51 files changed, 21898 insertions, 0 deletions

diff --git a/src/contrib/service/Makefile.am b/src/contrib/service/Makefile.am
index d7cb9946d..cfab56206 100644
--- a/src/contrib/service/Makefile.am
+++ b/src/contrib/service/Makefile.am
@@ -7,4 +7,7 @@ endif
 
 SUBDIRS = \
         template \
+        set \
+        consensus \
+        secretsharing \
         $(EXP_DIR)
diff --git a/src/contrib/service/consensus/.gitignore b/src/contrib/service/consensus/.gitignore
new file mode 100644
index 000000000..8050d760e
--- /dev/null
+++ b/src/contrib/service/consensus/.gitignore
@@ -0,0 +1,6 @@
+gnunet-service-evil-consensus
+gnunet-consensus-profiler
+gnunet-service-consensus
+test_consensus_api
+resource.log.master
+consensus-simulation.py
diff --git a/src/contrib/service/consensus/Makefile.am b/src/contrib/service/consensus/Makefile.am
new file mode 100644
index 000000000..69405b90e
--- /dev/null
+++ b/src/contrib/service/consensus/Makefile.am
@@ -0,0 +1,106 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+pkgcfg_DATA = \
+  consensus.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = -fprofile-arcs -ftest-coverage
+endif
+
+
+libexec_PROGRAMS = \
+ gnunet-service-consensus
+
+if ENABLE_MALICIOUS
+libexec_PROGRAMS += \
+ gnunet-service-evil-consensus
+endif
+
+SUFFIXES = .py.in .py
+
+.py.in.py:
+        $(AWK) -v bdir="$(bindir)" -v py="$(PYTHON)" -v awkay="$(AWK_BINARY)" -v pfx="$(prefix)" -v prl="$(PERL)" -v sysconfdirectory="$(sysconfdir)" -v pkgdatadirectory="$(pkgdatadir)" -f $(top_srcdir)/bin/dosubst.awk < $< > $@
+        chmod +x $@
+
+check-python-style:
+        flake8 consensus-simulation.py.in
+
+lib_LTLIBRARIES = \
+  libgnunetconsensus.la
+
+gnunet_service_consensus_SOURCES = \
+ gnunet-service-consensus.c
+gnunet_service_consensus_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/core/libgnunetcore.la \
+  $(top_builddir)/src/contrib/service/set/libgnunetset.la \
+  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
+  $(GN_LIBINTL)
+
+gnunet_service_evil_consensus_SOURCES = \
+ gnunet-service-consensus.c \
+ consensus_protocol.h
+gnunet_service_evil_consensus_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/core/libgnunetcore.la \
+  $(top_builddir)/src/contrib/service/set/libgnunetset.la \
+  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
+  $(GN_LIBINTL)
+gnunet_service_evil_consensus_CFLAGS = -DEVIL
+
+libgnunetconsensus_la_SOURCES = \
+  consensus_api.c \
+  consensus.h
+libgnunetconsensus_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunetconsensus_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)
+
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_consensus.la
+
+libgnunet_plugin_block_consensus_la_SOURCES = \
+  plugin_block_consensus.c
+libgnunet_plugin_block_consensus_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_consensus_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+
+check_PROGRAMS = \
+ test_consensus_api
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
+
+test_consensus_api_SOURCES = \
+ test_consensus_api.c
+test_consensus_api_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetconsensus.la
+
+noinst_SCRIPTS = \
+        consensus-simulation.py
+
+CLEANFILES = \
+        $(noinst_SCRIPTS)
+
+EXTRA_DIST = \
+  test_consensus.conf \
+  consensus-simulation.py.in
diff --git a/src/contrib/service/consensus/consensus-simulation.py.in b/src/contrib/service/consensus/consensus-simulation.py.in
new file mode 100644
index 000000000..272a52da2
--- /dev/null
+++ b/src/contrib/service/consensus/consensus-simulation.py.in
@@ -0,0 +1,112 @@
+#!@PYTHONEXE@
+# This file is part of GNUnet
+# (C) 2013, 2018 Christian Grothoff (and other contributing authors)
+#
+# GNUnet is free software: you can redistribute it and/or modify it
+# under the terms of the GNU Affero General Public License as published
+# by the Free Software Foundation, either version 3 of the License,
+# or (at your option) any later version.
+#
+# GNUnet is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: AGPL3.0-or-later
+
+import argparse
+import random
+from math import ceil, log, floor
+
+
+def bsc(n):
+    """ count the bits set in n"""
+    l = n.bit_length()
+    c = 0
+    x = 1
+    for _ in range(0, l):
+        if n & x:
+            c = c + 1
+        x = x << 1
+    return c
+
+
+def simulate(k, n, verbose):
+    assert k < n
+    largest_arc = int(2**ceil(log(n, 2))) // 2
+    num_ghosts = (2 * largest_arc) - n
+    if verbose:
+        print("we have", num_ghosts, "ghost peers")
+        # n.b. all peers with idx<k are evil
+    peers = list(range(n))
+    info = [1 << x for x in range(n)]
+
+    def done_p():
+        for x in range(k, n):
+            if bsc(info[x]) < n - k:
+                return False
+        return True
+
+    rounds = 0
+    while not done_p():
+        if verbose:
+            print("-- round --")
+        arc = 1
+        while arc <= largest_arc:
+            if verbose:
+                print("-- subround --")
+            new_info = [x for x in info]
+            for peer_physical in range(n):
+                peer_logical = peers[peer_physical]
+                peer_type = None
+                partner_logical = (peer_logical + arc) % n
+                partner_physical = peers.index(partner_logical)
+                if peer_physical < k or partner_physical < k:
+                    if verbose:
+                        print(
+                            "bad peer in connection", peer_physical, "--",
+                            partner_physical
+                        )
+                    continue
+                if peer_logical & arc == 0:
+                    # we are outgoing
+                    if verbose:
+                        print(peer_physical, "connects to", partner_physical)
+                    peer_type = "outgoing"
+                    if peer_logical < num_ghosts:
+                        # we have a ghost, check if the peer who connects
+                        # to our ghost is actually outgoing
+                        ghost_partner_logical = (peer_logical - arc) % n
+                        if ghost_partner_logical & arc == 0:
+                            peer_type = peer_type + ", ghost incoming"
+                    new_info[peer_physical] = new_info[peer_physical] | info[
+                        peer_physical] | info[partner_physical]
+                    new_info[partner_physical
+                             ] = new_info[partner_physical] | info[
+                                 peer_physical] | info[partner_physical]
+                else:
+                    peer_type = "incoming"
+                if verbose > 1:
+                    print("type of", str(peer_physical) + ":", peer_type)
+            info = new_info
+            arc = arc << 1
+        rounds = rounds + 1
+        random.shuffle(peers)
+    return rounds
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("k", metavar="k", type=int, help="#(bad peers)")
+    parser.add_argument("n", metavar="n", type=int, help="#(all peers)")
+    parser.add_argument("r", metavar="r", type=int, help="#(rounds)")
+    parser.add_argument('--verbose', '-v', action='count')
+
+    args = parser.parse_args()
+    sum = 0.0
+    for n in range(0, args.r):
+        sum += simulate(args.k, args.n, args.verbose)
+    print(sum // args.r)
diff --git a/src/contrib/service/consensus/consensus.conf.in b/src/contrib/service/consensus/consensus.conf.in
new file mode 100644
index 000000000..b0fbcaf5a
--- /dev/null
+++ b/src/contrib/service/consensus/consensus.conf.in
@@ -0,0 +1,10 @@
+[consensus]
+START_ON_DEMAND = @START_ON_DEMAND@
+@JAVAPORT@PORT = 2103
+HOSTNAME = localhost
+BINARY = gnunet-service-consensus
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-consensus.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
diff --git a/src/contrib/service/consensus/consensus.h b/src/contrib/service/consensus/consensus.h
new file mode 100644
index 000000000..888213d55
--- /dev/null
+++ b/src/contrib/service/consensus/consensus.h
@@ -0,0 +1,92 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Florian Dold
+ * @file consensus/consensus.h
+ * @brief
+ */
+#ifndef CONSENSUS_H
+#define CONSENSUS_H
+
+#include "gnunet_common.h"
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Sent by the client to the service,
+ * when the client wants the service to join a consensus session.
+ */
+struct GNUNET_CONSENSUS_JoinMessage
+{
+  /**
+   * Type: GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_JOIN
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of peers (at the end of this message) that want to
+   * participate in the consensus.
+   */
+  uint32_t num_peers GNUNET_PACKED;
+
+  /**
+   * Session id of the consensus.
+   */
+  struct GNUNET_HashCode session_id;
+
+  /**
+   * Start time for the consensus.
+   */
+  struct GNUNET_TIME_AbsoluteNBO start;
+
+  /**
+   * Deadline for conclude.
+   */
+  struct GNUNET_TIME_AbsoluteNBO deadline;
+
+  /* GNUNET_PeerIdentity[num_peers] */
+};
+
+
+/**
+ * Message with an element
+ */
+struct GNUNET_CONSENSUS_ElementMessage
+{
+  /**
+   * Type:
+   * Either GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_RECEIVED_ELEMENT
+   * or GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_INSERT_ELEMENT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Type: GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_NEW_ELEMENT
+   */
+  uint16_t element_type GNUNET_PACKED; /* FIXME: alignment? => uint32_t */
+
+  /* rest: element data */
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/contrib/service/consensus/consensus_api.c b/src/contrib/service/consensus/consensus_api.c
new file mode 100644
index 000000000..01d0ad3de
--- /dev/null
+++ b/src/contrib/service/consensus/consensus_api.c
@@ -0,0 +1,346 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file consensus/consensus_api.c
+ * @brief
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_consensus_service.h"
+#include "consensus.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "consensus-api", __VA_ARGS__)
+
+
+/**
+ * Handle for the service.
+ */
+struct GNUNET_CONSENSUS_Handle
+{
+  /**
+   * Configuration to use.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Callback for new elements. Not called for elements added locally.
+   */
+  GNUNET_CONSENSUS_ElementCallback new_element_cb;
+
+  /**
+   * Closure for @e new_element_cb
+   */
+  void *new_element_cls;
+
+  /**
+   * The (local) session identifier for the consensus session.
+   */
+  struct GNUNET_HashCode session_id;
+
+  /**
+   * #GNUNET_YES iff the join message has been sent to the service.
+   */
+  int joined;
+
+  /**
+   * Called when the conclude operation finishes or fails.
+   */
+  GNUNET_CONSENSUS_ConcludeCallback conclude_cb;
+
+  /**
+   * Closure for the @e conclude_cb callback.
+   */
+  void *conclude_cls;
+
+  /**
+   * Deadline for the conclude operation.
+   */
+  struct GNUNET_TIME_Absolute conclude_deadline;
+
+  /**
+   * Message queue for the client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+};
+
+
+/**
+ * FIXME: this should not bee necessary when the API
+ * issue has been fixed
+ */
+struct InsertDoneInfo
+{
+  GNUNET_CONSENSUS_InsertDoneCallback idc;
+  void *cls;
+};
+
+
+/**
+ * Called when the server has sent is a new element
+ *
+ * @param cls consensus handle
+ * @param msg element message
+ */
+static int
+check_new_element (void *cls,
+                   const struct GNUNET_CONSENSUS_ElementMessage *msg)
+{
+  /* any size is fine, elements are variable-size */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Called when the server has sent is a new element
+ *
+ * @param cls consensus handle
+ * @param msg element message
+ */
+static void
+handle_new_element (void *cls,
+                    const struct GNUNET_CONSENSUS_ElementMessage *msg)
+{
+  struct GNUNET_CONSENSUS_Handle *consensus = cls;
+  struct GNUNET_SET_Element element;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "received new element\n");
+  element.element_type = msg->element_type;
+  element.size = ntohs (msg->header.size) - sizeof(struct
+                                                   GNUNET_CONSENSUS_ElementMessage);
+  element.data = &msg[1];
+  consensus->new_element_cb (consensus->new_element_cls,
+                             &element);
+}
+
+
+/**
+ * Called when the server has announced
+ * that the conclusion is over.
+ *
+ * @param cls consensus handle
+ * @param msg conclude done message
+ */
+static void
+handle_conclude_done (void *cls,
+                      const struct GNUNET_MessageHeader *msg)
+{
+  struct GNUNET_CONSENSUS_Handle *consensus = cls;
+  GNUNET_CONSENSUS_ConcludeCallback cc;
+
+  GNUNET_MQ_destroy (consensus->mq);
+  consensus->mq = NULL;
+  GNUNET_assert (NULL != (cc = consensus->conclude_cb));
+  consensus->conclude_cb = NULL;
+  cc (consensus->conclude_cls);
+}
+
+
+/**
+ * Generic error handler, called with the appropriate
+ * error code and the same closure specified at the creation of
+ * the message queue.
+ * Not every message queue implementation supports an error handler.
+ *
+ * @param cls closure, same closure as for the message handlers
+ * @param error error code
+ */
+static void
+mq_error_handler (void *cls,
+                  enum GNUNET_MQ_Error error)
+{
+  LOG (GNUNET_ERROR_TYPE_WARNING,
+       "consensus service disconnected us\n");
+}
+
+
+/**
+ * Create a consensus session.
+ *
+ * @param cfg configuration to use for connecting to the consensus service
+ * @param num_peers number of peers in the peers array
+ * @param peers array of peers participating in this consensus session
+ *              Inclusion of the local peer is optional.
+ * @param session_id session identifier
+ *                   Allows a group of peers to have more than consensus session.
+ * @param start start time of the consensus, conclude should be called before
+ *              the start time.
+ * @param deadline time when the consensus should have concluded
+ * @param new_element_cb callback, called when a new element is added to the set by
+ *                    another peer
+ * @param new_element_cls closure for new_element
+ * @return handle to use, NULL on error
+ */
+struct GNUNET_CONSENSUS_Handle *
+GNUNET_CONSENSUS_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                         unsigned int num_peers,
+                         const struct GNUNET_PeerIdentity *peers,
+                         const struct GNUNET_HashCode *session_id,
+                         struct GNUNET_TIME_Absolute start,
+                         struct GNUNET_TIME_Absolute deadline,
+                         GNUNET_CONSENSUS_ElementCallback new_element_cb,
+                         void *new_element_cls)
+{
+  struct GNUNET_CONSENSUS_Handle *consensus
+    = GNUNET_new (struct GNUNET_CONSENSUS_Handle);
+  struct GNUNET_MQ_MessageHandler mq_handlers[] = {
+    GNUNET_MQ_hd_var_size (new_element,
+                           GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_RECEIVED_ELEMENT,
+                           struct GNUNET_CONSENSUS_ElementMessage,
+                           consensus),
+    GNUNET_MQ_hd_fixed_size (conclude_done,
+                             GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_CONCLUDE_DONE,
+                             struct GNUNET_MessageHeader,
+                             consensus),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_CONSENSUS_JoinMessage *join_msg;
+  struct GNUNET_MQ_Envelope *ev;
+
+  consensus->cfg = cfg;
+  consensus->new_element_cb = new_element_cb;
+  consensus->new_element_cls = new_element_cls;
+  consensus->session_id = *session_id;
+  consensus->mq = GNUNET_CLIENT_connect (cfg,
+                                         "consensus",
+                                         mq_handlers,
+                                         &mq_error_handler,
+                                         consensus);
+  if (NULL == consensus->mq)
+  {
+    GNUNET_free (consensus);
+    return NULL;
+  }
+  ev = GNUNET_MQ_msg_extra (join_msg,
+                            (num_peers * sizeof(struct GNUNET_PeerIdentity)),
+                            GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_JOIN);
+
+  join_msg->session_id = consensus->session_id;
+  join_msg->start = GNUNET_TIME_absolute_hton (start);
+  join_msg->deadline = GNUNET_TIME_absolute_hton (deadline);
+  join_msg->num_peers = htonl (num_peers);
+  GNUNET_memcpy (&join_msg[1],
+                 peers,
+                 num_peers * sizeof(struct GNUNET_PeerIdentity));
+
+  GNUNET_MQ_send (consensus->mq, ev);
+  return consensus;
+}
+
+
+static void
+idc_adapter (void *cls)
+{
+  struct InsertDoneInfo *i = cls;
+
+  i->idc (i->cls, GNUNET_OK);
+  GNUNET_free (i);
+}
+
+
+/**
+ * Insert an element in the set being reconsiled.  Must not be called after
+ * "GNUNET_CONSENSUS_conclude".
+ *
+ * @param consensus handle for the consensus session
+ * @param element the element to be inserted
+ * @param idc function called when we are done with this element and it
+ *            is thus allowed to call GNUNET_CONSENSUS_insert again
+ * @param idc_cls closure for 'idc'
+ */
+void
+GNUNET_CONSENSUS_insert (struct GNUNET_CONSENSUS_Handle *consensus,
+                         const struct GNUNET_SET_Element *element,
+                         GNUNET_CONSENSUS_InsertDoneCallback idc,
+                         void *idc_cls)
+{
+  struct GNUNET_CONSENSUS_ElementMessage *element_msg;
+  struct GNUNET_MQ_Envelope *ev;
+  struct InsertDoneInfo *i;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG, "inserting, size=%u\n", element->size);
+
+  ev = GNUNET_MQ_msg_extra (element_msg, element->size,
+                            GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_INSERT);
+
+  GNUNET_memcpy (&element_msg[1], element->data, element->size);
+
+  if (NULL != idc)
+  {
+    i = GNUNET_new (struct InsertDoneInfo);
+    i->idc = idc;
+    i->cls = idc_cls;
+    GNUNET_MQ_notify_sent (ev, idc_adapter, i);
+  }
+  GNUNET_MQ_send (consensus->mq, ev);
+}
+
+
+/**
+ * We are done with inserting new elements into the consensus;
+ * try to conclude the consensus within a given time window.
+ * After conclude has been called, no further elements may be
+ * inserted by the client.
+ *
+ * @param consensus consensus session
+ * @param conclude called when the conclusion was successful
+ * @param conclude_cls closure for the conclude callback
+ */
+void
+GNUNET_CONSENSUS_conclude (struct GNUNET_CONSENSUS_Handle *consensus,
+                           GNUNET_CONSENSUS_ConcludeCallback conclude,
+                           void *conclude_cls)
+{
+  struct GNUNET_MQ_Envelope *ev;
+
+  GNUNET_assert (NULL != conclude);
+  GNUNET_assert (NULL == consensus->conclude_cb);
+
+  consensus->conclude_cls = conclude_cls;
+  consensus->conclude_cb = conclude;
+
+  ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_CONCLUDE);
+  GNUNET_MQ_send (consensus->mq, ev);
+}
+
+
+/**
+ * Destroy a consensus handle (free all state associated with
+ * it, no longer call any of the callbacks).
+ *
+ * @param consensus handle to destroy
+ */
+void
+GNUNET_CONSENSUS_destroy (struct GNUNET_CONSENSUS_Handle *consensus)
+{
+  if (NULL != consensus->mq)
+  {
+    GNUNET_MQ_destroy (consensus->mq);
+    consensus->mq = NULL;
+  }
+  GNUNET_free (consensus);
+}
+
+
+/* end of consensus_api.c */
diff --git a/src/contrib/service/consensus/consensus_protocol.h b/src/contrib/service/consensus/consensus_protocol.h
new file mode 100644
index 000000000..0afd56b27
--- /dev/null
+++ b/src/contrib/service/consensus/consensus_protocol.h
@@ -0,0 +1,137 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+
+/**
+ * @file consensus/consensus_protocol.h
+ * @brief p2p message definitions for consensus
+ * @author Florian Dold
+ */
+
+#ifndef GNUNET_CONSENSUS_PROTOCOL_H
+#define GNUNET_CONSENSUS_PROTOCOL_H
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_common.h"
+#include "gnunet_protocols.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Sent as context message for set reconciliation.
+ *
+ * Essentially contains all the fields
+ * from 'struct TaskKey', but in NBO.
+ */
+struct GNUNET_CONSENSUS_RoundContextMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_CONSENSUS_P2P_ROUND_CONTEXT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * A value from 'enum PhaseKind'.
+   */
+  uint16_t kind GNUNET_PACKED;
+
+  /**
+   * Number of the first peer
+   * in canonical order.
+   */
+  int16_t peer1 GNUNET_PACKED;
+
+  /**
+   * Number of the second peer in canonical order.
+   */
+  int16_t peer2 GNUNET_PACKED;
+
+  /**
+   * Repetition of the gradecast phase.
+   */
+  int16_t repetition GNUNET_PACKED;
+
+  /**
+   * Leader in the gradecast phase.
+   *
+   * Can be different from both peer1 and peer2.
+   */
+  int16_t leader GNUNET_PACKED;
+
+  /**
+   * Non-zero if this set reconciliation
+   * had elements removed because they were contested.
+   *
+   * Will be considered when grading broadcasts.
+   *
+   * Ignored for set operations that are not within gradecasts.
+   */
+  uint16_t is_contested GNUNET_PACKED;
+};
+
+
+enum
+{
+  CONSENSUS_MARKER_CONTESTED = 1,
+  CONSENSUS_MARKER_SIZE = 2,
+};
+
+
+/**
+ * Consensus element, either marker or payload.
+ */
+struct ConsensusElement
+{
+  /**
+   * Payload element_type, only valid
+   * if this is not a marker element.
+   */
+  uint16_t payload_type GNUNET_PACKED;
+
+  /**
+   * Is this a marker element?
+   */
+  uint8_t marker;
+
+  /* rest: element data */
+};
+
+
+struct ConsensusSizeElement
+{
+  struct ConsensusElement ce;
+
+  uint64_t size GNUNET_PACKED;
+  uint8_t sender_index;
+};
+
+
+struct ConsensusStuffedElement
+{
+  struct ConsensusElement ce;
+  struct GNUNET_HashCode rand GNUNET_PACKED;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/contrib/service/consensus/gnunet-service-consensus.c b/src/contrib/service/consensus/gnunet-service-consensus.c
new file mode 100644
index 000000000..5b6b9bbd7
--- /dev/null
+++ b/src/contrib/service/consensus/gnunet-service-consensus.c
@@ -0,0 +1,3572 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012, 2013, 2017, 2020 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file consensus/gnunet-service-consensus.c
+ * @brief multi-peer set reconciliation
+ * @author Florian Dold <flo@dold.me>
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_block_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_applications.h"
+#include "gnunet_set_service.h"
+#include "gnunet_statistics_service.h"
+#include "gnunet_consensus_service.h"
+#include "consensus_protocol.h"
+#include "consensus.h"
+
+
+enum ReferendumVote
+{
+  /**
+   * Vote that nothing should change.
+   * This option is never voted explicitly.
+   */
+  VOTE_STAY = 0,
+  /**
+   * Vote that an element should be added.
+   */
+  VOTE_ADD = 1,
+  /**
+   * Vote that an element should be removed.
+   */
+  VOTE_REMOVE = 2,
+};
+
+
+enum EarlyStoppingPhase
+{
+  EARLY_STOPPING_NONE = 0,
+  EARLY_STOPPING_ONE_MORE = 1,
+  EARLY_STOPPING_DONE = 2,
+};
+
+
+enum PhaseKind
+{
+  PHASE_KIND_ALL_TO_ALL,
+  PHASE_KIND_ALL_TO_ALL_2,
+  PHASE_KIND_GRADECAST_LEADER,
+  PHASE_KIND_GRADECAST_ECHO,
+  PHASE_KIND_GRADECAST_ECHO_GRADE,
+  PHASE_KIND_GRADECAST_CONFIRM,
+  PHASE_KIND_GRADECAST_CONFIRM_GRADE,
+  /**
+   * Apply a repetition of the all-to-all
+   * gradecast to the current set.
+   */
+  PHASE_KIND_APPLY_REP,
+  PHASE_KIND_FINISH,
+};
+
+
+enum SetKind
+{
+  SET_KIND_NONE = 0,
+  SET_KIND_CURRENT,
+  /**
+   * Last result set from a gradecast
+   */
+  SET_KIND_LAST_GRADECAST,
+  SET_KIND_LEADER_PROPOSAL,
+  SET_KIND_ECHO_RESULT,
+};
+
+enum DiffKind
+{
+  DIFF_KIND_NONE = 0,
+  DIFF_KIND_LEADER_PROPOSAL,
+  DIFF_KIND_LEADER_CONSENSUS,
+  DIFF_KIND_GRADECAST_RESULT,
+};
+
+enum RfnKind
+{
+  RFN_KIND_NONE = 0,
+  RFN_KIND_ECHO,
+  RFN_KIND_CONFIRM,
+  RFN_KIND_GRADECAST_RESULT
+};
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Tuple of integers that together identify a task uniquely.
+ */
+struct TaskKey
+{
+  /**
+   * A value from 'enum PhaseKind'.
+   */
+  uint16_t kind GNUNET_PACKED;
+
+  /**
+   * Number of the first peer
+   * in canonical order.
+   */
+  int16_t peer1 GNUNET_PACKED;
+
+  /**
+   * Number of the second peer in canonical order.
+   */
+  int16_t peer2 GNUNET_PACKED;
+
+  /**
+   * Repetition of the gradecast phase.
+   */
+  int16_t repetition GNUNET_PACKED;
+
+  /**
+   * Leader in the gradecast phase.
+   *
+   * Can be different from both peer1 and peer2.
+   */
+  int16_t leader GNUNET_PACKED;
+};
+
+
+struct SetKey
+{
+  enum SetKind set_kind GNUNET_PACKED;
+  /**
+   * Repetition counter.
+   */
+  int k1 GNUNET_PACKED;
+  /**
+   * Leader (or 0).
+   */
+  int k2 GNUNET_PACKED;
+};
+
+
+struct SetEntry
+{
+  struct SetKey key;
+  struct GNUNET_SET_Handle *h;
+
+  /**
+   * #GNUNET_YES if the set resulted from applying a referendum with contested
+   * elements.
+   */
+  int is_contested;
+};
+
+
+struct DiffKey
+{
+  enum DiffKind diff_kind GNUNET_PACKED;
+
+  int k1 GNUNET_PACKED;
+
+  int k2 GNUNET_PACKED;
+};
+
+struct RfnKey
+{
+  enum RfnKind rfn_kind GNUNET_PACKED;
+  int k1 GNUNET_PACKED;
+  int k2 GNUNET_PACKED;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+
+struct SetOpCls
+{
+  struct SetKey input_set;
+
+  struct SetKey output_set;
+  struct RfnKey output_rfn;
+  struct DiffKey output_diff;
+
+  int do_not_remove;
+
+  int transceive_contested;
+
+  struct GNUNET_SET_OperationHandle *op;
+};
+
+
+struct FinishCls
+{
+  struct SetKey input_set;
+};
+
+/**
+ * Closure for both @a start_task
+ * and @a cancel_task.
+ */
+union TaskFuncCls
+{
+  struct SetOpCls setop;
+  struct FinishCls finish;
+};
+
+
+struct TaskEntry;
+
+
+typedef void
+(*TaskFunc) (struct TaskEntry *task);
+
+
+/*
+ * Node in the consensus task graph.
+ */
+struct TaskEntry
+{
+  struct TaskKey key;
+
+  struct Step *step;
+
+  int is_started;
+
+  int is_finished;
+
+  TaskFunc start;
+  TaskFunc cancel;
+
+  union TaskFuncCls cls;
+};
+
+
+struct Step
+{
+  /**
+   * All steps of one session are in a
+   * linked list for easier deallocation.
+   */
+  struct Step *prev;
+
+  /**
+   * All steps of one session are in a
+   * linked list for easier deallocation.
+   */
+  struct Step *next;
+
+  struct ConsensusSession *session;
+
+  /**
+   * Tasks that this step is composed of.
+   */
+  struct TaskEntry **tasks;
+  unsigned int tasks_len;
+  unsigned int tasks_cap;
+
+  unsigned int finished_tasks;
+
+  /*
+   * Tasks that have this task as dependency.
+   *
+   * We store pointers to subordinates rather
+   * than to prerequisites since it makes
+   * tracking the readiness of a task easier.
+   */
+  struct Step **subordinates;
+  unsigned int subordinates_len;
+  unsigned int subordinates_cap;
+
+  /**
+   * Counter for the prerequisites of this step.
+   */
+  size_t pending_prereq;
+
+  /**
+   * Task that will run this step despite any pending prerequisites.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  unsigned int is_running;
+
+  unsigned int is_finished;
+
+  /**
+   * Synchrony round of the task.  Determines the deadline for the task.
+   */
+  unsigned int round;
+
+  /**
+   * Human-readable name for the task, used for debugging.
+   */
+  char *debug_name;
+
+  /**
+   * When we're doing an early finish, how should this step be treated?  If
+   * #GNUNET_YES, the step will be marked as finished without actually running
+   * its tasks.  Otherwise, the step will still be run even after an early
+   * finish.
+   *
+   * Note that a task may never be finished early if it is already running.
+   */
+  int early_finishable;
+};
+
+
+struct RfnElementInfo
+{
+  const struct GNUNET_SET_Element *element;
+
+  /**
+   * #GNUNET_YES if the peer votes for the proposal.
+   */
+  int *votes;
+
+  /**
+   * Proposal for this element, can only be #VOTE_ADD or #VOTE_REMOVE.
+   */
+  enum ReferendumVote proposal;
+};
+
+
+struct ReferendumEntry
+{
+  struct RfnKey key;
+
+  /*
+   * Elements where there is at least one proposed change.
+   *
+   * Maps the hash of the GNUNET_SET_Element
+   * to 'struct RfnElementInfo'.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *rfn_elements;
+
+  unsigned int num_peers;
+
+  /**
+   * Stores, for every peer in the session,
+   * whether the peer finished the whole referendum.
+   *
+   * Votes from peers are only counted if they're
+   * marked as committed (#GNUNET_YES) in the referendum.
+   *
+   * Otherwise (#GNUNET_NO), the requested changes are
+   * not counted for majority votes or thresholds.
+   */
+  int *peer_commited;
+
+
+  /**
+   * Contestation state of the peer.  If a peer is contested, the values it
+   * contributed are still counted for applying changes, but the grading is
+   * affected.
+   */
+  int *peer_contested;
+};
+
+
+struct DiffElementInfo
+{
+  const struct GNUNET_SET_Element *element;
+
+  /**
+   * Positive weight for 'add', negative
+   * weights for 'remove'.
+   */
+  int weight;
+};
+
+
+/**
+ * Weighted diff.
+ */
+struct DiffEntry
+{
+  struct DiffKey key;
+  struct GNUNET_CONTAINER_MultiHashMap *changes;
+};
+
+struct SetHandle
+{
+  struct SetHandle *prev;
+  struct SetHandle *next;
+
+  struct GNUNET_SET_Handle *h;
+};
+
+
+/**
+ * A consensus session consists of one local client and the remote authorities.
+ */
+struct ConsensusSession
+{
+  /**
+   * Consensus sessions are kept in a DLL.
+   */
+  struct ConsensusSession *next;
+
+  /**
+   * Consensus sessions are kept in a DLL.
+   */
+  struct ConsensusSession *prev;
+
+  unsigned int num_client_insert_pending;
+
+  struct GNUNET_CONTAINER_MultiHashMap *setmap;
+  struct GNUNET_CONTAINER_MultiHashMap *rfnmap;
+  struct GNUNET_CONTAINER_MultiHashMap *diffmap;
+
+  /**
+   * Array of peers with length 'num_peers'.
+   */
+  int *peers_blacklisted;
+
+  /*
+   * Mapping from (hashed) TaskKey to TaskEntry.
+   *
+   * We map the application_id for a round to the task that should be
+   * executed, so we don't have to go through all task whenever we get
+   * an incoming set op request.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *taskmap;
+
+  struct Step *steps_head;
+  struct Step *steps_tail;
+
+  int conclude_started;
+
+  int conclude_done;
+
+  /**
+   * Global consensus identification, computed
+   * from the session id and participating authorities.
+   */
+  struct GNUNET_HashCode global_id;
+
+  /**
+   * Client that inhabits the session
+   */
+  struct GNUNET_SERVICE_Client *client;
+
+  /**
+   * Queued messages to the client.
+   */
+  struct GNUNET_MQ_Handle *client_mq;
+
+  /**
+   * Time when the conclusion of the consensus should begin.
+   */
+  struct GNUNET_TIME_Absolute conclude_start;
+
+  /**
+   * Timeout for all rounds together, single rounds will schedule a timeout task
+   * with a fraction of the conclude timeout.
+   * Only valid once the current round is not CONSENSUS_ROUND_BEGIN.
+   */
+  struct GNUNET_TIME_Absolute conclude_deadline;
+
+  struct GNUNET_PeerIdentity *peers;
+
+  /**
+   * Number of other peers in the consensus.
+   */
+  unsigned int num_peers;
+
+  /**
+   * Index of the local peer in the peers array
+   */
+  unsigned int local_peer_idx;
+
+  /**
+   * Listener for requests from other peers.
+   * Uses the session's global id as app id.
+   */
+  struct GNUNET_SET_ListenHandle *set_listener;
+
+  /**
+   * State of our early stopping scheme.
+   */
+  int early_stopping;
+
+  /**
+   * Our set size from the first round.
+   */
+  uint64_t first_size;
+
+  uint64_t *first_sizes_received;
+
+  /**
+   * Bounded Eppstein lower bound.
+   */
+  uint64_t lower_bound;
+
+  struct SetHandle *set_handles_head;
+  struct SetHandle *set_handles_tail;
+};
+
+/**
+ * Linked list of sessions this peer participates in.
+ */
+static struct ConsensusSession *sessions_head;
+
+/**
+ * Linked list of sessions this peer participates in.
+ */
+static struct ConsensusSession *sessions_tail;
+
+/**
+ * Configuration of the consensus service.
+ */
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+/**
+ * Peer that runs this service.
+ */
+static struct GNUNET_PeerIdentity my_peer;
+
+/**
+ * Statistics handle.
+ */
+struct GNUNET_STATISTICS_Handle *statistics;
+
+
+static void
+finish_task (struct TaskEntry *task);
+
+
+static void
+run_ready_steps (struct ConsensusSession *session);
+
+
+static const char *
+phasename (uint16_t phase)
+{
+  switch (phase)
+  {
+  case PHASE_KIND_ALL_TO_ALL: return "ALL_TO_ALL";
+
+  case PHASE_KIND_ALL_TO_ALL_2: return "ALL_TO_ALL_2";
+
+  case PHASE_KIND_FINISH: return "FINISH";
+
+  case PHASE_KIND_GRADECAST_LEADER: return "GRADECAST_LEADER";
+
+  case PHASE_KIND_GRADECAST_ECHO: return "GRADECAST_ECHO";
+
+  case PHASE_KIND_GRADECAST_ECHO_GRADE: return "GRADECAST_ECHO_GRADE";
+
+  case PHASE_KIND_GRADECAST_CONFIRM: return "GRADECAST_CONFIRM";
+
+  case PHASE_KIND_GRADECAST_CONFIRM_GRADE: return "GRADECAST_CONFIRM_GRADE";
+
+  case PHASE_KIND_APPLY_REP: return "APPLY_REP";
+
+  default: return "(unknown)";
+  }
+}
+
+
+static const char *
+setname (uint16_t kind)
+{
+  switch (kind)
+  {
+  case SET_KIND_CURRENT: return "CURRENT";
+
+  case SET_KIND_LEADER_PROPOSAL: return "LEADER_PROPOSAL";
+
+  case SET_KIND_NONE: return "NONE";
+
+  default: return "(unknown)";
+  }
+}
+
+
+static const char *
+rfnname (uint16_t kind)
+{
+  switch (kind)
+  {
+  case RFN_KIND_NONE: return "NONE";
+
+  case RFN_KIND_ECHO: return "ECHO";
+
+  case RFN_KIND_CONFIRM: return "CONFIRM";
+
+  default: return "(unknown)";
+  }
+}
+
+
+static const char *
+diffname (uint16_t kind)
+{
+  switch (kind)
+  {
+  case DIFF_KIND_NONE: return "NONE";
+
+  case DIFF_KIND_LEADER_CONSENSUS: return "LEADER_CONSENSUS";
+
+  case DIFF_KIND_GRADECAST_RESULT: return "GRADECAST_RESULT";
+
+  case DIFF_KIND_LEADER_PROPOSAL: return "LEADER_PROPOSAL";
+
+  default: return "(unknown)";
+  }
+}
+
+
+#ifdef GNUNET_EXTRA_LOGGING
+
+
+static const char *
+debug_str_element (const struct GNUNET_SET_Element *el)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_SET_element_hash (el, &hash);
+
+  return GNUNET_h2s (&hash);
+}
+
+
+static const char *
+debug_str_task_key (const struct TaskKey *tk)
+{
+  static char buf[256];
+
+  snprintf (buf, sizeof(buf),
+            "TaskKey kind=%s, p1=%d, p2=%d, l=%d, rep=%d",
+            phasename (tk->kind), tk->peer1, tk->peer2,
+            tk->leader, tk->repetition);
+
+  return buf;
+}
+
+
+static const char *
+debug_str_diff_key (const struct DiffKey *dk)
+{
+  static char buf[256];
+
+  snprintf (buf, sizeof(buf),
+            "DiffKey kind=%s, k1=%d, k2=%d",
+            diffname (dk->diff_kind), dk->k1, dk->k2);
+
+  return buf;
+}
+
+
+static const char *
+debug_str_set_key (const struct SetKey *sk)
+{
+  static char buf[256];
+
+  snprintf (buf, sizeof(buf),
+            "SetKey kind=%s, k1=%d, k2=%d",
+            setname (sk->set_kind),
+            sk->k1,
+            sk->k2);
+  return buf;
+}
+
+
+static const char *
+debug_str_rfn_key (const struct RfnKey *rk)
+{
+  static char buf[256];
+
+  snprintf (buf, sizeof(buf),
+            "RfnKey kind=%s, k1=%d, k2=%d",
+            rfnname (rk->rfn_kind),
+            rk->k1,
+            rk->k2);
+  return buf;
+}
+
+
+#endif /* GNUNET_EXTRA_LOGGING */
+
+
+/**
+ * Send the final result set of the consensus to the client, element by
+ * element.
+ *
+ * @param cls closure
+ * @param element the current element, NULL if all elements have been
+ *        iterated over
+ * @return #GNUNET_YES to continue iterating, #GNUNET_NO to stop.
+ */
+static int
+send_to_client_iter (void *cls,
+                     const struct GNUNET_SET_Element *element)
+{
+  struct TaskEntry *task = (struct TaskEntry *) cls;
+  struct ConsensusSession *session = task->step->session;
+  struct GNUNET_MQ_Envelope *ev;
+
+  if (NULL != element)
+  {
+    struct GNUNET_CONSENSUS_ElementMessage *m;
+    const struct ConsensusElement *ce;
+
+    GNUNET_assert (GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT ==
+                   element->element_type);
+    ce = element->data;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "marker is %u\n",
+                (unsigned) ce->marker);
+
+    if (0 != ce->marker)
+      return GNUNET_YES;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%d: sending element %s to client\n",
+                session->local_peer_idx,
+                debug_str_element (element));
+
+    ev = GNUNET_MQ_msg_extra (m,
+                              element->size - sizeof(struct ConsensusElement),
+                              GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_RECEIVED_ELEMENT);
+    m->element_type = ce->payload_type;
+    GNUNET_memcpy (&m[1],
+                   &ce[1],
+                   element->size - sizeof(struct ConsensusElement));
+    GNUNET_MQ_send (session->client_mq,
+                    ev);
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%d: finished iterating elements for client\n",
+                session->local_peer_idx);
+    ev = GNUNET_MQ_msg_header (
+      GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_CONCLUDE_DONE);
+    GNUNET_MQ_send (session->client_mq,
+                    ev);
+  }
+  return GNUNET_YES;
+}
+
+
+static struct SetEntry *
+lookup_set (struct ConsensusSession *session,
+            const struct SetKey *key)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: looking up set {%s}\n",
+              session->local_peer_idx,
+              debug_str_set_key (key));
+
+  GNUNET_assert (SET_KIND_NONE != key->set_kind);
+  GNUNET_CRYPTO_hash (key,
+                      sizeof(struct SetKey),
+                      &hash);
+  return GNUNET_CONTAINER_multihashmap_get (session->setmap,
+                                            &hash);
+}
+
+
+static struct DiffEntry *
+lookup_diff (struct ConsensusSession *session,
+             const struct DiffKey *key)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: looking up diff {%s}\n",
+              session->local_peer_idx,
+              debug_str_diff_key (key));
+  GNUNET_assert (DIFF_KIND_NONE != key->diff_kind);
+  GNUNET_CRYPTO_hash (key,
+                      sizeof(struct DiffKey),
+                      &hash);
+  return GNUNET_CONTAINER_multihashmap_get (session->diffmap,
+                                            &hash);
+}
+
+
+static struct ReferendumEntry *
+lookup_rfn (struct ConsensusSession *session,
+            const struct RfnKey *key)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: looking up rfn {%s}\n",
+              session->local_peer_idx,
+              debug_str_rfn_key (key));
+  GNUNET_assert (RFN_KIND_NONE != key->rfn_kind);
+  GNUNET_CRYPTO_hash (key,
+                      sizeof(struct RfnKey),
+                      &hash);
+  return GNUNET_CONTAINER_multihashmap_get (session->rfnmap,
+                                            &hash);
+}
+
+
+static void
+diff_insert (struct DiffEntry *diff,
+             int weight,
+             const struct GNUNET_SET_Element *element)
+{
+  struct DiffElementInfo *di;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert ((1 == weight) || (-1 == weight));
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "diff_insert with element size %u\n",
+              element->size);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "hashing element\n");
+
+  GNUNET_SET_element_hash (element, &hash);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "hashed element\n");
+
+  di = GNUNET_CONTAINER_multihashmap_get (diff->changes, &hash);
+
+  if (NULL == di)
+  {
+    di = GNUNET_new (struct DiffElementInfo);
+    di->element = GNUNET_SET_element_dup (element);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multihashmap_put (diff->changes,
+                                                      &hash,
+                                                      di,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST));
+  }
+
+  di->weight = weight;
+}
+
+
+static void
+rfn_commit (struct ReferendumEntry *rfn,
+            uint16_t commit_peer)
+{
+  GNUNET_assert (commit_peer < rfn->num_peers);
+
+  rfn->peer_commited[commit_peer] = GNUNET_YES;
+}
+
+
+static void
+rfn_contest (struct ReferendumEntry *rfn,
+             uint16_t contested_peer)
+{
+  GNUNET_assert (contested_peer < rfn->num_peers);
+
+  rfn->peer_contested[contested_peer] = GNUNET_YES;
+}
+
+
+static uint16_t
+rfn_noncontested (struct ReferendumEntry *rfn)
+{
+  uint16_t ret;
+
+  ret = 0;
+  for (uint16_t i = 0; i < rfn->num_peers; i++)
+    if ((GNUNET_YES == rfn->peer_commited[i]) && (GNUNET_NO ==
+                                                  rfn->peer_contested[i]))
+      ret++;
+
+  return ret;
+}
+
+
+static void
+rfn_vote (struct ReferendumEntry *rfn,
+          uint16_t voting_peer,
+          enum ReferendumVote vote,
+          const struct GNUNET_SET_Element *element)
+{
+  struct RfnElementInfo *ri;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert (voting_peer < rfn->num_peers);
+
+  /* Explicit voting only makes sense with VOTE_ADD or VOTE_REMOTE,
+     since VOTE_KEEP is implicit in not voting. */
+  GNUNET_assert ((VOTE_ADD == vote) || (VOTE_REMOVE == vote));
+
+  GNUNET_SET_element_hash (element, &hash);
+  ri = GNUNET_CONTAINER_multihashmap_get (rfn->rfn_elements, &hash);
+
+  if (NULL == ri)
+  {
+    ri = GNUNET_new (struct RfnElementInfo);
+    ri->element = GNUNET_SET_element_dup (element);
+    ri->votes = GNUNET_new_array (rfn->num_peers, int);
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multihashmap_put (rfn->rfn_elements,
+                                                      &hash, ri,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST));
+  }
+
+  ri->votes[voting_peer] = GNUNET_YES;
+  ri->proposal = vote;
+}
+
+
+static uint16_t
+task_other_peer (struct TaskEntry *task)
+{
+  uint16_t me = task->step->session->local_peer_idx;
+
+  if (task->key.peer1 == me)
+    return task->key.peer2;
+  return task->key.peer1;
+}
+
+
+static int
+cmp_uint64_t (const void *pa, const void *pb)
+{
+  uint64_t a = *(uint64_t *) pa;
+  uint64_t b = *(uint64_t *) pb;
+
+  if (a == b)
+    return 0;
+  if (a < b)
+    return -1;
+  return 1;
+}
+
+
+/**
+ * Callback for set operation results. Called for each element
+ * in the result set.
+ *
+ * @param cls closure
+ * @param element a result element, only valid if status is #GNUNET_SET_STATUS_OK
+ * @param current_size current set size
+ * @param status see enum GNUNET_SET_Status
+ */
+static void
+set_result_cb (void *cls,
+               const struct GNUNET_SET_Element *element,
+               uint64_t current_size,
+               enum GNUNET_SET_Status status)
+{
+  struct TaskEntry *task = cls;
+  struct ConsensusSession *session = task->step->session;
+  struct SetEntry *output_set = NULL;
+  struct DiffEntry *output_diff = NULL;
+  struct ReferendumEntry *output_rfn = NULL;
+  unsigned int other_idx;
+  struct SetOpCls *setop;
+  const struct ConsensusElement *consensus_element = NULL;
+
+  if (NULL != element)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: got element of type %u, status %u\n",
+                session->local_peer_idx,
+                (unsigned) element->element_type,
+                (unsigned) status);
+    GNUNET_assert (GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT ==
+                   element->element_type);
+    consensus_element = element->data;
+  }
+
+  setop = &task->cls.setop;
+
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: got set result for {%s}, status %u\n",
+              session->local_peer_idx,
+              debug_str_task_key (&task->key),
+              status);
+
+  if (GNUNET_NO == task->is_started)
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  if (GNUNET_YES == task->is_finished)
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  other_idx = task_other_peer (task);
+
+  if (SET_KIND_NONE != setop->output_set.set_kind)
+  {
+    output_set = lookup_set (session,
+                             &setop->output_set);
+    GNUNET_assert (NULL != output_set);
+  }
+
+  if (DIFF_KIND_NONE != setop->output_diff.diff_kind)
+  {
+    output_diff = lookup_diff (session, &setop->output_diff);
+    GNUNET_assert (NULL != output_diff);
+  }
+
+  if (RFN_KIND_NONE != setop->output_rfn.rfn_kind)
+  {
+    output_rfn = lookup_rfn (session, &setop->output_rfn);
+    GNUNET_assert (NULL != output_rfn);
+  }
+
+  if (GNUNET_YES == session->peers_blacklisted[other_idx])
+  {
+    /* Peer might have been blacklisted
+       by a gradecast running in parallel, ignore elements from now */
+    if (GNUNET_SET_STATUS_ADD_LOCAL == status)
+      return;
+    if (GNUNET_SET_STATUS_ADD_REMOTE == status)
+      return;
+  }
+
+  if ((NULL != consensus_element) && (0 != consensus_element->marker))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: got some marker\n",
+                session->local_peer_idx);
+    if ((GNUNET_YES == setop->transceive_contested) &&
+        (CONSENSUS_MARKER_CONTESTED == consensus_element->marker))
+    {
+      GNUNET_assert (NULL != output_rfn);
+      rfn_contest (output_rfn, task_other_peer (task));
+      return;
+    }
+
+    if (CONSENSUS_MARKER_SIZE == consensus_element->marker)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: got size marker\n",
+                  session->local_peer_idx);
+
+
+      struct ConsensusSizeElement *cse = (void *) consensus_element;
+
+      if (cse->sender_index == other_idx)
+      {
+        if (NULL == session->first_sizes_received)
+          session->first_sizes_received = GNUNET_new_array (session->num_peers,
+                                                            uint64_t);
+        session->first_sizes_received[other_idx] = GNUNET_ntohll (cse->size);
+
+        uint64_t *copy = GNUNET_memdup (session->first_sizes_received,
+                                        sizeof(uint64_t) * session->num_peers);
+        qsort (copy, session->num_peers, sizeof(uint64_t), cmp_uint64_t);
+        session->lower_bound = copy[session->num_peers / 3 + 1];
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "P%u: lower bound %llu\n",
+                    session->local_peer_idx,
+                    (long long) session->lower_bound);
+        GNUNET_free (copy);
+      }
+      return;
+    }
+
+    return;
+  }
+
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_ADD_LOCAL:
+    GNUNET_assert (NULL != consensus_element);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Adding element in Task {%s}\n",
+                debug_str_task_key (&task->key));
+    if (NULL != output_set)
+    {
+      // FIXME: record pending adds, use callback
+      GNUNET_SET_add_element (output_set->h,
+                              element,
+                              NULL,
+                              NULL);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: adding element %s into set {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_set_key (&setop->output_set),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    if (NULL != output_diff)
+    {
+      diff_insert (output_diff, 1, element);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: adding element %s into diff {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_diff_key (&setop->output_diff),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    if (NULL != output_rfn)
+    {
+      rfn_vote (output_rfn, task_other_peer (task), VOTE_ADD, element);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: adding element %s into rfn {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_rfn_key (&setop->output_rfn),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    // XXX: add result to structures in task
+    break;
+
+  case GNUNET_SET_STATUS_ADD_REMOTE:
+    GNUNET_assert (NULL != consensus_element);
+    if (GNUNET_YES == setop->do_not_remove)
+      break;
+    if (CONSENSUS_MARKER_CONTESTED == consensus_element->marker)
+      break;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Removing element in Task {%s}\n",
+                debug_str_task_key (&task->key));
+    if (NULL != output_set)
+    {
+      // FIXME: record pending adds, use callback
+      GNUNET_SET_remove_element (output_set->h,
+                                 element,
+                                 NULL,
+                                 NULL);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: removing element %s from set {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_set_key (&setop->output_set),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    if (NULL != output_diff)
+    {
+      diff_insert (output_diff, -1, element);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: removing element %s from diff {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_diff_key (&setop->output_diff),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    if (NULL != output_rfn)
+    {
+      rfn_vote (output_rfn, task_other_peer (task), VOTE_REMOVE, element);
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: removing element %s from rfn {%s} of task {%s}\n",
+                  session->local_peer_idx,
+                  debug_str_element (element),
+                  debug_str_rfn_key (&setop->output_rfn),
+                  debug_str_task_key (&task->key));
+#endif
+    }
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    // XXX: check first if any changes to the underlying
+    // set are still pending
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: Finishing setop in Task {%s} (%u/%u)\n",
+                session->local_peer_idx,
+                debug_str_task_key (&task->key),
+                (unsigned int) task->step->finished_tasks,
+                (unsigned int) task->step->tasks_len);
+    if (NULL != output_rfn)
+    {
+      rfn_commit (output_rfn, task_other_peer (task));
+    }
+    if (PHASE_KIND_ALL_TO_ALL == task->key.kind)
+    {
+      session->first_size = current_size;
+    }
+    finish_task (task);
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    // XXX: cleanup
+    GNUNET_break_op (0);
+    finish_task (task);
+    return;
+
+  default:
+    /* not reached */
+    GNUNET_assert (0);
+  }
+}
+
+
+#ifdef EVIL
+
+enum EvilnessType
+{
+  EVILNESS_NONE,
+  EVILNESS_CRAM_ALL,
+  EVILNESS_CRAM_LEAD,
+  EVILNESS_CRAM_ECHO,
+  EVILNESS_SLACK,
+  EVILNESS_SLACK_A2A,
+};
+
+enum EvilnessSubType
+{
+  EVILNESS_SUB_NONE,
+  EVILNESS_SUB_REPLACEMENT,
+  EVILNESS_SUB_NO_REPLACEMENT,
+};
+
+struct Evilness
+{
+  enum EvilnessType type;
+  enum EvilnessSubType subtype;
+  unsigned int num;
+};
+
+
+static int
+parse_evilness_cram_subtype (const char *evil_subtype_str,
+                             struct Evilness *evil)
+{
+  if (0 == strcmp ("replace", evil_subtype_str))
+  {
+    evil->subtype = EVILNESS_SUB_REPLACEMENT;
+  }
+  else if (0 == strcmp ("noreplace", evil_subtype_str))
+  {
+    evil->subtype = EVILNESS_SUB_NO_REPLACEMENT;
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Malformed field '%s' in EVIL_SPEC (unknown subtype), behaving like a good peer.\n",
+                evil_subtype_str);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+static void
+get_evilness (struct ConsensusSession *session, struct Evilness *evil)
+{
+  char *evil_spec;
+  char *field;
+  char *evil_type_str = NULL;
+  char *evil_subtype_str = NULL;
+
+  GNUNET_assert (NULL != evil);
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg, "consensus",
+                                                          "EVIL_SPEC",
+                                                          &evil_spec))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: no evilness\n",
+                session->local_peer_idx);
+    evil->type = EVILNESS_NONE;
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: got evilness spec\n",
+              session->local_peer_idx);
+
+  for (field = strtok (evil_spec, "/");
+       NULL != field;
+       field = strtok (NULL, "/"))
+  {
+    unsigned int peer_num;
+    unsigned int evil_num;
+    int ret;
+
+    evil_type_str = NULL;
+    evil_subtype_str = NULL;
+
+    ret = sscanf (field, "%u;%m[a-z-];%m[a-z-];%u", &peer_num, &evil_type_str,
+                  &evil_subtype_str, &evil_num);
+
+    if (ret != 4)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Malformed field '%s' in EVIL_SPEC (expected 4 components got %d), behaving like a good peer.\n",
+                  field,
+                  ret);
+      goto not_evil;
+    }
+
+    GNUNET_assert (NULL != evil_type_str);
+    GNUNET_assert (NULL != evil_subtype_str);
+
+    if (peer_num == session->local_peer_idx)
+    {
+      if (0 == strcmp ("slack", evil_type_str))
+      {
+        evil->type = EVILNESS_SLACK;
+      }
+      if (0 == strcmp ("slack-a2a", evil_type_str))
+      {
+        evil->type = EVILNESS_SLACK_A2A;
+      }
+      else if (0 == strcmp ("cram-all", evil_type_str))
+      {
+        evil->type = EVILNESS_CRAM_ALL;
+        evil->num = evil_num;
+        if (GNUNET_OK != parse_evilness_cram_subtype (evil_subtype_str, evil))
+          goto not_evil;
+      }
+      else if (0 == strcmp ("cram-lead", evil_type_str))
+      {
+        evil->type = EVILNESS_CRAM_LEAD;
+        evil->num = evil_num;
+        if (GNUNET_OK != parse_evilness_cram_subtype (evil_subtype_str, evil))
+          goto not_evil;
+      }
+      else if (0 == strcmp ("cram-echo", evil_type_str))
+      {
+        evil->type = EVILNESS_CRAM_ECHO;
+        evil->num = evil_num;
+        if (GNUNET_OK != parse_evilness_cram_subtype (evil_subtype_str, evil))
+          goto not_evil;
+      }
+      else
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Malformed field '%s' in EVIL_SPEC (unknown type), behaving like a good peer.\n",
+                    evil_type_str);
+        goto not_evil;
+      }
+      goto cleanup;
+    }
+    /* No GNUNET_free since memory was allocated by libc */
+    free (evil_type_str);
+    evil_type_str = NULL;
+    evil_subtype_str = NULL;
+  }
+not_evil:
+  evil->type = EVILNESS_NONE;
+cleanup:
+  GNUNET_free (evil_spec);
+  /* no GNUNET_free since it wasn't
+   * allocated with GNUNET_malloc */
+  if (NULL != evil_type_str)
+    free (evil_type_str);
+  if (NULL != evil_subtype_str)
+    free (evil_subtype_str);
+}
+
+
+#endif
+
+
+/**
+ * Commit the appropriate set for a task.
+ */
+static void
+commit_set (struct ConsensusSession *session,
+            struct TaskEntry *task)
+{
+  struct SetEntry *set;
+  struct SetOpCls *setop = &task->cls.setop;
+
+  GNUNET_assert (NULL != setop->op);
+  set = lookup_set (session, &setop->input_set);
+  GNUNET_assert (NULL != set);
+
+  if ((GNUNET_YES == setop->transceive_contested) && (GNUNET_YES ==
+                                                      set->is_contested))
+  {
+    struct GNUNET_SET_Element element;
+    struct ConsensusElement ce = { 0 };
+
+    ce.marker = CONSENSUS_MARKER_CONTESTED;
+    element.data = &ce;
+    element.size = sizeof(struct ConsensusElement);
+    element.element_type = GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT;
+    GNUNET_SET_add_element (set->h, &element, NULL, NULL);
+  }
+
+  if (PHASE_KIND_ALL_TO_ALL_2 == task->key.kind)
+  {
+    struct GNUNET_SET_Element element;
+    struct ConsensusSizeElement cse = {
+      .size = 0,
+      .sender_index = 0
+    };
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "inserting size marker\n");
+    cse.ce.marker = CONSENSUS_MARKER_SIZE;
+    cse.size = GNUNET_htonll (session->first_size);
+    cse.sender_index = session->local_peer_idx;
+    element.data = &cse;
+    element.size = sizeof(struct ConsensusSizeElement);
+    element.element_type = GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT;
+    GNUNET_SET_add_element (set->h, &element, NULL, NULL);
+  }
+
+#ifdef EVIL
+  {
+    struct Evilness evil;
+
+    get_evilness (session, &evil);
+    if (EVILNESS_NONE != evil.type)
+    {
+      /* Useful for evaluation */
+      GNUNET_STATISTICS_set (statistics,
+                             "is evil",
+                             1,
+                             GNUNET_NO);
+    }
+    switch (evil.type)
+    {
+    case EVILNESS_CRAM_ALL:
+    case EVILNESS_CRAM_LEAD:
+    case EVILNESS_CRAM_ECHO:
+      /* We're not cramming elements in the
+         all-to-all round, since that would just
+         add more elements to the result set, but
+         wouldn't test robustness. */
+      if (PHASE_KIND_ALL_TO_ALL == task->key.kind)
+      {
+        GNUNET_SET_commit (setop->op, set->h);
+        break;
+      }
+      if ((EVILNESS_CRAM_LEAD == evil.type) &&
+          ((PHASE_KIND_GRADECAST_LEADER != task->key.kind) ||
+           (SET_KIND_CURRENT != set->key.set_kind) ))
+      {
+        GNUNET_SET_commit (setop->op, set->h);
+        break;
+      }
+      if ((EVILNESS_CRAM_ECHO == evil.type) && (PHASE_KIND_GRADECAST_ECHO !=
+                                                task->key.kind))
+      {
+        GNUNET_SET_commit (setop->op, set->h);
+        break;
+      }
+      for (unsigned int i = 0; i < evil.num; i++)
+      {
+        struct GNUNET_SET_Element element;
+        struct ConsensusStuffedElement se = {
+          .ce.payload_type = 0,
+          .ce.marker = 0,
+        };
+        element.data = &se;
+        element.size = sizeof(struct ConsensusStuffedElement);
+        element.element_type = GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT;
+
+        if (EVILNESS_SUB_REPLACEMENT == evil.subtype)
+        {
+          /* Always generate a new element. */
+          GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                            &se.rand);
+        }
+        else if (EVILNESS_SUB_NO_REPLACEMENT == evil.subtype)
+        {
+          /* Always cram the same elements, derived from counter. */
+          GNUNET_CRYPTO_hash (&i, sizeof(i), &se.rand);
+        }
+        else
+        {
+          GNUNET_assert (0);
+        }
+        GNUNET_SET_add_element (set->h, &element, NULL, NULL);
+#ifdef GNUNET_EXTRA_LOGGING
+        GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                    "P%u: evil peer: cramming element %s into set {%s} of task {%s}\n",
+                    session->local_peer_idx,
+                    debug_str_element (&element),
+                    debug_str_set_key (&setop->input_set),
+                    debug_str_task_key (&task->key));
+#endif
+      }
+      GNUNET_STATISTICS_update (statistics,
+                                "# stuffed elements",
+                                evil.num,
+                                GNUNET_NO);
+      GNUNET_SET_commit (setop->op, set->h);
+      break;
+
+    case EVILNESS_SLACK:
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: evil peer: slacking\n",
+                  (unsigned int) session->local_peer_idx);
+
+    /* Do nothing. */
+    case EVILNESS_SLACK_A2A:
+      if ((PHASE_KIND_ALL_TO_ALL_2 == task->key.kind) ||
+          (PHASE_KIND_ALL_TO_ALL == task->key.kind))
+      {
+        struct GNUNET_SET_Handle *empty_set;
+        empty_set = GNUNET_SET_create (cfg, GNUNET_SET_OPERATION_UNION);
+        GNUNET_SET_commit (setop->op, empty_set);
+        GNUNET_SET_destroy (empty_set);
+      }
+      else
+      {
+        GNUNET_SET_commit (setop->op,
+                           set->h);
+      }
+      break;
+
+    case EVILNESS_NONE:
+      GNUNET_SET_commit (setop->op,
+                         set->h);
+      break;
+    }
+  }
+#else
+  if (GNUNET_NO == session->peers_blacklisted[task_other_peer (task)])
+  {
+    GNUNET_SET_commit (setop->op, set->h);
+  }
+  else
+  {
+    /* For our testcases, we don't want the blacklisted
+       peers to wait. */
+    GNUNET_SET_operation_cancel (setop->op);
+    setop->op = NULL;
+    finish_task (task);
+  }
+#endif
+}
+
+
+static void
+put_diff (struct ConsensusSession *session,
+          struct DiffEntry *diff)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_CRYPTO_hash (&diff->key,
+                      sizeof(struct DiffKey),
+                      &hash);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap_put (session->diffmap,
+                                                    &hash,
+                                                    diff,
+                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+}
+
+
+static void
+put_set (struct ConsensusSession *session,
+         struct SetEntry *set)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert (NULL != set->h);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Putting set %s\n",
+              debug_str_set_key (&set->key));
+  GNUNET_CRYPTO_hash (&set->key,
+                      sizeof(struct SetKey),
+                      &hash);
+  GNUNET_assert (GNUNET_SYSERR !=
+                 GNUNET_CONTAINER_multihashmap_put (session->setmap,
+                                                    &hash,
+                                                    set,
+                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE));
+}
+
+
+static void
+put_rfn (struct ConsensusSession *session,
+         struct ReferendumEntry *rfn)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_CRYPTO_hash (&rfn->key, sizeof(struct RfnKey), &hash);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap_put (session->rfnmap,
+                                                    &hash,
+                                                    rfn,
+                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+}
+
+
+static void
+task_cancel_reconcile (struct TaskEntry *task)
+{
+  /* not implemented yet */
+  GNUNET_assert (0);
+}
+
+
+static void
+apply_diff_to_rfn (struct DiffEntry *diff,
+                   struct ReferendumEntry *rfn,
+                   uint16_t voting_peer,
+                   uint16_t num_peers)
+{
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+  struct DiffElementInfo *di;
+
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (diff->changes);
+
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &di))
+  {
+    if (di->weight > 0)
+    {
+      rfn_vote (rfn, voting_peer, VOTE_ADD, di->element);
+    }
+    if (di->weight < 0)
+    {
+      rfn_vote (rfn, voting_peer, VOTE_REMOVE, di->element);
+    }
+  }
+
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+}
+
+
+static struct DiffEntry *
+diff_create (void)
+{
+  struct DiffEntry *d = GNUNET_new (struct DiffEntry);
+
+  d->changes = GNUNET_CONTAINER_multihashmap_create (8,
+                                                     GNUNET_NO);
+
+  return d;
+}
+
+
+#if 0
+static struct DiffEntry *
+diff_compose (struct DiffEntry *diff_1,
+              struct DiffEntry *diff_2)
+{
+  struct DiffEntry *diff_new;
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+  struct DiffElementInfo *di;
+
+  diff_new = diff_create ();
+
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (diff_1->changes);
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &di))
+  {
+    diff_insert (diff_new,
+                 di->weight,
+                 di->element);
+  }
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (diff_2->changes);
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &di))
+  {
+    diff_insert (diff_new,
+                 di->weight,
+                 di->element);
+  }
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+
+  return diff_new;
+}
+
+
+#endif
+
+
+struct ReferendumEntry *
+rfn_create (uint16_t size)
+{
+  struct ReferendumEntry *rfn;
+
+  rfn = GNUNET_new (struct ReferendumEntry);
+  rfn->rfn_elements = GNUNET_CONTAINER_multihashmap_create (8, GNUNET_NO);
+  rfn->peer_commited = GNUNET_new_array (size, int);
+  rfn->peer_contested = GNUNET_new_array (size, int);
+  rfn->num_peers = size;
+
+  return rfn;
+}
+
+
+#if UNUSED
+static void
+diff_destroy (struct DiffEntry *diff)
+{
+  GNUNET_CONTAINER_multihashmap_destroy (diff->changes);
+  GNUNET_free (diff);
+}
+
+
+#endif
+
+
+/**
+ * For a given majority, count what the outcome
+ * is (add/remove/keep), and give the number
+ * of peers that voted for this outcome.
+ */
+static void
+rfn_majority (const struct ReferendumEntry *rfn,
+              const struct RfnElementInfo *ri,
+              uint16_t *ret_majority,
+              enum ReferendumVote *ret_vote)
+{
+  uint16_t votes_yes = 0;
+  uint16_t num_commited = 0;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Computing rfn majority for element %s of rfn {%s}\n",
+              debug_str_element (ri->element),
+              debug_str_rfn_key (&rfn->key));
+
+  for (uint16_t i = 0; i < rfn->num_peers; i++)
+  {
+    if (GNUNET_NO == rfn->peer_commited[i])
+      continue;
+    num_commited++;
+
+    if (GNUNET_YES == ri->votes[i])
+      votes_yes++;
+  }
+
+  if (votes_yes > (num_commited) / 2)
+  {
+    *ret_vote = ri->proposal;
+    *ret_majority = votes_yes;
+  }
+  else
+  {
+    *ret_vote = VOTE_STAY;
+    *ret_majority = num_commited - votes_yes;
+  }
+}
+
+
+struct SetCopyCls
+{
+  struct TaskEntry *task;
+  struct SetKey dst_set_key;
+};
+
+
+static void
+set_copy_cb (void *cls,
+             struct GNUNET_SET_Handle *copy)
+{
+  struct SetCopyCls *scc = cls;
+  struct TaskEntry *task = scc->task;
+  struct SetKey dst_set_key = scc->dst_set_key;
+  struct SetEntry *set;
+  struct SetHandle *sh = GNUNET_new (struct SetHandle);
+
+  sh->h = copy;
+  GNUNET_CONTAINER_DLL_insert (task->step->session->set_handles_head,
+                               task->step->session->set_handles_tail,
+                               sh);
+
+  GNUNET_free (scc);
+  set = GNUNET_new (struct SetEntry);
+  set->h = copy;
+  set->key = dst_set_key;
+  put_set (task->step->session, set);
+
+  task->start (task);
+}
+
+
+/**
+ * Call the start function of the given
+ * task again after we created a copy of the given set.
+ */
+static void
+create_set_copy_for_task (struct TaskEntry *task,
+                          struct SetKey *src_set_key,
+                          struct SetKey *dst_set_key)
+{
+  struct SetEntry *src_set;
+  struct SetCopyCls *scc = GNUNET_new (struct SetCopyCls);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Copying set {%s} to {%s} for task {%s}\n",
+              debug_str_set_key (src_set_key),
+              debug_str_set_key (dst_set_key),
+              debug_str_task_key (&task->key));
+
+  scc->task = task;
+  scc->dst_set_key = *dst_set_key;
+  src_set = lookup_set (task->step->session, src_set_key);
+  GNUNET_assert (NULL != src_set);
+  GNUNET_SET_copy_lazy (src_set->h,
+                        set_copy_cb,
+                        scc);
+}
+
+
+struct SetMutationProgressCls
+{
+  int num_pending;
+  /**
+   * Task to finish once all changes are through.
+   */
+  struct TaskEntry *task;
+};
+
+
+static void
+set_mutation_done (void *cls)
+{
+  struct SetMutationProgressCls *pc = cls;
+
+  GNUNET_assert (pc->num_pending > 0);
+
+  pc->num_pending--;
+
+  if (0 == pc->num_pending)
+  {
+    struct TaskEntry *task = pc->task;
+    GNUNET_free (pc);
+    finish_task (task);
+  }
+}
+
+
+static void
+try_finish_step_early (struct Step *step)
+{
+  if (GNUNET_YES == step->is_running)
+    return;
+  if (GNUNET_YES == step->is_finished)
+    return;
+  if (GNUNET_NO == step->early_finishable)
+    return;
+
+  step->is_finished = GNUNET_YES;
+
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Finishing step `%s' early.\n",
+              step->debug_name);
+#endif
+
+  for (unsigned int i = 0; i < step->subordinates_len; i++)
+  {
+    GNUNET_assert (step->subordinates[i]->pending_prereq > 0);
+    step->subordinates[i]->pending_prereq--;
+#ifdef GNUNET_EXTRA_LOGGING
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Decreased pending_prereq to %u for step `%s'.\n",
+                (unsigned int) step->subordinates[i]->pending_prereq,
+                step->subordinates[i]->debug_name);
+#endif
+    try_finish_step_early (step->subordinates[i]);
+  }
+
+  // XXX: maybe schedule as task to avoid recursion?
