_lookup_ (struct GSF_PendingRequest *pr);
  * @param result final datastore lookup result
  */
 typedef void
-(*GSF_LocalLookupContinuation) (void *cls,
-                                struct GSF_PendingRequest *pr,
-                                enum GNUNET_BLOCK_EvaluationResult result);
+(*GSF_LocalLookupContinuation) (
+  void *cls,
+  struct GSF_PendingRequest *pr,
+  enum GNUNET_BLOCK_ReplyEvaluationResult result);
 
 
 /**
diff --git a/src/fs/plugin_block_fs.c b/src/fs/plugin_block_fs.c
index 6a9ab3f41..43380b3b6 100644
--- a/src/fs/plugin_block_fs.c
+++ b/src/fs/plugin_block_fs.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2010, 2013 GNUnet e.V.
+     Copyright (C) 2010, 2013, 2021 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -225,7 +225,7 @@ block_plugin_fs_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_fs_get_key (void *cls,
                          enum GNUNET_BLOCK_Type type,
                          const void *block,
@@ -238,9 +238,10 @@ block_plugin_fs_get_key (void *cls,
   {
   case GNUNET_BLOCK_TYPE_FS_DBLOCK:
   case GNUNET_BLOCK_TYPE_FS_IBLOCK:
-    GNUNET_CRYPTO_hash (block, block_size, key);
+    GNUNET_CRYPTO_hash (block,
+                        block_size,
+                        key);
     return GNUNET_OK;
-
   case GNUNET_BLOCK_TYPE_FS_UBLOCK:
     if (block_size < sizeof(struct UBlock))
     {
@@ -252,7 +253,6 @@ block_plugin_fs_get_key (void *cls,
                         sizeof(ub->verification_key),
                         key);
     return GNUNET_OK;
-
   default:
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -261,12 +261,153 @@ block_plugin_fs_get_key (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_fs_check_query (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             const struct GNUNET_HashCode *query,
+                             const void *xquery,
+                             size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_fs_check_block (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             const struct GNUNET_HashCode *query,
+                             const void *block,
+                             size_t block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    {
+      const struct UBlock *ub;
+      
+      if (block_size < sizeof(struct UBlock))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      ub = block;
+      if (block_size !=
+          ntohl (ub->purpose.size) +
+          sizeof (struct GNUNET_CRYPTO_EcdsaSignature))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      if (GNUNET_OK !=
+          GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK,
+                                       &ub->purpose,
+                                       &ub->signature,
+                                       &ub->verification_key))
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+      return GNUNET_OK;
+    }
+  default:
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_fs_check_reply (void *cls,
+                             enum GNUNET_BLOCK_Type type,
+                             struct GNUNET_BLOCK_Group *group,
+                             const struct GNUNET_HashCode *query,
+                             const void *xquery,
+                             size_t xquery_size,
+                             const void *reply_block,
+                             size_t reply_block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_FS_DBLOCK:
+  case GNUNET_BLOCK_TYPE_FS_IBLOCK:
+    return GNUNET_BLOCK_REPLY_OK_LAST;
+  case GNUNET_BLOCK_TYPE_FS_UBLOCK:
+    {
+      struct GNUNET_HashCode chash;
+
+      GNUNET_CRYPTO_hash (reply_block,
+                          reply_block_size,
+                          &chash);
+      if (GNUNET_YES ==
+          GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                              &chash))
+        return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+      return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+}
+
+
+/**
  * Entry point for the plugin.
  */
 void *
 libgnunet_plugin_block_fs_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_FS_DBLOCK,
     GNUNET_BLOCK_TYPE_FS_IBLOCK,
     GNUNET_BLOCK_TYPE_FS_UBLOCK,
@@ -278,6 +419,9 @@ libgnunet_plugin_block_fs_init (void *cls)
   api->evaluate = &block_plugin_fs_evaluate;
   api->get_key = &block_plugin_fs_get_key;
   api->create_group = &block_plugin_fs_create_group;
+  api->check_query = &block_plugin_fs_check_query;
+  api->check_block = &block_plugin_fs_check_block;
+  api->check_reply = &block_plugin_fs_check_reply;
   api->types = types;
   return api;
 }
diff --git a/src/fs/test_plugin_block_fs.c b/src/fs/test_plugin_block_fs.c
index 4f71c5d74..727cc37c2 100644
--- a/src/fs/test_plugin_block_fs.c
+++ b/src/fs/test_plugin_block_fs.c
@@ -34,36 +34,31 @@ test_fs (struct GNUNET_BLOCK_Context *ctx)
 
   memset (block, 1, sizeof(block));
   if (GNUNET_OK !=
-      GNUNET_BLOCK_get_key (ctx, GNUNET_BLOCK_TYPE_FS_DBLOCK, block,
-                            sizeof(block), &key))
+      GNUNET_BLOCK_get_key (ctx,
+                            GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                            block,
+                            sizeof(block),
+                            &key))
     return 1;
-  if (GNUNET_BLOCK_EVALUATION_OK_LAST !=
-      GNUNET_BLOCK_evaluate (ctx,
-                             GNUNET_BLOCK_TYPE_FS_DBLOCK,
-                             NULL,
-                             GNUNET_BLOCK_EO_NONE,
-                             &key,
-                             NULL, 0,
-                             block, sizeof(block)))
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_block (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                &key,
+                                block,
+                                sizeof(block)))
     return 2;
-  if (GNUNET_BLOCK_EVALUATION_REQUEST_VALID !=
-      GNUNET_BLOCK_evaluate (ctx,
-                             GNUNET_BLOCK_TYPE_FS_DBLOCK,
-                             NULL,
-                             GNUNET_BLOCK_EO_NONE,
-                             &key,
-                             NULL, 0,
-                             NULL, 0))
+  if (GNUNET_OK !=
+      GNUNET_BLOCK_check_query (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                &key,
+                                NULL, 0))
     return 4;
   GNUNET_log_skip (1, GNUNET_NO);
   if (GNUNET_BLOCK_EVALUATION_REQUEST_INVALID !=
-      GNUNET_BLOCK_evaluate (ctx,
-                             GNUNET_BLOCK_TYPE_FS_DBLOCK,
-                             NULL,
-                             GNUNET_BLOCK_EO_NONE,
-                             &key,
-                             "bogus", 5,
-                             NULL, 0))
+      GNUNET_BLOCK_check_query (ctx,
+                                GNUNET_BLOCK_TYPE_FS_DBLOCK,
+                                &key,
+                                "bogus", 5))
     return 8;
   GNUNET_log_skip (0, GNUNET_YES);
   return 0;
diff --git a/src/gns/Makefile.am b/src/gns/Makefile.am
index 1380cba10..315b4dbf3 100644
--- a/src/gns/Makefile.am
+++ b/src/gns/Makefile.am
@@ -22,20 +22,6 @@ else
   LIBIDN2=
 endif
 
-EXTRA_DIST = \
-  test_gns_defaults.conf \
-  test_gns_lookup.conf \
-  test_gns_proxy.conf \
-  test_gns_simple_lookup.conf \
-  openssl.cnf \
-  gnunet-gns-proxy-setup-ca.in \
-  zonefiles/J7POEUT41A8PBFS7KVVDRF88GBOU4HK8PSU5QKVLVE3R9T91E99G.zkey \
-  zonefiles/OEFL7A4VEF1B40QLEMTG5D8G1CN6EN16QUSG5R2DT71GRJN34LSG.zkey \
-  zonefiles/test_zonekey \
-  $(check_SCRIPTS) \
-  $(pkgdata_DATA) \
-  test_gnunet_gns.sh.in
-
 USE_VPN = $(top_builddir)/src/vpn/libgnunetvpn.la
 
 if USE_COVERAGE
@@ -50,6 +36,8 @@ plugindir = $(libdir)/gnunet
 
 pkgcfg_DATA = \
   gns.conf
+dist_pkgcfg_DATA = \
+  tlds.conf
 
 lib_LTLIBRARIES = \
   libgnunetgns.la
@@ -294,6 +282,19 @@ endif
 check_SCRIPTS += \
   test_plugin_rest_gns.sh
 
+EXTRA_DIST = \
+  test_gns_defaults.conf \
+  test_gns_lookup.conf \
+  test_gns_proxy.conf \
+  test_gns_simple_lookup.conf \
+  openssl.cnf \
+  gnunet-gns-proxy-setup-ca.in \
+  zonefiles/J7POEUT41A8PBFS7KVVDRF88GBOU4HK8PSU5QKVLVE3R9T91E99G.zkey \
+  zonefiles/OEFL7A4VEF1B40QLEMTG5D8G1CN6EN16QUSG5R2DT71GRJN34LSG.zkey \
+  zonefiles/test_zonekey \
+  $(check_SCRIPTS) \
+  $(pkgdata_DATA) \
+  test_gnunet_gns.sh.in
 
 if ENABLE_TEST_RUN
 if HAVE_SQLITE
diff --git a/src/gns/gns.conf.in b/src/gns/gns.conf.in
index a458f69a2..13741bee9 100644
--- a/src/gns/gns.conf.in
+++ b/src/gns/gns.conf.in
@@ -24,9 +24,6 @@ INTERCEPT_DNS = NO
 
 # PREFIX = valgrind --leak-check=full --track-origins=yes
 
-# Zones
-.pin = 000G001MF6DVMZZ4Y8XRZQDXM1PB3D3VGEK29ZHXBA57EPSNW1QBPKT8J0
-
 [gns-proxy]
 BINARY = gnunet-gns-proxy
 START_ON_DEMAND = NO
diff --git a/src/gns/gnunet-gns-proxy-setup-ca.in b/src/gns/gnunet-gns-proxy-setup-ca.in
index 9a298f24a..b3ebfd11d 100644
--- a/src/gns/gnunet-gns-proxy-setup-ca.in
+++ b/src/gns/gnunet-gns-proxy-setup-ca.in
@@ -48,33 +48,45 @@
 
 dir=$(dirname "$0")
 
-if test -e @PKGDATADIRECTORY@/progname.sh
-then
-    . @PKGDATADIRECTORY@/progname.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/progname.sh
-fi
+progname=${0##*/}
 
-if test -e @PKGDATADIRECTORY@/existence.sh
-then
-    . @PKGDATADIRECTORY@/existence.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/existence.sh
-fi
+existence() {
+  command -v "$1" >/dev/null 2>&1
+}
+
+statusmsg()
+{
+    ${runcmd} echo "${tab}$@" | tee -a "${results}"
+}
+
+infomsg()
+{
+    if [ x$verbosity = x1 ]; then
+        statusmsg "INFO:${tab}$@"
+    fi
+}
 
-if test -e @PKGDATADIRECTORY@/msg.sh
-then
-    . @PKGDATADIRECTORY@/msg.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/msg.sh
-fi
+warningmsg()
+{
+    statusmsg "WARNING:${tab}$@"
+}
 
-if test -e @PKGDATADIRECTORY@/version_gnunet.sh
-then
-    . @PKGDATADIRECTORY@/version_gnunet.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/version_gnunet.sh
-fi
+errormsg()
+{
+    statusmsg "ERROR:${tab}$@"
+}
+
+linemsg()
+{
+    statusmsg "========================================="
+}
+
+
+print_version()
+{
+    GNUNET_ARM_VERSION=`gnunet-arm -v | awk '{print $2 " " $3}'`
+    echo ${progname} $GNUNET_ARM_VERSION
+}
 
 # Whitespace normalization without depending on shell features:
 tab='   '
diff --git a/src/gns/plugin_block_gns.c b/src/gns/plugin_block_gns.c
index 9b58c9034..407754a8c 100644
--- a/src/gns/plugin_block_gns.c
+++ b/src/gns/plugin_block_gns.c
@@ -185,7 +185,7 @@ block_plugin_gns_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_gns_get_key (void *cls,
                           enum GNUNET_BLOCK_Type type,
                           const void *reply_block,
@@ -208,13 +208,139 @@ block_plugin_gns_get_key (void *cls,
 }
 
 
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_gns_check_query (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size)
+{
+  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+    return GNUNET_SYSERR;
+  if (0 != xquery_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_gns_check_block (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              const struct GNUNET_HashCode *query,
+                              const void *block,
+                              size_t block_size)
+{
+  const struct GNUNET_GNSRECORD_Block *gblock;
+  
+  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+    return GNUNET_SYSERR;
+  if (block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  gblock = block;
+  if (GNUNET_GNSRECORD_block_get_size (gblock) > block_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (GNUNET_OK !=
+      GNUNET_GNSRECORD_block_verify (gblock))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_gns_check_reply (void *cls,
+                              enum GNUNET_BLOCK_Type type,
+                              struct GNUNET_BLOCK_Group *group,
+                              const struct GNUNET_HashCode *query,
+                              const void *xquery,
+                              size_t xquery_size,
+                              const void *reply_block,
+                              size_t reply_block_size)
+{
+  const struct GNUNET_GNSRECORD_Block *block;
+  struct GNUNET_HashCode chash;
+
+  if (type != GNUNET_BLOCK_TYPE_GNS_NAMERECORD)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  /* this is a reply */
+  if (reply_block_size < sizeof(struct GNUNET_GNSRECORD_Block))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_REPLY_INVALID;
+  }
+  block = reply_block;
+  if (GNUNET_GNSRECORD_block_get_size (block) > reply_block_size)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_BLOCK_REPLY_INVALID;
+  }
+  GNUNET_CRYPTO_hash (reply_block,
+                      reply_block_size,
+                      &chash);
+  if (GNUNET_YES ==
+      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                          &chash))
+    return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
 /**
  * Entry point for the plugin.
  */
 void *
 libgnunet_plugin_block_gns_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_GNS_NAMERECORD,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
@@ -224,6 +350,9 @@ libgnunet_plugin_block_gns_init (void *cls)
   api->evaluate = &block_plugin_gns_evaluate;
   api->get_key = &block_plugin_gns_get_key;
   api->create_group = &block_plugin_gns_create_group;
+  api->check_query = &block_plugin_gns_check_query;
+  api->check_block = &block_plugin_gns_check_block;
+  api->check_reply = &block_plugin_gns_check_reply;
   api->types = types;
   return api;
 }
diff --git a/src/gns/test_gnunet_gns.sh.in b/src/gns/test_gnunet_gns.sh.in
index 8a96ff034..d0c07b4e4 100755
--- a/src/gns/test_gnunet_gns.sh.in
+++ b/src/gns/test_gnunet_gns.sh.in
@@ -8,12 +8,9 @@
 # but this works for now.
 dir=$(dirname "$0")
 
-if test -e @PKGDATADIRECTORY@/existence.sh
-then
-    . @PKGDATADIRECTORY@/existence.sh
-else
-    . $dir/../../contrib/build-common/sh/lib.sh/existence.sh
-fi
+existence() {
+  command -v "$1" >/dev/null 2>&1
+}
 
 LOCATION=`existence gnunet-config`
 if test -z $LOCATION; then
diff --git a/src/identity/Makefile.am b/src/identity/Makefile.am
index 59ace6c41..e535c208a 100644
--- a/src/identity/Makefile.am
+++ b/src/identity/Makefile.am
@@ -71,9 +71,12 @@ check_PROGRAMS = \
  test_identity \
  test_identity_defaults 
 
+check_SCRIPTS = \
+  test_identity_messages.sh
+
 if ENABLE_TEST_RUN
 AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
-TESTS = $(check_PROGRAMS) 
+TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 endif
 
 
diff --git a/src/identity/gnunet-identity.c b/src/identity/gnunet-identity.c
index d8dc936d3..97dc2ce7e 100644
--- a/src/identity/gnunet-identity.c
+++ b/src/identity/gnunet-identity.c
@@ -71,6 +71,16 @@ static int quiet;
 static int type_eddsa;
 
 /**
+ * -W option
+ */
+static char *write_msg;
+
+/**
+ * -R option
+ */
+static char *read_msg;
+
+/**
  * -C option
  */
 static char *create_ego;
@@ -86,6 +96,11 @@ static char *delete_ego;
 static char *privkey_ego;
 
 /**
+ * -k option
+ */
+static char *pubkey_msg;
+
+/**
  * -s option.
  */
 static char *set_ego;
@@ -164,6 +179,8 @@ test_finished (void)
        (NULL == delete_op) &&
        (NULL == set_op) &&
        (NULL == set_subsystem) &&
+       (NULL == write_msg) &&
+       (NULL == read_msg) &&
        (! list) &&
        (! monitor))
   {
@@ -260,6 +277,135 @@ set_done (void *cls, const char *emsg)
 
 
 /**
+ * Encrypt a message given with -W, encrypted using public key of
+ * an identity given with -k.
+ */
+static void
+write_encrypted_message (void)
+{
+  struct GNUNET_IDENTITY_PublicKey recipient;
+  if (GNUNET_IDENTITY_public_key_from_string (pubkey_msg, &recipient) !=
+      GNUNET_SYSERR)
+  {
+    struct GNUNET_CRYPTO_EcdhePublicKey message_key;
+    size_t msg_len = strlen (write_msg);
+    ssize_t res = GNUNET_IDENTITY_encrypt (write_msg,
+                                           msg_len,
+                                           &recipient,
+                                           &message_key,
+                                           write_msg);
+    if (-1 != res)
+    {
+      char *keystr;
+      char *serialized_msg;
+      keystr = GNUNET_STRINGS_data_to_string_alloc (&message_key,
+                                                    sizeof(struct
+                                                           GNUNET_CRYPTO_EcdhePublicKey));
+      serialized_msg = GNUNET_STRINGS_data_to_string_alloc (write_msg,
+                                                            msg_len);
+      fprintf (stdout,
+               "%s.%s\n",
+               keystr, serialized_msg);
+      GNUNET_free (keystr);
+      GNUNET_free (serialized_msg);
+    }
+    else
+    {
+      fprintf (stderr, "Error during encryption.\n");
+      global_ret = 1;
+    }
+  }
+  else
+  {
+    fprintf (stderr, "Invalid recipient public key.\n");
+    global_ret = 1;
+  }
+}
+
+
+/**
+ * Decrypt a message given with -R, encrypted using public key of @c ego
+ * and ephemeral key given with -k.
+ *
+ * @param ego ego whose private key is used for decryption
+ */
+static void
+read_encrypted_message (struct GNUNET_IDENTITY_Ego *ego)
+{
+  // message contains ECDHE key and ciphertext divided by ".", so split up first
+  char delim[2] = ".";
+  char *key_msg = strtok (read_msg, delim);
+  char *cipher;
+  if (NULL == key_msg)
+  {
+    fprintf (stderr, "Invalid message format.\n");
+    global_ret = 1;
+    return;
+  }
+  cipher = strtok (NULL, delim);
+  if (NULL == cipher)
+  {
+    fprintf (stderr, "Invalid message format, text missing.\n");
+    global_ret = 1;
+    return;
+  }
+
+  if (NULL != strtok (NULL, delim))
+  {
+    fprintf (stderr,
+             "Invalid message format, expecting only key and cipher components.\n");
+    global_ret = 1;
+    return;
+  }
+
+  struct GNUNET_CRYPTO_EcdhePublicKey message_key;
+  if (GNUNET_OK == GNUNET_STRINGS_string_to_data (key_msg, strlen (
+                                                    key_msg),
+                                                  &message_key,
+                                                  sizeof(message_key)))
+  {
+    char *deserialized_msg;
+    size_t msg_len;
+    if (GNUNET_OK == GNUNET_STRINGS_string_to_data_alloc (cipher, strlen (
+                                                            cipher),
+                                                          (void **) &
+                                                          deserialized_msg,
+                                                          &msg_len))
+    {
+      ssize_t res = GNUNET_IDENTITY_decrypt (deserialized_msg,
+                                             msg_len,
+                                             GNUNET_IDENTITY_ego_get_private_key (
+                                               ego),
+                                             &message_key,
+                                             deserialized_msg);
+      if (-1 != res)
+      {
+        fprintf (stdout,
+                 "%s\n",
+                 deserialized_msg);
+      }
+      else
+      {
+        fprintf (stderr, "Failed to decrypt message.\n");
+        global_ret = 1;
+      }
+      GNUNET_free (deserialized_msg);
+    }
+    else
+    {
+      fprintf (stderr, "Invalid message format.\n");
+      global_ret = 1;
+    }
+  }
+  else
+  {
+    fprintf (stderr, "Invalid message ephemeral key.\n");
+    global_ret = 1;
+  }
+}
+
+
+/**
  * If listing is enabled, prints information about the egos.
  *
  * This function is initially called for all egos and then again
@@ -330,13 +476,25 @@ print_ego (void *cls,
     GNUNET_free (set_ego);
     set_ego = NULL;
   }
+  if ( (NULL == ego) &&
+       (NULL != set_ego) &&
+       (NULL != read_msg) )
+  {
+    fprintf (stderr,
+             "Ego `%s' is not known, cannot decrypt message.\n",
+             set_ego);
+    GNUNET_free (read_msg);
+    read_msg = NULL;
+    GNUNET_free (set_ego);
+    set_ego = NULL;
+  }
   if ((NULL == ego) && (! monitor))
   {
     list = 0;
     test_finished ();
     return;
   }
-  if (! (list | monitor))
+  if (! (list | monitor) && (NULL == read_msg))
     return;
   if ( (NULL == ego) ||
        (NULL == identifier) )
@@ -349,7 +507,14 @@ print_ego (void *cls,
   s = GNUNET_IDENTITY_public_key_to_string (&pk);
   privs = GNUNET_IDENTITY_private_key_to_string (
     GNUNET_IDENTITY_ego_get_private_key (ego));
-  if ((monitor) || (NULL != identifier))
+  if ((NULL != read_msg) && (NULL != set_ego))
+  {
+    // due to the check above, set_ego and the identifier are equal
+    read_encrypted_message (ego);
+    GNUNET_free (read_msg);
+    read_msg = NULL;
+  }
+  else if ((monitor) || (NULL != identifier))
   {
     if (quiet)
     {
@@ -397,6 +562,19 @@ run (void *cls,
     fprintf (stderr, "Option -s requires option -e to be specified as well.\n");
     return;
   }
+
+  if ((NULL != read_msg) && (NULL == set_ego))
+  {
+    fprintf (stderr,
+             "Option -R requires options -e to be specified as well.\n");
+    return;
+  }
+
+  if ((NULL != write_msg) && (NULL == pubkey_msg))
+  {
+    fprintf (stderr, "Option -W requires option -k to be specified as well.\n");
+    return;
+  }
   sh = GNUNET_IDENTITY_connect (cfg,
                                 (monitor | list) ||
                                 (NULL != set_ego) ||
@@ -404,6 +582,13 @@ run (void *cls,
                                 ? &print_ego
                                 : NULL,
                                 NULL);
+  if (NULL != write_msg)
+  {
+    write_encrypted_message ();
+    GNUNET_free (write_msg);
+    write_msg = NULL;
+  }
+  // read message is handled in ego callback (print_ego)
   if (NULL != delete_ego)
     delete_op =
       GNUNET_IDENTITY_delete (sh,
@@ -471,6 +656,18 @@ main (int argc, char *const *argv)
                                  gettext_noop (
                                    "set the private key for the identity to PRIVATE_KEY (use together with -C)"),
                                  &privkey_ego),
+    GNUNET_GETOPT_option_string ('R',
+                                 "read",
+                                 "MESSAGE",
+                                 gettext_noop (
+                                   "Read and decrypt message encrypted for the given ego (use together with -e EGO)"),
+                                 &read_msg),
+    GNUNET_GETOPT_option_string ('W',
+                                 "write",
+                                 "MESSAGE",
+                                 gettext_noop (
+                                   "Encrypt and write message for recipient identity PULBIC_KEY, (use together with -k RECIPIENT_PUBLIC_KEY)"),
+                                 &write_msg),
     GNUNET_GETOPT_option_flag ('X',
                                "eddsa",
                                gettext_noop (
@@ -489,8 +686,14 @@ main (int argc, char *const *argv)
       "ego",
       "NAME",
       gettext_noop (
-        "set default identity to NAME for a subsystem SUBSYSTEM (use together with -s) or restrict results to NAME (use together with -d)"),
+        "set default identity to NAME for a subsystem SUBSYSTEM (use together with -s), restrict results to NAME (use together with -d) or read and decrypt a message for NAME (use together with -R)"),
       &set_ego),
+    GNUNET_GETOPT_option_string ('k',
+                                 "key",
+                                 "PUBLIC_KEY",
+                                 gettext_noop (
+                                   "The public key of the recipient (with -W)"),
+                                 &pubkey_msg),
     GNUNET_GETOPT_option_flag ('m',
                                "monitor",
                                gettext_noop ("run in monitor mode egos"),
diff --git a/src/identity/identity_api.c b/src/identity/identity_api.c
index 08a975e65..01f36b840 100644
--- a/src/identity/identity_api.c
+++ b/src/identity/identity_api.c
@@ -979,10 +979,8 @@ GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key)
   {
   case GNUNET_IDENTITY_TYPE_ECDSA:
     return sizeof (key->type) + sizeof (key->ecdsa_key);
-    break;
   case GNUNET_IDENTITY_TYPE_EDDSA:
     return sizeof (key->type) + sizeof (key->eddsa_key);
-    break;
   default:
     GNUNET_break (0);
   }
@@ -992,19 +990,22 @@ GNUNET_IDENTITY_key_get_length (const struct GNUNET_IDENTITY_PublicKey *key)
 