+  run_ready_steps (step->session);
+}
+
+
+static void
+finish_step (struct Step *step)
+{
+  GNUNET_assert (step->finished_tasks == step->tasks_len);
+  GNUNET_assert (GNUNET_YES == step->is_running);
+  GNUNET_assert (GNUNET_NO == step->is_finished);
+
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "All tasks of step `%s' with %u subordinates finished.\n",
+              step->debug_name,
+              step->subordinates_len);
+#endif
+
+  for (unsigned int i = 0; i < step->subordinates_len; i++)
+  {
+    GNUNET_assert (step->subordinates[i]->pending_prereq > 0);
+    step->subordinates[i]->pending_prereq--;
+#ifdef GNUNET_EXTRA_LOGGING
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Decreased pending_prereq to %u for step `%s'.\n",
+                (unsigned int) step->subordinates[i]->pending_prereq,
+                step->subordinates[i]->debug_name);
+#endif
+  }
+
+  step->is_finished = GNUNET_YES;
+
+  // XXX: maybe schedule as task to avoid recursion?
+  run_ready_steps (step->session);
+}
+
+
+/**
+ * Apply the result from one round of gradecasts (i.e. every peer
+ * should have gradecasted) to the peer's current set.
+ *
+ * @param task the task with context information
+ */
+static void
+task_start_apply_round (struct TaskEntry *task)
+{
+  struct ConsensusSession *session = task->step->session;
+  struct SetKey sk_in;
+  struct SetKey sk_out;
+  struct RfnKey rk_in;
+  struct SetEntry *set_out;
+  struct ReferendumEntry *rfn_in;
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+  struct RfnElementInfo *ri;
+  struct SetMutationProgressCls *progress_cls;
+  uint16_t worst_majority = UINT16_MAX;
+
+  sk_in = (struct SetKey) { SET_KIND_CURRENT, task->key.repetition };
+  rk_in = (struct RfnKey) { RFN_KIND_GRADECAST_RESULT, task->key.repetition };
+  sk_out = (struct SetKey) { SET_KIND_CURRENT, task->key.repetition + 1 };
+
+  set_out = lookup_set (session, &sk_out);
+  if (NULL == set_out)
+  {
+    create_set_copy_for_task (task,
+                              &sk_in,
+                              &sk_out);
+    return;
+  }
+
+  rfn_in = lookup_rfn (session, &rk_in);
+  GNUNET_assert (NULL != rfn_in);
+
+  progress_cls = GNUNET_new (struct SetMutationProgressCls);
+  progress_cls->task = task;
+
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (rfn_in->rfn_elements);
+
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &ri))
+  {
+    uint16_t majority_num;
+    enum ReferendumVote majority_vote;
+
+    rfn_majority (rfn_in, ri, &majority_num, &majority_vote);
+
+    if (worst_majority > majority_num)
+      worst_majority = majority_num;
+
+    switch (majority_vote)
+    {
+    case VOTE_ADD:
+      progress_cls->num_pending++;
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_SET_add_element (set_out->h,
+                                             ri->element,
+                                             &set_mutation_done,
+                                             progress_cls));
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: apply round: adding element %s with %u-majority.\n",
+                  session->local_peer_idx,
+                  debug_str_element (ri->element), majority_num);
+      break;
+
+    case VOTE_REMOVE:
+      progress_cls->num_pending++;
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_SET_remove_element (set_out->h,
+                                                ri->element,
+                                                &set_mutation_done,
+                                                progress_cls));
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: apply round: deleting element %s with %u-majority.\n",
+                  session->local_peer_idx,
+                  debug_str_element (ri->element), majority_num);
+      break;
+
+    case VOTE_STAY:
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: apply round: keeping element %s with %u-majority.\n",
+                  session->local_peer_idx,
+                  debug_str_element (ri->element), majority_num);
+      // do nothing
+      break;
+
+    default:
+      GNUNET_assert (0);
+      break;
+    }
+  }
+
+  if (0 == progress_cls->num_pending)
+  {
+    // call closure right now, no pending ops
+    GNUNET_free (progress_cls);
+    finish_task (task);
+  }
+
+  {
+    uint16_t thresh = (session->num_peers / 3) * 2;
+
+    if (worst_majority >= thresh)
+    {
+      switch (session->early_stopping)
+      {
+      case EARLY_STOPPING_NONE:
+        session->early_stopping = EARLY_STOPPING_ONE_MORE;
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    "P%u: Stopping early (after one more superround)\n",
+                    session->local_peer_idx);
+        break;
+
+      case EARLY_STOPPING_ONE_MORE:
+        GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                    "P%u: finishing steps due to early finish\n",
+                    session->local_peer_idx);
+        session->early_stopping = EARLY_STOPPING_DONE;
+        {
+          struct Step *step;
+          for (step = session->steps_head; NULL != step; step = step->next)
+            try_finish_step_early (step);
+        }
+        break;
+
+      case EARLY_STOPPING_DONE:
+        /* We shouldn't be here anymore after early stopping */
+        GNUNET_break (0);
+        break;
+
+      default:
+        GNUNET_assert (0);
+        break;
+      }
+    }
+    else if (EARLY_STOPPING_NONE != session->early_stopping)
+    {
+      // Our assumption about the number of bad peers
+      // has been broken.
+      GNUNET_break_op (0);
+    }
+    else
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "P%u: NOT finishing early (majority not good enough)\n",
+                  session->local_peer_idx);
+    }
+  }
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+}
+
+
+static void
+task_start_grade (struct TaskEntry *task)
+{
+  struct ConsensusSession *session = task->step->session;
+  struct ReferendumEntry *output_rfn;
+  struct ReferendumEntry *input_rfn;
+  struct DiffEntry *input_diff;
+  struct RfnKey rfn_key;
+  struct DiffKey diff_key;
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+  struct RfnElementInfo *ri;
+  unsigned int gradecast_confidence = 2;
+
+  rfn_key = (struct RfnKey) { RFN_KIND_GRADECAST_RESULT, task->key.repetition };
+  output_rfn = lookup_rfn (session, &rfn_key);
+  if (NULL == output_rfn)
+  {
+    output_rfn = rfn_create (session->num_peers);
+    output_rfn->key = rfn_key;
+    put_rfn (session, output_rfn);
+  }
+
+  diff_key = (struct DiffKey) { DIFF_KIND_LEADER_PROPOSAL, task->key.repetition,
+                                task->key.leader };
+  input_diff = lookup_diff (session, &diff_key);
+  GNUNET_assert (NULL != input_diff);
+
+  rfn_key = (struct RfnKey) { RFN_KIND_ECHO, task->key.repetition,
+                              task->key.leader };
+  input_rfn = lookup_rfn (session, &rfn_key);
+  GNUNET_assert (NULL != input_rfn);
+
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (
+    input_rfn->rfn_elements);
+
+  apply_diff_to_rfn (input_diff, output_rfn, task->key.leader,
+                     session->num_peers);
+
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &ri))
+  {
+    uint16_t majority_num;
+    enum ReferendumVote majority_vote;
+
+    // XXX: we need contested votes and non-contested votes here
+    rfn_majority (input_rfn, ri, &majority_num, &majority_vote);
+
+    if (majority_num <= session->num_peers / 3)
+      majority_vote = VOTE_REMOVE;
+
+    switch (majority_vote)
+    {
+    case VOTE_STAY:
+      break;
+
+    case VOTE_ADD:
+      rfn_vote (output_rfn, task->key.leader, VOTE_ADD, ri->element);
+      break;
+
+    case VOTE_REMOVE:
+      rfn_vote (output_rfn, task->key.leader, VOTE_REMOVE, ri->element);
+      break;
+
+    default:
+      GNUNET_assert (0);
+      break;
+    }
+  }
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+
+  {
+    uint16_t noncontested;
+    noncontested = rfn_noncontested (input_rfn);
+    if (noncontested < (session->num_peers / 3) * 2)
+    {
+      gradecast_confidence = GNUNET_MIN (1, gradecast_confidence);
+    }
+    if (noncontested < (session->num_peers / 3) + 1)
+    {
+      gradecast_confidence = 0;
+    }
+  }
+
+  if (gradecast_confidence >= 1)
+    rfn_commit (output_rfn, task->key.leader);
+
+  if (gradecast_confidence <= 1)
+    session->peers_blacklisted[task->key.leader] = GNUNET_YES;
+
+  finish_task (task);
+}
+
+
+static void
+task_start_reconcile (struct TaskEntry *task)
+{
+  struct SetEntry *input;
+  struct SetOpCls *setop = &task->cls.setop;
+  struct ConsensusSession *session = task->step->session;
+
+  input = lookup_set (session, &setop->input_set);
+  GNUNET_assert (NULL != input);
+  GNUNET_assert (NULL != input->h);
+
+  /* We create the outputs for the operation here
+     (rather than in the set operation callback)
+     because we want something valid in there, even
+     if the other peer doesn't talk to us */
+
+  if (SET_KIND_NONE != setop->output_set.set_kind)
+  {
+    /* If we don't have an existing output set,
+       we clone the input set. */
+    if (NULL == lookup_set (session, &setop->output_set))
+    {
+      create_set_copy_for_task (task,
+                                &setop->input_set,
+                                &setop->output_set);
+      return;
+    }
+  }
+
+  if (RFN_KIND_NONE != setop->output_rfn.rfn_kind)
+  {
+    if (NULL == lookup_rfn (session, &setop->output_rfn))
+    {
+      struct ReferendumEntry *rfn;
+
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: output rfn <%s> missing, creating.\n",
+                  session->local_peer_idx,
+                  debug_str_rfn_key (&setop->output_rfn));
+
+      rfn = rfn_create (session->num_peers);
+      rfn->key = setop->output_rfn;
+      put_rfn (session, rfn);
+    }
+  }
+
+  if (DIFF_KIND_NONE != setop->output_diff.diff_kind)
+  {
+    if (NULL == lookup_diff (session, &setop->output_diff))
+    {
+      struct DiffEntry *diff;
+
+      diff = diff_create ();
+      diff->key = setop->output_diff;
+      put_diff (session, diff);
+    }
+  }
+
+  if ((task->key.peer1 == session->local_peer_idx) && (task->key.peer2 ==
+                                                       session->local_peer_idx))
+  {
+    /* XXX: mark the corresponding rfn as committed if necessary */
+    finish_task (task);
+    return;
+  }
+
+  if (task->key.peer1 == session->local_peer_idx)
+  {
+    struct GNUNET_CONSENSUS_RoundContextMessage rcm;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: Looking up set {%s} to run remote union\n",
+                session->local_peer_idx,
+                debug_str_set_key (&setop->input_set));
+    rcm.header.type = htons (GNUNET_MESSAGE_TYPE_CONSENSUS_P2P_ROUND_CONTEXT);
+    rcm.header.size = htons (sizeof(rcm));
+    rcm.kind = htons (task->key.kind);
+    rcm.peer1 = htons (task->key.peer1);
+    rcm.peer2 = htons (task->key.peer2);
+    rcm.leader = htons (task->key.leader);
+    rcm.repetition = htons (task->key.repetition);
+    rcm.is_contested = htons (0);
+
+    GNUNET_assert (NULL == setop->op);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: initiating set op with P%u, our set is %s\n",
+                session->local_peer_idx,
+                task->key.peer2,
+                debug_str_set_key (&setop->input_set));
+
+    struct GNUNET_SET_Option opts[] = {
+      { GNUNET_SET_OPTION_BYZANTINE, { .num = session->lower_bound } },
+      { GNUNET_SET_OPTION_END },
+    };
+
+    // XXX: maybe this should be done while
+    // setting up tasks alreays?
+    setop->op = GNUNET_SET_prepare (&session->peers[task->key.peer2],
+                                    &session->global_id,
+                                    &rcm.header,
+                                    GNUNET_SET_RESULT_SYMMETRIC,
+                                    opts,
+                                    set_result_cb,
+                                    task);
+
+    commit_set (session, task);
+  }
+  else if (task->key.peer2 == session->local_peer_idx)
+  {
+    /* Wait for the other peer to contact us */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: waiting set op with P%u\n",
+                session->local_peer_idx, task->key.peer1);
+
+    if (NULL != setop->op)
+    {
+      commit_set (session, task);
+    }
+  }
+  else
+  {
+    /* We made an error while constructing the task graph. */
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+task_start_eval_echo (struct TaskEntry *task)
+{
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+  struct ReferendumEntry *input_rfn;
+  struct RfnElementInfo *ri;
+  struct SetEntry *output_set;
+  struct SetMutationProgressCls *progress_cls;
+  struct ConsensusSession *session = task->step->session;
+  struct SetKey sk_in;
+  struct SetKey sk_out;
+  struct RfnKey rk_in;
+
+  sk_in = (struct SetKey) { SET_KIND_LEADER_PROPOSAL, task->key.repetition,
+                            task->key.leader };
+  sk_out = (struct SetKey) { SET_KIND_ECHO_RESULT, task->key.repetition,
+                             task->key.leader };
+  output_set = lookup_set (session, &sk_out);
+  if (NULL == output_set)
+  {
+    create_set_copy_for_task (task,
+                              &sk_in,
+                              &sk_out);
+    return;
+  }
+
+  {
+    // FIXME: should be marked as a shallow copy, so
+    // we can destroy everything correctly
+    struct SetEntry *last_set = GNUNET_new (struct SetEntry);
+
+    last_set->h = output_set->h;
+    last_set->key = (struct SetKey) { SET_KIND_LAST_GRADECAST };
+    put_set (session, last_set);
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Evaluating referendum in Task {%s}\n",
+              debug_str_task_key (&task->key));
+
+  progress_cls = GNUNET_new (struct SetMutationProgressCls);
+  progress_cls->task = task;
+  rk_in = (struct RfnKey) { RFN_KIND_ECHO, task->key.repetition,
+                            task->key.leader };
+  input_rfn = lookup_rfn (session, &rk_in);
+  GNUNET_assert (NULL != input_rfn);
+  iter = GNUNET_CONTAINER_multihashmap_iterator_create (
+    input_rfn->rfn_elements);
+  GNUNET_assert (NULL != iter);
+
+  while (GNUNET_YES ==
+         GNUNET_CONTAINER_multihashmap_iterator_next (iter,
+                                                      NULL,
+                                                      (const void **) &ri))
+  {
+    enum ReferendumVote majority_vote;
+    uint16_t majority_num;
+
+    rfn_majority (input_rfn, ri, &majority_num, &majority_vote);
+
+    if (majority_num < session->num_peers / 3)
+    {
+      /* It is not the case that all nonfaulty peers
+         echoed the same value.  Since we're doing a set reconciliation, we
+         can't simply send "nothing" for the value.  Thus we mark our 'confirm'
+         reconciliation as contested.  Other peers might not know that the
+         leader is faulty, thus we still re-distribute in the confirmation
+         round. *///
+      output_set->is_contested = GNUNET_YES;
+    }
+
+    switch (majority_vote)
+    {
+    case VOTE_ADD:
+      progress_cls->num_pending++;
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_SET_add_element (output_set->h,
+                                             ri->element,
+                                             set_mutation_done,
+                                             progress_cls));
+      break;
+
+    case VOTE_REMOVE:
+      progress_cls->num_pending++;
+      GNUNET_assert (GNUNET_OK ==
+                     GNUNET_SET_remove_element (output_set->h,
+                                                ri->element,
+                                                set_mutation_done,
+                                                progress_cls));
+      break;
+
+    case VOTE_STAY:
+      /* Nothing to do. */
+      break;
+
+    default:
+      /* not reached */
+      GNUNET_assert (0);
+    }
+  }
+
+  GNUNET_CONTAINER_multihashmap_iterator_destroy (iter);
+
+  if (0 == progress_cls->num_pending)
+  {
+    // call closure right now, no pending ops
+    GNUNET_free (progress_cls);
+    finish_task (task);
+  }
+}
+
+
+static void
+task_start_finish (struct TaskEntry *task)
+{
+  struct SetEntry *final_set;
+  struct ConsensusSession *session = task->step->session;
+
+  final_set = lookup_set (session,
+                          &task->cls.finish.input_set);
+  GNUNET_assert (NULL != final_set);
+  GNUNET_SET_iterate (final_set->h,
+                      &send_to_client_iter,
+                      task);
+}
+
+
+static void
+start_task (struct ConsensusSession *session,
+            struct TaskEntry *task)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: starting task {%s}\n",
+              session->local_peer_idx,
+              debug_str_task_key (&task->key));
+  GNUNET_assert (GNUNET_NO == task->is_started);
+  GNUNET_assert (GNUNET_NO == task->is_finished);
+  GNUNET_assert (NULL != task->start);
+  task->start (task);
+  task->is_started = GNUNET_YES;
+}
+
+
+/*
+ * Run all steps of the session that don't any
+ * more dependencies.
+ */
+static void
+run_ready_steps (struct ConsensusSession *session)
+{
+  struct Step *step;
+
+  step = session->steps_head;
+
+  while (NULL != step)
+  {
+    if ((GNUNET_NO == step->is_running) && (0 == step->pending_prereq) &&
+        (GNUNET_NO == step->is_finished))
+    {
+      GNUNET_assert (0 == step->finished_tasks);
+
+#ifdef GNUNET_EXTRA_LOGGING
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "P%u: Running step `%s' of round %d with %d tasks and %d subordinates\n",
+                  session->local_peer_idx,
+                  step->debug_name,
+                  step->round, step->tasks_len, step->subordinates_len);
+#endif
+
+      step->is_running = GNUNET_YES;
+      for (size_t i = 0; i < step->tasks_len; i++)
+        start_task (session, step->tasks[i]);
+
+      /* Sometimes there is no task to trigger finishing the step, so we have to do it here. */
+      if ((step->finished_tasks == step->tasks_len) && (GNUNET_NO ==
+                                                        step->is_finished))
+        finish_step (step);
+
+      /* Running the next ready steps will be triggered by task completion */
+      return;
+    }
+    step = step->next;
+  }
+
+  return;
+}
+
+
+static void
+finish_task (struct TaskEntry *task)
+{
+  GNUNET_assert (GNUNET_NO == task->is_finished);
+  task->is_finished = GNUNET_YES;
+  task->step->finished_tasks++;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "P%u: Finishing Task {%s} (now %u/%u tasks finished in step)\n",
+              task->step->session->local_peer_idx,
+              debug_str_task_key (&task->key),
+              (unsigned int) task->step->finished_tasks,
+              (unsigned int) task->step->tasks_len);
+
+  if (task->step->finished_tasks == task->step->tasks_len)
+    finish_step (task->step);
+}
+
+
+/**
+ * Search peer in the list of peers in session.
+ *
+ * @param peer peer to find
+ * @param session session with peer
+ * @return index of peer, -1 if peer is not in session
+ */
+static int
+get_peer_idx (const struct GNUNET_PeerIdentity *peer,
+              const struct ConsensusSession *session)
+{
+  for (int i = 0; i < session->num_peers; i++)
+    if (0 == GNUNET_memcmp (peer, &session->peers[i]))
+      return i;
+  return -1;
+}
+
+
+/**
+ * Compute a global, (hopefully) unique consensus session id,
+ * from the local id of the consensus session, and the identities of all participants.
+ * Thus, if the local id of two consensus sessions coincide, but are not comprised of
+ * exactly the same peers, the global id will be different.
+ *
+ * @param session session to generate the global id for
+ * @param local_session_id local id of the consensus session
+ */
+static void
+compute_global_id (struct ConsensusSession *session,
+                   const struct GNUNET_HashCode *local_session_id)
+{
+  const char *salt = "gnunet-service-consensus/session_id";
+
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CRYPTO_kdf (&session->global_id,
+                                    sizeof(struct GNUNET_HashCode),
+                                    salt,
+                                    strlen (salt),
+                                    session->peers,
+                                    session->num_peers * sizeof(struct
+                                                                GNUNET_PeerIdentity),
+                                    local_session_id,
+                                    sizeof(struct GNUNET_HashCode),
+                                    NULL));
+}
+
+
+/**
+ * Compare two peer identities (for qsort()).
+ *
+ * @param h1 some peer identity
+ * @param h2 some peer identity
+ * @return 1 if h1 > h2, -1 if h1 < h2 and 0 if h1 == h2.
+ */
+static int
+peer_id_cmp (const void *h1,
+             const void *h2)
+{
+  return memcmp (h1, h2, sizeof(struct GNUNET_PeerIdentity));
+}
+
+
+/**
+ * Create the sorted list of peers for the session,
+ * add the local peer if not in the join message.
+ *
+ * @param session session to initialize
+ * @param join_msg join message with the list of peers participating at the end
+ */
+static void
+initialize_session_peer_list (
+  struct ConsensusSession *session,
+  const struct GNUNET_CONSENSUS_JoinMessage *join_msg)
+{
+  const struct GNUNET_PeerIdentity *msg_peers
+    = (const struct GNUNET_PeerIdentity *) &join_msg[1];
+  int local_peer_in_list;
+
+  session->num_peers = ntohl (join_msg->num_peers);
+
+  /* Peers in the join message, may or may not include the local peer,
+     Add it if it is missing. */
+  local_peer_in_list = GNUNET_NO;
+  for (unsigned int i = 0; i < session->num_peers; i++)
+  {
+    if (0 == GNUNET_memcmp (&msg_peers[i],
+                            &my_peer))
+    {
+      local_peer_in_list = GNUNET_YES;
+      break;
+    }
+  }
+  if (GNUNET_NO == local_peer_in_list)
+    session->num_peers++;
+
+  session->peers = GNUNET_new_array (session->num_peers,
+                                     struct GNUNET_PeerIdentity);
+  if (GNUNET_NO == local_peer_in_list)
+    session->peers[session->num_peers - 1] = my_peer;
+  GNUNET_memcpy (session->peers,
+                 msg_peers,
+                 ntohl (join_msg->num_peers)
+                 * sizeof(struct GNUNET_PeerIdentity));
+  qsort (session->peers,
+         session->num_peers,
+         sizeof (struct GNUNET_PeerIdentity),
+         &peer_id_cmp);
+}
+
+
+static struct TaskEntry *
+lookup_task (const struct ConsensusSession *session,
+             const struct TaskKey *key)
+{
+  struct GNUNET_HashCode hash;
+
+  GNUNET_CRYPTO_hash (key,
+                      sizeof(struct TaskKey),
+                      &hash);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Looking up task hash %s\n",
+              GNUNET_h2s (&hash));
+  return GNUNET_CONTAINER_multihashmap_get (session->taskmap,
+                                            &hash);
+}
+
+
+/**
+ * Called when another peer wants to do a set operation with the
+ * local peer.
+ *
+ * @param cls closure
+ * @param other_peer the other peer
+ * @param context_msg message with application specific information from
+ *        the other peer
+ * @param request request from the other peer, use GNUNET_SET_accept
+ *        to accept it, otherwise the request will be refused
+ *        Note that we don't use a return value here, as it is also
+ *        necessary to specify the set we want to do the operation with,
+ *        which sometimes can be derived from the context message.
+ *        Also necessary to specify the timeout.
+ */
+static void
+set_listen_cb (void *cls,
+               const struct GNUNET_PeerIdentity *other_peer,
+               const struct GNUNET_MessageHeader *context_msg,
+               struct GNUNET_SET_Request *request)
+{
+  struct ConsensusSession *session = cls;
+  struct TaskKey tk;
+  struct TaskEntry *task;
+  struct GNUNET_CONSENSUS_RoundContextMessage *cm;
+
+  if (NULL == context_msg)
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  if (GNUNET_MESSAGE_TYPE_CONSENSUS_P2P_ROUND_CONTEXT != ntohs (
+        context_msg->type))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  if (sizeof(struct GNUNET_CONSENSUS_RoundContextMessage) != ntohs (
+        context_msg->size))
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  cm = (struct GNUNET_CONSENSUS_RoundContextMessage *) context_msg;
+
+  tk = ((struct TaskKey) {
+    .kind = ntohs (cm->kind),
+    .peer1 = ntohs (cm->peer1),
+    .peer2 = ntohs (cm->peer2),
+    .repetition = ntohs (cm->repetition),
+    .leader = ntohs (cm->leader),
+  });
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: got req for task %s\n",
+              session->local_peer_idx, debug_str_task_key (&tk));
+
+  task = lookup_task (session, &tk);
+
+  if (NULL == task)
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  if (GNUNET_YES == task->is_finished)
+  {
+    GNUNET_break_op (0);
+    return;
+  }
+
+  if (task->key.peer2 != session->local_peer_idx)
+  {
+    /* We're being asked, so we must be the 2nd peer. */
+    GNUNET_break_op (0);
+    return;
+  }
+
+  GNUNET_assert (! ((task->key.peer1 == session->local_peer_idx) &&
+                    (task->key.peer2 == session->local_peer_idx)));
+
+  struct GNUNET_SET_Option opts[] = {
+    { GNUNET_SET_OPTION_BYZANTINE, { .num = session->lower_bound } },
+    { GNUNET_SET_OPTION_END },
+  };
+
+  task->cls.setop.op = GNUNET_SET_accept (request,
+                                          GNUNET_SET_RESULT_SYMMETRIC,
+                                          opts,
+                                          &set_result_cb,
+                                          task);
+
+  /* If the task hasn't been started yet,
+     we wait for that until we commit. */
+
+  if (GNUNET_YES == task->is_started)
+  {
+    commit_set (session, task);
+  }
+}
+
+
+static void
+put_task (struct GNUNET_CONTAINER_MultiHashMap *taskmap,
+          struct TaskEntry *t)
+{
+  struct GNUNET_HashCode round_hash;
+  struct Step *s;
+
+  GNUNET_assert (NULL != t->step);
+  t = GNUNET_memdup (t, sizeof(struct TaskEntry));
+  s = t->step;
+  if (s->tasks_len == s->tasks_cap)
+  {
+    unsigned int target_size = 3 * (s->tasks_cap + 1) / 2;
+    GNUNET_array_grow (s->tasks,
+                       s->tasks_cap,
+                       target_size);
+  }
+
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_assert (NULL != s->debug_name);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Putting task <%s> into step `%s'\n",
+              debug_str_task_key (&t->key),
+              s->debug_name);
+#endif
+
+  s->tasks[s->tasks_len] = t;
+  s->tasks_len++;
+
+  GNUNET_CRYPTO_hash (&t->key,
+                      sizeof(struct TaskKey),
+                      &round_hash);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap_put (taskmap,
+                                                    &round_hash,
+                                                    t,
+                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+}
+
+
+static void
+install_step_timeouts (struct ConsensusSession *session)
+{
+  /* Given the fully constructed task graph
+     with rounds for tasks, we can give the tasks timeouts. */
+
+  // unsigned int max_round;
+
+  /* XXX: implement! */
+}
+
+
+/*
+ * Arrange two peers in some canonical order.
+ */
+static void
+arrange_peers (uint16_t *p1,
+               uint16_t *p2,
+               uint16_t n)
+{
+  uint16_t a;
+  uint16_t b;
+
+  GNUNET_assert (*p1 < n);
+  GNUNET_assert (*p2 < n);
+
+  if (*p1 < *p2)
+  {
+    a = *p1;
+    b = *p2;
+  }
+  else
+  {
+    a = *p2;
+    b = *p1;
+  }
+
+  /* For uniformly random *p1, *p2,
+     this condition is true with 50% chance */
+  if (((b - a) + n) % n <= n / 2)
+  {
+    *p1 = a;
+    *p2 = b;
+  }
+  else
+  {
+    *p1 = b;
+    *p2 = a;
+  }
+}
+
+
+/**
+ * Record @a dep as a dependency of @a step.
+ */
+static void
+step_depend_on (struct Step *step,
+                struct Step *dep)
+{
+  /* We're not checking for cyclic dependencies,
+     but this is a cheap sanity check. */
+  GNUNET_assert (step != dep);
+  GNUNET_assert (NULL != step);
+  GNUNET_assert (NULL != dep);
+  GNUNET_assert (dep->round <= step->round);
+
+#ifdef GNUNET_EXTRA_LOGGING
+  /* Make sure we have complete debugging information.
+     Also checks that we don't screw up too badly
+     constructing the task graph. */
+  GNUNET_assert (NULL != step->debug_name);
+  GNUNET_assert (NULL != dep->debug_name);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Making step `%s' depend on `%s'\n",
+              step->debug_name,
+              dep->debug_name);
+#endif
+
+  if (dep->subordinates_cap == dep->subordinates_len)
+  {
+    unsigned int target_size = 3 * (dep->subordinates_cap + 1) / 2;
+    GNUNET_array_grow (dep->subordinates,
+                       dep->subordinates_cap,
+                       target_size);
+  }
+
+  GNUNET_assert (dep->subordinates_len <= dep->subordinates_cap);
+
+  dep->subordinates[dep->subordinates_len] = step;
+  dep->subordinates_len++;
+
+  step->pending_prereq++;
+}
+
+
+static struct Step *
+create_step (struct ConsensusSession *session,
+             int round,
+             int early_finishable)
+{
+  struct Step *step;
+
+  step = GNUNET_new (struct Step);
+  step->session = session;
+  step->round = round;
+  step->early_finishable = early_finishable;
+  GNUNET_CONTAINER_DLL_insert_tail (session->steps_head,
+                                    session->steps_tail,
+                                    step);
+  return step;
+}
+
+
+/**
+ * Construct the task graph for a single gradecast.
+ */
+static void
+construct_task_graph_gradecast (struct ConsensusSession *session,
+                                uint16_t rep,
+                                uint16_t lead,
+                                struct Step *step_before,
+                                struct Step *step_after)
+{
+  uint16_t n = session->num_peers;
+  uint16_t me = session->local_peer_idx;
+  uint16_t p1;
+  uint16_t p2;
+  /* The task we're currently setting up. */
+  struct TaskEntry task;
+  struct Step *step;
+  struct Step *prev_step;
+  uint16_t round;
+
+  round = step_before->round + 1;
+
+  /* gcast step 1: leader disseminates */
+  step = create_step (session,
+                      round,
+                      GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name,
+                   "disseminate leader %u rep %u",
+                   lead,
+                   rep);
+#endif
+  step_depend_on (step,
+                  step_before);
+
+  if (lead == me)
+  {
+    for (unsigned int k = 0; k < n; k++)
+    {
+      if (k == me)
+        continue;
+      p1 = me;
+      p2 = k;
+      arrange_peers (&p1, &p2, n);
+      task = ((struct TaskEntry) {
+        .step = step,
+        .start = task_start_reconcile,
+        .cancel = task_cancel_reconcile,
+        .key = (struct TaskKey) { PHASE_KIND_GRADECAST_LEADER, p1, p2, rep,
+                                  me },
+      });
+      task.cls.setop.input_set = (struct SetKey) { SET_KIND_CURRENT, rep };
+      put_task (session->taskmap, &task);
+    }
+    /* We run this task to make sure that the leader
+       has the stored the SET_KIND_LEADER set of himself,
+       so it can participate in the rest of the gradecast
+       without the code having to handle any special cases. */
+    task = ((struct TaskEntry) {
+      .step = step,
+      .key = (struct TaskKey) { PHASE_KIND_GRADECAST_LEADER, me, me, rep, me },
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_CURRENT, rep };
+    task.cls.setop.output_set = (struct SetKey) { SET_KIND_LEADER_PROPOSAL, rep,
+                                                  me };
+    task.cls.setop.output_diff = (struct DiffKey) { DIFF_KIND_LEADER_PROPOSAL,
+                                                    rep, me };
+    put_task (session->taskmap, &task);
+  }
+  else
+  {
+    p1 = me;
+    p2 = lead;
+    arrange_peers (&p1, &p2, n);
+    task = ((struct TaskEntry) {
+      .step = step,
+      .key = (struct TaskKey) { PHASE_KIND_GRADECAST_LEADER, p1, p2, rep,
+                                lead },
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_CURRENT, rep };
+    task.cls.setop.output_set = (struct SetKey) { SET_KIND_LEADER_PROPOSAL, rep,
+                                                  lead };
+    task.cls.setop.output_diff = (struct DiffKey) { DIFF_KIND_LEADER_PROPOSAL,
+                                                    rep, lead };
+    put_task (session->taskmap, &task);
+  }
+
+  /* gcast phase 2: echo */
+  prev_step = step;
+  round += 1;
+  step = create_step (session,
+                      round,
+                      GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name,
+                   "echo leader %u rep %u",
+                   lead,
+                   rep);
+#endif
+  step_depend_on (step,
+                  prev_step);
+
+  for (unsigned int k = 0; k < n; k++)
+  {
+    p1 = k;
+    p2 = me;
+    arrange_peers (&p1, &p2, n);
+    task = ((struct TaskEntry) {
+      .step = step,
+      .key = (struct TaskKey) { PHASE_KIND_GRADECAST_ECHO, p1, p2, rep, lead },
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_LEADER_PROPOSAL, rep,
+                                                 lead };
+    task.cls.setop.output_rfn = (struct RfnKey) { RFN_KIND_ECHO, rep, lead };
+    put_task (session->taskmap, &task);
+  }
+
+  prev_step = step;
+  /* Same round, since step only has local tasks */
+  step = create_step (session, round, GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name, "echo grade leader %u rep %u", lead, rep);
+#endif
+  step_depend_on (step, prev_step);
+
+  arrange_peers (&p1, &p2, n);
+  task = ((struct TaskEntry) {
+    .key = (struct TaskKey) { PHASE_KIND_GRADECAST_ECHO_GRADE, -1, -1, rep,
+                              lead },
+    .step = step,
+    .start = task_start_eval_echo
+  });
+  put_task (session->taskmap, &task);
+
+  prev_step = step;
+  round += 1;
+  step = create_step (session, round, GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name, "confirm leader %u rep %u", lead, rep);
+#endif
+  step_depend_on (step, prev_step);
+
+  /* gcast phase 3: confirmation and grading */
+  for (unsigned int k = 0; k < n; k++)
+  {
+    p1 = k;
+    p2 = me;
+    arrange_peers (&p1, &p2, n);
+    task = ((struct TaskEntry) {
+      .step = step,
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+      .key = (struct TaskKey) { PHASE_KIND_GRADECAST_CONFIRM, p1, p2, rep,
+                                lead },
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_ECHO_RESULT, rep,
+                                                 lead };
+    task.cls.setop.output_rfn = (struct RfnKey) { RFN_KIND_CONFIRM, rep, lead };
+    /* If there was at least one element in the echo round that was
+       contested (i.e. it had no n-t majority), then we let the other peers
+       know, and other peers let us know.  The contested flag for each peer is
+       stored in the rfn. */
+    task.cls.setop.transceive_contested = GNUNET_YES;
+    put_task (session->taskmap, &task);
+  }
+
+  prev_step = step;
+  /* Same round, since step only has local tasks */
+  step = create_step (session, round, GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name, "confirm grade leader %u rep %u", lead,
+                   rep);
+#endif
+  step_depend_on (step, prev_step);
+
+  task = ((struct TaskEntry) {
+    .step = step,
+    .key = (struct TaskKey) { PHASE_KIND_GRADECAST_CONFIRM_GRADE, -1, -1, rep,
+                              lead },
+    .start = task_start_grade,
+  });
+  put_task (session->taskmap, &task);
+
+  step_depend_on (step_after, step);
+}
+
+
+static void
+construct_task_graph (struct ConsensusSession *session)
+{
+  uint16_t n = session->num_peers;
+  uint16_t t = n / 3;
+  uint16_t me = session->local_peer_idx;
+  /* The task we're currently setting up. */
+  struct TaskEntry task;
+  /* Current leader */
+  unsigned int lead;
+  struct Step *step;
+  struct Step *prev_step;
+  unsigned int round = 0;
+
+  // XXX: introduce first step,
+  // where we wait for all insert acks
+  // from the set service
+
+  /* faster but brittle all-to-all */
+
+  // XXX: Not implemented yet
+
+  /* all-to-all step */
+
+  step = create_step (session, round, GNUNET_NO);
+
+#ifdef GNUNET_EXTRA_LOGGING
+  step->debug_name = GNUNET_strdup ("all to all");
+#endif
+
+  for (unsigned int i = 0; i < n; i++)
+  {
+    uint16_t p1;
+    uint16_t p2;
+
+    p1 = me;
+    p2 = i;
+    arrange_peers (&p1, &p2, n);
+    task = ((struct TaskEntry) {
+      .key = (struct TaskKey) { PHASE_KIND_ALL_TO_ALL, p1, p2, -1, -1 },
+      .step = step,
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_CURRENT, 0 };
+    task.cls.setop.output_set = task.cls.setop.input_set;
+    task.cls.setop.do_not_remove = GNUNET_YES;
+    put_task (session->taskmap, &task);
+  }
+
+  round += 1;
+  prev_step = step;
+  step = create_step (session, round, GNUNET_NO);;
+#ifdef GNUNET_EXTRA_LOGGING
+  step->debug_name = GNUNET_strdup ("all to all 2");
+#endif
+  step_depend_on (step, prev_step);
+
+
+  for (unsigned int i = 0; i < n; i++)
+  {
+    uint16_t p1;
+    uint16_t p2;
+
+    p1 = me;
+    p2 = i;
+    arrange_peers (&p1, &p2, n);
+    task = ((struct TaskEntry) {
+      .key = (struct TaskKey) { PHASE_KIND_ALL_TO_ALL_2, p1, p2, -1, -1 },
+      .step = step,
+      .start = task_start_reconcile,
+      .cancel = task_cancel_reconcile,
+    });
+    task.cls.setop.input_set = (struct SetKey) { SET_KIND_CURRENT, 0 };
+    task.cls.setop.output_set = task.cls.setop.input_set;
+    task.cls.setop.do_not_remove = GNUNET_YES;
+    put_task (session->taskmap, &task);
+  }
+
+  round += 1;
+
+  prev_step = step;
+  step = NULL;
+
+
+  /* Byzantine union */
+
+  /* sequential repetitions of the gradecasts */
+  for (unsigned int i = 0; i < t + 1; i++)
+  {
+    struct Step *step_rep_start;
+    struct Step *step_rep_end;
+
+    /* Every repetition is in a separate round. */
+    step_rep_start = create_step (session, round, GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+    GNUNET_asprintf (&step_rep_start->debug_name, "gradecast start rep %u", i);
+#endif
+
+    step_depend_on (step_rep_start, prev_step);
+
+    /* gradecast has three rounds */
+    round += 3;
+    step_rep_end = create_step (session, round, GNUNET_YES);
+#ifdef GNUNET_EXTRA_LOGGING
+    GNUNET_asprintf (&step_rep_end->debug_name, "gradecast end rep %u", i);
+#endif
+
+    /* parallel gradecasts */
+    for (lead = 0; lead < n; lead++)
+      construct_task_graph_gradecast (session, i, lead, step_rep_start,
+                                      step_rep_end);
+
+    task = ((struct TaskEntry) {
+      .step = step_rep_end,
+      .key = (struct TaskKey) { PHASE_KIND_APPLY_REP, -1, -1, i, -1 },
+      .start = task_start_apply_round,
+    });
+    put_task (session->taskmap, &task);
+
+    prev_step = step_rep_end;
+  }
+
+  /* There is no next gradecast round, thus the final
+     start step is the overall end step of the gradecasts */
+  round += 1;
+  step = create_step (session, round, GNUNET_NO);
+#ifdef GNUNET_EXTRA_LOGGING
+  GNUNET_asprintf (&step->debug_name, "finish");
+#endif
+  step_depend_on (step, prev_step);
+
+  task = ((struct TaskEntry) {
+    .step = step,
+    .key = (struct TaskKey) { PHASE_KIND_FINISH, -1, -1, -1, -1 },
+    .start = task_start_finish,
+  });
+  task.cls.finish.input_set = (struct SetKey) { SET_KIND_LAST_GRADECAST };
+
+  put_task (session->taskmap, &task);
+}
+
+
+/**
+ * Check join message.
+ *
+ * @param cls session of client that sent the message
+ * @param m message sent by the client
+ * @return #GNUNET_OK if @a m is well-formed
+ */
+static int
+check_client_join (void *cls,
+                   const struct GNUNET_CONSENSUS_JoinMessage *m)
+{
+  uint32_t listed_peers = ntohl (m->num_peers);
+
+  if ((ntohs (m->header.size) - sizeof(*m)) !=
+      listed_peers * sizeof(struct GNUNET_PeerIdentity))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Called when a client wants to join a consensus session.
+ *
+ * @param cls session of client that sent the message
+ * @param m message sent by the client
+ */
+static void
+handle_client_join (void *cls,
+                    const struct GNUNET_CONSENSUS_JoinMessage *m)
+{
+  struct ConsensusSession *session = cls;
+  struct ConsensusSession *other_session;
+
+  initialize_session_peer_list (session,
+                                m);
+  compute_global_id (session,
+                     &m->session_id);
+
+  /* Check if some local client already owns the session.
+     It is only legal to have a session with an existing global id
+     if all other sessions with this global id are finished.*/
+  for (other_session = sessions_head;
+       NULL != other_session;
+       other_session = other_session->next)
+  {
+    if ( (other_session != session) &&
+         (0 == GNUNET_CRYPTO_hash_cmp (&session->global_id,
+                                       &other_session->global_id)) )
+      break;
+  }
+
+  session->conclude_deadline
+    = GNUNET_TIME_absolute_ntoh (m->deadline);
+  session->conclude_start
+    = GNUNET_TIME_absolute_ntoh (m->start);
+  session->local_peer_idx = get_peer_idx (&my_peer,
+                                          session);
+  GNUNET_assert (-1 != session->local_peer_idx);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Joining consensus session %s containing %u peers as %u with timeout %s\n",
+              GNUNET_h2s (&m->session_id),
+              session->num_peers,
+              session->local_peer_idx,
+              GNUNET_STRINGS_relative_time_to_string (
+                GNUNET_TIME_absolute_get_difference (session->conclude_start,
+                                                     session->conclude_deadline),
+                GNUNET_YES));
+
+  session->set_listener
+    = GNUNET_SET_listen (cfg,
+                         GNUNET_SET_OPERATION_UNION,
+                         &session->global_id,
+                         &set_listen_cb,
+                         session);
+
+  session->setmap = GNUNET_CONTAINER_multihashmap_create (1,
+                                                          GNUNET_NO);
+  session->taskmap = GNUNET_CONTAINER_multihashmap_create (1,
+                                                           GNUNET_NO);
+  session->diffmap = GNUNET_CONTAINER_multihashmap_create (1,
+                                                           GNUNET_NO);
+  session->rfnmap = GNUNET_CONTAINER_multihashmap_create (1,
+                                                          GNUNET_NO);
+
+  {
+    struct SetEntry *client_set;
+
+    client_set = GNUNET_new (struct SetEntry);
+    client_set->h = GNUNET_SET_create (cfg,
+                                       GNUNET_SET_OPERATION_UNION);
+    struct SetHandle *sh = GNUNET_new (struct SetHandle);
+    sh->h = client_set->h;
+    GNUNET_CONTAINER_DLL_insert (session->set_handles_head,
+                                 session->set_handles_tail,
+                                 sh);
+    client_set->key = ((struct SetKey) { SET_KIND_CURRENT, 0, 0 });
+    put_set (session,
+             client_set);
+  }
+
+  session->peers_blacklisted = GNUNET_new_array (session->num_peers,
+                                                 int);
+
+  /* Just construct the task graph,
+     but don't run anything until the client calls conclude. */
+  construct_task_graph (session);
+  GNUNET_SERVICE_client_continue (session->client);
+}
+
+
+/**
+ * Called when a client performs an insert operation.
+ *
+ * @param cls client handle
+ * @param msg message sent by the client
+ * @return #GNUNET_OK (always well-formed)
+ */
+static int
+check_client_insert (void *cls,
+                     const struct GNUNET_CONSENSUS_ElementMessage *msg)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Called when a client performs an insert operation.
+ *
+ * @param cls client handle
+ * @param msg message sent by the client
+ */
+static void
+handle_client_insert (void *cls,
+                      const struct GNUNET_CONSENSUS_ElementMessage *msg)
+{
+  struct ConsensusSession *session = cls;
+  ssize_t element_size;
+  struct GNUNET_SET_Handle *initial_set;
+  struct ConsensusElement *ce;
+
+  if (GNUNET_YES == session->conclude_started)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (session->client);
+    return;
+  }
+  element_size = ntohs (msg->header.size) - sizeof(*msg);
+  ce = GNUNET_malloc (sizeof(struct ConsensusElement) + element_size);
+  GNUNET_memcpy (&ce[1],
+                 &msg[1],
+                 element_size);
+  ce->payload_type = msg->element_type;
+
+  {
+    struct SetKey key = { SET_KIND_CURRENT, 0, 0 };
+    struct SetEntry *entry;
+
+    entry = lookup_set (session,
+                        &key);
+    GNUNET_assert (NULL != entry);
+    initial_set = entry->h;
+  }
+
+  session->num_client_insert_pending++;
+
+  {
+    struct GNUNET_SET_Element element = {
+      .element_type = GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT,
+      .size = sizeof(struct ConsensusElement) + element_size,
+      .data = ce,
+    };
+
+    GNUNET_SET_add_element (initial_set,
+                            &element,
+                            NULL,
+                            NULL);
+#ifdef GNUNET_EXTRA_LOGGING
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "P%u: element %s added\n",
+                session->local_peer_idx,
+                debug_str_element (&element));
+#endif
+  }
+  GNUNET_free (ce);
+  GNUNET_SERVICE_client_continue (session->client);
+}
+
+
+/**
+ * Called when a client performs the conclude operation.
+ *
+ * @param cls client handle
+ * @param message message sent by the client
+ */
+static void
+handle_client_conclude (void *cls,
+                        const struct GNUNET_MessageHeader *message)
+{
+  struct ConsensusSession *session = cls;
+
+  if (GNUNET_YES == session->conclude_started)
+  {
+    /* conclude started twice */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (session->client);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "conclude requested\n");
+  session->conclude_started = GNUNET_YES;
+  install_step_timeouts (session);
+  run_ready_steps (session);
+  GNUNET_SERVICE_client_continue (session->client);
+}
+
+
+/**
+ * Called to clean up, after a shutdown has been requested.
+ *
+ * @param cls closure
+ */
+static void
+shutdown_task (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "shutting down\n");
+  GNUNET_STATISTICS_destroy (statistics,
+                             GNUNET_NO);
+  statistics = NULL;
+}
+
+
+/**
+ * Start processing consensus requests.
+ *
+ * @param cls closure
+ * @param c configuration to use
+ * @param service the initialized service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *c,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  cfg = c;
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_get_peer_identity (cfg,
+                                       &my_peer))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Could not retrieve host identity\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  statistics = GNUNET_STATISTICS_create ("consensus",
+                                         cfg);
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task,
+                                 NULL);
+}
+
+
+/**
+ * Callback called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return @a c
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *c,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  struct ConsensusSession *session = GNUNET_new (struct ConsensusSession);
+
+  session->client = c;
+  session->client_mq = mq;
+  GNUNET_CONTAINER_DLL_insert (sessions_head,
+                               sessions_tail,
+                               session);
+  return session;
+}
+
+
+/**
+ * Callback called when a client disconnected from the service
+ *
+ * @param cls closure for the service
+ * @param c the client that disconnected
+ * @param internal_cls should be equal to @a c
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *c,
+                      void *internal_cls)
+{
+  struct ConsensusSession *session = internal_cls;
+
+  if (NULL != session->set_listener)
+  {
+    GNUNET_SET_listen_cancel (session->set_listener);
+    session->set_listener = NULL;
+  }
+  GNUNET_CONTAINER_DLL_remove (sessions_head,
+                               sessions_tail,
+                               session);
+  while (session->set_handles_head)
+  {
+    struct SetHandle *sh = session->set_handles_head;
+
+    session->set_handles_head = sh->next;
+    GNUNET_SET_destroy (sh->h);
+    GNUNET_free (sh);
+  }
+  GNUNET_free (session);
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN (
+  "consensus",
+  GNUNET_SERVICE_OPTION_NONE,
+  &run,
+  &client_connect_cb,
+  &client_disconnect_cb,
+  NULL,
+  GNUNET_MQ_hd_fixed_size (client_conclude,
+                           GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_CONCLUDE,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+  GNUNET_MQ_hd_var_size (client_insert,
+                         GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_INSERT,
+                         struct GNUNET_CONSENSUS_ElementMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (client_join,
+                         GNUNET_MESSAGE_TYPE_CONSENSUS_CLIENT_JOIN,
+                         struct GNUNET_CONSENSUS_JoinMessage,
+                         NULL),
+  GNUNET_MQ_handler_end ());
+
+/* end of gnunet-service-consensus.c */
diff --git a/src/contrib/service/consensus/meson.build b/src/contrib/service/consensus/meson.build
new file mode 100644
index 000000000..b66acf2b9
--- /dev/null
+++ b/src/contrib/service/consensus/meson.build
@@ -0,0 +1,67 @@
+libgnunetconsensus_src = ['consensus_api.c']
+
+gnunetserviceconsensus_src = ['gnunet-service-consensus.c']
+
+configure_file(input : 'consensus.conf.in',
+               output : 'consensus.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+# FIXME needs new seti/setu
+if get_option('monolith')
+  #foreach p : libgnunetconsensus_src + gnunetserviceconsensus_src
+  #  gnunet_src += 'consensus/' + p
+  #endforeach
+  subdir_done()
+endif
+
+libgnunetconsensus = shared_library('gnunetconsensus',
+        libgnunetconsensus_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: libgnunetutil_dep,
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+pkg.generate(libgnunetconsensus, url: 'https://www.gnunet.org',
+             description : 'Provides API for accessing the consensus service')
+libgnunetarm_dep = declare_dependency(link_with : libgnunetarm)
+libgnunetconsensus_dep = declare_dependency(link_with : libgnunetconsensus)
+
+shared_module('gnunet_plugin_block_consensus',
+              ['plugin_block_consensus.c'],
+              dependencies: [libgnunetutil_dep,
+                             libgnunetblock_dep],
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+
+executable ('gnunet-service-consensus',
+            gnunetserviceconsensus_src,
+            dependencies: [libgnunetconsensus_dep,
+                           libgnunetutil_dep,
+                           libgnunetset_dep,
+                           libgnunetstatistics_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir') / 'gnunet' / 'libexec')
+
+# FIXME do we need evil stuff and ENABLE_MALICIOUS?
+
+testconsensusapi = executable ('test_consensus_api',
+            ['test_consensus_api.c'],
+            dependencies: [libgnunetconsensus_dep,
+                           libgnunetutil_dep,
+                           libgnunettesting_dep],
+            include_directories: [incdir, configuration_inc],
+            install: false)
+
+configure_file(input : 'test_consensus.conf',
+               output : 'test_consensus.conf',
+               configuration : cdata,
+               install: false)
+
+test('test_consensus_api', testconsensusapi,
+  workdir: meson.current_build_dir(),
+  suite: 'consensus')
diff --git a/src/contrib/service/consensus/plugin_block_consensus.c b/src/contrib/service/consensus/plugin_block_consensus.c
new file mode 100644
index 000000000..241d8fc7b
--- /dev/null
+++ b/src/contrib/service/consensus/plugin_block_consensus.c
@@ -0,0 +1,222 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017, 2021 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file consensus/plugin_block_consensus.c
+ * @brief consensus block, either nested block or marker
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "consensus_protocol.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Our closure.
+ */
+struct BlockContext
+{
+  /**
+   * Configuration to use.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Lazily initialized block context.
+   */
+  struct GNUNET_BLOCK_Context *bc;
+};
+
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_consensus_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  /* consensus does not use queries/DHT */
+  GNUNET_break (0);
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_consensus_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const void *block,
+                                    size_t block_size)
+{
+  struct BlockContext *ctx = cls;
+  const struct ConsensusElement *ce = block;
+
+  if (block_size < sizeof(*ce))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_NO;
+  }
+  if ( (0 != ce->marker) ||
+       (0 == ce->payload_type) )
+    return GNUNET_OK;
+  if (NULL == ctx->bc)
+    ctx->bc = GNUNET_BLOCK_context_create (ctx->cfg);
+  return GNUNET_BLOCK_check_block (ctx->bc,
+                                   ntohl (ce->payload_type),
+                                   &ce[1],
+                                   block_size - sizeof(*ce));
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_consensus_check_reply (
+  void *cls,
+  enum GNUNET_BLOCK_Type type,
+  struct GNUNET_BLOCK_Group *group,
+  const struct GNUNET_HashCode *query,
+  const void *xquery,
+  size_t xquery_size,
+  const void *reply_block,
+  size_t reply_block_size)
+{
+  struct BlockContext *ctx = cls;
+  const struct ConsensusElement *ce = reply_block;
+
+  GNUNET_assert (reply_block_size >= sizeof(struct ConsensusElement));
+  if ( (0 != ce->marker) ||
+       (0 == ce->payload_type) )
+    return GNUNET_BLOCK_REPLY_OK_MORE;
+  if (NULL == ctx->bc)
+    ctx->bc = GNUNET_BLOCK_context_create (ctx->cfg);
+  return GNUNET_BLOCK_check_reply (ctx->bc,
+                                   ntohl (ce->payload_type),
+                                   group,
+                                   query,
+                                   xquery,
+                                   xquery_size,
+                                   &ce[1],
+                                   reply_block_size - sizeof(*ce));
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_consensus_get_key (void *cls,
+                                enum GNUNET_BLOCK_Type type,
+                                const void *block,
+                                size_t block_size,
+                                struct GNUNET_HashCode *key)
+{
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_consensus_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_CONSENSUS_ELEMENT,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  const struct GNUNET_CONFIGURATION_Handle *cfg = cls;
+  struct BlockContext *ctx;
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  ctx = GNUNET_new (struct BlockContext);
+  ctx->cfg = cfg;
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->cls = ctx;
+  api->get_key = &block_plugin_consensus_get_key;
+  api->check_query = &block_plugin_consensus_check_query;
+  api->check_block = &block_plugin_consensus_check_block;
+  api->check_reply = &block_plugin_consensus_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_consensus_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+  struct BlockContext *ctx = api->cls;
+
+  if (NULL != ctx->bc)
+    GNUNET_BLOCK_context_destroy (ctx->bc);
+  GNUNET_free (ctx);
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_consensus.c */
diff --git a/src/contrib/service/consensus/test_consensus.conf b/src/contrib/service/consensus/test_consensus.conf
new file mode 100644
index 000000000..df7fb6861
--- /dev/null
+++ b/src/contrib/service/consensus/test_consensus.conf
@@ -0,0 +1,87 @@
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-consensus/
+
+[consensus]
+#OPTIONS = -L INFO
+BINARY = gnunet-service-consensus
+
+#PREFIX = valgrind
+
+#EVIL_SPEC = 0;cram-all;noreplace;5
+#EVIL_SPEC = 0;cram;5/1;cram;5
+#EVIL_SPEC = 0;cram;5/1;cram;5/2;cram;5
+#EVIL_SPEC = 0;cram;5/1;cram;5/2;cram;5/3;cram;5
+
+
+[arm]
+RESOURCE_DIAGNOSTICS = resource.log.${PEERID:-master}
+
+[core]
+IMMEDIATE_START = YES
+
+[revocation]
+IMMEDIATE_START = NO
+
+[fs]
+IMMEDIATE_START = NO
+
+[gns]
+IMMEDIATE_START = NO
+
+[zonemaster]
+IMMEDIATE_START = NO
+
+[hostlist]
+IMMEDIATE_START = NO
+
+[cadet]
+#PREFIX = valgrind
+
+[transport]
+PLUGINS = unix
+OPTIONS = -LERROR
+
+[set]
+#OPTIONS = -L INFO
+#PREFIX = valgrind --leak-check=full
+#PREFIX = valgrind
+
+[testbed]
+OVERLAY_TOPOLOGY = CLIQUE
+MAX_PARALLEL_OPERATIONS = 1000
+MAX_PARALLEL_TOPOLOGY_CONFIG_OPERATIONS = 100
+OPERATION_TIMEOUT = 60 s
+MAX_OPEN_FDS = 4096
+
+[hostlist]
+START_ON_DEMAND = NO
+
+[fs]
+START_ON_DEMAND = NO
+
+[revocation]
+START_ON_DEMAND = NO
+
+[nat]
+# Use addresses from the local network interfaces (including loopback, but also others)
+USE_LOCALADDR = YES
+
+# Disable IPv6 support
+DISABLEV6 = NO
+
+# Do we use addresses from localhost address ranges? (::1, 127.0.0.0/8)
+RETURN_LOCAL_ADDRESSES = YES
+
+[nse]
+WORKBITS=0
+
+[ats]
+WAN_QUOTA_IN = unlimited
+WAN_QUOTA_OUT = unlimited
+
+[core]
+USE_EPHEMERAL_KEYS = NO
+
+[rps]
+START_ON_DEMAND = NO
+IMMEDIATE_START = NO
diff --git a/src/contrib/service/consensus/test_consensus_api.c b/src/contrib/service/consensus/test_consensus_api.c
new file mode 100644
index 000000000..235a67484
--- /dev/null
+++ b/src/contrib/service/consensus/test_consensus_api.c
@@ -0,0 +1,120 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file consensus/test_consensus_api.c
+ * @brief testcase for consensus_api.c
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_consensus_service.h"
+#include "gnunet_testing_lib.h"
+
+
+static struct GNUNET_CONSENSUS_Handle *consensus;
+
+static struct GNUNET_HashCode session_id;
+
+static unsigned int elements_received;
+
+
+static void
+conclude_done (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "conclude over\n");
+  if (2 != elements_received)
+    GNUNET_assert (0);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+on_new_element (void *cls,
+                const struct GNUNET_SET_Element *element)
+{
+  elements_received++;
+}
+
+
+static void
+insert_done (void *cls, int success)
+{
+  /* make sure cb is only called once */
+  static int called = GNUNET_NO;
+
+  GNUNET_assert (GNUNET_NO == called);
+  called = GNUNET_YES;
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "insert done\n");
+  GNUNET_CONSENSUS_conclude (consensus, &conclude_done, NULL);
+}
+
+
+/**
+ * Signature of the main function of a task.
+ *
+ * @param cls closure
+ */
+static void
+on_shutdown (void *cls)
+{
+  if (NULL != consensus)
+  {
+    GNUNET_CONSENSUS_destroy (consensus);
+    consensus = NULL;
+  }
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  char *str = "foo";
+
+  struct GNUNET_SET_Element el1 = { 4, 0, "foo" };
+  struct GNUNET_SET_Element el2 = { 5, 0, "quux" };
+
+  GNUNET_log_setup ("test_consensus_api",
+                    "INFO",
+                    NULL);
+  GNUNET_SCHEDULER_add_shutdown (&on_shutdown, NULL);
+
+  GNUNET_CRYPTO_hash (str, strlen (str), &session_id);
+  consensus = GNUNET_CONSENSUS_create (cfg, 0, NULL, &session_id,
+                                       GNUNET_TIME_relative_to_absolute (
+                                         GNUNET_TIME_UNIT_SECONDS),
+                                       GNUNET_TIME_relative_to_absolute (
+                                         GNUNET_TIME_UNIT_MINUTES),
+                                       on_new_element, &consensus);
+  GNUNET_assert (consensus != NULL);
+
+  GNUNET_CONSENSUS_insert (consensus, &el1, NULL, &consensus);
+  GNUNET_CONSENSUS_insert (consensus, &el2, &insert_done, &consensus);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  return GNUNET_TESTING_peer_run ("test_consensus_api",
+                                  "test_consensus.conf",
+                                  &run, NULL);
+}
diff --git a/src/contrib/service/secretsharing/.gitignore b/src/contrib/service/secretsharing/.gitignore
new file mode 100644
index 000000000..fe9db53a4
--- /dev/null
+++ b/src/contrib/service/secretsharing/.gitignore
@@ -0,0 +1,3 @@
+gnunet-service-secretsharing
+gnunet-secretsharing-profiler
+test_secretsharing_api
diff --git a/src/contrib/service/secretsharing/Makefile.am b/src/contrib/service/secretsharing/Makefile.am
new file mode 100644
index 000000000..afc42309c
--- /dev/null
+++ b/src/contrib/service/secretsharing/Makefile.am
@@ -0,0 +1,74 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+pkgcfg_DATA = \
+  secretsharing.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = -fprofile-arcs -ftest-coverage
+endif
+
+
+libexec_PROGRAMS = \
+ gnunet-service-secretsharing
+
+#noinst_PROGRAMS = \
+# gnunet-secretsharing-profiler
+
+lib_LTLIBRARIES = \
+  libgnunetsecretsharing.la
+
+
+# TNG
+#gnunet_secretsharing_profiler_SOURCES = \
+# gnunet-secretsharing-profiler.c
+#gnunet_secretsharing_profiler_LDADD = \
+#  libgnunetsecretsharing.la \
+#  $(top_builddir)/src/service/testing/libgnunettesting.la \
+#  $(top_builddir)/src/testbed/libgnunettestbed.la \
+#  $(top_builddir)/src/lib/util/libgnunetutil.la \
+#  $(GN_LIBINTL)
+
+gnunet_service_secretsharing_SOURCES = \
+ gnunet-service-secretsharing.c \
+ secretsharing_common.c \
+ secretsharing_protocol.h
+gnunet_service_secretsharing_CFLAGS = $(AM_CFLAGS)
+gnunet_service_secretsharing_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/contrib/service/consensus/libgnunetconsensus.la \
+  $(LIBGCRYPT_LIBS) \
+  $(GN_LIBINTL)
+
+libgnunetsecretsharing_la_SOURCES = \
+  secretsharing_api.c \
+  secretsharing_common.c \
+  secretsharing.h
+libgnunetsecretsharing_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LIBGCRYPT_LIBS) \
+  $(LTLIBINTL)
+libgnunetsecretsharing_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)
+
+check_PROGRAMS = \
+ # test_secretsharing_api
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
+
+test_secretsharing_api_SOURCES = \
+ test_secretsharing_api.c
+test_secretsharing_api_LDADD = \
+  libgnunetsecretsharing.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la
+
+EXTRA_DIST = \
+  test_secretsharing.conf
diff --git a/src/contrib/service/secretsharing/gnunet-secretsharing-profiler.c b/src/contrib/service/secretsharing/gnunet-secretsharing-profiler.c
new file mode 100644
index 000000000..432d6da89
--- /dev/null
+++ b/src/contrib/service/secretsharing/gnunet-secretsharing-profiler.c
@@ -0,0 +1,662 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2014 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file secretsharing/gnunet-secretsharing-profiler.c
+ * @brief profiling tool for distributed key generation and decryption
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_secretsharing_service.h"
+#include "gnunet_testbed_service.h"
+
+/**
+ * How many peers should participate in the key generation?
+ */
+static unsigned int num_peers = 3;
+
+/**
+ * What should the threshold for then key be?
+ */
+static unsigned int threshold = 2;
+
+/**
+ * Should we try to decrypt a value after the key generation?
+ */
+static int decrypt = GNUNET_NO;
+
+/**
+ * When would we like to see the operation finished?
+ */
+static struct GNUNET_TIME_Relative timeout;
+
+/**
+ * When should dkg communication start?
+ */
+static struct GNUNET_TIME_Relative delay;
+
+/**
+ * Handles for secretsharing sessions.
+ */
+static struct GNUNET_SECRETSHARING_Session **session_handles;
+
+static struct GNUNET_SECRETSHARING_DecryptionHandle **decrypt_handles;
+
+/**
+ * Shares we got from the distributed key generation.
+ */
+static struct GNUNET_SECRETSHARING_Share **shares;
+
+static struct GNUNET_SECRETSHARING_PublicKey common_pubkey;
+
+
+static unsigned int num_connected_sessions;
+
+static unsigned int num_connected_decrypt;
+
+/**
+ * Handles to the running peers.
+ * When peers[i] is NULL, the i-th peer has stopped.
+ */
+static struct GNUNET_TESTBED_Peer **peers;
+
+static struct GNUNET_PeerIdentity *peer_ids;
+
+static unsigned int num_retrieved_peer_ids;
+
+static unsigned int num_generated;
+
+static unsigned int num_decrypted;
+
+static struct GNUNET_HashCode session_id;
+
+static unsigned int verbose;
+
+static struct GNUNET_SECRETSHARING_Plaintext reference_plaintext;
+
+static struct GNUNET_SECRETSHARING_Ciphertext ciphertext;
+
+static struct GNUNET_TIME_Absolute dkg_start;
+
+static struct GNUNET_TIME_Absolute dkg_deadline;
+
+
+static struct GNUNET_TIME_Absolute decrypt_start;
+
+static struct GNUNET_TIME_Absolute decrypt_deadline;
+
+/**
+ * Connect operations, one for every peer.
+ */
+static struct GNUNET_TESTBED_Operation **connect_ops;
+
+/**
+ * Are we performing a shutdown right now?
+ */
+static int in_shutdown;
+
+
+/**
+ * Signature of the event handler function called by the
+ * respective event controller.
+ *
+ * @param cls closure
+ * @param event information about the event
+ */
+static void
+controller_cb (void *cls,
+               const struct GNUNET_TESTBED_EventInformation *event)
+{
+  GNUNET_assert (0);
+}
+
+
+/**
+ * Callback to be called when a service connect operation is completed
+ *
+ * @param cls the callback closure from functions generating an operation
+ * @param op the operation that has been finished
+ * @param ca_result the service handle returned from GNUNET_TESTBED_ConnectAdapter()
+ * @param emsg error message in case the operation has failed; will be NULL if
+ *          operation has executed successfully.
+ */
+static void
+session_connect_complete (void *cls,
+                          struct GNUNET_TESTBED_Operation *op,
+                          void *ca_result,
+                          const char *emsg)
+{
+  if (NULL != emsg)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "testbed connect emsg: %s\n",
+                emsg);
+    GNUNET_assert (0);
+  }
+
+  num_connected_sessions++;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "dkg: session connect complete\n");
+
+  if (num_connected_sessions == num_peers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "dkg: all peers connected\n");
+  }
+}
+
+
+/**
+ * Callback to be called when a service connect operation is completed
+ *
+ * @param cls the callback closure from functions generating an operation
+ * @param op the operation that has been finished
+ * @param ca_result the service handle returned from GNUNET_TESTBED_ConnectAdapter()
+ * @param emsg error message in case the operation has failed; will be NULL if
+ *          operation has executed successfully.
+ */
+static void
+decrypt_connect_complete (void *cls,
+                          struct GNUNET_TESTBED_Operation *op,
+                          void *ca_result,
+                          const char *emsg)
+{
+  if (NULL != emsg)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "testbed connect emsg: %s\n",
+                emsg);
+    GNUNET_assert (0);
+  }
+
+  num_connected_decrypt++;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "decrypt: session connect complete\n");
+
+  if (num_connected_decrypt == num_peers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "decrypt: all peers connected\n");
+  }
+}
+
+
+/**
+ * Called when a decryption has succeeded.
+ *
+ * @param cls Plaintext
+ * @param plaintext Plaintext
+ */
+static void
+decrypt_cb (void *cls,
+            const struct GNUNET_SECRETSHARING_Plaintext *plaintext)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle **dhp = cls;
+  unsigned int n = dhp - decrypt_handles;
+
+  num_decrypted++;
+
+  *dhp = NULL;
+
+  // we should still be connected if this is called
+  GNUNET_assert (NULL != connect_ops[n]);
+
+  GNUNET_TESTBED_operation_done (connect_ops[n]);
+
+  if (NULL == plaintext)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "decrypt failed for peer %u\n", n);
+    return;
+  }
+  else if (0 == GNUNET_memcmp (&reference_plaintext, plaintext))
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "decrypt got correct result for peer %u\n", n);
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "decrypt got wrong result for peer %u\n", n);
+
+  if (num_decrypted == num_peers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "every peer decrypted\n");
+    GNUNET_SCHEDULER_shutdown ();
+  }
+
+  *dhp = NULL;
+}
+
+
+/**
+ * Adapter function called to establish a connection to
+ * a service.
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer to connect to; will be available until
+ *          GNUNET_TESTBED_operation_done() is called on the operation returned
+ *          from GNUNET_TESTBED_service_connect()
+ * @return service handle to return in 'op_result', NULL on error
+ */
+static void *
+decrypt_connect_adapter (void *cls,
+                         const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle **hp = cls;
+  unsigned int n = hp - decrypt_handles;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "decrypt connect adapter, %d peers\n",
+              num_peers);
+  *hp = GNUNET_SECRETSHARING_decrypt (cfg, shares[n], &ciphertext,
+                                      decrypt_start, decrypt_deadline,
+                                      decrypt_cb,
+                                      hp);
+
+  return *hp;
+}
+
+
+/**
+ * Adapter function called to destroy a connection to
+ * a service.