 ssize_t
 GNUNET_IDENTITY_read_key_from_buffer (struct GNUNET_IDENTITY_PublicKey *key,
-                                      const void*buffer,
+                                      const void *buffer,
                                       size_t len)
 {
   if (len < sizeof (key->type))
     return -1;
-  GNUNET_memcpy (&(key->type), buffer, sizeof (key->type));
-  const ssize_t length = GNUNET_IDENTITY_key_get_length (key);
+  GNUNET_memcpy (&key->type,
+                 buffer,
+                 sizeof (key->type));
+  ssize_t length = GNUNET_IDENTITY_key_get_length (key);
   if (len < length)
     return -1;
   if (length < 0)
     return -2;
-  GNUNET_memcpy (&(key->ecdsa_key), buffer + sizeof (key->type), length
-                 - sizeof (key->type));
+  GNUNET_memcpy (&key->ecdsa_key,
+                 buffer + sizeof (key->type),
+                 length - sizeof (key->type));
   return length;
 }
 
diff --git a/src/identity/test_identity.conf b/src/identity/test_identity.conf
index 9c433da77..14b915732 100644
--- a/src/identity/test_identity.conf
+++ b/src/identity/test_identity.conf
@@ -1,3 +1,6 @@
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-identity-service/
+
 [arm]
 PORT = 12000
 UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-p1-service-arm.sock
diff --git a/src/identity/test_identity_messages.sh b/src/identity/test_identity_messages.sh
new file mode 100755
index 000000000..250c6a6f1
--- /dev/null
+++ b/src/identity/test_identity_messages.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+trap "gnunet-arm -e -c test_identity.conf" SIGINT
+
+LOCATION=$(which gnunet-config)
+if [ -z $LOCATION ]
+then
+  LOCATION="gnunet-config"
+fi
+$LOCATION --version 1> /dev/null
+if test $? != 0
+then
+  echo "GNUnet command line tools cannot be found, check environmental variables PATH and GNUNET_PREFIX"
+  exit 77
+fi
+
+rm -rf `gnunet-config -c test_identity.conf -s PATHS -o GNUNET_HOME -f`
+
+which timeout >/dev/null 2>&1 && DO_TIMEOUT="timeout 30"
+
+TEST_MSG="This is a test message. 123"
+gnunet-arm -s -c test_identity.conf
+gnunet-identity -C recipientego -c test_identity.conf
+RECIPIENT_KEY=$(gnunet-identity -d -e recipientego -q -c test_identity.conf)
+MSG_ENC=$(gnunet-identity -W "$TEST_MSG" -k $RECIPIENT_KEY -c test_identity.conf)
+MSG_DEC=$(gnunet-identity -R "$MSG_ENC" -e recipientego -c test_identity.conf)
+
+if test "$TEST_MSG" != "$MSG_DEC"
+then
+  echo "Failed - $TEST_MSG != $MSG_DEC"
+  exit 1
+fi
+
+gnunet-identity -D recipientego -c test_identity.conf
+gnunet-arm -e -c test_identity.conf
diff --git a/src/include/.gitignore b/src/include/.gitignore
new file mode 100644
index 000000000..6c12255e5
--- /dev/null
+++ b/src/include/.gitignore
@@ -0,0 +1,2 @@
+gnu_name_system_record_types.h
+gnunet_signatures.h
diff --git a/src/include/gnu_name_system_record_types.h b/src/include/gnu_name_system_record_types.h
deleted file mode 100644
index 22b2c472e..000000000
--- a/src/include/gnu_name_system_record_types.h
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
-     This file is part of GNUnet
-     Copyright (C) 2012-2021 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-#ifndef GNU_NAME_SYSTEM_RECORD_TYPES_H
-#define GNU_NAME_SYSTEM_RECORD_TYPES_H
-
-/**
- * WARNING:
- * This header is generated!
- * In order to add GNS record types, you must register
- * them in GANA, and then use the header generation script
- * to create an update of this file. You may then replace this
- * file with the update.
- */
-
-#ifdef __cplusplus
-extern "C" {
-#if 0 /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-
-/**
- * GNS zone transfer
- */
-#define GNUNET_GNSRECORD_TYPE_PKEY 65536
-
-/**
- * GNS nick names
- */
-#define GNUNET_GNSRECORD_TYPE_NICK 65537
-
-/**
- * legacy hostnames
- */
-#define GNUNET_GNSRECORD_TYPE_LEHO 65538
-
-/**
- * VPN resolution
- */
-#define GNUNET_GNSRECORD_TYPE_VPN 65539
-
-/**
- * Delegation to DNS
- */
-#define GNUNET_GNSRECORD_TYPE_GNS2DNS 65540
-
-/**
- * Boxed records (see TLSA/SRV handling in GNS)
- */
-#define GNUNET_GNSRECORD_TYPE_BOX 65541
-
-/**
- * social place for SecuShare
- */
-#define GNUNET_GNSRECORD_TYPE_PLACE 65542
-
-/**
- * Endpoint for conversation
- */
-#define GNUNET_GNSRECORD_TYPE_PHONE 65543
-
-/**
- * identity attribute
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE 65544
-
-/**
- * local ticket reference
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_TICKET 65545
-
-/**
- * For ABD policies
- */
-#define GNUNET_GNSRECORD_TYPE_DELEGATE 65548
-
-/**
- * For ABD reverse lookups
- */
-#define GNUNET_GNSRECORD_TYPE_ATTRIBUTE 65549
-
-/**
- * for reclaim records
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_ATTRIBUTE_REF 65550
-
-/**
- * For reclaim OIDC client names.
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_CLIENT 65552
-
-/**
- * Used reclaimID OIDC client redirect URIs.
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_OIDC_REDIRECT 65553
-
-/**
- * Record type for an attribute attestation (e.g. JWT).
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_CREDENTIAL 65554
-
-/**
- * Record type for a presentation of a credential.
- */
-#define GNUNET_GNSRECORD_TYPE_RECLAIM_PRESENTATION 65555
-
-/**
- * Record type for EDKEY zone delegations.
- */
-#define GNUNET_GNSRECORD_TYPE_EDKEY 65556
-
-/**
- * Encoding for Robust Immutable Storage (ERIS) binary read capability
- */
-#define GNUNET_GNSRECORD_TYPE_ERIS_READ_CAPABILITY 65557
-
-/**
- * Record type to share an entry of a messenger room
- */
-#define GNUNET_GNSRECORD_TYPE_MESSENGER_ROOM_ENTRY 65558
-
-
-#if 0 /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/src/include/gnunet_block_lib.h b/src/include/gnunet_block_lib.h
index 73b51252e..5640209a6 100644
--- a/src/include/gnunet_block_lib.h
+++ b/src/include/gnunet_block_lib.h
@@ -43,6 +43,8 @@ extern "C"
 
 /**
  * Blocks in the datastore and the datacache must have a unique type.
+ *
+ * TODO: move to GANA!
  */
 enum GNUNET_BLOCK_Type
 {
@@ -155,6 +157,7 @@ enum GNUNET_BLOCK_Type
 
 /**
  * Flags that can be set to control the evaluation.
+ * @deprecated
  */
 enum GNUNET_BLOCK_EvaluationOptions
 {
@@ -173,6 +176,7 @@ enum GNUNET_BLOCK_EvaluationOptions
 
 /**
  * Possible ways for how a block may relate to a query.
+ * @deprecated
  */
 enum GNUNET_BLOCK_EvaluationResult
 {
@@ -221,6 +225,44 @@ enum GNUNET_BLOCK_EvaluationResult
 
 
 /**
+ * Possible ways for how a block may relate to a query.
+ */
+enum GNUNET_BLOCK_ReplyEvaluationResult
+{
+  /**
+   * Valid result, but suppressed because it is a duplicate.
+   */
+  GNUNET_BLOCK_REPLY_OK_DUPLICATE = 0,
+
+  /**
+   * Valid result, and there may be more.
+   */
+  GNUNET_BLOCK_REPLY_OK_MORE = 1,
+
+  /**
+   * Last possible valid result.
+   */
+  GNUNET_BLOCK_REPLY_OK_LAST = 2,
+
+  /**
+   * Specified block type not supported by any plugin.
+   */
+  GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED = -1,
+
+  /**
+   * Block does not match query (invalid result)
+   */
+  GNUNET_BLOCK_REPLY_INVALID = -2,
+
+  /**
+   * Block does not match xquery (valid result, not relevant for the request)
+   */
+  GNUNET_BLOCK_REPLY_IRRELEVANT = -3,
+
+};
+
+
+/**
  * Handle to an initialized block library.
  */
 struct GNUNET_BLOCK_Context;
@@ -297,7 +339,7 @@ GNUNET_BLOCK_group_create (struct GNUNET_BLOCK_Context *ctx,
  * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
  *         supported, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_serialize (struct GNUNET_BLOCK_Group *bg,
                               uint32_t *nonce,
                               void **raw_data,
@@ -330,6 +372,7 @@ GNUNET_BLOCK_group_destroy (struct GNUNET_BLOCK_Group *bg);
  * @param reply_block response to validate
  * @param reply_block_size number of bytes in @a reply_block
  * @return characterization of result
+ * @deprecated
  */
 enum GNUNET_BLOCK_EvaluationResult
 GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
@@ -344,6 +387,70 @@ GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
 
 
 /**
+ * Function called to validate a reply.
+ * Also checks the query key against the block contents
+ * as it would be done with the #GNUNET_BLOCK_get_key() function.
+ *
+ * @param ctx block contxt
+ * @param type block type
+ * @param group block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+enum GNUNET_BLOCK_ReplyEvaluationResult
+GNUNET_BLOCK_check_reply (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          struct GNUNET_BLOCK_Group *group,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size,
+                          const void *reply_block,
+                          size_t reply_block_size);
+
+
+/**
+ * Function called to validate a request.
+ *
+ * @param ctx block contxt
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
+ *   #GNUNET_SYSERR if @a type is not supported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_query (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *xquery,
+                          size_t xquery_size);
+
+
+/**
+ * Function called to validate a block.
+ *
+ * @param ctx block contxt
+ * @param type block type
+ * @param query query key (hash)
+ * @param block payload to put
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not,
+ *   #GNUNET_SYSERR if @a type is not supported
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_BLOCK_check_block (struct GNUNET_BLOCK_Context *ctx,
+                          enum GNUNET_BLOCK_Type type,
+                          const struct GNUNET_HashCode *query,
+                          const void *block,
+                          size_t block_size);
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param ctx block context
@@ -356,7 +463,7 @@ GNUNET_BLOCK_evaluate (struct GNUNET_BLOCK_Context *ctx,
  *         #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
                       enum GNUNET_BLOCK_Type type,
                       const void *block,
@@ -375,7 +482,7 @@ GNUNET_BLOCK_get_key (struct GNUNET_BLOCK_Context *ctx,
  * @param seen_results_count number of entries in @a seen_results
  * @return #GNUNET_SYSERR if not supported, #GNUNET_OK on success
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
                              const struct GNUNET_HashCode *seen_results,
                              unsigned int seen_results_count);
@@ -393,7 +500,7 @@ GNUNET_BLOCK_group_set_seen (struct GNUNET_BLOCK_Group *bg,
  *         #GNUNET_NO if merge failed due to different nonce
  *         #GNUNET_SYSERR if merging is not supported
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_BLOCK_group_merge (struct GNUNET_BLOCK_Group *bg1,
                           struct GNUNET_BLOCK_Group *bg2);
 
diff --git a/src/include/gnunet_block_plugin.h b/src/include/gnunet_block_plugin.h
index ee237ac03..2c9a3839d 100644
--- a/src/include/gnunet_block_plugin.h
+++ b/src/include/gnunet_block_plugin.h
@@ -48,9 +48,9 @@
  * @param seen_results_count number of entries in @a seen_results
  */
 typedef void
-(*GNUNET_BLOCK_GroupMarkSeenFunction)(struct GNUNET_BLOCK_Group *bg,
-                                      const struct
-                                      GNUNET_HashCode *seen_results,
+(*GNUNET_BLOCK_GroupMarkSeenFunction)(
+                                      struct GNUNET_BLOCK_Group *bg,
+                                      const struct GNUNET_HashCode *seen_results,
                                       unsigned int seen_results_count);
 
 
@@ -63,7 +63,7 @@ typedef void
  * @return #GNUNET_OK on success, #GNUNET_NO if the nonces were different and thus
  *         we failed.
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GroupMergeFunction)(struct GNUNET_BLOCK_Group *bg1,
                                    const struct GNUNET_BLOCK_Group *bg2);
 
@@ -78,7 +78,7 @@ typedef int
  * @return #GNUNET_OK on success, #GNUNET_NO if serialization is not
  *         supported, #GNUNET_SYSERR on error
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GroupSerializeFunction)(struct GNUNET_BLOCK_Group *bg,
                                        uint32_t *nonce,
                                        void **raw_data,
@@ -180,6 +180,7 @@ typedef struct GNUNET_BLOCK_Group *
  * @param reply_block response to validate
  * @param reply_block_size number of bytes in @a reply_block
  * @return characterization of result
+ * @deprecated
  */
 typedef enum GNUNET_BLOCK_EvaluationResult
 (*GNUNET_BLOCK_EvaluationFunction)(void *cls,
@@ -195,19 +196,83 @@ typedef enum GNUNET_BLOCK_EvaluationResult
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_BLOCK_QueryEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        const struct GNUNET_HashCode *query,
+                                        const void *xquery,
+                                        size_t xquery_size);
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+typedef enum GNUNET_GenericReturnValue
+(*GNUNET_BLOCK_BlockEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        const struct GNUNET_HashCode *query,
+                                        const void *block,
+                                        size_t block_size);
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+typedef enum GNUNET_BLOCK_ReplyEvaluationResult
+(*GNUNET_BLOCK_ReplyEvaluationFunction)(void *cls,
+                                        enum GNUNET_BLOCK_Type type,
+                                        struct GNUNET_BLOCK_Group *group,
+                                        const struct GNUNET_HashCode *query,
+                                        const void *xquery,
+                                        size_t xquery_size,
+                                        const void *reply_block,
+                                        size_t reply_block_size);
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
  * @param type block type
  * @param block block to get the key for
  * @param block_size number of bytes in @a block
- * @param key set to the key (query) for the given block
+ * @param[out] key set to the key (query) for the given block
  * @return #GNUNET_YES on success,
  *         #GNUNET_NO if the block is malformed
  *         #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_BLOCK_GetKeyFunction) (void *cls,
                                 enum GNUNET_BLOCK_Type type,
                                 const void *block,
@@ -234,6 +299,8 @@ struct GNUNET_BLOCK_PluginFunctions
   /**
    * Main function of a block plugin.  Allows us to check if a
    * block matches a query.
+   *
+   * @param deprecated
    */
   GNUNET_BLOCK_EvaluationFunction evaluate;
 
@@ -247,6 +314,22 @@ struct GNUNET_BLOCK_PluginFunctions
    * context (i.e. to detect duplicates).
    */
   GNUNET_BLOCK_GroupCreateFunction create_group;
+
+  /**
+   * Check that a query is well-formed.
+   */
+  GNUNET_BLOCK_QueryEvaluationFunction check_query;
+
+  /**
+   * Check that a block is well-formed.
+   */
+  GNUNET_BLOCK_BlockEvaluationFunction check_block;
+
+  /**
+   * Check that a reply block matches a query.
+   */
+  GNUNET_BLOCK_ReplyEvaluationFunction check_reply;  
+
 };
 
 #endif
diff --git a/src/include/gnunet_crypto_lib.h b/src/include/gnunet_crypto_lib.h
index 9166f822b..1ab135d80 100644
--- a/src/include/gnunet_crypto_lib.h
+++ b/src/include/gnunet_crypto_lib.h
@@ -50,6 +50,7 @@ extern "C" {
 #endif
 #endif
 
+#include <stdbool.h>
 #include <sodium.h>
 
 /**
@@ -1037,61 +1038,38 @@ GNUNET_CRYPTO_hash_xor (const struct GNUNET_HashCode *a,
 
 
 /**
- * @ingroup hash
- * Convert a hashcode into a key.
+ * Count the number of leading 0 bits in @a h.
  *
- * @param hc hash code that serves to generate the key
- * @param skey set to a valid session key
- * @param iv set to a valid initialization vector
+ * @param h a hash
+ * @return number of leading 0 bits in @a h
  */
-void
-GNUNET_CRYPTO_hash_to_aes_key (
-  const struct GNUNET_HashCode *hc,
-  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
-  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv);
+unsigned int
+GNUNET_CRYPTO_hash_count_leading_zeros (const struct GNUNET_HashCode *h);
 
 
 /**
- * @ingroup hash
- * Obtain a bit from a hashcode.
+ * Count the number of tailing 0 bits in @a h.
  *
- * @param code the `struct GNUNET_HashCode` to index bit-wise
- * @param bit index into the hashcode, [0...159] where 0 is the leftmost bit
- *        (bytes in code interpreted big endian)
- * @return Bit \a bit from hashcode \a code, -1 for invalid index
- */
-int
-GNUNET_CRYPTO_hash_get_bit_ltr (const struct GNUNET_HashCode *code,
-                                unsigned int bit);
-
-
-/**
- * Obtain a bit from a hashcode.
- * @param code the GNUNET_CRYPTO_hash to index bit-wise
- * @param bit index into the hashcode, [0...511] where 0 is the rightmost bit
- *        (bytes in code interpreted little endian)
- * @return Bit \a bit from hashcode \a code, -1 for invalid index
+ * @param h a hash
+ * @return number of tailing 0 bits in @a h
  */
-int
-GNUNET_CRYPTO_hash_get_bit_rtl (const struct GNUNET_HashCode *code,
-                                unsigned int bit);
+unsigned int
+GNUNET_CRYPTO_hash_count_tailing_zeros (const struct GNUNET_HashCode *h);
 
 
 /**
  * @ingroup hash
- * Determine how many low order bits match in two
- * `struct GNUNET_HashCodes`.  e.g. - 010011 and 011111 share
- * the first two lowest order bits, and therefore the
- * return value is two (NOT XOR distance, nor how many
- * bits match absolutely!).
+ * Convert a hashcode into a key.
  *
- * @param first the first hashcode
- * @param second the hashcode to compare first to
- * @return the number of bits that match
+ * @param hc hash code that serves to generate the key
+ * @param skey set to a valid session key
+ * @param iv set to a valid initialization vector
  */
-unsigned int
-GNUNET_CRYPTO_hash_matching_bits (const struct GNUNET_HashCode *first,
-                                  const struct GNUNET_HashCode *second);
+void
+GNUNET_CRYPTO_hash_to_aes_key (
+  const struct GNUNET_HashCode *hc,
+  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv);
 
 
 /**
@@ -2606,7 +2584,6 @@ void
 GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
                                struct GNUNET_CRYPTO_CsRPublic *r_pub);
 
-
 /**
  * Derives new random blinding factors.
  * In original papers blinding factors are generated randomly
@@ -2614,13 +2591,12 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
  * To ensure unpredictability a new nonce has to be used.
  * Uses HKDF internally
  *
- * @param secret is secret to derive blinding factors
- * @param secret_len secret length
+ * @param blind_seed is the blinding seed to derive blinding factors
  * @param[out] bs array containing the two derived blinding secrets
  */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const void *secret,
-                                          size_t secret_len,
+GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
+                                          GNUNET_CRYPTO_CsNonce *blind_seed,
                                           struct GNUNET_CRYPTO_CsBlindingSecret
                                           bs[2]);
 
diff --git a/src/include/gnunet_datacache_lib.h b/src/include/gnunet_datacache_lib.h
index 40885803b..519c36bb4 100644
--- a/src/include/gnunet_datacache_lib.h
+++ b/src/include/gnunet_datacache_lib.h
@@ -146,20 +146,6 @@ GNUNET_DATACACHE_get (struct GNUNET_DATACACHE_Handle *h,
 
 
 /**
- * Obtain a random element from the datacache.
- *
- * @param h handle to the datacache
- * @param iter maybe NULL (to just count)
- * @param iter_cls closure for @a iter
- * @return the number of results found (zero or 1)
- */
-unsigned int
-GNUNET_DATACACHE_get_random (struct GNUNET_DATACACHE_Handle *h,
-                             GNUNET_DATACACHE_Iterator iter,
-                             void *iter_cls);
-
-
-/**
  * Iterate over the results that are "close" to a particular key in
  * the datacache.  "close" is defined as numerically larger than @a
  * key (when interpreted as a circular address space), with small
diff --git a/src/include/gnunet_datacache_plugin.h b/src/include/gnunet_datacache_plugin.h
index d7fa8fde0..5d5cac12c 100644
--- a/src/include/gnunet_datacache_plugin.h
+++ b/src/include/gnunet_datacache_plugin.h
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet
-     Copyright (C) 2006, 2009, 2015 GNUnet e.V.
+     Copyright (C) 2006, 2009, 2015, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -115,15 +115,17 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param path_info a path through the network
    * @return 0 if duplicate, -1 on error, number of bytes used otherwise
    */
-  ssize_t (*put) (void *cls,
-                  const struct GNUNET_HashCode *key,
-                  uint32_t xor_distance,
-                  size_t size,
-                  const char *data,
-                  enum GNUNET_BLOCK_Type type,
-                  struct GNUNET_TIME_Absolute discard_time,
-                  unsigned int path_info_len,
-                  const struct GNUNET_PeerIdentity *path_info);
+  ssize_t
+  (*put) (void *cls,
+          const struct GNUNET_HashCode *key,
+          uint32_t xor_distance,
+          size_t size,
+          const char *data,
+          enum GNUNET_BLOCK_Type type,
+          struct GNUNET_TIME_Absolute discard_time,
+          unsigned int path_info_len,
+          const struct GNUNET_PeerIdentity *path_info);
+
 
   /**
    * Iterate over the results for a particular key
@@ -136,11 +138,13 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return the number of results found
    */
-  unsigned int (*get) (void *cls,
-                       const struct GNUNET_HashCode *key,
-                       enum GNUNET_BLOCK_Type type,
-                       GNUNET_DATACACHE_Iterator iter,
-                       void *iter_cls);
+  unsigned int
+  (*get) (void *cls,
+          const struct GNUNET_HashCode *key,
+          enum GNUNET_BLOCK_Type type,
+          GNUNET_DATACACHE_Iterator iter,
+          void *iter_cls);
+
 
   /**
    * Delete the entry with the lowest expiration value
@@ -149,19 +153,8 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param cls closure (internal context for the plugin)
    * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
    */
-  int (*del) (void *cls);
-
-  /**
-   * Return a random value from the datastore.
-   *
-   * @param cls closure (internal context for the plugin)
-   * @param iter maybe NULL (to just count)
-   * @param iter_cls closure for @a iter
-   * @return the number of results found (zero or one)
-   */
-  unsigned int (*get_random) (void *cls,
-                              GNUNET_DATACACHE_Iterator iter,
-                              void *iter_cls);
+  enum GNUNET_GenericReturnValue
+  (*del)(void *cls);
 
 
   /**
@@ -177,11 +170,12 @@ struct GNUNET_DATACACHE_PluginFunctions
    * @param iter_cls closure for @a iter
    * @return the number of results found
    */
-  unsigned int (*get_closest) (void *cls,
-                               const struct GNUNET_HashCode *key,
-                               unsigned int num_results,
-                               GNUNET_DATACACHE_Iterator iter,
-                               void *iter_cls);
+  unsigned int
+  (*get_closest) (void *cls,
+                  const struct GNUNET_HashCode *key,
+                  unsigned int num_results,
+                  GNUNET_DATACACHE_Iterator iter,
+                  void *iter_cls);
 };
 
 
diff --git a/src/include/gnunet_dht_service.h b/src/include/gnunet_dht_service.h
index d4a4ed7d2..160beffdd 100644
--- a/src/include/gnunet_dht_service.h
+++ b/src/include/gnunet_dht_service.h
@@ -56,6 +56,12 @@ extern "C"
 
 
 /**
+ * Maximum allowed replication level for all requests.
+ */
+#define GNUNET_DHT_MAXIMUM_REPLICATION_LEVEL 16
+
+
+/**
  * Connection to the DHT service.
  */
 struct GNUNET_DHT_Handle;
diff --git a/src/include/gnunet_getopt_lib.h b/src/include/gnunet_getopt_lib.h
index 731be4159..259d648dd 100644
--- a/src/include/gnunet_getopt_lib.h
+++ b/src/include/gnunet_getopt_lib.h
@@ -378,6 +378,24 @@ GNUNET_GETOPT_option_absolute_time (char shortName,
 
 
 /**
+ * Allow user to specify a `struct GNUNET_TIME_Timestamp`
+ * (using human-readable "fancy" time).
+ *
+ * @param shortName short name of the option
+ * @param name long name of the option
+ * @param argumentHelp help text for the option argument
+ * @param description long help text for the option
+ * @param[out] val set to the time specified at the command line
+ */
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_timestamp (char shortName,
+                                const char *name,
+                                const char *argumentHelp,
+                                const char *description,
+                                struct GNUNET_TIME_Timestamp *val);
+
+
+/**
  * Increment @a val each time the option flag is given by one.
  *
  * @param shortName short name of the option
diff --git a/src/include/gnunet_identity_service.h b/src/include/gnunet_identity_service.h
index c123983e2..e40a741bf 100644
--- a/src/include/gnunet_identity_service.h
+++ b/src/include/gnunet_identity_service.h
@@ -82,6 +82,8 @@ struct GNUNET_IDENTITY_Handle;
  */
 struct GNUNET_IDENTITY_Ego;
 
+// FIXME: these types are NOT packed,
+// NOT 64-bit aligned, but used in messages!!??
 