+ *
+ * @param cls closure
+ * @param op_result service handle returned from the connect adapter
+ */
+static void
+decrypt_disconnect_adapter (void *cls, void *op_result)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle **dh = cls;
+  unsigned int n = dh - decrypt_handles;
+
+  GNUNET_assert (*dh == decrypt_handles[n]);
+
+  if (NULL != *dh)
+  {
+    GNUNET_SECRETSHARING_decrypt_cancel (*dh);
+    *dh = NULL;
+  }
+
+  GNUNET_assert (NULL != connect_ops[n]);
+  connect_ops[n] = NULL;
+}
+
+
+static void
+secret_ready_cb (void *cls,
+                 struct GNUNET_SECRETSHARING_Share *my_share,
+                 struct GNUNET_SECRETSHARING_PublicKey *public_key,
+                 unsigned int num_ready_peers,
+                 const struct GNUNET_PeerIdentity *ready_peers)
+{
+  struct GNUNET_SECRETSHARING_Session **sp = cls;
+  unsigned int n = sp - session_handles;
+  char pubkey_str[1024];
+  char *ret;
+
+  num_generated++;
+  *sp = NULL;
+  shares[n] = my_share;
+  if (NULL == my_share)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "key generation failed for peer #%u\n",
+                n);
+  }
+  else
+  {
+    ret = GNUNET_STRINGS_data_to_string (public_key, sizeof *public_key,
+                                         pubkey_str, 1024);
+    GNUNET_assert (NULL != ret);
+    *ret = '\0';
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "key generation successful for peer #%u, pubkey %s\n", n,
+                pubkey_str);
+
+    /* we're the first to get the key -> store it */
+    if (num_generated == 1)
+    {
+      common_pubkey = *public_key;
+    }
+    else if (0 != GNUNET_memcmp (public_key, &common_pubkey))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "generated public keys do not match\n");
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+  }
+
+  // we should still be connected
+  GNUNET_assert (NULL != connect_ops[n]);
+
+  // disconnect from the service, will call the disconnect callback
+  GNUNET_TESTBED_operation_done (connect_ops[n]);
+}
+
+
+/**
+ * Adapter function called to establish a connection to
+ * a service.
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer to connect to; will be available until
+ *          GNUNET_TESTBED_operation_done() is called on the operation returned
+ *          from GNUNET_TESTBED_service_connect()
+ * @return service handle to return in 'op_result', NULL on error
+ */
+static void *
+session_connect_adapter (void *cls,
+                         const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_SECRETSHARING_Session **sp = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "connect adapter, %d peers\n",
+              num_peers);
+  *sp = GNUNET_SECRETSHARING_create_session (cfg,
+                                             num_peers,
+                                             peer_ids,
+                                             &session_id,
+                                             dkg_start,
+                                             dkg_deadline,
+                                             threshold,
+                                             &secret_ready_cb, sp);
+  return *sp;
+}
+
+
+/**
+ * Adapter function called to destroy a connection to
+ * a service.
+ *
+ * @param cls closure
+ * @param op_result service handle returned from the connect adapter
+ */
+static void
+session_disconnect_adapter (void *cls, void *op_result)
+{
+  struct GNUNET_SECRETSHARING_Session **sp = cls;
+  unsigned int n = (sp - session_handles);
+
+  GNUNET_assert (*sp == session_handles[n]);
+
+  if (NULL != *sp)
+  {
+    GNUNET_SECRETSHARING_session_destroy (*sp);
+    *sp = NULL;
+  }
+
+  GNUNET_assert (NULL != connect_ops[n]);
+  connect_ops[n] = NULL;
+
+  if (GNUNET_YES == in_shutdown)
+    return;
+
+  // all peers received their secret
+  if (num_generated == num_peers)
+  {
+    int i;
+
+    // only do decryption if requested by the user
+    if (GNUNET_NO == decrypt)
+    {
+      GNUNET_SCHEDULER_shutdown ();
+      return;
+    }
+
+    decrypt_start = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
+                                              delay);
+    decrypt_deadline = GNUNET_TIME_absolute_add (decrypt_start, timeout);
+
+    // compute g^42 as the plaintext which we will decrypt and then
+    // cooperatively decrypt
+    GNUNET_SECRETSHARING_plaintext_generate_i (&reference_plaintext, 42);
+    GNUNET_SECRETSHARING_encrypt (&common_pubkey, &reference_plaintext,
+                                  &ciphertext);
+
+    for (i = 0; i < num_peers; i++)
+      connect_ops[i] =
+        GNUNET_TESTBED_service_connect (NULL, peers[i], "secretsharing",
+                                        &decrypt_connect_complete, NULL,
+                                        &decrypt_connect_adapter,
+                                        &decrypt_disconnect_adapter,
+                                        &decrypt_handles[i]);
+  }
+}
+
+
+/**
+ * Callback to be called when the requested peer information is available
+ *
+ * @param cb_cls the closure from GNUNET_TESTBED_peer_get_information()
+ * @param op the operation this callback corresponds to
+ * @param pinfo the result; will be NULL if the operation has failed
+ * @param emsg error message if the operation has failed; will be NULL if the
+ *          operation is successful
+ */
+static void
+peer_info_cb (void *cb_cls,
+              struct GNUNET_TESTBED_Operation *op,
+              const struct GNUNET_TESTBED_PeerInformation *pinfo,
+              const char *emsg)
+{
+  struct GNUNET_PeerIdentity *p;
+  int i;
+
+  GNUNET_assert (NULL == emsg);
+
+  p = (struct GNUNET_PeerIdentity *) cb_cls;
+
+  if (pinfo->pit == GNUNET_TESTBED_PIT_IDENTITY)
+  {
+    *p = *pinfo->result.id;
+    num_retrieved_peer_ids++;
+    if (num_retrieved_peer_ids == num_peers)
+      for (i = 0; i < num_peers; i++)
+        connect_ops[i] =
+          GNUNET_TESTBED_service_connect (NULL, peers[i], "secretsharing",
+                                          session_connect_complete, NULL,
+                                          session_connect_adapter,
+                                          session_disconnect_adapter,
+                                          &session_handles[i]);
+  }
+  else
+  {
+    GNUNET_assert (0);
+  }
+
+  GNUNET_TESTBED_operation_done (op);
+}
+
+
+/**
+ * Signature of the main function of a task.
+ *
+ * @param cls closure
+ */
+static void
+handle_shutdown (void *cls)
+{
+  in_shutdown = GNUNET_YES;
+
+  if (NULL != connect_ops)
+  {
+    unsigned int i;
+    for (i = 0; i < num_peers; i++)
+      if (NULL != connect_ops[i])
+      {
+        // the disconnect callback will set the op to NULL
+        GNUNET_TESTBED_operation_done (connect_ops[i]);
+      }
+    GNUNET_free (connect_ops);
+  }
+
+  // killing the testbed operation will take care of remaining
+  // service handles in the disconnect callback
+}
+
+
+/**
+ * Signature of a main function for a testcase.
+ *
+ * @param cls closure
+ * @param h the run handle
+ * @param num_peers number of peers in 'peers'
+ * @param started_peers handle to peers run in the testbed.  NULL upon timeout (see
+ *          GNUNET_TESTBED_test_run()).
+ * @param links_succeeded the number of overlay link connection attempts that
+ *          succeeded
+ * @param links_failed the number of overlay link connection attempts that
+ *          failed
+ */
+static void
+test_master (void *cls,
+             struct GNUNET_TESTBED_RunHandle *h,
+             unsigned int num_peers,
+             struct GNUNET_TESTBED_Peer **started_peers,
+             unsigned int links_succeeded,
+             unsigned int links_failed)
+{
+  int i;
+
+  GNUNET_log_setup ("gnunet-secretsharing-profiler", "INFO", NULL);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "test master\n");
+
+  GNUNET_SCHEDULER_add_shutdown (&handle_shutdown, NULL);
+
+  peers = started_peers;
+
+  peer_ids = GNUNET_malloc (num_peers * sizeof(struct GNUNET_PeerIdentity));
+
+  session_handles = GNUNET_new_array (num_peers, struct
+                                      GNUNET_SECRETSHARING_Session *);
+  decrypt_handles = GNUNET_new_array (num_peers, struct
+                                      GNUNET_SECRETSHARING_DecryptionHandle *);
+  connect_ops = GNUNET_new_array (num_peers, struct GNUNET_TESTBED_Operation *);
+  shares = GNUNET_new_array (num_peers, struct GNUNET_SECRETSHARING_Share *);
+
+  for (i = 0; i < num_peers; i++)
+  {
+    // we do not store the returned operation, as peer_info_cb
+    // will receive it as a parameter and call GNUNET_TESTBED_operation_done.
+    GNUNET_TESTBED_peer_get_information (peers[i],
+                                         GNUNET_TESTBED_PIT_IDENTITY,
+                                         peer_info_cb,
+                                         &peer_ids[i]);
+  }
+}
+
+
+static void
+run (void *cls, char *const *args, const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  static char *session_str = "gnunet-secretsharing/test";
+  char *topology;
+  int topology_cmp_result;
+
+  dkg_start = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (), delay);
+  dkg_deadline = GNUNET_TIME_absolute_add (dkg_start, timeout);
+
+  if (GNUNET_OK != GNUNET_CONFIGURATION_get_value_string (cfg, "testbed",
+                                                          "OVERLAY_TOPOLOGY",
+                                                          &topology))
+  {
+    fprintf (stderr,
+             "'OVERLAY_TOPOLOGY' not found in 'testbed' config section, "
+             "seems like you passed the wrong configuration file\n");
+    return;
+  }
+
+  topology_cmp_result = strcasecmp (topology, "NONE");
+  GNUNET_free (topology);
+
+  if (0 == topology_cmp_result)
+  {
+    fprintf (stderr,
+             "'OVERLAY_TOPOLOGY' set to 'NONE', "
+             "seems like you passed the wrong configuration file\n");
+    return;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "running gnunet-secretsharing-profiler\n");
+
+  GNUNET_CRYPTO_hash (session_str, strlen (session_str), &session_id);
+
+  (void) GNUNET_TESTBED_test_run ("gnunet-secretsharing-profiler",
+                                  cfgfile,
+                                  num_peers,
+                                  0,
+                                  controller_cb,
+                                  NULL,
+                                  test_master,
+                                  NULL);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_option_uint ('n',
+                               "num-peers",
+                               NULL,
+                               gettext_noop ("number of peers in consensus"),
+                               &num_peers),
+
+    GNUNET_GETOPT_option_relative_time ('D',
+                                        "delay",
+                                        NULL,
+                                        gettext_noop ("dkg start delay"),
+                                        &delay),
+
+    GNUNET_GETOPT_option_relative_time ('t',
+                                        "timeout",
+                                        NULL,
+                                        gettext_noop ("dkg timeout"),
+                                        &timeout),
+
+    GNUNET_GETOPT_option_uint ('k',
+                               "threshold",
+                               NULL,
+                               gettext_noop ("threshold"),
+                               &threshold),
+
+    GNUNET_GETOPT_option_flag ('d',
+                               "descrypt",
+                               gettext_noop ("also profile decryption"),
+                               &decrypt),
+
+
+    GNUNET_GETOPT_option_verbose (&verbose),
+
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  delay = GNUNET_TIME_UNIT_ZERO;
+  timeout = GNUNET_TIME_UNIT_MINUTES;
+  GNUNET_PROGRAM_run2 (argc, argv, "gnunet-secretsharing-profiler",
+                       "help",
+                       options, &run, NULL, GNUNET_YES);
+  return 0;
+}
diff --git a/src/contrib/service/secretsharing/gnunet-service-secretsharing.c b/src/contrib/service/secretsharing/gnunet-service-secretsharing.c
new file mode 100644
index 000000000..84338bd11
--- /dev/null
+++ b/src/contrib/service/secretsharing/gnunet-service-secretsharing.c
@@ -0,0 +1,2414 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file secretsharing/gnunet-service-secretsharing.c
+ * @brief secret sharing service
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_time_lib.h"
+#include "gnunet_signatures.h"
+#include "gnunet_consensus_service.h"
+#include "secretsharing.h"
+#include "secretsharing_protocol.h"
+#include <gcrypt.h>
+
+
+#define EXTRA_CHECKS 1
+
+
+/**
+ * Info about a peer in a key generation session.
+ */
+struct KeygenPeerInfo
+{
+  /**
+   * Peer identity of the peer.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * The peer's paillier public key.
+   * Freshly generated for each keygen session.
+   */
+  struct GNUNET_CRYPTO_PaillierPublicKey paillier_public_key;
+
+  /**
+   * The peer's commitment to its presecret.
+   */
+  gcry_mpi_t presecret_commitment;
+
+  /**
+   * Commitment to the preshare that is
+   * intended for our peer.
+   */
+  gcry_mpi_t preshare_commitment;
+
+  /**
+   * Sigma (exponentiated share) for this peer.
+   */
+  gcry_mpi_t sigma;
+
+  /**
+   * Did we successfully receive the round1 element
+   * of the peer?
+   */
+  int round1_valid;
+
+  /**
+   * Did we successfully receive the round2 element
+   * of the peer?
+   */
+  int round2_valid;
+};
+
+
+/**
+ * Information about a peer in a decrypt session.
+ */
+struct DecryptPeerInfo
+{
+  /**
+   * Identity of the peer.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * Original index in the key generation round.
+   * Necessary for computing the lagrange coefficients.
+   */
+  unsigned int original_index;
+
+  /**
+   * Set to the partial decryption of
+   * this peer, or NULL if we did not
+   * receive a partial decryption from this
+   * peer or the zero knowledge proof failed.
+   */
+  gcry_mpi_t partial_decryption;
+};
+
+
+/**
+ * State we keep per client.
+ */
+struct ClientState;
+
+
+/**
+ * Session to establish a threshold-shared secret.
+ */
+struct KeygenSession
+{
+  /**
+   * Current consensus, used for both DKG rounds.
+   */
+  struct GNUNET_CONSENSUS_Handle *consensus;
+
+  /**
+   * Which client is this for?
+   */
+  struct ClientState *cs;
+
+  /**
+   * Randomly generated coefficients of the polynomial for sharing our
+   * pre-secret, where 'preshares[0]' is our pre-secret.  Contains 'threshold'
+   * elements, thus represents a polynomial of degree 'threshold-1', which can
+   * be interpolated with 'threshold' data points.
+   *
+   * The pre-secret-shares 'i=1,...,num_peers' are given by evaluating this
+   * polyomial at 'i' for share i.
+   */
+  gcry_mpi_t *presecret_polynomial;
+
+  /**
+   * Minimum number of shares required to restore the secret.
+   * Also the number of coefficients for the polynomial representing
+   * the sharing.  Obviously, the polynomial then has degree threshold-1.
+   */
+  unsigned int threshold;
+
+  /**
+   * Total number of peers.
+   */
+  unsigned int num_peers;
+
+  /**
+   * Index of the local peer.
+   */
+  unsigned int local_peer;
+
+  /**
+   * Information about all participating peers.
+   * Array of size 'num_peers'.
+   */
+  struct KeygenPeerInfo *info;
+
+  /**
+   * List of all peers involved in the secret sharing session.
+   */
+  struct GNUNET_PeerIdentity *peers;
+
+  /**
+   * Identifier for this session.
+   */
+  struct GNUNET_HashCode session_id;
+
+  /**
+   * Paillier private key of our peer.
+   */
+  struct GNUNET_CRYPTO_PaillierPrivateKey paillier_private_key;
+
+  /**
+   * When would we like the key to be established?
+   */
+  struct GNUNET_TIME_Absolute deadline;
+
+  /**
+   * When does the DKG start?  Necessary to compute fractions of the
+   * operation's desired time interval.
+   */
+  struct GNUNET_TIME_Absolute start_time;
+
+  /**
+   * Index of the local peer in the ordered list
+   * of peers in the session.
+   */
+  unsigned int local_peer_idx;
+
+  /**
+   * Share of our peer.  Once preshares from other peers are received, they
+   * will be added to 'my'share.
+   */
+  gcry_mpi_t my_share;
+
+  /**
+   * Public key, will be updated when a round2 element arrives.
+   */
+  gcry_mpi_t public_key;
+};
+
+
+/**
+ * Session to cooperatively decrypt a value.
+ */
+struct DecryptSession
+{
+  /**
+   * Handle to the consensus over partial decryptions.
+   */
+  struct GNUNET_CONSENSUS_Handle *consensus;
+
+  /**
+   * Which client is this for?
+   */
+  struct ClientState *cs;
+
+  /**
+   * When should we start communicating for decryption?
+   */
+  struct GNUNET_TIME_Absolute start;
+
+  /**
+   * When would we like the ciphertext to be
+   * decrypted?
+   */
+  struct GNUNET_TIME_Absolute deadline;
+
+  /**
+   * Ciphertext we want to decrypt.
+   */
+  struct GNUNET_SECRETSHARING_Ciphertext ciphertext;
+
+  /**
+   * Share of the local peer.
+   * Contains other important information, such as
+   * the list of other peers.
+   */
+  struct GNUNET_SECRETSHARING_Share *share;
+
+  /**
+   * State information about other peers.
+   */
+  struct DecryptPeerInfo *info;
+};
+
+
+/**
+ * State we keep per client.
+ */
+struct ClientState
+{
+  /**
+   * Decrypt session of the client, if any.
+   */
+  struct DecryptSession *decrypt_session;
+
+  /**
+   * Keygen session of the client, if any.
+   */
+  struct KeygenSession *keygen_session;
+
+  /**
+   * Client this is about.
+   */
+  struct GNUNET_SERVICE_Client *client;
+
+  /**
+   * MQ to talk to @a client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+};
+
+
+/**
+ * The ElGamal prime field order as libgcrypt mpi.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_q;
+
+/**
+ * Modulus of the prime field used for ElGamal.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_p;
+
+/**
+ * Generator for prime field of order 'elgamal_q'.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_g;
+
+/**
+ * Peer that runs this service.
+ */
+static struct GNUNET_PeerIdentity my_peer;
+
+/**
+ * Peer that runs this service.
+ */
+static struct GNUNET_CRYPTO_EddsaPrivateKey *my_peer_private_key;
+
+/**
+ * Configuration of this service.
+ */
+static const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+
+/**
+ * Get the peer info belonging to a peer identity in a keygen session.
+ *
+ * @param ks The keygen session.
+ * @param peer The peer identity.
+ * @return The Keygen peer info, or NULL if the peer could not be found.
+ */
+static struct KeygenPeerInfo *
+get_keygen_peer_info (const struct KeygenSession *ks,
+                      const struct GNUNET_PeerIdentity *peer)
+{
+  unsigned int i;
+
+  for (i = 0; i < ks->num_peers; i++)
+    if (0 == GNUNET_memcmp (peer, &ks->info[i].peer))
+      return &ks->info[i];
+  return NULL;
+}
+
+
+/**
+ * Get the peer info belonging to a peer identity in a decrypt session.
+ *
+ * @param ds The decrypt session.
+ * @param peer The peer identity.
+ * @return The decrypt peer info, or NULL if the peer could not be found.
+ */
+static struct DecryptPeerInfo *
+get_decrypt_peer_info (const struct DecryptSession *ds,
+                       const struct GNUNET_PeerIdentity *peer)
+{
+  unsigned int i;
+
+  for (i = 0; i < ds->share->num_peers; i++)
+    if (0 == GNUNET_memcmp (peer, &ds->info[i].peer))
+      return &ds->info[i];
+  return NULL;
+}
+
+
+/**
+ * Interpolate between two points in time.
+ *
+ * @param start start time
+ * @param end end time
+ * @param num numerator of the scale factor
+ * @param denum denumerator of the scale factor
+ */
+static struct GNUNET_TIME_Absolute
+time_between (struct GNUNET_TIME_Absolute start,
+              struct GNUNET_TIME_Absolute end,
+              int num, int denum)
+{
+  struct GNUNET_TIME_Absolute result;
+  uint64_t diff;
+
+  GNUNET_assert (start.abs_value_us <= end.abs_value_us);
+  diff = end.abs_value_us - start.abs_value_us;
+  result.abs_value_us = start.abs_value_us + ((diff * num) / denum);
+
+  return result;
+}
+
+
+/**
+ * Compare two peer identities.  Intended to be used with qsort or bsearch.
+ *
+ * @param p1 Some peer identity.
+ * @param p2 Some peer identity.
+ * @return 1 if p1 > p2, -1 if p1 < p2 and 0 if p1 == p2.
+ */
+static int
+peer_id_cmp (const void *p1, const void *p2)
+{
+  return memcmp (p1,
+                 p2,
+                 sizeof(struct GNUNET_PeerIdentity));
+}
+
+
+/**
+ * Get the index of a peer in an array of peers
+ *
+ * @param haystack Array of peers.
+ * @param n Size of @a haystack.
+ * @param needle Peer to find
+ * @return Index of @a needle in @a haystack, or -1 if peer
+ *         is not in the list.
+ */
+static int
+peer_find (const struct GNUNET_PeerIdentity *haystack, unsigned int n,
+           const struct GNUNET_PeerIdentity *needle)
+{
+  unsigned int i;
+
+  for (i = 0; i < n; i++)
+    if (0 == GNUNET_memcmp (&haystack[i],
+                            needle))
+      return i;
+  return -1;
+}
+
+
+/**
+ * Normalize the given list of peers, by including the local peer
+ * (if it is missing) and sorting the peers by their identity.
+ *
+ * @param listed Peers in the unnormalized list.
+ * @param num_listed Peers in the un-normalized list.
+ * @param[out] num_normalized Number of peers in the normalized list.
+ * @param[out] my_peer_idx Index of the local peer in the normalized list.
+ * @return Normalized list, must be free'd by the caller.
+ */
+static struct GNUNET_PeerIdentity *
+normalize_peers (struct GNUNET_PeerIdentity *listed,
+                 unsigned int num_listed,
+                 unsigned int *num_normalized,
+                 unsigned int *my_peer_idx)
+{
+  unsigned int local_peer_in_list;
+  /* number of peers in the normalized list */
+  unsigned int n;
+  struct GNUNET_PeerIdentity *normalized;
+
+  local_peer_in_list = GNUNET_YES;
+  n = num_listed;
+  if (peer_find (listed, num_listed, &my_peer) < 0)
+  {
+    local_peer_in_list = GNUNET_NO;
+    n += 1;
+  }
+
+  normalized = GNUNET_new_array (n,
+                                 struct GNUNET_PeerIdentity);
+
+  if (GNUNET_NO == local_peer_in_list)
+    normalized[n - 1] = my_peer;
+
+  GNUNET_memcpy (normalized,
+                 listed,
+                 num_listed * sizeof(struct GNUNET_PeerIdentity));
+  qsort (normalized,
+         n,
+         sizeof(struct GNUNET_PeerIdentity),
+         &peer_id_cmp);
+
+  if (NULL != my_peer_idx)
+    *my_peer_idx = peer_find (normalized, n, &my_peer);
+  if (NULL != num_normalized)
+    *num_normalized = n;
+
+  return normalized;
+}
+
+
+/**
+ * Get a the j-th lagrange coefficient for a set of indices.
+ *
+ * @param[out] coeff the lagrange coefficient
+ * @param j lagrange coefficient we want to compute
+ * @param indices indices
+ * @param num number of indices in @a indices
+ */
+static void
+compute_lagrange_coefficient (gcry_mpi_t coeff, unsigned int j,
+                              unsigned int *indices,
+                              unsigned int num)
+{
+  unsigned int i;
+  /* numerator */
+  gcry_mpi_t n;
+  /* denominator */
+  gcry_mpi_t d;
+  /* temp value for l-j */
+  gcry_mpi_t tmp;
+
+  GNUNET_assert (0 != coeff);
+
+  GNUNET_assert (0 != (n = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (d = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (tmp = gcry_mpi_new (0)));
+
+  gcry_mpi_set_ui (n, 1);
+  gcry_mpi_set_ui (d, 1);
+
+  for (i = 0; i < num; i++)
+  {
+    unsigned int l = indices[i];
+    if (l == j)
+      continue;
+    gcry_mpi_mul_ui (n, n, l + 1);
+    // d <- d * (l-j)
+    gcry_mpi_set_ui (tmp, l + 1);
+    gcry_mpi_sub_ui (tmp, tmp, j + 1);
+    gcry_mpi_mul (d, d, tmp);
+  }
+
+  // gcry_mpi_invm does not like negative numbers ...
+  gcry_mpi_mod (d, d, elgamal_q);
+
+  GNUNET_assert (gcry_mpi_cmp_ui (d, 0) > 0);
+
+  // now we do the actual division, with everything mod q, as we
+  // are not operating on elements from <g>, but on exponents
+  GNUNET_assert (0 != gcry_mpi_invm (d, d, elgamal_q));
+
+  gcry_mpi_mulm (coeff, n, d, elgamal_q);
+
+  gcry_mpi_release (n);
+  gcry_mpi_release (d);
+  gcry_mpi_release (tmp);
+}
+
+
+/**
+ * Destroy a decrypt session, removing it from
+ * the linked list of decrypt sessions.
+ *
+ * @param ds decrypt session to destroy
+ */
+static void
+decrypt_session_destroy (struct DecryptSession *ds)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "destroying decrypt session\n");
+  if (NULL != ds->cs)
+  {
+    ds->cs->decrypt_session = NULL;
+    ds->cs = NULL;
+  }
+  if (NULL != ds->consensus)
+  {
+    GNUNET_CONSENSUS_destroy (ds->consensus);
+    ds->consensus = NULL;
+  }
+
+  if (NULL != ds->info)
+  {
+    for (unsigned int i = 0; i < ds->share->num_peers; i++)
+    {
+      if (NULL != ds->info[i].partial_decryption)
+      {
+        gcry_mpi_release (ds->info[i].partial_decryption);
+        ds->info[i].partial_decryption = NULL;
+      }
+    }
+    GNUNET_free (ds->info);
+    ds->info = NULL;
+  }
+  if (NULL != ds->share)
+  {
+    GNUNET_SECRETSHARING_share_destroy (ds->share);
+    ds->share = NULL;
+  }
+
+  GNUNET_free (ds);
+}
+
+
+static void
+keygen_info_destroy (struct KeygenPeerInfo *info)
+{
+  if (NULL != info->sigma)
+  {
+    gcry_mpi_release (info->sigma);
+    info->sigma = NULL;
+  }
+  if (NULL != info->presecret_commitment)
+  {
+    gcry_mpi_release (info->presecret_commitment);
+    info->presecret_commitment = NULL;
+  }
+  if (NULL != info->preshare_commitment)
+  {
+    gcry_mpi_release (info->preshare_commitment);
+    info->preshare_commitment = NULL;
+  }
+}
+
+
+static void
+keygen_session_destroy (struct KeygenSession *ks)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "destroying keygen session\n");
+
+  if (NULL != ks->cs)
+  {
+    ks->cs->keygen_session = NULL;
+    ks->cs = NULL;
+  }
+  if (NULL != ks->info)
+  {
+    for (unsigned int i = 0; i < ks->num_peers; i++)
+      keygen_info_destroy (&ks->info[i]);
+    GNUNET_free (ks->info);
+    ks->info = NULL;
+  }
+
+  if (NULL != ks->consensus)
+  {
+    GNUNET_CONSENSUS_destroy (ks->consensus);
+    ks->consensus = NULL;
+  }
+
+  if (NULL != ks->presecret_polynomial)
+  {
+    for (unsigned int i = 0; i < ks->threshold; i++)
+    {
+      GNUNET_assert (NULL != ks->presecret_polynomial[i]);
+      gcry_mpi_release (ks->presecret_polynomial[i]);
+      ks->presecret_polynomial[i] = NULL;
+    }
+    GNUNET_free (ks->presecret_polynomial);
+    ks->presecret_polynomial = NULL;
+  }
+  if (NULL != ks->my_share)
+  {
+    gcry_mpi_release (ks->my_share);
+    ks->my_share = NULL;
+  }
+  if (NULL != ks->public_key)
+  {
+    gcry_mpi_release (ks->public_key);
+    ks->public_key = NULL;
+  }
+  if (NULL != ks->peers)
+  {
+    GNUNET_free (ks->peers);
+    ks->peers = NULL;
+  }
+  GNUNET_free (ks);
+}
+
+
+/**
+ * Task run during shutdown.
+ *
+ * @param cls unused
+ */
+static void
+cleanup_task (void *cls)
+{
+  /* Nothing to do! */
+}
+
+
+/**
+ * Generate the random coefficients of our pre-secret polynomial
+ *
+ * @param ks the session
+ */
+static void
+generate_presecret_polynomial (struct KeygenSession *ks)
+{
+  int i;
+  gcry_mpi_t v;
+
+  GNUNET_assert (NULL == ks->presecret_polynomial);
+  ks->presecret_polynomial = GNUNET_new_array (ks->threshold,
+                                               gcry_mpi_t);
+  for (i = 0; i < ks->threshold; i++)
+  {
+    v = ks->presecret_polynomial[i] = gcry_mpi_new (
+      GNUNET_SECRETSHARING_ELGAMAL_BITS);
+    GNUNET_assert (NULL != v);
+    // Randomize v such that 0 < v < elgamal_q.
+    // The '- 1' is necessary as bitlength(q) = bitlength(p) - 1.
+    do
+    {
+      gcry_mpi_randomize (v, GNUNET_SECRETSHARING_ELGAMAL_BITS - 1,
+                          GCRY_WEAK_RANDOM);
+    }
+    while ((gcry_mpi_cmp_ui (v, 0) == 0) || (gcry_mpi_cmp (v, elgamal_q) >= 0));
+  }
+}
+
+
+/**
+ * Consensus element handler for round one.
+ * We should get one ephemeral key for each peer.
+ *
+ * @param cls Closure (keygen session).
+ * @param element The element from consensus, or
+ *                NULL if consensus failed.
+ */
+static void
+keygen_round1_new_element (void *cls,
+                           const struct GNUNET_SET_Element *element)
+{
+  const struct GNUNET_SECRETSHARING_KeygenCommitData *d;
+  struct KeygenSession *ks = cls;
+  struct KeygenPeerInfo *info;
+
+  if (NULL == element)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "round1 consensus failed\n");
+    return;
+  }
+
+  /* elements have fixed size */
+  if (element->size != sizeof(struct GNUNET_SECRETSHARING_KeygenCommitData))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen commit data with wrong size (%u) in consensus, %u expected\n",
+                (unsigned int) element->size,
+                (unsigned int) sizeof(struct
+                                      GNUNET_SECRETSHARING_KeygenCommitData));
+    return;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "got round1 element\n");
+
+  d = element->data;
+  info = get_keygen_peer_info (ks, &d->peer);
+
+  if (NULL == info)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen commit data with wrong peer identity (%s) in consensus\n",
+                GNUNET_i2s (&d->peer));
+    return;
+  }
+
+  /* Check that the right amount of data has been signed. */
+  if (d->purpose.size !=
+      htonl (element->size - offsetof (struct
+                                       GNUNET_SECRETSHARING_KeygenCommitData,
+                                       purpose)))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen commit data with wrong signature purpose size in consensus\n");
+    return;
+  }
+
+  if (GNUNET_OK != GNUNET_CRYPTO_eddsa_verify_ (
+        GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG1,
+        &d->purpose, &d->signature,
+        &d->peer.public_key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen commit data with invalid signature in consensus\n");
+    return;
+  }
+  info->paillier_public_key = d->pubkey;
+  GNUNET_CRYPTO_mpi_scan_unsigned (&info->presecret_commitment, &d->commitment,
+                                   512 / 8);
+  info->round1_valid = GNUNET_YES;
+}
+
+
+/**
+ * Evaluate the polynomial with coefficients @a coeff at @a x.
+ * The i-th element in @a coeff corresponds to the coefficient of x^i.
+ *
+ * @param[out] z result of the evaluation
+ * @param coeff array of coefficients
+ * @param num_coeff number of coefficients
+ * @param x where to evaluate the polynomial
+ * @param m what group are we operating in?
+ */
+static void
+horner_eval (gcry_mpi_t z, gcry_mpi_t *coeff, unsigned int num_coeff, gcry_mpi_t
+             x, gcry_mpi_t m)
+{
+  unsigned int i;
+
+  gcry_mpi_set_ui (z, 0);
+  for (i = 0; i < num_coeff; i++)
+  {
+    // z <- zx + c
+    gcry_mpi_mul (z, z, x);
+    gcry_mpi_addm (z, z, coeff[num_coeff - i - 1], m);
+  }
+}
+
+
+static void
+keygen_round2_conclude (void *cls)
+{
+  struct KeygenSession *ks = cls;
+  struct GNUNET_SECRETSHARING_SecretReadyMessage *m;
+  struct GNUNET_MQ_Envelope *ev;
+  size_t share_size;
+  unsigned int i;
+  unsigned int j;
+  struct GNUNET_SECRETSHARING_Share *share;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "round2 conclude\n");
+
+  GNUNET_CONSENSUS_destroy (ks->consensus);
+  ks->consensus = NULL;
+
+  share = GNUNET_new (struct GNUNET_SECRETSHARING_Share);
+
+  share->num_peers = 0;
+
+  for (i = 0; i < ks->num_peers; i++)
+    if (GNUNET_YES == ks->info[i].round2_valid)
+      share->num_peers++;
+
+  share->peers = GNUNET_new_array (share->num_peers,
+                                   struct GNUNET_PeerIdentity);
+  share->sigmas =
+    GNUNET_new_array (share->num_peers,
+                      struct GNUNET_SECRETSHARING_FieldElement);
+  share->original_indices = GNUNET_new_array (share->num_peers,
+                                              uint16_t);
+
+  /* maybe we're not even in the list of peers? */
+  share->my_peer = share->num_peers;
+
+  j = 0; /* running index of valid peers */
+  for (i = 0; i < ks->num_peers; i++)
+  {
+    if (GNUNET_YES == ks->info[i].round2_valid)
+    {
+      share->peers[j] = ks->info[i].peer;
+      GNUNET_CRYPTO_mpi_print_unsigned (&share->sigmas[j],
+                                        GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                        ks->info[i].sigma);
+      share->original_indices[i] = j;
+      if (0 == GNUNET_memcmp (&share->peers[i], &my_peer))
+        share->my_peer = j;
+      j += 1;
+    }
+  }
+
+  if (share->my_peer == share->num_peers)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "P%u: peer identity not in share\n",
+                ks->local_peer_idx);
+  }
+
+  GNUNET_CRYPTO_mpi_print_unsigned (&share->my_share,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                    ks->my_share);
+  GNUNET_CRYPTO_mpi_print_unsigned (&share->public_key,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                    ks->public_key);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "keygen completed with %u peers\n",
+              share->num_peers);
+
+  /* Write the share. If 0 peers completed the dkg, an empty
+   * share will be sent. */
+
+  GNUNET_assert (GNUNET_OK == GNUNET_SECRETSHARING_share_write (share, NULL, 0,
+                                                                &share_size));
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "writing share of size %u\n",
+              (unsigned int) share_size);
+
+  ev = GNUNET_MQ_msg_extra (m, share_size,
+                            GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_SECRET_READY);
+
+  GNUNET_assert (GNUNET_OK == GNUNET_SECRETSHARING_share_write (share, &m[1],
+                                                                share_size,
+                                                                NULL));
+
+  GNUNET_SECRETSHARING_share_destroy (share);
+  share = NULL;
+
+  GNUNET_MQ_send (ks->cs->mq,
+                  ev);
+}
+
+
+static void
+restore_fair (const struct GNUNET_CRYPTO_PaillierPublicKey *ppub,
+              const struct GNUNET_SECRETSHARING_FairEncryption *fe,
+              gcry_mpi_t x, gcry_mpi_t xres)
+{
+  gcry_mpi_t a_1;
+  gcry_mpi_t a_2;
+  gcry_mpi_t b_1;
+  gcry_mpi_t b_2;
+  gcry_mpi_t big_a;
+  gcry_mpi_t big_b;
+  gcry_mpi_t big_t;
+  gcry_mpi_t n;
+  gcry_mpi_t t_1;
+  gcry_mpi_t t_2;
+  gcry_mpi_t t;
+  gcry_mpi_t r;
+  gcry_mpi_t v;
+
+
+  GNUNET_assert (NULL != (n = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (t = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (t_1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (t_2 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (r = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (big_t = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (v = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (big_a = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (big_b = gcry_mpi_new (0)));
+
+  // a = (N,0)^T
+  GNUNET_CRYPTO_mpi_scan_unsigned (&a_1,
+                                   ppub,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+  GNUNET_assert (NULL != (a_2 = gcry_mpi_new (0)));
+  gcry_mpi_set_ui (a_2, 0);
+  // b = (x,1)^T
+  GNUNET_assert (NULL != (b_1 = gcry_mpi_new (0)));
+  gcry_mpi_set (b_1, x);
+  GNUNET_assert (NULL != (b_2 = gcry_mpi_new (0)));
+  gcry_mpi_set_ui (b_2, 1);
+
+  // A = a DOT a
+  gcry_mpi_mul (t, a_1, a_1);
+  gcry_mpi_mul (big_a, a_2, a_2);
+  gcry_mpi_add (big_a, big_a, t);
+
+  // B = b DOT b
+  gcry_mpi_mul (t, b_1, b_1);
+  gcry_mpi_mul (big_b, b_2, b_2);
+  gcry_mpi_add (big_b, big_b, t);
+
+  while (1)
+  {
+    // n = a DOT b
+    gcry_mpi_mul (t, a_1, b_1);
+    gcry_mpi_mul (n, a_2, b_2);
+    gcry_mpi_add (n, n, t);
+
+    // r = nearest(n/B)
+    gcry_mpi_div (r, NULL, n, big_b, 0);
+
+    // T := A - 2rn + rrB
+    gcry_mpi_mul (v, r, n);
+    gcry_mpi_mul_ui (v, v, 2);
+    gcry_mpi_sub (big_t, big_a, v);
+    gcry_mpi_mul (v, r, r);
+    gcry_mpi_mul (v, v, big_b);
+    gcry_mpi_add (big_t, big_t, v);
+
+    if (gcry_mpi_cmp (big_t, big_b) >= 0)
+    {
+      break;
+    }
+
+    // t = a - rb
+    gcry_mpi_mul (v, r, b_1);
+    gcry_mpi_sub (t_1, a_1, v);
+    gcry_mpi_mul (v, r, b_2);
+    gcry_mpi_sub (t_2, a_2, v);
+
+    // a = b
+    gcry_mpi_set (a_1, b_1);
+    gcry_mpi_set (a_2, b_2);
+    // b = t
+    gcry_mpi_set (b_1, t_1);
+    gcry_mpi_set (b_2, t_2);
+
+    gcry_mpi_set (big_a, big_b);
+    gcry_mpi_set (big_b, big_t);
+  }
+
+  gcry_mpi_set (xres, b_2);
+  gcry_mpi_invm (xres, xres, elgamal_q);
+  gcry_mpi_mulm (xres, xres, b_1, elgamal_q);
+
+  gcry_mpi_release (a_1);
+  gcry_mpi_release (a_2);
+  gcry_mpi_release (b_1);
+  gcry_mpi_release (b_2);
+  gcry_mpi_release (big_a);
+  gcry_mpi_release (big_b);
+  gcry_mpi_release (big_t);
+  gcry_mpi_release (n);
+  gcry_mpi_release (t_1);
+  gcry_mpi_release (t_2);
+  gcry_mpi_release (t);
+  gcry_mpi_release (r);
+  gcry_mpi_release (v);
+}
+
+
+static void
+get_fair_encryption_challenge (const struct
+                               GNUNET_SECRETSHARING_FairEncryption *fe,
+                               gcry_mpi_t *e)
+{
+  struct
+  {
+    struct GNUNET_CRYPTO_PaillierCiphertext c;
+    char h[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+    char t1[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+    char t2[GNUNET_CRYPTO_PAILLIER_BITS * 2 / 8];
+  } hash_data;
+  struct GNUNET_HashCode e_hash;
+
+  memset (&hash_data,
+          0,
+          sizeof(hash_data));
+  GNUNET_memcpy (&hash_data.c, &fe->c, sizeof(struct
+                                              GNUNET_CRYPTO_PaillierCiphertext));
+  GNUNET_memcpy (&hash_data.h, &fe->h, GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_memcpy (&hash_data.t1, &fe->t1, GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_memcpy (&hash_data.t2, &fe->t2, GNUNET_CRYPTO_PAILLIER_BITS * 2 / 8);
+  GNUNET_CRYPTO_hash (&hash_data,
+                      sizeof(hash_data),
+                      &e_hash);
+  /* This allocates "e" */
+  GNUNET_CRYPTO_mpi_scan_unsigned (e,
+                                   &e_hash,
+                                   sizeof(struct GNUNET_HashCode));
+  gcry_mpi_mod (*e, *e, elgamal_q);
+}
+
+
+static int
+verify_fair (const struct GNUNET_CRYPTO_PaillierPublicKey *ppub,
+             const struct GNUNET_SECRETSHARING_FairEncryption *fe)
+{
+  gcry_mpi_t n;
+  gcry_mpi_t n_sq;
+  gcry_mpi_t z;
+  gcry_mpi_t t1;
+  gcry_mpi_t t2;
+  gcry_mpi_t e;
+  gcry_mpi_t w;
+  gcry_mpi_t tmp1;
+  gcry_mpi_t tmp2;
+  gcry_mpi_t y;
+  gcry_mpi_t big_y;
+  int res;
+
+  GNUNET_assert (NULL != (n_sq = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (tmp1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (tmp2 = gcry_mpi_new (0)));
+
+  get_fair_encryption_challenge (fe,
+                                 &e /* this allocates e */);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   ppub,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+  GNUNET_CRYPTO_mpi_scan_unsigned (&t1, fe->t1, GNUNET_CRYPTO_PAILLIER_BITS
+                                   / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&z, fe->z,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&y, fe->h,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&w, fe->w, GNUNET_CRYPTO_PAILLIER_BITS / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&big_y, fe->c.bits,
+                                   GNUNET_CRYPTO_PAILLIER_BITS * 2 / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&t2, fe->t2, GNUNET_CRYPTO_PAILLIER_BITS
+                                   * 2 / 8);
+  gcry_mpi_mul (n_sq, n, n);
+
+  // tmp1 = g^z
+  gcry_mpi_powm (tmp1, elgamal_g, z, elgamal_p);
+  // tmp2 = y^{-e}
+  gcry_mpi_powm (tmp1, y, e, elgamal_p);
+  gcry_mpi_invm (tmp1, tmp1, elgamal_p);
+  // tmp1 = tmp1 * tmp2
+  gcry_mpi_mulm (tmp1, tmp1, tmp2, elgamal_p);
+
+  if (0 == gcry_mpi_cmp (t1, tmp1))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "fair encryption invalid (t1)\n");
+    res = GNUNET_NO;
+    goto cleanup;
+  }
+
+  gcry_mpi_powm (big_y, big_y, e, n_sq);
+  gcry_mpi_invm (big_y, big_y, n_sq);
+
+  gcry_mpi_add_ui (tmp1, n, 1);
+  gcry_mpi_powm (tmp1, tmp1, z, n_sq);
+
+  gcry_mpi_powm (tmp2, w, n, n_sq);
+
+  gcry_mpi_mulm (tmp1, tmp1, tmp2, n_sq);
+  gcry_mpi_mulm (tmp1, tmp1, big_y, n_sq);
+
+
+  if (0 == gcry_mpi_cmp (t2, tmp1))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "fair encryption invalid (t2)\n");
+    res = GNUNET_NO;
+    goto cleanup;
+  }
+
+  res = GNUNET_YES;
+
+cleanup:
+
+  gcry_mpi_release (n);
+  gcry_mpi_release (n_sq);
+  gcry_mpi_release (z);
+  gcry_mpi_release (t1);
+  gcry_mpi_release (t2);
+  gcry_mpi_release (e);
+  gcry_mpi_release (w);
+  gcry_mpi_release (tmp1);
+  gcry_mpi_release (tmp2);
+  gcry_mpi_release (y);
+  gcry_mpi_release (big_y);
+  return res;
+}
+
+
+/**
+ * Create a fair Paillier encryption of then given ciphertext.
+ *
+ * @param v the ciphertext
+ * @param[out] fe the fair encryption
+ */
+static void
+encrypt_fair (gcry_mpi_t v,
+              const struct GNUNET_CRYPTO_PaillierPublicKey *ppub,
+              struct GNUNET_SECRETSHARING_FairEncryption *fe)
+{
+  gcry_mpi_t r;
+  gcry_mpi_t s;
+  gcry_mpi_t t1;
+  gcry_mpi_t t2;
+  gcry_mpi_t z;
+  gcry_mpi_t w;
+  gcry_mpi_t n;
+  gcry_mpi_t e;
+  gcry_mpi_t n_sq;
+  gcry_mpi_t u;
+  gcry_mpi_t Y;
+  gcry_mpi_t G;
+  gcry_mpi_t h;
+
+  GNUNET_assert (NULL != (r = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (s = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (t1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (t2 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (z = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (w = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (n_sq = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (u = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (Y = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (G = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (h = gcry_mpi_new (0)));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&n,
+                                   ppub,
+                                   sizeof(struct
+                                          GNUNET_CRYPTO_PaillierPublicKey));
+  gcry_mpi_mul (n_sq, n, n);
+  gcry_mpi_add_ui (G, n, 1);
+
+  do
+  {
+    gcry_mpi_randomize (u, GNUNET_CRYPTO_PAILLIER_BITS, GCRY_WEAK_RANDOM);
+  }
+  while (gcry_mpi_cmp (u, n) >= 0);
+
+  gcry_mpi_powm (t1, G, v, n_sq);
+  gcry_mpi_powm (t2, u, n, n_sq);
+  gcry_mpi_mulm (Y, t1, t2, n_sq);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->c.bits,
+                                    sizeof fe->c.bits,
+                                    Y);
+
+
+  gcry_mpi_randomize (r, 2048, GCRY_WEAK_RANDOM);
+  do
+  {
+    gcry_mpi_randomize (s, GNUNET_CRYPTO_PAILLIER_BITS, GCRY_WEAK_RANDOM);
+  }
+  while (gcry_mpi_cmp (s, n) >= 0);
+
+  // compute t1
+  gcry_mpi_mulm (t1, elgamal_g, r, elgamal_p);
+  // compute t2 (use z and w as temp)
+  gcry_mpi_powm (z, G, r, n_sq);
+  gcry_mpi_powm (w, s, n, n_sq);
+  gcry_mpi_mulm (t2, z, w, n_sq);
+
+
+  gcry_mpi_powm (h, elgamal_g, v, elgamal_p);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->h,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                    h);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->t1,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                    t1);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->t2,
+                                    GNUNET_CRYPTO_PAILLIER_BITS * 2 / 8,
+                                    t2);
+
+  get_fair_encryption_challenge (fe,
+                                 &e /* This allocates "e" */);
+
+  // compute z
+  gcry_mpi_mul (z, e, v);
+  gcry_mpi_addm (z, z, r, elgamal_q);
+  // compute w
+  gcry_mpi_powm (w, u, e, n);
+  gcry_mpi_mulm (w, w, s, n);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->z,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                                    z);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (fe->w,
+                                    GNUNET_CRYPTO_PAILLIER_BITS / 8,
+                                    w);
+
+  gcry_mpi_release (n);
+  gcry_mpi_release (r);
+  gcry_mpi_release (s);
+  gcry_mpi_release (t1);
+  gcry_mpi_release (t2);
+  gcry_mpi_release (z);
+  gcry_mpi_release (w);
+  gcry_mpi_release (e);
+  gcry_mpi_release (n_sq);
+  gcry_mpi_release (u);
+  gcry_mpi_release (Y);
+  gcry_mpi_release (G);
+  gcry_mpi_release (h);
+}
+
+
+/**
+ * Insert round 2 element in the consensus, consisting of
+ * (1) The exponentiated pre-share polynomial coefficients A_{i,l}=g^{a_{i,l}}
+ * (2) The exponentiated pre-shares y_{i,j}=g^{s_{i,j}}
+ * (3) The encrypted pre-shares Y_{i,j}
+ * (4) The zero knowledge proof for fairness of
+ *     the encryption
+ *
+ * @param ks session to use
+ */
+static void
+insert_round2_element (struct KeygenSession *ks)
+{
+  struct GNUNET_SET_Element *element;
+  struct GNUNET_SECRETSHARING_KeygenRevealData *d;
+  unsigned char *pos;
+  unsigned char *last_pos;
+  size_t element_size;
+  unsigned int i;
+  gcry_mpi_t idx;
+  gcry_mpi_t v;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: Inserting round2 element\n",
+              ks->local_peer_idx);
+
+  GNUNET_assert (NULL != (v = gcry_mpi_new (
+                            GNUNET_SECRETSHARING_ELGAMAL_BITS)));
+  GNUNET_assert (NULL != (idx = gcry_mpi_new (
+                            GNUNET_SECRETSHARING_ELGAMAL_BITS)));
+
+  element_size = (sizeof(struct GNUNET_SECRETSHARING_KeygenRevealData)
+                  + sizeof(struct GNUNET_SECRETSHARING_FairEncryption)
+                  * ks->num_peers
+                  + GNUNET_SECRETSHARING_ELGAMAL_BITS / 8 * ks->threshold);
+
+  element = GNUNET_malloc (sizeof(struct GNUNET_SET_Element) + element_size);
+  element->size = element_size;
+  element->data = (void *) &element[1];
+
+  d = (void *) element->data;
+  d->peer = my_peer;
+
+  // start inserting vector elements
+  // after the fixed part of the element's data
+  pos = (void *) &d[1];
+  last_pos = pos + element_size;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: computed exp preshares\n",
+              ks->local_peer_idx);
+
+  // encrypted pre-shares
+  // and fair encryption proof
+  {
+    for (i = 0; i < ks->num_peers; i++)
+    {
+      ptrdiff_t remaining = last_pos - pos;
+      struct GNUNET_SECRETSHARING_FairEncryption *fe = (void *) pos;
+
+      GNUNET_assert (remaining > 0);
+      memset (fe, 0, sizeof *fe);
+      if (GNUNET_YES == ks->info[i].round1_valid)
+      {
+        gcry_mpi_set_ui (idx, i + 1);
+        // evaluate the polynomial
+        horner_eval (v, ks->presecret_polynomial, ks->threshold, idx,
+                     elgamal_q);
+        // encrypt the result
+        encrypt_fair (v, &ks->info[i].paillier_public_key, fe);
+      }
+      pos += sizeof *fe;
+    }
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: computed enc preshares\n",
+              ks->local_peer_idx);
+
+  // exponentiated coefficients
+  for (i = 0; i < ks->threshold; i++)
+  {
+    ptrdiff_t remaining = last_pos - pos;
+    GNUNET_assert (remaining > 0);
+    gcry_mpi_powm (v, elgamal_g, ks->presecret_polynomial[i], elgamal_p);
+    GNUNET_CRYPTO_mpi_print_unsigned (pos, GNUNET_SECRETSHARING_ELGAMAL_BITS
+                                      / 8, v);
+    pos += GNUNET_SECRETSHARING_ELGAMAL_BITS / 8;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: computed exp coefficients\n",
+              ks->local_peer_idx);
+
+
+  d->purpose.size = htonl (element_size - offsetof (struct
+                                                    GNUNET_SECRETSHARING_KeygenRevealData,
+                                                    purpose));
+  d->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG2);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_sign_ (my_peer_private_key,
+                                            &d->purpose,
+                                            &d->signature));
+
+  GNUNET_CONSENSUS_insert (ks->consensus, element, NULL, NULL);
+  GNUNET_free (element);  /* FIXME: maybe stack-allocate instead? */
+
+  gcry_mpi_release (v);
+  gcry_mpi_release (idx);
+}
+
+
+static gcry_mpi_t
+keygen_reveal_get_exp_coeff (struct KeygenSession *ks,
+                             const struct
+                             GNUNET_SECRETSHARING_KeygenRevealData *d,
+                             unsigned int idx)
+{
+  unsigned char *pos;
+  gcry_mpi_t exp_coeff;
+
+  GNUNET_assert (idx < ks->threshold);
+
+  pos = (void *) &d[1];
+  // skip encrypted pre-shares
+  pos += sizeof(struct GNUNET_SECRETSHARING_FairEncryption) * ks->num_peers;
+  // skip exp. coeffs we are not interested in
+  pos += GNUNET_SECRETSHARING_ELGAMAL_BITS / 8 * idx;
+  // the first exponentiated coefficient is the public key share
+  GNUNET_CRYPTO_mpi_scan_unsigned (&exp_coeff, pos,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  return exp_coeff;
+}
+
+
+static struct GNUNET_SECRETSHARING_FairEncryption *
+keygen_reveal_get_enc_preshare (struct KeygenSession *ks,
+                                const struct
+                                GNUNET_SECRETSHARING_KeygenRevealData *d,
+                                unsigned int idx)
+{
+  unsigned char *pos;
+
+  GNUNET_assert (idx < ks->num_peers);
+
+  pos = (void *) &d[1];
+  // skip encrypted pre-shares we're not interested in
+  pos += sizeof(struct GNUNET_SECRETSHARING_FairEncryption) * idx;
+  return (struct GNUNET_SECRETSHARING_FairEncryption *) pos;
+}
+
+
+static gcry_mpi_t
+keygen_reveal_get_exp_preshare (struct KeygenSession *ks,
+                                const struct
+                                GNUNET_SECRETSHARING_KeygenRevealData *d,
+                                unsigned int idx)
+{
+  gcry_mpi_t exp_preshare;
+  struct GNUNET_SECRETSHARING_FairEncryption *fe;
+
+  GNUNET_assert (idx < ks->num_peers);
+  fe = keygen_reveal_get_enc_preshare (ks, d, idx);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&exp_preshare, fe->h,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  return exp_preshare;
+}
+
+
+static void
+keygen_round2_new_element (void *cls,
+                           const struct GNUNET_SET_Element *element)
+{
+  struct KeygenSession *ks = cls;
+  const struct GNUNET_SECRETSHARING_KeygenRevealData *d;
+  struct KeygenPeerInfo *info;
+  size_t expected_element_size;
+  unsigned int j;
+  int cmp_result;
+  gcry_mpi_t tmp;
+  gcry_mpi_t public_key_share;
+  gcry_mpi_t preshare;
+
+  if (NULL == element)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING, "round2 consensus failed\n");
+    return;
+  }
+
+  expected_element_size = (sizeof(struct GNUNET_SECRETSHARING_KeygenRevealData)
+                           + sizeof(struct
+                                    GNUNET_SECRETSHARING_FairEncryption)
+                           * ks->num_peers
+                           + GNUNET_SECRETSHARING_ELGAMAL_BITS / 8
+                           * ks->threshold);
+
+  if (element->size != expected_element_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen round2 data with wrong size (%u) in consensus, %u expected\n",
+                (unsigned int) element->size,
+                (unsigned int) expected_element_size);
+    return;
+  }
+
+  d = (const void *) element->data;
+
+  info = get_keygen_peer_info (ks, &d->peer);
+
+  if (NULL == info)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen commit data with wrong peer identity (%s) in consensus\n",
+                GNUNET_i2s (&d->peer));
+    return;
+  }
+
+  if (GNUNET_NO == info->round1_valid)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "ignoring round2 element from peer with invalid round1 element (%s)\n",
+                GNUNET_i2s (&d->peer));
+    return;
+  }
+
+  if (GNUNET_YES == info->round2_valid)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "ignoring duplicate round2 element (%s)\n",
+                GNUNET_i2s (&d->peer));
+    return;
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "got round2 element\n");
+
+  if (ntohl (d->purpose.size) !=
+      element->size - offsetof (struct GNUNET_SECRETSHARING_KeygenRevealData,
+                                purpose))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen reveal data with wrong signature purpose size in consensus\n");
+    return;
+  }
+
+  if (GNUNET_OK != GNUNET_CRYPTO_eddsa_verify_ (
+        GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG2,
+        &d->purpose, &d->signature,
+        &d->peer.public_key))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "keygen reveal data with invalid signature in consensus\n");
+    return;
+  }
+
+  public_key_share = keygen_reveal_get_exp_coeff (ks, d, 0);
+  info->preshare_commitment = keygen_reveal_get_exp_preshare (ks, d,
+                                                              ks->local_peer_idx);
+
+  if (NULL == ks->public_key)
+  {
+    GNUNET_assert (NULL != (ks->public_key = gcry_mpi_new (0)));
+    gcry_mpi_set_ui (ks->public_key, 1);
+  }
+  gcry_mpi_mulm (ks->public_key, ks->public_key, public_key_share, elgamal_p);
+
+  gcry_mpi_release (public_key_share);
+  public_key_share = NULL;
+
+  {
+    struct GNUNET_SECRETSHARING_FairEncryption *fe =
+      keygen_reveal_get_enc_preshare (ks, d, ks->local_peer_idx);
+    GNUNET_assert (NULL != (preshare = gcry_mpi_new (0)));
+    GNUNET_CRYPTO_paillier_decrypt (&ks->paillier_private_key,
+                                    &ks->info[ks->local_peer_idx].
+                                    paillier_public_key,
+                                    &fe->c,
+                                    preshare);
+
+    // FIXME: not doing the restoration is less expensive
+    restore_fair (&ks->info[ks->local_peer_idx].paillier_public_key,
+                  fe,
+                  preshare,
+                  preshare);
+  }
+
+  GNUNET_assert (NULL != (tmp = gcry_mpi_new (0)));
+  gcry_mpi_powm (tmp, elgamal_g, preshare, elgamal_p);
+
+  cmp_result = gcry_mpi_cmp (tmp, info->preshare_commitment);
+  gcry_mpi_release (tmp);
+  tmp = NULL;
+  if (0 != cmp_result)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "P%u: Got invalid presecret from P%u\n",
+                (unsigned int) ks->local_peer_idx, (unsigned int) (info
+                                                                   - ks->info));
+    return;
+  }
+
+  if (NULL == ks->my_share)
+  {
+    GNUNET_assert (NULL != (ks->my_share = gcry_mpi_new (0)));
+  }
+  gcry_mpi_addm (ks->my_share, ks->my_share, preshare, elgamal_q);
+
+  for (j = 0; j < ks->num_peers; j++)
+  {
+    gcry_mpi_t presigma;
+    if (NULL == ks->info[j].sigma)
+    {
+      GNUNET_assert (NULL != (ks->info[j].sigma = gcry_mpi_new (0)));
+      gcry_mpi_set_ui (ks->info[j].sigma, 1);
+    }
+    presigma = keygen_reveal_get_exp_preshare (ks, d, j);
+    gcry_mpi_mulm (ks->info[j].sigma, ks->info[j].sigma, presigma, elgamal_p);
+    gcry_mpi_release (presigma);
+  }
+
+  gcry_mpi_t prod;
+  GNUNET_assert (NULL != (prod = gcry_mpi_new (0)));
+  gcry_mpi_t j_to_k;
+  GNUNET_assert (NULL != (j_to_k = gcry_mpi_new (0)));
+  // validate that the polynomial sharing matches the additive sharing
+  for (j = 0; j < ks->num_peers; j++)
+  {
+    unsigned int k;
+    int cmp_result;
+    gcry_mpi_t exp_preshare;
+    gcry_mpi_set_ui (prod, 1);
+    for (k = 0; k < ks->threshold; k++)
+    {
+      // Using pow(double,double) is a bit sketchy.
+      // We count players from 1, but shares from 0.
+      gcry_mpi_t tmp;
+      gcry_mpi_set_ui (j_to_k, (unsigned int) pow (j + 1, k));
+      tmp = keygen_reveal_get_exp_coeff (ks, d, k);
+      gcry_mpi_powm (tmp, tmp, j_to_k, elgamal_p);
+      gcry_mpi_mulm (prod, prod, tmp, elgamal_p);
+      gcry_mpi_release (tmp);
+    }
+    exp_preshare = keygen_reveal_get_exp_preshare (ks, d, j);
+    gcry_mpi_mod (exp_preshare, exp_preshare, elgamal_p);
+    cmp_result = gcry_mpi_cmp (prod, exp_preshare);
+    gcry_mpi_release (exp_preshare);
+    exp_preshare = NULL;
+    if (0 != cmp_result)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "P%u: reveal data from P%u incorrect\n",
+                  ks->local_peer_idx, j);
+      /* no need for further verification, round2 stays invalid ... */
+      return;
+    }
+  }
+
+  // TODO: verify proof of fair encryption (once implemented)
+  for (j = 0; j < ks->num_peers; j++)
+  {
+    struct GNUNET_SECRETSHARING_FairEncryption *fe =
+      keygen_reveal_get_enc_preshare (ks, d, j);
+    if (GNUNET_YES != verify_fair (&ks->info[j].paillier_public_key, fe))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  "P%u: reveal data from P%u incorrect (fair encryption)\n",
+                  ks->local_peer_idx, j);
+      return;
+    }
+  }
+
+  info->round2_valid = GNUNET_YES;
+
+  gcry_mpi_release (preshare);
+  gcry_mpi_release (prod);
+  gcry_mpi_release (j_to_k);
+}
+
+
+/**
+ * Called when the first consensus round has concluded.
+ * Will initiate the second round.
+ *
+ * @param cls closure
+ */
+static void
+keygen_round1_conclude (void *cls)
+{
+  struct KeygenSession *ks = cls;
+
+  GNUNET_CONSENSUS_destroy (ks->consensus);
+
+  ks->consensus = GNUNET_CONSENSUS_create (cfg, ks->num_peers, ks->peers,
+                                           &ks->session_id,
+                                           time_between (ks->start_time,
+                                                         ks->deadline, 1, 2),
+                                           ks->deadline,
+                                           keygen_round2_new_element, ks);
+
+  insert_round2_element (ks);
+
+  GNUNET_CONSENSUS_conclude (ks->consensus,
+                             keygen_round2_conclude,
+                             ks);
+}
+
+
+/**
+ * Insert the ephemeral key and the presecret commitment
+ * of this peer in the consensus of the given session.
+ *
+ * @param ks session to use
+ */
+static void
+insert_round1_element (struct KeygenSession *ks)
+{
+  struct GNUNET_SET_Element *element;
+  struct GNUNET_SECRETSHARING_KeygenCommitData *d;
+  // g^a_{i,0}
+  gcry_mpi_t v;
+  // big-endian representation of 'v'
+  unsigned char v_data[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+
+  element = GNUNET_malloc (sizeof *element + sizeof *d);
+  d = (void *) &element[1];
+  element->data = d;
+  element->size = sizeof *d;
+
+  d->peer = my_peer;
+
+  GNUNET_assert (0 != (v = gcry_mpi_new (GNUNET_SECRETSHARING_ELGAMAL_BITS)));
+
+  gcry_mpi_powm (v, elgamal_g, ks->presecret_polynomial[0], elgamal_p);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (v_data, GNUNET_SECRETSHARING_ELGAMAL_BITS
+                                    / 8, v);
+
+  GNUNET_CRYPTO_hash (v_data, GNUNET_SECRETSHARING_ELGAMAL_BITS / 8,
+                      &d->commitment);
+
+  d->pubkey = ks->info[ks->local_peer_idx].paillier_public_key;
+
+  d->purpose.size = htonl ((sizeof *d) - offsetof (struct
+                                                   GNUNET_SECRETSHARING_KeygenCommitData,
+                                                   purpose));
+  d->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DKG1);
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_sign_ (my_peer_private_key,
+                                            &d->purpose,
+                                            &d->signature));
+
+  GNUNET_CONSENSUS_insert (ks->consensus, element, NULL, NULL);
+
+  gcry_mpi_release (v);
+  GNUNET_free (element);
+}
+
+
+/**
+ * Check that @a msg is well-formed.
+ *
+ * @param cls identification of the client
+ * @param msg the actual message
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+static int
+check_client_keygen (void *cls,
+                     const struct GNUNET_SECRETSHARING_CreateMessage *msg)
+{
+  unsigned int num_peers = ntohs (msg->num_peers);
+
+  if (ntohs (msg->header.size) - sizeof(*msg) !=
+      num_peers * sizeof(struct GNUNET_PeerIdentity))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Functions with this signature are called whenever a message is
+ * received.
+ *
+ * @param cls identification of the client
+ * @param msg the actual message
+ */
+static void
+handle_client_keygen (void *cls,
+                      const struct GNUNET_SECRETSHARING_CreateMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct KeygenSession *ks;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "client requested key generation\n");
+  if (NULL != cs->keygen_session)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  ks = GNUNET_new (struct KeygenSession);
+  ks->cs = cs;
+  cs->keygen_session = ks;
+  ks->deadline = GNUNET_TIME_absolute_ntoh (msg->deadline);
+  ks->threshold = ntohs (msg->threshold);
+  ks->num_peers = ntohs (msg->num_peers);
+
+  ks->peers = normalize_peers ((struct GNUNET_PeerIdentity *) &msg[1],
+                               ks->num_peers,
+                               &ks->num_peers,
+                               &ks->local_peer_idx);
+
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "first round of consensus with %u peers\n",
+              ks->num_peers);
+  ks->consensus = GNUNET_CONSENSUS_create (cfg,
+                                           ks->num_peers,
+                                           ks->peers,
+                                           &msg->session_id,
+                                           GNUNET_TIME_absolute_ntoh (
+                                             msg->start),
+                                           GNUNET_TIME_absolute_ntoh (
+                                             msg->deadline),
+                                           keygen_round1_new_element,
+                                           ks);
+
+  ks->info = GNUNET_new_array (ks->num_peers,
+                               struct KeygenPeerInfo);
+
+  for (unsigned int i = 0; i < ks->num_peers; i++)
+    ks->info[i].peer = ks->peers[i];
+
+  GNUNET_CRYPTO_paillier_create (
+    &ks->info[ks->local_peer_idx].paillier_public_key,
+    &ks->paillier_private_key);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: Generated paillier key pair\n",
+              ks->local_peer_idx);
+  generate_presecret_polynomial (ks);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: Generated presecret polynomial\n",
+              ks->local_peer_idx);
+  insert_round1_element (ks);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: Concluding for round 1\n",
+              ks->local_peer_idx);
+  GNUNET_CONSENSUS_conclude (ks->consensus,
+                             keygen_round1_conclude,
+                             ks);
+  GNUNET_SERVICE_client_continue (cs->client);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: Waiting for round 1 elements ...\n",
+              ks->local_peer_idx);
+}
+
+
+/**
+ * Called when the partial decryption consensus concludes.
+ */
+static void
+decrypt_conclude (void *cls)
+{
+  struct DecryptSession *ds = cls;
+  struct GNUNET_SECRETSHARING_DecryptResponseMessage *msg;
+  struct GNUNET_MQ_Envelope *ev;
+  gcry_mpi_t lagrange;
+  gcry_mpi_t m;
+  gcry_mpi_t tmp;
+  gcry_mpi_t c_2;
+  gcry_mpi_t prod;
+  unsigned int *indices;
+  unsigned int num;
+  unsigned int i;
+  unsigned int j;
+
+  GNUNET_CONSENSUS_destroy (ds->consensus);
+  ds->consensus = NULL;
+
+  GNUNET_assert (0 != (lagrange = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (m = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (tmp = gcry_mpi_new (0)));
+  GNUNET_assert (0 != (prod = gcry_mpi_new (0)));
+
+  num = 0;
+  for (i = 0; i < ds->share->num_peers; i++)
+    if (NULL != ds->info[i].partial_decryption)
+      num++;
+
+  indices = GNUNET_new_array (num,
+                              unsigned int);
+  j = 0;
+  for (i = 0; i < ds->share->num_peers; i++)
+    if (NULL != ds->info[i].partial_decryption)
+      indices[j++] = ds->info[i].original_index;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "P%u: decrypt conclude, with %u peers\n",
+              ds->share->my_peer,
+              num);
+
+  gcry_mpi_set_ui (prod, 1);
+  for (i = 0; i < num; i++)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "P%u: index of %u: %u\n",
+                ds->share->my_peer, i, indices[i]);
+    compute_lagrange_coefficient (lagrange, indices[i], indices, num);
+    // w_i^{\lambda_i}
+    gcry_mpi_powm (tmp, ds->info[indices[i]].partial_decryption, lagrange,
+                   elgamal_p);
+
+    // product of all exponentiated partiel decryptions ...
+    gcry_mpi_mulm (prod, prod, tmp, elgamal_p);
+  }
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&c_2, ds->ciphertext.c2_bits,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+
+  GNUNET_assert (0 != gcry_mpi_invm (prod, prod, elgamal_p));
+  gcry_mpi_mulm (m, c_2, prod, elgamal_p);
+  ev = GNUNET_MQ_msg (msg,
+                      GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT_DONE);
+  GNUNET_CRYPTO_mpi_print_unsigned (&msg->plaintext,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, m);
+  msg->success = htonl (1);
+  GNUNET_MQ_send (ds->cs->mq,
+                  ev);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "sent decrypt done to client\n");
+
+  GNUNET_free (indices);
+
+  gcry_mpi_release (lagrange);
+  gcry_mpi_release (m);
+  gcry_mpi_release (tmp);
+  gcry_mpi_release (prod);
+  gcry_mpi_release (c_2);
+
+  // FIXME: what if not enough peers participated?
+}
+
+
+/**
+ * Get a string representation of an MPI.
+ * The caller must free the returned string.