 /**
  * A private key for an identity as per LSD0001.
diff --git a/src/include/gnunet_json_lib.h b/src/include/gnunet_json_lib.h
index 5ef4592e5..7d101196c 100644
--- a/src/include/gnunet_json_lib.h
+++ b/src/include/gnunet_json_lib.h
@@ -304,25 +304,25 @@ GNUNET_JSON_spec_boolean (const char *name,
 /* ************ GNUnet-specific parser specifications ******************* */
 
 /**
- * Absolute time.
+ * Timestamp.
  *
  * @param name name of the JSON field
  * @param[out] at where to store the absolute time found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time (const char *name,
-                                struct GNUNET_TIME_Absolute *at);
+GNUNET_JSON_spec_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp *t);
 
 
 /**
- * Absolute time in network byte order.
+ * Timestamp in network byte order.
  *
  * @param name name of the JSON field
- * @param[out] at where to store the absolute time found under @a name
+ * @param[out] tn where to store the absolute time found under @a name
  */
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time_nbo (const char *name,
-                                    struct GNUNET_TIME_AbsoluteNBO *at);
+GNUNET_JSON_spec_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO *tn);
 
 
 /**
@@ -385,23 +385,23 @@ GNUNET_JSON_from_data (const void *data, size_t size);
 
 
 /**
- * Convert absolute timestamp to a json string.
+ * Convert timestamp to a json string.
  *
  * @param stamp the time stamp
  * @return a json string with the timestamp in @a stamp
  */
 json_t *
-GNUNET_JSON_from_time_abs (struct GNUNET_TIME_Absolute stamp);
+GNUNET_JSON_from_timestamp (struct GNUNET_TIME_Timestamp stamp);
 
 
 /**
- * Convert absolute timestamp to a json string.
+ * Convert timestamp to a json string.
  *
  * @param stamp the time stamp
  * @return a json string with the timestamp in @a stamp
  */
 json_t *
-GNUNET_JSON_from_time_abs_nbo (struct GNUNET_TIME_AbsoluteNBO stamp);
+GNUNET_JSON_from_timestamp_nbo (struct GNUNET_TIME_TimestampNBO stamp);
 
 
 /**
@@ -747,30 +747,30 @@ GNUNET_JSON_pack_data_varsize (const char *name,
 
 /**
  * Generate packer instruction for a JSON field of type
- * absolute time.
+ * timestamp.
  *
  * @param name name of the field to add to the object
- * @param at absolute time to pack, a value of 0 is only
+ * @param at timestamp pack, a value of 0 is only
  *        allowed with #GNUNET_JSON_pack_allow_null()!
  * @return json pack specification
  */
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs (const char *name,
-                           struct GNUNET_TIME_Absolute at);
+GNUNET_JSON_pack_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp at);
 
 
 /**
  * Generate packer instruction for a JSON field of type
- * absolute time in network byte order.
+ * timestamp in network byte order.
  *
  * @param name name of the field to add to the object
- * @param at absolute time to pack, a value of 0 is only
+ * @param at timestamp to pack, a value of 0 is only
  *        allowed with #GNUNET_JSON_pack_allow_null()!
  * @return json pack specification
  */
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs_nbo (const char *name,
-                               struct GNUNET_TIME_AbsoluteNBO at);
+GNUNET_JSON_pack_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO at);
 
 
 /**
diff --git a/src/include/gnunet_pq_lib.h b/src/include/gnunet_pq_lib.h
index 05d373f88..f7bf59212 100644
--- a/src/include/gnunet_pq_lib.h
+++ b/src/include/gnunet_pq_lib.h
@@ -96,7 +96,11 @@ struct GNUNET_PQ_QueryParam
  */
 #define GNUNET_PQ_query_param_end \
   {                               \
-    NULL, NULL, NULL, 0, 0        \
+    .conv = NULL,                 \
+    .conv_cls = NULL,             \
+    .data = NULL,                 \
+    .size = 0,                    \
+    .num_params = 0               \
   }
 
 
@@ -200,6 +204,17 @@ GNUNET_PQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x);
 
 
 /**
+ * Generate query parameter for a timestamp.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp (const struct GNUNET_TIME_Timestamp *x);
+
+
+/**
  * Generate query parameter for an absolute time value.
  * The database must store a 64-bit integer.
  *
@@ -212,6 +227,18 @@ GNUNET_PQ_query_param_absolute_time_nbo (
 
 
 /**
+ * Generate query parameter for a timestamp in NBO.
+ * The database must store a 64-bit integer.
+ *
+ * @param x pointer to the query parameter to pass
+ * @return query parameter to use
+ */
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp_nbo (
+  const struct GNUNET_TIME_TimestampNBO *t);
+
+
+/**
  * Generate query parameter for an uint16_t in host byte order.
  *
  * @param x pointer to the query parameter to pass
@@ -472,6 +499,18 @@ GNUNET_PQ_result_spec_absolute_time (const char *name,
 
 
 /**
+ * Timestamp expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] t where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp (const char *name,
+                                 struct GNUNET_TIME_Timestamp *t);
+
+
+/**
  * Relative time expected.
  *
  * @param name name of the field in the table
@@ -496,6 +535,18 @@ GNUNET_PQ_result_spec_absolute_time_nbo (const char *name,
 
 
 /**
+ * Timestamp expected.
+ *
+ * @param name name of the field in the table
+ * @param[out] tn where to store the result
+ * @return array entry for the result specification to use
+ */
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp_nbo (const char *name,
+                                     struct GNUNET_TIME_TimestampNBO *tn);
+
+
+/**
  * uint16_t expected.
  *
  * @param name name of the field in the table
diff --git a/src/include/gnunet_signatures.h b/src/include/gnunet_signatures.h
deleted file mode 100644
index 7c0c1d104..000000000
--- a/src/include/gnunet_signatures.h
+++ /dev/null
@@ -1,266 +0,0 @@
-/*
-     This file is part of GNUnet.
-     Copyright (C) 2009 GNUnet e.V.
-
-     GNUnet is free software: you can redistribute it and/or modify it
-     under the terms of the GNU Affero General Public License as published
-     by the Free Software Foundation, either version 3 of the License,
-     or (at your option) any later version.
-
-     GNUnet is distributed in the hope that it will be useful, but
-     WITHOUT ANY WARRANTY; without even the implied warranty of
-     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     Affero General Public License for more details.
-
-     You should have received a copy of the GNU Affero General Public License
-     along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-     SPDX-License-Identifier: AGPL3.0-or-later
- */
-
-/**
- * @author Christian Grothoff
- *
- * @file
- * Constants for network signatures
- *
- * @defgroup signatures  Network signature definitions
- * @{
- */
-
-#ifndef GNUNET_SIGNATURES_H
-#define GNUNET_SIGNATURES_H
-
-#ifdef __cplusplus
-extern "C"
-{
-#if 0                           /* keep Emacsens' auto-indent happy */
-}
-#endif
-#endif
-
-/**
- * Test signature, not valid for anything other than writing
- * a test. (Note that the signature verification code will
- * accept this value).
- */
-#define GNUNET_SIGNATURE_PURPOSE_TEST 0
-
-/**
- * Signature for confirming that this peer uses a particular address.
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_PONG_OWN 1
-
-/**
- * Signature for confirming that this peer intends to disconnect.
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DISCONNECT 2
-
-/**
- * Signature for confirming a key revocation.
- */
-#define GNUNET_SIGNATURE_PURPOSE_REVOCATION 3
-
-/**
- * Signature for a namespace/pseudonym advertisement (by
- * the namespace owner).
- */
-#define GNUNET_SIGNATURE_PURPOSE_NAMESPACE_ADVERTISEMENT 4
-
-/**
- * Signature by which a peer affirms that it is
- * providing a certain bit of content (used
- * in LOCation URIs).
- */
-#define GNUNET_SIGNATURE_PURPOSE_PEER_PLACEMENT 5
-
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_KBLOCK 6
-
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_SBLOCK 7
-
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_NBLOCK 8
-
-/**
- * Obsolete, legacy value.
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_NBLOCK_KSIG 9
-
-/**
- *
- */
-#define GNUNET_SIGNATURE_PURPOSE_RESOLVER_RESPONSE 10
-
-/**
- * Signature of an GNUNET_DNS_Advertisement
- */
-#define GNUNET_SIGNATURE_PURPOSE_DNS_RECORD 11
-
-/**
- * Signature of a chat message.
- */
-#define GNUNET_SIGNATURE_PURPOSE_CHAT_MESSAGE 12
-
-/**
- * Signature of confirmation receipt for a chat message.
- */
-#define GNUNET_SIGNATURE_PURPOSE_CHAT_RECEIPT 13
-
-/**
- * Signature of a network size estimate message.
- */
-#define GNUNET_SIGNATURE_PURPOSE_NSE_SEND 14
-
-/**
- * Signature of a gnunet naming system record block
- */
-#define GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN 15
-
-/**
- * Purpose is to set a session key.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SET_ECC_KEY 16
-
-/**
- * UBlock Signature, done using DSS, not ECC
- */
-#define GNUNET_SIGNATURE_PURPOSE_FS_UBLOCK 17
-
-/**
- * Accept state in regex DFA.  Peer affirms that
- * it offers the matching service.
- */
-#define GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT 18
-
-/**
- * Signature of a multicast message sent by the origin.
- */
-#define GNUNET_SIGNATURE_PURPOSE_MULTICAST_MESSAGE 19
-
-/**
- * Signature of a conversation ring.
- */
-#define GNUNET_SIGNATURE_PURPOSE_CONVERSATION_RING 20
-
-/**
- * Signature for the first round of distributed key generation.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG1 21
-
-/**
- * Signature for the second round of distributed key generation.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG2 22
-
-/**
- * Signature for cooperatice decryption.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DECRYPTION 23
-
-/**
- * Signature of a multicast request sent by a member.
- */
-#define GNUNET_SIGNATURE_PURPOSE_MULTICAST_REQUEST 24
-
-/**
- * Signature for a sensor anomaly report message.
- */
-#define GNUNET_SIGNATURE_PURPOSE_SENSOR_ANOMALY_REPORT 25
-
-/**
- * Signature for a GNUid Token
- */
-#define GNUNET_SIGNATURE_PURPOSE_GNUID_TOKEN 26
-
-/**
- * Signature for a GNUid Ticket
- */
-#define GNUNET_SIGNATURE_PURPOSE_RECLAIM_CODE_SIGN 27
-
-/**
- * Signature for a GNUnet credential
- */
-#define GNUNET_SIGNATURE_PURPOSE_DELEGATE 28
-
-/**
- * Signature by a peer affirming that this is one of its
- * addresses (for the given time period).
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_ADDRESS 29
-
-/**
- * Signature by a peer affirming that the given ephemeral
- * key is currently in use by that peer's transport service.
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_EPHEMERAL 30
-
-/**
- * Signature used by TCP communicator handshake,
- */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE 31
-
-/**
- * Signature used by TCP communicator rekey.
- */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY 32
-
-/**
- * Signature used by UDP communicator handshake
- */
-#define GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE 33
-
-/**
- * Signature used by UDP broadcasts.
- */
-#define GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST 34
-
-/**
- * Signature by a peer affirming that it received a
- * challenge (and stating how long it expects the
- * address on which the challenge was received to
- * remain valid).
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_CHALLENGE 35
-
-/**
- * Signature by a peer affirming that it is on a DV path.
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_HOP 36
-
-/**
- * Signature by a peer affirming that it originated the
- * DV path.
- */
-#define GNUNET_SIGNATURE_PURPOSE_TRANSPORT_DV_INITIATOR 37
-
-/**
- * Signature by a peer that like to create a connection.
- */
-#define GNUNET_SIGNATURE_PURPOSE_CADET_CONNECTION_INITIATOR 38
-
-/**
- * Signature by a peer sending back the nonce received at initial handshake.
- */
-#define GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK 39
-
-#if 0                           /* keep Emacsens' auto-indent happy */
-{
-#endif
-#ifdef __cplusplus
-}
-#endif
-
-/* ifndef GNUNET_SIGNATURES_H */
-#endif
-
-/** @} */  /* end of group */
-
-/* end of gnunet_signatures.h */
diff --git a/src/include/gnunet_sq_lib.h b/src/include/gnunet_sq_lib.h
index 21ce5b393..e89ded07e 100644
--- a/src/include/gnunet_sq_lib.h
+++ b/src/include/gnunet_sq_lib.h
@@ -40,7 +40,7 @@
  *            so immediately suitable for passing to `sqlite3_bind`-functions.
  * @return #GNUNET_SYSERR on error, #GNUNET_OK on success
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_SQ_QueryConverter)(void *cls,
                             const void *data,
                             size_t data_len,
@@ -156,8 +156,8 @@ GNUNET_SQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x);
  * @param x pointer to the query parameter to pass
  */
 struct GNUNET_SQ_QueryParam
-GNUNET_SQ_query_param_absolute_time_nbo (const struct
-                                         GNUNET_TIME_AbsoluteNBO *x);
+GNUNET_SQ_query_param_absolute_time_nbo (
+  const struct GNUNET_TIME_AbsoluteNBO *x);
 
 
 /**
@@ -222,7 +222,7 @@ GNUNET_SQ_reset (sqlite3 *dbh,
  *   #GNUNET_YES if all results could be extracted
  *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
  */
-typedef int
+typedef enum GNUNET_GenericReturnValue
 (*GNUNET_SQ_ResultConverter)(void *cls,
                              sqlite3_stmt *result,
                              unsigned int column,
@@ -436,7 +436,7 @@ GNUNET_SQ_result_spec_uint64 (uint64_t *u64);
  *   #GNUNET_OK if all results could be extracted
  *   #GNUNET_SYSERR if a result was invalid (non-existing field)
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_SQ_extract_result (sqlite3_stmt *result,
                           struct GNUNET_SQ_ResultSpec *rs);
 
diff --git a/src/include/gnunet_strings_lib.h b/src/include/gnunet_strings_lib.h
index 977c2ead7..2e0c720ee 100644
--- a/src/include/gnunet_strings_lib.h
+++ b/src/include/gnunet_strings_lib.h
@@ -76,7 +76,7 @@ GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
  * @param rtime set to the relative time
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
                                        struct GNUNET_TIME_Relative *rtime);
 
@@ -91,12 +91,27 @@ GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
  * @param atime set to the absolute time
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_absolute (const char *fancy_time,
                                        struct GNUNET_TIME_Absolute *atime);
 
 
 /**
+ * @ingroup time
+ * Convert a given fancy human-readable time to our internal
+ * representation.  The human-readable time is expected to be
+ * in local time, whereas the returned value will be in UTC.
+ *
+ * @param fancy_time human readable string (e.g. %Y-%m-%d %H:%M:%S)
+ * @param atime set to the absolute time
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
+ */
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_timestamp (const char *fancy_time,
+                                        struct GNUNET_TIME_Timestamp *atime);
+
+
+/**
  * Convert a given filesize into a fancy human-readable format.
  *
  * @param size number of bytes
diff --git a/src/include/gnunet_time_lib.h b/src/include/gnunet_time_lib.h
index 26b442066..b14439462 100644
--- a/src/include/gnunet_time_lib.h
+++ b/src/include/gnunet_time_lib.h
@@ -54,6 +54,17 @@ struct GNUNET_TIME_Absolute
 };
 
 /**
+ * Rounded time for timestamps used by GNUnet, in seconds.
+ */
+struct GNUNET_TIME_Timestamp
+{
+  /**
+   * The actual value. Must be round number in seconds.
+   */
+  struct GNUNET_TIME_Absolute abs_time;
+};
+
+/**
  * Time for relative time used by GNUnet, in microseconds.
  * Always positive, so we can only refer to future time.
  */
@@ -89,17 +100,34 @@ struct GNUNET_TIME_AbsoluteNBO
    */
   uint64_t abs_value_us__ GNUNET_PACKED;
 };
+
+/**
+ * Time for timestamps used by GNUnet, in seconds and in network byte order.
+ */
+struct GNUNET_TIME_TimestampNBO
+{
+  /**
+   * The actual value. Must be round number in seconds.
+   */
+  struct GNUNET_TIME_AbsoluteNBO abs_time_nbo;
+};
+
 GNUNET_NETWORK_STRUCT_END
 
 /**
  * Relative time zero.
  */
-#define GNUNET_TIME_UNIT_ZERO     GNUNET_TIME_relative_get_zero_ ()
+#define GNUNET_TIME_UNIT_ZERO ((struct GNUNET_TIME_Relative){0})
 
 /**
  * Absolute time zero.
  */
-#define GNUNET_TIME_UNIT_ZERO_ABS GNUNET_TIME_absolute_get_zero_ ()
+#define GNUNET_TIME_UNIT_ZERO_ABS ((struct GNUNET_TIME_Absolute){0})
+
+/**
+ * Timestamp of zero.
+ */
+#define GNUNET_TIME_UNIT_ZERO_TS ((struct GNUNET_TIME_Timestamp){{0}})
 
 /**
  * One microsecond, our basic time unit.
@@ -154,13 +182,22 @@ GNUNET_NETWORK_STRUCT_END
  * Constant used to specify "forever".  This constant
  * will be treated specially in all time operations.
  */
-#define GNUNET_TIME_UNIT_FOREVER_REL GNUNET_TIME_relative_get_forever_ ()
+#define GNUNET_TIME_UNIT_FOREVER_REL \
+  ((struct GNUNET_TIME_Relative){UINT64_MAX})
 
 /**
  * Constant used to specify "forever".  This constant
  * will be treated specially in all time operations.
  */
-#define GNUNET_TIME_UNIT_FOREVER_ABS GNUNET_TIME_absolute_get_forever_ ()
+#define GNUNET_TIME_UNIT_FOREVER_ABS \
+  ((struct GNUNET_TIME_Absolute){UINT64_MAX})
+
+/**
+ * Constant used to specify "forever".  This constant
+ * will be treated specially in all time operations.
+ */
+#define GNUNET_TIME_UNIT_FOREVER_TS \
+  ((struct GNUNET_TIME_Timestamp){{UINT64_MAX}})
 
 
 /**
@@ -183,6 +220,47 @@ GNUNET_NETWORK_STRUCT_END
 
 
 /**
+ * Convert @a ts to human-readable timestamp.
+ * Note that the returned value will be overwritten if this function
+ * is called again.
+ *
+ * @param ts the timestamp to convert
+ * @return statically allocated string, will change on the next call
+ */
+const char *
+GNUNET_TIME_timestamp2s (struct GNUNET_TIME_Timestamp ts);
+
+
+/**
+ * @ingroup time
+ * Like `asctime`, except for GNUnet time.  Converts a GNUnet internal
+ * absolute time (which is in UTC) to a string in local time.
+ * Note that the returned value will be overwritten if this function
+ * is called again.
+ *
+ * @param t the absolute time to convert
+ * @return timestamp in human-readable form in local time
+ */
+const char *
+GNUNET_TIME_absolute2s (struct GNUNET_TIME_Absolute ts);
+
+
+/**
+ * @ingroup time
+ * Give relative time in human-readable fancy format.
+ * This is one of the very few calls in the entire API that is
+ * NOT reentrant!
+ *
+ * @param delta time in milli seconds
+ * @param do_round are we allowed to round a bit?
+ * @return string in human-readable form
+ */
+const char *
+GNUNET_TIME_relative2s (struct GNUNET_TIME_Relative delta,
+                        bool do_round);
+
+
+/**
  * Randomized exponential back-off, starting at 1 ms
  * and going up by a factor of 2+r, where 0 <= r <= 0.5, up
  * to a maximum of the given threshold.
@@ -192,8 +270,8 @@ GNUNET_NETWORK_STRUCT_END
  * @return the next backoff time
  */
 struct GNUNET_TIME_Relative
-GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt, struct
-                                GNUNET_TIME_Relative threshold);
+GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt,
+                                struct GNUNET_TIME_Relative threshold);
 
 
 /**
@@ -290,27 +368,69 @@ GNUNET_TIME_relative_to_absolute (struct GNUNET_TIME_Relative rel);
 
 
 /**
- * Round a time value so that it is suitable for transmission
- * via JSON encodings.
+ * Convert relative time to a timestamp in the
+ * future.
+ *
+ * @param rel relative time to convert
+ * @return timestamp that is "rel" in the future, or FOREVER if rel==FOREVER (or if we would overflow)
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_relative_to_timestamp (struct GNUNET_TIME_Relative rel);
+
+
+/**
+ * Round an absolute time to a timestamp.
  *
  * @param at time to round
- * @return #GNUNET_OK if time was already rounded, #GNUNET_NO if
- *         it was just now rounded
+ * @return the result
  */
-int
-GNUNET_TIME_round_abs (struct GNUNET_TIME_Absolute *at);
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_absolute_to_timestamp (struct GNUNET_TIME_Absolute at);
 
 
 /**
- * Round a time value so that it is suitable for transmission
- * via JSON encodings.
+ * Get timestamp representing the current time.
  *
- * @param rt time to round
- * @return #GNUNET_OK if time was already rounded, #GNUNET_NO if
- *         it was just now rounded
+ * @return current time, rounded down to seconds
  */
-int
-GNUNET_TIME_round_rel (struct GNUNET_TIME_Relative *rt);
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_get (void);
+
+
+/**
+ * Compare two absolute times.
+ *
+ * @param t1 first time
+ * @param op compare operator
+ * @param t2 second time
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_absolute_cmp(t1,op,t2) \
+  ((void) (1 op 2), (t1).abs_value_us op (t2).abs_value_us)
+
+
+/**
+ * Compare two timestamps
+ *
+ * @param t1 first timestamp
+ * @param op compare operator
+ * @param t2 second timestamp
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_timestamp_cmp(t1,op,t2) \
+  GNUNET_TIME_absolute_cmp ((t1).abs_time,op,(t2).abs_time)
+
+
+/**
+ * Compare two relative times.
+ *
+ * @param t1 first time
+ * @param op compare operator
+ * @param t2 second time
+ * @return true if @a t1 @a op @a t2
+ */
+#define GNUNET_TIME_relative_cmp(t1,op,t2) \
+  ((void) (1 op 2), (t1).rel_value_us op (t2).rel_value_us)
 
 
 /**
@@ -362,6 +482,30 @@ GNUNET_TIME_absolute_max (struct GNUNET_TIME_Absolute t1,
 
 
 /**
+ * Return the maximum of two timestamps.
+ *
+ * @param t1 first timestamp
+ * @param t2 other timestamp
+ * @return timestamp that is smaller
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_max (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2);
+
+
+/**
+ * Return the minimum of two timestamps.
+ *
+ * @param t1 first timestamp
+ * @param t2 other timestamp
+ * @return timestamp that is smaller
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_min (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2);
+
+
+/**
  * Given a timestamp in the future, how much time
  * remains until then?
  *
@@ -530,6 +674,16 @@ GNUNET_TIME_absolute_hton (struct GNUNET_TIME_Absolute a);
 
 
 /**
+ * Convert timestamp to network byte order.
+ *
+ * @param t time to convert
+ * @return converted time value
+ */
+struct GNUNET_TIME_TimestampNBO
+GNUNET_TIME_timestamp_hton (struct GNUNET_TIME_Timestamp t);
+
+
+/**
  * Convert milliseconds after the UNIX epoch to absolute time.
  *
  * @param ms_after_epoch millisecond timestamp to convert
@@ -558,6 +712,15 @@ GNUNET_TIME_absolute_is_past (struct GNUNET_TIME_Absolute abs);
 
 
 /**
+ * Test if @a abs is truly zero.
+ *
+ * @return true if it is.
+ */
+bool
+GNUNET_TIME_absolute_is_zero (struct GNUNET_TIME_Absolute abs);
+
+
+/**
  * Test if @a abs is truly in the future (excluding now).
  *
  * @return true if it is.
@@ -595,6 +758,15 @@ GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch);
 
 
 /**
+ * Convert seconds after the UNIX epoch to timestamp.
+ *
+ * @param s_after_epoch seconds after epoch to convert
+ * @return converted time value
+ */struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch);
+
+
+/**
  * Convert absolute time from network byte order.
  *
  * @param a time to convert
@@ -605,6 +777,16 @@ GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a);
 
 
 /**
+ * Convert timestamp from network byte order.
+ *
+ * @param tn time to convert
+ * @return converted time value
+ */
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_ntoh (struct GNUNET_TIME_TimestampNBO tn);
+
+
+/**
  * Set the timestamp offset for this instance.
  *
  * @param offset the offset to skew the locale time by
diff --git a/src/json/json_generator.c b/src/json/json_generator.c
index 0c513ca9d..5421b9527 100644
--- a/src/json/json_generator.c
+++ b/src/json/json_generator.c
@@ -27,14 +27,6 @@
 #include "gnunet_json_lib.h"
 
 
-/**
- * Convert binary data to a JSON string
- * with the base32crockford encoding.
- *
- * @param data binary data
- * @param size size of @a data in bytes
- * @return json string that encodes @a data
- */
 json_t *
 GNUNET_JSON_from_data (const void *data,
                        size_t size)
@@ -57,30 +49,30 @@ GNUNET_JSON_from_data (const void *data,
 }
 
 
-/**
- * Convert absolute timestamp to a json string.
- *
- * @param stamp the time stamp
- * @return a json string with the timestamp in @a stamp
- */
 json_t *
-GNUNET_JSON_from_time_abs (struct GNUNET_TIME_Absolute stamp)
+GNUNET_JSON_from_timestamp (struct GNUNET_TIME_Timestamp stamp)
 {
   json_t *j;
 
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_TIME_round_abs (&stamp));
-
   j = json_object ();
   if (NULL == j)
   {
     GNUNET_break (0);
     return NULL;
   }
-  if (stamp.abs_value_us == GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us)
+  if (GNUNET_TIME_absolute_is_never (stamp.abs_time))
   {
     if (0 !=
         json_object_set_new (j,
+                             "t_s",
+                             json_string ("never")))
+    {
+      GNUNET_break (0);
+      json_decref (j);
+      return NULL;
+    }
+    if (0 !=
+        json_object_set_new (j,
                              "t_ms",
                              json_string ("never")))
     {
@@ -90,11 +82,29 @@ GNUNET_JSON_from_time_abs (struct GNUNET_TIME_Absolute stamp)
     }
     return j;
   }
+  GNUNET_assert (
+    0 ==
+    (stamp.abs_time.abs_value_us
+     % GNUNET_TIME_UNIT_SECONDS.rel_value_us));
   if (0 !=
-      json_object_set_new (j,
-                           "t_ms",
-                           json_integer ((json_int_t) (stamp.abs_value_us
-                                                       / 1000LL))))
+      json_object_set_new (
+        j,
+        "t_s",
+        json_integer (
+          (json_int_t) (stamp.abs_time.abs_value_us
+                        / GNUNET_TIME_UNIT_SECONDS.rel_value_us))))
+  {
+    GNUNET_break (0);
+    json_decref (j);
+    return NULL;
+  }
+  if (0 !=
+      json_object_set_new (
+        j,
+        "t_ms",
+        json_integer (
+          (json_int_t) (stamp.abs_time.abs_value_us
+                        / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us))))
   {
     GNUNET_break (0);
     json_decref (j);
@@ -104,43 +114,37 @@ GNUNET_JSON_from_time_abs (struct GNUNET_TIME_Absolute stamp)
 }
 
 
-/**
- * Convert absolute timestamp to a json string.
- *
- * @param stamp the time stamp
- * @return a json string with the timestamp in @a stamp
- */
 json_t *
-GNUNET_JSON_from_time_abs_nbo (struct GNUNET_TIME_AbsoluteNBO stamp)
+GNUNET_JSON_from_timestamp_nbo (struct GNUNET_TIME_TimestampNBO stamp)
 {
-  return GNUNET_JSON_from_time_abs (GNUNET_TIME_absolute_ntoh (stamp));
+  return GNUNET_JSON_from_timestamp (GNUNET_TIME_timestamp_ntoh (stamp));
 }
 
 
-/**
- * Convert relative timestamp to a json string.
- *
- * @param stamp the time stamp
- * @return a json string with the timestamp in @a stamp
- */
 json_t *
 GNUNET_JSON_from_time_rel (struct GNUNET_TIME_Relative stamp)
 {
   json_t *j;
 
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_TIME_round_rel (&stamp));
-
   j = json_object ();
   if (NULL == j)
   {
     GNUNET_break (0);
     return NULL;
   }
-  if (stamp.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+  if (GNUNET_TIME_relative_is_forever (stamp))
   {
     if (0 !=
         json_object_set_new (j,
+                             "d_us",
+                             json_string ("forever")))
+    {
+      GNUNET_break (0);
+      json_decref (j);
+      return NULL;
+    }
+    if (0 !=
+        json_object_set_new (j,
                              "d_ms",
                              json_string ("forever")))
     {
@@ -150,11 +154,27 @@ GNUNET_JSON_from_time_rel (struct GNUNET_TIME_Relative stamp)
     }
     return j;
   }
+  if (stamp.rel_value_us >= (1LLU << 53))
+  {
+    /* value is larger than allowed */
+    GNUNET_break (0);
+    return NULL;
+  }
   if (0 !=
-      json_object_set_new (j,
-                           "d_ms",
-                           json_integer ((json_int_t) (stamp.rel_value_us
-                                                       / 1000LL))))
+      json_object_set_new (
+        j,
+        "d_us",
+        json_integer ((json_int_t) stamp.rel_value_us)))
+  {
+    GNUNET_break (0);
+    json_decref (j);
+    return NULL;
+  }
+  if (0 !=
+      json_object_set_new (
+        j,
+        "d_ms",
+        json_integer (((json_int_t) stamp.rel_value_us)/1000LL)))
   {
     GNUNET_break (0);
     json_decref (j);
@@ -164,12 +184,6 @@ GNUNET_JSON_from_time_rel (struct GNUNET_TIME_Relative stamp)
 }
 
 
-/**
- * Convert RSA public key to JSON.
- *
- * @param pk public key to convert
- * @return corresponding JSON encoding
- */
 json_t *
 GNUNET_JSON_from_rsa_public_key (const struct GNUNET_CRYPTO_RsaPublicKey *pk)
 {
@@ -186,12 +200,6 @@ GNUNET_JSON_from_rsa_public_key (const struct GNUNET_CRYPTO_RsaPublicKey *pk)
 }
 
 
-/**
- * Convert RSA signature to JSON.
- *
- * @param sig signature to convert
- * @return corresponding JSON encoding
- */
 json_t *
 GNUNET_JSON_from_rsa_signature (const struct GNUNET_CRYPTO_RsaSignature *sig)
 {
diff --git a/src/json/json_helper.c b/src/json/json_helper.c
index 3a11f205c..c0513c529 100644
--- a/src/json/json_helper.c
+++ b/src/json/json_helper.c
@@ -49,7 +49,7 @@ GNUNET_JSON_spec_end ()
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
+static enum GNUNET_GenericReturnValue
 parse_fixed_data (void *cls,
                   json_t *root,
                   struct GNUNET_JSON_Specification *spec)
@@ -579,19 +579,20 @@ GNUNET_JSON_spec_int64 (const char *name,
 /* ************ GNUnet-specific parser specifications ******************* */
 
 /**
- * Parse given JSON object to absolute time.
+ * Parse given JSON object to a timestamp.
  *
  * @param cls closure, NULL
  * @param root the json object representing data
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
-parse_abs_time (void *cls,
-                json_t *root,
-                struct GNUNET_JSON_Specification *spec)
+static enum GNUNET_GenericReturnValue
+parse_timestamp (void *cls,
+                 json_t *root,
+                 struct GNUNET_JSON_Specification *spec)
 {
-  struct GNUNET_TIME_Absolute *abs = spec->ptr;
+  struct GNUNET_TIME_Timestamp *ts = spec->ptr;
+  json_t *json_t_s;
   json_t *json_t_ms;
   unsigned long long int tval;
 
@@ -600,13 +601,49 @@ parse_abs_time (void *cls,
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
-  json_t_ms = json_object_get (root, "t_ms");
+  json_t_s = json_object_get (root,
+                              "t_s");
+  if (json_is_integer (json_t_s))
+  {
+    tval = json_integer_value (json_t_s);
+    /* Time is in seconds in JSON, but in microseconds in GNUNET_TIME_Absolute */
+    ts->abs_time.abs_value_us
+      = tval * GNUNET_TIME_UNIT_SECONDS.rel_value_us;
+    if (ts->abs_time.abs_value_us
+        / GNUNET_TIME_UNIT_SECONDS.rel_value_us
+        != tval)
+    {
+      /* Integer overflow */
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    return GNUNET_OK;
+  }
+  if (json_is_string (json_t_s))
+  {
+    const char *val;
+
+    val = json_string_value (json_t_s);
+    if ((0 == strcasecmp (val,
+                          "never")))
+    {
+      ts->abs_time = GNUNET_TIME_UNIT_FOREVER_ABS;
+      return GNUNET_OK;
+    }
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  json_t_ms = json_object_get (root,
+                               "t_ms");
   if (json_is_integer (json_t_ms))
   {
     tval = json_integer_value (json_t_ms);
-    /* Time is in milliseconds in JSON, but in microseconds in GNUNET_TIME_Absolute */
-    abs->abs_value_us = tval * GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us;
-    if ((abs->abs_value_us)
+    GNUNET_break_op (0 == tval % 1000);
+    tval -= tval % 1000;
+    /* Time is in seconds in JSON, but in microseconds in GNUNET_TIME_Absolute */
+    ts->abs_time.abs_value_us
+      = tval * GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us;
+    if (ts->abs_time.abs_value_us
         / GNUNET_TIME_UNIT_MILLISECONDS.rel_value_us
         != tval)
     {
@@ -621,9 +658,10 @@ parse_abs_time (void *cls,
     const char *val;
 
     val = json_string_value (json_t_ms);
-    if ((0 == strcasecmp (val, "never")))
+    if ((0 == strcasecmp (val,
+                          "never")))
     {
-      *abs = GNUNET_TIME_UNIT_FOREVER_ABS;
+      ts->abs_time = GNUNET_TIME_UNIT_FOREVER_ABS;
       return GNUNET_OK;
     }
     GNUNET_break_op (0);
@@ -635,17 +673,14 @@ parse_abs_time (void *cls,
 
 
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time (const char *name,
-                                struct GNUNET_TIME_Absolute *at)
+GNUNET_JSON_spec_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp *t)
 {
   struct GNUNET_JSON_Specification ret = {
-    .parser = &parse_abs_time,
-    .cleaner = NULL,
-    .cls = NULL,
+    .parser = &parse_timestamp,
     .field = name,
-    .ptr = at,
-    .ptr_size = sizeof(struct GNUNET_TIME_Absolute),
-    .size_ptr = NULL
+    .ptr = t,
+    .ptr_size = sizeof(struct GNUNET_TIME_Timestamp)
   };
 
   return ret;
@@ -660,40 +695,37 @@ GNUNET_JSON_spec_absolute_time (const char *name,
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
-parse_abs_time_nbo (void *cls,
-                    json_t *root,
-                    struct GNUNET_JSON_Specification *spec)
+static enum GNUNET_GenericReturnValue
+parse_timestamp_nbo (void *cls,
+                     json_t *root,
+                     struct GNUNET_JSON_Specification *spec)
 {
-  struct GNUNET_TIME_AbsoluteNBO *abs = spec->ptr;
-  struct GNUNET_TIME_Absolute a;
+  struct GNUNET_TIME_TimestampNBO *ts = spec->ptr;
+  struct GNUNET_TIME_Timestamp a;
   struct GNUNET_JSON_Specification ispec;
 
   ispec = *spec;
-  ispec.parser = &parse_abs_time;
+  ispec.parser = &parse_timestamp;
   ispec.ptr = &a;
   if (GNUNET_OK !=
-      parse_abs_time (NULL,
-                      root,
-                      &ispec))
+      parse_timestamp (NULL,
+                       root,
+                       &ispec))
     return GNUNET_SYSERR;
-  *abs = GNUNET_TIME_absolute_hton (a);
+  *ts = GNUNET_TIME_timestamp_hton (a);
   return GNUNET_OK;
 }
 
 
 struct GNUNET_JSON_Specification
-GNUNET_JSON_spec_absolute_time_nbo (const char *name,
-                                    struct GNUNET_TIME_AbsoluteNBO *at)
+GNUNET_JSON_spec_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO *at)
 {
   struct GNUNET_JSON_Specification ret = {
-    .parser = &parse_abs_time_nbo,
-    .cleaner = NULL,
-    .cls = NULL,
+    .parser = &parse_timestamp_nbo,
     .field = name,
     .ptr = at,
-    .ptr_size = sizeof(struct GNUNET_TIME_AbsoluteNBO),
-    .size_ptr = NULL
+    .ptr_size = sizeof(struct GNUNET_TIME_TimestampNBO)
   };
 
   return ret;
@@ -708,12 +740,13 @@ GNUNET_JSON_spec_absolute_time_nbo (const char *name,
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
+static enum GNUNET_GenericReturnValue
 parse_rel_time (void *cls,
                 json_t *root,
                 struct GNUNET_JSON_Specification *spec)
 {
   struct GNUNET_TIME_Relative *rel = spec->ptr;
+  json_t *json_d_us;
   json_t *json_d_ms;
   unsigned long long int tval;
 
@@ -722,25 +755,52 @@ parse_rel_time (void *cls,
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
-  json_d_ms = json_object_get (root, "d_ms");
-  if (json_is_integer (json_d_ms))
+  json_d_us = json_object_get (root,
+                               "d_us");
+  if (json_is_integer (json_d_us))
   {
-    tval = json_integer_value (json_d_ms);
-    /* Time is in milliseconds in JSON, but in microseconds in GNUNET_TIME_Absolute */
-    rel->rel_value_us = tval * 1000LL;
-    if ((rel->rel_value_us) / 1000LL != tval)
+    tval = json_integer_value (json_d_us);
+    if (tval >= (1LLU << 53))
     {
-      /* Integer overflow */
+      /* value is larger than allowed */
       GNUNET_break_op (0);
       return GNUNET_SYSERR;
     }
+    rel->rel_value_us = tval;
+    return GNUNET_OK;
+  }
+  if (json_is_string (json_d_us))
+  {
+    const char *val;
+
+    val = json_string_value (json_d_us);
+    if ((0 == strcasecmp (val,
+                          "forever")))
+    {
+      *rel = GNUNET_TIME_UNIT_FOREVER_REL;
+      return GNUNET_OK;
+    }
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+
+  json_d_ms = json_object_get (root,
+                               "d_ms");
+  if (json_is_integer (json_d_ms))
+  {
+    tval = json_integer_value (json_d_ms);
+    *rel = GNUNET_TIME_relative_multiply (
+      GNUNET_TIME_UNIT_MILLISECONDS,
+      tval);
     return GNUNET_OK;
   }
   if (json_is_string (json_d_ms))
   {
     const char *val;
+
     val = json_string_value (json_d_ms);
-    if ((0 == strcasecmp (val, "forever")))
+    if ((0 == strcasecmp (val,
+                          "forever")))
     {
       *rel = GNUNET_TIME_UNIT_FOREVER_REL;
       return GNUNET_OK;
@@ -759,12 +819,9 @@ GNUNET_JSON_spec_relative_time (const char *name,
 {
   struct GNUNET_JSON_Specification ret = {
     .parser = &parse_rel_time,
-    .cleaner = NULL,
-    .cls = NULL,
     .field = name,
     .ptr = rt,
-    .ptr_size = sizeof(struct GNUNET_TIME_Relative),
-    .size_ptr = NULL
+    .ptr_size = sizeof(struct GNUNET_TIME_Relative)
   };
 
   return ret;
@@ -779,7 +836,7 @@ GNUNET_JSON_spec_relative_time (const char *name,
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
+static enum GNUNET_GenericReturnValue
 parse_rsa_public_key (void *cls,
                       json_t *root,
                       struct GNUNET_JSON_Specification *spec)
@@ -864,7 +921,7 @@ GNUNET_JSON_spec_rsa_public_key (const char *name,
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
+static enum GNUNET_GenericReturnValue
 parse_rsa_signature (void *cls,
                      json_t *root,
                      struct GNUNET_JSON_Specification *spec)
@@ -952,7 +1009,7 @@ GNUNET_JSON_spec_rsa_signature (const char *name,
  * @param[out] spec where to write the data
  * @return #GNUNET_OK upon successful parsing; #GNUNET_SYSERR upon error
  */
-static int
+static enum GNUNET_GenericReturnValue
 parse_boolean (void *cls,
                json_t *root,
                struct GNUNET_JSON_Specification *spec)
diff --git a/src/json/json_pack.c b/src/json/json_pack.c
index 92f8b4535..296f56104 100644
--- a/src/json/json_pack.c
+++ b/src/json/json_pack.c
@@ -245,16 +245,16 @@ GNUNET_JSON_pack_data_varsize (const char *name,
 
 
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs (const char *name,
-                           struct GNUNET_TIME_Absolute at)
+GNUNET_JSON_pack_timestamp (const char *name,
+                            struct GNUNET_TIME_Timestamp t)
 {
   struct GNUNET_JSON_PackSpec ps = {
     .field_name = name
   };
 
-  if (0 != at.abs_value_us)
+  if (! GNUNET_TIME_absolute_is_zero (t.abs_time))
   {
-    ps.object = GNUNET_JSON_from_time_abs (at);
+    ps.object = GNUNET_JSON_from_timestamp (t);
     GNUNET_assert (NULL != ps.object);
   }
   else
@@ -266,11 +266,11 @@ GNUNET_JSON_pack_time_abs (const char *name,
 
 
 struct GNUNET_JSON_PackSpec
-GNUNET_JSON_pack_time_abs_nbo (const char *name,
-                               struct GNUNET_TIME_AbsoluteNBO at)
+GNUNET_JSON_pack_timestamp_nbo (const char *name,
+                                struct GNUNET_TIME_TimestampNBO at)
 {
-  return GNUNET_JSON_pack_time_abs (name,
-                                    GNUNET_TIME_absolute_ntoh (at));
+  return GNUNET_JSON_pack_timestamp (name,
+                                     GNUNET_TIME_timestamp_ntoh (at));
 }
 
 
diff --git a/src/json/test_json.c b/src/json/test_json.c
index 4485a37a4..d6c372cf3 100644
--- a/src/json/test_json.c
+++ b/src/json/test_json.c
@@ -1,6 +1,6 @@
 /*
    This file is part of GNUnet
-   (C) 2015, 2016 GNUnet e.V.
+   (C) 2015, 2016, 2021 GNUnet e.V.
 