+ *
+ * @param mpi mpi to convert to a string
+ * @return string representation of @a mpi, must be free'd by the caller
+ */
+static char *
+mpi_to_str (gcry_mpi_t mpi)
+{
+  unsigned char *buf;
+
+  GNUNET_assert (0 == gcry_mpi_aprint (GCRYMPI_FMT_HEX, &buf, NULL, mpi));
+  return (char *) buf;
+}
+
+
+/**
+ * Called when a new partial decryption arrives.
+ */
+static void
+decrypt_new_element (void *cls,
+                     const struct GNUNET_SET_Element *element)
+{
+  struct DecryptSession *session = cls;
+  const struct GNUNET_SECRETSHARING_DecryptData *d;
+  struct DecryptPeerInfo *info;
+  struct GNUNET_HashCode challenge_hash;
+
+  /* nizk response */
+  gcry_mpi_t r;
+  /* nizk challenge */
+  gcry_mpi_t challenge;
+  /* nizk commit1, g^\beta */
+  gcry_mpi_t commit1;
+  /* nizk commit2, c_1^\beta */
+  gcry_mpi_t commit2;
+  /* homomorphic commitment to the peer's share,
+   * public key share */
+  gcry_mpi_t sigma;
+  /* partial decryption we received */
+  gcry_mpi_t w;
+  /* ciphertext component #1 */
+  gcry_mpi_t c1;
+  /* temporary variable (for comparison) #1 */
+  gcry_mpi_t tmp1;
+  /* temporary variable (for comparison) #2 */
+  gcry_mpi_t tmp2;
+
+  if (NULL == element)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "decryption failed\n");
+    /* FIXME: destroy */
+    return;
+  }
+
+  if (element->size != sizeof *d)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "element of wrong size in decrypt consensus\n");
+    return;
+  }
+
+  d = element->data;
+
+  info = get_decrypt_peer_info (session, &d->peer);
+
+  if (NULL == info)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "decrypt element from invalid peer (%s)\n",
+                GNUNET_i2s (&d->peer));
+    return;
+  }
+
+  if (NULL != info->partial_decryption)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "decrypt element duplicate\n");
+    return;
+  }
+
+  if (0 != GNUNET_memcmp (&d->ciphertext, &session->ciphertext))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "P%u: got decrypt element with non-matching ciphertext from P%u\n",
+                (unsigned int) session->share->my_peer, (unsigned int) (info
+                                                                        -
+                                                                        session
+                                                                        ->info));
+
+    return;
+  }
+
+
+  GNUNET_CRYPTO_hash (offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                ciphertext) + (char *) d,
+                      offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                nizk_response)
+                      - offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                  ciphertext),
+                      &challenge_hash);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&challenge, &challenge_hash,
+                                   sizeof(struct GNUNET_HashCode));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&sigma, &session->share->sigmas[info
+                                                                   - session->
+                                                                   info],
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&c1, session->ciphertext.c1_bits,
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&commit1, &d->nizk_commit1,
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&commit2, &d->nizk_commit2,
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&r, &d->nizk_response,
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&w, &d->partial_decryption,
+                                   sizeof(struct
+                                          GNUNET_SECRETSHARING_FieldElement));
+
+  GNUNET_assert (NULL != (tmp1 = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (tmp2 = gcry_mpi_new (0)));
+
+  // tmp1 = g^r
+  gcry_mpi_powm (tmp1, elgamal_g, r, elgamal_p);
+
+  // tmp2 = g^\beta * \sigma^challenge
+  gcry_mpi_powm (tmp2, sigma, challenge, elgamal_p);
+  gcry_mpi_mulm (tmp2, tmp2, commit1, elgamal_p);
+
+  if (0 != gcry_mpi_cmp (tmp1, tmp2))
+  {
+    char *tmp1_str;
+    char *tmp2_str;
+
+    tmp1_str = mpi_to_str (tmp1);
+    tmp2_str = mpi_to_str (tmp2);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "P%u: Received invalid partial decryption from P%u (eqn 1), expected %s got %s\n",
+                session->share->my_peer,
+                (unsigned int) (info - session->info),
+                tmp1_str,
+                tmp2_str);
+    GNUNET_free (tmp1_str);
+    GNUNET_free (tmp2_str);
+    goto cleanup;
+  }
+
+
+  gcry_mpi_powm (tmp1, c1, r, elgamal_p);
+
+  gcry_mpi_powm (tmp2, w, challenge, elgamal_p);
+  gcry_mpi_mulm (tmp2, tmp2, commit2, elgamal_p);
+
+
+  if (0 != gcry_mpi_cmp (tmp1, tmp2))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "P%u: Received invalid partial decryption from P%u (eqn 2)\n",
+                session->share->my_peer,
+                (unsigned int) (info - session->info));
+    goto cleanup;
+  }
+
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&info->partial_decryption,
+                                   &d->partial_decryption,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+cleanup:
+  gcry_mpi_release (tmp1);
+  gcry_mpi_release (tmp2);
+  gcry_mpi_release (sigma);
+  gcry_mpi_release (commit1);
+  gcry_mpi_release (commit2);
+  gcry_mpi_release (r);
+  gcry_mpi_release (w);
+  gcry_mpi_release (challenge);
+  gcry_mpi_release (c1);
+}
+
+
+static void
+insert_decrypt_element (struct DecryptSession *ds)
+{
+  struct GNUNET_SECRETSHARING_DecryptData d;
+  struct GNUNET_SET_Element element;
+  /* our share */
+  gcry_mpi_t s;
+  /* partial decryption with our share */
+  gcry_mpi_t w;
+  /* first component of the elgamal ciphertext */
+  gcry_mpi_t c1;
+  /* nonce for dlog zkp */
+  gcry_mpi_t beta;
+  gcry_mpi_t tmp;
+  gcry_mpi_t challenge;
+  gcry_mpi_t sigma;
+  struct GNUNET_HashCode challenge_hash;
+
+  /* make vagrind happy until we implement the real deal ... */
+  memset (&d, 0, sizeof d);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "P%u: Inserting decrypt element\n",
+              ds->share->my_peer);
+
+  GNUNET_assert (ds->share->my_peer < ds->share->num_peers);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&c1, &ds->ciphertext.c1_bits,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&s, &ds->share->my_share,
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&sigma,
+                                   &ds->share->sigmas[ds->share->my_peer],
+                                   GNUNET_SECRETSHARING_ELGAMAL_BITS / 8);
+
+  GNUNET_assert (NULL != (w = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (beta = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (tmp = gcry_mpi_new (0)));
+
+  // FIXME: unnecessary, remove once crypto works
+  gcry_mpi_powm (tmp, elgamal_g, s, elgamal_p);
+  if (0 != gcry_mpi_cmp (tmp, sigma))
+  {
+    char *sigma_str = mpi_to_str (sigma);
+    char *tmp_str = mpi_to_str (tmp);
+    char *s_str = mpi_to_str (s);
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Share of P%u is invalid, ref sigma %s, "
+                "computed sigma %s, s %s\n",
+                ds->share->my_peer,
+                sigma_str, tmp_str, s_str);
+    GNUNET_free (sigma_str);
+    GNUNET_free (tmp_str);
+    GNUNET_free (s_str);
+  }
+
+  gcry_mpi_powm (w, c1, s, elgamal_p);
+
+  element.data = (void *) &d;
+  element.size = sizeof(struct GNUNET_SECRETSHARING_DecryptData);
+  element.element_type = 0;
+
+  d.ciphertext = ds->ciphertext;
+  d.peer = my_peer;
+  GNUNET_CRYPTO_mpi_print_unsigned (&d.partial_decryption,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, w);
+
+  // create the zero knowledge proof
+  // randomly choose beta such that 0 < beta < q
+  do
+  {
+    gcry_mpi_randomize (beta, GNUNET_SECRETSHARING_ELGAMAL_BITS - 1,
+                        GCRY_WEAK_RANDOM);
+  }
+  while ((gcry_mpi_cmp_ui (beta, 0) == 0) || (gcry_mpi_cmp (beta, elgamal_q) >=
+                                              0));
+  // tmp = g^beta
+  gcry_mpi_powm (tmp, elgamal_g, beta, elgamal_p);
+  GNUNET_CRYPTO_mpi_print_unsigned (&d.nizk_commit1,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, tmp);
+  // tmp = (c_1)^beta
+  gcry_mpi_powm (tmp, c1, beta, elgamal_p);
+  GNUNET_CRYPTO_mpi_print_unsigned (&d.nizk_commit2,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, tmp);
+
+  // the challenge is the hash of everything up to the response
+  GNUNET_CRYPTO_hash (offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                ciphertext) + (char *) &d,
+                      offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                nizk_response)
+                      - offsetof (struct GNUNET_SECRETSHARING_DecryptData,
+                                  ciphertext),
+                      &challenge_hash);
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&challenge, &challenge_hash,
+                                   sizeof(struct GNUNET_HashCode));
+
+  // compute the response in tmp,
+  // tmp = (c * s + beta) mod q
+  gcry_mpi_mulm (tmp, challenge, s, elgamal_q);
+  gcry_mpi_addm (tmp, tmp, beta, elgamal_q);
+
+  GNUNET_CRYPTO_mpi_print_unsigned (&d.nizk_response,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, tmp);
+
+  d.purpose.size = htonl (element.size - offsetof (struct
+                                                   GNUNET_SECRETSHARING_DecryptData,
+                                                   purpose));
+  d.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_SECRETSHARING_DECRYPTION);
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_eddsa_sign_ (my_peer_private_key,
+                                            &d.purpose,
+                                            &d.signature));
+
+  GNUNET_CONSENSUS_insert (ds->consensus, &element, NULL, NULL);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "P%u: Inserting decrypt element done!\n",
+              ds->share->my_peer);
+
+  gcry_mpi_release (s);
+  gcry_mpi_release (w);
+  gcry_mpi_release (c1);
+  gcry_mpi_release (beta);
+  gcry_mpi_release (tmp);
+  gcry_mpi_release (challenge);
+  gcry_mpi_release (sigma);
+}
+
+
+/**
+ * Check that @a msg is well-formed.
+ *
+ * @param cls identification of the client
+ * @param msg the actual message
+ * @return #GNUNET_OK (check deferred a bit)
+ */
+static int
+check_client_decrypt (void *cls,
+                      const struct
+                      GNUNET_SECRETSHARING_DecryptRequestMessage *msg)
+{
+  /* we check later, it's complicated */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Functions with this signature are called whenever a message is
+ * received.
+ *
+ * @param cls identification of the client
+ * @param msg the actual message
+ */
+static void
+handle_client_decrypt (void *cls,
+                       const struct
+                       GNUNET_SECRETSHARING_DecryptRequestMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct DecryptSession *ds;
+  struct GNUNET_HashCode session_id;
+
+  if (NULL != cs->decrypt_session)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  ds = GNUNET_new (struct DecryptSession);
+  cs->decrypt_session = ds;
+  ds->cs = cs;
+  ds->start = GNUNET_TIME_absolute_ntoh (msg->start);
+  ds->deadline = GNUNET_TIME_absolute_ntoh (msg->deadline);
+  ds->ciphertext = msg->ciphertext;
+
+  ds->share = GNUNET_SECRETSHARING_share_read (&msg[1],
+                                               ntohs (msg->header.size)
+                                               - sizeof(*msg),
+                                               NULL);
+  if (NULL == ds->share)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+
+  /* FIXME: this is probably sufficient, but kdf/hash with all values would be nicer ... */
+  GNUNET_CRYPTO_hash (&msg->ciphertext,
+                      sizeof(struct GNUNET_SECRETSHARING_Ciphertext),
+                      &session_id);
+  ds->consensus = GNUNET_CONSENSUS_create (cfg,
+                                           ds->share->num_peers,
+                                           ds->share->peers,
+                                           &session_id,
+                                           ds->start,
+                                           ds->deadline,
+                                           &decrypt_new_element,
+                                           ds);
+
+
+  ds->info = GNUNET_new_array (ds->share->num_peers,
+                               struct DecryptPeerInfo);
+  for (unsigned int i = 0; i < ds->share->num_peers; i++)
+  {
+    ds->info[i].peer = ds->share->peers[i];
+    ds->info[i].original_index = ds->share->original_indices[i];
+  }
+  insert_decrypt_element (ds);
+  GNUNET_CONSENSUS_conclude (ds->consensus,
+                             decrypt_conclude,
+                             ds);
+  GNUNET_SERVICE_client_continue (cs->client);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "decrypting with %u peers\n",
+              ds->share->num_peers);
+}
+
+
+static void
+init_crypto_constants (void)
+{
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_q, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_Q_HEX, 0,
+                                     NULL));
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_p, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_P_HEX, 0,
+                                     NULL));
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_g, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_G_HEX, 0,
+                                     NULL));
+}
+
+
+/**
+ * Initialize secretsharing service.
+ *
+ * @param cls closure
+ * @param c configuration to use
+ * @param service the initialized service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *c,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  cfg = c;
+  my_peer_private_key = GNUNET_CRYPTO_eddsa_key_create_from_configuration (c);
+  if (NULL == my_peer_private_key)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "could not access host private key\n");
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  init_crypto_constants ();
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_get_peer_identity (cfg,
+                                       &my_peer))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "could not retrieve host identity\n");
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+  GNUNET_SCHEDULER_add_shutdown (&cleanup_task,
+                                 NULL);
+}
+
+
+/**
+ * Callback called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return @a c
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *c,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  struct ClientState *cs = GNUNET_new (struct ClientState);;
+
+  cs->client = c;
+  cs->mq = mq;
+  return cs;
+}
+
+
+/**
+ * Callback called when a client disconnected from the service
+ *
+ * @param cls closure for the service
+ * @param c the client that disconnected
+ * @param internal_cls should be equal to @a c
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *c,
+                      void *internal_cls)
+{
+  struct ClientState *cs = internal_cls;
+
+  if (NULL != cs->keygen_session)
+    keygen_session_destroy (cs->keygen_session);
+
+  if (NULL != cs->decrypt_session)
+    decrypt_session_destroy (cs->decrypt_session);
+  GNUNET_free (cs);
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN
+  ("secretsharing",
+  GNUNET_SERVICE_OPTION_NONE,
+  &run,
+  &client_connect_cb,
+  &client_disconnect_cb,
+  NULL,
+  GNUNET_MQ_hd_var_size (client_keygen,
+                         GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_GENERATE,
+                         struct GNUNET_SECRETSHARING_CreateMessage,
+                         NULL),
+  GNUNET_MQ_hd_var_size (client_decrypt,
+                         GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT,
+                         struct GNUNET_SECRETSHARING_DecryptRequestMessage,
+                         NULL),
+  GNUNET_MQ_handler_end ());
diff --git a/src/contrib/service/secretsharing/meson.build b/src/contrib/service/secretsharing/meson.build
new file mode 100644
index 000000000..bfd66dddb
--- /dev/null
+++ b/src/contrib/service/secretsharing/meson.build
@@ -0,0 +1,46 @@
+libgnunetsecretsharing_src = ['secretsharing_api.c', 'secretsharing_common.c']
+
+gnunetservicesecretsharing_src = ['gnunet-service-secretsharing.c', 'secretsharing_common.c']
+
+configure_file(input : 'secretsharing.conf.in',
+               output : 'secretsharing.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+# FIXME needs new seti/setu
+if get_option('monolith')
+  #foreach p : libgnunetsecretsharing_src + gnunetservicesecretsharing_src
+  #  gnunet_src += 'secretsharing/' + p
+  #endforeach
+  subdir_done()
+endif
+
+libgnunetsecretsharing = library('gnunetsecretsharing',
+        libgnunetsecretsharing_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: [libgnunetutil_dep,
+                       libgnunetstatistics_dep,
+                       gcrypt_dep,
+                       libgnunetdatacache_dep],
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+libgnunetsecretsharing_dep = declare_dependency(link_with : libgnunetsecretsharing)
+pkg.generate(libgnunetsecretsharing, url: 'https://www.gnunet.org',
+             description : 'Provides API for the secretsharing service')
+
+executable ('gnunet-service-secretsharing',
+            gnunetservicesecretsharing_src,
+            dependencies: [libgnunetsecretsharing_dep,
+                           libgnunetutil_dep,
+                           gcrypt_dep,
+                           m_dep,
+                           libgnunetconsensus_dep,
+                           libgnunetstatistics_dep,
+                           libgnunetdatacache_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir')/'gnunet'/'libexec')
+
diff --git a/src/contrib/service/secretsharing/secretsharing.conf.in b/src/contrib/service/secretsharing/secretsharing.conf.in
new file mode 100644
index 000000000..df8566abd
--- /dev/null
+++ b/src/contrib/service/secretsharing/secretsharing.conf.in
@@ -0,0 +1,20 @@
+[secretsharing]
+START_ON_DEMAND = NO
+@JAVAPORT@PORT = 2114
+HOSTNAME = localhost
+BINARY = gnunet-service-secretsharing
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-secretsharing.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
+# PREFIX = valgrind --leak-check=yes
+# DISABLE_SOCKET_FORWARDING = NO
+# USERNAME =
+# MAXBUF =
+# TIMEOUT =
+# DISABLEV6 =
+# BINDTO =
+# REJECT_FROM =
+# REJECT_FROM6 =
+# PREFIX =
diff --git a/src/contrib/service/secretsharing/secretsharing.h b/src/contrib/service/secretsharing/secretsharing.h
new file mode 100644
index 000000000..6e104ebfa
--- /dev/null
+++ b/src/contrib/service/secretsharing/secretsharing.h
@@ -0,0 +1,227 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @author Florian Dold
+ * @file secretsharing/secretsharing.h
+ * @brief messages used for the secretsharing api
+ */
+#ifndef SECRETSHARING_H
+#define SECRETSHARING_H
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_time_lib.h"
+#include "gnunet_common.h"
+#include "gnunet_secretsharing_service.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+struct GNUNET_SECRETSHARING_FieldElement
+{
+  /**
+   * Value of an element in &lt;elgamal_g&gt;.
+   */
+  unsigned char bits[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+};
+
+
+struct GNUNET_SECRETSHARING_CreateMessage
+{
+  /**
+   * Type: GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_GENERATE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Session ID, will be used for consensus.
+   */
+  struct GNUNET_HashCode session_id GNUNET_PACKED;
+
+  /**
+   * Start time for communication with the other peers.
+   */
+  struct GNUNET_TIME_AbsoluteNBO start;
+
+  /**
+   * Deadline for the establishment of the crypto system.
+   */
+  struct GNUNET_TIME_AbsoluteNBO deadline;
+
+  /**
+   * Minimum number of cooperating peers to decrypt a
+   * value.
+   */
+  uint16_t threshold GNUNET_PACKED;
+
+  /**
+   * Number of peers at the end of this message.
+   */
+  uint16_t num_peers GNUNET_PACKED;
+
+  /* struct GNUNET_PeerIdentity[num_peers]; */
+};
+
+
+struct GNUNET_SECRETSHARING_ShareHeaderNBO
+{
+  /**
+   * Threshold for the key this share belongs to.
+   */
+  uint16_t threshold;
+
+  /**
+   * Peers that have the share.
+   */
+  uint16_t num_peers;
+
+  /**
+   * Index of our peer in the list.
+   */
+  uint16_t my_peer;
+
+  /**
+   * Public key. Must correspond to the product of
+   * the homomorphic share commitments.
+   */
+  struct GNUNET_SECRETSHARING_PublicKey public_key;
+
+  /**
+   * Share of 'my_peer'
+   */
+  struct GNUNET_SECRETSHARING_FieldElement my_share;
+};
+
+
+/**
+ * Notify the client that then threshold secret has been
+ * established.
+ */
+struct GNUNET_SECRETSHARING_SecretReadyMessage
+{
+  /**
+   * Type: GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_SECRET_READY
+   */
+  struct GNUNET_MessageHeader header;
+
+  /* rest: the serialized share */
+};
+
+
+struct GNUNET_SECRETSHARING_DecryptRequestMessage
+{
+  /**
+   * Type: GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT_REQUEST
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Until when should the decryption start?
+   */
+  struct GNUNET_TIME_AbsoluteNBO start;
+
+  /**
+   * Until when should the decryption be finished?
+   */
+  struct GNUNET_TIME_AbsoluteNBO deadline;
+
+  /**
+   * Ciphertext we want to decrypt.
+   */
+  struct GNUNET_SECRETSHARING_Ciphertext ciphertext;
+
+  /* the share with payload */
+};
+
+
+struct GNUNET_SECRETSHARING_DecryptResponseMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT_DONE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Zero if decryption failed, non-zero if decryption succeeded.
+   * If the decryption failed, plaintext is also zero.
+   */
+  uint32_t success GNUNET_PACKED;
+
+  /**
+   * Decrypted plaintext.
+   */
+  struct GNUNET_SECRETSHARING_FieldElement plaintext;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+
+/**
+ * A share, with all values in in host byte order.
+ */
+struct GNUNET_SECRETSHARING_Share
+{
+  /**
+   * Threshold for the key this share belongs to.
+   */
+  uint16_t threshold;
+
+  /**
+   * Peers that have the share.
+   */
+  uint16_t num_peers;
+
+  /**
+   * Index of our peer in the list.
+   */
+  uint16_t my_peer;
+
+  /**
+   * Public key.  Computed from the
+   * exponentiated coefficients.
+   */
+  struct GNUNET_SECRETSHARING_PublicKey public_key;
+
+  /**
+   * Share of 'my_peer'
+   */
+  struct GNUNET_SECRETSHARING_FieldElement my_share;
+
+  /**
+   * Peer identities (includes 'my_peer')
+   */
+  struct GNUNET_PeerIdentity *peers;
+
+  /*
+   * For each peer, store elgamal_g to the peer's
+   * share.
+   */
+  struct GNUNET_SECRETSHARING_FieldElement *sigmas;
+
+  /*
+   * Original indices of peers from the DKG round.
+   */
+  uint16_t *original_indices;
+};
+
+
+#endif
diff --git a/src/contrib/service/secretsharing/secretsharing_api.c b/src/contrib/service/secretsharing/secretsharing_api.c
new file mode 100644
index 000000000..595af751f
--- /dev/null
+++ b/src/contrib/service/secretsharing/secretsharing_api.c
@@ -0,0 +1,492 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file secretsharing/secretsharing_api.c
+ * @brief
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_secretsharing_service.h"
+#include "secretsharing.h"
+#include <gcrypt.h>
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "secretsharing-api", __VA_ARGS__)
+
+/**
+ * Session that will eventually establish a shared secred between
+ * the involved peers and allow encryption and cooperative decryption.
+ */
+struct GNUNET_SECRETSHARING_Session
+{
+  /**
+   * Message queue for @e client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Called when the secret sharing is done.
+   */
+  GNUNET_SECRETSHARING_SecretReadyCallback secret_ready_cb;
+
+  /**
+   * Closure for @e secret_ready_cb.
+   */
+  void *secret_ready_cls;
+};
+
+
+/**
+ * Handle to cancel a cooperative decryption operation.
+ */
+struct GNUNET_SECRETSHARING_DecryptionHandle
+{
+  /**
+   * Message queue for @e client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Called when the secret sharing is done.
+   */
+  GNUNET_SECRETSHARING_DecryptCallback decrypt_cb;
+
+  /**
+   * Closure for @e decrypt_cb.
+   */
+  void *decrypt_cls;
+};
+
+
+/**
+ * The ElGamal prime field order as libgcrypt mpi.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_q;
+
+/**
+ * Modulus of the prime field used for ElGamal.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_p;
+
+/**
+ * Generator for prime field of order 'elgamal_q'.
+ * Initialized in #init_crypto_constants.
+ */
+static gcry_mpi_t elgamal_g;
+
+
+/**
+ * Function to initialize #elgamal_q, #elgamal_p and #elgamal_g.
+ */
+static void
+ensure_elgamal_initialized (void)
+{
+  if (NULL != elgamal_q)
+    return; /* looks like crypto is already initialized */
+
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_q, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_Q_HEX, 0,
+                                     NULL));
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_p, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_P_HEX, 0,
+                                     NULL));
+  GNUNET_assert (0 == gcry_mpi_scan (&elgamal_g, GCRYMPI_FMT_HEX,
+                                     GNUNET_SECRETSHARING_ELGAMAL_G_HEX, 0,
+                                     NULL));
+}
+
+
+/**
+ * Callback invoked when there is an error communicating with
+ * the service.  Notifies the application about the error.
+ *
+ * @param cls the `struct GNUNET_SECRETSHARING_Session`
+ * @param error error code
+ */
+static void
+handle_session_client_error (void *cls,
+                             enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_SECRETSHARING_Session *s = cls;
+
+  s->secret_ready_cb (s->secret_ready_cls, NULL, NULL, 0, NULL);
+  GNUNET_SECRETSHARING_session_destroy (s);
+}
+
+
+/**
+ * Callback invoked when there is an error communicating with
+ * the service.  Notifies the application about the error.
+ *
+ * @param cls the `struct GNUNET_SECRETSHARING_DecryptionHandle`
+ * @param error error code
+ */
+static void
+handle_decrypt_client_error (void *cls,
+                             enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle *dh = cls;
+
+  dh->decrypt_cb (dh->decrypt_cls, NULL);
+  GNUNET_SECRETSHARING_decrypt_cancel (dh);
+}
+
+
+/**
+ * Handler invoked with the final result message from
+ * secret sharing.  Decodes the message and passes the
+ * result to the application.
+ *
+ * @param cls the `struct GNUNET_SECRETSHARING_Session`
+ * @param m message with the result
+ */
+static int
+check_secret_ready (void *cls,
+                    const struct GNUNET_SECRETSHARING_SecretReadyMessage *m)
+{
+  /* FIXME: actually check m is well-formed here! */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handler invoked with the final result message from
+ * secret sharing.  Decodes the message and passes the
+ * result to the application.
+ *
+ * @param cls the `struct GNUNET_SECRETSHARING_Session`
+ * @param m message with the result
+ */
+static void
+handle_secret_ready (void *cls,
+                     const struct GNUNET_SECRETSHARING_SecretReadyMessage *m)
+{
+  struct GNUNET_SECRETSHARING_Session *s = cls;
+  struct GNUNET_SECRETSHARING_Share *share;
+  size_t share_size;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got secret ready message of size %u\n",
+       ntohs (m->header.size));
+  share_size = ntohs (m->header.size) - sizeof(struct
+                                               GNUNET_SECRETSHARING_SecretReadyMessage);
+
+  share = GNUNET_SECRETSHARING_share_read (&m[1],
+                                           share_size,
+                                           NULL);
+  GNUNET_assert (NULL != share);  // FIXME: this can fail!
+  // should have been checked in #check_secret_ready!
+  // FIXME: below we never check &m[1] is valid!
+  // FIXME: do we leak 'share' here?
+  s->secret_ready_cb (s->secret_ready_cls,
+                      share, /* FIXME */
+                      &share->public_key,
+                      share->num_peers,
+                      (const struct GNUNET_PeerIdentity *) &m[1]);
+
+  GNUNET_SECRETSHARING_session_destroy (s);
+}
+
+
+/**
+ * Destroy a secret sharing session.
+ * The secret ready callback will not be called.
+ *
+ * @param s session to destroy
+ */
+void
+GNUNET_SECRETSHARING_session_destroy (struct GNUNET_SECRETSHARING_Session *s)
+{
+  GNUNET_MQ_destroy (s->mq);
+  s->mq = NULL;
+  GNUNET_free (s);
+}
+
+
+/**
+ * Create a session that will eventually establish a shared secret
+ * with the other peers.
+ *
+ * @param cfg configuration to use
+ * @param num_peers number of peers in @a peers
+ * @param peers array of peers that we will share secrets with, can optionally contain the local peer
+ * @param session_id unique session id
+ * @param start When should all peers be available for sharing the secret?
+ *              Random number generation can take place before the start time.
+ * @param deadline point in time where the session must be established; taken as hint
+ *                 by underlying consensus sessions
+ * @param threshold minimum number of peers that must cooperate to decrypt a value
+ * @param cb called when the secret has been established
+ * @param cls closure for @a cb
+ */
+struct GNUNET_SECRETSHARING_Session *
+GNUNET_SECRETSHARING_create_session (const struct
+                                     GNUNET_CONFIGURATION_Handle *cfg,
+                                     unsigned int num_peers,
+                                     const struct GNUNET_PeerIdentity *peers,
+                                     const struct GNUNET_HashCode *session_id,
+                                     struct GNUNET_TIME_Absolute start,
+                                     struct GNUNET_TIME_Absolute deadline,
+                                     unsigned int threshold,
+                                     GNUNET_SECRETSHARING_SecretReadyCallback cb,
+                                     void *cls)
+{
+  struct GNUNET_SECRETSHARING_Session *s
+    = GNUNET_new (struct GNUNET_SECRETSHARING_Session);
+  struct GNUNET_MQ_MessageHandler mq_handlers[] = {
+    GNUNET_MQ_hd_var_size (secret_ready,
+                           GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_SECRET_READY,
+                           struct GNUNET_SECRETSHARING_SecretReadyMessage,
+                           s),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SECRETSHARING_CreateMessage *msg;
+
+  s->mq = GNUNET_CLIENT_connect (cfg,
+                                 "secretsharing",
+                                 mq_handlers,
+                                 &handle_session_client_error,
+                                 s);
+  if (NULL == s->mq)
+  {
+    /* secretsharing not configured correctly */
+    GNUNET_break (0);
+    GNUNET_free (s);
+    return NULL;
+  }
+  s->secret_ready_cb = cb;
+  s->secret_ready_cls = cls;
+  ev = GNUNET_MQ_msg_extra (msg,
+                            num_peers * sizeof(struct GNUNET_PeerIdentity),
+                            GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_GENERATE);
+
+  msg->threshold = htons (threshold);
+  msg->num_peers = htons (num_peers);
+  msg->session_id = *session_id;
+  msg->start = GNUNET_TIME_absolute_hton (start);
+  msg->deadline = GNUNET_TIME_absolute_hton (deadline);
+  GNUNET_memcpy (&msg[1], peers, num_peers * sizeof(struct
+                                                    GNUNET_PeerIdentity));
+
+  GNUNET_MQ_send (s->mq, ev);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Secretsharing session created with %u peers\n",
+       num_peers);
+  return s;
+}
+
+
+static void
+handle_decrypt_done (void *cls,
+                     const struct
+                     GNUNET_SECRETSHARING_DecryptResponseMessage *m)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle *dh = cls;
+  const struct GNUNET_SECRETSHARING_Plaintext *plaintext;
+
+  if (m->success == 0)
+    plaintext = NULL;
+  else
+    plaintext = (void *) &m->plaintext;
+  dh->decrypt_cb (dh->decrypt_cls, plaintext);
+  GNUNET_SECRETSHARING_decrypt_cancel (dh);
+}
+
+
+struct GNUNET_SECRETSHARING_DecryptionHandle *
+GNUNET_SECRETSHARING_decrypt (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                              struct GNUNET_SECRETSHARING_Share *share,
+                              const struct
+                              GNUNET_SECRETSHARING_Ciphertext *ciphertext,
+                              struct GNUNET_TIME_Absolute start,
+                              struct GNUNET_TIME_Absolute deadline,
+                              GNUNET_SECRETSHARING_DecryptCallback decrypt_cb,
+                              void *decrypt_cb_cls)
+{
+  struct GNUNET_SECRETSHARING_DecryptionHandle *s
+    = GNUNET_new (struct GNUNET_SECRETSHARING_DecryptionHandle);
+  struct GNUNET_MQ_MessageHandler mq_handlers[] = {
+    GNUNET_MQ_hd_fixed_size (decrypt_done,
+                             GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT_DONE,
+                             struct GNUNET_SECRETSHARING_DecryptResponseMessage,
+                             s),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SECRETSHARING_DecryptRequestMessage *msg;
+  size_t share_size;
+
+  s->decrypt_cb = decrypt_cb;
+  s->decrypt_cls = decrypt_cb_cls;
+  s->mq = GNUNET_CLIENT_connect (cfg,
+                                 "secretsharing",
+                                 mq_handlers,
+                                 &handle_decrypt_client_error,
+                                 s);
+  if (NULL == s->mq)
+  {
+    GNUNET_free (s);
+    return NULL;
+  }
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_SECRETSHARING_share_write (share, NULL, 0,
+                                                   &share_size));
+
+  ev = GNUNET_MQ_msg_extra (msg,
+                            share_size,
+                            GNUNET_MESSAGE_TYPE_SECRETSHARING_CLIENT_DECRYPT);
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_SECRETSHARING_share_write (share,
+                                                   &msg[1],
+                                                   share_size,
+                                                   NULL));
+
+  msg->start = GNUNET_TIME_absolute_hton (start);
+  msg->deadline = GNUNET_TIME_absolute_hton (deadline);
+  msg->ciphertext = *ciphertext;
+
+  GNUNET_MQ_send (s->mq, ev);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "decrypt session created\n");
+  return s;
+}
+
+
+int
+GNUNET_SECRETSHARING_plaintext_generate_i (struct
+                                           GNUNET_SECRETSHARING_Plaintext *
+                                           plaintext,
+                                           int64_t exponent)
+{
+  int negative;
+  gcry_mpi_t x;
+
+  ensure_elgamal_initialized ();
+
+  GNUNET_assert (NULL != (x = gcry_mpi_new (0)));
+
+  negative = GNUNET_NO;
+  if (exponent < 0)
+  {
+    negative = GNUNET_YES;
+    exponent = -exponent;
+  }
+
+  gcry_mpi_set_ui (x, exponent);
+
+  gcry_mpi_powm (x, elgamal_g, x, elgamal_p);
+
+  if (GNUNET_YES == negative)
+  {
+    int res;
+    res = gcry_mpi_invm (x, x, elgamal_p);
+    if (0 == res)
+      return GNUNET_SYSERR;
+  }
+
+  GNUNET_CRYPTO_mpi_print_unsigned (plaintext,
+                                    sizeof(struct
+                                           GNUNET_SECRETSHARING_Plaintext),
+                                    x);
+
+  return GNUNET_OK;
+}
+
+
+int
+GNUNET_SECRETSHARING_encrypt (const struct
+                              GNUNET_SECRETSHARING_PublicKey *public_key,
+                              const struct
+                              GNUNET_SECRETSHARING_Plaintext *plaintext,
+                              struct GNUNET_SECRETSHARING_Ciphertext *
+                              result_ciphertext)
+{
+  /* pubkey */
+  gcry_mpi_t h;
+  /* nonce */
+  gcry_mpi_t y;
+  /* plaintext message */
+  gcry_mpi_t m;
+  /* temp value */
+  gcry_mpi_t tmp;
+
+  ensure_elgamal_initialized ();
+
+  GNUNET_assert (NULL != (h = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (y = gcry_mpi_new (0)));
+  GNUNET_assert (NULL != (tmp = gcry_mpi_new (0)));
+
+  GNUNET_CRYPTO_mpi_scan_unsigned (&h, public_key, sizeof *public_key);
+  GNUNET_CRYPTO_mpi_scan_unsigned (&m, plaintext, sizeof *plaintext);
+
+  // Randomize y such that 0 < y < elgamal_q.
+  // The '- 1' is necessary as bitlength(q) = bitlength(p) - 1.
+  do
+  {
+    gcry_mpi_randomize (y, GNUNET_SECRETSHARING_ELGAMAL_BITS - 1,
+                        GCRY_WEAK_RANDOM);
+  }
+  while ((gcry_mpi_cmp_ui (y, 0) == 0) || (gcry_mpi_cmp (y, elgamal_q) >= 0));
+
+  // tmp <- g^y
+  gcry_mpi_powm (tmp, elgamal_g, y, elgamal_p);
+  // write tmp to c1
+  GNUNET_CRYPTO_mpi_print_unsigned (&result_ciphertext->c1_bits,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, tmp);
+
+  // tmp <- h^y
+  gcry_mpi_powm (tmp, h, y, elgamal_p);
+  // tmp <- tmp * m
+  gcry_mpi_mulm (tmp, tmp, m, elgamal_p);
+  // write tmp to c2
+  GNUNET_CRYPTO_mpi_print_unsigned (&result_ciphertext->c2_bits,
+                                    GNUNET_SECRETSHARING_ELGAMAL_BITS / 8, tmp);
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Cancel a decryption.
+ *
+ * The decrypt_cb is not called anymore, but the calling
+ * peer may already have irrevocably contributed its share for the decryption of the value.
+ *
+ * @param dh to cancel
+ */
+void
+GNUNET_SECRETSHARING_decrypt_cancel (struct
+                                     GNUNET_SECRETSHARING_DecryptionHandle *dh)
+{
+  GNUNET_MQ_destroy (dh->mq);
+  dh->mq = NULL;
+  GNUNET_free (dh);
+}
+
+
+/* end of secretsharing_api.c */
diff --git a/src/contrib/service/secretsharing/secretsharing_common.c b/src/contrib/service/secretsharing/secretsharing_common.c
new file mode 100644
index 000000000..44b96b1c8
--- /dev/null
+++ b/src/contrib/service/secretsharing/secretsharing_common.c
@@ -0,0 +1,159 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+#include "platform.h"
+#include "secretsharing.h"
+
+/**
+ * Read a share from its binary representation.
+ *
+ * @param data Binary representation of the share.
+ * @param len Length of @a data.
+ * @param[out] readlen Number of bytes read,
+ *             ignored if NULL.
+ * @return The share, or NULL on error.
+ */
+struct GNUNET_SECRETSHARING_Share *
+GNUNET_SECRETSHARING_share_read (const void *data,
+                                 size_t len,
+                                 size_t *readlen)
+{
+  struct GNUNET_SECRETSHARING_Share *share;
+  const struct GNUNET_SECRETSHARING_ShareHeaderNBO *sh = data;
+  const char *p;
+  size_t n;
+  uint16_t payload_size;
+
+  payload_size = ntohs (sh->num_peers)
+                 * (sizeof(uint16_t) + sizeof(struct
+                                              GNUNET_SECRETSHARING_FieldElement)
+                    + sizeof(struct GNUNET_PeerIdentity));
+
+  if (NULL != readlen)
+    *readlen = payload_size + sizeof *sh;
+
+  share = GNUNET_new (struct GNUNET_SECRETSHARING_Share);
+
+  share->threshold = ntohs (sh->threshold);
+  share->num_peers = ntohs (sh->num_peers);
+  share->my_peer = ntohs (sh->my_peer);
+
+  share->my_share = sh->my_share;
+  share->public_key = sh->public_key;
+
+  p = (const char *) &sh[1];
+
+  n = share->num_peers * sizeof(struct GNUNET_PeerIdentity);
+  share->peers = GNUNET_new_array (share->num_peers,
+                                   struct GNUNET_PeerIdentity);
+  GNUNET_memcpy (share->peers, p, n);
+  p += n;
+
+  n = share->num_peers * sizeof(struct GNUNET_SECRETSHARING_FieldElement);
+  share->sigmas = GNUNET_new_array (share->num_peers,
+                                    struct GNUNET_SECRETSHARING_FieldElement);
+  GNUNET_memcpy (share->sigmas, p, n);
+  p += n;
+
+  n = share->num_peers * sizeof(uint16_t);
+  share->original_indices = GNUNET_new_array (share->num_peers,
+                                              uint16_t);
+  GNUNET_memcpy (share->original_indices, p, n);
+
+  return share;
+}
+
+
+/**
+ * Convert a share to its binary representation.
+ * Can be called with a NULL @a buf to get the size of the share.
+ *
+ * @param share Share to write.
+ * @param buf Buffer to write to.
+ * @param buflen Number of writable bytes in @a buf.
+ * @param[out] writelen Pointer to store number of bytes written,
+ *             ignored if NULL.
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure.
+ */
+int
+GNUNET_SECRETSHARING_share_write (const struct
+                                  GNUNET_SECRETSHARING_Share *share,
+                                  void *buf, size_t buflen, size_t *writelen)
+{
+  uint16_t payload_size;
+  struct GNUNET_SECRETSHARING_ShareHeaderNBO *sh;
+  char *p;
+  int n;
+
+  payload_size = share->num_peers
+                 * (sizeof(uint16_t) + sizeof(struct
+                                              GNUNET_SECRETSHARING_FieldElement)
+                    + sizeof(struct GNUNET_PeerIdentity));
+
+  if (NULL != writelen)
+    *writelen = payload_size + sizeof(struct
+                                      GNUNET_SECRETSHARING_ShareHeaderNBO);
+
+  /* just a query for the writelen */
+  if (buf == NULL)
+    return GNUNET_OK;
+
+  /* wrong buffer size */
+  if (buflen < payload_size + sizeof(struct
+                                     GNUNET_SECRETSHARING_ShareHeaderNBO))
+    return GNUNET_SYSERR;
+
+  sh = buf;
+
+  sh->threshold = htons (share->threshold);
+  sh->num_peers = htons (share->num_peers);
+  sh->my_peer = htons (share->my_peer);
+
+  sh->my_share = share->my_share;
+  sh->public_key = share->public_key;
+
+  p = (void *) &sh[1];
+
+  n = share->num_peers * sizeof(struct GNUNET_PeerIdentity);
+  GNUNET_memcpy (p, share->peers, n);
+  p += n;
+
+  n = share->num_peers * sizeof(struct GNUNET_SECRETSHARING_FieldElement);
+  GNUNET_memcpy (p, share->sigmas, n);
+  p += n;
+
+  n = share->num_peers * sizeof(uint16_t);
+  GNUNET_memcpy (p, share->original_indices, n);
+
+  return GNUNET_OK;
+}
+
+
+void
+GNUNET_SECRETSHARING_share_destroy (struct GNUNET_SECRETSHARING_Share *share)
+{
+  GNUNET_free (share->original_indices);
+  share->original_indices = NULL;
+  GNUNET_free (share->sigmas);
+  share->sigmas = NULL;
+  GNUNET_free (share->peers);
+  share->peers = NULL;
+  GNUNET_free (share);
+}
diff --git a/src/contrib/service/secretsharing/secretsharing_protocol.h b/src/contrib/service/secretsharing/secretsharing_protocol.h
new file mode 100644
index 000000000..e6f3ba286
--- /dev/null
+++ b/src/contrib/service/secretsharing/secretsharing_protocol.h
@@ -0,0 +1,147 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+
+/**
+ * @file secretsharing/secretsharing_protocol.h
+ * @brief p2p message definitions for secretsharing
+ * @author Florian Dold
+ */
+
+#ifndef GNUNET_SECRETSHARING_PROTOCOL_H
+#define GNUNET_SECRETSHARING_PROTOCOL_H
+
+#include "platform.h"
+#include "gnunet_common.h"
+#include "gnunet_protocols.h"
+#include "secretsharing.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+
+/**
+ * Consensus element data used in the first round of key generation.
+ */
+struct GNUNET_SECRETSHARING_KeygenCommitData
+{
+  /**
+   * Signature over the rest of the message.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature signature;
+  /**
+   * Signature purpose for signing the keygen commit data.
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+  /**
+   * Peer that inserts this element.
+   */
+  struct GNUNET_PeerIdentity peer;
+  /**
+   * Ephemeral paillier public key used by 'peer' for
+   * this session.
+   */
+  struct GNUNET_CRYPTO_PaillierPublicKey pubkey;
+  /**
+   * Commitment of 'peer' to its presecret.
+   */
+  struct GNUNET_HashCode commitment GNUNET_PACKED;
+};
+
+
+struct GNUNET_SECRETSHARING_KeygenRevealData
+{
+  /**
+   * Signature over rest of the message.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature signature;
+  /*
+   * Signature purpose for signing the keygen commit data.
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+  /**
+   * Peer that inserts this element.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /* values follow */
+};
+
+
+/**
+ * Data of then element put in consensus
+ * for decrypting a value.
+ */
+struct GNUNET_SECRETSHARING_DecryptData
+{
+  /*
+   * Signature over rest of the message.
+   */
+  struct GNUNET_CRYPTO_EddsaSignature signature;
+  /*
+   * Signature purpose for signing the keygen commit data.
+   */
+  struct GNUNET_CRYPTO_EccSignaturePurpose purpose;
+  /**
+   * Ciphertext we want to decrypt.
+   */
+  struct GNUNET_SECRETSHARING_Ciphertext ciphertext;
+  /**
+   * Peer that inserts this element.
+   */
+  struct GNUNET_PeerIdentity peer;
+  /**
+   * Partial decryption, computed as \f$c_1^{s_i}\f$
+   */
+  struct GNUNET_SECRETSHARING_FieldElement partial_decryption;
+  /**
+   * Commitment for the non-interactive zero knowledge proof.
+   * \f$g^\beta\f$, with \f$\beta < q\f$
+   */
+  struct GNUNET_SECRETSHARING_FieldElement nizk_commit1;
+  /**
+   * Commitment for the non-interactive zero knowledge proof.
+   * \f$c_1^\beta\f$, with \f$\beta < q\f$
+   */
+  struct GNUNET_SECRETSHARING_FieldElement nizk_commit2;
+  /**
+   * Response to the challenge computed from the protocol transcript.
+   * \f$r = \beta + challenge \cdot share_i\f$
+   */
+  struct GNUNET_SECRETSHARING_FieldElement nizk_response;
+};
+
+
+struct GNUNET_SECRETSHARING_FairEncryption
+{
+  struct GNUNET_CRYPTO_PaillierCiphertext c;
+  /**
+   * h = g^x, where x is the fairly encrypted secret.
+   */
+  char h[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+  char t1[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+  char t2[GNUNET_CRYPTO_PAILLIER_BITS * 2 / 8];
+  char z[GNUNET_SECRETSHARING_ELGAMAL_BITS / 8];
+  char w[GNUNET_CRYPTO_PAILLIER_BITS / 8];
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/contrib/service/secretsharing/test_secretsharing.conf b/src/contrib/service/secretsharing/test_secretsharing.conf
new file mode 100644
index 000000000..9cbe3ebb1
--- /dev/null
+++ b/src/contrib/service/secretsharing/test_secretsharing.conf
@@ -0,0 +1,40 @@
+[secretsharing]
+START_ON_DEMAND = YES
+#PREFIX = valgrind --leak-check=full
+OPTIONS = -LINFO
+
+[consensus]
+START_ON_DEMAND = YES
+
+[transport]
+OPTIONS = -LERROR
+PLUGINS = unix
+
+[set]
+OPTIONS = -L INFO
+START_ON_DEMAND = YES
+#PREFIX = valgrind --leak-check=full
+
+[testbed]
+OVERLAY_TOPOLOGY = CLIQUE
+
+[hostlist]
+SERVERS =
+
+[nat]
+# Use addresses from the local network interfaces (including loopback, but also others)
+USE_LOCALADDR = YES
+
+# Disable IPv6 support
+DISABLEV6 = NO
+
+# Do we use addresses from localhost address ranges? (::1, 127.0.0.0/8)
+RETURN_LOCAL_ADDRESSES = YES
+
+[nse]
+START_ON_DEMAND = NO
+
+
+[rps]
+START_ON_DEMAND = NO
+IMMEDIATE_START = NO
diff --git a/src/contrib/service/secretsharing/test_secretsharing_api.c b/src/contrib/service/secretsharing/test_secretsharing_api.c
new file mode 100644
index 000000000..470bfddf4
--- /dev/null
+++ b/src/contrib/service/secretsharing/test_secretsharing_api.c
@@ -0,0 +1,103 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file secretsharing/test_secretsharing_api.c
+ * @brief testcase for the secretsharing api
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_secretsharing_service.h"
+
+
+static int success;
+
+static struct GNUNET_SECRETSHARING_Session *keygen;
+
+
+static void
+secret_ready_cb (void *cls,
+                 struct GNUNET_SECRETSHARING_Share *my_share,
+                 struct GNUNET_SECRETSHARING_PublicKey *public_key,
+                 unsigned int num_ready_peers,
+                 const struct GNUNET_PeerIdentity *ready_peers)
+{
+  keygen = NULL;
+  if (num_ready_peers == 1)
+    success = 1;
+  // FIXME: check that our share is valid, which we can do as there's only
+  // one peer.
+  GNUNET_SECRETSHARING_share_destroy (my_share);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "secret ready, shutting down\n");
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+handle_shutdown (void *cls)
+{
+  if (NULL != keygen)
+  {
+    GNUNET_SECRETSHARING_session_destroy (keygen);
+    keygen = NULL;
+  }
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  struct GNUNET_HashCode session_id;
+  struct GNUNET_TIME_Absolute start;
+  struct GNUNET_TIME_Absolute deadline;
+
+  GNUNET_SCHEDULER_add_shutdown (&handle_shutdown, NULL);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "testing secretsharing api\n");
+
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, &session_id);
+
+  start = GNUNET_TIME_absolute_get ();
+  deadline = GNUNET_TIME_absolute_add (start, GNUNET_TIME_UNIT_SECONDS);
+
+  keygen = GNUNET_SECRETSHARING_create_session (cfg,
+                                                0, NULL, /* only the local peer */
+                                                &session_id,
+                                                start, deadline,
+                                                1,
+                                                secret_ready_cb, NULL);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  int ret;
+
+  ret = GNUNET_TESTING_peer_run ("test_secretsharing_api",
+                                 "test_secretsharing.conf",
+                                 &run, NULL);
+  if (0 != ret)
+    return ret;
+  return (GNUNET_YES == success) ? 0 : 1;
+}
diff --git a/src/contrib/service/set/.gitignore b/src/contrib/service/set/.gitignore
new file mode 100644
index 000000000..f1c958639
--- /dev/null
+++ b/src/contrib/service/set/.gitignore
@@ -0,0 +1,7 @@
+gnunet-set-profiler
+gnunet-service-set
+gnunet-set-ibf-profiler
+test_set_api
+test_set_intersection_result_full
+test_set_union_copy
+test_set_union_result_symmetric
diff --git a/src/contrib/service/set/Makefile.am b/src/contrib/service/set/Makefile.am
new file mode 100644
index 000000000..88d4d39ad
--- /dev/null
+++ b/src/contrib/service/set/Makefile.am
@@ -0,0 +1,122 @@
+# This Makefile.am is in the public domain
+AM_CPPFLAGS = -I$(top_srcdir)/src/include
+
+pkgcfgdir= $(pkgdatadir)/config.d/
+
+libexecdir= $(pkglibdir)/libexec/
+
+plugindir = $(libdir)/gnunet
+
+pkgcfg_DATA = \
+  set.conf
+
+if USE_COVERAGE
+  AM_CFLAGS = -fprofile-arcs -ftest-coverage
+endif
+
+noinst_PROGRAMS = \
+ gnunet-set-ibf-profiler \
+ gnunet-set-profiler
+
+libexec_PROGRAMS = \
+ gnunet-service-set
+
+lib_LTLIBRARIES = \
+  libgnunetset.la
+
+gnunet_set_profiler_SOURCES = \
+ gnunet-set-profiler.c
+gnunet_set_profiler_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
+  libgnunetset.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  $(GN_LIBINTL)
+
+
+gnunet_set_ibf_profiler_SOURCES = \
+ gnunet-set-ibf-profiler.c \
+ ibf.c
+gnunet_set_ibf_profiler_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(GN_LIBINTL)
+
+gnunet_service_set_SOURCES = \
+ gnunet-service-set.c gnunet-service-set.h \
+ gnunet-service-set_union.c gnunet-service-set_union.h \
+ gnunet-service-set_intersection.c gnunet-service-set_intersection.h \
+ ibf.c ibf.h \
+ gnunet-service-set_union_strata_estimator.c gnunet-service-set_union_strata_estimator.h \
+ gnunet-service-set_protocol.h
+gnunet_service_set_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/service/core/libgnunetcore.la \
+  $(top_builddir)/src/service/cadet/libgnunetcadet.la \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  libgnunetset.la \
+  $(GN_LIBINTL)
+
+libgnunetset_la_SOURCES = \
+  set_api.c set.h
+libgnunetset_la_LIBADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunetset_la_LDFLAGS = \
+  $(GN_LIB_LDFLAGS)
+
+check_PROGRAMS = \
+ # test_set_api \
+ # test_set_union_result_symmetric \
+ # test_set_intersection_result_full \
+ test_set_union_copy
+
+if ENABLE_TEST_RUN
+AM_TESTS_ENVIRONMENT=export GNUNET_PREFIX=$${GNUNET_PREFIX:-@libdir@};export PATH=$${GNUNET_PREFIX:-@prefix@}/bin:$$PATH;unset XDG_DATA_HOME;unset XDG_CONFIG_HOME;
+TESTS = $(check_PROGRAMS)
+endif
+
+test_set_api_SOURCES = \
+ test_set_api.c
+test_set_api_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetset.la
+
+test_set_union_result_symmetric_SOURCES = \
+ test_set_union_result_symmetric.c
+test_set_union_result_symmetric_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetset.la
+
+test_set_intersection_result_full_SOURCES = \
+ test_set_intersection_result_full.c
+test_set_intersection_result_full_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetset.la
+
+test_set_union_copy_SOURCES = \
+ test_set_union_copy.c
+test_set_union_copy_LDADD = \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(top_builddir)/src/service/testing/libgnunettesting.la \
+  libgnunetset.la
+
+plugin_LTLIBRARIES = \
+  libgnunet_plugin_block_set_test.la
+
+libgnunet_plugin_block_set_test_la_SOURCES = \
+  plugin_block_set_test.c
+libgnunet_plugin_block_set_test_la_LIBADD = \
+  $(top_builddir)/src/lib/block/libgnunetblock.la \
+  $(top_builddir)/src/lib/block/libgnunetblockgroup.la \
+  $(top_builddir)/src/lib/util/libgnunetutil.la \
+  $(LTLIBINTL)
+libgnunet_plugin_block_set_test_la_LDFLAGS = \
+ $(GN_PLUGIN_LDFLAGS)
+
+
+EXTRA_DIST = \
+  test_set.conf
diff --git a/src/contrib/service/set/gnunet-service-set.c b/src/contrib/service/set/gnunet-service-set.c
new file mode 100644
index 000000000..7c522ec34
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set.c
@@ -0,0 +1,1983 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set.c
+ * @brief two-peer set operations
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet-service-set.h"
+#include "gnunet-service-set_union.h"
+#include "gnunet-service-set_intersection.h"
+#include "gnunet-service-set_protocol.h"
+#include "gnunet_statistics_service.h"
+
+/**
+ * How long do we hold on to an incoming channel if there is
+ * no local listener before giving up?
+ */
+#define INCOMING_CHANNEL_TIMEOUT GNUNET_TIME_UNIT_MINUTES
+
+
+/**
+ * Lazy copy requests made by a client.
+ */
+struct LazyCopyRequest
+{
+  /**
+   * Kept in a DLL.
+   */
+  struct LazyCopyRequest *prev;
+
+  /**
+   * Kept in a DLL.
+   */
+  struct LazyCopyRequest *next;
+
+  /**
+   * Which set are we supposed to copy?
+   */
+  struct Set *source_set;
+
+  /**
+   * Cookie identifying the request.
+   */
+  uint32_t cookie;
+};
+
+
+/**
+ * A listener is inhabited by a client, and waits for evaluation
+ * requests from remote peers.
+ */
+struct Listener
+{
+  /**
+   * Listeners are held in a doubly linked list.
+   */
+  struct Listener *next;
+
+  /**
+   * Listeners are held in a doubly linked list.
+   */
+  struct Listener *prev;
+
+  /**
+   * Head of DLL of operations this listener is responsible for.
+   * Once the client has accepted/declined the operation, the
+   * operation is moved to the respective set's operation DLLS.
+   */
+  struct Operation *op_head;
+
+  /**
+   * Tail of DLL of operations this listener is responsible for.
+   * Once the client has accepted/declined the operation, the
+   * operation is moved to the respective set's operation DLLS.
+   */
+  struct Operation *op_tail;
+
+  /**
+   * Client that owns the listener.
+   * Only one client may own a listener.
+   */
+  struct ClientState *cs;
+
+  /**
+   * The port we are listening on with CADET.
+   */
+  struct GNUNET_CADET_Port *open_port;
+
+  /**
+   * Application ID for the operation, used to distinguish
+   * multiple operations of the same type with the same peer.
+   */
+  struct GNUNET_HashCode app_id;
+
+  /**
+   * The type of the operation.
+   */
+  enum GNUNET_SET_OperationType operation;
+};
+
+
+/**
+ * Handle to the cadet service, used to listen for and connect to
+ * remote peers.
+ */
+static struct GNUNET_CADET_Handle *cadet;
+
+/**
+ * DLL of lazy copy requests by this client.
+ */
+static struct LazyCopyRequest *lazy_copy_head;
+
+/**
+ * DLL of lazy copy requests by this client.
+ */
+static struct LazyCopyRequest *lazy_copy_tail;
+
+/**
+ * Generator for unique cookie we set per lazy copy request.
+ */
+static uint32_t lazy_copy_cookie;
+
+/**
+ * Statistics handle.
+ */
+struct GNUNET_STATISTICS_Handle *_GSS_statistics;
+
+/**
+ * Listeners are held in a doubly linked list.
+ */
+static struct Listener *listener_head;
+
+/**
+ * Listeners are held in a doubly linked list.
+ */
+static struct Listener *listener_tail;
+
+/**
+ * Number of active clients.
+ */
+static unsigned int num_clients;
+
+/**
+ * Are we in shutdown? if #GNUNET_YES and the number of clients
+ * drops to zero, disconnect from CADET.
+ */
+static int in_shutdown;
+
+/**
+ * Counter for allocating unique IDs for clients, used to identify
+ * incoming operation requests from remote peers, that the client can
+ * choose to accept or refuse.  0 must not be used (reserved for
+ * uninitialized).
+ */
+static uint32_t suggest_id;
+
+
+/**
+ * Get the incoming socket associated with the given id.
+ *
+ * @param id id to look for
+ * @return the incoming socket associated with the id,
+ *         or NULL if there is none
+ */
+static struct Operation *
+get_incoming (uint32_t id)
+{
+  for (struct Listener *listener = listener_head; NULL != listener;
+       listener = listener->next)
+  {
+    for (struct Operation *op = listener->op_head; NULL != op; op = op->next)
+      if (op->suggest_id == id)
+        return op;
+  }
+  return NULL;
+}
+
+
+/**
+ * Destroy an incoming request from a remote peer
+ *
+ * @param op remote request to destroy
+ */
+static void
+incoming_destroy (struct Operation *op)
+{
+  struct Listener *listener;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Destroying incoming operation %p\n",
+              op);
+  if (NULL != (listener = op->listener))
+  {
+    GNUNET_CONTAINER_DLL_remove (listener->op_head, listener->op_tail, op);
+    op->listener = NULL;
+  }
+  if (NULL != op->timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (op->timeout_task);
+    op->timeout_task = NULL;
+  }
+  _GSS_operation_destroy2 (op);
+}
+
+
+/**
+ * Context for the #garbage_collect_cb().
+ */
+struct GarbageContext
+{
+  /**
+   * Map for which we are garbage collecting removed elements.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *map;
+
+  /**
+   * Lowest generation for which an operation is still pending.
+   */
+  unsigned int min_op_generation;
+
+  /**
+   * Largest generation for which an operation is still pending.
+   */
+  unsigned int max_op_generation;
+};
+
+
+/**
+ * Function invoked to check if an element can be removed from
+ * the set's history because it is no longer needed.
+ *
+ * @param cls the `struct GarbageContext *`
+ * @param key key of the element in the map
+ * @param value the `struct ElementEntry *`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+garbage_collect_cb (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  // struct GarbageContext *gc = cls;
+  // struct ElementEntry *ee = value;
+
+  // if (GNUNET_YES != ee->removed)
+  //  return GNUNET_OK;
+  // if ( (gc->max_op_generation < ee->generation_added) ||
+  //     (ee->generation_removed > gc->min_op_generation) )
+  // {
+  //  GNUNET_assert (GNUNET_YES ==
+  //                 GNUNET_CONTAINER_multihashmap_remove (gc->map,
+  //                                                       key,
+  //                                                       ee));
+  //  GNUNET_free (ee);
+  // }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Collect and destroy elements that are not needed anymore, because
+ * their lifetime (as determined by their generation) does not overlap
+ * with any active set operation.
+ *
+ * @param set set to garbage collect
+ */
+static void
+collect_generation_garbage (struct Set *set)
+{
+  struct GarbageContext gc;
+
+  gc.min_op_generation = UINT_MAX;
+  gc.max_op_generation = 0;
+  for (struct Operation *op = set->ops_head; NULL != op; op = op->next)
+  {
+    gc.min_op_generation =
+      GNUNET_MIN (gc.min_op_generation, op->generation_created);
+    gc.max_op_generation =
+      GNUNET_MAX (gc.max_op_generation, op->generation_created);
+  }
+  gc.map = set->content->elements;
+  GNUNET_CONTAINER_multihashmap_iterate (set->content->elements,
+                                         &garbage_collect_cb,
+                                         &gc);
+}
+
+
+/**
+ * Is @a generation in the range of exclusions?
+ *
+ * @param generation generation to query
+ * @param excluded array of generations where the element is excluded
+ * @param excluded_size length of the @a excluded array
+ * @return #GNUNET_YES if @a generation is in any of the ranges
+ */
+static int
+is_excluded_generation (unsigned int generation,
+                        struct GenerationRange *excluded,
+                        unsigned int excluded_size)
+{
+  for (unsigned int i = 0; i < excluded_size; i++)
+    if ((generation >= excluded[i].start) && (generation < excluded[i].end))
+      return GNUNET_YES;
+  return GNUNET_NO;
+}
+
+
+/**
+ * Is element @a ee part of the set during @a query_generation?
+ *
+ * @param ee element to test
+ * @param query_generation generation to query
+ * @param excluded array of generations where the element is excluded
+ * @param excluded_size length of the @a excluded array
+ * @return #GNUNET_YES if the element is in the set, #GNUNET_NO if not
+ */
+static int
+is_element_of_generation (struct ElementEntry *ee,
+                          unsigned int query_generation,
+                          struct GenerationRange *excluded,
+                          unsigned int excluded_size)
+{
+  struct MutationEvent *mut;
+  int is_present;
+
+  GNUNET_assert (NULL != ee->mutations);
+  if (GNUNET_YES ==
+      is_excluded_generation (query_generation, excluded, excluded_size))
+  {
+    GNUNET_break (0);
+    return GNUNET_NO;
+  }
+
+  is_present = GNUNET_NO;
+
+  /* Could be made faster with binary search, but lists
+     are small, so why bother. */
+  for (unsigned int i = 0; i < ee->mutations_size; i++)
+  {
+    mut = &ee->mutations[i];
+
+    if (mut->generation > query_generation)
+    {
+      /* The mutation doesn't apply to our generation
+         anymore.  We can'b break here, since mutations aren't
+         sorted by generation. */
+      continue;
+    }
+
+    if (GNUNET_YES ==
+        is_excluded_generation (mut->generation, excluded, excluded_size))
+    {
+      /* The generation is excluded (because it belongs to another
+         fork via a lazy copy) and thus mutations aren't considered
+         for membership testing. */
+      continue;
+    }
+
+    /* This would be an inconsistency in how we manage mutations. */
+    if ((GNUNET_YES == is_present) && (GNUNET_YES == mut->added))
+      GNUNET_assert (0);
+    /* Likewise. */
+    if ((GNUNET_NO == is_present) && (GNUNET_NO == mut->added))
+      GNUNET_assert (0);
+
+    is_present = mut->added;
+  }
+
+  return is_present;
+}
+
+
+/**
+ * Is element @a ee part of the set used by @a op?
+ *
+ * @param ee element to test
+ * @param op operation the defines the set and its generation
+ * @return #GNUNET_YES if the element is in the set, #GNUNET_NO if not
+ */
+int
+_GSS_is_element_of_operation (struct ElementEntry *ee, struct Operation *op)
+{
+  return is_element_of_generation (ee,
+                                   op->generation_created,
+                                   op->set->excluded_generations,
+                                   op->set->excluded_generations_size);
+}
+
+
+/**
+ * Destroy the given operation.  Used for any operation where both
+ * peers were known and that thus actually had a vt and channel.  Must
+ * not be used for operations where 'listener' is still set and we do
+ * not know the other peer.
+ *
+ * Call the implementation-specific cancel function of the operation.
+ * Disconnects from the remote peer.  Does not disconnect the client,
+ * as there may be multiple operations per set.
+ *
+ * @param op operation to destroy
+ * @param gc #GNUNET_YES to perform garbage collection on the set
+ */
+void
+_GSS_operation_destroy (struct Operation *op, int gc)
+{
+  struct Set *set = op->set;
+  struct GNUNET_CADET_Channel *channel;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Destroying operation %p\n", op);
+  GNUNET_assert (NULL == op->listener);
+  if (NULL != op->state)
+  {
+    set->vt->cancel (op);
+    op->state = NULL;
+  }
+  if (NULL != set)
+  {
+    GNUNET_CONTAINER_DLL_remove (set->ops_head, set->ops_tail, op);
+    op->set = NULL;
+  }
+  if (NULL != op->context_msg)
+  {
+    GNUNET_free (op->context_msg);
+    op->context_msg = NULL;
+  }
+  if (NULL != (channel = op->channel))
+  {
+    /* This will free op; called conditionally as this helper function
+       is also called from within the channel disconnect handler. */
+    op->channel = NULL;
+    GNUNET_CADET_channel_destroy (channel);
+  }
+  if ((NULL != set) && (GNUNET_YES == gc))
+    collect_generation_garbage (set);
+  /* We rely on the channel end handler to free 'op'. When 'op->channel' was NULL,
+   * there was a channel end handler that will free 'op' on the call stack. */
+}
+
+
+/**
+ * Callback called when a client connects to the service.
+ *
+ * @param cls closure for the service
+ * @param c the new client that connected to the service
+ * @param mq the message queue used to send messages to the client
+ * @return @a `struct ClientState`
+ */
+static void *
+client_connect_cb (void *cls,
+                   struct GNUNET_SERVICE_Client *c,
+                   struct GNUNET_MQ_Handle *mq)
+{
+  struct ClientState *cs;
+
+  num_clients++;
+  cs = GNUNET_new (struct ClientState);
+  cs->client = c;
+  cs->mq = mq;
+  return cs;
+}
+
+
+/**
+ * Iterator over hash map entries to free element entries.
+ *
+ * @param cls closure
+ * @param key current key code
+ * @param value a `struct ElementEntry *` to be free'd
+ * @return #GNUNET_YES (continue to iterate)
+ */
+static int
+destroy_elements_iterator (void *cls,
+                           const struct GNUNET_HashCode *key,
+                           void *value)
+{
+  struct ElementEntry *ee = value;
+
+  GNUNET_free (ee->mutations);
+  GNUNET_free (ee);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Clean up after a client has disconnected
+ *
+ * @param cls closure, unused
+ * @param client the client to clean up after
+ * @param internal_cls the `struct ClientState`
+ */
+static void
+client_disconnect_cb (void *cls,
+                      struct GNUNET_SERVICE_Client *client,
+                      void *internal_cls)
+{
+  struct ClientState *cs = internal_cls;
+  struct Operation *op;
+  struct Listener *listener;
+  struct Set *set;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Client disconnected, cleaning up\n");
+  if (NULL != (set = cs->set))
+  {
+    struct SetContent *content = set->content;
+    struct PendingMutation *pm;
+    struct PendingMutation *pm_current;
+    struct LazyCopyRequest *lcr;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Destroying client's set\n");
+    /* Destroy pending set operations */
+    while (NULL != set->ops_head)
+      _GSS_operation_destroy (set->ops_head, GNUNET_NO);
+
+    /* Destroy operation-specific state */
+    GNUNET_assert (NULL != set->state);
+    set->vt->destroy_set (set->state);
+    set->state = NULL;
+
+    /* Clean up ongoing iterations */
+    if (NULL != set->iter)
+    {
+      GNUNET_CONTAINER_multihashmap_iterator_destroy (set->iter);
+      set->iter = NULL;
+      set->iteration_id++;
+    }
+
+    /* discard any pending mutations that reference this set */
+    pm = content->pending_mutations_head;
+    while (NULL != pm)
+    {
+      pm_current = pm;
+      pm = pm->next;
+      if (pm_current->set == set)
+      {
+        GNUNET_CONTAINER_DLL_remove (content->pending_mutations_head,
+                                     content->pending_mutations_tail,
+                                     pm_current);
+        GNUNET_free (pm_current);
+      }
+    }
+
+    /* free set content (or at least decrement RC) */
+    set->content = NULL;
+    GNUNET_assert (0 != content->refcount);
+    content->refcount--;
+    if (0 == content->refcount)
+    {
+      GNUNET_assert (NULL != content->elements);
+      GNUNET_CONTAINER_multihashmap_iterate (content->elements,
+                                             &destroy_elements_iterator,
+                                             NULL);
+      GNUNET_CONTAINER_multihashmap_destroy (content->elements);
+      content->elements = NULL;
+      GNUNET_free (content);
+    }
+    GNUNET_free (set->excluded_generations);
+    set->excluded_generations = NULL;
+
+    /* remove set from pending copy requests */
+    lcr = lazy_copy_head;
+    while (NULL != lcr)
+    {
+      struct LazyCopyRequest *lcr_current = lcr;
+
+      lcr = lcr->next;
+      if (lcr_current->source_set == set)
+      {
+        GNUNET_CONTAINER_DLL_remove (lazy_copy_head,
+                                     lazy_copy_tail,
+                                     lcr_current);
+        GNUNET_free (lcr_current);
+      }
+    }
+    GNUNET_free (set);
+  }
+
+  if (NULL != (listener = cs->listener))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Destroying client's listener\n");
+    GNUNET_CADET_close_port (listener->open_port);
+    listener->open_port = NULL;
+    while (NULL != (op = listener->op_head))
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                  "Destroying incoming operation `%u' from peer `%s'\n",
+                  (unsigned int) op->client_request_id,
+                  GNUNET_i2s (&op->peer));
+      incoming_destroy (op);
+    }
+    GNUNET_CONTAINER_DLL_remove (listener_head, listener_tail, listener);
+    GNUNET_free (listener);
+  }
+  GNUNET_free (cs);
+  num_clients--;
+  if ((GNUNET_YES == in_shutdown) && (0 == num_clients))
+  {
+    if (NULL != cadet)
+    {
+      GNUNET_CADET_disconnect (cadet);
+      cadet = NULL;
+    }
+  }
+}
+
+
+/**
+ * Check a request for a set operation from another peer.