    GNUnet is free software: you can redistribute it and/or modify it
    under the terms of the GNU Affero General Public License as published
@@ -34,33 +34,44 @@
  * @return 0 on success
  */
 static int
-test_abs_time ()
+test_timestamp (void)
 {
   json_t *j;
   struct GNUNET_TIME_Absolute a1;
-  struct GNUNET_TIME_Absolute a2;
-  struct GNUNET_JSON_Specification s1[] = { GNUNET_JSON_spec_absolute_time (
-                                              NULL,
-                                              &a2),
-                                            GNUNET_JSON_spec_end () };
-  struct GNUNET_JSON_Specification s2[] = { GNUNET_JSON_spec_absolute_time (
-                                              NULL,
-                                              &a2),
-                                            GNUNET_JSON_spec_end () };
+  struct GNUNET_TIME_Timestamp t1;
+  struct GNUNET_TIME_Timestamp t2;
+  struct GNUNET_JSON_Specification s1[] = {
+    GNUNET_JSON_spec_timestamp (NULL,
+                                &t2),
+    GNUNET_JSON_spec_end ()
+  };
+  struct GNUNET_JSON_Specification s2[] = {
+    GNUNET_JSON_spec_timestamp (NULL,
+                                &t2),
+    GNUNET_JSON_spec_end ()
+  };
 
   a1 = GNUNET_TIME_absolute_get ();
-  GNUNET_TIME_round_abs (&a1);
-  j = GNUNET_JSON_from_time_abs (a1);
+  t1 = GNUNET_TIME_absolute_to_timestamp (a1);
+  j = GNUNET_JSON_from_timestamp (t1);
   GNUNET_assert (NULL != j);
-  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (j, s1, NULL, NULL));
-  GNUNET_assert (a1.abs_value_us == a2.abs_value_us);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_JSON_parse (j,
+                                    s1,
+                                    NULL,
+                                    NULL));
+  GNUNET_assert (GNUNET_TIME_timestamp_cmp (t1, ==, t2));
   json_decref (j);
 
   a1 = GNUNET_TIME_UNIT_FOREVER_ABS;
-  j = GNUNET_JSON_from_time_abs (a1);
+  j = GNUNET_JSON_from_timestamp (t1);
   GNUNET_assert (NULL != j);
-  GNUNET_assert (GNUNET_OK == GNUNET_JSON_parse (j, s2, NULL, NULL));
-  GNUNET_assert (a1.abs_value_us == a2.abs_value_us);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_JSON_parse (j,
+                                    s2,
+                                    NULL,
+                                    NULL));
+  GNUNET_assert (GNUNET_TIME_timestamp_cmp (t1, ==, t2));
   json_decref (j);
   return 0;
 }
@@ -72,19 +83,21 @@ test_abs_time ()
  * @return 0 on success
  */
 static int
-test_rel_time ()
+test_rel_time (void)
 {
   json_t *j;
   struct GNUNET_TIME_Relative r1;
   struct GNUNET_TIME_Relative r2;
-  struct GNUNET_JSON_Specification s1[] = { GNUNET_JSON_spec_relative_time (
-                                              NULL,
-                                              &r2),
-                                            GNUNET_JSON_spec_end () };
-  struct GNUNET_JSON_Specification s2[] = { GNUNET_JSON_spec_relative_time (
-                                              NULL,
-                                              &r2),
-                                            GNUNET_JSON_spec_end () };
+  struct GNUNET_JSON_Specification s1[] = {
+    GNUNET_JSON_spec_relative_time (NULL,
+                                    &r2),
+    GNUNET_JSON_spec_end ()
+  };
+  struct GNUNET_JSON_Specification s2[] = {
+    GNUNET_JSON_spec_relative_time (NULL,
+                                    &r2),
+    GNUNET_JSON_spec_end ()
+  };
 
   r1 = GNUNET_TIME_UNIT_SECONDS;
   j = GNUNET_JSON_from_time_rel (r1);
@@ -211,7 +224,7 @@ int
 main (int argc, const char *const argv[])
 {
   GNUNET_log_setup ("test-json", "WARNING", NULL);
-  if (0 != test_abs_time ())
+  if (0 != test_timestamp ())
     return 1;
   if (0 != test_rel_time ())
     return 1;
diff --git a/src/messenger/messenger_api.c b/src/messenger/messenger_api.c
index a37b1b10b..6b3ffe638 100644
--- a/src/messenger/messenger_api.c
+++ b/src/messenger/messenger_api.c
@@ -253,7 +253,7 @@ handle_recv_message (void *cls,
         store, context, sender
     );
 
-    handle_room_message (room, contact, &message, hash);
+    contact = handle_room_message (room, contact, &message, hash);
 
     const struct GNUNET_MESSENGER_Message *stored_message = get_room_message(room, hash);
 
diff --git a/src/namestore/gnunet-namestore-fcfsd.c b/src/namestore/gnunet-namestore-fcfsd.c
index 7ec9db156..5b13e50ff 100644
--- a/src/namestore/gnunet-namestore-fcfsd.c
+++ b/src/namestore/gnunet-namestore-fcfsd.c
@@ -789,7 +789,11 @@ create_response (void *cls,
                               "message", _ ("unable to process submitted data"),
                               NULL);
         rd->body_length = strlen (rd->body);
+#ifdef MHD_HTTP_CONTENT_TOO_LARGE
+        rd->code = MHD_HTTP_CONTENT_TOO_LARGE;
+#else
         rd->code = MHD_HTTP_PAYLOAD_TOO_LARGE;
+#endif
         return MHD_YES;
       case GNUNET_JSON_PR_JSON_INVALID:
         rd->body = make_json ("error", "true",
diff --git a/src/nse/gnunet-service-nse.c b/src/nse/gnunet-service-nse.c
index 972b3a79d..56014752d 100644
--- a/src/nse/gnunet-service-nse.c
+++ b/src/nse/gnunet-service-nse.c
@@ -505,12 +505,18 @@ get_matching_bits (struct GNUNET_TIME_Absolute timestamp,
 {
   struct GNUNET_HashCode timestamp_hash;
   struct GNUNET_HashCode pid_hash;
+  struct GNUNET_HashCode xor;
 
   GNUNET_CRYPTO_hash (&timestamp.abs_value_us,
                       sizeof(timestamp.abs_value_us),
                       &timestamp_hash);
-  GNUNET_CRYPTO_hash (id, sizeof(struct GNUNET_PeerIdentity), &pid_hash);
-  return GNUNET_CRYPTO_hash_matching_bits (&timestamp_hash, &pid_hash);
+  GNUNET_CRYPTO_hash (id,
+                      sizeof(struct GNUNET_PeerIdentity),
+                      &pid_hash);
+  GNUNET_CRYPTO_hash_xor (&pid_hash,
+                          &timestamp_hash,
+                          &xor);
+  return GNUNET_CRYPTO_hash_count_leading_zeros (&xor);
 }
 
 
@@ -774,24 +780,6 @@ update_flood_message (void *cls)
 
 
 /**
- * Count the leading zeroes in hash.
- *
- * @param hash to count leading zeros in
- * @return the number of leading zero bits.
- */
-static unsigned int
-count_leading_zeroes (const struct GNUNET_HashCode *hash)
-{
-  unsigned int hash_count;
-
-  hash_count = 0;
-  while (0 == GNUNET_CRYPTO_hash_get_bit_ltr (hash, hash_count))
-    hash_count++;
-  return hash_count;
-}
-
-
-/**
  * Check whether the given public key and integer are a valid proof of
  * work.
  *
@@ -799,7 +787,7 @@ count_leading_zeroes (const struct GNUNET_HashCode *hash)
  * @param val the integer
  * @return #GNUNET_YES if valid, #GNUNET_NO if not
  */
-static int
+static enum GNUNET_GenericReturnValue
 check_proof_of_work (const struct GNUNET_CRYPTO_EddsaPublicKey *pkey,
                      uint64_t val)
 {
@@ -815,8 +803,10 @@ check_proof_of_work (const struct GNUNET_CRYPTO_EddsaPublicKey *pkey,
                           buf,
                           sizeof(buf),
                           &result);
-  return (count_leading_zeroes (&result) >= nse_work_required) ? GNUNET_YES
-         : GNUNET_NO;
+  return (GNUNET_CRYPTO_hash_count_leading_zeros (&result) >=
+          nse_work_required)
+    ? GNUNET_YES
+    : GNUNET_NO;
 }
 
 
@@ -877,7 +867,8 @@ find_proof (void *cls)
                             buf,
                             sizeof(buf),
                             &result);
-    if (nse_work_required <= count_leading_zeroes (&result))
+    if (nse_work_required <=
+        GNUNET_CRYPTO_hash_count_leading_zeros (&result))
     {
       my_proof = counter;
       GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
diff --git a/src/pq/pq_connect.c b/src/pq/pq_connect.c
index a63d5f14e..5fea994ef 100644
--- a/src/pq/pq_connect.c
+++ b/src/pq/pq_connect.c
@@ -122,6 +122,7 @@ GNUNET_PQ_connect2 (const char *config_str,
   GNUNET_PQ_reconnect (db);
   if (NULL == db->conn)
   {
+    GNUNET_CONTAINER_multishortmap_destroy (db->channel_map);
     GNUNET_free (db->load_path);
     GNUNET_free (db->config_str);
     GNUNET_free (db);
diff --git a/src/pq/pq_query_helper.c b/src/pq/pq_query_helper.c
index 78c324512..ce8ce8f87 100644
--- a/src/pq/pq_query_helper.c
+++ b/src/pq/pq_query_helper.c
@@ -70,7 +70,8 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_null (void)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_null, NULL, NULL, 0, 1
+    .conv = &qconv_null,
+    .num_params = 1
   };
 
   return res;
@@ -192,7 +193,10 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_uint16 (const uint16_t *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_uint16, NULL, x, sizeof(*x), 1
+    .conv = &qconv_uint16,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
   };
 
   return res;
@@ -246,7 +250,10 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_uint32 (const uint32_t *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_uint32, NULL, x, sizeof(*x), 1
+    .conv = &qconv_uint32,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
   };
 
   return res;
@@ -300,7 +307,10 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_uint64 (const uint64_t *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_uint64, NULL, x, sizeof(*x), 1
+    .conv = &qconv_uint64,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
   };
 
   return res;
@@ -350,11 +360,13 @@ qconv_rsa_public_key (void *cls,
 
 
 struct GNUNET_PQ_QueryParam
-GNUNET_PQ_query_param_rsa_public_key (const struct
-                                      GNUNET_CRYPTO_RsaPublicKey *x)
+GNUNET_PQ_query_param_rsa_public_key (
+  const struct GNUNET_CRYPTO_RsaPublicKey *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_rsa_public_key, NULL, (x), 0, 1
+    .conv = &qconv_rsa_public_key,
+    .data = x,
+    .num_params = 1
   };
 
   return res;
@@ -407,7 +419,9 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_rsa_signature (const struct GNUNET_CRYPTO_RsaSignature *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_rsa_signature, NULL, (x), 0, 1
+    .conv = &qconv_rsa_signature,
+    .data = x,
+    .num_params = 1
   };
 
   return res;
@@ -463,7 +477,10 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_relative_time (const struct GNUNET_TIME_Relative *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_rel_time, NULL, x, sizeof(*x), 1
+    .conv = &qconv_rel_time,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
   };
 
   return res;
@@ -519,7 +536,10 @@ struct GNUNET_PQ_QueryParam
 GNUNET_PQ_query_param_absolute_time (const struct GNUNET_TIME_Absolute *x)
 {
   struct GNUNET_PQ_QueryParam res = {
-    &qconv_abs_time, NULL, x, sizeof(*x), 1
+    .conv = &qconv_abs_time,
+    .data = x,
+    .size = sizeof(*x),
+    .num_params = 1
   };
 
   return res;
@@ -534,4 +554,19 @@ GNUNET_PQ_query_param_absolute_time_nbo (
 }
 
 
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp (const struct GNUNET_TIME_Timestamp *x)
+{
+  return GNUNET_PQ_query_param_absolute_time (&x->abs_time);
+}
+
+
+struct GNUNET_PQ_QueryParam
+GNUNET_PQ_query_param_timestamp_nbo (
+  const struct GNUNET_TIME_TimestampNBO *x)
+{
+  return GNUNET_PQ_query_param_absolute_time_nbo (&x->abs_time_nbo);
+}
+
+
 /* end of pq_query_helper.c */
diff --git a/src/pq/pq_result_helper.c b/src/pq/pq_result_helper.c
index 4057772ec..2c11f5202 100644
--- a/src/pq/pq_result_helper.c
+++ b/src/pq/pq_result_helper.c
@@ -757,6 +757,148 @@ GNUNET_PQ_result_spec_absolute_time_nbo (const char *name,
  *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
  */
 static enum GNUNET_GenericReturnValue
+extract_timestamp (void *cls,
+                   PGresult *result,
+                   int row,
+                   const char *fname,
+                   size_t *dst_size,
+                   void *dst)
+{
+  struct GNUNET_TIME_Timestamp *udst = dst;
+  struct GNUNET_TIME_Absolute abs;
+  const int64_t *res;
+  int fnum;
+
+  (void) cls;
+  fnum = PQfnumber (result,
+                    fname);
+  if (fnum < 0)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (PQgetisnull (result,
+                   row,
+                   fnum))
+    return GNUNET_NO;
+  GNUNET_assert (NULL != dst);
+  if (sizeof(struct GNUNET_TIME_Absolute) != *dst_size)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (sizeof(int64_t) !=
+      PQgetlength (result,
+                   row,
+                   fnum))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  res = (int64_t *) PQgetvalue (result,
+                                row,
+                                fnum);
+  if (INT64_MAX == GNUNET_ntohll ((uint64_t) *res))
+  {
+    abs = GNUNET_TIME_UNIT_FOREVER_ABS;
+  }
+  else
+  {
+    abs.abs_value_us = GNUNET_ntohll ((uint64_t) *res);
+    if (0 != abs.abs_value_us % GNUNET_TIME_UNIT_SECONDS.rel_value_us)
+    {
+      /* timestamps must be multiple of seconds! */
+      GNUNET_break (0);
+      return GNUNET_SYSERR;
+    }
+  }
+  udst->abs_time = abs;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp (const char *name,
+                                 struct GNUNET_TIME_Timestamp *at)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_timestamp,
+    .dst = (void *) at,
+    .dst_size = sizeof(*at),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param int row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
+extract_timestamp_nbo (void *cls,
+                       PGresult *result,
+                       int row,
+                       const char *fname,
+                       size_t *dst_size,
+                       void *dst)
+{
+  struct GNUNET_TIME_TimestampNBO *udst = dst;
+  struct GNUNET_TIME_Timestamp t;
+  enum GNUNET_GenericReturnValue r;
+
+  r = extract_timestamp (NULL,
+                         result,
+                         row,
+                         fname,
+                         dst_size,
+                         &t);
+  if (GNUNET_OK != r)
+    return r;
+  *udst = GNUNET_TIME_timestamp_hton (t);
+  return r;
+}
+
+
+struct GNUNET_PQ_ResultSpec
+GNUNET_PQ_result_spec_timestamp_nbo (const char *name,
+                                     struct GNUNET_TIME_TimestampNBO *at)
+{
+  struct GNUNET_PQ_ResultSpec res = {
+    .conv = &extract_timestamp_nbo,
+    .dst = (void *) at,
+    .dst_size = sizeof(*at),
+    .fname = name
+  };
+
+  return res;
+}
+
+
+/**
+ * Extract data from a Postgres database @a result at row @a row.
+ *
+ * @param cls closure
+ * @param result where to extract data from
+ * @param int row to extract data from
+ * @param fname name (or prefix) of the fields to extract from
+ * @param[in,out] dst_size where to store size of result, may be NULL
+ * @param[out] dst where to store the result
+ * @return
+ *   #GNUNET_YES if all results could be extracted
+ *   #GNUNET_SYSERR if a result was invalid (non-existing field or NULL)
+ */
+static enum GNUNET_GenericReturnValue
 extract_uint16 (void *cls,
                 PGresult *result,
                 int row,
diff --git a/src/regex/plugin_block_regex.c b/src/regex/plugin_block_regex.c
index ad897493f..0953830ab 100644
--- a/src/regex/plugin_block_regex.c
+++ b/src/regex/plugin_block_regex.c
@@ -329,6 +329,222 @@ block_plugin_regex_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_regex_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (0 != xquery_size)
+    {
+      const char *s;
+
+      s = (const char *) xquery;
+      if ('\0' != s[xquery_size - 1])     /* must be valid 0-terminated string */
+      {
+        GNUNET_break_op (0);
+        return GNUNET_NO;
+      }
+    }
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    if (0 != xquery_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_regex_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (GNUNET_SYSERR ==
+        REGEX_BLOCK_check (block,
+                           block_size,
+                           query,
+                           NULL))
+      return GNUNET_NO;
+    return GNUNET_OK;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    {
+    const struct RegexAcceptBlock *rba;
+    
+    if (sizeof(struct RegexAcceptBlock) != block_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    rba = block;
+    if (ntohl (rba->purpose.size) !=
+        sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+        + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+        + sizeof(struct GNUNET_HashCode))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    if (GNUNET_TIME_absolute_is_past (GNUNET_TIME_absolute_ntoh (
+                                                                 rba->expiration_time)))
+    {
+      return GNUNET_NO;
+    }
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_eddsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REGEX_ACCEPT,
+                                     &rba->purpose,
+                                     &rba->signature,
+                                     &rba->peer.public_key))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_OK;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_regex_check_reply (
+                                void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                struct GNUNET_BLOCK_Group *group,
+                                const struct GNUNET_HashCode *query,
+                                const void *xquery,
+                                size_t xquery_size,
+                                const void *reply_block,
+                                size_t reply_block_size)
+{
+  struct GNUNET_HashCode chash;
+
+  switch (type)
+  {
+  case GNUNET_BLOCK_TYPE_REGEX:
+    if (0 != xquery_size)
+    {
+      const char *s;
+      
+      s = (const char *) xquery;
+      if ('\0' != s[xquery_size - 1])   /* must be valid 0-terminated string */
+      {
+        /* Technically, the query is invalid ... */
+        GNUNET_break (0);
+        return GNUNET_BLOCK_REPLY_INVALID;
+      }
+    }
+    switch (REGEX_BLOCK_check (reply_block,
+                               reply_block_size,
+                               query,
+                               xquery))
+    {
+    case GNUNET_SYSERR:
+      GNUNET_break_op (0);
+      return GNUNET_BLOCK_REPLY_INVALID;
+    case GNUNET_NO:
+      /* xquery mismatch, can happen */
+      return GNUNET_BLOCK_REPLY_IRRELEVANT;
+    default:
+      break;
+    }
+    GNUNET_CRYPTO_hash (reply_block,
+                        reply_block_size,
+                        &chash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                            &chash))
+      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
+    {
+    const struct RegexAcceptBlock *rba;
+
+    if (sizeof(struct RegexAcceptBlock) != reply_block_size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_BLOCK_REPLY_INVALID;
+    }
+    rba = reply_block;
+    if (ntohl (rba->purpose.size) !=
+        sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+        + sizeof(struct GNUNET_TIME_AbsoluteNBO)
+        + sizeof(struct GNUNET_HashCode))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_BLOCK_REPLY_INVALID;
+    }
+    GNUNET_CRYPTO_hash (reply_block,
+                        reply_block_size,
+                        &chash);
+    if (GNUNET_YES ==
+        GNUNET_BLOCK_GROUP_bf_test_and_set (group,
+                                            &chash))
+      return GNUNET_BLOCK_REPLY_OK_DUPLICATE;
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+    }
+  default:
+    GNUNET_break (0);
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  }
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -339,7 +555,7 @@ block_plugin_regex_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_regex_get_key (void *cls,
                             enum GNUNET_BLOCK_Type type,
                             const void *block,
@@ -350,14 +566,14 @@ block_plugin_regex_get_key (void *cls,
   {
   case GNUNET_BLOCK_TYPE_REGEX:
     if (GNUNET_OK !=
-        REGEX_BLOCK_get_key (block, block_size,
+        REGEX_BLOCK_get_key (block,
+                             block_size,
                              key))
     {
       GNUNET_break_op (0);
       return GNUNET_NO;
     }
     return GNUNET_OK;
-
   case GNUNET_BLOCK_TYPE_REGEX_ACCEPT:
     if (sizeof(struct RegexAcceptBlock) != block_size)
     {
@@ -366,7 +582,6 @@ block_plugin_regex_get_key (void *cls,
     }
     *key = ((struct RegexAcceptBlock *) block)->key;
     return GNUNET_OK;
-
   default:
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -380,7 +595,7 @@ block_plugin_regex_get_key (void *cls,
 void *
 libgnunet_plugin_block_regex_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_REGEX,
     GNUNET_BLOCK_TYPE_REGEX_ACCEPT,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
@@ -390,6 +605,9 @@ libgnunet_plugin_block_regex_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_regex_evaluate;
   api->get_key = &block_plugin_regex_get_key;
+  api->check_query = &block_plugin_regex_check_query;
+  api->check_block = &block_plugin_regex_check_block;
+  api->check_reply = &block_plugin_regex_check_reply;
   api->create_group = &block_plugin_regex_create_group;
   api->types = types;
   return api;
diff --git a/src/revocation/gnunet-service-revocation.c b/src/revocation/gnunet-service-revocation.c
index 5fe0ade98..4494ade83 100644
--- a/src/revocation/gnunet-service-revocation.c
+++ b/src/revocation/gnunet-service-revocation.c
@@ -169,14 +169,16 @@ new_peer_entry (const struct GNUNET_PeerIdentity *peer)
  * @return #GNUNET_YES if the message is verified
  *         #GNUNET_NO if the key/signature don't verify
  */
-static int
+static enum GNUNET_GenericReturnValue
 verify_revoke_message (const struct RevokeMessage *rm)
 {
-  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
-                                                 (unsigned
-                                                  int) revocation_work_required,
-                                                 epoch_duration))
+  const struct GNUNET_REVOCATION_PowP *pow
+    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+
+  if (GNUNET_YES !=
+      GNUNET_REVOCATION_check_pow (pow,
+                                   (unsigned int) revocation_work_required,
+                                   epoch_duration))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Proof of work invalid!\n");
@@ -263,7 +265,7 @@ handle_query_message (void *cls,
  * @param value our `struct PeerEntry` for the neighbour
  * @return #GNUNET_OK (continue to iterate)
  */
-static int
+static enum GNUNET_GenericReturnValue
 do_flood (void *cls,
           const struct GNUNET_PeerIdentity *target,
           void *value)
@@ -278,10 +280,12 @@ do_flood (void *cls,
                          but we have no direct CORE
                          connection for flooding */
   e = GNUNET_MQ_msg_extra (cp,
-                     htonl (rm->pow_size),
-                     GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
+                           htonl (rm->pow_size),
+                           GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
   *cp = *rm;
-  memcpy (&cp[1], &rm[1], htonl (rm->pow_size));
+  memcpy (&cp[1],
+          &rm[1],
+          htonl (rm->pow_size));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Flooding revocation to `%s'\n",
               GNUNET_i2s (target));
@@ -300,17 +304,18 @@ do_flood (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_NO if we encountered an error,
  *         #GNUNET_SYSERR if the message was malformed
  */
-static int
+static enum GNUNET_GenericReturnValue
 publicize_rm (const struct RevokeMessage *rm)
 {
   struct RevokeMessage *cp;
   struct GNUNET_HashCode hc;
   struct GNUNET_SETU_Element e;
   ssize_t pklen;
-  const struct GNUNET_IDENTITY_PublicKey *pk;
+  const struct GNUNET_REVOCATION_PowP *pow
+    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+  const struct GNUNET_IDENTITY_PublicKey *pk
+    = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
 
-  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
-  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
   pklen = GNUNET_IDENTITY_key_get_length (pk);
   if (0 > pklen)
   {
diff --git a/src/revocation/plugin_block_revocation.c b/src/revocation/plugin_block_revocation.c
index da5882d59..3beae60bb 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -34,19 +34,6 @@
 #define DEBUG_REVOCATION GNUNET_EXTRA_LOGGING
 
 /**
- * Number of bits we set per entry in the bloomfilter.
- * Do not change!
- */
-#define BLOOMFILTER_K 16
-
-
-/**
- * How big is the BF we use for DHT blocks?
- */
-#define REVOCATION_BF_SIZE 8
-
-
-/**
  * Context used inside the plugin.
  */
 struct InternalContext
@@ -57,54 +44,6 @@ struct InternalContext
 
 
 /**
- * Create a new block group.
- *
- * @param ctx block context in which the block group is created
- * @param type type of the block for which we are creating the group
- * @param nonce random value used to seed the group creation
- * @param raw_data optional serialized prior state of the group, NULL if unavailable/fresh
- * @param raw_data_size number of bytes in @a raw_data, 0 if unavailable/fresh
- * @param va variable arguments specific to @a type
- * @return block group handle, NULL if block groups are not supported
- *         by this @a type of block (this is not an error)
- */
-static struct GNUNET_BLOCK_Group *
-block_plugin_revocation_create_group (void *cls,
-                                      enum GNUNET_BLOCK_Type type,
-                                      uint32_t nonce,
-                                      const void *raw_data,
-                                      size_t raw_data_size,
-                                      va_list va)
-{
-  unsigned int bf_size;
-  const char *guard;
-
-  guard = va_arg (va, const char *);
-  if (0 == strcmp (guard,
-                   "seen-set-size"))
-    bf_size = GNUNET_BLOCK_GROUP_compute_bloomfilter_size (va_arg (va, unsigned
-                                                                   int),
-                                                           BLOOMFILTER_K);
-  else if (0 == strcmp (guard,
-                        "filter-size"))
-    bf_size = va_arg (va, unsigned int);
-  else
-  {
-    GNUNET_break (0);
-    bf_size = REVOCATION_BF_SIZE;
-  }
-  GNUNET_break (NULL == va_arg (va, const char *));
-  return GNUNET_BLOCK_GROUP_bf_create (cls,
-                                       bf_size,
-                                       BLOOMFILTER_K,
-                                       type,
-                                       nonce,
-                                       raw_data,
-                                       raw_data_size);
-}
-
-
-/**
  * Function called to validate a reply or a request.  For
  * request evaluation, simply pass "NULL" for the reply_block.
  *
@@ -133,7 +72,6 @@ block_plugin_revocation_evaluate (void *cls,
                                   size_t reply_block_size)
 {
   struct InternalContext *ic = cls;
-  struct GNUNET_HashCode chash;
   ssize_t pklen;
   const struct RevokeMessage *rm = reply_block;
 