+ *
+ * @param cls the operation state
+ * @param msg the received message
+ * @return #GNUNET_OK if the channel should be kept alive,
+ *         #GNUNET_SYSERR to destroy the channel
+ */
+static int
+check_incoming_msg (void *cls, const struct OperationRequestMessage *msg)
+{
+  struct Operation *op = cls;
+  struct Listener *listener = op->listener;
+  const struct GNUNET_MessageHeader *nested_context;
+
+  /* double operation request */
+  if (0 != op->suggest_id)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  /* This should be equivalent to the previous condition, but can't hurt to check twice */
+  if (NULL == op->listener)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  if (listener->operation !=
+      (enum GNUNET_SET_OperationType) ntohl (msg->operation))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  nested_context = GNUNET_MQ_extract_nested_mh (msg);
+  if ((NULL != nested_context) &&
+      (ntohs (nested_context->size) > GNUNET_SET_CONTEXT_MESSAGE_MAX_SIZE))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle a request for a set operation from another peer.  Checks if we
+ * have a listener waiting for such a request (and in that case initiates
+ * asking the listener about accepting the connection). If no listener
+ * is waiting, we queue the operation request in hope that a listener
+ * shows up soon (before timeout).
+ *
+ * This msg is expected as the first and only msg handled through the
+ * non-operation bound virtual table, acceptance of this operation replaces
+ * our virtual table and subsequent msgs would be routed differently (as
+ * we then know what type of operation this is).
+ *
+ * @param cls the operation state
+ * @param msg the received message
+ * @return #GNUNET_OK if the channel should be kept alive,
+ *         #GNUNET_SYSERR to destroy the channel
+ */
+static void
+handle_incoming_msg (void *cls, const struct OperationRequestMessage *msg)
+{
+  struct Operation *op = cls;
+  struct Listener *listener = op->listener;
+  const struct GNUNET_MessageHeader *nested_context;
+  struct GNUNET_MQ_Envelope *env;
+  struct GNUNET_SET_RequestMessage *cmsg;
+
+  nested_context = GNUNET_MQ_extract_nested_mh (msg);
+  /* Make a copy of the nested_context (application-specific context
+     information that is opaque to set) so we can pass it to the
+     listener later on */
+  if (NULL != nested_context)
+    op->context_msg = GNUNET_copy_message (nested_context);
+  op->remote_element_count = ntohl (msg->element_count);
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "Received P2P operation request (op %u, port %s) for active listener\n",
+    (uint32_t) ntohl (msg->operation),
+    GNUNET_h2s (&op->listener->app_id));
+  GNUNET_assert (0 == op->suggest_id);
+  if (0 == suggest_id)
+    suggest_id++;
+  op->suggest_id = suggest_id++;
+  GNUNET_assert (NULL != op->timeout_task);
+  GNUNET_SCHEDULER_cancel (op->timeout_task);
+  op->timeout_task = NULL;
+  env = GNUNET_MQ_msg_nested_mh (cmsg,
+                                 GNUNET_MESSAGE_TYPE_SET_REQUEST,
+                                 op->context_msg);
+  GNUNET_log (
+    GNUNET_ERROR_TYPE_DEBUG,
+    "Suggesting incoming request with accept id %u to listener %p of client %p\n",
+    op->suggest_id,
+    listener,
+    listener->cs);
+  cmsg->accept_id = htonl (op->suggest_id);
+  cmsg->peer_id = op->peer;
+  GNUNET_MQ_send (listener->cs->mq, env);
+  /* NOTE: GNUNET_CADET_receive_done() will be called in
+   #handle_client_accept() */
+}
+
+
+/**
+ * Add an element to @a set as specified by @a msg
+ *
+ * @param set set to manipulate
+ * @param msg message specifying the change
+ */
+static void
+execute_add (struct Set *set, const struct GNUNET_SET_ElementMessage *msg)
+{
+  struct GNUNET_SET_Element el;
+  struct ElementEntry *ee;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert (GNUNET_MESSAGE_TYPE_SET_ADD == ntohs (msg->header.type));
+  el.size = ntohs (msg->header.size) - sizeof(*msg);
+  el.data = &msg[1];
+  el.element_type = ntohs (msg->element_type);
+  GNUNET_SET_element_hash (&el, &hash);
+  ee = GNUNET_CONTAINER_multihashmap_get (set->content->elements, &hash);
+  if (NULL == ee)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client inserts element %s of size %u\n",
+                GNUNET_h2s (&hash),
+                el.size);
+    ee = GNUNET_malloc (el.size + sizeof(*ee));
+    ee->element.size = el.size;
+    GNUNET_memcpy (&ee[1], el.data, el.size);
+    ee->element.data = &ee[1];
+    ee->element.element_type = el.element_type;
+    ee->remote = GNUNET_NO;
+    ee->mutations = NULL;
+    ee->mutations_size = 0;
+    ee->element_hash = hash;
+    GNUNET_break (GNUNET_YES ==
+                  GNUNET_CONTAINER_multihashmap_put (
+                    set->content->elements,
+                    &ee->element_hash,
+                    ee,
+                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  }
+  else if (GNUNET_YES ==
+           is_element_of_generation (ee,
+                                     set->current_generation,
+                                     set->excluded_generations,
+                                     set->excluded_generations_size))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client inserted element %s of size %u twice (ignored)\n",
+                GNUNET_h2s (&hash),
+                el.size);
+
+    /* same element inserted twice */
+    return;
+  }
+
+  {
+    struct MutationEvent mut = { .generation = set->current_generation,
+                                 .added = GNUNET_YES };
+    GNUNET_array_append (ee->mutations, ee->mutations_size, mut);
+  }
+  set->vt->add (set->state, ee);
+}
+
+
+/**
+ * Remove an element from @a set as specified by @a msg
+ *
+ * @param set set to manipulate
+ * @param msg message specifying the change
+ */
+static void
+execute_remove (struct Set *set, const struct GNUNET_SET_ElementMessage *msg)
+{
+  struct GNUNET_SET_Element el;
+  struct ElementEntry *ee;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert (GNUNET_MESSAGE_TYPE_SET_REMOVE == ntohs (msg->header.type));
+  el.size = ntohs (msg->header.size) - sizeof(*msg);
+  el.data = &msg[1];
+  el.element_type = ntohs (msg->element_type);
+  GNUNET_SET_element_hash (&el, &hash);
+  ee = GNUNET_CONTAINER_multihashmap_get (set->content->elements, &hash);
+  if (NULL == ee)
+  {
+    /* Client tried to remove non-existing element. */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client removes non-existing element of size %u\n",
+                el.size);
+    return;
+  }
+  if (GNUNET_NO == is_element_of_generation (ee,
+                                             set->current_generation,
+                                             set->excluded_generations,
+                                             set->excluded_generations_size))
+  {
+    /* Client tried to remove element twice */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client removed element of size %u twice (ignored)\n",
+                el.size);
+    return;
+  }
+  else
+  {
+    struct MutationEvent mut = { .generation = set->current_generation,
+                                 .added = GNUNET_NO };
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client removes element of size %u\n",
+                el.size);
+
+    GNUNET_array_append (ee->mutations, ee->mutations_size, mut);
+  }
+  set->vt->remove (set->state, ee);
+}
+
+
+/**
+ * Perform a mutation on a set as specified by the @a msg
+ *
+ * @param set the set to mutate
+ * @param msg specification of what to change
+ */
+static void
+execute_mutation (struct Set *set, const struct GNUNET_SET_ElementMessage *msg)
+{
+  switch (ntohs (msg->header.type))
+  {
+  case GNUNET_MESSAGE_TYPE_SET_ADD:
+    execute_add (set, msg);
+    break;
+
+  case GNUNET_MESSAGE_TYPE_SET_REMOVE:
+    execute_remove (set, msg);
+    break;
+
+  default:
+    GNUNET_break (0);
+  }
+}
+
+
+/**
+ * Execute mutations that were delayed on a set because of
+ * pending operations.
+ *
+ * @param set the set to execute mutations on
+ */
+static void
+execute_delayed_mutations (struct Set *set)
+{
+  struct PendingMutation *pm;
+
+  if (0 != set->content->iterator_count)
+    return; /* still cannot do this */
+  while (NULL != (pm = set->content->pending_mutations_head))
+  {
+    GNUNET_CONTAINER_DLL_remove (set->content->pending_mutations_head,
+                                 set->content->pending_mutations_tail,
+                                 pm);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Executing pending mutation on %p.\n",
+                pm->set);
+    execute_mutation (pm->set, pm->msg);
+    GNUNET_free (pm->msg);
+    GNUNET_free (pm);
+  }
+}
+
+
+/**
+ * Send the next element of a set to the set's client.  The next element is given by
+ * the set's current hashmap iterator.  The set's iterator will be set to NULL if there
+ * are no more elements in the set.  The caller must ensure that the set's iterator is
+ * valid.
+ *
+ * The client will acknowledge each received element with a
+ * #GNUNET_MESSAGE_TYPE_SET_ITER_ACK message.  Our
+ * #handle_client_iter_ack() will then trigger the next transmission.
+ * Note that the #GNUNET_MESSAGE_TYPE_SET_ITER_DONE is not acknowledged.
+ *
+ * @param set set that should send its next element to its client
+ */
+static void
+send_client_element (struct Set *set)
+{
+  int ret;
+  struct ElementEntry *ee;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_IterResponseMessage *msg;
+
+  GNUNET_assert (NULL != set->iter);
+  do
+  {
+    ret = GNUNET_CONTAINER_multihashmap_iterator_next (set->iter,
+                                                       NULL,
+                                                       (const void **) &ee);
+    if (GNUNET_NO == ret)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Iteration on %p done.\n", set);
+      ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_ITER_DONE);
+      GNUNET_CONTAINER_multihashmap_iterator_destroy (set->iter);
+      set->iter = NULL;
+      set->iteration_id++;
+      GNUNET_assert (set->content->iterator_count > 0);
+      set->content->iterator_count--;
+      execute_delayed_mutations (set);
+      GNUNET_MQ_send (set->cs->mq, ev);
+      return;
+    }
+    GNUNET_assert (NULL != ee);
+  }
+  while (GNUNET_NO ==
+         is_element_of_generation (ee,
+                                   set->iter_generation,
+                                   set->excluded_generations,
+                                   set->excluded_generations_size));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending iteration element on %p.\n",
+              set);
+  ev = GNUNET_MQ_msg_extra (msg,
+                            ee->element.size,
+                            GNUNET_MESSAGE_TYPE_SET_ITER_ELEMENT);
+  GNUNET_memcpy (&msg[1], ee->element.data, ee->element.size);
+  msg->element_type = htons (ee->element.element_type);
+  msg->iteration_id = htons (set->iteration_id);
+  GNUNET_MQ_send (set->cs->mq, ev);
+}
+
+
+/**
+ * Called when a client wants to iterate the elements of a set.
+ * Checks if we have a set associated with the client and if we
+ * can right now start an iteration. If all checks out, starts
+ * sending the elements of the set to the client.
+ *
+ * @param cls client that sent the message
+ * @param m message sent by the client
+ */
+static void
+handle_client_iterate (void *cls, const struct GNUNET_MessageHeader *m)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+
+  if (NULL == (set = cs->set))
+  {
+    /* attempt to iterate over a non existing set */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  if (NULL != set->iter)
+  {
+    /* Only one concurrent iterate-action allowed per set */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Iterating set %p in gen %u with %u content elements\n",
+              (void *) set,
+              set->current_generation,
+              GNUNET_CONTAINER_multihashmap_size (set->content->elements));
+  GNUNET_SERVICE_client_continue (cs->client);
+  set->content->iterator_count++;
+  set->iter =
+    GNUNET_CONTAINER_multihashmap_iterator_create (set->content->elements);
+  set->iter_generation = set->current_generation;
+  send_client_element (set);
+}
+
+
+/**
+ * Called when a client wants to create a new set.  This is typically
+ * the first request from a client, and includes the type of set
+ * operation to be performed.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static void
+handle_client_create_set (void *cls, const struct GNUNET_SET_CreateMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client created new set (operation %u)\n",
+              (uint32_t) ntohl (msg->operation));
+  if (NULL != cs->set)
+  {
+    /* There can only be one set per client */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  set = GNUNET_new (struct Set);
+  switch (ntohl (msg->operation))
+  {
+  case GNUNET_SET_OPERATION_INTERSECTION:
+    set->vt = _GSS_intersection_vt ();
+    break;
+
+  case GNUNET_SET_OPERATION_UNION:
+    set->vt = _GSS_union_vt ();
+    break;
+
+  default:
+    GNUNET_free (set);
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  set->operation = (enum GNUNET_SET_OperationType) ntohl (msg->operation);
+  set->state = set->vt->create ();
+  if (NULL == set->state)
+  {
+    /* initialization failed (i.e. out of memory) */
+    GNUNET_free (set);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  set->content = GNUNET_new (struct SetContent);
+  set->content->refcount = 1;
+  set->content->elements = GNUNET_CONTAINER_multihashmap_create (1, GNUNET_YES);
+  set->cs = cs;
+  cs->set = set;
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Timeout happens iff:
+ *  - we suggested an operation to our listener,
+ *    but did not receive a response in time
+ *  - we got the channel from a peer but no #GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST
+ *
+ * @param cls channel context
+ */
+static void
+incoming_timeout_cb (void *cls)
+{
+  struct Operation *op = cls;
+
+  op->timeout_task = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Remote peer's incoming request timed out\n");
+  incoming_destroy (op);
+}
+
+
+/**
+ * Method called whenever another peer has added us to a channel the
+ * other peer initiated.  Only called (once) upon reception of data
+ * from a channel we listen on.
+ *
+ * The channel context represents the operation itself and gets added
+ * to a DLL, from where it gets looked up when our local listener
+ * client responds to a proposed/suggested operation or connects and
+ * associates with this operation.
+ *
+ * @param cls closure
+ * @param channel new handle to the channel
+ * @param source peer that started the channel
+ * @return initial channel context for the channel
+ *         returns NULL on error
+ */
+static void *
+channel_new_cb (void *cls,
+                struct GNUNET_CADET_Channel *channel,
+                const struct GNUNET_PeerIdentity *source)
+{
+  struct Listener *listener = cls;
+  struct Operation *op;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "New incoming channel\n");
+  op = GNUNET_new (struct Operation);
+  op->listener = listener;
+  op->peer = *source;
+  op->channel = channel;
+  op->mq = GNUNET_CADET_get_mq (op->channel);
+  op->salt = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, UINT32_MAX);
+  op->timeout_task = GNUNET_SCHEDULER_add_delayed (INCOMING_CHANNEL_TIMEOUT,
+                                                   &incoming_timeout_cb,
+                                                   op);
+  GNUNET_CONTAINER_DLL_insert (listener->op_head, listener->op_tail, op);
+  return op;
+}
+
+
+/**
+ * Function called whenever a channel is destroyed.  Should clean up
+ * any associated state.  It must NOT call
+ * GNUNET_CADET_channel_destroy() on the channel.
+ *
+ * The peer_disconnect function is part of a a virtual table set initially either
+ * when a peer creates a new channel with us, or once we create
+ * a new channel ourselves (evaluate).
+ *
+ * Once we know the exact type of operation (union/intersection), the vt is
+ * replaced with an operation specific instance (_GSS_[op]_vt).
+ *
+ * @param channel_ctx place where local state associated
+ *                   with the channel is stored
+ * @param channel connection to the other end (henceforth invalid)
+ */
+static void
+channel_end_cb (void *channel_ctx, const struct GNUNET_CADET_Channel *channel)
+{
+  struct Operation *op = channel_ctx;
+
+  op->channel = NULL;
+  _GSS_operation_destroy2 (op);
+}
+
+
+/**
+ * This function probably should not exist
+ * and be replaced by inlining more specific
+ * logic in the various places where it is called.
+ */
+void
+_GSS_operation_destroy2 (struct Operation *op)
+{
+  struct GNUNET_CADET_Channel *channel;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "channel_end_cb called\n");
+  if (NULL != (channel = op->channel))
+  {
+    /* This will free op; called conditionally as this helper function
+       is also called from within the channel disconnect handler. */
+    op->channel = NULL;
+    GNUNET_CADET_channel_destroy (channel);
+  }
+  if (NULL != op->listener)
+  {
+    incoming_destroy (op);
+    return;
+  }
+  if (NULL != op->set)
+    op->set->vt->channel_death (op);
+  else
+    _GSS_operation_destroy (op, GNUNET_YES);
+  GNUNET_free (op);
+}
+
+
+/**
+ * Function called whenever an MQ-channel's transmission window size changes.
+ *
+ * The first callback in an outgoing channel will be with a non-zero value
+ * and will mean the channel is connected to the destination.
+ *
+ * For an incoming channel it will be called immediately after the
+ * #GNUNET_CADET_ConnectEventHandler, also with a non-zero value.
+ *
+ * @param cls Channel closure.
+ * @param channel Connection to the other end (henceforth invalid).
+ * @param window_size New window size. If the is more messages than buffer size
+ *                    this value will be negative..
+ */
+static void
+channel_window_cb (void *cls,
+                   const struct GNUNET_CADET_Channel *channel,
+                   int window_size)
+{
+  /* FIXME: not implemented, we could do flow control here... */
+}
+
+
+/**
+ * Called when a client wants to create a new listener.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static void
+handle_client_listen (void *cls, const struct GNUNET_SET_ListenMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct GNUNET_MQ_MessageHandler cadet_handlers[] =
+  { GNUNET_MQ_hd_var_size (incoming_msg,
+                           GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST,
+                           struct OperationRequestMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_ibf,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_IBF,
+                           struct IBFMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_elements,
+                           GNUNET_MESSAGE_TYPE_SET_P2P_ELEMENTS,
+                           struct GNUNET_SET_ElementMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_offer,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_OFFER,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_inquiry,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_INQUIRY,
+                           struct InquiryMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_demand,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DEMAND,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+    GNUNET_MQ_hd_fixed_size (union_p2p_done,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DONE,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (union_p2p_over,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_OVER,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (union_p2p_full_done,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_DONE,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_hd_fixed_size (union_p2p_request_full,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_REQUEST_FULL,
+                             struct GNUNET_MessageHeader,
+                             NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_strata_estimator,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SE,
+                           struct StrataEstimatorMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_strata_estimator,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SEC,
+                           struct StrataEstimatorMessage,
+                           NULL),
+    GNUNET_MQ_hd_var_size (union_p2p_full_element,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_ELEMENT,
+                           struct GNUNET_SET_ElementMessage,
+                           NULL),
+    GNUNET_MQ_hd_fixed_size (intersection_p2p_element_info,
+                             GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_ELEMENT_INFO,
+                             struct IntersectionElementInfoMessage,
+                             NULL),
+    GNUNET_MQ_hd_var_size (intersection_p2p_bf,
+                           GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_BF,
+                           struct BFMessage,
+                           NULL),
+    GNUNET_MQ_hd_fixed_size (intersection_p2p_done,
+                             GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_DONE,
+                             struct IntersectionDoneMessage,
+                             NULL),
+    GNUNET_MQ_handler_end () };
+  struct Listener *listener;
+
+  if (NULL != cs->listener)
+  {
+    /* max. one active listener per client! */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  listener = GNUNET_new (struct Listener);
+  listener->cs = cs;
+  cs->listener = listener;
+  listener->app_id = msg->app_id;
+  listener->operation = (enum GNUNET_SET_OperationType) ntohl (msg->operation);
+  GNUNET_CONTAINER_DLL_insert (listener_head, listener_tail, listener);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "New listener created (op %u, port %s)\n",
+              listener->operation,
+              GNUNET_h2s (&listener->app_id));
+  listener->open_port = GNUNET_CADET_open_port (cadet,
+                                                &msg->app_id,
+                                                &channel_new_cb,
+                                                listener,
+                                                &channel_window_cb,
+                                                &channel_end_cb,
+                                                cadet_handlers);
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Called when the listening client rejects an operation
+ * request by another peer.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static void
+handle_client_reject (void *cls, const struct GNUNET_SET_RejectMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Operation *op;
+
+  op = get_incoming (ntohl (msg->accept_reject_id));
+  if (NULL == op)
+  {
+    /* no matching incoming operation for this reject;
+       could be that the other peer already disconnected... */
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Client rejected unknown operation %u\n",
+                (unsigned int) ntohl (msg->accept_reject_id));
+    GNUNET_SERVICE_client_continue (cs->client);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Peer request (op %u, app %s) rejected by client\n",
+              op->listener->operation,
+              GNUNET_h2s (&cs->listener->app_id));
+  _GSS_operation_destroy2 (op);
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Called when a client wants to add or remove an element to a set it inhabits.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static int
+check_client_mutation (void *cls, const struct GNUNET_SET_ElementMessage *msg)
+{
+  /* NOTE: Technically, we should probably check with the
+     block library whether the element we are given is well-formed */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Called when a client wants to add or remove an element to a set it inhabits.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static void
+handle_client_mutation (void *cls, const struct GNUNET_SET_ElementMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+
+  if (NULL == (set = cs->set))
+  {
+    /* client without a set requested an operation */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_SERVICE_client_continue (cs->client);
+
+  if (0 != set->content->iterator_count)
+  {
+    struct PendingMutation *pm;
+
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Scheduling mutation on set\n");
+    pm = GNUNET_new (struct PendingMutation);
+    pm->msg =
+      (struct GNUNET_SET_ElementMessage *) GNUNET_copy_message (&msg->header);
+    pm->set = set;
+    GNUNET_CONTAINER_DLL_insert_tail (set->content->pending_mutations_head,
+                                      set->content->pending_mutations_tail,
+                                      pm);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Executing mutation on set\n");
+  execute_mutation (set, msg);
+}
+
+
+/**
+ * Advance the current generation of a set,
+ * adding exclusion ranges if necessary.
+ *
+ * @param set the set where we want to advance the generation
+ */
+static void
+advance_generation (struct Set *set)
+{
+  struct GenerationRange r;
+
+  if (set->current_generation == set->content->latest_generation)
+  {
+    set->content->latest_generation++;
+    set->current_generation++;
+    return;
+  }
+
+  GNUNET_assert (set->current_generation < set->content->latest_generation);
+
+  r.start = set->current_generation + 1;
+  r.end = set->content->latest_generation + 1;
+  set->content->latest_generation = r.end;
+  set->current_generation = r.end;
+  GNUNET_array_append (set->excluded_generations,
+                       set->excluded_generations_size,
+                       r);
+}
+
+
+/**
+ * Called when a client wants to initiate a set operation with another
+ * peer.  Initiates the CADET connection to the listener and sends the
+ * request.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_client_evaluate (void *cls, const struct GNUNET_SET_EvaluateMessage *msg)
+{
+  /* FIXME: suboptimal, even if the context below could be NULL,
+     there are malformed messages this does not check for... */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Called when a client wants to initiate a set operation with another
+ * peer.  Initiates the CADET connection to the listener and sends the
+ * request.
+ *
+ * @param cls client that sent the message
+ * @param msg message sent by the client
+ */
+static void
+handle_client_evaluate (void *cls, const struct GNUNET_SET_EvaluateMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Operation *op = GNUNET_new (struct Operation);
+  const struct GNUNET_MQ_MessageHandler cadet_handlers[] =
+  { GNUNET_MQ_hd_var_size (incoming_msg,
+                           GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST,
+                           struct OperationRequestMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_ibf,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_IBF,
+                           struct IBFMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_elements,
+                           GNUNET_MESSAGE_TYPE_SET_P2P_ELEMENTS,
+                           struct GNUNET_SET_ElementMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_offer,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_OFFER,
+                           struct GNUNET_MessageHeader,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_inquiry,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_INQUIRY,
+                           struct InquiryMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_demand,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DEMAND,
+                           struct GNUNET_MessageHeader,
+                           op),
+    GNUNET_MQ_hd_fixed_size (union_p2p_done,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DONE,
+                             struct GNUNET_MessageHeader,
+                             op),
+    GNUNET_MQ_hd_fixed_size (union_p2p_over,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_OVER,
+                             struct GNUNET_MessageHeader,
+                             op),
+    GNUNET_MQ_hd_fixed_size (union_p2p_full_done,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_DONE,
+                             struct GNUNET_MessageHeader,
+                             op),
+    GNUNET_MQ_hd_fixed_size (union_p2p_request_full,
+                             GNUNET_MESSAGE_TYPE_SET_UNION_P2P_REQUEST_FULL,
+                             struct GNUNET_MessageHeader,
+                             op),
+    GNUNET_MQ_hd_var_size (union_p2p_strata_estimator,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SE,
+                           struct StrataEstimatorMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_strata_estimator,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SEC,
+                           struct StrataEstimatorMessage,
+                           op),
+    GNUNET_MQ_hd_var_size (union_p2p_full_element,
+                           GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_ELEMENT,
+                           struct GNUNET_SET_ElementMessage,
+                           op),
+    GNUNET_MQ_hd_fixed_size (intersection_p2p_element_info,
+                             GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_ELEMENT_INFO,
+                             struct IntersectionElementInfoMessage,
+                             op),
+    GNUNET_MQ_hd_var_size (intersection_p2p_bf,
+                           GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_BF,
+                           struct BFMessage,
+                           op),
+    GNUNET_MQ_hd_fixed_size (intersection_p2p_done,
+                             GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_DONE,
+                             struct IntersectionDoneMessage,
+                             op),
+    GNUNET_MQ_handler_end () };
+  struct Set *set;
+  const struct GNUNET_MessageHeader *context;
+
+  if (NULL == (set = cs->set))
+  {
+    GNUNET_break (0);
+    GNUNET_free (op);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  op->salt = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE, UINT32_MAX);
+  op->peer = msg->target_peer;
+  op->result_mode = ntohl (msg->result_mode);
+  op->client_request_id = ntohl (msg->request_id);
+  op->byzantine = msg->byzantine;
+  op->byzantine_lower_bound = msg->byzantine_lower_bound;
+  op->force_full = msg->force_full;
+  op->force_delta = msg->force_delta;
+  context = GNUNET_MQ_extract_nested_mh (msg);
+
+  /* Advance generation values, so that
+     mutations won't interfer with the running operation. */
+  op->set = set;
+  op->generation_created = set->current_generation;
+  advance_generation (set);
+  GNUNET_CONTAINER_DLL_insert (set->ops_head, set->ops_tail, op);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Creating new CADET channel to port %s for set operation type %u\n",
+              GNUNET_h2s (&msg->app_id),
+              set->operation);
+  op->channel = GNUNET_CADET_channel_create (cadet,
+                                             op,
+                                             &msg->target_peer,
+                                             &msg->app_id,
+                                             &channel_window_cb,
+                                             &channel_end_cb,
+                                             cadet_handlers);
+  op->mq = GNUNET_CADET_get_mq (op->channel);
+  op->state = set->vt->evaluate (op, context);
+  if (NULL == op->state)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Handle an ack from a client, and send the next element. Note
+ * that we only expect acks for set elements, not after the
+ * #GNUNET_MESSAGE_TYPE_SET_ITER_DONE message.
+ *
+ * @param cls client the client
+ * @param ack the message
+ */
+static void
+handle_client_iter_ack (void *cls, const struct GNUNET_SET_IterAckMessage *ack)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+
+  if (NULL == (set = cs->set))
+  {
+    /* client without a set acknowledged receiving a value */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  if (NULL == set->iter)
+  {
+    /* client sent an ack, but we were not expecting one (as
+       set iteration has finished) */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_SERVICE_client_continue (cs->client);
+  if (ntohl (ack->send_more))
+  {
+    send_client_element (set);
+  }
+  else
+  {
+    GNUNET_CONTAINER_multihashmap_iterator_destroy (set->iter);
+    set->iter = NULL;
+    set->iteration_id++;
+  }
+}
+
+
+/**
+ * Handle a request from the client to copy a set.
+ *
+ * @param cls the client
+ * @param mh the message
+ */
+static void
+handle_client_copy_lazy_prepare (void *cls,
+                                 const struct GNUNET_MessageHeader *mh)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+  struct LazyCopyRequest *cr;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_CopyLazyResponseMessage *resp_msg;
+
+  if (NULL == (set = cs->set))
+  {
+    /* client without a set requested an operation */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client requested creation of lazy copy\n");
+  cr = GNUNET_new (struct LazyCopyRequest);
+  cr->cookie = ++lazy_copy_cookie;
+  cr->source_set = set;
+  GNUNET_CONTAINER_DLL_insert (lazy_copy_head, lazy_copy_tail, cr);
+  ev = GNUNET_MQ_msg (resp_msg, GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_RESPONSE);
+  resp_msg->cookie = cr->cookie;
+  GNUNET_MQ_send (set->cs->mq, ev);
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Handle a request from the client to connect to a copy of a set.
+ *
+ * @param cls the client
+ * @param msg the message
+ */
+static void
+handle_client_copy_lazy_connect (
+  void *cls,
+  const struct GNUNET_SET_CopyLazyConnectMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct LazyCopyRequest *cr;
+  struct Set *set;
+  int found;
+
+  if (NULL != cs->set)
+  {
+    /* There can only be one set per client */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  found = GNUNET_NO;
+  for (cr = lazy_copy_head; NULL != cr; cr = cr->next)
+  {
+    if (cr->cookie == msg->cookie)
+    {
+      found = GNUNET_YES;
+      break;
+    }
+  }
+  if (GNUNET_NO == found)
+  {
+    /* client asked for copy with cookie we don't know */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  GNUNET_CONTAINER_DLL_remove (lazy_copy_head, lazy_copy_tail, cr);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client %p requested use of lazy copy\n",
+              cs);
+  set = GNUNET_new (struct Set);
+  switch (cr->source_set->operation)
+  {
+  case GNUNET_SET_OPERATION_INTERSECTION:
+    set->vt = _GSS_intersection_vt ();
+    break;
+
+  case GNUNET_SET_OPERATION_UNION:
+    set->vt = _GSS_union_vt ();
+    break;
+
+  default:
+    GNUNET_assert (0);
+    return;
+  }
+
+  if (NULL == set->vt->copy_state)
+  {
+    /* Lazy copy not supported for this set operation */
+    GNUNET_break (0);
+    GNUNET_free (set);
+    GNUNET_free (cr);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+
+  set->operation = cr->source_set->operation;
+  set->state = set->vt->copy_state (cr->source_set->state);
+  set->content = cr->source_set->content;
+  set->content->refcount++;
+
+  set->current_generation = cr->source_set->current_generation;
+  set->excluded_generations_size = cr->source_set->excluded_generations_size;
+  set->excluded_generations =
+    GNUNET_memdup (cr->source_set->excluded_generations,
+                   set->excluded_generations_size
+                   * sizeof(struct GenerationRange));
+
+  /* Advance the generation of the new set, so that mutations to the
+     of the cloned set and the source set are independent. */
+  advance_generation (set);
+  set->cs = cs;
+  cs->set = set;
+  GNUNET_free (cr);
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Handle a request from the client to cancel a running set operation.
+ *
+ * @param cls the client
+ * @param msg the message
+ */
+static void
+handle_client_cancel (void *cls, const struct GNUNET_SET_CancelMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+  struct Operation *op;
+  int found;
+
+  if (NULL == (set = cs->set))
+  {
+    /* client without a set requested an operation */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  found = GNUNET_NO;
+  for (op = set->ops_head; NULL != op; op = op->next)
+  {
+    if (op->client_request_id == ntohl (msg->request_id))
+    {
+      found = GNUNET_YES;
+      break;
+    }
+  }
+  if (GNUNET_NO == found)
+  {
+    /* It may happen that the operation was already destroyed due to
+     * the other peer disconnecting.  The client may not know about this
+     * yet and try to cancel the (just barely non-existent) operation.
+     * So this is not a hard error.
+     */GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "Client canceled non-existent op %u\n",
+                (uint32_t) ntohl (msg->request_id));
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Client requested cancel for op %u\n",
+                (uint32_t) ntohl (msg->request_id));
+    _GSS_operation_destroy (op, GNUNET_YES);
+  }
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Handle a request from the client to accept a set operation that
+ * came from a remote peer.  We forward the accept to the associated
+ * operation for handling
+ *
+ * @param cls the client
+ * @param msg the message
+ */
+static void
+handle_client_accept (void *cls, const struct GNUNET_SET_AcceptMessage *msg)
+{
+  struct ClientState *cs = cls;
+  struct Set *set;
+  struct Operation *op;
+  struct GNUNET_SET_ResultMessage *result_message;
+  struct GNUNET_MQ_Envelope *ev;
+  struct Listener *listener;
+
+  if (NULL == (set = cs->set))
+  {
+    /* client without a set requested to accept */
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  op = get_incoming (ntohl (msg->accept_reject_id));
+  if (NULL == op)
+  {
+    /* It is not an error if the set op does not exist -- it may
+    * have been destroyed when the partner peer disconnected. */
+    GNUNET_log (
+      GNUNET_ERROR_TYPE_INFO,
+      "Client %p accepted request %u of listener %p that is no longer active\n",
+      cs,
+      ntohl (msg->accept_reject_id),
+      cs->listener);
+    ev = GNUNET_MQ_msg (result_message, GNUNET_MESSAGE_TYPE_SET_RESULT);
+    result_message->request_id = msg->request_id;
+    result_message->result_status = htons (GNUNET_SET_STATUS_FAILURE);
+    GNUNET_MQ_send (set->cs->mq, ev);
+    GNUNET_SERVICE_client_continue (cs->client);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Client accepting request %u\n",
+              (uint32_t) ntohl (msg->accept_reject_id));
+  listener = op->listener;
+  op->listener = NULL;
+  GNUNET_CONTAINER_DLL_remove (listener->op_head, listener->op_tail, op);
+  op->set = set;
+  GNUNET_CONTAINER_DLL_insert (set->ops_head, set->ops_tail, op);
+  op->client_request_id = ntohl (msg->request_id);
+  op->result_mode = ntohl (msg->result_mode);
+  op->byzantine = msg->byzantine;
+  op->byzantine_lower_bound = msg->byzantine_lower_bound;
+  op->force_full = msg->force_full;
+  op->force_delta = msg->force_delta;
+
+  /* Advance generation values, so that future mutations do not
+     interfer with the running operation. */
+  op->generation_created = set->current_generation;
+  advance_generation (set);
+  GNUNET_assert (NULL == op->state);
+  op->state = set->vt->accept (op);
+  if (NULL == op->state)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (cs->client);
+    return;
+  }
+  /* Now allow CADET to continue, as we did not do this in
+   #handle_incoming_msg (as we wanted to first see if the
+     local client would accept the request). */
+  GNUNET_CADET_receive_done (op->channel);
+  GNUNET_SERVICE_client_continue (cs->client);
+}
+
+
+/**
+ * Called to clean up, after a shutdown has been requested.
+ *
+ * @param cls closure, NULL
+ */
+static void
+shutdown_task (void *cls)
+{
+  /* Delay actual shutdown to allow service to disconnect clients */
+  in_shutdown = GNUNET_YES;
+  if (0 == num_clients)
+  {
+    if (NULL != cadet)
+    {
+      GNUNET_CADET_disconnect (cadet);
+      cadet = NULL;
+    }
+  }
+  GNUNET_STATISTICS_destroy (_GSS_statistics, GNUNET_YES);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "handled shutdown request\n");
+}
+
+
+/**
+ * Function called by the service's run
+ * method to run service-specific setup code.
+ *
+ * @param cls closure
+ * @param cfg configuration to use
+ * @param service the initialized service
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_SERVICE_Handle *service)
+{
+  /* FIXME: need to modify SERVICE (!) API to allow
+     us to run a shutdown task *after* clients were
+     forcefully disconnected! */
+  GNUNET_SCHEDULER_add_shutdown (&shutdown_task, NULL);
+  _GSS_statistics = GNUNET_STATISTICS_create ("set", cfg);
+  cadet = GNUNET_CADET_connect (cfg);
+  if (NULL == cadet)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                _ ("Could not connect to CADET service\n"));
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+}
+
+
+/**
+ * Define "main" method using service macro.
+ */
+GNUNET_SERVICE_MAIN (
+  "set",
+  GNUNET_SERVICE_OPTION_NONE,
+  &run,
+  &client_connect_cb,
+  &client_disconnect_cb,
+  NULL,
+  GNUNET_MQ_hd_fixed_size (client_accept,
+                           GNUNET_MESSAGE_TYPE_SET_ACCEPT,
+                           struct GNUNET_SET_AcceptMessage,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_iter_ack,
+                           GNUNET_MESSAGE_TYPE_SET_ITER_ACK,
+                           struct GNUNET_SET_IterAckMessage,
+                           NULL),
+  GNUNET_MQ_hd_var_size (client_mutation,
+                         GNUNET_MESSAGE_TYPE_SET_ADD,
+                         struct GNUNET_SET_ElementMessage,
+                         NULL),
+  GNUNET_MQ_hd_fixed_size (client_create_set,
+                           GNUNET_MESSAGE_TYPE_SET_CREATE,
+                           struct GNUNET_SET_CreateMessage,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_iterate,
+                           GNUNET_MESSAGE_TYPE_SET_ITER_REQUEST,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+  GNUNET_MQ_hd_var_size (client_evaluate,
+                         GNUNET_MESSAGE_TYPE_SET_EVALUATE,
+                         struct GNUNET_SET_EvaluateMessage,
+                         NULL),
+  GNUNET_MQ_hd_fixed_size (client_listen,
+                           GNUNET_MESSAGE_TYPE_SET_LISTEN,
+                           struct GNUNET_SET_ListenMessage,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_reject,
+                           GNUNET_MESSAGE_TYPE_SET_REJECT,
+                           struct GNUNET_SET_RejectMessage,
+                           NULL),
+  GNUNET_MQ_hd_var_size (client_mutation,
+                         GNUNET_MESSAGE_TYPE_SET_REMOVE,
+                         struct GNUNET_SET_ElementMessage,
+                         NULL),
+  GNUNET_MQ_hd_fixed_size (client_cancel,
+                           GNUNET_MESSAGE_TYPE_SET_CANCEL,
+                           struct GNUNET_SET_CancelMessage,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_copy_lazy_prepare,
+                           GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_PREPARE,
+                           struct GNUNET_MessageHeader,
+                           NULL),
+  GNUNET_MQ_hd_fixed_size (client_copy_lazy_connect,
+                           GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_CONNECT,
+                           struct GNUNET_SET_CopyLazyConnectMessage,
+                           NULL),
+  GNUNET_MQ_handler_end ());
+
+
+/* end of gnunet-service-set.c */
diff --git a/src/contrib/service/set/gnunet-service-set.h b/src/contrib/service/set/gnunet-service-set.h
new file mode 100644
index 000000000..abdec7f08
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set.h
@@ -0,0 +1,665 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set.h
+ * @brief common components for the implementation the different set operations
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_SET_H_PRIVATE
+#define GNUNET_SERVICE_SET_H_PRIVATE
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_applications.h"
+#include "gnunet_core_service.h"
+#include "gnunet_cadet_service.h"
+#include "gnunet_set_service.h"
+#include "set.h"
+
+
+/**
+ * Implementation-specific set state.  Used as opaque pointer, and
+ * specified further in the respective implementation.
+ */
+struct SetState;
+
+/**
+ * Implementation-specific set operation.  Used as opaque pointer, and
+ * specified further in the respective implementation.
+ */
+struct OperationState;
+
+/**
+ * A set that supports a specific operation with other peers.
+ */
+struct Set;
+
+/**
+ * Information about an element element in the set.  All elements are
+ * stored in a hash-table from their hash-code to their 'struct
+ * Element', so that the remove and add operations are reasonably
+ * fast.
+ */
+struct ElementEntry;
+
+/**
+ * Operation context used to execute a set operation.
+ */
+struct Operation;
+
+
+/**
+ * Signature of functions that create the implementation-specific
+ * state for a set supporting a specific operation.
+ *
+ * @return a set state specific to the supported operation, NULL on error
+ */
+typedef struct SetState *
+(*SetCreateImpl) (void);
+
+
+/**
+ * Signature of functions that implement the add/remove functionality
+ * for a set supporting a specific operation.
+ *
+ * @param set implementation-specific set state
+ * @param ee element message from the client
+ */
+typedef void
+(*SetAddRemoveImpl) (struct SetState *state,
+                     struct ElementEntry *ee);
+
+
+/**
+ * Make a copy of a set's internal state.
+ *
+ * @param state set state to copy
+ * @return copy of the internal state
+ */
+typedef struct SetState *
+(*SetCopyStateImpl) (struct SetState *state);
+
+
+/**
+ * Signature of functions that implement the destruction of the
+ * implementation-specific set state.
+ *
+ * @param state the set state, contains implementation-specific data
+ */
+typedef void
+(*SetDestroyImpl) (struct SetState *state);
+
+
+/**
+ * Signature of functions that implement accepting a set operation.
+ *
+ * @param op operation that is created by accepting the operation,
+ *        should be initialized by the implementation
+ * @return operation-specific state to keep in @a op
+ */
+typedef struct OperationState *
+(*OpAcceptImpl) (struct Operation *op);
+
+
+/**
+ * Signature of functions that implement starting the evaluation of
+ * set operations.
+ *
+ * @param op operation that is created, should be initialized to
+ *        begin the evaluation
+ * @param opaque_context message to be transmitted to the listener
+ *        to convince it to accept, may be NULL
+ * @return operation-specific state to keep in @a op
+ */
+typedef struct OperationState *
+(*OpEvaluateImpl) (struct Operation *op,
+                   const struct GNUNET_MessageHeader *opaque_context);
+
+/**
+ * Signature of functions that implement operation cancellation.
+ * This includes notifying the client about the operation's final
+ * state.
+ *
+ * @param op operation state
+ */
+typedef void
+(*OpCancelImpl) (struct Operation *op);
+
+
+/**
+ * Signature of functions called when the CADET channel died.
+ *
+ * @param op operation state
+ */
+typedef void
+(*OpChannelDeathImpl) (struct Operation *op);
+
+
+/**
+ * Dispatch table for a specific set operation.  Every set operation
+ * has to implement the callback in this struct.
+ */
+struct SetVT
+{
+  /**
+   * Callback for the set creation.
+   */
+  SetCreateImpl create;
+
+  /**
+   * Callback for element insertion
+   */
+  SetAddRemoveImpl add;
+
+  /**
+   * Callback for element removal.
+   */
+  SetAddRemoveImpl remove;
+
+  /**
+   * Callback for making a copy of a set's internal state.
+   */
+  SetCopyStateImpl copy_state;
+
+  /**
+   * Callback for destruction of the set state.
+   */
+  SetDestroyImpl destroy_set;
+
+  /**
+   * Callback for accepting a set operation request
+   */
+  OpAcceptImpl accept;
+
+  /**
+   * Callback for starting evaluation with a remote peer.
+   */
+  OpEvaluateImpl evaluate;
+
+  /**
+   * Callback for canceling an operation.
+   */
+  OpCancelImpl cancel;
+
+  /**
+   * Callback called in case the CADET channel died.
+   */
+  OpChannelDeathImpl channel_death;
+};
+
+
+/**
+ * MutationEvent gives information about changes
+ * to an element (removal / addition) in a set content.
+ */
+struct MutationEvent
+{
+  /**
+   * First generation affected by this mutation event.
+   *
+   * If @a generation is 0, this mutation event is a list
+   * sentinel element.
+   */
+  unsigned int generation;
+
+  /**
+   * If @a added is #GNUNET_YES, then this is a
+   * `remove` event, otherwise it is an `add` event.
+   */
+  int added;
+};
+
+
+/**
+ * Information about an element element in the set.  All elements are
+ * stored in a hash-table from their hash-code to their `struct
+ * Element`, so that the remove and add operations are reasonably
+ * fast.
+ */
+struct ElementEntry
+{
+  /**
+   * The actual element. The data for the element
+   * should be allocated at the end of this struct.
+   */
+  struct GNUNET_SET_Element element;
+
+  /**
+   * Hash of the element.  For set union: Will be used to derive the
+   * different IBF keys for different salts.
+   */
+  struct GNUNET_HashCode element_hash;
+
+  /**
+   * If @a mutations is not NULL, it contains
+   * a list of mutations, ordered by increasing generation.
+   * The list is terminated by a sentinel event with `generation`
+   * set to 0.
+   *
+   * If @a mutations is NULL, then this element exists in all generations
+   * of the respective set content this element belongs to.
+   */
+  struct MutationEvent *mutations;
+
+  /**
+   * Number of elements in the array @a mutations.
+   */
+  unsigned int mutations_size;
+
+  /**
+   * #GNUNET_YES if the element is a remote element, and does not belong
+   * to the operation's set.
+   */
+  int remote;
+};
+
+
+/**
+ * A listener is inhabited by a client, and waits for evaluation
+ * requests from remote peers.
+ */
+struct Listener;
+
+
+/**
+ * State we keep per client.
+ */
+struct ClientState
+{
+  /**
+   * Set, if associated with the client, otherwise NULL.
+   */
+  struct Set *set;
+
+  /**
+   * Listener, if associated with the client, otherwise NULL.
+   */
+  struct Listener *listener;
+
+  /**
+   * Client handle.
+   */
+  struct GNUNET_SERVICE_Client *client;
+
+  /**
+   * Message queue.
+   */
+  struct GNUNET_MQ_Handle *mq;
+};
+
+
+/**
+ * Operation context used to execute a set operation.
+ */
+struct Operation
+{
+  /**
+   * Kept in a DLL of the listener, if @e listener is non-NULL.
+   */
+  struct Operation *next;
+
+  /**
+   * Kept in a DLL of the listener, if @e listener is non-NULL.
+   */
+  struct Operation *prev;
+
+  /**
+   * Channel to the peer.
+   */
+  struct GNUNET_CADET_Channel *channel;
+
+  /**
+   * Port this operation runs on.
+   */
+  struct Listener *listener;
+
+  /**
+   * Message queue for the channel.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Context message, may be NULL.
+   */
+  struct GNUNET_MessageHeader *context_msg;
+
+  /**
+   * Set associated with the operation, NULL until the spec has been
+   * associated with a set.
+   */
+  struct Set *set;
+
+  /**
+   * Operation-specific operation state.  Note that the exact
+   * type depends on this being a union or intersection operation
+   * (and thus on @e vt).
+   */
+  struct OperationState *state;
+
+  /**
+   * The identity of the requesting peer.  Needs to
+   * be stored here as the op spec might not have been created yet.
+   */
+  struct GNUNET_PeerIdentity peer;
+
+  /**
+   * Timeout task, if the incoming peer has not been accepted
+   * after the timeout, it will be disconnected.
+   */
+  struct GNUNET_SCHEDULER_Task *timeout_task;
+
+  /**
+   * Salt to use for the operation.
+   */
+  uint32_t salt;
+
+  /**
+   * Remote peers element count
+   */
+  uint32_t remote_element_count;
+
+  /**
+   * ID used to identify an operation between service and client
+   */
+  uint32_t client_request_id;
+
+  /**
+   * When are elements sent to the client, and which elements are sent?
+   */
+  enum GNUNET_SET_ResultMode result_mode;
+
+  /**
+   * Always use delta operation instead of sending full sets,
+   * even it it's less efficient.
+   */
+  int force_delta;
+
+  /**
+   * Always send full sets, even if delta operations would
+   * be more efficient.
+   */
+  int force_full;
+
+  /**
+   * #GNUNET_YES to fail operations where Byzantine faults
+   * are suspected
+   */
+  int byzantine;
+
+  /**
+   * Lower bound for the set size, used only when
+   * byzantine mode is enabled.
+   */
+  int byzantine_lower_bound;
+
+  /**
+   * Unique request id for the request from a remote peer, sent to the
+   * client, which will accept or reject the request.  Set to '0' iff
+   * the request has not been suggested yet.
+   */
+  uint32_t suggest_id;
+
+  /**
+   * Generation in which the operation handle
+   * was created.
+   */
+  unsigned int generation_created;
+};
+
+
+/**
+ * SetContent stores the actual set elements, which may be shared by
+ * multiple generations derived from one set.
+ */
+struct SetContent
+{
+  /**
+   * Maps `struct GNUNET_HashCode *` to `struct ElementEntry *`.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *elements;
+
+  /**
+   * Mutations requested by the client that we're
+   * unable to execute right now because we're iterating
+   * over the underlying hash map of elements.
+   */
+  struct PendingMutation *pending_mutations_head;
+
+  /**
+   * Mutations requested by the client that we're
+   * unable to execute right now because we're iterating
+   * over the underlying hash map of elements.
+   */
+  struct PendingMutation *pending_mutations_tail;
+
+  /**
+   * Number of references to the content.
+   */
+  unsigned int refcount;
+
+  /**
+   * FIXME: document!
+   */
+  unsigned int latest_generation;
+
+  /**
+   * Number of concurrently active iterators.
+   */
+  int iterator_count;
+};
+
+
+struct GenerationRange
+{
+  /**
+   * First generation that is excluded.
+   */
+  unsigned int start;
+
+  /**
+   * Generation after the last excluded generation.
+   */
+  unsigned int end;
+};
+
+
+/**
+ * Information about a mutation to apply to a set.
+ */
+struct PendingMutation
+{
+  /**
+   * Mutations are kept in a DLL.
+   */
+  struct PendingMutation *prev;
+
+  /**
+   * Mutations are kept in a DLL.
+   */
+  struct PendingMutation *next;
+
+  /**
+   * Set this mutation is about.
+   */
+  struct Set *set;
+
+  /**
+   * Message that describes the desired mutation.
+   * May only be a #GNUNET_MESSAGE_TYPE_SET_ADD or
+   * #GNUNET_MESSAGE_TYPE_SET_REMOVE.
+   */
+  struct GNUNET_SET_ElementMessage *msg;
+};
+
+
+/**
+ * A set that supports a specific operation with other peers.
+ */
+struct Set
+{
+  /**
+   * Sets are held in a doubly linked list (in `sets_head` and `sets_tail`).
+   */
+  struct Set *next;
+
+  /**
+   * Sets are held in a doubly linked list.
+   */
+  struct Set *prev;
+
+  /**
+   * Client that owns the set.  Only one client may own a set,
+   * and there can only be one set per client.
+   */
+  struct ClientState *cs;
+
+  /**
+   * Content, possibly shared by multiple sets,
+   * and thus reference counted.
+   */
+  struct SetContent *content;
+
+  /**
+   * Virtual table for this set.  Determined by the operation type of
+   * this set.
+   *
+   * Used only for Add/remove of elements and when receiving an incoming
+   * operation from a remote peer.
+   */
+  const struct SetVT *vt;
+
+  /**
+   * Implementation-specific state.
+   */
+  struct SetState *state;
+
+  /**
+   * Current state of iterating elements for the client.
+   * NULL if we are not currently iterating.
+   */
+  struct GNUNET_CONTAINER_MultiHashMapIterator *iter;
+
+  /**
+   * Evaluate operations are held in a linked list.
+   */
+  struct Operation *ops_head;
+
+  /**
+   * Evaluate operations are held in a linked list.
+   */
+  struct Operation *ops_tail;
+
+  /**
+   * List of generations we have to exclude, due to lazy copies.
+   */
+  struct GenerationRange *excluded_generations;
+
+  /**
+   * Current generation, that is, number of previously executed
+   * operations and lazy copies on the underlying set content.
+   */
+  unsigned int current_generation;
+
+  /**
+   * Number of elements in array @a excluded_generations.
+   */
+  unsigned int excluded_generations_size;
+
+  /**
+   * Type of operation supported for this set
+   */
+  enum GNUNET_SET_OperationType operation;
+
+  /**
+   * Generation we're currently iteration over.
+   */
+  unsigned int iter_generation;
+
+  /**
+   * Each @e iter is assigned a unique number, so that the client
+   * can distinguish iterations.
+   */
+  uint16_t iteration_id;
+};
+
+
+extern struct GNUNET_STATISTICS_Handle *_GSS_statistics;
+
+
+/**
+ * Destroy the given operation.   Used for any operation where both
+ * peers were known and that thus actually had a vt and channel.  Must
+ * not be used for operations where 'listener' is still set and we do
+ * not know the other peer.
+ *
+ * Call the implementation-specific cancel function of the operation.
+ * Disconnects from the remote peer.  Does not disconnect the client,
+ * as there may be multiple operations per set.
+ *
+ * @param op operation to destroy
+ * @param gc #GNUNET_YES to perform garbage collection on the set
+ */
+void
+_GSS_operation_destroy (struct Operation *op,
+                        int gc);
+
+
+/**
+ * This function probably should not exist
+ * and be replaced by inlining more specific
+ * logic in the various places where it is called.
+ */
+void
+_GSS_operation_destroy2 (struct Operation *op);
+
+
+/**
+ * Get the table with implementing functions for set union.
+ *
+ * @return the operation specific VTable
+ */
+const struct SetVT *
+_GSS_union_vt (void);
+
+
+/**
+ * Get the table with implementing functions for set intersection.
+ *
+ * @return the operation specific VTable
+ */
+const struct SetVT *
+_GSS_intersection_vt (void);
+
+
+/**
+ * Is element @a ee part of the set used by @a op?
+ *
+ * @param ee element to test
+ * @param op operation the defines the set and its generation
+ * @return #GNUNET_YES if the element is in the set, #GNUNET_NO if not
+ */
+int
+_GSS_is_element_of_operation (struct ElementEntry *ee,
+                              struct Operation *op);
+
+
+#endif
diff --git a/src/contrib/service/set/gnunet-service-set_intersection.c b/src/contrib/service/set/gnunet-service-set_intersection.c
new file mode 100644
index 000000000..51a8d0dbc
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_intersection.c
@@ -0,0 +1,1324 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set_intersection.c
+ * @brief two-peer set intersection
+ * @author Christian Fuchs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_statistics_service.h"
+#include "gnunet-service-set.h"
+#include "gnunet_block_lib.h"
+#include "gnunet-service-set_protocol.h"
+#include "gnunet-service-set_intersection.h"
+#include <gcrypt.h>
+
+
+/**
+ * Current phase we are in for a intersection operation.
+ */
+enum IntersectionOperationPhase
+{
+  /**
+   * We are just starting.
+   */
+  PHASE_INITIAL,
+
+  /**
+   * We have send the number of our elements to the other
+   * peer, but did not setup our element set yet.
+   */
+  PHASE_COUNT_SENT,
+
+  /**
+   * We have initialized our set and are now reducing it by exchanging
+   * Bloom filters until one party notices the their element hashes
+   * are equal.
+   */
+  PHASE_BF_EXCHANGE,
+
+  /**
+   * We must next send the P2P DONE message (after finishing mostly
+   * with the local client).  Then we will wait for the channel to close.
+   */
+  PHASE_MUST_SEND_DONE,
+
+  /**
+   * We have received the P2P DONE message, and must finish with the
+   * local client before terminating the channel.
+   */
+  PHASE_DONE_RECEIVED,
+
+  /**
+   * The protocol is over.  Results may still have to be sent to the
+   * client.
+   */
+  PHASE_FINISHED
+};
+
+
+/**
+ * State of an evaluate operation with another peer.
+ */
+struct OperationState
+{
+  /**
+   * The bf we currently receive
+   */
+  struct GNUNET_CONTAINER_BloomFilter *remote_bf;
+
+  /**
+   * BF of the set's element.
+   */
+  struct GNUNET_CONTAINER_BloomFilter *local_bf;
+
+  /**
+   * Remaining elements in the intersection operation.
+   * Maps element-id-hashes to 'elements in our set'.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *my_elements;
+
+  /**
+   * Iterator for sending the final set of @e my_elements to the client.
+   */
+  struct GNUNET_CONTAINER_MultiHashMapIterator *full_result_iter;
+
+  /**
+   * Evaluate operations are held in a linked list.
+   */
+  struct OperationState *next;
+
+  /**
+   * Evaluate operations are held in a linked list.
+   */
+  struct OperationState *prev;
+
+  /**
+   * For multipart BF transmissions, we have to store the
+   * bloomfilter-data until we fully received it.
+   */
+  char *bf_data;
+
+  /**
+   * XOR of the keys of all of the elements (remaining) in my set.
+   * Always updated when elements are added or removed to
+   * @e my_elements.
+   */
+  struct GNUNET_HashCode my_xor;
+
+  /**
+   * XOR of the keys of all of the elements (remaining) in
+   * the other peer's set.  Updated when we receive the
+   * other peer's Bloom filter.
+   */
+  struct GNUNET_HashCode other_xor;
+
+  /**
+   * How many bytes of @e bf_data are valid?
+   */
+  uint32_t bf_data_offset;
+
+  /**
+   * Current element count contained within @e my_elements.
+   * (May differ briefly during initialization.)
+   */
+  uint32_t my_element_count;
+
+  /**
+   * size of the bloomfilter in @e bf_data.
+   */
+  uint32_t bf_data_size;
+
+  /**
+   * size of the bloomfilter
+   */
+  uint32_t bf_bits_per_element;
+
+  /**
+   * Salt currently used for BF construction (by us or the other peer,
+   * depending on where we are in the code).
+   */
+  uint32_t salt;
+
+  /**
+   * Current state of the operation.
+   */
+  enum IntersectionOperationPhase phase;
+
+  /**
+   * Generation in which the operation handle
+   * was created.
+   */
+  unsigned int generation_created;
+
+  /**
+   * Did we send the client that we are done?
+   */
+  int client_done_sent;
+
+  /**
+   * Set whenever we reach the state where the death of the
+   * channel is perfectly find and should NOT result in the
+   * operation being cancelled.
+   */
+  int channel_death_expected;
+};
+
+
+/**
+ * Extra state required for efficient set intersection.
+ * Merely tracks the total number of elements.
+ */
+struct SetState
+{
+  /**
+   * Number of currently valid elements in the set which have not been
+   * removed.
+   */
+  uint32_t current_set_element_count;
+};
+
+
+/**
+ * If applicable in the current operation mode, send a result message
+ * to the client indicating we removed an element.
+ *
+ * @param op intersection operation
+ * @param element element to send
+ */
+static void
+send_client_removed_element (struct Operation *op,
+                             struct GNUNET_SET_Element *element)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *rm;
+
+  if (GNUNET_SET_RESULT_REMOVED != op->result_mode)
+    return; /* Wrong mode for transmitting removed elements */
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending removed element (size %u) to client\n",
+              element->size);
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# Element removed messages sent",
+                            1,
+                            GNUNET_NO);
+  GNUNET_assert (0 != op->client_request_id);
+  ev = GNUNET_MQ_msg_extra (rm,
+                            element->size,
+                            GNUNET_MESSAGE_TYPE_SET_RESULT);
+  if (NULL == ev)
+  {
+    GNUNET_break (0);
+    return;
+  }
+  rm->result_status = htons (GNUNET_SET_STATUS_OK);
+  rm->request_id = htonl (op->client_request_id);
+  rm->element_type = element->element_type;
+  GNUNET_memcpy (&rm[1],
+                 element->data,
+                 element->size);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+}
+
+
+/**
+ * Fills the "my_elements" hashmap with all relevant elements.
+ *
+ * @param cls the `struct Operation *` we are performing
+ * @param key current key code
+ * @param value the `struct ElementEntry *` from the hash map
+ * @return #GNUNET_YES (we should continue to iterate)
+ */
+static int
+filtered_map_initialization (void *cls,
+                             const struct GNUNET_HashCode *key,
+                             void *value)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee = value;
+  struct GNUNET_HashCode mutated_hash;
+
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "FIMA called for %s:%u\n",
+              GNUNET_h2s (&ee->element_hash),
+              ee->element.size);
+
+  if (GNUNET_NO == _GSS_is_element_of_operation (ee, op))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Reduced initialization, not starting with %s:%u (wrong generation)\n",
+                GNUNET_h2s (&ee->element_hash),
+                ee->element.size);
+    return GNUNET_YES;   /* element not valid in our operation's generation */
+  }
+
+  /* Test if element is in other peer's bloomfilter */
+  GNUNET_BLOCK_mingle_hash (&ee->element_hash,
+                            op->state->salt,
+                            &mutated_hash);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Testing mingled hash %s with salt %u\n",
+              GNUNET_h2s (&mutated_hash),
+              op->state->salt);
+  if (GNUNET_NO ==
+      GNUNET_CONTAINER_bloomfilter_test (op->state->remote_bf,
+                                         &mutated_hash))
+  {
+    /* remove this element */
+    send_client_removed_element (op,
+                                 &ee->element);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Reduced initialization, not starting with %s:%u\n",
+                GNUNET_h2s (&ee->element_hash),
+                ee->element.size);
+    return GNUNET_YES;
+  }
+  op->state->my_element_count++;
+  GNUNET_CRYPTO_hash_xor (&op->state->my_xor,
+                          &ee->element_hash,
+                          &op->state->my_xor);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Filtered initialization of my_elements, adding %s:%u\n",
+              GNUNET_h2s (&ee->element_hash),
+              ee->element.size);
+  GNUNET_break (GNUNET_YES ==
+                GNUNET_CONTAINER_multihashmap_put (op->state->my_elements,
+                                                   &ee->element_hash,
+                                                   ee,
+                                                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+
+  return GNUNET_YES;
+}
+
+
+/**
+ * Removes elements from our hashmap if they are not contained within the
+ * provided remote bloomfilter.
+ *
+ * @param cls closure with the `struct Operation *`
+ * @param key current key code
+ * @param value value in the hash map
+ * @return #GNUNET_YES (we should continue to iterate)
+ */
+static int
+iterator_bf_reduce (void *cls,
+                    const struct GNUNET_HashCode *key,
+                    void *value)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee = value;
+  struct GNUNET_HashCode mutated_hash;
+
+  GNUNET_BLOCK_mingle_hash (&ee->element_hash,
+                            op->state->salt,
+                            &mutated_hash);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Testing mingled hash %s with salt %u\n",
+              GNUNET_h2s (&mutated_hash),
+              op->state->salt);
+  if (GNUNET_NO ==
+      GNUNET_CONTAINER_bloomfilter_test (op->state->remote_bf,
+                                         &mutated_hash))
+  {
+    GNUNET_break (0 < op->state->my_element_count);
+    op->state->my_element_count--;
+    GNUNET_CRYPTO_hash_xor (&op->state->my_xor,
+                            &ee->element_hash,
+                            &op->state->my_xor);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Bloom filter reduction of my_elements, removing %s:%u\n",
+                GNUNET_h2s (&ee->element_hash),
+                ee->element.size);
+    GNUNET_assert (GNUNET_YES ==
+                   GNUNET_CONTAINER_multihashmap_remove (op->state->my_elements,
+                                                         &ee->element_hash,
+                                                         ee));
+    send_client_removed_element (op,
+                                 &ee->element);
+  }
+  else
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Bloom filter reduction of my_elements, keeping %s:%u\n",
+                GNUNET_h2s (&ee->element_hash),
+                ee->element.size);
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Create initial bloomfilter based on all the elements given.
+ *
+ * @param cls the `struct Operation *`
+ * @param key current key code
+ * @param value the `struct ElementEntry` to process
+ * @return #GNUNET_YES (we should continue to iterate)
+ */
+static int
+iterator_bf_create (void *cls,
+                    const struct GNUNET_HashCode *key,
+                    void *value)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee = value;
+  struct GNUNET_HashCode mutated_hash;
+
+  GNUNET_BLOCK_mingle_hash (&ee->element_hash,
+                            op->state->salt,
+                            &mutated_hash);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Initializing BF with hash %s with salt %u\n",
+              GNUNET_h2s (&mutated_hash),
+              op->state->salt);
+  GNUNET_CONTAINER_bloomfilter_add (op->state->local_bf,
+                                    &mutated_hash);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Inform the client that the intersection operation has failed,
+ * and proceed to destroy the evaluate operation.
+ *
+ * @param op the intersection operation to fail
+ */
+static void
+fail_intersection_operation (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *msg;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+              "Intersection operation failed\n");
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# Intersection operations failed",
+                            1,
+                            GNUNET_NO);
+  if (NULL != op->state->my_elements)
+  {
+    GNUNET_CONTAINER_multihashmap_destroy (op->state->my_elements);
+    op->state->my_elements = NULL;
+  }
+  ev = GNUNET_MQ_msg (msg,
+                      GNUNET_MESSAGE_TYPE_SET_RESULT);
+  msg->result_status = htons (GNUNET_SET_STATUS_FAILURE);
+  msg->request_id = htonl (op->client_request_id);
+  msg->element_type = htons (0);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+  _GSS_operation_destroy (op,
+                          GNUNET_YES);
+}
+
+
+/**
+ * Send a bloomfilter to our peer.  After the result done message has
+ * been sent to the client, destroy the evaluate operation.
+ *
+ * @param op intersection operation
+ */
+static void
+send_bloomfilter (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct BFMessage *msg;
+  uint32_t bf_size;
+  uint32_t bf_elementbits;
+  uint32_t chunk_size;
+  char *bf_data;
+  uint32_t offset;
+
+  /* We consider the ratio of the set sizes to determine
+     the number of bits per element, as the smaller set
+     should use more bits to maximize its set reduction
+     potential and minimize overall bandwidth consumption. */
+  bf_elementbits = 2 + ceil (log2 ((double)
+                                   (op->remote_element_count
+                                    / (double) op->state->my_element_count)));
+  if (bf_elementbits < 1)
+    bf_elementbits = 1; /* make sure k is not 0 */
+  /* optimize BF-size to ~50% of bits set */
+  bf_size = ceil ((double) (op->state->my_element_count
+                            * bf_elementbits / log (2)));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending Bloom filter (%u) of size %u bytes\n",
+              (unsigned int) bf_elementbits,
+              (unsigned int) bf_size);
+  op->state->local_bf = GNUNET_CONTAINER_bloomfilter_init (NULL,
+                                                           bf_size,
+                                                           bf_elementbits);
+  op->state->salt = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_NONCE,
+                                              UINT32_MAX);
+  GNUNET_CONTAINER_multihashmap_iterate (op->state->my_elements,
+                                         &iterator_bf_create,
+                                         op);
+
+  /* send our Bloom filter */
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# Intersection Bloom filters sent",
+                            1,
+                            GNUNET_NO);
+  chunk_size = 60 * 1024 - sizeof(struct BFMessage);
+  if (bf_size <= chunk_size)
+  {
+    /* singlepart */
+    chunk_size = bf_size;
+    ev = GNUNET_MQ_msg_extra (msg,
+                              chunk_size,
+                              GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_BF);
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_CONTAINER_bloomfilter_get_raw_data (
+                     op->state->local_bf,
+                     (char *) &msg[1],
+                     bf_size));
+    msg->sender_element_count = htonl (op->state->my_element_count);
+    msg->bloomfilter_total_length = htonl (bf_size);
+    msg->bits_per_element = htonl (bf_elementbits);
+    msg->sender_mutator = htonl (op->state->salt);
+    msg->element_xor_hash = op->state->my_xor;
+    GNUNET_MQ_send (op->mq, ev);
+  }
+  else
+  {
+    /* multipart */
+    bf_data = GNUNET_malloc (bf_size);
+    GNUNET_assert (GNUNET_SYSERR !=
+                   GNUNET_CONTAINER_bloomfilter_get_raw_data (
+                     op->state->local_bf,
+                     bf_data,
+                     bf_size));
+    offset = 0;
+    while (offset < bf_size)
+    {
+      if (bf_size - chunk_size < offset)
+        chunk_size = bf_size - offset;
+      ev = GNUNET_MQ_msg_extra (msg,
+                                chunk_size,
+                                GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_BF);
+      GNUNET_memcpy (&msg[1],
+                     &bf_data[offset],
+                     chunk_size);
+      offset += chunk_size;
+      msg->sender_element_count = htonl (op->state->my_element_count);
+      msg->bloomfilter_total_length = htonl (bf_size);
+      msg->bits_per_element = htonl (bf_elementbits);
+      msg->sender_mutator = htonl (op->state->salt);
+      msg->element_xor_hash = op->state->my_xor;
+      GNUNET_MQ_send (op->mq, ev);
+    }
+    GNUNET_free (bf_data);
+  }
+  GNUNET_CONTAINER_bloomfilter_free (op->state->local_bf);
+  op->state->local_bf = NULL;
+}
+
+
+/**
+ * Signal to the client that the operation has finished and
+ * destroy the operation.