@@ -160,14 +98,134 @@ block_plugin_revocation_evaluate (void *cls,
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
-  GNUNET_CRYPTO_hash (pk,
-                      pklen,
-                      &chash);
-  if (GNUNET_YES ==
-      GNUNET_BLOCK_GROUP_bf_test_and_set (group,
-                                          &chash))
-    return GNUNET_BLOCK_EVALUATION_OK_DUPLICATE;
-  return GNUNET_BLOCK_EVALUATION_TYPE_NOT_SUPPORTED;
+  return GNUNET_BLOCK_EVALUATION_OK_LAST;
+}
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_revocation_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  (void) cls;
+  (void) query;
+  (void) xquery;
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+    return GNUNET_SYSERR;
+  if (0 != xquery_size)
+    return GNUNET_NO;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_revocation_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  struct InternalContext *ic = cls;
+  const struct RevokeMessage *rm = block;
+  const struct GNUNET_REVOCATION_PowP *pow
+    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+  struct GNUNET_IDENTITY_PublicKey pk;
+  ssize_t pklen;
+  size_t left;
+
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+    return GNUNET_SYSERR;
+  if (block_size < sizeof(*rm) + sizeof(*pow))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (block_size != sizeof(*rm) + ntohl (rm->pow_size))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  left = block_size - sizeof (*rm) - sizeof (*pow);
+  pklen = GNUNET_IDENTITY_read_key_from_buffer (&pk,
+                                                &pow[1],
+                                                left);
+  if (0 > pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if (GNUNET_YES !=
+      GNUNET_REVOCATION_check_pow (pow,
+                                   ic->matching_bits,
+                                   ic->epoch_duration))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_revocation_check_reply (
+                                     void *cls,
+                                     enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  (void) cls;
+  (void) group;
+  (void) query;
+  (void) xquery;
+  (void) xquery_size;
+  (void) reply_block;
+  (void) reply_block_size;
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+    return GNUNET_BLOCK_REPLY_TYPE_NOT_SUPPORTED;
+  return GNUNET_BLOCK_REPLY_OK_LAST;
 }
 
 
@@ -182,7 +240,7 @@ block_plugin_revocation_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_revocation_get_key (void *cls,
                                  enum GNUNET_BLOCK_Type type,
                                  const void *block,
@@ -190,24 +248,35 @@ block_plugin_revocation_get_key (void *cls,
                                  struct GNUNET_HashCode *key)
 {
   const struct RevokeMessage *rm = block;
-  ssize_t ksize;
+  const struct GNUNET_REVOCATION_PowP *pow
+    = (const struct GNUNET_REVOCATION_PowP *) &rm[1];
+  struct GNUNET_IDENTITY_PublicKey pk;
+  ssize_t pklen;
+  size_t left;
 
-  if (block_size <= sizeof(*rm))
+  if (GNUNET_BLOCK_TYPE_REVOCATION != type)
+    return GNUNET_SYSERR;
+  if (block_size < sizeof(*rm) + sizeof(*pow))
   {
     GNUNET_break_op (0);
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
   }
-  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
-  const struct GNUNET_IDENTITY_PublicKey *pk;
-  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
-  ksize = GNUNET_IDENTITY_key_get_length (pk);
-  if (0 > ksize)
+  if (block_size != sizeof(*rm) + ntohl (rm->pow_size))
   {
     GNUNET_break_op (0);
-    return GNUNET_SYSERR;
+    return GNUNET_NO;
   }
-  GNUNET_CRYPTO_hash (pk,
-                      ksize,
+  left = block_size - sizeof (*rm) - sizeof (*pow);
+  pklen = GNUNET_IDENTITY_read_key_from_buffer (&pk,
+                                                &pow[1],
+                                                left);
+  if (0 > pklen)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  GNUNET_CRYPTO_hash (&pow[1],
+                      pklen,
                       key);
   return GNUNET_OK;
 }
@@ -221,8 +290,8 @@ block_plugin_revocation_get_key (void *cls,
 void *
 libgnunet_plugin_block_revocation_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
-    GNUNET_BLOCK_TYPE_REVOCATION,
+  static const enum GNUNET_BLOCK_Type types[] = {
+                                                 GNUNET_BLOCK_TYPE_REVOCATION,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
   const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
@@ -247,7 +316,10 @@ libgnunet_plugin_block_revocation_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_revocation_evaluate;
   api->get_key = &block_plugin_revocation_get_key;
-  api->create_group = &block_plugin_revocation_create_group;
+  api->check_query = &block_plugin_revocation_check_query;
+  api->check_block = &block_plugin_revocation_check_block;
+  api->check_reply = &block_plugin_revocation_check_reply;
+  api->create_group = NULL;
   api->types = types;
   ic = GNUNET_new (struct InternalContext);
   ic->matching_bits = (unsigned int) matching_bits;
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index f2b95bafa..d5bd53e56 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -53,7 +53,7 @@ struct GNUNET_REVOCATION_Query
 
 /**
  * Helper struct that holds a found pow nonce
- * and the corresponding number of leading zeroes.
+ * and the corresponding number of leading zeros.
  */
 struct BestPow
 {
@@ -389,27 +389,10 @@ GNUNET_REVOCATION_revoke_cancel (struct GNUNET_REVOCATION_Handle *h)
 
 
 /**
- * Count the leading zeroes in hash.
- *
- * @param hash to count leading zeros in
- * @return the number of leading zero bits.
- */
-static unsigned int
-count_leading_zeroes (const struct GNUNET_HashCode *hash)
-{
-  unsigned int hash_count;
-  hash_count = 0;
-  while ((0 == GNUNET_CRYPTO_hash_get_bit_ltr (hash, hash_count)))
-    hash_count++;
-  return hash_count;
-}
-
-
-/**
  * Calculate the average zeros in the pows.
  *
  * @param ph the PowHandle
- * @return the average number of zeroes.
+ * @return the average number of zeros.
  */
 static unsigned int
 calculate_score (const struct GNUNET_REVOCATION_PowCalculationHandle *ph)
@@ -535,7 +518,7 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
                             buf,
                             sizeof(buf),
                             &result);
-    tmp_score = count_leading_zeroes (&result);
+    tmp_score = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                 "Score %u with %" PRIu64 " (#%u)\n",
                 tmp_score, pow_val, i);
@@ -732,7 +715,7 @@ GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
                           buf,
                           sizeof(buf),
                           &result);
-  zeros = count_leading_zeroes (&result);
+  zeros = GNUNET_CRYPTO_hash_count_leading_zeros (&result);
   for (unsigned int i = 0; i < POW_COUNT; i++)
   {
     if (pc->best[i].bits < zeros)
diff --git a/src/set/plugin_block_set_test.c b/src/set/plugin_block_set_test.c
index 1de086092..3d66831bb 100644
--- a/src/set/plugin_block_set_test.c
+++ b/src/set/plugin_block_set_test.c
@@ -66,6 +66,87 @@ block_plugin_set_test_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_set_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_set_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if ((NULL == block) ||
+      (0 == block_size) ||
+      (0 != ((char *) block)[0]))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_set_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  if ((NULL == reply_block) ||
+      (0 == reply_block_size) ||
+      (0 != ((char *) reply_block)[0]))
+    return GNUNET_BLOCK_REPLY_INVALID;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -76,7 +157,7 @@ block_plugin_set_test_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_set_test_get_key (void *cls,
                                enum GNUNET_BLOCK_Type type,
                                const void *block,
@@ -93,7 +174,7 @@ block_plugin_set_test_get_key (void *cls,
 void *
 libgnunet_plugin_block_set_test_init (void *cls)
 {
-  static enum GNUNET_BLOCK_Type types[] = {
+  static const enum GNUNET_BLOCK_Type types[] = {
     GNUNET_BLOCK_TYPE_SET_TEST,
     GNUNET_BLOCK_TYPE_ANY       /* end of list */
   };
@@ -102,6 +183,9 @@ libgnunet_plugin_block_set_test_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_set_test_evaluate;
   api->get_key = &block_plugin_set_test_get_key;
+  api->check_query = &block_plugin_set_test_check_query;
+  api->check_block = &block_plugin_set_test_check_block;
+  api->check_reply = &block_plugin_set_test_check_reply;
   api->types = types;
   return api;
 }
diff --git a/src/seti/plugin_block_seti_test.c b/src/seti/plugin_block_seti_test.c
index 55cf31bea..af86e1af6 100644
--- a/src/seti/plugin_block_seti_test.c
+++ b/src/seti/plugin_block_seti_test.c
@@ -66,6 +66,87 @@ block_plugin_seti_test_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_seti_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_seti_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if ((NULL == block) ||
+      (0 == block_size) ||
+      (0 != ((char *) block)[0]))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_seti_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  if ( (NULL == reply_block) ||
+       (0 == reply_block_size) ||
+       (0 != ((char *) reply_block)[0]) )
+    return GNUNET_BLOCK_REPLY_INVALID;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -76,7 +157,7 @@ block_plugin_seti_test_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_seti_test_get_key (void *cls,
                                 enum GNUNET_BLOCK_Type type,
                                 const void *block,
@@ -102,6 +183,9 @@ libgnunet_plugin_block_seti_test_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_seti_test_evaluate;
   api->get_key = &block_plugin_seti_test_get_key;
+  api->check_query = &block_plugin_seti_test_check_query;
+  api->check_block = &block_plugin_seti_test_check_block;
+  api->check_reply = &block_plugin_seti_test_check_reply;
   api->types = types;
   return api;
 }
diff --git a/src/setu/plugin_block_setu_test.c b/src/setu/plugin_block_setu_test.c
index fd0c8a680..9872bba39 100644
--- a/src/setu/plugin_block_setu_test.c
+++ b/src/setu/plugin_block_setu_test.c
@@ -66,6 +66,87 @@ block_plugin_setu_test_evaluate (void *cls,
 
 
 /**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param ctx block context
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_setu_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query key for the block (hash), must match exactly
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_setu_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if ( (NULL == block) ||
+       (0 == block_size) ||
+       (0 != ((char *) block)[0]) )
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_setu_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  if ( (NULL == reply_block) ||
+       (0 == reply_block_size) ||
+       (0 != ((char *) reply_block)[0]) )
+    return GNUNET_BLOCK_REPLY_INVALID;
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
  * Function called to obtain the key for a block.
  *
  * @param cls closure
@@ -76,7 +157,7 @@ block_plugin_setu_test_evaluate (void *cls,
  * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
  *         (or if extracting a key from a block of this type does not work)
  */
-static int
+static enum GNUNET_GenericReturnValue
 block_plugin_setu_test_get_key (void *cls,
                                 enum GNUNET_BLOCK_Type type,
                                 const void *block,
@@ -102,6 +183,9 @@ libgnunet_plugin_block_setu_test_init (void *cls)
   api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
   api->evaluate = &block_plugin_setu_test_evaluate;
   api->get_key = &block_plugin_setu_test_get_key;
+  api->check_query = &block_plugin_setu_test_check_query;
+  api->check_block = &block_plugin_setu_test_check_block;
+  api->check_reply = &block_plugin_setu_test_check_reply;
   api->types = types;
   return api;
 }
diff --git a/src/transport/gnunet-communicator-tcp.c b/src/transport/gnunet-communicator-tcp.c
index 2a5e33e2b..3bfdeaa90 100644
--- a/src/transport/gnunet-communicator-tcp.c
+++ b/src/transport/gnunet-communicator-tcp.c
@@ -115,7 +115,7 @@ GNUNET_NETWORK_STRUCT_BEGIN
 struct TcpHandshakeSignature
 {
   /**
-   * Purpose must be #GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE
    */
   struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
@@ -153,7 +153,7 @@ struct TcpHandshakeSignature
 struct TcpHandshakeAckSignature
 {
   /**
-   * Purpose must be #GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK
    */
   struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
@@ -190,7 +190,7 @@ struct TCPConfirmation
   struct GNUNET_PeerIdentity sender;
 
   /**
-   * Sender's signature of type #GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE
+   * Sender's signature of type #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE
    */
   struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
@@ -225,7 +225,7 @@ struct TCPConfirmationAck
   struct GNUNET_PeerIdentity sender;
 
   /**
-   * Sender's signature of type #GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK
+   * Sender's signature of type #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK
    */
   struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
@@ -297,7 +297,7 @@ struct TCPRekey
   struct GNUNET_CRYPTO_EcdhePublicKey ephemeral;
 
   /**
-   * Sender's signature of type #GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY
+   * Sender's signature of type #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY
    */
   struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
@@ -315,7 +315,7 @@ struct TCPRekey
 struct TcpRekeySignature
 {
   /**
-   * Purpose must be #GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY
    */
   struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
@@ -1313,7 +1313,7 @@ do_rekey (struct Queue *queue, const struct TCPRekey *rekey)
 {
   struct TcpRekeySignature thp;
 
-  thp.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY);
+  thp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY);
   thp.purpose.size = htonl (sizeof(thp));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "do_rekey size %u\n",
@@ -1340,7 +1340,7 @@ do_rekey (struct Queue *queue, const struct TCPRekey *rekey)
                 GNUNET_TIME_absolute_ntoh (thp.monotonic_time)));
   GNUNET_assert (ntohl ((&thp)->purpose.size) == sizeof (*(&thp)));
   if (GNUNET_OK !=
-      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY,
+      GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY,
                                   &thp,
                                   &rekey->sender_sig,
                                   &queue->target.public_key))
@@ -1464,7 +1464,7 @@ send_challenge (struct ChallengeNonceP challenge, struct Queue *queue)
   tca.monotonic_time =
     GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get_monotonic (cfg));
   thas.purpose.purpose = htonl (
-    GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK);
+    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK);
   thas.purpose.size = htonl (sizeof(thas));
   thas.sender = my_identity;
   thas.receiver = queue->target;
@@ -1527,7 +1527,7 @@ inject_rekey (struct Queue *queue)
   GNUNET_CRYPTO_ecdhe_key_get_public (&queue->ephemeral, &rekey.ephemeral);
   rekey.monotonic_time =
     GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get_monotonic (cfg));
-  thp.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_TCP_REKEY);
+  thp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_REKEY);
   thp.purpose.size = htonl (sizeof(thp));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "inject_rekey size %u\n",
@@ -1725,7 +1725,7 @@ try_handle_plaintext (struct Queue *queue)
     }
 
     thas.purpose.purpose = htonl (
-      GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK);
+      GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK);
     thas.purpose.size = htonl (sizeof(thas));
     thas.sender = tca->sender;
     thas.receiver = my_identity;
@@ -1733,7 +1733,7 @@ try_handle_plaintext (struct Queue *queue)
     thas.challenge = tca->challenge;
 
     if (GNUNET_SYSERR == GNUNET_CRYPTO_eddsa_verify (
-          GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE_ACK,
+          GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE_ACK,
           &thas,
           &tca->sender_sig,
           &tca->sender.public_key))
@@ -2472,7 +2472,7 @@ transmit_kx (struct Queue *queue,
   GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_NONCE,
                               &tc.challenge,
                               sizeof(tc.challenge));
-  ths.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE);
+  ths.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE);
   ths.purpose.size = htonl (sizeof(ths));
   ths.sender = my_identity;
   ths.receiver = queue->target;
@@ -2625,7 +2625,7 @@ decrypt_and_check_tc (struct Queue *queue,
                          sizeof(*tc),
                          &ibuf[sizeof(struct GNUNET_CRYPTO_EcdhePublicKey)],
                          sizeof(*tc)));
-  ths.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE);
+  ths.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE);
   ths.purpose.size = htonl (sizeof(ths));
   ths.sender = tc->sender;
   ths.receiver = my_identity;
@@ -2633,7 +2633,7 @@ decrypt_and_check_tc (struct Queue *queue,
   ths.monotonic_time = tc->monotonic_time;
   ths.challenge = tc->challenge;
   ret = GNUNET_CRYPTO_eddsa_verify (
-    GNUNET_SIGNATURE_COMMUNICATOR_TCP_HANDSHAKE,
+    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_TCP_HANDSHAKE,
     &ths,
     &tc->sender_sig,
     &tc->sender.public_key);
diff --git a/src/transport/gnunet-communicator-udp.c b/src/transport/gnunet-communicator-udp.c
index 201e94e80..b6edff485 100644
--- a/src/transport/gnunet-communicator-udp.c
+++ b/src/transport/gnunet-communicator-udp.c
@@ -164,7 +164,7 @@ GNUNET_NETWORK_STRUCT_BEGIN
 struct UdpHandshakeSignature
 {
   /**
-   * Purpose must be #GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE
    */
   struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
@@ -227,7 +227,7 @@ struct UDPConfirmation
   struct GNUNET_PeerIdentity sender;
 
   /**
-   * Sender's signature of type #GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE
+   * Sender's signature of type #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE
    */
   struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 
@@ -284,7 +284,7 @@ struct UDPAck
 struct UdpBroadcastSignature
 {
   /**
-   * Purpose must be #GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST
+   * Purpose must be #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST
    */
   struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
 
@@ -315,7 +315,7 @@ struct UDPBroadcast
 
   /**
    * Sender's signature of type
-   * #GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST
+   * #GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST
    */
   struct GNUNET_CRYPTO_EddsaSignature sender_sig;
 };
@@ -2202,14 +2202,14 @@ verify_confirmation (const struct GNUNET_CRYPTO_EcdhePublicKey *ephemeral,
 {
   struct UdpHandshakeSignature uhs;
 
-  uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE);
+  uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE);
   uhs.purpose.size = htonl (sizeof(uhs));
   uhs.sender = uc->sender;
   uhs.receiver = my_identity;
   uhs.ephemeral = *ephemeral;
   uhs.monotonic_time = uc->monotonic_time;
   return GNUNET_CRYPTO_eddsa_verify (
-    GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE,
+    GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE,
     &uhs,
     &uc->sender_sig,
     &uc->sender.public_key);
@@ -2350,7 +2350,7 @@ sock_read (void *cls)
                 "received UDPBroadcast from %s\n",
                 GNUNET_a2s ((const struct sockaddr *) addr_verify, salen));
     ub = (const struct UDPBroadcast *) buf;
-    uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST);
+    uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST);
     uhs.purpose.size = htonl (sizeof(uhs));
     uhs.sender = ub->sender;
     sender = ub->sender;
@@ -2366,7 +2366,7 @@ sock_read (void *cls)
                 GNUNET_i2s (&sender));
     GNUNET_CRYPTO_hash ((struct sockaddr *) addr_verify, salen, &uhs.h_address);
     if (GNUNET_OK ==
-        GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST,
+        GNUNET_CRYPTO_eddsa_verify (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST,
                                     &uhs,
                                     &ub->sender_sig,
                                     &ub->sender.public_key))
@@ -2699,7 +2699,7 @@ mq_send_kx (struct GNUNET_MQ_Handle *mq,
   uc.sender = my_identity;
   uc.monotonic_time =
     GNUNET_TIME_absolute_hton (GNUNET_TIME_absolute_get_monotonic (cfg));
-  uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_UDP_HANDSHAKE);
+  uhs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_HANDSHAKE);
   uhs.purpose.size = htonl (sizeof(uhs));
   uhs.sender = my_identity;
   uhs.receiver = receiver->target;
@@ -3644,7 +3644,7 @@ iface_proc (void *cls,
   bi->salen = addrlen;
   bi->found = GNUNET_YES;
   bi->bcm.sender = my_identity;
-  ubs.purpose.purpose = htonl (GNUNET_SIGNATURE_COMMUNICATOR_UDP_BROADCAST);
+  ubs.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_COMMUNICATOR_UDP_BROADCAST);
   ubs.purpose.size = htonl (sizeof(ubs));
   ubs.sender = my_identity;
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
diff --git a/src/util/Makefile.am b/src/util/Makefile.am
index 9fda40f51..406d42b1e 100644
--- a/src/util/Makefile.am
+++ b/src/util/Makefile.am
@@ -144,7 +144,7 @@ libgnunetutil_la_LIBADD = \
 
 libgnunetutil_la_LDFLAGS = \
   $(GN_LIB_LDFLAGS) \
-  -version-info 14:0:0
+  -version-info 15:0:0
 
 GNUNET_ECC = gnunet-ecc
 GNUNET_SCRYPT = gnunet-scrypt
diff --git a/src/util/crypto_cs.c b/src/util/crypto_cs.c
index 5c441b669..c89ba5d83 100644
--- a/src/util/crypto_cs.c
+++ b/src/util/crypto_cs.c
@@ -147,8 +147,8 @@ GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
  * @param[out] bs array containing the two derived blinding secrets
  */
 void
-GNUNET_CRYPTO_cs_blinding_secrets_derive (const void *secret,
-                                          size_t secret_len,
+GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct
+                                          GNUNET_CRYPTO_CsNonce *blind_seed,
                                           struct GNUNET_CRYPTO_CsBlindingSecret
                                           bs[2])
 {
@@ -161,8 +161,8 @@ GNUNET_CRYPTO_cs_blinding_secrets_derive (const void *secret,
                                      GCRY_MD_SHA256,
                                      "alphabeta",
                                      strlen ("alphabeta"),
-                                     secret,
-                                     secret_len,
+                                     blind_seed,
+                                     sizeof(*blind_seed),
                                      NULL,
                                      0));
   map_to_scalar_subgroup (&bs[0].alpha);
diff --git a/src/util/crypto_ecc_setup.c b/src/util/crypto_ecc_setup.c
index f7cd8c6d9..21ce48eef 100644
--- a/src/util/crypto_ecc_setup.c
+++ b/src/util/crypto_ecc_setup.c
@@ -134,8 +134,10 @@ read_from_file (const char *filename,
  * @param filename name of file to use to store the key
  * @param do_create should a file be created?
  * @param[out] pkey set to the private key from @a filename on success
- * @return #GNUNET_OK on success, #GNUNET_NO if @a do_create was set but
- *         we found an existing file, #GNUNET_SYSERR on failure
+ * @return - #GNUNET_OK on success,
+ *  - #GNUNET_NO if @a do_create was set but we found an existing file,
+ *  - #GNUNET_SYSERR on failure _or_ if the file didn't exist and @a
+ *    do_create was not set
  */
 enum GNUNET_GenericReturnValue
 GNUNET_CRYPTO_eddsa_key_from_file (const char *filename,
@@ -152,6 +154,11 @@ GNUNET_CRYPTO_eddsa_key_from_file (const char *filename,
     /* file existed, report that we didn't create it... */
     return (do_create) ? GNUNET_NO : GNUNET_OK;
   }
+  else if (! do_create)
+  {
+    return GNUNET_SYSERR;
+  }
+
   GNUNET_CRYPTO_eddsa_key_create (pkey);
   ret = GNUNET_DISK_fn_write (filename,
                               pkey,
diff --git a/src/util/crypto_hash.c b/src/util/crypto_hash.c
index d62ec8012..dcd46e5f9 100644
--- a/src/util/crypto_hash.c
+++ b/src/util/crypto_hash.c
@@ -135,18 +135,22 @@ GNUNET_CRYPTO_hash_xor (const struct GNUNET_HashCode *a,
                         const struct GNUNET_HashCode *b,
                         struct GNUNET_HashCode *result)
 {
-  for (ssize_t i = (sizeof(struct GNUNET_HashCode) / sizeof(unsigned int)) - 1;
-       i >= 0;
-       i--)
-    result->bits[i] = a->bits[i] ^ b->bits[i];
+  const unsigned long long *lla = (const unsigned long long *) a;
+  const unsigned long long *llb = (const unsigned long long *) b;
+  unsigned long long *llr = (unsigned long long *) result;
+
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*a) % sizeof (unsigned long long));
+  for (int i = sizeof (*result) / sizeof (*llr) - 1; i>=0; i--)
+    llr[i] = lla[i] ^ llb[i];
 }
 
 
 void
-GNUNET_CRYPTO_hash_to_aes_key (const struct GNUNET_HashCode *hc,
-                               struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
-                               struct
-                               GNUNET_CRYPTO_SymmetricInitializationVector *iv)
+GNUNET_CRYPTO_hash_to_aes_key (
+  const struct GNUNET_HashCode *hc,
+  struct GNUNET_CRYPTO_SymmetricSessionKey *skey,
+  struct GNUNET_CRYPTO_SymmetricInitializationVector *iv)
 {
   GNUNET_assert (GNUNET_YES ==
                  GNUNET_CRYPTO_kdf (
@@ -167,33 +171,47 @@ GNUNET_CRYPTO_hash_to_aes_key (const struct GNUNET_HashCode *hc,
 }
 