+ *
+ * @param cls operation to destroy
+ */
+static void
+send_client_done_and_destroy (void *cls)
+{
+  struct Operation *op = cls;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *rm;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Intersection succeeded, sending DONE to local client\n");
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# Intersection operations succeeded",
+                            1,
+                            GNUNET_NO);
+  ev = GNUNET_MQ_msg (rm,
+                      GNUNET_MESSAGE_TYPE_SET_RESULT);
+  rm->request_id = htonl (op->client_request_id);
+  rm->result_status = htons (GNUNET_SET_STATUS_DONE);
+  rm->element_type = htons (0);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+  _GSS_operation_destroy (op,
+                          GNUNET_YES);
+}
+
+
+/**
+ * Remember that we are done dealing with the local client
+ * AND have sent the other peer our message that we are done,
+ * so we are not just waiting for the channel to die before
+ * telling the local client that we are done as our last act.
+ *
+ * @param cls the `struct Operation`.
+ */
+static void
+finished_local_operations (void *cls)
+{
+  struct Operation *op = cls;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "DONE sent to other peer, now waiting for other end to close the channel\n");
+  op->state->phase = PHASE_FINISHED;
+  op->state->channel_death_expected = GNUNET_YES;
+}
+
+
+/**
+ * Notify the other peer that we are done.  Once this message
+ * is out, we still need to notify the local client that we
+ * are done.
+ *
+ * @param op operation to notify for.
+ */
+static void
+send_p2p_done (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct IntersectionDoneMessage *idm;
+
+  GNUNET_assert (PHASE_MUST_SEND_DONE == op->state->phase);
+  GNUNET_assert (GNUNET_NO == op->state->channel_death_expected);
+  ev = GNUNET_MQ_msg (idm,
+                      GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_DONE);
+  idm->final_element_count = htonl (op->state->my_element_count);
+  idm->element_xor_hash = op->state->my_xor;
+  GNUNET_MQ_notify_sent (ev,
+                         &finished_local_operations,
+                         op);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+}
+
+
+/**
+ * Send all elements in the full result iterator.
+ *
+ * @param cls the `struct Operation *`
+ */
+static void
+send_remaining_elements (void *cls)
+{
+  struct Operation *op = cls;
+  const void *nxt;
+  const struct ElementEntry *ee;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *rm;
+  const struct GNUNET_SET_Element *element;
+  int res;
+
+  res = GNUNET_CONTAINER_multihashmap_iterator_next (
+    op->state->full_result_iter,
+    NULL,
+    &nxt);
+  if (GNUNET_NO == res)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sending done and destroy because iterator ran out\n");
+    GNUNET_CONTAINER_multihashmap_iterator_destroy (
+      op->state->full_result_iter);
+    op->state->full_result_iter = NULL;
+    if (PHASE_DONE_RECEIVED == op->state->phase)
+    {
+      op->state->phase = PHASE_FINISHED;
+      send_client_done_and_destroy (op);
+    }
+    else if (PHASE_MUST_SEND_DONE == op->state->phase)
+    {
+      send_p2p_done (op);
+    }
+    else
+    {
+      GNUNET_assert (0);
+    }
+    return;
+  }
+  ee = nxt;
+  element = &ee->element;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending element %s:%u to client (full set)\n",
+              GNUNET_h2s (&ee->element_hash),
+              element->size);
+  GNUNET_assert (0 != op->client_request_id);
+  ev = GNUNET_MQ_msg_extra (rm,
+                            element->size,
+                            GNUNET_MESSAGE_TYPE_SET_RESULT);
+  GNUNET_assert (NULL != ev);
+  rm->result_status = htons (GNUNET_SET_STATUS_OK);
+  rm->request_id = htonl (op->client_request_id);
+  rm->element_type = element->element_type;
+  GNUNET_memcpy (&rm[1],
+                 element->data,
+                 element->size);
+  GNUNET_MQ_notify_sent (ev,
+                         &send_remaining_elements,
+                         op);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+}
+
+
+/**
+ * Fills the "my_elements" hashmap with the initial set of
+ * (non-deleted) elements from the set of the specification.
+ *
+ * @param cls closure with the `struct Operation *`
+ * @param key current key code for the element
+ * @param value value in the hash map with the `struct ElementEntry *`
+ * @return #GNUNET_YES (we should continue to iterate)
+ */
+static int
+initialize_map_unfiltered (void *cls,
+                           const struct GNUNET_HashCode *key,
+                           void *value)
+{
+  struct ElementEntry *ee = value;
+  struct Operation *op = cls;
+
+  if (GNUNET_NO == _GSS_is_element_of_operation (ee, op))
+    return GNUNET_YES; /* element not live in operation's generation */
+  GNUNET_CRYPTO_hash_xor (&op->state->my_xor,
+                          &ee->element_hash,
+                          &op->state->my_xor);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Initial full initialization of my_elements, adding %s:%u\n",
+              GNUNET_h2s (&ee->element_hash),
+              ee->element.size);
+  GNUNET_break (GNUNET_YES ==
+                GNUNET_CONTAINER_multihashmap_put (op->state->my_elements,
+                                                   &ee->element_hash,
+                                                   ee,
+                                                   GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+  return GNUNET_YES;
+}
+
+
+/**
+ * Send our element count to the peer, in case our element count is
+ * lower than theirs.
+ *
+ * @param op intersection operation
+ */
+static void
+send_element_count (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct IntersectionElementInfoMessage *msg;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Sending our element count (%u)\n",
+              op->state->my_element_count);
+  ev = GNUNET_MQ_msg (msg,
+                      GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_ELEMENT_INFO);
+  msg->sender_element_count = htonl (op->state->my_element_count);
+  GNUNET_MQ_send (op->mq, ev);
+}
+
+
+/**
+ * We go first, initialize our map with all elements and
+ * send the first Bloom filter.
+ *
+ * @param op operation to start exchange for
+ */
+static void
+begin_bf_exchange (struct Operation *op)
+{
+  op->state->phase = PHASE_BF_EXCHANGE;
+  GNUNET_CONTAINER_multihashmap_iterate (op->set->content->elements,
+                                         &initialize_map_unfiltered,
+                                         op);
+  send_bloomfilter (op);
+}
+
+
+void
+handle_intersection_p2p_element_info (void *cls,
+                                      const struct
+                                      IntersectionElementInfoMessage *msg)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_INTERSECTION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  op->remote_element_count = ntohl (msg->sender_element_count);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received remote element count (%u), I have %u\n",
+              op->remote_element_count,
+              op->state->my_element_count);
+  if (((PHASE_INITIAL != op->state->phase) &&
+       (PHASE_COUNT_SENT != op->state->phase)) ||
+      (op->state->my_element_count > op->remote_element_count) ||
+      (0 == op->state->my_element_count) ||
+      (0 == op->remote_element_count))
+  {
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  GNUNET_break (NULL == op->state->remote_bf);
+  begin_bf_exchange (op);
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Process a Bloomfilter once we got all the chunks.
+ *
+ * @param op the intersection operation
+ */
+static void
+process_bf (struct Operation *op)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Received BF in phase %u, foreign count is %u, my element count is %u/%u\n",
+              op->state->phase,
+              op->remote_element_count,
+              op->state->my_element_count,
+              GNUNET_CONTAINER_multihashmap_size (op->set->content->elements));
+  switch (op->state->phase)
+  {
+  case PHASE_INITIAL:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+
+  case PHASE_COUNT_SENT:
+    /* This is the first BF being sent, build our initial map with
+       filtering in place */
+    op->state->my_element_count = 0;
+    GNUNET_CONTAINER_multihashmap_iterate (op->set->content->elements,
+                                           &filtered_map_initialization,
+                                           op);
+    break;
+
+  case PHASE_BF_EXCHANGE:
+    /* Update our set by reduction */
+    GNUNET_CONTAINER_multihashmap_iterate (op->state->my_elements,
+                                           &iterator_bf_reduce,
+                                           op);
+    break;
+
+  case PHASE_MUST_SEND_DONE:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+
+  case PHASE_DONE_RECEIVED:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+
+  case PHASE_FINISHED:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  GNUNET_CONTAINER_bloomfilter_free (op->state->remote_bf);
+  op->state->remote_bf = NULL;
+
+  if ((0 == op->state->my_element_count) ||  /* fully disjoint */
+      ((op->state->my_element_count == op->remote_element_count) &&
+       (0 == GNUNET_memcmp (&op->state->my_xor,
+                            &op->state->other_xor))))
+  {
+    /* we are done */
+    op->state->phase = PHASE_MUST_SEND_DONE;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Intersection succeeded, sending DONE to other peer\n");
+    GNUNET_CONTAINER_bloomfilter_free (op->state->local_bf);
+    op->state->local_bf = NULL;
+    if (GNUNET_SET_RESULT_FULL == op->result_mode)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                  "Sending full result set (%u elements)\n",
+                  GNUNET_CONTAINER_multihashmap_size (op->state->my_elements));
+      op->state->full_result_iter
+        = GNUNET_CONTAINER_multihashmap_iterator_create (
+            op->state->my_elements);
+      send_remaining_elements (op);
+      return;
+    }
+    send_p2p_done (op);
+    return;
+  }
+  op->state->phase = PHASE_BF_EXCHANGE;
+  send_bloomfilter (op);
+}
+
+
+/**
+ * Check an BF message from a remote peer.
+ *
+ * @param cls the intersection operation
+ * @param msg the header of the message
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+int
+check_intersection_p2p_bf (void *cls,
+                           const struct BFMessage *msg)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_INTERSECTION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle an BF message from a remote peer.
+ *
+ * @param cls the intersection operation
+ * @param msg the header of the message
+ */
+void
+handle_intersection_p2p_bf (void *cls,
+                            const struct BFMessage *msg)
+{
+  struct Operation *op = cls;
+  uint32_t bf_size;
+  uint32_t chunk_size;
+  uint32_t bf_bits_per_element;
+
+  switch (op->state->phase)
+  {
+  case PHASE_INITIAL:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+
+  case PHASE_COUNT_SENT:
+  case PHASE_BF_EXCHANGE:
+    bf_size = ntohl (msg->bloomfilter_total_length);
+    bf_bits_per_element = ntohl (msg->bits_per_element);
+    chunk_size = htons (msg->header.size) - sizeof(struct BFMessage);
+    op->state->other_xor = msg->element_xor_hash;
+    if (bf_size == chunk_size)
+    {
+      if (NULL != op->state->bf_data)
+      {
+        GNUNET_break_op (0);
+        fail_intersection_operation (op);
+        return;
+      }
+      /* single part, done here immediately */
+      op->state->remote_bf
+        = GNUNET_CONTAINER_bloomfilter_init ((const char *) &msg[1],
+                                             bf_size,
+                                             bf_bits_per_element);
+      op->state->salt = ntohl (msg->sender_mutator);
+      op->remote_element_count = ntohl (msg->sender_element_count);
+      process_bf (op);
+      break;
+    }
+    /* multipart chunk */
+    if (NULL == op->state->bf_data)
+    {
+      /* first chunk, initialize */
+      op->state->bf_data = GNUNET_malloc (bf_size);
+      op->state->bf_data_size = bf_size;
+      op->state->bf_bits_per_element = bf_bits_per_element;
+      op->state->bf_data_offset = 0;
+      op->state->salt = ntohl (msg->sender_mutator);
+      op->remote_element_count = ntohl (msg->sender_element_count);
+    }
+    else
+    {
+      /* increment */
+      if ((op->state->bf_data_size != bf_size) ||
+          (op->state->bf_bits_per_element != bf_bits_per_element) ||
+          (op->state->bf_data_offset + chunk_size > bf_size) ||
+          (op->state->salt != ntohl (msg->sender_mutator)) ||
+          (op->remote_element_count != ntohl (msg->sender_element_count)))
+      {
+        GNUNET_break_op (0);
+        fail_intersection_operation (op);
+        return;
+      }
+    }
+    GNUNET_memcpy (&op->state->bf_data[op->state->bf_data_offset],
+                   (const char *) &msg[1],
+                   chunk_size);
+    op->state->bf_data_offset += chunk_size;
+    if (op->state->bf_data_offset == bf_size)
+    {
+      /* last chunk, run! */
+      op->state->remote_bf
+        = GNUNET_CONTAINER_bloomfilter_init (op->state->bf_data,
+                                             bf_size,
+                                             bf_bits_per_element);
+      GNUNET_free (op->state->bf_data);
+      op->state->bf_data = NULL;
+      op->state->bf_data_size = 0;
+      process_bf (op);
+    }
+    break;
+
+  default:
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Remove all elements from our hashmap.
+ *
+ * @param cls closure with the `struct Operation *`
+ * @param key current key code
+ * @param value value in the hash map
+ * @return #GNUNET_YES (we should continue to iterate)
+ */
+static int
+filter_all (void *cls,
+            const struct GNUNET_HashCode *key,
+            void *value)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee = value;
+
+  GNUNET_break (0 < op->state->my_element_count);
+  op->state->my_element_count--;
+  GNUNET_CRYPTO_hash_xor (&op->state->my_xor,
+                          &ee->element_hash,
+                          &op->state->my_xor);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Final reduction of my_elements, removing %s:%u\n",
+              GNUNET_h2s (&ee->element_hash),
+              ee->element.size);
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_CONTAINER_multihashmap_remove (op->state->my_elements,
+                                                       &ee->element_hash,
+                                                       ee));
+  send_client_removed_element (op,
+                               &ee->element);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Handle a done message from a remote peer
+ *
+ * @param cls the intersection operation
+ * @param idm the message
+ */
+void
+handle_intersection_p2p_done (void *cls,
+                              const struct IntersectionDoneMessage *idm)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_INTERSECTION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  if (PHASE_BF_EXCHANGE != op->state->phase)
+  {
+    /* wrong phase to conclude? FIXME: Or should we allow this
+       if the other peer has _initially_ already an empty set? */
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  if (0 == ntohl (idm->final_element_count))
+  {
+    /* other peer determined empty set is the intersection,
+       remove all elements */
+    GNUNET_CONTAINER_multihashmap_iterate (op->state->my_elements,
+                                           &filter_all,
+                                           op);
+  }
+  if ((op->state->my_element_count != ntohl (idm->final_element_count)) ||
+      (0 != GNUNET_memcmp (&op->state->my_xor,
+                           &idm->element_xor_hash)))
+  {
+    /* Other peer thinks we are done, but we disagree on the result! */
+    GNUNET_break_op (0);
+    fail_intersection_operation (op);
+    return;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Got IntersectionDoneMessage, have %u elements in intersection\n",
+              op->state->my_element_count);
+  op->state->phase = PHASE_DONE_RECEIVED;
+  GNUNET_CADET_receive_done (op->channel);
+
+  GNUNET_assert (GNUNET_NO == op->state->client_done_sent);
+  if (GNUNET_SET_RESULT_FULL == op->result_mode)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sending full result set to client (%u elements)\n",
+                GNUNET_CONTAINER_multihashmap_size (op->state->my_elements));
+    op->state->full_result_iter
+      = GNUNET_CONTAINER_multihashmap_iterator_create (op->state->my_elements);
+    send_remaining_elements (op);
+    return;
+  }
+  op->state->phase = PHASE_FINISHED;
+  send_client_done_and_destroy (op);
+}
+
+
+/**
+ * Initiate a set intersection operation with a remote peer.
+ *
+ * @param op operation that is created, should be initialized to
+ *        begin the evaluation
+ * @param opaque_context message to be transmitted to the listener
+ *        to convince it to accept, may be NULL
+ * @return operation-specific state to keep in @a op
+ */
+static struct OperationState *
+intersection_evaluate (struct Operation *op,
+                       const struct GNUNET_MessageHeader *opaque_context)
+{
+  struct OperationState *state;
+  struct GNUNET_MQ_Envelope *ev;
+  struct OperationRequestMessage *msg;
+
+  ev = GNUNET_MQ_msg_nested_mh (msg,
+                                GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST,
+                                opaque_context);
+  if (NULL == ev)
+  {
+    /* the context message is too large!? */
+    GNUNET_break (0);
+    return NULL;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Initiating intersection operation evaluation\n");
+  state = GNUNET_new (struct OperationState);
+  /* we started the operation, thus we have to send the operation request */
+  state->phase = PHASE_INITIAL;
+  state->my_element_count = op->set->state->current_set_element_count;
+  state->my_elements
+    = GNUNET_CONTAINER_multihashmap_create (state->my_element_count,
+                                            GNUNET_YES);
+
+  msg->operation = htonl (GNUNET_SET_OPERATION_INTERSECTION);
+  msg->element_count = htonl (state->my_element_count);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+  state->phase = PHASE_COUNT_SENT;
+  if (NULL != opaque_context)
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sent op request with context message\n");
+  else
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Sent op request without context message\n");
+  return state;
+}
+
+
+/**
+ * Accept an intersection operation request from a remote peer.  Only
+ * initializes the private operation state.
+ *
+ * @param op operation that will be accepted as an intersection operation
+ */
+static struct OperationState *
+intersection_accept (struct Operation *op)
+{
+  struct OperationState *state;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Accepting set intersection operation\n");
+  state = GNUNET_new (struct OperationState);
+  state->phase = PHASE_INITIAL;
+  state->my_element_count
+    = op->set->state->current_set_element_count;
+  state->my_elements
+    = GNUNET_CONTAINER_multihashmap_create (GNUNET_MIN (state->my_element_count,
+                                                        op->remote_element_count),
+                                            GNUNET_YES);
+  op->state = state;
+  if (op->remote_element_count < state->my_element_count)
+  {
+    /* If the other peer (Alice) has fewer elements than us (Bob),
+       we just send the count as Alice should send the first BF */
+    send_element_count (op);
+    state->phase = PHASE_COUNT_SENT;
+    return state;
+  }
+  /* We have fewer elements, so we start with the BF */
+  begin_bf_exchange (op);
+  return state;
+}
+
+
+/**
+ * Destroy the intersection operation.  Only things specific to the
+ * intersection operation are destroyed.
+ *
+ * @param op intersection operation to destroy
+ */
+static void
+intersection_op_cancel (struct Operation *op)
+{
+  /* check if the op was canceled twice */
+  GNUNET_assert (NULL != op->state);
+  if (NULL != op->state->remote_bf)
+  {
+    GNUNET_CONTAINER_bloomfilter_free (op->state->remote_bf);
+    op->state->remote_bf = NULL;
+  }
+  if (NULL != op->state->local_bf)
+  {
+    GNUNET_CONTAINER_bloomfilter_free (op->state->local_bf);
+    op->state->local_bf = NULL;
+  }
+  if (NULL != op->state->my_elements)
+  {
+    GNUNET_CONTAINER_multihashmap_destroy (op->state->my_elements);
+    op->state->my_elements = NULL;
+  }
+  if (NULL != op->state->full_result_iter)
+  {
+    GNUNET_CONTAINER_multihashmap_iterator_destroy (
+      op->state->full_result_iter);
+    op->state->full_result_iter = NULL;
+  }
+  GNUNET_free (op->state);
+  op->state = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Destroying intersection op state done\n");
+}
+
+
+/**
+ * Create a new set supporting the intersection operation.
+ *
+ * @return the newly created set
+ */
+static struct SetState *
+intersection_set_create ()
+{
+  struct SetState *set_state;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Intersection set created\n");
+  set_state = GNUNET_new (struct SetState);
+  set_state->current_set_element_count = 0;
+
+  return set_state;
+}
+
+
+/**
+ * Add the element from the given element message to the set.
+ *
+ * @param set_state state of the set want to add to
+ * @param ee the element to add to the set
+ */
+static void
+intersection_add (struct SetState *set_state,
+                  struct ElementEntry *ee)
+{
+  set_state->current_set_element_count++;
+}
+
+
+/**
+ * Destroy a set that supports the intersection operation
+ *
+ * @param set_state the set to destroy
+ */
+static void
+intersection_set_destroy (struct SetState *set_state)
+{
+  GNUNET_free (set_state);
+}
+
+
+/**
+ * Remove the element given in the element message from the set.
+ *
+ * @param set_state state of the set to remove from
+ * @param element set element to remove
+ */
+static void
+intersection_remove (struct SetState *set_state,
+                     struct ElementEntry *element)
+{
+  GNUNET_assert (0 < set_state->current_set_element_count);
+  set_state->current_set_element_count--;
+}
+
+
+/**
+ * Callback for channel death for the intersection operation.
+ *
+ * @param op operation that lost the channel
+ */
+static void
+intersection_channel_death (struct Operation *op)
+{
+  if (GNUNET_YES == op->state->channel_death_expected)
+  {
+    /* oh goodie, we are done! */
+    send_client_done_and_destroy (op);
+  }
+  else
+  {
+    /* sorry, channel went down early, too bad. */
+    _GSS_operation_destroy (op,
+                            GNUNET_YES);
+  }
+}
+
+
+/**
+ * Get the table with implementing functions for set intersection.
+ *
+ * @return the operation specific VTable
+ */
+const struct SetVT *
+_GSS_intersection_vt ()
+{
+  static const struct SetVT intersection_vt = {
+    .create = &intersection_set_create,
+    .add = &intersection_add,
+    .remove = &intersection_remove,
+    .destroy_set = &intersection_set_destroy,
+    .evaluate = &intersection_evaluate,
+    .accept = &intersection_accept,
+    .cancel = &intersection_op_cancel,
+    .channel_death = &intersection_channel_death,
+  };
+
+  return &intersection_vt;
+}
diff --git a/src/contrib/service/set/gnunet-service-set_intersection.h b/src/contrib/service/set/gnunet-service-set_intersection.h
new file mode 100644
index 000000000..d8884d0a7
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_intersection.h
@@ -0,0 +1,79 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set_intersection.h
+ * @brief two-peer set operations
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_SET_INTERSECTION_H
+#define GNUNET_SERVICE_SET_INTERSECTION_H
+
+#include "gnunet-service-set.h"
+
+
+/**
+ * Check an BF message from a remote peer.
+ *
+ * @param cls the intersection operation
+ * @param msg the header of the message
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+int
+check_intersection_p2p_bf (void *cls,
+                           const struct BFMessage *msg);
+
+
+/**
+ * Handle an BF message from a remote peer.
+ *
+ * @param cls the intersection operation
+ * @param msg the header of the message
+ */
+void
+handle_intersection_p2p_bf (void *cls,
+                            const struct BFMessage *msg);
+
+
+/**
+ * Handle the initial `struct IntersectionElementInfoMessage` from a
+ * remote peer.
+ *
+ * @param cls the intersection operation
+ * @param msg the header of the message
+ */
+void
+handle_intersection_p2p_element_info (void *cls,
+                                      const struct
+                                      IntersectionElementInfoMessage *msg);
+
+
+/**
+ * Handle a done message from a remote peer
+ *
+ * @param cls the intersection operation
+ * @param mh the message
+ */
+void
+handle_intersection_p2p_done (void *cls,
+                              const struct IntersectionDoneMessage *idm);
+
+
+#endif
diff --git a/src/contrib/service/set/gnunet-service-set_protocol.h b/src/contrib/service/set/gnunet-service-set_protocol.h
new file mode 100644
index 000000000..a2803ee47
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_protocol.h
@@ -0,0 +1,226 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2013, 2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @author Florian Dold
+ * @author Christian Grothoff
+ * @file set/gnunet-service-set_protocol.h
+ * @brief Peer-to-Peer messages for gnunet set
+ */
+#ifndef SET_PROTOCOL_H
+#define SET_PROTOCOL_H
+
+#include "platform.h"
+#include "gnunet_common.h"
+
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+struct OperationRequestMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Operation to request, values from `enum GNUNET_SET_OperationType`
+   */
+  uint32_t operation GNUNET_PACKED;
+
+  /**
+   * For Intersection: my element count
+   */
+  uint32_t element_count GNUNET_PACKED;
+
+  /**
+   * Application-specific identifier of the request.
+   */
+  struct GNUNET_HashCode app_idX;
+
+  /* rest: optional message */
+};
+
+
+/**
+ * Message containing buckets of an invertible bloom filter.
+ *
+ * If an IBF has too many buckets for an IBF message,
+ * it is split into multiple messages.
+ */
+struct IBFMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_UNION_P2P_IBF
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Order of the whole ibf, where
+   * num_buckets = 2^order
+   */
+  uint8_t order;
+
+  /**
+   * Padding, must be 0.
+   */
+  uint8_t reserved1;
+
+  /**
+   * Padding, must be 0.
+   */
+  uint16_t reserved2 GNUNET_PACKED;
+
+  /**
+   * Offset of the strata in the rest of the message
+   */
+  uint32_t offset GNUNET_PACKED;
+
+  /**
+   * Salt used when hashing elements for this IBF.
+   */
+  uint32_t salt GNUNET_PACKED;
+
+  /* rest: buckets */
+};
+
+
+struct InquiryMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_UNION_P2P_IBF
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Salt used when hashing elements for this inquiry.
+   */
+  uint32_t salt GNUNET_PACKED;
+
+  /**
+   * Reserved, set to 0.
+   */
+  uint32_t reserved GNUNET_PACKED;
+
+  /* rest: inquiry IBF keys */
+};
+
+
+/**
+ * During intersection, the first (and possibly second) message
+ * send it the number of elements in the set, to allow the peers
+ * to decide who should start with the Bloom filter.
+ */
+struct IntersectionElementInfoMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_ELEMENT_INFO
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * mutator used with this bloomfilter.
+   */
+  uint32_t sender_element_count GNUNET_PACKED;
+};
+
+
+/**
+ * Bloom filter messages exchanged for set intersection calculation.
+ */
+struct BFMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_BF
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Number of elements the sender still has in the set.
+   */
+  uint32_t sender_element_count GNUNET_PACKED;
+
+  /**
+   * XOR of all hashes over all elements remaining in the set.
+   * Used to determine termination.
+   */
+  struct GNUNET_HashCode element_xor_hash;
+
+  /**
+   * Mutator used with this bloomfilter.
+   */
+  uint32_t sender_mutator GNUNET_PACKED;
+
+  /**
+   * Total length of the bloomfilter data.
+   */
+  uint32_t bloomfilter_total_length GNUNET_PACKED;
+
+  /**
+   * Number of bits (k-value) used in encoding the bloomfilter.
+   */
+  uint32_t bits_per_element GNUNET_PACKED;
+
+  /**
+   * rest: the sender's bloomfilter
+   */
+};
+
+
+/**
+ * Last message, send to confirm the final set.  Contains the element
+ * count as it is possible that the peer determined that we were done
+ * by getting the empty set, which in that case also needs to be
+ * communicated.
+ */
+struct IntersectionDoneMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_INTERSECTION_P2P_DONE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Final number of elements in intersection.
+   */
+  uint32_t final_element_count GNUNET_PACKED;
+
+  /**
+   * XOR of all hashes over all elements remaining in the set.
+   */
+  struct GNUNET_HashCode element_xor_hash;
+};
+
+
+/**
+ * Strata estimator together with the peer's overall set size.
+ */
+struct StrataEstimatorMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SE(C)
+   */
+  struct GNUNET_MessageHeader header;
+
+  uint64_t set_size;
+};
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/contrib/service/set/gnunet-service-set_union.c b/src/contrib/service/set/gnunet-service-set_union.c
new file mode 100644
index 000000000..3a2bc8bd7
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_union.c
@@ -0,0 +1,2463 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set_union.c
+ * @brief two-peer set operations
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_statistics_service.h"
+#include "gnunet-service-set.h"
+#include "ibf.h"
+#include "gnunet-service-set_union.h"
+#include "gnunet-service-set_union_strata_estimator.h"
+#include "gnunet-service-set_protocol.h"
+#include <gcrypt.h>
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "set-union", __VA_ARGS__)
+
+
+/**
+ * Number of IBFs in a strata estimator.
+ */
+#define SE_STRATA_COUNT 32
+
+/**
+ * Size of the IBFs in the strata estimator.
+ */
+#define SE_IBF_SIZE 80
+
+/**
+ * The hash num parameter for the difference digests and strata estimators.
+ */
+#define SE_IBF_HASH_NUM 4
+
+/**
+ * Number of buckets that can be transmitted in one message.
+ */
+#define MAX_BUCKETS_PER_MESSAGE ((1 << 15) / IBF_BUCKET_SIZE)
+
+/**
+ * The maximum size of an ibf we use is 2^(MAX_IBF_ORDER).
+ * Choose this value so that computing the IBF is still cheaper
+ * than transmitting all values.
+ */
+#define MAX_IBF_ORDER (20)
+
+/**
+ * Number of buckets used in the ibf per estimated
+ * difference.
+ */
+#define IBF_ALPHA 4
+
+
+/**
+ * Current phase we are in for a union operation.
+ */
+enum UnionOperationPhase
+{
+  /**
+   * We sent the request message, and expect a strata estimator.
+   */
+  PHASE_EXPECT_SE,
+
+  /**
+   * We sent the strata estimator, and expect an IBF. This phase is entered once
+   * upon initialization and later via #PHASE_EXPECT_ELEMENTS_AND_REQUESTS.
+   *
+   * XXX: could use better wording.
+   * XXX: repurposed to also expect a "request full set" message, should be renamed
+   *
+   * After receiving the complete IBF, we enter #PHASE_EXPECT_ELEMENTS
+   */
+  PHASE_EXPECT_IBF,
+
+  /**
+   * Continuation for multi part IBFs.
+   */
+  PHASE_EXPECT_IBF_CONT,
+
+  /**
+   * We are decoding an IBF.
+   */
+  PHASE_INVENTORY_ACTIVE,
+
+  /**
+   * The other peer is decoding the IBF we just sent.
+   */
+  PHASE_INVENTORY_PASSIVE,
+
+  /**
+   * The protocol is almost finished, but we still have to flush our message
+   * queue and/or expect some elements.
+   */
+  PHASE_FINISH_CLOSING,
+
+  /**
+   * In the penultimate phase,
+   * we wait until all our demands
+   * are satisfied.  Then we send a done
+   * message, and wait for another done message.
+   */
+  PHASE_FINISH_WAITING,
+
+  /**
+   * In the ultimate phase, we wait until
+   * our demands are satisfied and then
+   * quit (sending another DONE message).
+   */
+  PHASE_DONE,
+
+  /**
+   * After sending the full set, wait for responses with the elements
+   * that the local peer is missing.
+   */
+  PHASE_FULL_SENDING,
+};
+
+
+/**
+ * State of an evaluate operation with another peer.
+ */
+struct OperationState
+{
+  /**
+   * Copy of the set's strata estimator at the time of
+   * creation of this operation.
+   */
+  struct StrataEstimator *se;
+
+  /**
+   * The IBF we currently receive.
+   */
+  struct InvertibleBloomFilter *remote_ibf;
+
+  /**
+   * The IBF with the local set's element.
+   */
+  struct InvertibleBloomFilter *local_ibf;
+
+  /**
+   * Maps unsalted IBF-Keys to elements.
+   * Used as a multihashmap, the keys being the lower 32bit of the IBF-Key.
+   * Colliding IBF-Keys are linked.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap32 *key_to_element;
+
+  /**
+   * Current state of the operation.
+   */
+  enum UnionOperationPhase phase;
+
+  /**
+   * Did we send the client that we are done?
+   */
+  int client_done_sent;
+
+  /**
+   * Number of ibf buckets already received into the @a remote_ibf.
+   */
+  unsigned int ibf_buckets_received;
+
+  /**
+   * Hashes for elements that we have demanded from the other peer.
+   */
+  struct GNUNET_CONTAINER_MultiHashMap *demanded_hashes;
+
+  /**
+   * Salt that we're using for sending IBFs
+   */
+  uint32_t salt_send;
+
+  /**
+   * Salt for the IBF we've received and that we're currently decoding.
+   */
+  uint32_t salt_receive;
+
+  /**
+   * Number of elements we received from the other peer
+   * that were not in the local set yet.
+   */
+  uint32_t received_fresh;
+
+  /**
+   * Total number of elements received from the other peer.
+   */
+  uint32_t received_total;
+
+  /**
+   * Initial size of our set, just before
+   * the operation started.
+   */
+  uint64_t initial_size;
+};
+
+
+/**
+ * The key entry is used to associate an ibf key with an element.
+ */
+struct KeyEntry
+{
+  /**
+   * IBF key for the entry, derived from the current salt.
+   */
+  struct IBF_Key ibf_key;
+
+  /**
+   * The actual element associated with the key.
+   *
+   * Only owned by the union operation if element->operation
+   * is #GNUNET_YES.
+   */
+  struct ElementEntry *element;
+
+  /**
+   * Did we receive this element?
+   * Even if element->is_foreign is false, we might
+   * have received the element, so this indicates that
+   * the other peer has it.
+   */
+  int received;
+};
+
+
+/**
+ * Used as a closure for sending elements
+ * with a specific IBF key.
+ */
+struct SendElementClosure
+{
+  /**
+   * The IBF key whose matching elements should be
+   * sent.
+   */
+  struct IBF_Key ibf_key;
+
+  /**
+   * Operation for which the elements
+   * should be sent.
+   */
+  struct Operation *op;
+};
+
+
+/**
+ * Extra state required for efficient set union.
+ */
+struct SetState
+{
+  /**
+   * The strata estimator is only generated once for
+   * each set.
+   * The IBF keys are derived from the element hashes with
+   * salt=0.
+   */
+  struct StrataEstimator *se;
+};
+
+
+/**
+ * Iterator over hash map entries, called to
+ * destroy the linked list of colliding ibf key entries.
+ *
+ * @param cls closure
+ * @param key current key code
+ * @param value value in the hash map
+ * @return #GNUNET_YES if we should continue to iterate,
+ *         #GNUNET_NO if not.
+ */
+static int
+destroy_key_to_element_iter (void *cls,
+                             uint32_t key,
+                             void *value)
+{
+  struct KeyEntry *k = value;
+
+  GNUNET_assert (NULL != k);
+  if (GNUNET_YES == k->element->remote)
+  {
+    GNUNET_free (k->element);
+    k->element = NULL;
+  }
+  GNUNET_free (k);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Destroy the union operation.  Only things specific to the union
+ * operation are destroyed.
+ *
+ * @param op union operation to destroy
+ */
+static void
+union_op_cancel (struct Operation *op)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "destroying union op\n");
+  /* check if the op was canceled twice */
+  GNUNET_assert (NULL != op->state);
+  if (NULL != op->state->remote_ibf)
+  {
+    ibf_destroy (op->state->remote_ibf);
+    op->state->remote_ibf = NULL;
+  }
+  if (NULL != op->state->demanded_hashes)
+  {
+    GNUNET_CONTAINER_multihashmap_destroy (op->state->demanded_hashes);
+    op->state->demanded_hashes = NULL;
+  }
+  if (NULL != op->state->local_ibf)
+  {
+    ibf_destroy (op->state->local_ibf);
+    op->state->local_ibf = NULL;
+  }
+  if (NULL != op->state->se)
+  {
+    strata_estimator_destroy (op->state->se);
+    op->state->se = NULL;
+  }
+  if (NULL != op->state->key_to_element)
+  {
+    GNUNET_CONTAINER_multihashmap32_iterate (op->state->key_to_element,
+                                             &destroy_key_to_element_iter,
+                                             NULL);
+    GNUNET_CONTAINER_multihashmap32_destroy (op->state->key_to_element);
+    op->state->key_to_element = NULL;
+  }
+  GNUNET_free (op->state);
+  op->state = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "destroying union op done\n");
+}
+
+
+/**
+ * Inform the client that the union operation has failed,
+ * and proceed to destroy the evaluate operation.
+ *
+ * @param op the union operation to fail
+ */
+static void
+fail_union_operation (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *msg;
+
+  LOG (GNUNET_ERROR_TYPE_WARNING,
+       "union operation failed\n");
+  ev = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_SET_RESULT);
+  msg->result_status = htons (GNUNET_SET_STATUS_FAILURE);
+  msg->request_id = htonl (op->client_request_id);
+  msg->element_type = htons (0);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+  _GSS_operation_destroy (op, GNUNET_YES);
+}
+
+
+/**
+ * Derive the IBF key from a hash code and
+ * a salt.
+ *
+ * @param src the hash code
+ * @return the derived IBF key
+ */
+static struct IBF_Key
+get_ibf_key (const struct GNUNET_HashCode *src)
+{
+  struct IBF_Key key;
+  uint16_t salt = 0;
+
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CRYPTO_kdf (&key, sizeof(key),
+                                    src, sizeof *src,
+                                    &salt, sizeof(salt),
+                                    NULL, 0));
+  return key;
+}
+
+
+/**
+ * Context for #op_get_element_iterator
+ */
+struct GetElementContext
+{
+  /**
+   * FIXME.
+   */
+  struct GNUNET_HashCode hash;
+
+  /**
+   * FIXME.
+   */
+  struct KeyEntry *k;
+};
+
+
+/**
+ * Iterator over the mapping from IBF keys to element entries.  Checks if we
+ * have an element with a given GNUNET_HashCode.
+ *
+ * @param cls closure
+ * @param key current key code
+ * @param value value in the hash map
+ * @return #GNUNET_YES if we should search further,
+ *         #GNUNET_NO if we've found the element.
+ */
+static int
+op_get_element_iterator (void *cls,
+                         uint32_t key,
+                         void *value)
+{
+  struct GetElementContext *ctx = cls;
+  struct KeyEntry *k = value;
+
+  GNUNET_assert (NULL != k);
+  if (0 == GNUNET_CRYPTO_hash_cmp (&k->element->element_hash,
+                                   &ctx->hash))
+  {
+    ctx->k = k;
+    return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Determine whether the given element is already in the operation's element
+ * set.
+ *
+ * @param op operation that should be tested for 'element_hash'
+ * @param element_hash hash of the element to look for
+ * @return #GNUNET_YES if the element has been found, #GNUNET_NO otherwise
+ */
+static struct KeyEntry *
+op_get_element (struct Operation *op,
+                const struct GNUNET_HashCode *element_hash)
+{
+  int ret;
+  struct IBF_Key ibf_key;
+  struct GetElementContext ctx = { { { 0 } }, 0 };
+
+  ctx.hash = *element_hash;
+
+  ibf_key = get_ibf_key (element_hash);
+  ret = GNUNET_CONTAINER_multihashmap32_get_multiple (op->state->key_to_element,
+                                                      (uint32_t) ibf_key.key_val,
+                                                      op_get_element_iterator,
+                                                      &ctx);
+
+  /* was the iteration aborted because we found the element? */
+  if (GNUNET_SYSERR == ret)
+  {
+    GNUNET_assert (NULL != ctx.k);
+    return ctx.k;
+  }
+  return NULL;
+}
+
+
+/**
+ * Insert an element into the union operation's
+ * key-to-element mapping. Takes ownership of 'ee'.
+ * Note that this does not insert the element in the set,
+ * only in the operation's key-element mapping.
+ * This is done to speed up re-tried operations, if some elements
+ * were transmitted, and then the IBF fails to decode.
+ *
+ * XXX: clarify ownership, doesn't sound right.
+ *
+ * @param op the union operation
+ * @param ee the element entry
+ * @param received was this element received from the remote peer?
+ */
+static void
+op_register_element (struct Operation *op,
+                     struct ElementEntry *ee,
+                     int received)
+{
+  struct IBF_Key ibf_key;
+  struct KeyEntry *k;
+
+  ibf_key = get_ibf_key (&ee->element_hash);
+  k = GNUNET_new (struct KeyEntry);
+  k->element = ee;
+  k->ibf_key = ibf_key;
+  k->received = received;
+  GNUNET_assert (GNUNET_OK ==
+                 GNUNET_CONTAINER_multihashmap32_put (op->state->key_to_element,
+                                                      (uint32_t) ibf_key.key_val,
+                                                      k,
+                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+}
+
+
+/**
+ * FIXME.
+ */
+static void
+salt_key (const struct IBF_Key *k_in,
+          uint32_t salt,
+          struct IBF_Key *k_out)
+{
+  int s = salt % 64;
+  uint64_t x = k_in->key_val;
+
+  /* rotate ibf key */
+  x = (x >> s) | (x << (64 - s));
+  k_out->key_val = x;
+}
+
+
+/**
+ * FIXME.
+ */
+static void
+unsalt_key (const struct IBF_Key *k_in,
+            uint32_t salt,
+            struct IBF_Key *k_out)
+{
+  int s = salt % 64;
+  uint64_t x = k_in->key_val;
+
+  x = (x << s) | (x >> (64 - s));
+  k_out->key_val = x;
+}
+
+
+/**
+ * Insert a key into an ibf.
+ *
+ * @param cls the ibf
+ * @param key unused
+ * @param value the key entry to get the key from
+ */
+static int
+prepare_ibf_iterator (void *cls,
+                      uint32_t key,
+                      void *value)
+{
+  struct Operation *op = cls;
+  struct KeyEntry *ke = value;
+  struct IBF_Key salted_key;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "[OP %p] inserting %lx (hash %s) into ibf\n",
+       op,
+       (unsigned long) ke->ibf_key.key_val,
+       GNUNET_h2s (&ke->element->element_hash));
+  salt_key (&ke->ibf_key,
+            op->state->salt_send,
+            &salted_key);
+  ibf_insert (op->state->local_ibf, salted_key);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Iterator for initializing the
+ * key-to-element mapping of a union operation
+ *
+ * @param cls the union operation `struct Operation *`
+ * @param key unused
+ * @param value the `struct ElementEntry *` to insert
+ *        into the key-to-element mapping
+ * @return #GNUNET_YES (to continue iterating)
+ */
+static int
+init_key_to_element_iterator (void *cls,
+                              const struct GNUNET_HashCode *key,
+                              void *value)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee = value;
+
+  /* make sure that the element belongs to the set at the time
+   * of creating the operation */
+  if (GNUNET_NO ==
+      _GSS_is_element_of_operation (ee,
+                                    op))
+    return GNUNET_YES;
+  GNUNET_assert (GNUNET_NO == ee->remote);
+  op_register_element (op,
+                       ee,
+                       GNUNET_NO);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Initialize the IBF key to element mapping local to this set
+ * operation.
+ *
+ * @param op the set union operation
+ */
+static void
+initialize_key_to_element (struct Operation *op)
+{
+  unsigned int len;
+
+  GNUNET_assert (NULL == op->state->key_to_element);
+  len = GNUNET_CONTAINER_multihashmap_size (op->set->content->elements);
+  op->state->key_to_element = GNUNET_CONTAINER_multihashmap32_create (len + 1);
+  GNUNET_CONTAINER_multihashmap_iterate (op->set->content->elements,
+                                         &init_key_to_element_iterator,
+                                         op);
+}
+
+
+/**
+ * Create an ibf with the operation's elements
+ * of the specified size
+ *
+ * @param op the union operation
+ * @param size size of the ibf to create
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+prepare_ibf (struct Operation *op,
+             uint32_t size)
+{
+  GNUNET_assert (NULL != op->state->key_to_element);
+
+  if (NULL != op->state->local_ibf)
+    ibf_destroy (op->state->local_ibf);
+  op->state->local_ibf = ibf_create (size, SE_IBF_HASH_NUM);
+  if (NULL == op->state->local_ibf)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to allocate local IBF\n");
+    return GNUNET_SYSERR;
+  }
+  GNUNET_CONTAINER_multihashmap32_iterate (op->state->key_to_element,
+                                           &prepare_ibf_iterator,
+                                           op);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Send an ibf of appropriate size.
+ *
+ * Fragments the IBF into multiple messages if necessary.
+ *
+ * @param op the union operation
+ * @param ibf_order order of the ibf to send, size=2^order
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+send_ibf (struct Operation *op,
+          uint16_t ibf_order)
+{
+  unsigned int buckets_sent = 0;
+  struct InvertibleBloomFilter *ibf;
+
+  if (GNUNET_OK !=
+      prepare_ibf (op, 1 << ibf_order))
+  {
+    /* allocation failed */
+    return GNUNET_SYSERR;
+  }
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sending ibf of size %u\n",
+       1 << ibf_order);
+
+  {
+    char name[64] = { 0 };
+    snprintf (name, sizeof(name), "# sent IBF (order %u)", ibf_order);
+    GNUNET_STATISTICS_update (_GSS_statistics, name, 1, GNUNET_NO);
+  }
+
+  ibf = op->state->local_ibf;
+
+  while (buckets_sent < (1 << ibf_order))
+  {
+    unsigned int buckets_in_message;
+    struct GNUNET_MQ_Envelope *ev;
+    struct IBFMessage *msg;
+
+    buckets_in_message = (1 << ibf_order) - buckets_sent;
+    /* limit to maximum */
+    if (buckets_in_message > MAX_BUCKETS_PER_MESSAGE)
+      buckets_in_message = MAX_BUCKETS_PER_MESSAGE;
+
+    ev = GNUNET_MQ_msg_extra (msg,
+                              buckets_in_message * IBF_BUCKET_SIZE,
+                              GNUNET_MESSAGE_TYPE_SET_UNION_P2P_IBF);
+    msg->reserved1 = 0;
+    msg->reserved2 = 0;
+    msg->order = ibf_order;
+    msg->offset = htonl (buckets_sent);
+    msg->salt = htonl (op->state->salt_send);
+    ibf_write_slice (ibf, buckets_sent,
+                     buckets_in_message, &msg[1]);
+    buckets_sent += buckets_in_message;
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "ibf chunk size %u, %u/%u sent\n",
+         buckets_in_message,
+         buckets_sent,
+         1 << ibf_order);
+    GNUNET_MQ_send (op->mq, ev);
+  }
+
+  /* The other peer must decode the IBF, so
+   * we're passive. */
+  op->state->phase = PHASE_INVENTORY_PASSIVE;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Compute the necessary order of an ibf
+ * from the size of the symmetric set difference.
+ *
+ * @param diff the difference
+ * @return the required size of the ibf
+ */
+static unsigned int
+get_order_from_difference (unsigned int diff)
+{
+  unsigned int ibf_order;
+
+  ibf_order = 2;
+  while (((1 << ibf_order) < (IBF_ALPHA * diff) ||
+          ((1 << ibf_order) < SE_IBF_HASH_NUM)) &&
+         (ibf_order < MAX_IBF_ORDER))
+    ibf_order++;
+  // add one for correction
+  return ibf_order + 1;
+}
+
+
+/**
+ * Send a set element.
+ *
+ * @param cls the union operation `struct Operation *`
+ * @param key unused
+ * @param value the `struct ElementEntry *` to insert
+ *        into the key-to-element mapping
+ * @return #GNUNET_YES (to continue iterating)
+ */
+static int
+send_full_element_iterator (void *cls,
+                            const struct GNUNET_HashCode *key,
+                            void *value)
+{
+  struct Operation *op = cls;
+  struct GNUNET_SET_ElementMessage *emsg;
+  struct ElementEntry *ee = value;
+  struct GNUNET_SET_Element *el = &ee->element;
+  struct GNUNET_MQ_Envelope *ev;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Sending element %s\n",
+       GNUNET_h2s (key));
+  ev = GNUNET_MQ_msg_extra (emsg,
+                            el->size,
+                            GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_ELEMENT);
+  emsg->element_type = htons (el->element_type);
+  GNUNET_memcpy (&emsg[1],
+                 el->data,
+                 el->size);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Switch to full set transmission for @a op.
+ *
+ * @param op operation to switch to full set transmission.
+ */
+static void
+send_full_set (struct Operation *op)
+{
+  struct GNUNET_MQ_Envelope *ev;
+
+  op->state->phase = PHASE_FULL_SENDING;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Dedicing to transmit the full set\n");
+  /* FIXME: use a more memory-friendly way of doing this with an
+     iterator, just as we do in the non-full case! */
+  (void) GNUNET_CONTAINER_multihashmap_iterate (op->set->content->elements,
+                                                &send_full_element_iterator,
+                                                op);
+  ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_DONE);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+}
+
+
+/**
+ * Handle a strata estimator from a remote peer
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+int
+check_union_p2p_strata_estimator (void *cls,
+                                  const struct StrataEstimatorMessage *msg)
+{
+  struct Operation *op = cls;
+  int is_compressed;
+  size_t len;
+
+  if (op->state->phase != PHASE_EXPECT_SE)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  is_compressed = (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SEC == htons (
+                     msg->header.type));
+  len = ntohs (msg->header.size) - sizeof(struct StrataEstimatorMessage);
+  if ((GNUNET_NO == is_compressed) &&
+      (len != SE_STRATA_COUNT * SE_IBF_SIZE * IBF_BUCKET_SIZE))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle a strata estimator from a remote peer
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+void
+handle_union_p2p_strata_estimator (void *cls,
+                                   const struct StrataEstimatorMessage *msg)
+{
+  struct Operation *op = cls;
+  struct StrataEstimator *remote_se;
+  unsigned int diff;
+  uint64_t other_size;
+  size_t len;
+  int is_compressed;
+
+  is_compressed = (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SEC == htons (
+                     msg->header.type));
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# bytes of SE received",
+                            ntohs (msg->header.size),
+                            GNUNET_NO);
+  len = ntohs (msg->header.size) - sizeof(struct StrataEstimatorMessage);
+  other_size = GNUNET_ntohll (msg->set_size);
+  remote_se = strata_estimator_create (SE_STRATA_COUNT,
+                                       SE_IBF_SIZE,
+                                       SE_IBF_HASH_NUM);
+  if (NULL == remote_se)
+  {
+    /* insufficient resources, fail */
+    fail_union_operation (op);
+    return;
+  }
+  if (GNUNET_OK !=
+      strata_estimator_read (&msg[1],
+                             len,
+                             is_compressed,
+                             remote_se))
+  {
+    /* decompression failed */
+    strata_estimator_destroy (remote_se);
+    fail_union_operation (op);
+    return;
+  }
+  GNUNET_assert (NULL != op->state->se);
+  diff = strata_estimator_difference (remote_se,
+                                      op->state->se);
+
+  if (diff > 200)
+    diff = diff * 3 / 2;
+
+  strata_estimator_destroy (remote_se);
+  strata_estimator_destroy (op->state->se);
+  op->state->se = NULL;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "got se diff=%d, using ibf size %d\n",
+       diff,
+       1U << get_order_from_difference (diff));
+
+  {
+    char *set_debug;
+
+    set_debug = getenv ("GNUNET_SET_BENCHMARK");
+    if ((NULL != set_debug) &&
+        (0 == strcmp (set_debug, "1")))
+    {
+      FILE *f = fopen ("set.log", "a");
+      fprintf (f, "%llu\n", (unsigned long long) diff);
+      fclose (f);
+    }
+  }
+
+  if ((GNUNET_YES == op->byzantine) &&
+      (other_size < op->byzantine_lower_bound))
+  {
+    GNUNET_break (0);
+    fail_union_operation (op);
+    return;
+  }
+
+  if ((GNUNET_YES == op->force_full) ||
+      (diff > op->state->initial_size / 4) ||
+      (0 == other_size))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Deciding to go for full set transmission (diff=%d, own set=%llu)\n",
+         diff,
+         (unsigned long long) op->state->initial_size);
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# of full sends",
+                              1,
+                              GNUNET_NO);
+    if ((op->state->initial_size <= other_size) ||
+        (0 == other_size))
+    {
+      send_full_set (op);
+    }
+    else
+    {
+      struct GNUNET_MQ_Envelope *ev;
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Telling other peer that we expect its full set\n");
+      op->state->phase = PHASE_EXPECT_IBF;
+      ev = GNUNET_MQ_msg_header (
+        GNUNET_MESSAGE_TYPE_SET_UNION_P2P_REQUEST_FULL);
+      GNUNET_MQ_send (op->mq,
+                      ev);
+    }
+  }
+  else
+  {
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# of ibf sends",
+                              1,
+                              GNUNET_NO);
+    if (GNUNET_OK !=
+        send_ibf (op,
+                  get_order_from_difference (diff)))
+    {
+      /* Internal error, best we can do is shut the connection */
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to send IBF, closing connection\n");
+      fail_union_operation (op);
+      return;
+    }
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Iterator to send elements to a remote peer
+ *
+ * @param cls closure with the element key and the union operation
+ * @param key ignored
+ * @param value the key entry
+ */
+static int
+send_offers_iterator (void *cls,
+                      uint32_t key,
+                      void *value)
+{
+  struct SendElementClosure *sec = cls;
+  struct Operation *op = sec->op;
+  struct KeyEntry *ke = value;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_MessageHeader *mh;
+
+  /* Detect 32-bit key collision for the 64-bit IBF keys. */
+  if (ke->ibf_key.key_val != sec->ibf_key.key_val)
+    return GNUNET_YES;
+
+  ev = GNUNET_MQ_msg_header_extra (mh,
+                                   sizeof(struct GNUNET_HashCode),
+                                   GNUNET_MESSAGE_TYPE_SET_UNION_P2P_OFFER);
+
+  GNUNET_assert (NULL != ev);
+  *(struct GNUNET_HashCode *) &mh[1] = ke->element->element_hash;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "[OP %p] sending element offer (%s) to peer\n",
+       op,
+       GNUNET_h2s (&ke->element->element_hash));
+  GNUNET_MQ_send (op->mq, ev);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Send offers (in the form of GNUNET_Hash-es) to the remote peer for the given IBF key.
+ *
+ * @param op union operation
+ * @param ibf_key IBF key of interest
+ */
+static void
+send_offers_for_key (struct Operation *op,
+                     struct IBF_Key ibf_key)
+{
+  struct SendElementClosure send_cls;
+
+  send_cls.ibf_key = ibf_key;
+  send_cls.op = op;
+  (void) GNUNET_CONTAINER_multihashmap32_get_multiple (
+    op->state->key_to_element,
+    (uint32_t) ibf_key.
+    key_val,
+    &send_offers_iterator,
+    &send_cls);
+}
+
+
+/**
+ * Decode which elements are missing on each side, and
+ * send the appropriate offers and inquiries.
+ *
+ * @param op union operation
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR on failure
+ */
+static int
+decode_and_send (struct Operation *op)
+{
+  struct IBF_Key key;
+  struct IBF_Key last_key;
+  int side;
+  unsigned int num_decoded;
+  struct InvertibleBloomFilter *diff_ibf;
+
+  GNUNET_assert (PHASE_INVENTORY_ACTIVE == op->state->phase);
+
+  if (GNUNET_OK !=
+      prepare_ibf (op,
+                   op->state->remote_ibf->size))
+  {
+    GNUNET_break (0);
+    /* allocation failed */
+    return GNUNET_SYSERR;
+  }
+  diff_ibf = ibf_dup (op->state->local_ibf);
+  ibf_subtract (diff_ibf,
+                op->state->remote_ibf);
+
+  ibf_destroy (op->state->remote_ibf);
+  op->state->remote_ibf = NULL;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "decoding IBF (size=%u)\n",
+       diff_ibf->size);
+
+  num_decoded = 0;
+  key.key_val = 0; /* just to avoid compiler thinking we use undef'ed variable */
+
+  while (1)
+  {
+    int res;
+    int cycle_detected = GNUNET_NO;
+
+    last_key = key;
+
+    res = ibf_decode (diff_ibf, &side, &key);
+    if (res == GNUNET_OK)
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "decoded ibf key %lx\n",
+           (unsigned long) key.key_val);
+      num_decoded += 1;
+      if ((num_decoded > diff_ibf->size) ||
+          ((num_decoded > 1) &&
+           (last_key.key_val == key.key_val)))
+      {
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "detected cyclic ibf (decoded %u/%u)\n",
+             num_decoded,
+             diff_ibf->size);
+        cycle_detected = GNUNET_YES;
+      }
+    }
+    if ((GNUNET_SYSERR == res) ||
+        (GNUNET_YES == cycle_detected))
+    {
+      int next_order;
+      next_order = 0;
+      while (1 << next_order < diff_ibf->size)
+        next_order++;
+      next_order++;
+      if (next_order <= MAX_IBF_ORDER)
+      {
+        LOG (GNUNET_ERROR_TYPE_DEBUG,
+             "decoding failed, sending larger ibf (size %u)\n",
+             1 << next_order);
+        GNUNET_STATISTICS_update (_GSS_statistics,
+                                  "# of IBF retries",
+                                  1,
+                                  GNUNET_NO);
+        op->state->salt_send++;
+        if (GNUNET_OK !=
+            send_ibf (op, next_order))
+        {
+          /* Internal error, best we can do is shut the connection */
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                      "Failed to send IBF, closing connection\n");
+          fail_union_operation (op);
+          ibf_destroy (diff_ibf);
+          return GNUNET_SYSERR;
+        }
+      }
+      else
+      {
+        GNUNET_STATISTICS_update (_GSS_statistics,
+                                  "# of failed union operations (too large)",
+                                  1,
+                                  GNUNET_NO);
+        // XXX: Send the whole set, element-by-element
+        LOG (GNUNET_ERROR_TYPE_ERROR,
+             "set union failed: reached ibf limit\n");
+        fail_union_operation (op);
+        ibf_destroy (diff_ibf);
+        return GNUNET_SYSERR;
+      }
+      break;
+    }
+    if (GNUNET_NO == res)
+    {
+      struct GNUNET_MQ_Envelope *ev;
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "transmitted all values, sending DONE\n");
+      ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DONE);
+      GNUNET_MQ_send (op->mq, ev);
+      /* We now wait until we get a DONE message back
+       * and then wait for our MQ to be flushed and all our
+       * demands be delivered. */
+      break;
+    }
+    if (1 == side)
+    {
+      struct IBF_Key unsalted_key;
+
+      unsalt_key (&key,
+                  op->state->salt_receive,
+                  &unsalted_key);
+      send_offers_for_key (op,
+                           unsalted_key);
+    }
+    else if (-1 == side)
+    {
+      struct GNUNET_MQ_Envelope *ev;
+      struct InquiryMessage *msg;
+
+      /* It may be nice to merge multiple requests, but with CADET's corking it is not worth
+       * the effort additional complexity. */
+      ev = GNUNET_MQ_msg_extra (msg,
+                                sizeof(struct IBF_Key),
+                                GNUNET_MESSAGE_TYPE_SET_UNION_P2P_INQUIRY);
+      msg->salt = htonl (op->state->salt_receive);
+      GNUNET_memcpy (&msg[1],
+                     &key,
+                     sizeof(struct IBF_Key));
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "sending element inquiry for IBF key %lx\n",
+           (unsigned long) key.key_val);
+      GNUNET_MQ_send (op->mq, ev);
+    }
+    else
+    {
+      GNUNET_assert (0);
+    }
+  }
+  ibf_destroy (diff_ibf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Check an IBF message from a remote peer.
+ *
+ * Reassemble the IBF from multiple pieces, and
+ * process the whole IBF once possible.
+ *
+ * @param cls the union operation
+ * @param msg the header of the message
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+int
+check_union_p2p_ibf (void *cls,
+                     const struct IBFMessage *msg)
+{
+  struct Operation *op = cls;
+  unsigned int buckets_in_message;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  buckets_in_message = (ntohs (msg->header.size) - sizeof *msg)
+                       / IBF_BUCKET_SIZE;
+  if (0 == buckets_in_message)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if ((ntohs (msg->header.size) - sizeof *msg) != buckets_in_message
+      * IBF_BUCKET_SIZE)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (op->state->phase == PHASE_EXPECT_IBF_CONT)
+  {
+    if (ntohl (msg->offset) != op->state->ibf_buckets_received)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    if (1 << msg->order != op->state->remote_ibf->size)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+    if (ntohl (msg->salt) != op->state->salt_receive)
+    {
+      GNUNET_break_op (0);
+      return GNUNET_SYSERR;
+    }
+  }
+  else if ((op->state->phase != PHASE_INVENTORY_PASSIVE) &&
+           (op->state->phase != PHASE_EXPECT_IBF))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle an IBF message from a remote peer.
+ *
+ * Reassemble the IBF from multiple pieces, and
+ * process the whole IBF once possible.
+ *
+ * @param cls the union operation
+ * @param msg the header of the message
+ */
+void
+handle_union_p2p_ibf (void *cls,
+                      const struct IBFMessage *msg)
+{
+  struct Operation *op = cls;
+  unsigned int buckets_in_message;
+
+  buckets_in_message = (ntohs (msg->header.size) - sizeof *msg)
+                       / IBF_BUCKET_SIZE;
+  if ((op->state->phase == PHASE_INVENTORY_PASSIVE) ||
+      (op->state->phase == PHASE_EXPECT_IBF))
+  {
+    op->state->phase = PHASE_EXPECT_IBF_CONT;
+    GNUNET_assert (NULL == op->state->remote_ibf);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Creating new ibf of size %u\n",
+         1 << msg->order);
+    op->state->remote_ibf = ibf_create (1 << msg->order, SE_IBF_HASH_NUM);
+    op->state->salt_receive = ntohl (msg->salt);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Receiving new IBF with salt %u\n",
+         op->state->salt_receive);
+    if (NULL == op->state->remote_ibf)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to parse remote IBF, closing connection\n");
+      fail_union_operation (op);
+      return;
+    }
+    op->state->ibf_buckets_received = 0;
+    if (0 != ntohl (msg->offset))
+    {
+      GNUNET_break_op (0);
+      fail_union_operation (op);
+      return;
+    }
+  }
+  else
+  {
+    GNUNET_assert (op->state->phase == PHASE_EXPECT_IBF_CONT);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Received more of IBF\n");
+  }
+  GNUNET_assert (NULL != op->state->remote_ibf);
+
+  ibf_read_slice (&msg[1],
+                  op->state->ibf_buckets_received,
+                  buckets_in_message,
+                  op->state->remote_ibf);
+  op->state->ibf_buckets_received += buckets_in_message;
+
+  if (op->state->ibf_buckets_received == op->state->remote_ibf->size)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "received full ibf\n");
+    op->state->phase = PHASE_INVENTORY_ACTIVE;
+    if (GNUNET_OK !=
+        decode_and_send (op))
+    {
+      /* Internal error, best we can do is shut down */
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to decode IBF, closing connection\n");
+      fail_union_operation (op);
+      return;
+    }
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Send a result message to the client indicating
+ * that there is a new element.
+ *
+ * @param op union operation
+ * @param element element to send
+ * @param status status to send with the new element
+ */
+static void
+send_client_element (struct Operation *op,
+                     struct GNUNET_SET_Element *element,
+                     int status)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *rm;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "sending element (size %u) to client\n",
+       element->size);
+  GNUNET_assert (0 != op->client_request_id);
+  ev = GNUNET_MQ_msg_extra (rm, element->size, GNUNET_MESSAGE_TYPE_SET_RESULT);
+  if (NULL == ev)
+  {
+    GNUNET_MQ_discard (ev);
+    GNUNET_break (0);
+    return;
+  }
+  rm->result_status = htons (status);
+  rm->request_id = htonl (op->client_request_id);
+  rm->element_type = htons (element->element_type);
+  rm->current_size = GNUNET_htonll (GNUNET_CONTAINER_multihashmap32_size (
+                                      op->state->key_to_element));
+  GNUNET_memcpy (&rm[1],
+                 element->data,
+                 element->size);
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+}
+
+
+/**
+ * Signal to the client that the operation has finished and
+ * destroy the operation.
+ *
+ * @param cls operation to destroy
+ */
+static void
+send_client_done (void *cls)
+{
+  struct Operation *op = cls;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ResultMessage *rm;
+
+  if (GNUNET_YES == op->state->client_done_sent)
+  {
+    return;
+  }
+
+  if (PHASE_DONE != op->state->phase)
+  {
+    LOG (GNUNET_ERROR_TYPE_WARNING,
+         "Union operation failed\n");
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# Union operations failed",
+                              1,
+                              GNUNET_NO);
+    ev = GNUNET_MQ_msg (rm, GNUNET_MESSAGE_TYPE_SET_RESULT);
+    rm->result_status = htons (GNUNET_SET_STATUS_FAILURE);
+    rm->request_id = htonl (op->client_request_id);
+    rm->element_type = htons (0);
+    GNUNET_MQ_send (op->set->cs->mq,
+                    ev);
+    return;
+  }
+
+  op->state->client_done_sent = GNUNET_YES;
+
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# Union operations succeeded",
+                            1,
+                            GNUNET_NO);
+  LOG (GNUNET_ERROR_TYPE_INFO,
+       "Signalling client that union operation is done\n");
+  ev = GNUNET_MQ_msg (rm,
+                      GNUNET_MESSAGE_TYPE_SET_RESULT);
+  rm->request_id = htonl (op->client_request_id);
+  rm->result_status = htons (GNUNET_SET_STATUS_DONE);
+  rm->element_type = htons (0);
+  rm->current_size = GNUNET_htonll (GNUNET_CONTAINER_multihashmap32_size (
+                                      op->state->key_to_element));
+  GNUNET_MQ_send (op->set->cs->mq,
+                  ev);
+}
+
+
+/**
+ * Tests if the operation is finished, and if so notify.
+ *
+ * @param op operation to check
+ */
+static void
+maybe_finish (struct Operation *op)
+{
+  unsigned int num_demanded;
+
+  num_demanded = GNUNET_CONTAINER_multihashmap_size (
+    op->state->demanded_hashes);
+
+  if (PHASE_FINISH_WAITING == op->state->phase)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "In PHASE_FINISH_WAITING, pending %u demands\n",
+         num_demanded);
+    if (0 == num_demanded)
+    {
+      struct GNUNET_MQ_Envelope *ev;
+
+      op->state->phase = PHASE_DONE;
+      ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DONE);
+      GNUNET_MQ_send (op->mq,
+                      ev);
+      /* We now wait until the other peer sends P2P_OVER
+       * after it got all elements from us. */
+    }
+  }
+  if (PHASE_FINISH_CLOSING == op->state->phase)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "In PHASE_FINISH_CLOSING, pending %u demands\n",
+         num_demanded);
+    if (0 == num_demanded)
+    {
+      op->state->phase = PHASE_DONE;
+      send_client_done (op);
+      _GSS_operation_destroy2 (op);
+    }
+  }
+}
+
+
+/**
+ * Check an element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+int
+check_union_p2p_elements (void *cls,
+                          const struct GNUNET_SET_ElementMessage *emsg)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (0 == GNUNET_CONTAINER_multihashmap_size (op->state->demanded_hashes))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle an element message from a remote peer.
+ * Sent by the other peer either because we decoded an IBF and placed a demand,
+ * or because the other peer switched to full set transmission.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+void
+handle_union_p2p_elements (void *cls,
+                           const struct GNUNET_SET_ElementMessage *emsg)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee;
+  struct KeyEntry *ke;
+  uint16_t element_size;
+
+  element_size = ntohs (emsg->header.size) - sizeof(struct
+                                                    GNUNET_SET_ElementMessage);
+  ee = GNUNET_malloc (sizeof(struct ElementEntry) + element_size);
+  GNUNET_memcpy (&ee[1],
+                 &emsg[1],
+                 element_size);
+  ee->element.size = element_size;
+  ee->element.data = &ee[1];
+  ee->element.element_type = ntohs (emsg->element_type);
+  ee->remote = GNUNET_YES;
+  GNUNET_SET_element_hash (&ee->element,
+                           &ee->element_hash);
+  if (GNUNET_NO ==
+      GNUNET_CONTAINER_multihashmap_remove (op->state->demanded_hashes,
+                                            &ee->element_hash,
+                                            NULL))
+  {
+    /* We got something we didn't demand, since it's not in our map. */
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got element (size %u, hash %s) from peer\n",
+       (unsigned int) element_size,
+       GNUNET_h2s (&ee->element_hash));
+
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# received elements",
+                            1,
+                            GNUNET_NO);
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# exchanged elements",
+                            1,
+                            GNUNET_NO);
+
+  op->state->received_total++;
+
+  ke = op_get_element (op, &ee->element_hash);
+  if (NULL != ke)
+  {
+    /* Got repeated element.  Should not happen since
+     * we track demands. */
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# repeated elements",
+                              1,
+                              GNUNET_NO);
+    ke->received = GNUNET_YES;
+    GNUNET_free (ee);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Registering new element from remote peer\n");
+    op->state->received_fresh++;
+    op_register_element (op, ee, GNUNET_YES);
+    /* only send results immediately if the client wants it */
+    switch (op->result_mode)
+    {
+    case GNUNET_SET_RESULT_ADDED:
+      send_client_element (op, &ee->element, GNUNET_SET_STATUS_OK);
+      break;
+
+    case GNUNET_SET_RESULT_SYMMETRIC:
+      send_client_element (op, &ee->element, GNUNET_SET_STATUS_ADD_LOCAL);
+      break;
+
+    default:
+      /* Result mode not supported, should have been caught earlier. */
+      GNUNET_break (0);
+      break;
+    }
+  }
+
+  if ((op->state->received_total > 8) &&
+      (op->state->received_fresh < op->state->received_total / 3))
+  {
+    /* The other peer gave us lots of old elements, there's something wrong. */
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+  GNUNET_CADET_receive_done (op->channel);
+  maybe_finish (op);
+}
+
+
+/**
+ * Check a full element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+int
+check_union_p2p_full_element (void *cls,
+                              const struct GNUNET_SET_ElementMessage *emsg)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  // FIXME: check that we expect full elements here?
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle an element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+void
+handle_union_p2p_full_element (void *cls,
+                               const struct GNUNET_SET_ElementMessage *emsg)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee;
+  struct KeyEntry *ke;
+  uint16_t element_size;
+
+  element_size = ntohs (emsg->header.size) - sizeof(struct
+                                                    GNUNET_SET_ElementMessage);
+  ee = GNUNET_malloc (sizeof(struct ElementEntry) + element_size);
+  GNUNET_memcpy (&ee[1], &emsg[1], element_size);
+  ee->element.size = element_size;
+  ee->element.data = &ee[1];
+  ee->element.element_type = ntohs (emsg->element_type);
+  ee->remote = GNUNET_YES;
+  GNUNET_SET_element_hash (&ee->element, &ee->element_hash);
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got element (full diff, size %u, hash %s) from peer\n",
+       (unsigned int) element_size,
+       GNUNET_h2s (&ee->element_hash));
+
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# received elements",
+                            1,
+                            GNUNET_NO);
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# exchanged elements",
+                            1,
+                            GNUNET_NO);
+
+  op->state->received_total++;
+
+  ke = op_get_element (op, &ee->element_hash);
+  if (NULL != ke)
+  {
+    /* Got repeated element.  Should not happen since
+     * we track demands. */
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# repeated elements",
+                              1,
+                              GNUNET_NO);
+    ke->received = GNUNET_YES;
+    GNUNET_free (ee);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Registering new element from remote peer\n");
+    op->state->received_fresh++;
+    op_register_element (op, ee, GNUNET_YES);
+    /* only send results immediately if the client wants it */
+    switch (op->result_mode)
+    {
+    case GNUNET_SET_RESULT_ADDED:
+      send_client_element (op, &ee->element, GNUNET_SET_STATUS_OK);
+      break;
+
+    case GNUNET_SET_RESULT_SYMMETRIC:
+      send_client_element (op, &ee->element, GNUNET_SET_STATUS_ADD_LOCAL);
+      break;
+
+    default:
+      /* Result mode not supported, should have been caught earlier. */
+      GNUNET_break (0);
+      break;
+    }
+  }
+
+  if ((GNUNET_YES == op->byzantine) &&
+      (op->state->received_total > 384 + op->state->received_fresh * 4) &&
+      (op->state->received_fresh < op->state->received_total / 6))
+  {
+    /* The other peer gave us lots of old elements, there's something wrong. */
+    LOG (GNUNET_ERROR_TYPE_ERROR,
+         "Other peer sent only %llu/%llu fresh elements, failing operation\n",
+         (unsigned long long) op->state->received_fresh,
+         (unsigned long long) op->state->received_total);
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Send offers (for GNUNET_Hash-es) in response
+ * to inquiries (for IBF_Key-s).
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+int
+check_union_p2p_inquiry (void *cls,
+                         const struct InquiryMessage *msg)
+{
+  struct Operation *op = cls;
+  unsigned int num_keys;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  if (op->state->phase != PHASE_INVENTORY_PASSIVE)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  num_keys = (ntohs (msg->header.size) - sizeof(struct InquiryMessage))
+             / sizeof(struct IBF_Key);
+  if ((ntohs (msg->header.size) - sizeof(struct InquiryMessage))
+      != num_keys * sizeof(struct IBF_Key))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Send offers (for GNUNET_Hash-es) in response
+ * to inquiries (for IBF_Key-s).
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+void
+handle_union_p2p_inquiry (void *cls,
+                          const struct InquiryMessage *msg)
+{
+  struct Operation *op = cls;
+  const struct IBF_Key *ibf_key;
+  unsigned int num_keys;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received union inquiry\n");
+  num_keys = (ntohs (msg->header.size) - sizeof(struct InquiryMessage))
+             / sizeof(struct IBF_Key);
+  ibf_key = (const struct IBF_Key *) &msg[1];
+  while (0 != num_keys--)
+  {
+    struct IBF_Key unsalted_key;
+
+    unsalt_key (ibf_key,
+                ntohl (msg->salt),
+                &unsalted_key);
+    send_offers_for_key (op,
+                         unsalted_key);
+    ibf_key++;
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Iterator over hash map entries, called to
+ * destroy the linked list of colliding ibf key entries.
+ *
+ * @param cls closure
+ * @param key current key code
+ * @param value value in the hash map
+ * @return #GNUNET_YES if we should continue to iterate,
+ *         #GNUNET_NO if not.
+ */
+static int
+send_missing_full_elements_iter (void *cls,
+                                 uint32_t key,
+                                 void *value)
+{
+  struct Operation *op = cls;
+  struct KeyEntry *ke = value;
+  struct GNUNET_MQ_Envelope *ev;
+  struct GNUNET_SET_ElementMessage *emsg;
+  struct ElementEntry *ee = ke->element;
+
+  if (GNUNET_YES == ke->received)
+    return GNUNET_YES;
+  ev = GNUNET_MQ_msg_extra (emsg,
+                            ee->element.size,
+                            GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_ELEMENT);
+  GNUNET_memcpy (&emsg[1],
+                 ee->element.data,
+                 ee->element.size);
+  emsg->element_type = htons (ee->element.element_type);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+  return GNUNET_YES;
+}
+
+
+/**
+ * Handle a request for full set transmission.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_request_full (void *cls,
+                               const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received request for full set transmission\n");
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+  if (PHASE_EXPECT_IBF != op->state->phase)
+  {
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+
+  // FIXME: we need to check that our set is larger than the
+  // byzantine_lower_bound by some threshold
+  send_full_set (op);
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Handle a "full done" message.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_full_done (void *cls,
+                            const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+
+  switch (op->state->phase)
+  {
+  case PHASE_EXPECT_IBF:
+    {
+      struct GNUNET_MQ_Envelope *ev;
+
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "got FULL DONE, sending elements that other peer is missing\n");
+
+      /* send all the elements that did not come from the remote peer */
+      GNUNET_CONTAINER_multihashmap32_iterate (op->state->key_to_element,
+                                               &send_missing_full_elements_iter,
+                                               op);
+
+      ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_UNION_P2P_FULL_DONE);
+      GNUNET_MQ_send (op->mq,
+                      ev);
+      op->state->phase = PHASE_DONE;
+      /* we now wait until the other peer sends us the OVER message*/
+    }
+    break;
+
+  case PHASE_FULL_SENDING:
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "got FULL DONE, finishing\n");
+      /* We sent the full set, and got the response for that.  We're done. */
+      op->state->phase = PHASE_DONE;
+      GNUNET_CADET_receive_done (op->channel);
+      send_client_done (op);
+      _GSS_operation_destroy2 (op);
+      return;
+    }
+    break;
+
+  default:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Handle full done phase is %u\n",
+                (unsigned) op->state->phase);
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Check a demand by the other peer for elements based on a list
+ * of `struct GNUNET_HashCode`s.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ * @return #GNUNET_OK if @a mh is well-formed
+ */
+int
+check_union_p2p_demand (void *cls,
+                        const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+  unsigned int num_hashes;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  num_hashes = (ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader))
+               / sizeof(struct GNUNET_HashCode);
+  if ((ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader))
+      != num_hashes * sizeof(struct GNUNET_HashCode))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle a demand by the other peer for elements based on a list
+ * of `struct GNUNET_HashCode`s.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_demand (void *cls,
+                         const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+  struct ElementEntry *ee;
+  struct GNUNET_SET_ElementMessage *emsg;
+  const struct GNUNET_HashCode *hash;
+  unsigned int num_hashes;
+  struct GNUNET_MQ_Envelope *ev;
+
+  num_hashes = (ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader))
+               / sizeof(struct GNUNET_HashCode);
+  for (hash = (const struct GNUNET_HashCode *) &mh[1];
+       num_hashes > 0;
+       hash++, num_hashes--)
+  {
+    ee = GNUNET_CONTAINER_multihashmap_get (op->set->content->elements,
+                                            hash);
+    if (NULL == ee)
+    {
+      /* Demand for non-existing element. */
+      GNUNET_break_op (0);
+      fail_union_operation (op);
+      return;
+    }
+    if (GNUNET_NO == _GSS_is_element_of_operation (ee, op))
+    {
+      /* Probably confused lazily copied sets. */
+      GNUNET_break_op (0);
+      fail_union_operation (op);
+      return;
+    }
+    ev = GNUNET_MQ_msg_extra (emsg, ee->element.size,
+                              GNUNET_MESSAGE_TYPE_SET_P2P_ELEMENTS);
+    GNUNET_memcpy (&emsg[1], ee->element.data, ee->element.size);
+    emsg->reserved = htons (0);
+    emsg->element_type = htons (ee->element.element_type);
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "[OP %p] Sending demanded element (size %u, hash %s) to peer\n",
+         op,
+         (unsigned int) ee->element.size,
+         GNUNET_h2s (&ee->element_hash));
+    GNUNET_MQ_send (op->mq, ev);
+    GNUNET_STATISTICS_update (_GSS_statistics,
+                              "# exchanged elements",
+                              1,
+                              GNUNET_NO);
+
+    switch (op->result_mode)
+    {
+    case GNUNET_SET_RESULT_ADDED:
+      /* Nothing to do. */
+      break;
+
+    case GNUNET_SET_RESULT_SYMMETRIC:
+      send_client_element (op, &ee->element, GNUNET_SET_STATUS_ADD_REMOTE);
+      break;
+
+    default:
+      /* Result mode not supported, should have been caught earlier. */
+      GNUNET_break (0);
+      break;
+    }
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Check offer (of `struct GNUNET_HashCode`s).
+ *
+ * @param cls the union operation
+ * @param mh the message
+ * @return #GNUNET_OK if @a mh is well-formed
+ */
+int
+check_union_p2p_offer (void *cls,
+                       const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+  unsigned int num_hashes;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  /* look up elements and send them */
+  if ((op->state->phase != PHASE_INVENTORY_PASSIVE) &&
+      (op->state->phase != PHASE_INVENTORY_ACTIVE))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  num_hashes = (ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader))
+               / sizeof(struct GNUNET_HashCode);
+  if ((ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader)) !=
+      num_hashes * sizeof(struct GNUNET_HashCode))
+  {
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle offers (of `struct GNUNET_HashCode`s) and
+ * respond with demands (of `struct GNUNET_HashCode`s).
+ *
+ * @param cls the union operation
+ * @param mh the message
+ */
+void
+handle_union_p2p_offer (void *cls,
+                        const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+  const struct GNUNET_HashCode *hash;
+  unsigned int num_hashes;
+
+  num_hashes = (ntohs (mh->size) - sizeof(struct GNUNET_MessageHeader))
+               / sizeof(struct GNUNET_HashCode);
+  for (hash = (const struct GNUNET_HashCode *) &mh[1];
+       num_hashes > 0;
+       hash++, num_hashes--)
+  {
+    struct ElementEntry *ee;
+    struct GNUNET_MessageHeader *demands;
+    struct GNUNET_MQ_Envelope *ev;
+
+    ee = GNUNET_CONTAINER_multihashmap_get (op->set->content->elements,
+                                            hash);
+    if (NULL != ee)
+      if (GNUNET_YES == _GSS_is_element_of_operation (ee, op))
+        continue;
+
+    if (GNUNET_YES ==
+        GNUNET_CONTAINER_multihashmap_contains (op->state->demanded_hashes,
+                                                hash))
+    {
+      LOG (GNUNET_ERROR_TYPE_DEBUG,
+           "Skipped sending duplicate demand\n");
+      continue;
+    }
+
+    GNUNET_assert (GNUNET_OK ==
+                   GNUNET_CONTAINER_multihashmap_put (
+                     op->state->demanded_hashes,
+                     hash,
+                     NULL,
+                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_FAST));
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "[OP %p] Requesting element (hash %s)\n",
+         op, GNUNET_h2s (hash));
+    ev = GNUNET_MQ_msg_header_extra (demands,
+                                     sizeof(struct GNUNET_HashCode),
+                                     GNUNET_MESSAGE_TYPE_SET_UNION_P2P_DEMAND);
+    GNUNET_memcpy (&demands[1],
+                   hash,
+                   sizeof(struct GNUNET_HashCode));
+    GNUNET_MQ_send (op->mq, ev);
+  }
+  GNUNET_CADET_receive_done (op->channel);
+}
+
+
+/**
+ * Handle a done message from a remote peer
+ *
+ * @param cls the union operation
+ * @param mh the message
+ */
+void
+handle_union_p2p_done (void *cls,
+                       const struct GNUNET_MessageHeader *mh)
+{
+  struct Operation *op = cls;
+
+  if (GNUNET_SET_OPERATION_UNION != op->set->operation)
+  {
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+  switch (op->state->phase)
+  {
+  case PHASE_INVENTORY_PASSIVE:
+    /* We got all requests, but still have to send our elements in response. */
+    op->state->phase = PHASE_FINISH_WAITING;
+
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "got DONE (as passive partner), waiting for our demands to be satisfied\n");
+    /* The active peer is done sending offers
+     * and inquiries.  This means that all
+     * our responses to that (demands and offers)
+     * must be in flight (queued or in mesh).
+     *
+     * We should notify the active peer once
+     * all our demands are satisfied, so that the active
+     * peer can quit if we gave it everything.
+     */GNUNET_CADET_receive_done (op->channel);
+    maybe_finish (op);
+    return;
+
+  case PHASE_INVENTORY_ACTIVE:
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "got DONE (as active partner), waiting to finish\n");
+    /* All demands of the other peer are satisfied,
+     * and we processed all offers, thus we know
+     * exactly what our demands must be.
+     *
+     * We'll close the channel
+     * to the other peer once our demands are met.
+     */op->state->phase = PHASE_FINISH_CLOSING;
+    GNUNET_CADET_receive_done (op->channel);
+    maybe_finish (op);
+    return;
+
+  default:
+    GNUNET_break_op (0);
+    fail_union_operation (op);
+    return;
+  }
+}
+
+
+void
+handle_union_p2p_over (void *cls,
+                       const struct GNUNET_MessageHeader *mh)
+{
+  send_client_done (cls);
+}
+
+
+/**
+ * Initiate operation to evaluate a set union with a remote peer.
+ *
+ * @param op operation to perform (to be initialized)
+ * @param opaque_context message to be transmitted to the listener
+ *        to convince it to accept, may be NULL
+ */
+static struct OperationState *
+union_evaluate (struct Operation *op,
+                const struct GNUNET_MessageHeader *opaque_context)
+{
+  struct OperationState *state;
+  struct GNUNET_MQ_Envelope *ev;
+  struct OperationRequestMessage *msg;
+
+  ev = GNUNET_MQ_msg_nested_mh (msg,
+                                GNUNET_MESSAGE_TYPE_SET_P2P_OPERATION_REQUEST,
+                                opaque_context);
+  if (NULL == ev)
+  {
+    /* the context message is too large */
+    GNUNET_break (0);
+    return NULL;
+  }
+  state = GNUNET_new (struct OperationState);
+  state->demanded_hashes = GNUNET_CONTAINER_multihashmap_create (32,
+                                                                 GNUNET_NO);
+  /* copy the current generation's strata estimator for this operation */
+  state->se = strata_estimator_dup (op->set->state->se);
+  /* we started the operation, thus we have to send the operation request */
+  state->phase = PHASE_EXPECT_SE;
+  state->salt_receive = state->salt_send = 42; // FIXME?????
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Initiating union operation evaluation\n");
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# of total union operations",
+                            1,
+                            GNUNET_NO);
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# of initiated union operations",
+                            1,
+                            GNUNET_NO);
+  msg->operation = htonl (GNUNET_SET_OPERATION_UNION);
+  GNUNET_MQ_send (op->mq,
+                  ev);
+
+  if (NULL != opaque_context)
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "sent op request with context message\n");
+  else
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "sent op request without context message\n");
+
+  op->state = state;
+  initialize_key_to_element (op);
+  state->initial_size = GNUNET_CONTAINER_multihashmap32_size (
+    state->key_to_element);
+  return state;
+}
+
+
+/**
+ * Accept an union operation request from a remote peer.
+ * Only initializes the private operation state.
+ *
+ * @param op operation that will be accepted as a union operation
+ */
+static struct OperationState *
+union_accept (struct Operation *op)
+{
+  struct OperationState *state;
+  const struct StrataEstimator *se;
+  struct GNUNET_MQ_Envelope *ev;
+  struct StrataEstimatorMessage *strata_msg;
+  char *buf;
+  size_t len;
+  uint16_t type;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "accepting set union operation\n");
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# of accepted union operations",
+                            1,
+                            GNUNET_NO);
+  GNUNET_STATISTICS_update (_GSS_statistics,
+                            "# of total union operations",
+                            1,
+                            GNUNET_NO);
+
+  state = GNUNET_new (struct OperationState);
+  state->se = strata_estimator_dup (op->set->state->se);
+  state->demanded_hashes = GNUNET_CONTAINER_multihashmap_create (32,
+                                                                 GNUNET_NO);
+  state->salt_receive = state->salt_send = 42; // FIXME?????
+  op->state = state;
+  initialize_key_to_element (op);
+  state->initial_size = GNUNET_CONTAINER_multihashmap32_size (
+    state->key_to_element);
+
+  /* kick off the operation */
+  se = state->se;
+  buf = GNUNET_malloc (se->strata_count * IBF_BUCKET_SIZE * se->ibf_size);
+  len = strata_estimator_write (se,
+                                buf);
+  if (len < se->strata_count * IBF_BUCKET_SIZE * se->ibf_size)
+    type = GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SEC;
+  else
+    type = GNUNET_MESSAGE_TYPE_SET_UNION_P2P_SE;
+  ev = GNUNET_MQ_msg_extra (strata_msg,
+                            len,
+                            type);
+  GNUNET_memcpy (&strata_msg[1],
+                 buf,
+                 len);
+  GNUNET_free (buf);
+  strata_msg->set_size
+    = GNUNET_htonll (GNUNET_CONTAINER_multihashmap_size (
+                       op->set->content->elements));
+  GNUNET_MQ_send (op->mq,
+                  ev);
+  state->phase = PHASE_EXPECT_IBF;
+  return state;
+}
+
+
+/**
+ * Create a new set supporting the union operation
+ *
+ * We maintain one strata estimator per set and then manipulate it over the
+ * lifetime of the set, as recreating a strata estimator would be expensive.
+ *
+ * @return the newly created set, NULL on error
+ */
+static struct SetState *
+union_set_create (void)
+{
+  struct SetState *set_state;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "union set created\n");
+  set_state = GNUNET_new (struct SetState);
+  set_state->se = strata_estimator_create (SE_STRATA_COUNT,
+                                           SE_IBF_SIZE, SE_IBF_HASH_NUM);
+  if (NULL == set_state->se)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "Failed to allocate strata estimator\n");
+    GNUNET_free (set_state);
+    return NULL;
+  }
+  return set_state;
+}
+
+
+/**
+ * Add the element from the given element message to the set.
+ *
+ * @param set_state state of the set want to add to
+ * @param ee the element to add to the set
+ */
+static void
+union_add (struct SetState *set_state,
+           struct ElementEntry *ee)
+{
+  strata_estimator_insert (set_state->se,
+                           get_ibf_key (&ee->element_hash));
+}
+
+
+/**
+ * Remove the element given in the element message from the set.
+ * Only marks the element as removed, so that older set operations can still exchange it.
+ *
+ * @param set_state state of the set to remove from
+ * @param ee set element to remove
+ */
+static void
+union_remove (struct SetState *set_state,
+              struct ElementEntry *ee)
+{
+  strata_estimator_remove (set_state->se,
+                           get_ibf_key (&ee->element_hash));
+}
+
+
+/**
+ * Destroy a set that supports the union operation.
+ *
+ * @param set_state the set to destroy
+ */
+static void
+union_set_destroy (struct SetState *set_state)
+{
+  if (NULL != set_state->se)
+  {
+    strata_estimator_destroy (set_state->se);
+    set_state->se = NULL;
+  }
+  GNUNET_free (set_state);
+}
+
+
+/**
+ * Copy union-specific set state.
+ *
+ * @param state source state for copying the union state
+ * @return a copy of the union-specific set state
+ */
+static struct SetState *
+union_copy_state (struct SetState *state)
+{
+  struct SetState *new_state;
+
+  GNUNET_assert ((NULL != state) &&
+                 (NULL != state->se));
+  new_state = GNUNET_new (struct SetState);
+  new_state->se = strata_estimator_dup (state->se);
+
+  return new_state;
+}
+
+
+/**
+ * Handle case where channel went down for an operation.
+ *
+ * @param op operation that lost the channel
+ */
+static void
+union_channel_death (struct Operation *op)
+{
+  send_client_done (op);
+  _GSS_operation_destroy (op,
+                          GNUNET_YES);
+}
+
+
+/**
+ * Get the table with implementing functions for
+ * set union.
+ *
+ * @return the operation specific VTable
+ */
+const struct SetVT *
+_GSS_union_vt ()
+{
+  static const struct SetVT union_vt = {
+    .create = &union_set_create,
+    .add = &union_add,
+    .remove = &union_remove,
+    .destroy_set = &union_set_destroy,
+    .evaluate = &union_evaluate,
+    .accept = &union_accept,
+    .cancel = &union_op_cancel,
+    .copy_state = &union_copy_state,
+    .channel_death = &union_channel_death
+  };
+
+  return &union_vt;
+}
diff --git a/src/contrib/service/set/gnunet-service-set_union.h b/src/contrib/service/set/gnunet-service-set_union.h
new file mode 100644
index 000000000..68301c96b
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_union.h
@@ -0,0 +1,246 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013-2017 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set_union.h
+ * @brief two-peer set operations
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#ifndef GNUNET_SERVICE_SET_UNION_H
+#define GNUNET_SERVICE_SET_UNION_H
+
+#include "gnunet-service-set.h"
+#include "gnunet-service-set_protocol.h"
+
+
+/**
+ * Handle a strata estimator from a remote peer
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+int
+check_union_p2p_strata_estimator (void *cls,
+                                  const struct StrataEstimatorMessage *msg);
+
+
+/**
+ * Handle a strata estimator from a remote peer
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+void
+handle_union_p2p_strata_estimator (void *cls,
+                                   const struct StrataEstimatorMessage *msg);
+
+
+/**
+ * Check an IBF message from a remote peer.
+ *
+ * Reassemble the IBF from multiple pieces, and
+ * process the whole IBF once possible.
+ *
+ * @param cls the union operation
+ * @param msg the header of the message
+ * @return #GNUNET_OK if @a msg is well-formed
+ */
+int
+check_union_p2p_ibf (void *cls,
+                     const struct IBFMessage *msg);
+
+
+/**
+ * Handle an IBF message from a remote peer.
+ *
+ * Reassemble the IBF from multiple pieces, and
+ * process the whole IBF once possible.
+ *
+ * @param cls the union operation
+ * @param msg the header of the message
+ */
+void
+handle_union_p2p_ibf (void *cls,
+                      const struct IBFMessage *msg);
+
+
+/**
+ * Check an element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+int
+check_union_p2p_elements (void *cls,
+                          const struct GNUNET_SET_ElementMessage *emsg);
+
+
+/**
+ * Handle an element message from a remote peer.
+ * Sent by the other peer either because we decoded an IBF and placed a demand,
+ * or because the other peer switched to full set transmission.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+void
+handle_union_p2p_elements (void *cls,
+                           const struct GNUNET_SET_ElementMessage *emsg);
+
+
+/**
+ * Check a full element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+int
+check_union_p2p_full_element (void *cls,
+                              const struct GNUNET_SET_ElementMessage *emsg);
+
+
+/**
+ * Handle an element message from a remote peer.
+ *
+ * @param cls the union operation
+ * @param emsg the message
+ */
+void
+handle_union_p2p_full_element (void *cls,
+                               const struct GNUNET_SET_ElementMessage *emsg);
+
+
+/**
+ * Send offers (for GNUNET_Hash-es) in response
+ * to inquiries (for IBF_Key-s).
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+int
+check_union_p2p_inquiry (void *cls,
+                         const struct InquiryMessage *msg);
+
+
+/**
+ * Send offers (for GNUNET_Hash-es) in response
+ * to inquiries (for IBF_Key-s).
+ *
+ * @param cls the union operation
+ * @param msg the message
+ */
+void
+handle_union_p2p_inquiry (void *cls,
+                          const struct InquiryMessage *msg);
+
+
+/**
+ * Handle a request for full set transmission.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_request_full (void *cls,
+                               const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Handle a "full done" message.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_full_done (void *cls,
+                            const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Check a demand by the other peer for elements based on a list
+ * of `struct GNUNET_HashCode`s.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ * @return #GNUNET_OK if @a mh is well-formed
+ */
+int
+check_union_p2p_demand (void *cls,
+                        const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Handle a demand by the other peer for elements based on a list
+ * of `struct GNUNET_HashCode`s.
+ *
+ * @param cls closure, a set union operation
+ * @param mh the demand message
+ */
+void
+handle_union_p2p_demand (void *cls,
+                         const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Check offer (of `struct GNUNET_HashCode`s).
+ *
+ * @param cls the union operation
+ * @param mh the message
+ * @return #GNUNET_OK if @a mh is well-formed
+ */
+int
+check_union_p2p_offer (void *cls,
+                       const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Handle offers (of `struct GNUNET_HashCode`s) and
+ * respond with demands (of `struct GNUNET_HashCode`s).
+ *
+ * @param cls the union operation
+ * @param mh the message
+ */
+void
+handle_union_p2p_offer (void *cls,
+                        const struct GNUNET_MessageHeader *mh);
+
+
+/**
+ * Handle a done message from a remote peer
+ *
+ * @param cls the union operation
+ * @param mh the message
+ */
+void
+handle_union_p2p_done (void *cls,
+                       const struct GNUNET_MessageHeader *mh);
+
+/**
+ * Handle an over message from a remote peer
+ *
+ * @param cls the union operation
+ * @param mh the message
+ */
+void
+handle_union_p2p_over (void *cls,
+                       const struct GNUNET_MessageHeader *mh);
+
+
+#endif
diff --git a/src/contrib/service/set/gnunet-service-set_union_strata_estimator.c b/src/contrib/service/set/gnunet-service-set_union_strata_estimator.c
new file mode 100644
index 000000000..6de9fb5eb
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_union_strata_estimator.c
@@ -0,0 +1,297 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/gnunet-service-set_union_strata_estimator.c
+ * @brief invertible bloom filter
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "ibf.h"
+#include "gnunet-service-set_union_strata_estimator.h"
+
+
+/**
+ * Should we try compressing the strata estimator? This will
+ * break compatibility with the 0.10.1-network.
+ */
+#define FAIL_10_1_COMPATIBILTIY 1
+
+
+/**
+ * Write the given strata estimator to the buffer.
+ *
+ * @param se strata estimator to serialize
+ * @param[out] buf buffer to write to, must be of appropriate size
+ * @return number of bytes written to @a buf
+ */
+size_t
+strata_estimator_write (const struct StrataEstimator *se,
+                        void *buf)
+{
+  char *sbuf = buf;
+  unsigned int i;
+  size_t osize;
+
+  GNUNET_assert (NULL != se);
+  for (i = 0; i < se->strata_count; i++)
+  {
+    ibf_write_slice (se->strata[i],
+                     0,
+                     se->ibf_size,
+                     &sbuf[se->ibf_size * IBF_BUCKET_SIZE * i]);
+  }
+  osize = se->ibf_size * IBF_BUCKET_SIZE * se->strata_count;
+#if FAIL_10_1_COMPATIBILTIY
+  {
+    char *cbuf;
+    size_t nsize;
+
+    if (GNUNET_YES ==
+        GNUNET_try_compression (buf,
+                                osize,
+                                &cbuf,
+                                &nsize))
+    {
+      GNUNET_memcpy (buf, cbuf, nsize);
+      osize = nsize;
+      GNUNET_free (cbuf);
+    }
+  }
+#endif
+  return osize;
+}
+
+
+/**
+ * Read strata from the buffer into the given strata
+ * estimator.  The strata estimator must already be allocated.
+ *
+ * @param buf buffer to read from
+ * @param buf_len number of bytes in @a buf
+ * @param is_compressed is the data compressed?
+ * @param[out] se strata estimator to write to
+ * @return #GNUNET_OK on success
+ */
+int
+strata_estimator_read (const void *buf,
+                       size_t buf_len,
+                       int is_compressed,
+                       struct StrataEstimator *se)
+{
+  unsigned int i;
+  size_t osize;
+  char *dbuf;
+
+  dbuf = NULL;
+  if (GNUNET_YES == is_compressed)
+  {
+    osize = se->ibf_size * IBF_BUCKET_SIZE * se->strata_count;
+    dbuf = GNUNET_decompress (buf,
+                              buf_len,
+                              osize);
+    if (NULL == dbuf)
+    {
+      GNUNET_break_op (0);    /* bad compressed input data */
+      return GNUNET_SYSERR;
+    }
+    buf = dbuf;
+    buf_len = osize;
+  }
+
+  if (buf_len != se->strata_count * se->ibf_size * IBF_BUCKET_SIZE)
+  {
+    GNUNET_break (0);  /* very odd error */
+    GNUNET_free (dbuf);
+    return GNUNET_SYSERR;
+  }
+
+  for (i = 0; i < se->strata_count; i++)
+  {
+    ibf_read_slice (buf, 0, se->ibf_size, se->strata[i]);
+    buf += se->ibf_size * IBF_BUCKET_SIZE;
+  }
+  GNUNET_free (dbuf);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Add a key to the strata estimator.
+ *
+ * @param se strata estimator to add the key to
+ * @param key key to add
+ */
+void
+strata_estimator_insert (struct StrataEstimator *se,
+                         struct IBF_Key key)
+{
+  uint64_t v;
+  unsigned int i;
+
+  v = key.key_val;
+  /* count trailing '1'-bits of v */
+  for (i = 0; v & 1; v >>= 1, i++)
+    /* empty */;
+  ibf_insert (se->strata[i], key);
+}
+
+
+void
+strata_estimator_remove (struct StrataEstimator *se,
+                         struct IBF_Key key)
+{
+  uint64_t v;
+  unsigned int i;
+
+  v = key.key_val;
+  /* count trailing '1'-bits of v */
+  for (i = 0; v & 1; v >>= 1, i++)
+    /* empty */;
+  ibf_remove (se->strata[i], key);
+}
+
+
+/**
+ * Create a new strata estimator with the given parameters.
+ *
+ * @param strata_count number of stratas, that is, number of ibfs in the estimator
+ * @param ibf_size size of each ibf stratum
+ * @param ibf_hashnum hashnum parameter of each ibf
+ * @return a freshly allocated, empty strata estimator, NULL on error
+ */
+struct StrataEstimator *
+strata_estimator_create (unsigned int strata_count,
+                         uint32_t ibf_size,
+                         uint8_t ibf_hashnum)
+{
+  struct StrataEstimator *se;
+  unsigned int i;
+  unsigned int j;
+
+  se = GNUNET_new (struct StrataEstimator);
+  se->strata_count = strata_count;
+  se->ibf_size = ibf_size;
+  se->strata = GNUNET_new_array (strata_count,
+                                 struct InvertibleBloomFilter *);
+  for (i = 0; i < strata_count; i++)
+  {
+    se->strata[i] = ibf_create (ibf_size, ibf_hashnum);
+    if (NULL == se->strata[i])
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Failed to allocate memory for strata estimator\n");
+      for (j = 0; j < i; j++)
+        ibf_destroy (se->strata[i]);
+      GNUNET_free (se);
+      return NULL;
+    }
+  }
+  return se;
+}
+
+
+/**
+ * Estimate set difference with two strata estimators,
+ * i.e. arrays of IBFs.
+ * Does not not modify its arguments.
+ *
+ * @param se1 first strata estimator
+ * @param se2 second strata estimator
+ * @return the estimated difference
+ */
+unsigned int
+strata_estimator_difference (const struct StrataEstimator *se1,
+                             const struct StrataEstimator *se2)
+{
+  unsigned int count;
+
+  GNUNET_assert (se1->strata_count == se2->strata_count);
+  count = 0;
+  for (int i = se1->strata_count - 1; i >= 0; i--)
+  {
+    struct InvertibleBloomFilter *diff;
+    /* number of keys decoded from the ibf */
+
+    /* FIXME: implement this without always allocating new IBFs */
+    diff = ibf_dup (se1->strata[i]);
+    ibf_subtract (diff, se2->strata[i]);
+    for (int ibf_count = 0; GNUNET_YES; ibf_count++)
+    {
+      int more;
+
+      more = ibf_decode (diff, NULL, NULL);
+      if (GNUNET_NO == more)
+      {
+        count += ibf_count;
+        break;
+      }
+      /* Estimate if decoding fails or would not terminate */
+      if ((GNUNET_SYSERR == more) || (ibf_count > diff->size))
+      {
+        ibf_destroy (diff);
+        return count * (1 << (i + 1));
+      }
+    }
+    ibf_destroy (diff);
+  }
+  return count;
+}
+
+
+/**
+ * Make a copy of a strata estimator.
+ *
+ * @param se the strata estimator to copy
+ * @return the copy
+ */
+struct StrataEstimator *
+strata_estimator_dup (struct StrataEstimator *se)
+{
+  struct StrataEstimator *c;
+  unsigned int i;
+
+  c = GNUNET_new (struct StrataEstimator);
+  c->strata_count = se->strata_count;
+  c->ibf_size = se->ibf_size;
+  c->strata = GNUNET_new_array (se->strata_count,
+                                struct InvertibleBloomFilter *);
+  for (i = 0; i < se->strata_count; i++)
+    c->strata[i] = ibf_dup (se->strata[i]);
+  return c;
+}
+
+
+/**
+ * Destroy a strata estimator, free all of its resources.
+ *
+ * @param se strata estimator to destroy.
+ */
+void
+strata_estimator_destroy (struct StrataEstimator *se)
+{
+  unsigned int i;
+
+  for (i = 0; i < se->strata_count; i++)
+    ibf_destroy (se->strata[i]);
+  GNUNET_free (se->strata);
+  GNUNET_free (se);
+}
diff --git a/src/contrib/service/set/gnunet-service-set_union_strata_estimator.h b/src/contrib/service/set/gnunet-service-set_union_strata_estimator.h
new file mode 100644
index 000000000..94267a2dc
--- /dev/null
+++ b/src/contrib/service/set/gnunet-service-set_union_strata_estimator.h
@@ -0,0 +1,169 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/gnunet-service-set_union_strata_estimator.h
+ * @brief estimator of set difference
+ * @author Florian Dold
+ */
+
+#ifndef GNUNET_CONSENSUS_STRATA_ESTIMATOR_H
+#define GNUNET_CONSENSUS_STRATA_ESTIMATOR_H
+
+#include "platform.h"
+#include "gnunet_common.h"
+#include "gnunet_util_lib.h"
+
+#ifdef __cplusplus
+extern "C"
+{
+#if 0                           /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+
+/**
+ * A handle to a strata estimator.
+ */
+struct StrataEstimator
+{
+  /**
+   * The IBFs of this strata estimator.
+   */
+  struct InvertibleBloomFilter **strata;
+
+  /**
+   * Size of the IBF array in @e strata
+   */
+  unsigned int strata_count;
+
+  /**
+   * Size of each IBF stratum (in bytes)
+   */
+  unsigned int ibf_size;
+};
+
+
+/**
+ * Write the given strata estimator to the buffer.
+ *
+ * @param se strata estimator to serialize
+ * @param[out] buf buffer to write to, must be of appropriate size
+ * @return number of bytes written to @a buf
+ */
+size_t
+strata_estimator_write (const struct StrataEstimator *se,
+                        void *buf);
+
+
+/**
+ * Read strata from the buffer into the given strata
+ * estimator.  The strata estimator must already be allocated.
+ *
+ * @param buf buffer to read from
+ * @param buf_len number of bytes in @a buf
+ * @param is_compressed is the data compressed?
+ * @param[out] se strata estimator to write to
+ * @return #GNUNET_OK on success
+ */
+int
+strata_estimator_read (const void *buf,
+                       size_t buf_len,
+                       int is_compressed,
+                       struct StrataEstimator *se);
+
+
+/**
+ * Create a new strata estimator with the given parameters.
+ *
+ * @param strata_count number of stratas, that is, number of ibfs in the estimator
+ * @param ibf_size size of each ibf stratum
+ * @param ibf_hashnum hashnum parameter of each ibf
+ * @return a freshly allocated, empty strata estimator, NULL on error
+ */
+struct StrataEstimator *
+strata_estimator_create (unsigned int strata_count,
+                         uint32_t ibf_size,
+                         uint8_t ibf_hashnum);
+
+
+/**
+ * Get an estimation of the symmetric difference of the elements
+ * contained in both strata estimators.
+ *
+ * @param se1 first strata estimator
+ * @param se2 second strata estimator
+ * @return abs(|se1| - |se2|)
+ */
+unsigned int
+strata_estimator_difference (const struct StrataEstimator *se1,
+                             const struct StrataEstimator *se2);
+
+
+/**
+ * Add a key to the strata estimator.
+ *
+ * @param se strata estimator to add the key to
+ * @param key key to add
+ */
+void
+strata_estimator_insert (struct StrataEstimator *se,
+                         struct IBF_Key key);
+
+
+/**
+ * Remove a key from the strata estimator.
+ *
+ * @param se strata estimator to remove the key from
+ * @param key key to remove
+ */
+void
+strata_estimator_remove (struct StrataEstimator *se,
+                         struct IBF_Key key);
+
+
+/**
+ * Destroy a strata estimator, free all of its resources.
+ *
+ * @param se strata estimator to destroy.
+ */
+void
+strata_estimator_destroy (struct StrataEstimator *se);
+
+
+/**
+ * Make a copy of a strata estimator.
+ *
+ * @param se the strata estimator to copy
+ * @return the copy
+ */
+struct StrataEstimator *
+strata_estimator_dup (struct StrataEstimator *se);
+
+
+#if 0                           /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/contrib/service/set/gnunet-set-ibf-profiler.c b/src/contrib/service/set/gnunet-set-ibf-profiler.c
new file mode 100644
index 000000000..6465b15b8
--- /dev/null
+++ b/src/contrib/service/set/gnunet-set-ibf-profiler.c
@@ -0,0 +1,308 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/gnunet-set-ibf-profiler.c
+ * @brief tool for profiling the invertible bloom filter implementation
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#include "ibf.h"
+
+static unsigned int asize = 10;
+static unsigned int bsize = 10;
+static unsigned int csize = 10;
+static unsigned int hash_num = 4;
+static unsigned int ibf_size = 80;
+
+/* FIXME: add parameter for this */
+static enum GNUNET_CRYPTO_Quality random_quality = GNUNET_CRYPTO_QUALITY_WEAK;
+
+static struct GNUNET_CONTAINER_MultiHashMap *set_a;
+static struct GNUNET_CONTAINER_MultiHashMap *set_b;
+/* common elements in a and b */
+static struct GNUNET_CONTAINER_MultiHashMap *set_c;
+
+static struct GNUNET_CONTAINER_MultiHashMap *key_to_hashcode;
+
+static struct InvertibleBloomFilter *ibf_a;
+static struct InvertibleBloomFilter *ibf_b;
+
+
+static void
+register_hashcode (struct GNUNET_HashCode *hash)
+{
+  struct GNUNET_HashCode replicated;
+  struct IBF_Key key;
+
+  key = ibf_key_from_hashcode (hash);
+  ibf_hashcode_from_key (key, &replicated);
+  (void) GNUNET_CONTAINER_multihashmap_put (
+    key_to_hashcode,
+    &replicated,
+    GNUNET_memdup (hash, sizeof *hash),
+    GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE);
+}
+
+
+static void
+iter_hashcodes (struct IBF_Key key,
+                GNUNET_CONTAINER_MultiHashMapIteratorCallback iter,
+                void *cls)
+{
+  struct GNUNET_HashCode replicated;
+
+  ibf_hashcode_from_key (key, &replicated);
+  GNUNET_CONTAINER_multihashmap_get_multiple (key_to_hashcode,
+                                              &replicated,
+                                              iter,
+                                              cls);
+}
+
+
+static int
+insert_iterator (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  struct InvertibleBloomFilter *ibf = cls;
+
+  ibf_insert (ibf, ibf_key_from_hashcode (key));
+  return GNUNET_YES;
+}
+
+
+static int
+remove_iterator (void *cls, const struct GNUNET_HashCode *key, void *value)
+{
+  struct GNUNET_CONTAINER_MultiHashMap *hashmap = cls;
+
+  /* if remove fails, there just was a collision with another key */
+  (void) GNUNET_CONTAINER_multihashmap_remove (hashmap, value, NULL);
+  return GNUNET_YES;
+}
+
+
+static void
+run (void *cls,
+     char *const *args,
+     const char *cfgfile,
+     const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  struct GNUNET_HashCode id;
+  struct IBF_Key ibf_key;
+  int i;
+  int side;
+  int res;
+  struct GNUNET_TIME_Absolute start_time;
+  struct GNUNET_TIME_Relative delta_time;
+
+  set_a =
+    GNUNET_CONTAINER_multihashmap_create (((asize == 0) ? 1 : (asize + csize)),
+                                          GNUNET_NO);
+  set_b =
+    GNUNET_CONTAINER_multihashmap_create (((bsize == 0) ? 1 : (bsize + csize)),
+                                          GNUNET_NO);
+  set_c = GNUNET_CONTAINER_multihashmap_create (((csize == 0) ? 1 : csize),
+                                                GNUNET_NO);
+
+  key_to_hashcode =
+    GNUNET_CONTAINER_multihashmap_create (((asize + bsize + csize == 0)
+                                           ? 1
+                                           : (asize + bsize + csize)),
+                                          GNUNET_NO);
+
+  printf ("hash-num=%u, size=%u, #(A-B)=%u, #(B-A)=%u, #(A&B)=%u\n",
+          hash_num,
+          ibf_size,
+          asize,
+          bsize,
+          csize);
+
+  i = 0;
+  while (i < asize)
+  {
+    GNUNET_CRYPTO_hash_create_random (random_quality, &id);
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_a, &id))
+      continue;
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONTAINER_multihashmap_put (
+                    set_a,
+                    &id,
+                    NULL,
+                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    register_hashcode (&id);
+    i++;
+  }
+  i = 0;
+  while (i < bsize)
+  {
+    GNUNET_CRYPTO_hash_create_random (random_quality, &id);
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_a, &id))
+      continue;
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_b, &id))
+      continue;
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONTAINER_multihashmap_put (
+                    set_b,
+                    &id,
+                    NULL,
+                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    register_hashcode (&id);
+    i++;
+  }
+  i = 0;
+  while (i < csize)
+  {
+    GNUNET_CRYPTO_hash_create_random (random_quality, &id);
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_a, &id))
+      continue;
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_b, &id))
+      continue;
+    if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (set_c, &id))
+      continue;
+    GNUNET_break (GNUNET_OK ==
+                  GNUNET_CONTAINER_multihashmap_put (
+                    set_c,
+                    &id,
+                    NULL,
+                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+    register_hashcode (&id);
+    i++;
+  }
+
+  ibf_a = ibf_create (ibf_size, hash_num);
+  ibf_b = ibf_create (ibf_size, hash_num);
+  if ((NULL == ibf_a) || (NULL == ibf_b))
+  {
+    /* insufficient memory */
+    GNUNET_break (0);
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+
+
+  printf ("generated sets\n");
+
+  start_time = GNUNET_TIME_absolute_get ();
+
+  GNUNET_CONTAINER_multihashmap_iterate (set_a, &insert_iterator, ibf_a);
+  GNUNET_CONTAINER_multihashmap_iterate (set_b, &insert_iterator, ibf_b);
+  GNUNET_CONTAINER_multihashmap_iterate (set_c, &insert_iterator, ibf_a);
+  GNUNET_CONTAINER_multihashmap_iterate (set_c, &insert_iterator, ibf_b);
+
+  delta_time = GNUNET_TIME_absolute_get_duration (start_time);
+
+  printf ("encoded in: %s\n",
+          GNUNET_STRINGS_relative_time_to_string (delta_time, GNUNET_NO));
+
+  ibf_subtract (ibf_a, ibf_b);
+
+
+  start_time = GNUNET_TIME_absolute_get ();
+
+  for (i = 0; i <= asize + bsize; i++)
+  {
+    res = ibf_decode (ibf_a, &side, &ibf_key);
+    if (GNUNET_SYSERR == res)
+    {
+      printf ("decode failed, %u/%u elements left\n",
+              GNUNET_CONTAINER_multihashmap_size (set_a)
+              + GNUNET_CONTAINER_multihashmap_size (set_b),
+              asize + bsize);
+      return;
+    }
+    if (GNUNET_NO == res)
+    {
+      if ((0 == GNUNET_CONTAINER_multihashmap_size (set_b)) &&
+          (0 == GNUNET_CONTAINER_multihashmap_size (set_a)))
+      {
+        delta_time = GNUNET_TIME_absolute_get_duration (start_time);
+        printf ("decoded successfully in: %s\n",
+                GNUNET_STRINGS_relative_time_to_string (delta_time, GNUNET_NO));
+      }
+      else
+      {
+        printf ("decode missed elements (should never happen)\n");
+      }
+      return;
+    }
+
+    if (side == 1)
+      iter_hashcodes (ibf_key, remove_iterator, set_a);
+    if (side == -1)
+      iter_hashcodes (ibf_key, remove_iterator, set_b);
+  }
+  printf ("cyclic IBF, %u/%u elements left\n",
+          GNUNET_CONTAINER_multihashmap_size (set_a)
+          + GNUNET_CONTAINER_multihashmap_size (set_b),
+          asize + bsize);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_option_uint ('A',
+                               "asize",
+                               NULL,
+                               gettext_noop ("number of element in set A-B"),
+                               &asize),
+
+    GNUNET_GETOPT_option_uint ('B',
+                               "bsize",
+                               NULL,
+                               gettext_noop ("number of element in set B-A"),
+                               &bsize),
+
+    GNUNET_GETOPT_option_uint ('C',
+                               "csize",
+                               NULL,
+                               gettext_noop (
+                                 "number of common elements in A and B"),
+                               &csize),
+
+    GNUNET_GETOPT_option_uint ('k',
+                               "hash-num",
+                               NULL,
+                               gettext_noop ("hash num"),
+                               &hash_num),
+
+    GNUNET_GETOPT_option_uint ('s',
+                               "ibf-size",
+                               NULL,
+                               gettext_noop ("ibf size"),
+                               &ibf_size),
+
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_PROGRAM_run2 (argc,
+                       argv,
+                       "gnunet-consensus-ibf",
+                       "help",
+                       options,
+                       &run,
+                       NULL,
+                       GNUNET_YES);
+  return 0;
+}
diff --git a/src/contrib/service/set/gnunet-set-profiler.c b/src/contrib/service/set/gnunet-set-profiler.c
new file mode 100644
index 000000000..3014861a6
--- /dev/null
+++ b/src/contrib/service/set/gnunet-set-profiler.c
@@ -0,0 +1,508 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/gnunet-set-profiler.c
+ * @brief profiling tool for set
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_statistics_service.h"
+#include "gnunet_set_service.h"
+#include "gnunet_testbed_service.h"
+
+
+static int ret;
+
+static unsigned int num_a = 5;
+static unsigned int num_b = 5;
+static unsigned int num_c = 20;
+
+static char *op_str = "union";
+
+const static struct GNUNET_CONFIGURATION_Handle *config;
+
+struct SetInfo
+{
+  char *id;
+  struct GNUNET_SET_Handle *set;
+  struct GNUNET_SET_OperationHandle *oh;
+  struct GNUNET_CONTAINER_MultiHashMap *sent;
+  struct GNUNET_CONTAINER_MultiHashMap *received;
+  int done;
+} info1, info2;
+
+static struct GNUNET_CONTAINER_MultiHashMap *common_sent;
+
+static struct GNUNET_HashCode app_id;
+
+static struct GNUNET_PeerIdentity local_peer;
+
+static struct GNUNET_SET_ListenHandle *set_listener;
+
+static int byzantine;
+static unsigned int force_delta;
+static unsigned int force_full;
+static unsigned int element_size = 32;
+
+/**
+ * Handle to the statistics service.
+ */
+static struct GNUNET_STATISTICS_Handle *statistics;
+
+/**
+ * The profiler will write statistics
+ * for all peers to the file with this name.
+ */
+static char *statistics_filename;
+
+/**
+ * The profiler will write statistics
+ * for all peers to this file.
+ */
+static FILE *statistics_file;
+
+
+static int
+map_remove_iterator (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     void *value)
+{
+  struct GNUNET_CONTAINER_MultiHashMap *m = cls;
+  int ret;
+
+  GNUNET_assert (NULL != key);
+
+  ret = GNUNET_CONTAINER_multihashmap_remove_all (m, key);
+  if (GNUNET_OK != ret)
+    printf ("spurious element\n");
+  return GNUNET_YES;
+}
+
+
+/**
+ * Callback function to process statistic values.
+ *
+ * @param cls closure
+ * @param subsystem name of subsystem that created the statistic
+ * @param name the name of the datum
+ * @param value the current value
+ * @param is_persistent #GNUNET_YES if the value is persistent, #GNUNET_NO if not
+ * @return #GNUNET_OK to continue, #GNUNET_SYSERR to abort iteration
+ */
+static int
+statistics_result (void *cls,
+                   const char *subsystem,
+                   const char *name,
+                   uint64_t value,
+                   int is_persistent)
+{
+  if (NULL != statistics_file)
+  {
+    fprintf (statistics_file, "%s\t%s\t%lu\n", subsystem, name, (unsigned
+                                                                 long) value);
+  }
+  return GNUNET_OK;
+}
+
+
+static void
+statistics_done (void *cls,
+                 int success)
+{
+  GNUNET_assert (GNUNET_YES == success);
+  if (NULL != statistics_file)
+    fclose (statistics_file);
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+check_all_done (void)
+{
+  if ((info1.done == GNUNET_NO) || (info2.done == GNUNET_NO))
+    return;
+
+  GNUNET_CONTAINER_multihashmap_iterate (info1.received, map_remove_iterator,
+                                         info2.sent);
+  GNUNET_CONTAINER_multihashmap_iterate (info2.received, map_remove_iterator,
+                                         info1.sent);
+
+  printf ("set a: %d missing elements\n", GNUNET_CONTAINER_multihashmap_size (
+            info1.sent));
+  printf ("set b: %d missing elements\n", GNUNET_CONTAINER_multihashmap_size (
+            info2.sent));
+
+  if (NULL == statistics_filename)
+  {
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
+
+  statistics_file = fopen (statistics_filename, "w");
+  GNUNET_STATISTICS_get (statistics, NULL, NULL,
+                         &statistics_done,
+                         &statistics_result, NULL);
+}
+
+
+static void
+set_result_cb (void *cls,
+               const struct GNUNET_SET_Element *element,
+               uint64_t current_size,
+               enum GNUNET_SET_Status status)
+{
+  struct SetInfo *info = cls;
+  struct GNUNET_HashCode hash;
+
+  GNUNET_assert (GNUNET_NO == info->done);
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_DONE:
+  case GNUNET_SET_STATUS_HALF_DONE:
+    info->done = GNUNET_YES;
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "set %s done\n", info->id);
+    check_all_done ();
+    info->oh = NULL;
+    return;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    info->oh = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "failure\n");
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+
+  case GNUNET_SET_STATUS_ADD_LOCAL:
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "set %s: local element\n", info->id);
+    break;
+
+  case GNUNET_SET_STATUS_ADD_REMOTE:
+    GNUNET_CRYPTO_hash (element->data, element->size, &hash);
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO, "set %s: remote element %s\n", info->id,
+                GNUNET_h2s (&hash));
+    // XXX: record and check
+    return;
+
+  default:
+    GNUNET_assert (0);
+  }
+
+  if (element->size != element_size)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                "wrong element size: %u, expected %u\n",
+                element->size,
+                (unsigned int) sizeof(struct GNUNET_HashCode));
+    GNUNET_assert (0);
+  }
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "set %s: got element (%s)\n",
+              info->id, GNUNET_h2s (element->data));
+  GNUNET_assert (NULL != element->data);
+  struct GNUNET_HashCode data_hash;
+  GNUNET_CRYPTO_hash (element->data, element_size, &data_hash);
+  GNUNET_CONTAINER_multihashmap_put (info->received,
+                                     &data_hash, NULL,
+                                     GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+}
+
+
+static void
+set_listen_cb (void *cls,
+               const struct GNUNET_PeerIdentity *other_peer,
+               const struct GNUNET_MessageHeader *context_msg,
+               struct GNUNET_SET_Request *request)
+{
+  /* max. 2 options plus terminator */
+  struct GNUNET_SET_Option opts[3] = { { 0 } };
+  unsigned int n_opts = 0;
+
+  if (NULL == request)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "listener failed\n");
+    return;
+  }
+  GNUNET_assert (NULL == info2.oh);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "set listen cb called\n");
+  if (byzantine)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_BYZANTINE };
+  }
+  GNUNET_assert (! (force_full && force_delta));
+  if (force_full)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_FORCE_FULL };
+  }
+  if (force_delta)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_FORCE_DELTA };
+  }
+
+  opts[n_opts].type = 0;
+  info2.oh = GNUNET_SET_accept (request, GNUNET_SET_RESULT_SYMMETRIC,
+                                opts,
+                                set_result_cb, &info2);
+  GNUNET_SET_commit (info2.oh, info2.set);
+}
+
+
+static int
+set_insert_iterator (void *cls,
+                     const struct GNUNET_HashCode *key,
+                     void *value)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  struct GNUNET_SET_Element el;
+
+  el.element_type = 0;
+  el.data = value;
+  el.size = element_size;
+  GNUNET_SET_add_element (set, &el, NULL, NULL);
+  return GNUNET_YES;
+}
+
+
+static void
+handle_shutdown (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Shutting down set profiler\n");
+  if (NULL != set_listener)
+  {
+    GNUNET_SET_listen_cancel (set_listener);
+    set_listener = NULL;
+  }
+  if (NULL != info1.oh)
+  {
+    GNUNET_SET_operation_cancel (info1.oh);
+    info1.oh = NULL;
+  }
+  if (NULL != info2.oh)
+  {
+    GNUNET_SET_operation_cancel (info2.oh);
+    info2.oh = NULL;
+  }
+  if (NULL != info1.set)
+  {
+    GNUNET_SET_destroy (info1.set);
+    info1.set = NULL;
+  }
+  if (NULL != info2.set)
+  {
+    GNUNET_SET_destroy (info2.set);
+    info2.set = NULL;
+  }
+  GNUNET_STATISTICS_destroy (statistics, GNUNET_NO);
+}
+
+
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  unsigned int i;
+  struct GNUNET_HashCode hash;
+  /* max. 2 options plus terminator */
+  struct GNUNET_SET_Option opts[3] = { { 0 } };
+  unsigned int n_opts = 0;
+
+  config = cfg;
+
+  GNUNET_assert (element_size > 0);
+
+  if (GNUNET_OK != GNUNET_CRYPTO_get_peer_identity (cfg, &local_peer))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "could not retrieve host identity\n");
+    ret = 0;
+    return;
+  }
+
+  statistics = GNUNET_STATISTICS_create ("set-profiler", cfg);
+
+  GNUNET_SCHEDULER_add_shutdown (&handle_shutdown, NULL);
+
+  info1.id = "a";
+  info2.id = "b";
+
+  info1.sent = GNUNET_CONTAINER_multihashmap_create (num_a + 1, GNUNET_NO);
+  info2.sent = GNUNET_CONTAINER_multihashmap_create (num_b + 1, GNUNET_NO);
+  common_sent = GNUNET_CONTAINER_multihashmap_create (num_c + 1, GNUNET_NO);
+
+  info1.received = GNUNET_CONTAINER_multihashmap_create (num_a + 1, GNUNET_NO);
+  info2.received = GNUNET_CONTAINER_multihashmap_create (num_b + 1, GNUNET_NO);
+
+  for (i = 0; i < num_a; i++)
+  {
+    char *data = GNUNET_malloc (element_size);
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK, data, element_size);
+    GNUNET_CRYPTO_hash (data, element_size, &hash);
+    GNUNET_CONTAINER_multihashmap_put (info1.sent, &hash, data,
+                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  }
+
+  for (i = 0; i < num_b; i++)
+  {
+    char *data = GNUNET_malloc (element_size);
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK, data, element_size);
+    GNUNET_CRYPTO_hash (data, element_size, &hash);
+    GNUNET_CONTAINER_multihashmap_put (info2.sent, &hash, data,
+                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  }
+
+  for (i = 0; i < num_c; i++)
+  {
+    char *data = GNUNET_malloc (element_size);
+    GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK, data, element_size);
+    GNUNET_CRYPTO_hash (data, element_size, &hash);
+    GNUNET_CONTAINER_multihashmap_put (common_sent, &hash, data,
+                                       GNUNET_CONTAINER_MULTIHASHMAPOPTION_REPLACE);
+  }
+
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_STRONG, &app_id);
+
+  /* FIXME: also implement intersection etc. */
+  info1.set = GNUNET_SET_create (config, GNUNET_SET_OPERATION_UNION);
+  info2.set = GNUNET_SET_create (config, GNUNET_SET_OPERATION_UNION);
+
+  GNUNET_CONTAINER_multihashmap_iterate (info1.sent, set_insert_iterator,
+                                         info1.set);
+  GNUNET_CONTAINER_multihashmap_iterate (info2.sent, set_insert_iterator,
+                                         info2.set);
+  GNUNET_CONTAINER_multihashmap_iterate (common_sent, set_insert_iterator,
+                                         info1.set);
+  GNUNET_CONTAINER_multihashmap_iterate (common_sent, set_insert_iterator,
+                                         info2.set);
+
+  set_listener = GNUNET_SET_listen (config, GNUNET_SET_OPERATION_UNION,
+                                    &app_id, set_listen_cb, NULL);
+
+
+  if (byzantine)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_BYZANTINE };
+  }
+  GNUNET_assert (! (force_full && force_delta));
+  if (force_full)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_FORCE_FULL };
+  }
+  if (force_delta)
+  {
+    opts[n_opts++] = (struct GNUNET_SET_Option) { .type =
+                                                    GNUNET_SET_OPTION_FORCE_DELTA };
+  }
+
+  opts[n_opts].type = 0;
+
+  info1.oh = GNUNET_SET_prepare (&local_peer, &app_id, NULL,
+                                 GNUNET_SET_RESULT_SYMMETRIC,
+                                 opts,
+                                 set_result_cb, &info1);
+  GNUNET_SET_commit (info1.oh, info1.set);
+  GNUNET_SET_destroy (info1.set);
+  info1.set = NULL;
+}
+
+
+static void
+pre_run (void *cls, char *const *args, const char *cfgfile,
+         const struct GNUNET_CONFIGURATION_Handle *cfg)
+{
+  if (0 != GNUNET_TESTING_peer_run ("set-profiler",
+                                    cfgfile,
+                                    &run, NULL))
+    ret = 2;
+}
+
+
+int
+main (int argc, char **argv)
+{
+  struct GNUNET_GETOPT_CommandLineOption options[] = {
+    GNUNET_GETOPT_option_uint ('A',
+                               "num-first",
+                               NULL,
+                               gettext_noop ("number of values"),
+                               &num_a),
+
+    GNUNET_GETOPT_option_uint ('B',
+                               "num-second",
+                               NULL,
+                               gettext_noop ("number of values"),
+                               &num_b),
+
+    GNUNET_GETOPT_option_flag ('b',
+                               "byzantine",
+                               gettext_noop ("use byzantine mode"),
+                               &byzantine),
+
+    GNUNET_GETOPT_option_uint ('f',
+                               "force-full",
+                               NULL,
+                               gettext_noop ("force sending full set"),
+                               &force_full),
+
+    GNUNET_GETOPT_option_uint ('d',
+                               "force-delta",
+                               NULL,
+                               gettext_noop ("number delta operation"),
+                               &force_delta),
+
+    GNUNET_GETOPT_option_uint ('C',
+                               "num-common",
+                               NULL,
+                               gettext_noop ("number of values"),
+                               &num_c),
+
+    GNUNET_GETOPT_option_string ('x',
+                                 "operation",
+                                 NULL,
+                                 gettext_noop ("operation to execute"),
+                                 &op_str),
+
+    GNUNET_GETOPT_option_uint ('w',
+                               "element-size",
+                               NULL,
+                               gettext_noop ("element size"),
+                               &element_size),
+
+    GNUNET_GETOPT_option_filename ('s',
+                                   "statistics",
+                                   "FILENAME",
+                                   gettext_noop ("write statistics to file"),
+                                   &statistics_filename),
+
+    GNUNET_GETOPT_OPTION_END
+  };
+
+  GNUNET_PROGRAM_run2 (argc, argv, "gnunet-set-profiler",
+                       "help",
+                       options, &pre_run, NULL, GNUNET_YES);
+  return ret;
+}
diff --git a/src/contrib/service/set/ibf.c b/src/contrib/service/set/ibf.c
new file mode 100644
index 000000000..b6fb52b6b
--- /dev/null
+++ b/src/contrib/service/set/ibf.c
@@ -0,0 +1,410 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/ibf.c
+ * @brief implementation of the invertible bloom filter
+ * @author Florian Dold
+ */
+
+#include "platform.h"
+#include "ibf.h"
+
+/**
+ * Compute the key's hash from the key.
+ * Redefine to use a different hash function.
+ */
+#define IBF_KEY_HASH_VAL(k) (GNUNET_CRYPTO_crc32_n (&(k), sizeof(struct \
+                                                                 IBF_KeyHash)))
+
+/**
+ * Create a key from a hashcode.
+ *
+ * @param hash the hashcode
+ * @return a key
+ */
+struct IBF_Key
+ibf_key_from_hashcode (const struct GNUNET_HashCode *hash)
+{
+  return *(struct IBF_Key *) hash;
+}
+
+
+/**
+ * Create a hashcode from a key, by replicating the key
+ * until the hascode is filled
+ *
+ * @param key the key
+ * @param dst hashcode to store the result in
+ */
+void
+ibf_hashcode_from_key (struct IBF_Key key,
+                       struct GNUNET_HashCode *dst)
+{
+  struct IBF_Key *p;
+  unsigned int i;
+  const unsigned int keys_per_hashcode = sizeof(struct GNUNET_HashCode)
+                                         / sizeof(struct IBF_Key);
+
+  p = (struct IBF_Key *) dst;
+  for (i = 0; i < keys_per_hashcode; i++)
+    *p++ = key;
+}
+
+
+/**
+ * Create an invertible bloom filter.
+ *
+ * @param size number of IBF buckets
+ * @param hash_num number of buckets one element is hashed in
+ * @return the newly created invertible bloom filter, NULL on error
+ */
+struct InvertibleBloomFilter *
+ibf_create (uint32_t size, uint8_t hash_num)
+{
+  struct InvertibleBloomFilter *ibf;
+
+  GNUNET_assert (0 != size);
+
+  ibf = GNUNET_new (struct InvertibleBloomFilter);
+  ibf->count = GNUNET_malloc_large (size * sizeof(uint8_t));
+  if (NULL == ibf->count)
+  {
+    GNUNET_free (ibf);
+    return NULL;
+  }
+  ibf->key_sum = GNUNET_malloc_large (size * sizeof(struct IBF_Key));
+  if (NULL == ibf->key_sum)
+  {
+    GNUNET_free (ibf->count);
+    GNUNET_free (ibf);
+    return NULL;
+  }
+  ibf->key_hash_sum = GNUNET_malloc_large (size * sizeof(struct IBF_KeyHash));
+  if (NULL == ibf->key_hash_sum)
+  {
+    GNUNET_free (ibf->key_sum);
+    GNUNET_free (ibf->count);
+    GNUNET_free (ibf);
+    return NULL;
+  }
+  ibf->size = size;
+  ibf->hash_num = hash_num;
+
+  return ibf;
+}
+
+
+/**
+ * Store unique bucket indices for the specified key in dst.
+ */
+static void
+ibf_get_indices (const struct InvertibleBloomFilter *ibf,
+                 struct IBF_Key key,
+                 int *dst)
+{
+  uint32_t filled;
+  uint32_t i;
+  uint32_t bucket;
+
+  bucket = GNUNET_CRYPTO_crc32_n (&key, sizeof key);
+  for (i = 0, filled = 0; filled < ibf->hash_num; i++)
+  {
+    unsigned int j;
+    uint64_t x;
+    for (j = 0; j < filled; j++)
+      if (dst[j] == bucket)
+        goto try_next;
+    dst[filled++] = bucket % ibf->size;
+try_next:;
+    x = ((uint64_t) bucket << 32) | i;
+    bucket = GNUNET_CRYPTO_crc32_n (&x, sizeof x);
+  }
+}
+
+
+static void
+ibf_insert_into (struct InvertibleBloomFilter *ibf,
+                 struct IBF_Key key,
+                 const int *buckets, int side)
+{
+  int i;
+
+  for (i = 0; i < ibf->hash_num; i++)
+  {
+    const int bucket = buckets[i];
+    ibf->count[bucket].count_val += side;
+    ibf->key_sum[bucket].key_val ^= key.key_val;
+    ibf->key_hash_sum[bucket].key_hash_val
+      ^= IBF_KEY_HASH_VAL (key);
+  }
+}
+
+
+/**
+ * Insert a key into an IBF.
+ *
+ * @param ibf the IBF
+ * @param key the element's hash code
+ */
+void
+ibf_insert (struct InvertibleBloomFilter *ibf, struct IBF_Key key)
+{
+  int buckets[ibf->hash_num];
+
+  GNUNET_assert (ibf->hash_num <= ibf->size);
+  ibf_get_indices (ibf, key, buckets);
+  ibf_insert_into (ibf, key, buckets, 1);
+}
+
+
+/**
+ * Remove a key from an IBF.
+ *
+ * @param ibf the IBF
+ * @param key the element's hash code
+ */
+void
+ibf_remove (struct InvertibleBloomFilter *ibf, struct IBF_Key key)
+{
+  int buckets[ibf->hash_num];
+
+  GNUNET_assert (ibf->hash_num <= ibf->size);
+  ibf_get_indices (ibf, key, buckets);
+  ibf_insert_into (ibf, key, buckets, -1);
+}
+
+
+/**
+ * Test is the IBF is empty, i.e. all counts, keys and key hashes are zero.
+ */
+static int
+ibf_is_empty (struct InvertibleBloomFilter *ibf)
+{
+  int i;
+
+  for (i = 0; i < ibf->size; i++)
+  {
+    if (0 != ibf->count[i].count_val)
+      return GNUNET_NO;
+    if (0 != ibf->key_hash_sum[i].key_hash_val)
+      return GNUNET_NO;
+    if (0 != ibf->key_sum[i].key_val)
+      return GNUNET_NO;
+  }
+  return GNUNET_YES;
+}
+
+
+/**
+ * Decode and remove an element from the IBF, if possible.
+ *
+ * @param ibf the invertible bloom filter to decode
+ * @param ret_side sign of the cell's count where the decoded element came from.
+ *                 A negative sign indicates that the element was recovered
+ *                 resides in an IBF that was previously subtracted from.
+ * @param ret_id receives the hash code of the decoded element, if successful
+ * @return GNUNET_YES if decoding an element was successful,
+ *         GNUNET_NO if the IBF is empty,
+ *         GNUNET_SYSERR if the decoding has failed
+ */
+int
+ibf_decode (struct InvertibleBloomFilter *ibf,
+            int *ret_side, struct IBF_Key *ret_id)
+{
+  struct IBF_KeyHash hash;
+  int i;
+  int buckets[ibf->hash_num];
+
+  GNUNET_assert (NULL != ibf);
+
+  for (i = 0; i < ibf->size; i++)
+  {
+    int j;
+    int hit;
+
+    /* we can only decode from pure buckets */
+    if ((1 != ibf->count[i].count_val) && (-1 != ibf->count[i].count_val))
+      continue;
+
+    hash.key_hash_val = IBF_KEY_HASH_VAL (ibf->key_sum[i]);
+
+    /* test if the hash matches the key */
+    if (hash.key_hash_val != ibf->key_hash_sum[i].key_hash_val)
+      continue;
+
+    /* test if key in bucket hits its own location,
+     * if not, the key hash was subject to collision */
+    hit = GNUNET_NO;
+    ibf_get_indices (ibf, ibf->key_sum[i], buckets);
+    for (j = 0; j < ibf->hash_num; j++)
+      if (buckets[j] == i)
+        hit = GNUNET_YES;
+
+    if (GNUNET_NO == hit)
+      continue;
+
+    if (NULL != ret_side)
+      *ret_side = ibf->count[i].count_val;
+    if (NULL != ret_id)
+      *ret_id = ibf->key_sum[i];
+
+    /* insert on the opposite side, effectively removing the element */
+    ibf_insert_into (ibf, ibf->key_sum[i], buckets, -ibf->count[i].count_val);
+
+    return GNUNET_YES;
+  }
+
+  if (GNUNET_YES == ibf_is_empty (ibf))
+    return GNUNET_NO;
+  return GNUNET_SYSERR;
+}
+
+
+/**
+ * Write buckets from an ibf to a buffer.