 
-int
-GNUNET_CRYPTO_hash_get_bit_ltr (const struct GNUNET_HashCode *code,
-                                unsigned int bit)
+unsigned int
+GNUNET_CRYPTO_hash_count_leading_zeros (const struct GNUNET_HashCode *h)
 {
-  GNUNET_assert (bit < 8 * sizeof(struct GNUNET_HashCode));
-  return (((unsigned char *) code)[bit >> 3] & (128 >> (bit & 7))) > 0;
-}
-
+  const unsigned long long *llp = (const unsigned long long *) h;
+  unsigned int ret = 0;
+  unsigned int i;
 
-int
-GNUNET_CRYPTO_hash_get_bit_rtl (const struct GNUNET_HashCode *code,
-                                unsigned int bit)
-{
-  GNUNET_assert (bit < 8 * sizeof(struct GNUNET_HashCode));
-  return (((unsigned char *) code)[bit >> 3] & (1 << (bit & 7))) > 0;
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*h) % sizeof (unsigned long long));
+  for (i = 0; i<sizeof (*h) / sizeof (*llp); i++)
+  {
+    if (0LLU != llp[i])
+      break;
+    ret += sizeof (*llp) * 8;
+  }
+  if (ret == 8 * sizeof (*h))
+    return ret;
+  ret += __builtin_clzll (GNUNET_ntohll ((uint64_t) llp[i]));
+  return ret;
 }
 
 
 unsigned int
-GNUNET_CRYPTO_hash_matching_bits (const struct GNUNET_HashCode *first,
-                                  const struct GNUNET_HashCode *second)
+GNUNET_CRYPTO_hash_count_tailing_zeros (const struct GNUNET_HashCode *h)
 {
-  for (unsigned int i = 0; i < sizeof(struct GNUNET_HashCode) * 8; i++)
-    if (GNUNET_CRYPTO_hash_get_bit_rtl (first, i) !=
-        GNUNET_CRYPTO_hash_get_bit_rtl (second, i))
-      return i;
-  return sizeof(struct GNUNET_HashCode) * 8;
+  const unsigned long long *llp = (const unsigned long long *) h;
+  unsigned int ret = 0;
+  int i;
+
+  GNUNET_static_assert (8 == sizeof (unsigned long long));
+  GNUNET_static_assert (0 == sizeof (*h) % sizeof (unsigned long long));
+  for (i = sizeof (*h) / sizeof (*llp) - 1; i>=0; i--)
+  {
+    if (0LLU != llp[i])
+      break;
+    ret += sizeof (*llp) * 8;
+  }
+  if (ret == 8 * sizeof (*h))
+    return ret;
+  ret += __builtin_ctzll (GNUNET_ntohll ((uint64_t) llp[i]));
+  return ret;
 }
 
 
@@ -224,18 +242,19 @@ GNUNET_CRYPTO_hash_xorcmp (const struct GNUNET_HashCode *h1,
                            const struct GNUNET_HashCode *h2,
                            const struct GNUNET_HashCode *target)
 {
-  unsigned int d1;
-  unsigned int d2;
+  const unsigned long long *l1 = (const unsigned long long *) h1;
+  const unsigned long long *l2 = (const unsigned long long *) h2;
+  const unsigned long long *t = (const unsigned long long *) target;
 
-  for (ssize_t i = sizeof(struct GNUNET_HashCode) / sizeof(unsigned int) - 1;
-       i >= 0;
-       i--)
+  GNUNET_static_assert (0 == sizeof (*h1) % sizeof (*l1));
+  for (size_t i = 0; i < sizeof(*h1) / sizeof(*l1); i++)
   {
-    d1 = ((unsigned int *) h1)[i] ^ ((unsigned int *) target)[i];
-    d2 = ((unsigned int *) h2)[i] ^ ((unsigned int *) target)[i];
-    if (d1 > d2)
+    unsigned long long x1 = l1[i] ^ t[i];
+    unsigned long long x2 = l2[i] ^ t[i];
+
+    if (x1 > x2)
       return 1;
-    else if (d1 < d2)
+    if (x1 < x2)
       return -1;
   }
   return 0;
@@ -243,25 +262,30 @@ GNUNET_CRYPTO_hash_xorcmp (const struct GNUNET_HashCode *h1,
 
 
 void
-GNUNET_CRYPTO_hmac_derive_key (struct GNUNET_CRYPTO_AuthKey *key,
-                               const struct
-                               GNUNET_CRYPTO_SymmetricSessionKey *rkey,
-                               const void *salt, size_t salt_len, ...)
+GNUNET_CRYPTO_hmac_derive_key (
+  struct GNUNET_CRYPTO_AuthKey *key,
+  const struct GNUNET_CRYPTO_SymmetricSessionKey *rkey,
+  const void *salt, size_t salt_len,
+  ...)
 {
   va_list argp;
 
-  va_start (argp, salt_len);
-  GNUNET_CRYPTO_hmac_derive_key_v (key, rkey, salt, salt_len, argp);
+  va_start (argp,
+            salt_len);
+  GNUNET_CRYPTO_hmac_derive_key_v (key,
+                                   rkey,
+                                   salt, salt_len,
+                                   argp);
   va_end (argp);
 }
 
 
 void
-GNUNET_CRYPTO_hmac_derive_key_v (struct GNUNET_CRYPTO_AuthKey *key,
-                                 const struct
-                                 GNUNET_CRYPTO_SymmetricSessionKey *rkey,
-                                 const void *salt, size_t salt_len,
-                                 va_list argp)
+GNUNET_CRYPTO_hmac_derive_key_v (
+  struct GNUNET_CRYPTO_AuthKey *key,
+  const struct GNUNET_CRYPTO_SymmetricSessionKey *rkey,
+  const void *salt, size_t salt_len,
+  va_list argp)
 {
   GNUNET_CRYPTO_kdf_v (key->key, sizeof(key->key),
                        salt, salt_len,
@@ -283,7 +307,9 @@ GNUNET_CRYPTO_hmac_raw (const void *key, size_t key_len,
   {
     once = 1;
     GNUNET_assert (GPG_ERR_NO_ERROR ==
-                   gcry_md_open (&md, GCRY_MD_SHA512, GCRY_MD_FLAG_HMAC));
+                   gcry_md_open (&md,
+                                 GCRY_MD_SHA512,
+                                 GCRY_MD_FLAG_HMAC));
   }
   else
   {
@@ -323,15 +349,12 @@ GNUNET_CRYPTO_hash_context_start ()
   struct GNUNET_HashContext *hc;
 
   BENCHMARK_START (hash_context_start);
-
   hc = GNUNET_new (struct GNUNET_HashContext);
   GNUNET_assert (0 ==
                  gcry_md_open (&hc->hd,
                                GCRY_MD_SHA512,
                                0));
-
   BENCHMARK_END (hash_context_start);
-
   return hc;
 }
 
diff --git a/src/util/getopt_helpers.c b/src/util/getopt_helpers.c
index 592875531..917aa440b 100644
--- a/src/util/getopt_helpers.c
+++ b/src/util/getopt_helpers.c
@@ -38,7 +38,7 @@
  * @param value not used (NULL)
  * @return #GNUNET_NO (do not continue, not an error)
  */
-static int
+static enum GNUNET_GenericReturnValue
 print_version (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
                void *scls,
                const char *option,
@@ -53,12 +53,6 @@ print_version (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Define the option to print the version of
- * the application (-v option)
- *
- * @param version string with the version number
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_version (const char *version)
 {
@@ -90,7 +84,7 @@ GNUNET_GETOPT_option_version (const char *version)
  * @param value not used (NULL)
  * @return #GNUNET_NO (do not continue, not an error)
  */
-static int
+static enum GNUNET_GenericReturnValue
 format_help (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
              void *scls,
              const char *option,
@@ -192,12 +186,6 @@ OUTER:
 }
 
 
-/**
- * Defining the option to print the command line
- * help text (-h option).
- *
- * @param about string with brief description of the application
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_help (const char *about)
 {
@@ -229,7 +217,7 @@ GNUNET_GETOPT_option_help (const char *about)
  * @param value not used (NULL)
  * @return #GNUNET_OK
  */
-static int
+static enum GNUNET_GenericReturnValue
 increment_value (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
                  void *scls,
                  const char *option,
@@ -245,15 +233,6 @@ increment_value (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Increment @a val each time the option flag is given by one.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val increment by 1 each time the option is present
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_increment_uint (char shortName,
                                      const char *name,
@@ -272,12 +251,6 @@ GNUNET_GETOPT_option_increment_uint (char shortName,
 }
 
 
-/**
- * Define the '-V' verbosity option.  Using the option more
- * than once increments @a level each time.
- *
- * @param[out] level set to the verbosity level
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_verbose (unsigned int *level)
 {
@@ -308,7 +281,7 @@ GNUNET_GETOPT_option_verbose (unsigned int *level)
  * @param value not used (NULL)
  * @return #GNUNET_OK
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_one (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
          void *scls,
          const char *option,
@@ -324,16 +297,6 @@ set_one (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a flag (which internally means setting
- * an integer to 1/#GNUNET_YES/#GNUNET_OK.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to 1 if the option is present
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_flag (char shortName,
                            const char *name,
@@ -366,7 +329,7 @@ GNUNET_GETOPT_option_flag (char shortName,
  * @param value actual value of the option (a string)
  * @return #GNUNET_OK
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_string (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
             void *scls,
             const char *option,
@@ -383,15 +346,6 @@ set_string (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a string.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] str set to the string
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_string (char shortName,
                              const char *name,
@@ -413,12 +367,6 @@ GNUNET_GETOPT_option_string (char shortName,
 }
 
 
-/**
- * Define the '-L' log level option.  Note that we do not check
- * that the log level is valid here.
- *
- * @param[out] level set to the log level
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_loglevel (char **level)
 {
@@ -447,7 +395,7 @@ GNUNET_GETOPT_option_loglevel (char **level)
  * @param value actual value of the option (a string)
  * @return #GNUNET_OK
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_filename (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
               void *scls,
               const char *option,
@@ -464,15 +412,6 @@ set_filename (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a filename (automatically path expanded).
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] str set to the string
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_filename (char shortName,
                                const char *name,
@@ -494,11 +433,6 @@ GNUNET_GETOPT_option_filename (char shortName,
 }
 
 
-/**
- * Allow user to specify log file name (-l option)
- *
- * @param[out] logfn set to the name of the logfile
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_logfile (char **logfn)
 {
@@ -517,11 +451,6 @@ GNUNET_GETOPT_option_logfile (char **logfn)
 }
 
 
-/**
- * Allow user to specify configuration file name (-c option)
- *
- * @param[out] fn set to the name of the configuration file
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_cfgfile (char **fn)
 {
@@ -552,7 +481,7 @@ GNUNET_GETOPT_option_cfgfile (char **fn)
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_ulong (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
            void *scls,
            const char *option,
@@ -573,15 +502,6 @@ set_ulong (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify an `unsigned long long`
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to the value specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_ulong (char shortName,
                             const char *name,
@@ -616,7 +536,7 @@ GNUNET_GETOPT_option_ulong (char shortName,
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_timetravel_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
                      void *scls,
                      const char *option,
@@ -664,15 +584,6 @@ set_timetravel_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a `long long` with an offset to add to the current
- * system time to construct the time seen by the application. Used for
- * debugging / testing.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param[out] val set to the time specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_timetravel (char shortName,
                                  const char *name)
@@ -684,8 +595,7 @@ GNUNET_GETOPT_option_timetravel (char shortName,
     .description = _ (
       "modify system time by given offset (for debugging/testing only)"),
     .require_argument = 1,
-    .processor =
-      &set_timetravel_time
+    .processor = &set_timetravel_time
   };
 
   return clo;
@@ -705,7 +615,7 @@ GNUNET_GETOPT_option_timetravel (char shortName,
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_relative_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
                    void *scls,
                    const char *option,
@@ -725,16 +635,6 @@ set_relative_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a `struct GNUNET_TIME_Relative`
- * (using human-readable "fancy" time).
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to the time specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_relative_time (char shortName,
                                     const char *name,
@@ -748,8 +648,7 @@ GNUNET_GETOPT_option_relative_time (char shortName,
     .argumentHelp = argumentHelp,
     .description = description,
     .require_argument = 1,
-    .processor =
-      &set_relative_time,
+    .processor = &set_relative_time,
     .scls = (void *) val
   };
 
@@ -770,7 +669,7 @@ GNUNET_GETOPT_option_relative_time (char shortName,
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_absolute_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
                    void *scls,
                    const char *option,
@@ -790,16 +689,6 @@ set_absolute_time (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify a `struct GNUNET_TIME_Absolute`
- * (using human-readable "fancy" time).
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to the time specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_absolute_time (char shortName,
                                     const char *name,
@@ -813,8 +702,71 @@ GNUNET_GETOPT_option_absolute_time (char shortName,
     .argumentHelp = argumentHelp,
     .description = description,
     .require_argument = 1,
-    .processor =
-      &set_absolute_time,
+    .processor = &set_absolute_time,
+    .scls = (void *) val
+  };
+
+  return clo;
+}
+
+
+/**
+ * Set an option of type 'struct GNUNET_TIME_Timestamp' from the command line.
+ * A pointer to this function should be passed as part of the
+ * 'struct GNUNET_GETOPT_CommandLineOption' array to initialize options
+ * of this type.  It should be followed by a pointer to a value of
+ * type 'struct GNUNET_TIME_Absolute'.
+ *
+ * @param ctx command line processing context
+ * @param scls additional closure (will point to the `struct GNUNET_TIME_Absolute`)
+ * @param option name of the option
+ * @param value actual value of the option as a string.
+ * @return #GNUNET_OK if parsing the value worked
+ */
+static enum GNUNET_GenericReturnValue
+set_timestamp (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
+               void *scls,
+               const char *option,
+               const char *value)
+{
+  struct GNUNET_TIME_Timestamp *t = scls;
+  struct GNUNET_TIME_Absolute abs;
+
+  (void) ctx;
+  if (GNUNET_OK !=
+      GNUNET_STRINGS_fancy_time_to_absolute (value,
+                                             &abs))
+  {
+    fprintf (stderr,
+             _ ("You must pass a timestamp to the `%s' option.\n"),
+             option);
+    return GNUNET_SYSERR;
+  }
+  if (0 != abs.abs_value_us % GNUNET_TIME_UNIT_SECONDS.rel_value_us)
+  {
+    fprintf (stderr,
+             _ ("The maximum precision allowed for timestamps is seconds.\n"));
+    return GNUNET_SYSERR;
+  }
+  t->abs_time = abs;
+  return GNUNET_OK;
+}
+
+
+struct GNUNET_GETOPT_CommandLineOption
+GNUNET_GETOPT_option_timestamp (char shortName,
+                                const char *name,
+                                const char *argumentHelp,
+                                const char *description,
+                                struct GNUNET_TIME_Timestamp *val)
+{
+  struct GNUNET_GETOPT_CommandLineOption clo = {
+    .shortName = shortName,
+    .name = name,
+    .argumentHelp = argumentHelp,
+    .description = description,
+    .require_argument = 1,
+    .processor = &set_timestamp,
     .scls = (void *) val
   };
 
@@ -835,7 +787,7 @@ GNUNET_GETOPT_option_absolute_time (char shortName,
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_uint (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
           void *scls,
           const char *option,
@@ -864,15 +816,6 @@ set_uint (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify an unsigned integer.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to the value specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_uint (char shortName,
                            const char *name,
@@ -907,7 +850,7 @@ GNUNET_GETOPT_option_uint (char shortName,
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_uint16 (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
             void *scls,
             const char *option,
@@ -938,15 +881,6 @@ set_uint16 (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
 }
 
 
-/**
- * Allow user to specify an uint16_t.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val set to the value specified at the command line
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_uint16 (char shortName,
                              const char *name,
@@ -998,7 +932,7 @@ struct Base32Context
  * @param value actual value of the option as a string.
  * @return #GNUNET_OK if parsing the value worked
  */
-static int
+static enum GNUNET_GenericReturnValue
 set_base32 (struct GNUNET_GETOPT_CommandLineProcessorContext *ctx,
             void *scls,
             const char *option,
@@ -1036,17 +970,6 @@ free_bc (void *cls)
 }
 
 
-/**
- * Allow user to specify a binary value using Crockford
- * Base32 encoding.
- *
- * @param shortName short name of the option
- * @param name long name of the option
- * @param argumentHelp help text for the option argument
- * @param description long help text for the option
- * @param[out] val binary value decoded from Crockford Base32-encoded argument
- * @param val_size size of @a val in bytes
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_base32_fixed_size (char shortName,
                                         const char *name,
@@ -1073,12 +996,6 @@ GNUNET_GETOPT_option_base32_fixed_size (char shortName,
 }
 
 
-/**
- * Make the given option mandatory.
- *
- * @param opt option to modify
- * @return @a opt with the mandatory flag set.
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_mandatory (struct GNUNET_GETOPT_CommandLineOption opt)
 {
@@ -1087,12 +1004,6 @@ GNUNET_GETOPT_option_mandatory (struct GNUNET_GETOPT_CommandLineOption opt)
 }
 
 
-/**
- * Make the given option mutually exclusive with other options.
- *
- * @param opt option to modify
- * @return @a opt with the exclusive flag set.
- */
 struct GNUNET_GETOPT_CommandLineOption
 GNUNET_GETOPT_option_exclusive (struct GNUNET_GETOPT_CommandLineOption opt)
 {
diff --git a/src/util/gnunet-scrypt.c b/src/util/gnunet-scrypt.c
index fe8b6769f..ad46e3f39 100644
--- a/src/util/gnunet-scrypt.c
+++ b/src/util/gnunet-scrypt.c
@@ -78,24 +78,6 @@ shutdown_task (void *cls)
 
 
 /**
- * Count the leading zeroes in hash.
- *
- * @param hash to count leading zeros in
- * @return the number of leading zero bits.
- */
-static unsigned int
-count_leading_zeroes (const struct GNUNET_HashCode *hash)
-{
-  unsigned int hash_count;
-
-  hash_count = 0;
-  while (0 == GNUNET_CRYPTO_hash_get_bit_ltr (hash, hash_count))
-    hash_count++;
-  return hash_count;
-}
-
-
-/**
  * Find our proof of work.
  *
  * @param cls closure (unused)
@@ -131,7 +113,8 @@ find_proof (void *cls)
                             buf,
                             sizeof(buf),
                             &result);
-    if (nse_work_required <= count_leading_zeroes (&result))
+    if (nse_work_required <=
+        GNUNET_CRYPTO_hash_count_leading_zeros (&result))
     {
       proof = counter;
       fprintf (stdout,
diff --git a/src/util/perf_crypto_cs.c b/src/util/perf_crypto_cs.c
index a8c72052b..54c9c8e0e 100644
--- a/src/util/perf_crypto_cs.c
+++ b/src/util/perf_crypto_cs.c
@@ -103,8 +103,6 @@ eval ()
   for (i = 0; i < ITER; i++)
   {
     GNUNET_CRYPTO_cs_blinding_secrets_derive (&nonce,
-                                              sizeof(struct
-                                                     GNUNET_CRYPTO_CsNonce),
                                               bs);
   }
   printf ("10x derive blinding secrets took %s\n",
@@ -167,9 +165,9 @@ eval ()
   for (i = 0; i < ITER; i++)
   {
     GNUNET_CRYPTO_cs_verify (&sig,
-                                   &pub,
-                                   message,
-                                   message_len);
+                             &pub,
+                             message,
+                             message_len);
   }
   printf ("10x verifying signatures took %s\n",
           GNUNET_STRINGS_relative_time_to_string (
diff --git a/src/util/perf_crypto_rsa.c b/src/util/perf_crypto_rsa.c
index aba61786f..a3e041bdf 100644
--- a/src/util/perf_crypto_rsa.c
+++ b/src/util/perf_crypto_rsa.c
@@ -203,6 +203,7 @@ main (int argc, char *argv[])
 {
   eval (1024);
   eval (2048);
+  eval (3072);
   /* eval (4096); */
   return 0;
 }
diff --git a/src/util/strings.c b/src/util/strings.c
index 673915888..db672da87 100644
--- a/src/util/strings.c
+++ b/src/util/strings.c
@@ -201,7 +201,7 @@ struct ConversionTable
  * @param output where to store the result
  * @return #GNUNET_OK on success, #GNUNET_SYSERR on error
  */
-static int
+static enum GNUNET_GenericReturnValue
 convert_with_table (const char *input,
                     const struct ConversionTable *table,
                     unsigned long long *output)
@@ -256,7 +256,7 @@ convert_with_table (const char *input,
 }
 
 
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
                                     unsigned long long *size)
 {
@@ -280,7 +280,7 @@ GNUNET_STRINGS_fancy_size_to_bytes (const char *fancy_size,
 }
 
 
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
                                        struct GNUNET_TIME_Relative *rtime)
 {
@@ -322,7 +322,7 @@ GNUNET_STRINGS_fancy_time_to_relative (const char *fancy_time,
 }
 
 
-int
+enum GNUNET_GenericReturnValue
 GNUNET_STRINGS_fancy_time_to_absolute (const char *fancy_time,
                                        struct GNUNET_TIME_Absolute *atime)
 {
@@ -354,6 +354,15 @@ GNUNET_STRINGS_fancy_time_to_absolute (const char *fancy_time,
 }
 
 
+enum GNUNET_GenericReturnValue
+GNUNET_STRINGS_fancy_time_to_timestamp (const char *fancy_time,
+                                        struct GNUNET_TIME_Timestamp *atime)
+{
+  return GNUNET_STRINGS_fancy_time_to_absolute (fancy_time,
+                                                &atime->abs_time);
+}
+
+
 char *
 GNUNET_STRINGS_conv (const char *input,
                      size_t len,
@@ -607,7 +616,7 @@ GNUNET_STRINGS_absolute_time_to_string (struct GNUNET_TIME_Absolute t)
   time_t tt;
   struct tm *tp;
 
-  if (t.abs_value_us == GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us)
+  if (GNUNET_TIME_absolute_is_never (t))
     return "end of time";
   tt = t.abs_value_us / 1000LL / 1000LL;
   tp = localtime (&tt);
@@ -616,7 +625,8 @@ GNUNET_STRINGS_absolute_time_to_string (struct GNUNET_TIME_Absolute t)
    * As for msvcrt, use the wide variant, which always returns utf16
    * (otherwise we'd have to detect current codepage or use W32API character
    * set conversion routines to convert to UTF8).
-   */strftime (buf, sizeof(buf), "%a %b %d %H:%M:%S %Y", tp);
+   */
+  strftime (buf, sizeof(buf), "%a %b %d %H:%M:%S %Y", tp);
 
   return buf;
 }
diff --git a/src/util/test_crypto_cs.c b/src/util/test_crypto_cs.c
index 2978fec0a..d3406516e 100644
--- a/src/util/test_crypto_cs.c
+++ b/src/util/test_crypto_cs.c
@@ -148,8 +148,7 @@ test_generate_rpublic (const struct GNUNET_CRYPTO_CsRSecret *r_priv,
 
 
 void
-test_derive_blindingsecrets (const void *secret,
-                           size_t secret_len,
+test_derive_blindingsecrets (const struct GNUNET_CRYPTO_CsNonce *blind_seed,
                            struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
 {
   /* TEST 1
@@ -159,7 +158,7 @@ test_derive_blindingsecrets (const void *secret,
   memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
           * 2);
 
-  GNUNET_CRYPTO_cs_blinding_secrets_derive (secret, secret_len, bs);
+  GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
 
   GNUNET_assert (0 != memcmp (&other_bs[0],
                               &bs[0],
@@ -173,7 +172,7 @@ test_derive_blindingsecrets (const void *secret,
   memcpy (&other_bs[0], &bs[0], sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
           * 2);
   for (int i = 0; i<ITER; i++) {
-    GNUNET_CRYPTO_cs_blinding_secrets_derive (secret, secret_len, bs);
+    GNUNET_CRYPTO_cs_blinding_secrets_derive (blind_seed, bs);
     GNUNET_assert (0 == memcmp (&other_bs[0],
                                 &bs[0],
                                 sizeof(struct GNUNET_CRYPTO_CsBlindingSecret)
@@ -493,8 +492,7 @@ main (int argc,
   // generate blinding secrets
   struct GNUNET_CRYPTO_CsBlindingSecret blindingsecrets[2];
   test_derive_blindingsecrets (&nonce,
-                             sizeof(nonce),
-                             blindingsecrets);
+                               blindingsecrets);
 
   // calculate blinded c's
   struct GNUNET_CRYPTO_CsC blinded_cs[2];
diff --git a/src/util/test_crypto_eddsa.c b/src/util/test_crypto_eddsa.c
index 10d6a4e91..459619ff2 100644
--- a/src/util/test_crypto_eddsa.c
+++ b/src/util/test_crypto_eddsa.c
@@ -216,12 +216,16 @@ testCreateFromFile (void)
   struct GNUNET_CRYPTO_EddsaPublicKey p1;
   struct GNUNET_CRYPTO_EddsaPublicKey p2;
 
-  GNUNET_assert (0 <=
+  /* do_create == GNUNET_YES and non-existing file MUST return GNUNET_YES */
+  GNUNET_assert (0 == unlink (KEYFILE) || ENOENT == errno);
+  GNUNET_assert (GNUNET_YES ==
                  GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
                                                     GNUNET_YES,
                                                     &key));
   GNUNET_CRYPTO_eddsa_key_get_public (&key,
                                       &p1);
+
+  /* do_create == GNUNET_YES and _existing_ file MUST return GNUNET_NO */
   GNUNET_assert (GNUNET_NO ==
                  GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
                                                     GNUNET_YES,
@@ -231,16 +235,13 @@ testCreateFromFile (void)
   GNUNET_assert (0 ==
                  GNUNET_memcmp (&p1,
                                 &p2));
+
+  /* do_create == GNUNET_NO and non-existing file MUST return GNUNET_SYSERR */
   GNUNET_assert (0 == unlink (KEYFILE));
-  GNUNET_assert (GNUNET_OK ==
+  GNUNET_assert (GNUNET_SYSERR ==
                  GNUNET_CRYPTO_eddsa_key_from_file (KEYFILE,
                                                     GNUNET_NO,
                                                     &key));
-  GNUNET_CRYPTO_eddsa_key_get_public (&key,
-                                      &p2);
-  GNUNET_assert (0 !=
-                 GNUNET_memcmp (&p1,
-                                &p2));
   return GNUNET_OK;
 }
 
@@ -299,7 +300,6 @@ main (int argc, char *argv[])
     failure_count++;
   if (GNUNET_OK != testCreateFromFile ())
     failure_count++;
-  GNUNET_assert (0 == unlink (KEYFILE));
   perf_keygen ();
 
   if (0 != failure_count)
diff --git a/src/util/test_crypto_hash.c b/src/util/test_crypto_hash.c
index d22e1f5d3..8241676da 100644
--- a/src/util/test_crypto_hash.c
+++ b/src/util/test_crypto_hash.c
@@ -1,6 +1,6 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2002, 2003, 2004, 2006, 2009 GNUnet e.V.
+     Copyright (C) 2002, 2003, 2004, 2006, 2009, 2022 GNUnet e.V.
 
      GNUnet is free software: you can redistribute it and/or modify it
      under the terms of the GNU Affero General Public License as published
@@ -37,25 +37,29 @@ test (int number)
   struct GNUNET_HashCode h2;
   struct GNUNET_CRYPTO_HashAsciiEncoded enc;
 
-  memset (&h1, number, sizeof(struct GNUNET_HashCode));
-  GNUNET_CRYPTO_hash_to_enc (&h1, &enc);
-  if (GNUNET_OK != GNUNET_CRYPTO_hash_from_string ((char *) &enc, &h2))
+  memset (&h1,
+          number,
+          sizeof(struct GNUNET_HashCode));
+  GNUNET_CRYPTO_hash_to_enc (&h1,
+                             &enc);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_hash_from_string ((char *) &enc,
+                                      &h2))
   {
     printf ("enc2hash failed!\n");
     return 1;
   }
-  if (0 != memcmp (&h1, &h2, sizeof(struct GNUNET_HashCode)))
+  if (0 != GNUNET_memcmp (&h1,
+                          &h2))
     return 1;
   return 0;
 }
 
 
 static int
-testEncoding ()
+test_encoding (void)
 {
-  int i;
-
-  for (i = 0; i < 255; i++)
+  for (int i = 0; i < 255; i++)
     if (0 != test (i))
       return 1;
   return 0;
@@ -63,7 +67,7 @@ testEncoding ()
 
 
 static int
-testArithmetic ()
+test_arithmetic (void)
 {
   struct GNUNET_HashCode h1;
   struct GNUNET_HashCode h2;
@@ -72,49 +76,80 @@ testArithmetic ()
   struct GNUNET_CRYPTO_SymmetricSessionKey skey;
   struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
 
-  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, &h1);
-  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, &h2);
-  if (GNUNET_CRYPTO_hash_distance_u32 (&h1, &h2) !=
-      GNUNET_CRYPTO_hash_distance_u32 (&h2, &h1))
-    return 1;
-  GNUNET_CRYPTO_hash_difference (&h1, &h2, &d);
-  GNUNET_CRYPTO_hash_sum (&h1, &d, &s);
-  if (0 != GNUNET_CRYPTO_hash_cmp (&s, &h2))
-    return 1;
-  GNUNET_CRYPTO_hash_xor (&h1, &h2, &d);
-  GNUNET_CRYPTO_hash_xor (&h1, &d, &s);
-  if (0 != GNUNET_CRYPTO_hash_cmp (&s, &h2))
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                    &h1);
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                    &h2);
+  if (GNUNET_CRYPTO_hash_distance_u32 (&h1,
+                                       &h2) !=
+      GNUNET_CRYPTO_hash_distance_u32 (&h2,
+                                       &h1))
     return 1;
-  if (0 != GNUNET_CRYPTO_hash_xorcmp (&s, &h2, &h1))
+  GNUNET_CRYPTO_hash_difference (&h1,
+                                 &h2,
+                                 &d);
+  GNUNET_CRYPTO_hash_sum (&h1,
+                          &d,
+                          &s);
+  if (0 !=
+      GNUNET_CRYPTO_hash_cmp (&s,
+                              &h2))
     return 1;
-  if (-1 != GNUNET_CRYPTO_hash_xorcmp (&h1, &h2, &h1))
+  GNUNET_CRYPTO_hash_xor (&h1,
+                          &h2,
+                          &d);
+  GNUNET_CRYPTO_hash_xor (&h1,
+                          &d,
+                          &s);
+  if (0 !=
+      GNUNET_CRYPTO_hash_cmp (&s,
+                              &h2))
     return 1;
-  if (1 != GNUNET_CRYPTO_hash_xorcmp (&h1, &h2, &h2))
+  if (0 !=
+      GNUNET_CRYPTO_hash_xorcmp (&s,
+                                 &h2,
+                                 &h1))
     return 1;
-  memset (&d, 0x40, sizeof(d));
-  if (0 != GNUNET_CRYPTO_hash_get_bit_rtl (&d, 3))
+  if (-1 !=
+      GNUNET_CRYPTO_hash_xorcmp (&h1,
+                                 &h2,
+                                 &h1))
     return 1;
-  if (1 != GNUNET_CRYPTO_hash_get_bit_rtl (&d, 6))
+  if (1 !=
+      GNUNET_CRYPTO_hash_xorcmp (&h1,
+                                 &h2,
+                                 &h2))
     return 1;
-  memset (&d, 0x02, sizeof(d));
-  if (0 != GNUNET_CRYPTO_hash_get_bit_ltr (&d, 3))
-    return 1;
-  if (1 != GNUNET_CRYPTO_hash_get_bit_ltr (&d, 6))
-    return 1;
-  memset (&d, 0, sizeof(d));
-  GNUNET_CRYPTO_hash_to_aes_key (&d, &skey, &iv);
+  memset (&d,
+          0,
+          sizeof(d));
+  GNUNET_CRYPTO_hash_to_aes_key (&d,
+                                 &skey,
+                                 &iv);
+  memset (&h1,
+          0,
+          sizeof (h1));
+  h1.bits[1] = htonl (0x00200000); /* 32 + 8 + 2 = 42 MSB bits cleared */
+  GNUNET_assert (42 ==
+                 GNUNET_CRYPTO_hash_count_leading_zeros (&h1));
+  GNUNET_assert (512 - 42 - 1 ==
+                 GNUNET_CRYPTO_hash_count_tailing_zeros (&h1));
   return 0;
 }
 
 
 static void
-finished_task (void *cls, const struct GNUNET_HashCode *res)
+finished_task (void *cls,
+               const struct GNUNET_HashCode *res)
 {
   int *ret = cls;
   struct GNUNET_HashCode want;
 
-  GNUNET_CRYPTO_hash (block, sizeof(block), &want);
-  if (0 != memcmp (res, &want, sizeof(want)))
+  GNUNET_CRYPTO_hash (block,
+                      sizeof(block),
+                      &want);
+  if (0 != GNUNET_memcmp (res,
+                          &want))
     *ret = 2;
   else
     *ret = 0;
@@ -126,43 +161,57 @@ file_hasher (void *cls)
 {
   GNUNET_assert (NULL !=
                  GNUNET_CRYPTO_hash_file (GNUNET_SCHEDULER_PRIORITY_DEFAULT,
-                                          FILENAME, 1024, &finished_task, cls));
+                                          FILENAME,
+                                          1024,
+                                          &finished_task,
+                                          cls));
 }
 
 
 static int
-testFileHash ()
+test_file_hash (void)
 {
   int ret;
   FILE *f;
 
-  memset (block, 42, sizeof(block) / 2);
-  memset (&block[sizeof(block) / 2], 43, sizeof(block) / 2);
+  memset (block,
+          42,
+          sizeof(block) / 2);
+  memset (&block[sizeof(block) / 2],
+          43,
+          sizeof(block) / 2);
   GNUNET_assert (NULL != (f = fopen (FILENAME, "w+")));
-  GNUNET_break (sizeof(block) == fwrite (block, 1, sizeof(block), f));
+  GNUNET_break (sizeof(block) ==
+                fwrite (block,
+                        1,
+                        sizeof(block),
+                        f));
   GNUNET_break (0 == fclose (f));
   ret = 1;
-  GNUNET_SCHEDULER_run (&file_hasher, &ret);
+  GNUNET_SCHEDULER_run (&file_hasher,
+                        &ret);
   GNUNET_break (0 == unlink (FILENAME));
   return ret;
 }
 
 
 int
-main (int argc, char *argv[])
+main (int argc,
+      char *argv[])
 {
   int failureCount = 0;
-  int i;
-
-  GNUNET_log_setup ("test-crypto-hash", "WARNING", NULL);
-  for (i = 0; i < 10; i++)
-    failureCount += testEncoding ();
-  failureCount += testArithmetic ();
-  failureCount += testFileHash ();
-  if (failureCount != 0)
+
+  GNUNET_log_setup ("test-crypto-hash",
+                    "WARNING",
+                    NULL);
+  for (int i = 0; i < 10; i++)
+    failureCount += test_encoding ();
+  failureCount += test_arithmetic ();
+  failureCount += test_file_hash ();
+  if (0 != failureCount)
     return 1;
   return 0;
 }
 
 
-/* end of hashingtest.c */
+/* end of test_crypto_hash.c */
diff --git a/src/util/time.c b/src/util/time.c
index 144e1b401..83b39b4e8 100644
--- a/src/util/time.c
+++ b/src/util/time.c
@@ -58,27 +58,35 @@ GNUNET_TIME_get_offset ()
 }
 
 
-int
-GNUNET_TIME_round_abs (struct GNUNET_TIME_Absolute *at)
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_absolute_to_timestamp (struct GNUNET_TIME_Absolute at)
 {
-  if (at->abs_value_us == GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us)
-    return GNUNET_OK;
-  if (0 == at->abs_value_us % 1000000)
-    return GNUNET_OK;
-  at->abs_value_us -= at->abs_value_us % 1000000;
-  return GNUNET_NO;
+  struct GNUNET_TIME_Timestamp ts;
+
+  if (GNUNET_TIME_absolute_is_never (at))
+    return GNUNET_TIME_UNIT_FOREVER_TS;
+  ts.abs_time.abs_value_us = at.abs_value_us - at.abs_value_us % 1000000;
+  return ts;
+}
+
+
+struct GNUNET_TIME_TimestampNBO
+GNUNET_TIME_timestamp_hton (struct GNUNET_TIME_Timestamp t)
+{
+  struct GNUNET_TIME_TimestampNBO tn;
+
+  tn.abs_time_nbo = GNUNET_TIME_absolute_hton (t.abs_time);
+  return tn;
 }
 
 
-int
-GNUNET_TIME_round_rel (struct GNUNET_TIME_Relative *rt)
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_ntoh (struct GNUNET_TIME_TimestampNBO tn)
 {
-  if (rt->rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
-    return GNUNET_OK;
-  if (0 == rt->rel_value_us % 1000000)
-    return GNUNET_OK;
-  rt->rel_value_us -= rt->rel_value_us % 1000000;
-  return GNUNET_NO;
+  struct GNUNET_TIME_Timestamp t;
+
+  t.abs_time = GNUNET_TIME_absolute_ntoh (tn.abs_time_nbo);
+  return t;
 }
 
 
@@ -96,6 +104,14 @@ GNUNET_TIME_absolute_get ()
 }
 
 
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_get ()
+{
+  return GNUNET_TIME_absolute_to_timestamp (
+    GNUNET_TIME_absolute_get ());
+}
+
+
 struct GNUNET_TIME_Relative
 GNUNET_TIME_relative_get_zero_ ()
 {
@@ -177,12 +193,114 @@ GNUNET_TIME_absolute_get_forever_ ()
 }
 
 
+const char *
+GNUNET_TIME_timestamp2s (struct GNUNET_TIME_Timestamp ts)
+{
+  static GNUNET_THREAD_LOCAL char buf[255];
+  time_t tt;
+  struct tm *tp;
+
+  if (GNUNET_TIME_absolute_is_never (ts.abs_time))
+    return "end of time";
+  tt = ts.abs_time.abs_value_us / 1000LL / 1000LL;
+  tp = localtime (&tt);
+  /* This is hacky, but i don't know a way to detect libc character encoding.
+   * Just expect utf8 from glibc these days.
+   * As for msvcrt, use the wide variant, which always returns utf16
+   * (otherwise we'd have to detect current codepage or use W32API character
+   * set conversion routines to convert to UTF8).
+   */
+  strftime (buf,
+            sizeof(buf),
+            "%a %b %d %H:%M:%S %Y",
+            tp);
+  return buf;
+}
+
+
+const char *
+GNUNET_TIME_absolute2s (struct GNUNET_TIME_Absolute t)
+{
+  static GNUNET_THREAD_LOCAL char buf[255];
+  time_t tt;
+  struct tm *tp;
+
+  if (GNUNET_TIME_absolute_is_never (t))
+    return "end of time";
+  tt = t.abs_value_us / 1000LL / 1000LL;
+  tp = localtime (&tt);
+  /* This is hacky, but i don't know a way to detect libc character encoding.
+   * Just expect utf8 from glibc these days.
+   * As for msvcrt, use the wide variant, which always returns utf16
+   * (otherwise we'd have to detect current codepage or use W32API character
+   * set conversion routines to convert to UTF8).
+   */
+  strftime (buf,
+            sizeof(buf),
+            "%a %b %d %H:%M:%S %Y",
+            tp);
+  return buf;
+}
+
+
+const char *
+GNUNET_TIME_relative2s (struct GNUNET_TIME_Relative delta,
+                        bool do_round)
+{
+  static GNUNET_THREAD_LOCAL char buf[128];
+  const char *unit = /* time unit */ "µs";
+  uint64_t dval = delta.rel_value_us;
+
+  if (GNUNET_TIME_relative_is_forever (delta))
+    return "forever";
+  if (0 == delta.rel_value_us)
+    return "0 ms";
+  if ( ((GNUNET_YES == do_round) &&
+        (dval > 5 * 1000)) ||
+       (0 == (dval % 1000)))
+  {
+    dval = dval / 1000;
+    unit = /* time unit */ "ms";
+    if (((GNUNET_YES == do_round) && (dval > 5 * 1000)) || (0 == (dval % 1000)))
+    {
+      dval = dval / 1000;
+      unit = /* time unit */ "s";
+      if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+      {
+        dval = dval / 60;
+        unit = /* time unit */ "m";
+        if (((GNUNET_YES == do_round) && (dval > 5 * 60)) || (0 == (dval % 60)))
+        {
+          dval = dval / 60;
+          unit = /* time unit */ "h";
+          if (((GNUNET_YES == do_round) && (dval > 5 * 24)) ||
+              (0 == (dval % 24)))
+          {
+            dval = dval / 24;
+            if (1 == dval)
+              unit = /* time unit */ "day";
+            else
+              unit = /* time unit */ "days";
+          }
+        }
+      }
+    }
+  }
+  GNUNET_snprintf (buf,
+                   sizeof(buf),
+                   "%llu %s",
+                   (unsigned long long) dval,
+                   unit);
+  return buf;
+}
+
+
 struct GNUNET_TIME_Absolute
 GNUNET_TIME_relative_to_absolute (struct GNUNET_TIME_Relative rel)
 {
   struct GNUNET_TIME_Absolute ret;
 
-  if (rel.rel_value_us == UINT64_MAX)
+  if (GNUNET_TIME_relative_is_forever (rel))
     return GNUNET_TIME_UNIT_FOREVER_ABS;
   struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
 
@@ -196,6 +314,14 @@ GNUNET_TIME_relative_to_absolute (struct GNUNET_TIME_Relative rel)
 }
 
 
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_relative_to_timestamp (struct GNUNET_TIME_Relative rel)
+{
+  return GNUNET_TIME_absolute_to_timestamp (
+    GNUNET_TIME_relative_to_absolute (rel));
+}
+
+
 struct GNUNET_TIME_Relative
 GNUNET_TIME_relative_min (struct GNUNET_TIME_Relative t1,
                           struct GNUNET_TIME_Relative t2)
@@ -228,12 +354,28 @@ GNUNET_TIME_absolute_max (struct GNUNET_TIME_Absolute t1,
 }
 
 
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_max (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2)
+{
+  return (t1.abs_time.abs_value_us > t2.abs_time.abs_value_us) ? t1 : t2;
+}
+
+
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_min (struct GNUNET_TIME_Timestamp t1,
+                           struct GNUNET_TIME_Timestamp t2)
+{
+  return (t1.abs_time.abs_value_us < t2.abs_time.abs_value_us) ? t1 : t2;
+}
+
+
 struct GNUNET_TIME_Relative
 GNUNET_TIME_absolute_get_remaining (struct GNUNET_TIME_Absolute future)
 {
   struct GNUNET_TIME_Relative ret;
 
-  if (future.abs_value_us == UINT64_MAX)
+  if (GNUNET_TIME_absolute_is_never (future))
     return GNUNET_TIME_UNIT_FOREVER_REL;
   struct GNUNET_TIME_Absolute now = GNUNET_TIME_absolute_get ();
 
@@ -250,7 +392,7 @@ GNUNET_TIME_absolute_get_difference (struct GNUNET_TIME_Absolute start,
 {
   struct GNUNET_TIME_Relative ret;
 
-  if (end.abs_value_us == UINT64_MAX)
+  if (GNUNET_TIME_absolute_is_never (end))
     return GNUNET_TIME_UNIT_FOREVER_REL;
   if (end.abs_value_us < start.abs_value_us)
     return GNUNET_TIME_UNIT_ZERO;
@@ -279,8 +421,8 @@ GNUNET_TIME_absolute_add (struct GNUNET_TIME_Absolute start,
 {
   struct GNUNET_TIME_Absolute ret;
 
-  if ((start.abs_value_us == UINT64_MAX) ||
-      (duration.rel_value_us == UINT64_MAX))
+  if (GNUNET_TIME_absolute_is_never (start) ||
+      GNUNET_TIME_relative_is_forever (duration))
     return GNUNET_TIME_UNIT_FOREVER_ABS;
   if (start.abs_value_us + duration.rel_value_us < start.abs_value_us)
   {
@@ -300,7 +442,7 @@ GNUNET_TIME_absolute_subtract (struct GNUNET_TIME_Absolute start,
 
   if (start.abs_value_us <= duration.rel_value_us)
     return GNUNET_TIME_UNIT_ZERO_ABS;
-  if (start.abs_value_us == GNUNET_TIME_UNIT_FOREVER_ABS.abs_value_us)
+  if (GNUNET_TIME_absolute_is_never (start))
     return GNUNET_TIME_UNIT_FOREVER_ABS;
   ret.abs_value_us = start.abs_value_us - duration.rel_value_us;
   return ret;
@@ -315,7 +457,7 @@ GNUNET_TIME_relative_multiply (struct GNUNET_TIME_Relative rel,
 
   if (0 == factor)
     return GNUNET_TIME_UNIT_ZERO;
-  if (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+  if (GNUNET_TIME_relative_is_forever (rel))
     return GNUNET_TIME_UNIT_FOREVER_REL;
   ret.rel_value_us = rel.rel_value_us * factor;
   if (ret.rel_value_us / factor != rel.rel_value_us)
@@ -328,7 +470,8 @@ GNUNET_TIME_relative_multiply (struct GNUNET_TIME_Relative rel,
 
 
 struct GNUNET_TIME_Relative
-relative_multiply_double (struct GNUNET_TIME_Relative rel, double factor)
+relative_multiply_double (struct GNUNET_TIME_Relative rel,
+                          double factor)
 {
   struct GNUNET_TIME_Relative out;
   double m;
@@ -337,7 +480,7 @@ relative_multiply_double (struct GNUNET_TIME_Relative rel, double factor)
 
   if (0 == factor)
     return GNUNET_TIME_UNIT_ZERO;
-  if (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+  if (GNUNET_TIME_relative_is_forever (rel))
     return GNUNET_TIME_UNIT_FOREVER_REL;
 
   m = ((double) rel.rel_value_us) * factor;
@@ -361,7 +504,7 @@ GNUNET_TIME_relative_saturating_multiply (struct GNUNET_TIME_Relative rel,
 
   if (0 == factor)
     return GNUNET_TIME_UNIT_ZERO;
-  if (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us)
+  if (GNUNET_TIME_relative_is_forever (rel))
     return GNUNET_TIME_UNIT_FOREVER_REL;
   ret.rel_value_us = rel.rel_value_us * factor;
   if (ret.rel_value_us / factor != rel.rel_value_us)
@@ -379,7 +522,7 @@ GNUNET_TIME_relative_divide (struct GNUNET_TIME_Relative rel,
   struct GNUNET_TIME_Relative ret;
 
   if ((0 == factor) ||
-      (rel.rel_value_us == GNUNET_TIME_UNIT_FOREVER_REL.rel_value_us))
+      (GNUNET_TIME_relative_is_forever (rel)))
     return GNUNET_TIME_UNIT_FOREVER_REL;
   ret.rel_value_us = rel.rel_value_us / factor;
   return ret;
@@ -538,6 +681,20 @@ GNUNET_TIME_absolute_from_s (uint64_t s_after_epoch)
 }
 
 
+struct GNUNET_TIME_Timestamp
+GNUNET_TIME_timestamp_from_s (uint64_t s_after_epoch)
+{
+  struct GNUNET_TIME_Timestamp ret;
+
+  ret.abs_time.abs_value_us
+    = GNUNET_TIME_UNIT_SECONDS.rel_value_us * s_after_epoch;
+  if (ret.abs_time.abs_value_us / GNUNET_TIME_UNIT_SECONDS.rel_value_us
+      != s_after_epoch)
+    ret = GNUNET_TIME_UNIT_FOREVER_TS;
+  return ret;
+}
+
+
 struct GNUNET_TIME_Absolute
 GNUNET_TIME_absolute_ntoh (struct GNUNET_TIME_AbsoluteNBO a)
 {
@@ -645,6 +802,13 @@ GNUNET_TIME_randomized_backoff (struct GNUNET_TIME_Relative rt,
 }
 
 
+bool
+GNUNET_TIME_absolute_is_zero (struct GNUNET_TIME_Absolute abs)
+{
+  return 0 == abs.abs_value_us;
+}
+
+
 struct GNUNET_TIME_Relative
 GNUNET_TIME_randomize (struct GNUNET_TIME_Relative r)
 {