+ * Exactly (IBF_BUCKET_SIZE*ibf->size) bytes are written to buf.
+ *
+ * @param ibf the ibf to write
+ * @param start with which bucket to start
+ * @param count how many buckets to write
+ * @param buf buffer to write the data to
+ */
+void
+ibf_write_slice (const struct InvertibleBloomFilter *ibf, uint32_t start,
+                 uint32_t count, void *buf)
+{
+  struct IBF_Key *key_dst;
+  struct IBF_KeyHash *key_hash_dst;
+  struct IBF_Count *count_dst;
+
+    GNUNET_assert (start + count <= ibf->size);
+
+  /* copy keys */
+  key_dst = (struct IBF_Key *) buf;
+  GNUNET_memcpy (key_dst, ibf->key_sum + start, count * sizeof *key_dst);
+  key_dst += count;
+  /* copy key hashes */
+  key_hash_dst = (struct IBF_KeyHash *) key_dst;
+  GNUNET_memcpy (key_hash_dst, ibf->key_hash_sum + start, count
+                 * sizeof *key_hash_dst);
+  key_hash_dst += count;
+  /* copy counts */
+  count_dst = (struct IBF_Count *) key_hash_dst;
+  GNUNET_memcpy (count_dst, ibf->count + start, count * sizeof *count_dst);
+}
+
+
+/**
+ * Read buckets from a buffer into an ibf.
+ *
+ * @param buf pointer to the buffer to read from
+ * @param start which bucket to start at
+ * @param count how many buckets to read
+ * @param ibf the ibf to read from
+ */
+void
+ibf_read_slice (const void *buf, uint32_t start, uint32_t count, struct
+                InvertibleBloomFilter *ibf)
+{
+  struct IBF_Key *key_src;
+  struct IBF_KeyHash *key_hash_src;
+  struct IBF_Count *count_src;
+
+  GNUNET_assert (count > 0);
+  GNUNET_assert (start + count <= ibf->size);
+
+  /* copy keys */
+  key_src = (struct IBF_Key *) buf;
+  GNUNET_memcpy (ibf->key_sum + start, key_src, count * sizeof *key_src);
+  key_src += count;
+  /* copy key hashes */
+  key_hash_src = (struct IBF_KeyHash *) key_src;
+  GNUNET_memcpy (ibf->key_hash_sum + start, key_hash_src, count
+                 * sizeof *key_hash_src);
+  key_hash_src += count;
+  /* copy counts */
+  count_src = (struct IBF_Count *) key_hash_src;
+  GNUNET_memcpy (ibf->count + start, count_src, count * sizeof *count_src);
+}
+
+
+/**
+ * Subtract ibf2 from ibf1, storing the result in ibf1.
+ * The two IBF's must have the same parameters size and hash_num.
+ *
+ * @param ibf1 IBF that is subtracted from
+ * @param ibf2 IBF that will be subtracted from ibf1
+ */
+void
+ibf_subtract (struct InvertibleBloomFilter *ibf1, const struct
+              InvertibleBloomFilter *ibf2)
+{
+  int i;
+
+  GNUNET_assert (ibf1->size == ibf2->size);
+  GNUNET_assert (ibf1->hash_num == ibf2->hash_num);
+
+  for (i = 0; i < ibf1->size; i++)
+  {
+    ibf1->count[i].count_val -= ibf2->count[i].count_val;
+    ibf1->key_hash_sum[i].key_hash_val ^= ibf2->key_hash_sum[i].key_hash_val;
+    ibf1->key_sum[i].key_val ^= ibf2->key_sum[i].key_val;
+  }
+}
+
+
+/**
+ * Create a copy of an IBF, the copy has to be destroyed properly.
+ *
+ * @param ibf the IBF to copy
+ */
+struct InvertibleBloomFilter *
+ibf_dup (const struct InvertibleBloomFilter *ibf)
+{
+  struct InvertibleBloomFilter *copy;
+
+  copy = GNUNET_malloc (sizeof *copy);
+  copy->hash_num = ibf->hash_num;
+  copy->size = ibf->size;
+  copy->key_hash_sum = GNUNET_memdup (ibf->key_hash_sum, ibf->size
+                                      * sizeof(struct IBF_KeyHash));
+  copy->key_sum = GNUNET_memdup (ibf->key_sum, ibf->size * sizeof(struct
+                                                                  IBF_Key));
+  copy->count = GNUNET_memdup (ibf->count, ibf->size * sizeof(struct
+                                                              IBF_Count));
+  return copy;
+}
+
+
+/**
+ * Destroy all resources associated with the invertible bloom filter.
+ * No more ibf_*-functions may be called on ibf after calling destroy.
+ *
+ * @param ibf the intertible bloom filter to destroy
+ */
+void
+ibf_destroy (struct InvertibleBloomFilter *ibf)
+{
+  GNUNET_free (ibf->key_sum);
+  GNUNET_free (ibf->key_hash_sum);
+  GNUNET_free (ibf->count);
+  GNUNET_free (ibf);
+}
diff --git a/src/contrib/service/set/ibf.h b/src/contrib/service/set/ibf.h
new file mode 100644
index 000000000..334a797ef
--- /dev/null
+++ b/src/contrib/service/set/ibf.h
@@ -0,0 +1,256 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2012 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/ibf.h
+ * @brief invertible bloom filter
+ * @author Florian Dold
+ */
+
+#ifndef GNUNET_CONSENSUS_IBF_H
+#define GNUNET_CONSENSUS_IBF_H
+
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+#ifdef __cplusplus
+extern "C"
+{
+#if 0                           /* keep Emacsens' auto-indent happy */
+}
+#endif
+#endif
+
+
+/**
+ * Keys that can be inserted into and removed from an IBF.
+ */
+struct IBF_Key
+{
+  uint64_t key_val;
+};
+
+
+/**
+ * Hash of an IBF key.
+ */
+struct IBF_KeyHash
+{
+  uint32_t key_hash_val;
+};
+
+
+/**
+ * Type of the count field of IBF buckets.
+ */
+struct IBF_Count
+{
+  int8_t count_val;
+};
+
+
+/**
+ * Size of one ibf bucket in bytes
+ */
+#define IBF_BUCKET_SIZE (sizeof(struct IBF_Count) + sizeof(struct IBF_Key)   \
+                         + sizeof(struct IBF_KeyHash))
+
+
+/**
+ * Invertible bloom filter (IBF).
+ *
+ * An IBF is a counting bloom filter that has the ability to restore
+ * the hashes of its stored elements with high probability.
+ */
+struct InvertibleBloomFilter
+{
+  /**
+   * How many cells does this IBF have?
+   */
+  uint32_t size;
+
+  /**
+   * In how many cells do we hash one element?
+   * Usually 4 or 3.
+   */
+  uint8_t hash_num;
+
+  /**
+   * Xor sums of the elements' keys, used to identify the elements.
+   * Array of 'size' elements.
+   */
+  struct IBF_Key *key_sum;
+
+  /**
+   * Xor sums of the hashes of the keys of inserted elements.
+   * Array of 'size' elements.
+   */
+  struct IBF_KeyHash *key_hash_sum;
+
+  /**
+   * How many times has a bucket been hit?
+   * Can be negative, as a result of IBF subtraction.
+   * Array of 'size' elements.
+   */
+  struct IBF_Count *count;
+};
+
+
+/**
+ * Write buckets from an ibf to a buffer.
+ * Exactly (IBF_BUCKET_SIZE*ibf->size) bytes are written to buf.
+ *
+ * @param ibf the ibf to write
+ * @param start with which bucket to start
+ * @param count how many buckets to write
+ * @param buf buffer to write the data to
+ */
+void
+ibf_write_slice (const struct InvertibleBloomFilter *ibf,
+                 uint32_t start,
+                 uint32_t count,
+                 void *buf);
+
+
+/**
+ * Read buckets from a buffer into an ibf.
+ *
+ * @param buf pointer to the buffer to read from
+ * @param start which bucket to start at
+ * @param count how many buckets to read
+ * @param ibf the ibf to write to
+ */
+void
+ibf_read_slice (const void *buf,
+                uint32_t start,
+                uint32_t count,
+                struct InvertibleBloomFilter *ibf);
+
+
+/**
+ * Create a key from a hashcode.
+ *
+ * @param hash the hashcode
+ * @return a key
+ */
+struct IBF_Key
+ibf_key_from_hashcode (const struct GNUNET_HashCode *hash);
+
+
+/**
+ * Create a hashcode from a key, by replicating the key
+ * until the hascode is filled
+ *
+ * @param key the key
+ * @param dst hashcode to store the result in
+ */
+void
+ibf_hashcode_from_key (struct IBF_Key key, struct GNUNET_HashCode *dst);
+
+
+/**
+ * Create an invertible bloom filter.
+ *
+ * @param size number of IBF buckets
+ * @param hash_num number of buckets one element is hashed in, usually 3 or 4
+ * @return the newly created invertible bloom filter, NULL on error
+ */
+struct InvertibleBloomFilter *
+ibf_create (uint32_t size, uint8_t hash_num);
+
+
+/**
+ * Insert a key into an IBF.
+ *
+ * @param ibf the IBF
+ * @param key the element's hash code
+ */
+void
+ibf_insert (struct InvertibleBloomFilter *ibf, struct IBF_Key key);
+
+
+/**
+ * Remove a key from an IBF.
+ *
+ * @param ibf the IBF
+ * @param key the element's hash code
+ */
+void
+ibf_remove (struct InvertibleBloomFilter *ibf, struct IBF_Key key);
+
+
+/**
+ * Subtract ibf2 from ibf1, storing the result in ibf1.
+ * The two IBF's must have the same parameters size and hash_num.
+ *
+ * @param ibf1 IBF that is subtracted from
+ * @param ibf2 IBF that will be subtracted from ibf1
+ */
+void
+ibf_subtract (struct InvertibleBloomFilter *ibf1,
+              const struct InvertibleBloomFilter *ibf2);
+
+
+/**
+ * Decode and remove an element from the IBF, if possible.
+ *
+ * @param ibf the invertible bloom filter to decode
+ * @param ret_side sign of the cell's count where the decoded element came from.
+ *                 A negative sign indicates that the element was recovered
+ *                 resides in an IBF that was previously subtracted from.
+ * @param ret_id receives the hash code of the decoded element, if successful
+ * @return #GNUNET_YES if decoding an element was successful,
+ *         #GNUNET_NO if the IBF is empty,
+ *         #GNUNET_SYSERR if the decoding has failed
+ */
+int
+ibf_decode (struct InvertibleBloomFilter *ibf,
+            int *ret_side,
+            struct IBF_Key *ret_id);
+
+
+/**
+ * Create a copy of an IBF, the copy has to be destroyed properly.
+ *
+ * @param ibf the IBF to copy
+ */
+struct InvertibleBloomFilter *
+ibf_dup (const struct InvertibleBloomFilter *ibf);
+
+
+/**
+ * Destroy all resources associated with the invertible bloom filter.
+ * No more ibf_*-functions may be called on ibf after calling destroy.
+ *
+ * @param ibf the intertible bloom filter to destroy
+ */
+void
+ibf_destroy (struct InvertibleBloomFilter *ibf);
+
+
+
+#if 0                           /* keep Emacsens' auto-indent happy */
+{
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/contrib/service/set/ibf_sim.c b/src/contrib/service/set/ibf_sim.c
new file mode 100644
index 000000000..563ed0fb8
--- /dev/null
+++ b/src/contrib/service/set/ibf_sim.c
@@ -0,0 +1,143 @@
+/*
+      This file is part of GNUnet
+      Copyright (C) 2013 GNUnet e.V.
+
+      GNUnet is free software: you can redistribute it and/or modify it
+      under the terms of the GNU Affero General Public License as published
+      by the Free Software Foundation, either version 3 of the License,
+      or (at your option) any later version.
+
+      GNUnet is distributed in the hope that it will be useful, but
+      WITHOUT ANY WARRANTY; without even the implied warranty of
+      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+      Affero General Public License for more details.
+
+      You should have received a copy of the GNU Affero General Public License
+      along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/ibf_sim.c
+ * @brief implementation of simulation for invertible bloom filter
+ * @author Florian Dold
+ *
+ * This code was used for some internal experiments, it is not
+ * build or shipped as part of the GNUnet system.
+ */
+#include "platform.h"
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAX_IBF_DECODE 16
+
+/* report average over how many rounds? */
+#define ROUNDS 100000
+
+/* enable one of the three below */
+// simple fix
+#define FIX1 0
+// possibly slightly better fix for large IBF_DECODE values
+#define FIX2 1
+
+// SIGCOMM algorithm
+#define STRATA 0
+
+// print each value?
+#define VERBOSE 0
+// avoid assembly? (ASM is about 50% faster)
+#define SLOW 0
+
+int
+main (int argc, char **argv)
+{
+  unsigned int round;
+  unsigned int buckets[31]; // max is 2^31 as 'random' returns only between 0 and 2^31
+  unsigned int i;
+  int j;
+  unsigned int r;
+  unsigned int ret;
+  unsigned long long total;
+  unsigned int want;
+  double predict;
+
+  srandom (time (NULL));
+  total = 0;
+  want = atoi (argv[1]);
+  for (round = 0; round < ROUNDS; round++)
+  {
+    memset (buckets, 0, sizeof(buckets));
+    for (i = 0; i < want; i++)
+    {
+      /* FIXME: might want to use 'better' PRNG to avoid
+         PRNG-induced biases */
+      r = random ();
+      if (0 == r)
+        continue;
+#if SLOW
+      for (j = 0; (j < 31) && (0 == (r & (1 << j))); j++)
+        ;
+#else
+      /* use assembly / gcc */
+      j = __builtin_ffs (r) - 1;
+#endif
+      buckets[j]++;
+    }
+    ret = 0;
+    predict = 0.0;
+    for (j = 31; j >= 0; j--)
+    {
+#if FIX1
+      /* improved algorithm, for 1000 elements with IBF-DECODE 8, I
+         get 990/1000 elements on average over 1 million runs; key
+         idea being to stop short of the 'last' possible IBF as
+         otherwise a "lowball" per-chance would unduely influence the
+         result */if ((j > 0) &&
+          (buckets[j - 1] > MAX_IBF_DECODE))
+      {
+        ret *= (1 << (j + 1));
+        break;
+      }
+#endif
+#if FIX2
+      /* another improvement: don't just always cut off the last one,
+         but rather try to predict based on all previous values where
+         that "last" one is; additional prediction can only really
+         work if MAX_IBF_DECODE is sufficiently high */
+      if ((j > 0) &&
+          ((buckets[j - 1] > MAX_IBF_DECODE) ||
+           (predict > MAX_IBF_DECODE)))
+      {
+        ret *= (1 << (j + 1));
+        break;
+      }
+#endif
+#if STRATA
+      /* original algorithm, for 1000 elements with IBF-DECODE 8,
+         I get 920/1000 elements on average over 1 million runs */
+      if (buckets[j] > MAX_IBF_DECODE)
+      {
+        ret *= (1 << (j + 1));
+        break;
+      }
+#endif
+      ret += buckets[j];
+      predict = (buckets[j] + 2.0 * predict) / 2.0;
+    }
+#if VERBOSE
+    fprintf (stderr, "%u ", ret);
+#endif
+    total += ret;
+  }
+  fprintf (stderr, "\n");
+  fprintf (stdout, "average %llu\n", total / ROUNDS);
+  return 0;
+}
+
+
+/* TODO: should calculate stddev of the results to also be able to
+   say something about the stability of the results, outside of
+   large-scale averages -- gaining 8% precision at the expense of
+   50% additional variance might not be worth it... */
diff --git a/src/contrib/service/set/meson.build b/src/contrib/service/set/meson.build
new file mode 100644
index 000000000..fe4934cb9
--- /dev/null
+++ b/src/contrib/service/set/meson.build
@@ -0,0 +1,52 @@
+libgnunetset_src = ['set_api.c']
+
+gnunetserviceset_src = ['gnunet-service-set.c',
+                        'gnunet-service-set_union.c',
+                        'gnunet-service-set_intersection.c',
+                        'gnunet-service-set_union_strata_estimator.c',
+                        'ibf.c']
+
+configure_file(input : 'set.conf.in',
+               output : 'set.conf',
+               configuration : cdata,
+               install: true,
+               install_dir: pkgcfgdir)
+
+
+if get_option('monolith')
+  #foreach p : libgnunetset_src + gnunetserviceset_src
+  #  gnunet_src += 'set/' + p
+  #endforeach
+  subdir_done()
+endif
+
+libgnunetset = library('gnunetset',
+        libgnunetset_src,
+        soversion: '0',
+        version: '0.0.0',
+        dependencies: libgnunetutil_dep,
+        include_directories: [incdir, configuration_inc],
+        install: true,
+        install_dir: get_option('libdir'))
+pkg.generate(libgnunetset, url: 'https://www.gnunet.org',
+             description : 'Provides API for accessing the set service')
+libgnunetset_dep = declare_dependency(link_with : libgnunetset)
+shared_module('gnunet_plugin_block_set_test',
+              ['plugin_block_set_test.c'],
+              dependencies: libgnunetutil_dep,
+              include_directories: [incdir, configuration_inc],
+              install:true,
+              install_dir: get_option('libdir')/'gnunet')
+executable ('gnunet-service-set',
+            gnunetserviceset_src,
+            dependencies: [libgnunetset_dep,
+                           libgnunetutil_dep,
+                           m_dep,
+                           libgnunetstatistics_dep,
+                           libgnunetcore_dep,
+                           libgnunetcadet_dep,
+                           libgnunetblock_dep],
+            include_directories: [incdir, configuration_inc],
+            install: true,
+            install_dir: get_option('libdir') / 'gnunet' / 'libexec')
+
diff --git a/src/contrib/service/set/plugin_block_set_test.c b/src/contrib/service/set/plugin_block_set_test.c
new file mode 100644
index 000000000..cb5cef5ad
--- /dev/null
+++ b/src/contrib/service/set/plugin_block_set_test.c
@@ -0,0 +1,167 @@
+/*
+     This file is part of GNUnet
+     Copyright (C) 2017 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/plugin_block_set_test.c
+ * @brief set test block, recognizes elements with non-zero first byte as invalid
+ * @author Christian Grothoff
+ */
+
+#include "platform.h"
+#include "gnunet_block_plugin.h"
+#include "gnunet_block_group_lib.h"
+
+
+/**
+ * Function called to validate a query.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @return #GNUNET_OK if the query is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_set_test_check_query (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size)
+{
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a block for storage.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block data to validate
+ * @param block_size number of bytes in @a block
+ * @return #GNUNET_OK if the block is fine, #GNUNET_NO if not
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_set_test_check_block (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    const void *block,
+                                    size_t block_size)
+{
+  if ((NULL == block) ||
+      (0 == block_size) ||
+      (0 != ((char *) block)[0]))
+    return GNUNET_SYSERR;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Function called to validate a reply to a request.  Note that it is assumed
+ * that the reply has already been matched to the key (and signatures checked)
+ * as it would be done with the GetKeyFunction and the
+ * BlockEvaluationFunction.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param group which block group to use for evaluation
+ * @param query original query (hash)
+ * @param xquery extrended query data (can be NULL, depending on type)
+ * @param xquery_size number of bytes in @a xquery
+ * @param reply_block response to validate
+ * @param reply_block_size number of bytes in @a reply_block
+ * @return characterization of result
+ */
+static enum GNUNET_BLOCK_ReplyEvaluationResult
+block_plugin_set_test_check_reply (void *cls,
+                                    enum GNUNET_BLOCK_Type type,
+                                    struct GNUNET_BLOCK_Group *group,
+                                    const struct GNUNET_HashCode *query,
+                                    const void *xquery,
+                                    size_t xquery_size,
+                                    const void *reply_block,
+                                    size_t reply_block_size)
+{
+  if ((NULL == reply_block) ||
+      (0 == reply_block_size) ||
+      (0 != ((char *) reply_block)[0]))
+    GNUNET_assert (0);
+  return GNUNET_BLOCK_REPLY_OK_MORE;
+}
+
+
+/**
+ * Function called to obtain the key for a block.
+ *
+ * @param cls closure
+ * @param type block type
+ * @param block block to get the key for
+ * @param block_size number of bytes in block
+ * @param key set to the key (query) for the given block
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if type not supported
+ *         (or if extracting a key from a block of this type does not work)
+ */
+static enum GNUNET_GenericReturnValue
+block_plugin_set_test_get_key (void *cls,
+                               enum GNUNET_BLOCK_Type type,
+                               const void *block,
+                               size_t block_size,
+                               struct GNUNET_HashCode *key)
+{
+  return GNUNET_NO;
+}
+
+
+/**
+ * Entry point for the plugin.
+ */
+void *
+libgnunet_plugin_block_set_test_init (void *cls)
+{
+  static const enum GNUNET_BLOCK_Type types[] = {
+    GNUNET_BLOCK_TYPE_SET_TEST,
+    GNUNET_BLOCK_TYPE_ANY       /* end of list */
+  };
+  struct GNUNET_BLOCK_PluginFunctions *api;
+
+  api = GNUNET_new (struct GNUNET_BLOCK_PluginFunctions);
+  api->get_key = &block_plugin_set_test_get_key;
+  api->check_query = &block_plugin_set_test_check_query;
+  api->check_block = &block_plugin_set_test_check_block;
+  api->check_reply = &block_plugin_set_test_check_reply;
+  api->types = types;
+  return api;
+}
+
+
+/**
+ * Exit point from the plugin.
+ */
+void *
+libgnunet_plugin_block_set_test_done (void *cls)
+{
+  struct GNUNET_BLOCK_PluginFunctions *api = cls;
+
+  GNUNET_free (api);
+  return NULL;
+}
+
+
+/* end of plugin_block_set_test.c */
diff --git a/src/contrib/service/set/set.conf.in b/src/contrib/service/set/set.conf.in
new file mode 100644
index 000000000..66bcfa169
--- /dev/null
+++ b/src/contrib/service/set/set.conf.in
@@ -0,0 +1,12 @@
+[set]
+START_ON_DEMAND = @START_ON_DEMAND@
+@UNIXONLY@PORT = 2106
+HOSTNAME = localhost
+BINARY = gnunet-service-set
+ACCEPT_FROM = 127.0.0.1;
+ACCEPT_FROM6 = ::1;
+UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-set.sock
+UNIX_MATCH_UID = YES
+UNIX_MATCH_GID = YES
+
+#PREFIX = valgrind
diff --git a/src/contrib/service/set/set.h b/src/contrib/service/set/set.h
new file mode 100644
index 000000000..e9d10ea22
--- /dev/null
+++ b/src/contrib/service/set/set.h
@@ -0,0 +1,400 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012-2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/set.h
+ * @brief messages used for the set api
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#ifndef SET_H
+#define SET_H
+
+#include "platform.h"
+#include "gnunet_common.h"
+#include "gnunet_set_service.h"
+
+GNUNET_NETWORK_STRUCT_BEGIN
+
+/**
+ * Message sent by the client to the service to ask starting
+ * a new set to perform operations with.  Includes the desired
+ * set operation type.
+ */
+struct GNUNET_SET_CreateMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_CREATE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Operation type, values of `enum GNUNET_SET_OperationType`
+   */
+  uint32_t operation GNUNET_PACKED;
+};
+
+
+/**
+ * Message sent by the client to the service to start listening for
+ * incoming requests to perform a certain type of set operation for a
+ * certain type of application.
+ */
+struct GNUNET_SET_ListenMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_LISTEN
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Operation type, values of `enum GNUNET_SET_OperationType`
+   */
+  uint32_t operation GNUNET_PACKED;
+
+  /**
+   * application id
+   */
+  struct GNUNET_HashCode app_id;
+};
+
+
+/**
+ * Message sent by a listening client to the service to accept
+ * performing the operation with the other peer.
+ */
+struct GNUNET_SET_AcceptMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_ACCEPT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * ID of the incoming request we want to accept.
+   */
+  uint32_t accept_reject_id GNUNET_PACKED;
+
+  /**
+   * Request ID to identify responses.
+   */
+  uint32_t request_id GNUNET_PACKED;
+
+  /**
+   * How should results be sent to us?
+   * See `enum GNUNET_SET_ResultMode`.
+   */
+  uint32_t result_mode GNUNET_PACKED;
+
+  /**
+   * Always use delta operation instead of sending full sets,
+   * even it it's less efficient.
+   */
+  uint8_t force_delta;
+
+  /**
+   * Always send full sets, even if delta operations would
+   * be more efficient.
+   */
+  uint8_t force_full;
+
+  /**
+   * #GNUNET_YES to fail operations where Byzantine faults
+   * are suspected
+   */
+  uint8_t byzantine;
+
+  /**
+   * Lower bound for the set size, used only when
+   * byzantine mode is enabled.
+   */
+  uint8_t byzantine_lower_bound;
+};
+
+
+/**
+ * Message sent by a listening client to the service to reject
+ * performing the operation with the other peer.
+ */
+struct GNUNET_SET_RejectMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_REJECT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * ID of the incoming request we want to reject.
+   */
+  uint32_t accept_reject_id GNUNET_PACKED;
+};
+
+
+/**
+ * A request for an operation with another client.
+ */
+struct GNUNET_SET_RequestMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_REQUEST.
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * ID of the to identify the request when accepting or
+   * rejecting it.
+   */
+  uint32_t accept_id GNUNET_PACKED;
+
+  /**
+   * Identity of the requesting peer.
+   */
+  struct GNUNET_PeerIdentity peer_id;
+
+  /* rest: context message, that is, application-specific
+     message to convince listener to pick up */
+};
+
+
+/**
+ * Message sent by client to service to initiate a set operation as a
+ * client (not as listener).  A set (which determines the operation
+ * type) must already exist in association with this client.
+ */
+struct GNUNET_SET_EvaluateMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_EVALUATE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * How should results be sent to us?
+   * See `enum GNUNET_SET_ResultMode`.
+   */
+  uint32_t result_mode GNUNET_PACKED;
+
+  /**
+   * Peer to evaluate the operation with
+   */
+  struct GNUNET_PeerIdentity target_peer;
+
+  /**
+   * Application id
+   */
+  struct GNUNET_HashCode app_id;
+
+  /**
+   * Id of our set to evaluate, chosen implicitly by the client when it
+   * calls #GNUNET_SET_commit().
+   */
+  uint32_t request_id GNUNET_PACKED;
+
+  /**
+   * Always use delta operation instead of sending full sets,
+   * even it it's less efficient.
+   */
+  uint8_t force_delta;
+
+  /**
+   * Always send full sets, even if delta operations would
+   * be more efficient.
+   */
+  uint8_t force_full;
+
+  /**
+   * #GNUNET_YES to fail operations where Byzantine faults
+   * are suspected
+   */
+  uint8_t byzantine;
+
+  /**
+   * Lower bound for the set size, used only when
+   * byzantine mode is enabled.
+   */
+  uint8_t byzantine_lower_bound;
+
+  /* rest: context message, that is, application-specific
+     message to convince listener to pick up */
+};
+
+
+/**
+ * Message sent by the service to the client to indicate an
+ * element that is removed (set intersection) or added
+ * (set union) or part of the final result, depending on
+ * options specified for the operation.
+ */
+struct GNUNET_SET_ResultMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_RESULT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Current set size.
+   */
+  uint64_t current_size;
+
+  /**
+   * id the result belongs to
+   */
+  uint32_t request_id GNUNET_PACKED;
+
+  /**
+   * Was the evaluation successful? Contains
+   * an `enum GNUNET_SET_Status` in NBO.
+   */
+  uint16_t result_status GNUNET_PACKED;
+
+  /**
+   * Type of the element attached to the message, if any.
+   */
+  uint16_t element_type GNUNET_PACKED;
+
+  /* rest: the actual element */
+};
+
+
+/**
+ * Message sent by client to the service to add or remove
+ * an element to/from the set.
+ */
+struct GNUNET_SET_ElementMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_ADD or
+   *       #GNUNET_MESSAGE_TYPE_SET_REMOVE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Type of the element to add or remove.
+   */
+  uint16_t element_type GNUNET_PACKED;
+
+  /**
+   * For alignment, always zero.
+   */
+  uint16_t reserved GNUNET_PACKED;
+
+  /* rest: the actual element */
+};
+
+
+/**
+ * Sent to the service by the client
+ * in order to cancel a set operation.
+ */
+struct GNUNET_SET_CancelMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_CANCEL
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * ID of the request we want to cancel.
+   */
+  uint32_t request_id GNUNET_PACKED;
+};
+
+
+/**
+ * Set element transmitted by service to client in response to a set
+ * iteration request.
+ */
+struct GNUNET_SET_IterResponseMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_ITER_ELEMENT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * To which set iteration does this response belong to?  First
+   * iteration (per client) has counter zero. Wraps around.
+   */
+  uint16_t iteration_id GNUNET_PACKED;
+
+  /**
+   * Type of the element attached to the message,
+   * if any.
+   */
+  uint16_t element_type GNUNET_PACKED;
+
+  /* rest: element */
+};
+
+
+/**
+ * Client acknowledges receiving element in iteration.
+ */
+struct GNUNET_SET_IterAckMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_ITER_ACK
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Non-zero if the service should continue sending elements.
+   */
+  uint32_t send_more;
+};
+
+
+/**
+ * Server responds to a lazy copy request.
+ */
+struct GNUNET_SET_CopyLazyResponseMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_RESPONSE
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Temporary name for the copied set.
+   */
+  uint32_t cookie;
+};
+
+
+/**
+ * Client connects to a lazily copied set.
+ */
+struct GNUNET_SET_CopyLazyConnectMessage
+{
+  /**
+   * Type: #GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_CONNECT
+   */
+  struct GNUNET_MessageHeader header;
+
+  /**
+   * Temporary name for the copied set.
+   */
+  uint32_t cookie;
+};
+
+
+GNUNET_NETWORK_STRUCT_END
+
+#endif
diff --git a/src/contrib/service/set/set_api.c b/src/contrib/service/set/set_api.c
new file mode 100644
index 000000000..4f73ff06c
--- /dev/null
+++ b/src/contrib/service/set/set_api.c
@@ -0,0 +1,1199 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012-2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+/**
+ * @file set/set_api.c
+ * @brief api for the set service
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_protocols.h"
+#include "gnunet_set_service.h"
+#include "set.h"
+
+
+#define LOG(kind, ...) GNUNET_log_from (kind, "set-api", __VA_ARGS__)
+
+struct SetCopyRequest
+{
+  struct SetCopyRequest *next;
+
+  struct SetCopyRequest *prev;
+
+  void *cls;
+
+  GNUNET_SET_CopyReadyCallback cb;
+};
+
+/**
+ * Opaque handle to a set.
+ */
+struct GNUNET_SET_Handle
+{
+  /**
+   * Message queue for @e client.
+   */
+  struct GNUNET_MQ_Handle *mq;
+
+  /**
+   * Linked list of operations on the set.
+   */
+  struct GNUNET_SET_OperationHandle *ops_head;
+
+  /**
+   * Linked list of operations on the set.
+   */
+  struct GNUNET_SET_OperationHandle *ops_tail;
+
+  /**
+   * Callback for the current iteration over the set,
+   * NULL if no iterator is active.
+   */
+  GNUNET_SET_ElementIterator iterator;
+
+  /**
+   * Closure for @e iterator
+   */
+  void *iterator_cls;
+
+  /**
+   * Should the set be destroyed once all operations are gone?
+   * #GNUNET_SYSERR if #GNUNET_SET_destroy() must raise this flag,
+   * #GNUNET_YES if #GNUNET_SET_destroy() did raise this flag.
+   */
+  int destroy_requested;
+
+  /**
+   * Has the set become invalid (e.g. service died)?
+   */
+  int invalid;
+
+  /**
+   * Both client and service count the number of iterators
+   * created so far to match replies with iterators.
+   */
+  uint16_t iteration_id;
+
+  /**
+   * Configuration, needed when creating (lazy) copies.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Doubly linked list of copy requests.
+   */
+  struct SetCopyRequest *copy_req_head;
+
+  /**
+   * Doubly linked list of copy requests.
+   */
+  struct SetCopyRequest *copy_req_tail;
+};
+
+
+/**
+ * Handle for a set operation request from another peer.
+ */
+struct GNUNET_SET_Request
+{
+  /**
+   * Id of the request, used to identify the request when
+   * accepting/rejecting it.
+   */
+  uint32_t accept_id;
+
+  /**
+   * Has the request been accepted already?
+   * #GNUNET_YES/#GNUNET_NO
+   */
+  int accepted;
+};
+
+
+/**
+ * Handle to an operation.  Only known to the service after committing
+ * the handle with a set.
+ */
+struct GNUNET_SET_OperationHandle
+{
+  /**
+   * Function to be called when we have a result,
+   * or an error.
+   */
+  GNUNET_SET_ResultIterator result_cb;
+
+  /**
+   * Closure for @e result_cb.
+   */
+  void *result_cls;
+
+  /**
+   * Local set used for the operation,
+   * NULL if no set has been provided by conclude yet.
+   */
+  struct GNUNET_SET_Handle *set;
+
+  /**
+   * Message sent to the server on calling conclude,
+   * NULL if conclude has been called.
+   */
+  struct GNUNET_MQ_Envelope *conclude_mqm;
+
+  /**
+   * Address of the request if in the conclude message,
+   * used to patch the request id into the message when the set is known.
+   */
+  uint32_t *request_id_addr;
+
+  /**
+   * Handles are kept in a linked list.
+   */
+  struct GNUNET_SET_OperationHandle *prev;
+
+  /**
+   * Handles are kept in a linked list.
+   */
+  struct GNUNET_SET_OperationHandle *next;
+
+  /**
+   * Request ID to identify the operation within the set.
+   */
+  uint32_t request_id;
+};
+
+
+/**
+ * Opaque handle to a listen operation.
+ */
+struct GNUNET_SET_ListenHandle
+{
+  /**
+   * Message queue for the client.
+   */
+  struct GNUNET_MQ_Handle*mq;
+
+  /**
+   * Configuration handle for the listener, stored
+   * here to be able to reconnect transparently on
+   * connection failure.
+   */
+  const struct GNUNET_CONFIGURATION_Handle *cfg;
+
+  /**
+   * Function to call on a new incoming request,
+   * or on error.
+   */
+  GNUNET_SET_ListenCallback listen_cb;
+
+  /**
+   * Closure for @e listen_cb.
+   */
+  void *listen_cls;
+
+  /**
+   * Application ID we listen for.
+   */
+  struct GNUNET_HashCode app_id;
+
+  /**
+   * Time to wait until we try to reconnect on failure.
+   */
+  struct GNUNET_TIME_Relative reconnect_backoff;
+
+  /**
+   * Task for reconnecting when the listener fails.
+   */
+  struct GNUNET_SCHEDULER_Task *reconnect_task;
+
+  /**
+   * Operation we listen for.
+   */
+  enum GNUNET_SET_OperationType operation;
+};
+
+
+/* mutual recursion with handle_copy_lazy */
+static struct GNUNET_SET_Handle *
+create_internal (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                 enum GNUNET_SET_OperationType op,
+                 const uint32_t *cookie);
+
+
+/**
+ * Handle element for iteration over the set.  Notifies the
+ * iterator and sends an acknowledgement to the service.
+ *
+ * @param cls the `struct GNUNET_SET_Handle *`
+ * @param msg the message
+ */
+static void
+handle_copy_lazy (void *cls,
+                  const struct GNUNET_SET_CopyLazyResponseMessage *msg)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  struct SetCopyRequest *req;
+  struct GNUNET_SET_Handle *new_set;
+
+  req = set->copy_req_head;
+  if (NULL == req)
+  {
+    /* Service sent us unsolicited lazy copy response */
+    GNUNET_break (0);
+    return;
+  }
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Handling response to lazy copy\n");
+  GNUNET_CONTAINER_DLL_remove (set->copy_req_head,
+                               set->copy_req_tail,
+                               req);
+  // We pass none as operation here, since it doesn't matter when
+  // cloning.
+  new_set = create_internal (set->cfg,
+                             GNUNET_SET_OPERATION_NONE,
+                             &msg->cookie);
+  req->cb (req->cls, new_set);
+  GNUNET_free (req);
+}
+
+
+/**
+ * Check that the given @a msg is well-formed.
+ *
+ * @param cls closure
+ * @param msg message to check
+ * @return #GNUNET_OK if message is well-formed
+ */
+static int
+check_iter_element (void *cls,
+                    const struct GNUNET_SET_IterResponseMessage *msg)
+{
+  /* minimum size was already checked, everything else is OK! */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle element for iteration over the set.  Notifies the
+ * iterator and sends an acknowledgement to the service.
+ *
+ * @param cls the `struct GNUNET_SET_Handle *`
+ * @param msg the message
+ */
+static void
+handle_iter_element (void *cls,
+                     const struct GNUNET_SET_IterResponseMessage *msg)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  GNUNET_SET_ElementIterator iter = set->iterator;
+  struct GNUNET_SET_Element element;
+  struct GNUNET_SET_IterAckMessage *ack_msg;
+  struct GNUNET_MQ_Envelope *ev;
+  uint16_t msize;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Received element in set iteration\n");
+  msize = ntohs (msg->header.size);
+  if (set->iteration_id != ntohs (msg->iteration_id))
+  {
+    /* element from a previous iteration, skip! */
+    iter = NULL;
+  }
+  if (NULL != iter)
+  {
+    element.size = msize - sizeof(struct GNUNET_SET_IterResponseMessage);
+    element.element_type = ntohs (msg->element_type);
+    element.data = &msg[1];
+    iter (set->iterator_cls,
+          &element);
+  }
+  ev = GNUNET_MQ_msg (ack_msg,
+                      GNUNET_MESSAGE_TYPE_SET_ITER_ACK);
+  ack_msg->send_more = htonl ((NULL != iter));
+  GNUNET_MQ_send (set->mq, ev);
+}
+
+
+/**
+ * Handle message signalling conclusion of iteration over the set.
+ * Notifies the iterator that we are done.
+ *
+ * @param cls the set
+ * @param mh the message
+ */
+static void
+handle_iter_done (void *cls,
+                  const struct GNUNET_MessageHeader *mh)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  GNUNET_SET_ElementIterator iter = set->iterator;
+
+  if (NULL == iter)
+  {
+    /* FIXME: if this is true, could cancel+start a fresh one
+       cause elements to go to the wrong iteration? */
+    LOG (GNUNET_ERROR_TYPE_INFO,
+         "Service completed set iteration that was already cancelled\n");
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Set iteration completed\n");
+  set->destroy_requested = GNUNET_SYSERR;
+  set->iterator = NULL;
+  set->iteration_id++;
+  iter (set->iterator_cls,
+        NULL);
+  if (GNUNET_SYSERR == set->destroy_requested)
+    set->destroy_requested = GNUNET_NO;
+  if (GNUNET_YES == set->destroy_requested)
+    GNUNET_SET_destroy (set);
+}
+
+
+/**
+ * Check that the given @a msg is well-formed.
+ *
+ * @param cls closure
+ * @param msg message to check
+ * @return #GNUNET_OK if message is well-formed
+ */
+static int
+check_result (void *cls,
+              const struct GNUNET_SET_ResultMessage *msg)
+{
+  /* minimum size was already checked, everything else is OK! */
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle result message for a set operation.
+ *
+ * @param cls the set
+ * @param mh the message
+ */
+static void
+handle_result (void *cls,
+               const struct GNUNET_SET_ResultMessage *msg)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  struct GNUNET_SET_OperationHandle *oh;
+  struct GNUNET_SET_Element e;
+  enum GNUNET_SET_Status result_status;
+  int destroy_set;
+
+  GNUNET_assert (NULL != set->mq);
+  result_status = (enum GNUNET_SET_Status) ntohs (msg->result_status);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Got result message with status %d\n",
+       result_status);
+
+  oh = GNUNET_MQ_assoc_get (set->mq,
+                            ntohl (msg->request_id));
+  if (NULL == oh)
+  {
+    /* 'oh' can be NULL if we canceled the operation, but the service
+       did not get the cancel message yet. */
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Ignoring result from canceled operation\n");
+    return;
+  }
+
+  switch (result_status)
+  {
+  case GNUNET_SET_STATUS_OK:
+  case GNUNET_SET_STATUS_ADD_LOCAL:
+  case GNUNET_SET_STATUS_ADD_REMOTE:
+    goto do_element;
+
+  case GNUNET_SET_STATUS_FAILURE:
+  case GNUNET_SET_STATUS_DONE:
+    goto do_final;
+
+  case GNUNET_SET_STATUS_HALF_DONE:
+    /* not used anymore */
+    GNUNET_assert (0);
+  }
+
+do_final:
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Treating result as final status\n");
+  GNUNET_MQ_assoc_remove (set->mq,
+                          ntohl (msg->request_id));
+  GNUNET_CONTAINER_DLL_remove (set->ops_head,
+                               set->ops_tail,
+                               oh);
+  /* Need to do this calculation _before_ the result callback,
+     as IF the application still has a valid set handle, it
+     may trigger destruction of the set during the callback. */
+  destroy_set = (GNUNET_YES == set->destroy_requested) &&
+                (NULL == set->ops_head);
+  if (NULL != oh->result_cb)
+  {
+    oh->result_cb (oh->result_cls,
+                   NULL,
+                   GNUNET_ntohll (msg->current_size),
+                   result_status);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "No callback for final status\n");
+  }
+  if (destroy_set)
+    GNUNET_SET_destroy (set);
+  GNUNET_free (oh);
+  return;
+
+do_element:
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Treating result as element\n");
+  e.data = &msg[1];
+  e.size = ntohs (msg->header.size) - sizeof(struct GNUNET_SET_ResultMessage);
+  e.element_type = ntohs (msg->element_type);
+  if (NULL != oh->result_cb)
+    oh->result_cb (oh->result_cls,
+                   &e,
+                   GNUNET_ntohll (msg->current_size),
+                   result_status);
+}
+
+
+/**
+ * Destroy the given set operation.
+ *
+ * @param oh set operation to destroy
+ */
+static void
+set_operation_destroy (struct GNUNET_SET_OperationHandle *oh)
+{
+  struct GNUNET_SET_Handle *set = oh->set;
+  struct GNUNET_SET_OperationHandle *h_assoc;
+
+  if (NULL != oh->conclude_mqm)
+    GNUNET_MQ_discard (oh->conclude_mqm);
+  /* is the operation already committed? */
+  if (NULL != set)
+  {
+    GNUNET_CONTAINER_DLL_remove (set->ops_head,
+                                 set->ops_tail,
+                                 oh);
+    h_assoc = GNUNET_MQ_assoc_remove (set->mq,
+                                      oh->request_id);
+    GNUNET_assert ((NULL == h_assoc) ||
+                   (h_assoc == oh));
+  }
+  GNUNET_free (oh);
+}
+
+
+/**
+ * Cancel the given set operation.  We need to send an explicit cancel
+ * message, as all operations one one set communicate using one
+ * handle.
+ *
+ * @param oh set operation to cancel
+ */
+void
+GNUNET_SET_operation_cancel (struct GNUNET_SET_OperationHandle *oh)
+{
+  struct GNUNET_SET_Handle *set = oh->set;
+  struct GNUNET_SET_CancelMessage *m;
+  struct GNUNET_MQ_Envelope *mqm;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Cancelling SET operation\n");
+  if (NULL != set)
+  {
+    mqm = GNUNET_MQ_msg (m, GNUNET_MESSAGE_TYPE_SET_CANCEL);
+    m->request_id = htonl (oh->request_id);
+    GNUNET_MQ_send (set->mq, mqm);
+  }
+  set_operation_destroy (oh);
+  if ((NULL != set) &&
+      (GNUNET_YES == set->destroy_requested) &&
+      (NULL == set->ops_head))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Destroying set after operation cancel\n");
+    GNUNET_SET_destroy (set);
+  }
+}
+
+
+/**
+ * We encountered an error communicating with the set service while
+ * performing a set operation. Report to the application.
+ *
+ * @param cls the `struct GNUNET_SET_Handle`
+ * @param error error code
+ */
+static void
+handle_client_set_error (void *cls,
+                         enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_SET_Handle *set = cls;
+  GNUNET_SET_ElementIterator iter = set->iterator;
+
+  LOG (GNUNET_ERROR_TYPE_ERROR,
+       "Handling client set error %d\n",
+       error);
+  while (NULL != set->ops_head)
+  {
+    if ((NULL != set->ops_head->result_cb) &&
+        (GNUNET_NO == set->destroy_requested))
+      set->ops_head->result_cb (set->ops_head->result_cls,
+                                NULL,
+                                0,
+                                GNUNET_SET_STATUS_FAILURE);
+    set_operation_destroy (set->ops_head);
+  }
+  set->iterator = NULL;
+  set->iteration_id++;
+  set->invalid = GNUNET_YES;
+  if (NULL != iter)
+    iter (set->iterator_cls,
+          NULL);
+}
+
+
+/**
+ * FIXME.
+ */
+static struct GNUNET_SET_Handle *
+create_internal (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                 enum GNUNET_SET_OperationType op,
+                 const uint32_t *cookie)
+{
+  struct GNUNET_SET_Handle *set = GNUNET_new (struct GNUNET_SET_Handle);
+  struct GNUNET_MQ_MessageHandler mq_handlers[] = {
+    GNUNET_MQ_hd_var_size (result,
+                           GNUNET_MESSAGE_TYPE_SET_RESULT,
+                           struct GNUNET_SET_ResultMessage,
+                           set),
+    GNUNET_MQ_hd_var_size (iter_element,
+                           GNUNET_MESSAGE_TYPE_SET_ITER_ELEMENT,
+                           struct GNUNET_SET_IterResponseMessage,
+                           set),
+    GNUNET_MQ_hd_fixed_size (iter_done,
+                             GNUNET_MESSAGE_TYPE_SET_ITER_DONE,
+                             struct GNUNET_MessageHeader,
+                             set),
+    GNUNET_MQ_hd_fixed_size (copy_lazy,
+                             GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_RESPONSE,
+                             struct GNUNET_SET_CopyLazyResponseMessage,
+                             set),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_CreateMessage *create_msg;
+  struct GNUNET_SET_CopyLazyConnectMessage *copy_msg;
+
+  set->cfg = cfg;
+  set->mq = GNUNET_CLIENT_connect (cfg,
+                                   "set",
+                                   mq_handlers,
+                                   &handle_client_set_error,
+                                   set);
+  if (NULL == set->mq)
+  {
+    GNUNET_free (set);
+    return NULL;
+  }
+  if (NULL == cookie)
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Creating new set (operation %u)\n",
+         op);
+    mqm = GNUNET_MQ_msg (create_msg,
+                         GNUNET_MESSAGE_TYPE_SET_CREATE);
+    create_msg->operation = htonl (op);
+  }
+  else
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Creating new set (lazy copy)\n");
+    mqm = GNUNET_MQ_msg (copy_msg,
+                         GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_CONNECT);
+    copy_msg->cookie = *cookie;
+  }
+  GNUNET_MQ_send (set->mq,
+                  mqm);
+  return set;
+}
+
+
+/**
+ * Create an empty set, supporting the specified operation.
+ *
+ * @param cfg configuration to use for connecting to the
+ *        set service
+ * @param op operation supported by the set
+ *        Note that the operation has to be specified
+ *        beforehand, as certain set operations need to maintain
+ *        data structures specific to the operation
+ * @return a handle to the set
+ */
+struct GNUNET_SET_Handle *
+GNUNET_SET_create (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                   enum GNUNET_SET_OperationType op)
+{
+  struct GNUNET_SET_Handle *set;
+
+  set = create_internal (cfg,
+                         op,
+                         NULL);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Creating set %p for operation %d\n",
+       set,
+       op);
+  return set;
+}
+
+
+int
+GNUNET_SET_add_element (struct GNUNET_SET_Handle *set,
+                        const struct GNUNET_SET_Element *element,
+                        GNUNET_SET_Continuation cont,
+                        void *cont_cls)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_ElementMessage *msg;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "adding element of type %u to set %p\n",
+       (unsigned int) element->element_type,
+       set);
+  GNUNET_assert (NULL != set);
+  if (GNUNET_YES == set->invalid)
+  {
+    if (NULL != cont)
+      cont (cont_cls);
+    return GNUNET_SYSERR;
+  }
+  mqm = GNUNET_MQ_msg_extra (msg,
+                             element->size,
+                             GNUNET_MESSAGE_TYPE_SET_ADD);
+  msg->element_type = htons (element->element_type);
+  GNUNET_memcpy (&msg[1],
+                 element->data,
+                 element->size);
+  GNUNET_MQ_notify_sent (mqm,
+                         cont, cont_cls);
+  GNUNET_MQ_send (set->mq, mqm);
+  return GNUNET_OK;
+}
+
+
+int
+GNUNET_SET_remove_element (struct GNUNET_SET_Handle *set,
+                           const struct GNUNET_SET_Element *element,
+                           GNUNET_SET_Continuation cont,
+                           void *cont_cls)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_ElementMessage *msg;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Removing element from set %p\n",
+       set);
+  if (GNUNET_YES == set->invalid)
+  {
+    if (NULL != cont)
+      cont (cont_cls);
+    return GNUNET_SYSERR;
+  }
+  mqm = GNUNET_MQ_msg_extra (msg,
+                             element->size,
+                             GNUNET_MESSAGE_TYPE_SET_REMOVE);
+  msg->element_type = htons (element->element_type);
+  GNUNET_memcpy (&msg[1],
+                 element->data,
+                 element->size);
+  GNUNET_MQ_notify_sent (mqm,
+                         cont, cont_cls);
+  GNUNET_MQ_send (set->mq, mqm);
+  return GNUNET_OK;
+}
+
+
+/**
+ * Destroy the set handle if no operations are left, mark the set
+ * for destruction otherwise.
+ *
+ * @param set set handle to destroy
+ */
+void
+GNUNET_SET_destroy (struct GNUNET_SET_Handle *set)
+{
+  /* destroying set while iterator is active is currently
+     not supported; we should expand the API to allow
+     clients to explicitly cancel the iteration! */
+  GNUNET_assert (NULL != set);
+  if ((NULL != set->ops_head) ||
+      (NULL != set->iterator) ||
+      (GNUNET_SYSERR == set->destroy_requested))
+  {
+    LOG (GNUNET_ERROR_TYPE_DEBUG,
+         "Set operations are pending, delaying set destruction\n");
+    set->destroy_requested = GNUNET_YES;
+    return;
+  }
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Really destroying set\n");
+  if (NULL != set->mq)
+  {
+    GNUNET_MQ_destroy (set->mq);
+    set->mq = NULL;
+  }
+  GNUNET_free (set);
+}
+
+
+struct GNUNET_SET_OperationHandle *
+GNUNET_SET_prepare (const struct GNUNET_PeerIdentity *other_peer,
+                    const struct GNUNET_HashCode *app_id,
+                    const struct GNUNET_MessageHeader *context_msg,
+                    enum GNUNET_SET_ResultMode result_mode,
+                    struct GNUNET_SET_Option options[],
+                    GNUNET_SET_ResultIterator result_cb,
+                    void *result_cls)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_OperationHandle *oh;
+  struct GNUNET_SET_EvaluateMessage *msg;
+  struct GNUNET_SET_Option *opt;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Client prepares set operation (%d)\n",
+       result_mode);
+  oh = GNUNET_new (struct GNUNET_SET_OperationHandle);
+  oh->result_cb = result_cb;
+  oh->result_cls = result_cls;
+  mqm = GNUNET_MQ_msg_nested_mh (msg,
+                                 GNUNET_MESSAGE_TYPE_SET_EVALUATE,
+                                 context_msg);
+  msg->app_id = *app_id;
+  msg->result_mode = htonl (result_mode);
+  msg->target_peer = *other_peer;
+  for (opt = options; opt->type != 0; opt++)
+  {
+    switch (opt->type)
+    {
+    case GNUNET_SET_OPTION_BYZANTINE:
+      msg->byzantine = GNUNET_YES;
+      msg->byzantine_lower_bound = opt->v.num;
+      break;
+
+    case GNUNET_SET_OPTION_FORCE_FULL:
+      msg->force_full = GNUNET_YES;
+      break;
+
+    case GNUNET_SET_OPTION_FORCE_DELTA:
+      msg->force_delta = GNUNET_YES;
+      break;
+
+    default:
+      LOG (GNUNET_ERROR_TYPE_ERROR,
+           "Option with type %d not recognized\n", (int) opt->type);
+    }
+  }
+  oh->conclude_mqm = mqm;
+  oh->request_id_addr = &msg->request_id;
+
+  return oh;
+}
+
+
+/**
+ * Connect to the set service in order to listen for requests.
+ *
+ * @param cls the `struct GNUNET_SET_ListenHandle *` to connect
+ */
+static void
+listen_connect (void *cls);
+
+
+/**
+ * Check validity of request message for a listen operation
+ *
+ * @param cls the listen handle
+ * @param msg the message
+ * @return #GNUNET_OK if the message is well-formed
+ */
+static int
+check_request (void *cls,
+               const struct GNUNET_SET_RequestMessage *msg)
+{
+  const struct GNUNET_MessageHeader *context_msg;
+
+  if (ntohs (msg->header.size) == sizeof(*msg))
+    return GNUNET_OK; /* no context message is OK */
+  context_msg = GNUNET_MQ_extract_nested_mh (msg);
+  if (NULL == context_msg)
+  {
+    /* malformed context message is NOT ok */
+    GNUNET_break_op (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+/**
+ * Handle request message for a listen operation
+ *
+ * @param cls the listen handle
+ * @param msg the message
+ */
+static void
+handle_request (void *cls,
+                const struct GNUNET_SET_RequestMessage *msg)
+{
+  struct GNUNET_SET_ListenHandle *lh = cls;
+  struct GNUNET_SET_Request req;
+  const struct GNUNET_MessageHeader *context_msg;
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_RejectMessage *rmsg;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Processing incoming operation request with id %u\n",
+       ntohl (msg->accept_id));
+  /* we got another valid request => reset the backoff */
+  lh->reconnect_backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+  req.accept_id = ntohl (msg->accept_id);
+  req.accepted = GNUNET_NO;
+  context_msg = GNUNET_MQ_extract_nested_mh (msg);
+  /* calling #GNUNET_SET_accept() in the listen cb will set req->accepted */
+  lh->listen_cb (lh->listen_cls,
+                 &msg->peer_id,
+                 context_msg,
+                 &req);
+  if (GNUNET_YES == req.accepted)
+    return; /* the accept-case is handled in #GNUNET_SET_accept() */
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Rejected request %u\n",
+       ntohl (msg->accept_id));
+  mqm = GNUNET_MQ_msg (rmsg,
+                       GNUNET_MESSAGE_TYPE_SET_REJECT);
+  rmsg->accept_reject_id = msg->accept_id;
+  GNUNET_MQ_send (lh->mq, mqm);
+}
+
+
+/**
+ * Our connection with the set service encountered an error,
+ * re-initialize with exponential back-off.
+ *
+ * @param cls the `struct GNUNET_SET_ListenHandle *`
+ * @param error reason for the disconnect
+ */
+static void
+handle_client_listener_error (void *cls,
+                              enum GNUNET_MQ_Error error)
+{
+  struct GNUNET_SET_ListenHandle *lh = cls;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Listener broke down (%d), re-connecting\n",
+       (int) error);
+  GNUNET_MQ_destroy (lh->mq);
+  lh->mq = NULL;
+  lh->reconnect_task = GNUNET_SCHEDULER_add_delayed (lh->reconnect_backoff,
+                                                     &listen_connect,
+                                                     lh);
+  lh->reconnect_backoff = GNUNET_TIME_STD_BACKOFF (lh->reconnect_backoff);
+}
+
+
+/**
+ * Connect to the set service in order to listen for requests.
+ *
+ * @param cls the `struct GNUNET_SET_ListenHandle *` to connect
+ */
+static void
+listen_connect (void *cls)
+{
+  struct GNUNET_SET_ListenHandle *lh = cls;
+  struct GNUNET_MQ_MessageHandler mq_handlers[] = {
+    GNUNET_MQ_hd_var_size (request,
+                           GNUNET_MESSAGE_TYPE_SET_REQUEST,
+                           struct GNUNET_SET_RequestMessage,
+                           lh),
+    GNUNET_MQ_handler_end ()
+  };
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_ListenMessage *msg;
+
+  lh->reconnect_task = NULL;
+  GNUNET_assert (NULL == lh->mq);
+  lh->mq = GNUNET_CLIENT_connect (lh->cfg,
+                                  "set",
+                                  mq_handlers,
+                                  &handle_client_listener_error,
+                                  lh);
+  if (NULL == lh->mq)
+    return;
+  mqm = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_SET_LISTEN);
+  msg->operation = htonl (lh->operation);
+  msg->app_id = lh->app_id;
+  GNUNET_MQ_send (lh->mq,
+                  mqm);
+}
+
+
+/**
+ * Wait for set operation requests for the given application id
+ *
+ * @param cfg configuration to use for connecting to
+ *            the set service, needs to be valid for the lifetime of the listen handle
+ * @param operation operation we want to listen for
+ * @param app_id id of the application that handles set operation requests
+ * @param listen_cb called for each incoming request matching the operation
+ *                  and application id
+ * @param listen_cls handle for @a listen_cb
+ * @return a handle that can be used to cancel the listen operation
+ */
+struct GNUNET_SET_ListenHandle *
+GNUNET_SET_listen (const struct GNUNET_CONFIGURATION_Handle *cfg,
+                   enum GNUNET_SET_OperationType operation,
+                   const struct GNUNET_HashCode *app_id,
+                   GNUNET_SET_ListenCallback listen_cb,
+                   void *listen_cls)
+{
+  struct GNUNET_SET_ListenHandle *lh;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Starting listener for app %s\n",
+       GNUNET_h2s (app_id));
+  lh = GNUNET_new (struct GNUNET_SET_ListenHandle);
+  lh->listen_cb = listen_cb;
+  lh->listen_cls = listen_cls;
+  lh->cfg = cfg;
+  lh->operation = operation;
+  lh->app_id = *app_id;
+  lh->reconnect_backoff = GNUNET_TIME_UNIT_MILLISECONDS;
+  listen_connect (lh);
+  if (NULL == lh->mq)
+  {
+    GNUNET_free (lh);
+    return NULL;
+  }
+  return lh;
+}
+
+
+/**
+ * Cancel the given listen operation.
+ *
+ * @param lh handle for the listen operation
+ */
+void
+GNUNET_SET_listen_cancel (struct GNUNET_SET_ListenHandle *lh)
+{
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Canceling listener %s\n",
+       GNUNET_h2s (&lh->app_id));
+  if (NULL != lh->mq)
+  {
+    GNUNET_MQ_destroy (lh->mq);
+    lh->mq = NULL;
+  }
+  if (NULL != lh->reconnect_task)
+  {
+    GNUNET_SCHEDULER_cancel (lh->reconnect_task);
+    lh->reconnect_task = NULL;
+  }
+  GNUNET_free (lh);
+}
+
+
+struct GNUNET_SET_OperationHandle *
+GNUNET_SET_accept (struct GNUNET_SET_Request *request,
+                   enum GNUNET_SET_ResultMode result_mode,
+                   struct GNUNET_SET_Option options[],
+                   GNUNET_SET_ResultIterator result_cb,
+                   void *result_cls)
+{
+  struct GNUNET_MQ_Envelope *mqm;
+  struct GNUNET_SET_OperationHandle *oh;
+  struct GNUNET_SET_AcceptMessage *msg;
+
+  GNUNET_assert (GNUNET_NO == request->accepted);
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Client accepts set operation (%d) with id %u\n",
+       result_mode,
+       request->accept_id);
+  request->accepted = GNUNET_YES;
+  mqm = GNUNET_MQ_msg (msg,
+                       GNUNET_MESSAGE_TYPE_SET_ACCEPT);
+  msg->accept_reject_id = htonl (request->accept_id);
+  msg->result_mode = htonl (result_mode);
+  oh = GNUNET_new (struct GNUNET_SET_OperationHandle);
+  oh->result_cb = result_cb;
+  oh->result_cls = result_cls;
+  oh->conclude_mqm = mqm;
+  oh->request_id_addr = &msg->request_id;
+  return oh;
+}
+
+
+/**
+ * Commit a set to be used with a set operation.
+ * This function is called once we have fully constructed
+ * the set that we want to use for the operation.  At this
+ * time, the P2P protocol can then begin to exchange the
+ * set information and call the result callback with the
+ * result information.
+ *
+ * @param oh handle to the set operation
+ * @param set the set to use for the operation
+ * @return #GNUNET_OK on success, #GNUNET_SYSERR if the
+ *         set is invalid (e.g. the set service crashed)
+ */
+int
+GNUNET_SET_commit (struct GNUNET_SET_OperationHandle *oh,
+                   struct GNUNET_SET_Handle *set)
+{
+  if (NULL != oh->set)
+  {
+    /* Some other set was already committed for this
+     * operation, there is a logic bug in the client of this API */
+    GNUNET_break (0);
+    return GNUNET_OK;
+  }
+  GNUNET_assert (NULL != set);
+  if (GNUNET_YES == set->invalid)
+    return GNUNET_SYSERR;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Client commits to SET\n");
+  GNUNET_assert (NULL != oh->conclude_mqm);
+  oh->set = set;
+  GNUNET_CONTAINER_DLL_insert (set->ops_head,
+                               set->ops_tail,
+                               oh);
+  oh->request_id = GNUNET_MQ_assoc_add (set->mq,
+                                        oh);
+  *oh->request_id_addr = htonl (oh->request_id);
+  GNUNET_MQ_send (set->mq,
+                  oh->conclude_mqm);
+  oh->conclude_mqm = NULL;
+  oh->request_id_addr = NULL;
+  return GNUNET_OK;
+}
+
+
+/**
+ * Iterate over all elements in the given set.  Note that this
+ * operation involves transferring every element of the set from the
+ * service to the client, and is thus costly.
+ *
+ * @param set the set to iterate over
+ * @param iter the iterator to call for each element
+ * @param iter_cls closure for @a iter
+ * @return #GNUNET_YES if the iteration started successfully,
+ *         #GNUNET_NO if another iteration is active
+ *         #GNUNET_SYSERR if the set is invalid (e.g. the server crashed, disconnected)
+ */
+int
+GNUNET_SET_iterate (struct GNUNET_SET_Handle *set,
+                    GNUNET_SET_ElementIterator iter,
+                    void *iter_cls)
+{
+  struct GNUNET_MQ_Envelope *ev;
+
+  GNUNET_assert (NULL != iter);
+  if (GNUNET_YES == set->invalid)
+    return GNUNET_SYSERR;
+  if (NULL != set->iterator)
+    return GNUNET_NO;
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Iterating over set\n");
+  set->iterator = iter;
+  set->iterator_cls = iter_cls;
+  ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_ITER_REQUEST);
+  GNUNET_MQ_send (set->mq, ev);
+  return GNUNET_YES;
+}
+
+
+void
+GNUNET_SET_copy_lazy (struct GNUNET_SET_Handle *set,
+                      GNUNET_SET_CopyReadyCallback cb,
+                      void *cls)
+{
+  struct GNUNET_MQ_Envelope *ev;
+  struct SetCopyRequest *req;
+
+  LOG (GNUNET_ERROR_TYPE_DEBUG,
+       "Creating lazy copy of set\n");
+  ev = GNUNET_MQ_msg_header (GNUNET_MESSAGE_TYPE_SET_COPY_LAZY_PREPARE);
+  GNUNET_MQ_send (set->mq, ev);
+
+  req = GNUNET_new (struct SetCopyRequest);
+  req->cb = cb;
+  req->cls = cls;
+  GNUNET_CONTAINER_DLL_insert (set->copy_req_head,
+                               set->copy_req_tail,
+                               req);
+}
+
+
+/**
+ * Create a copy of an element.  The copy
+ * must be GNUNET_free-d by the caller.
+ *
+ * @param element the element to copy
+ * @return the copied element
+ */
+struct GNUNET_SET_Element *
+GNUNET_SET_element_dup (const struct GNUNET_SET_Element *element)
+{
+  struct GNUNET_SET_Element *copy;
+
+  copy = GNUNET_malloc (element->size + sizeof(struct GNUNET_SET_Element));
+  copy->size = element->size;
+  copy->element_type = element->element_type;
+  copy->data = &copy[1];
+  GNUNET_memcpy (&copy[1],
+                 element->data,
+                 copy->size);
+  return copy;
+}
+
+
+void
+GNUNET_SET_element_hash (const struct GNUNET_SET_Element *element,
+                         struct GNUNET_HashCode *ret_hash)
+{
+  struct GNUNET_HashContext *ctx = GNUNET_CRYPTO_hash_context_start ();
+
+  /* It's not guaranteed that the element data is always after the element header,
+     so we need to hash the chunks separately. */
+  GNUNET_CRYPTO_hash_context_read (ctx, &element->size, sizeof(uint16_t));
+  GNUNET_CRYPTO_hash_context_read (ctx, &element->element_type,
+                                   sizeof(uint16_t));
+  GNUNET_CRYPTO_hash_context_read (ctx, element->data, element->size);
+  GNUNET_CRYPTO_hash_context_finish (ctx, ret_hash);
+}
+
+
+/* end of set_api.c */
diff --git a/src/contrib/service/set/test_set.conf b/src/contrib/service/set/test_set.conf
new file mode 100644
index 000000000..f9b4547e9
--- /dev/null
+++ b/src/contrib/service/set/test_set.conf
@@ -0,0 +1,33 @@
+@INLINE@ ../../contrib/conf/gnunet/no_forcestart.conf
+
+[PATHS]
+GNUNET_TEST_HOME = $GNUNET_TMP/test-gnunet-set/
+
+[set]
+START_ON_DEMAND = YES
+#PREFIX = valgrind --leak-check=full
+#PREFIX = gdbserver :1234
+OPTIONS = -L INFO
+
+[transport]
+PLUGINS = unix
+OPTIONS = -LERROR
+
+[nat]
+RETURN_LOCAL_ADDRESSES = YES
+DISABLEV6 = YES
+USE_LOCALADDR = YES
+
+[peerinfo]
+NO_IO = YES
+
+[nat]
+# Use addresses from the local network interfaces (including loopback, but also others)
+USE_LOCALADDR = YES
+
+# Disable IPv6 support
+DISABLEV6 = NO
+
+# Do we use addresses from localhost address ranges? (::1, 127.0.0.0/8)
+RETURN_LOCAL_ADDRESSES = YES
+
diff --git a/src/contrib/service/set/test_set_api.c b/src/contrib/service/set/test_set_api.c
new file mode 100644
index 000000000..d1afdd354
--- /dev/null
+++ b/src/contrib/service/set/test_set_api.c
@@ -0,0 +1,403 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/test_set_api.c
+ * @brief testcase for set_api.c
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_set_service.h"
+
+
+static struct GNUNET_PeerIdentity local_id;
+
+static struct GNUNET_HashCode app_id;
+
+static struct GNUNET_SET_Handle *set1;
+
+static struct GNUNET_SET_Handle *set2;
+
+static struct GNUNET_SET_ListenHandle *listen_handle;
+
+static struct GNUNET_SET_OperationHandle *oh1;
+
+static struct GNUNET_SET_OperationHandle *oh2;
+
+static const struct GNUNET_CONFIGURATION_Handle *config;
+
+static unsigned int iter_count;
+
+static int ret;
+
+static struct GNUNET_SCHEDULER_Task *tt;
+
+
+static void
+result_cb_set1 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t size,
+                enum GNUNET_SET_Status status)
+{
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_OK:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "set 1: got element\n");
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    GNUNET_break (0);
+    oh1 = NULL;
+    fprintf (stderr, "set 1: received failure status!\n");
+    ret = 1;
+    if (NULL != tt)
+    {
+      GNUNET_SCHEDULER_cancel (tt);
+      tt = NULL;
+    }
+    GNUNET_SCHEDULER_shutdown ();
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "set 1: done\n");
+    oh1 = NULL;
+    if (NULL != set1)
+    {
+      GNUNET_SET_destroy (set1);
+      set1 = NULL;
+    }
+    if (NULL == set2)
+    {
+      GNUNET_SCHEDULER_cancel (tt);
+      tt = NULL;
+      GNUNET_SCHEDULER_shutdown ();
+    }
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+result_cb_set2 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t size,
+                enum GNUNET_SET_Status status)
+{
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_OK:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "set 2: got element\n");
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    GNUNET_break (0);
+    oh2 = NULL;
+    fprintf (stderr, "set 2: received failure status\n");
+    GNUNET_SCHEDULER_shutdown ();
+    ret = 1;
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    oh2 = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "set 2: done\n");
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+    if (NULL == set1)
+    {
+      GNUNET_SCHEDULER_cancel (tt);
+      tt = NULL;
+      GNUNET_SCHEDULER_shutdown ();
+    }
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+listen_cb (void *cls,
+           const struct GNUNET_PeerIdentity *other_peer,
+           const struct GNUNET_MessageHeader *context_msg,
+           struct GNUNET_SET_Request *request)
+{
+  GNUNET_assert (NULL != context_msg);
+  GNUNET_assert (ntohs (context_msg->type) == GNUNET_MESSAGE_TYPE_DUMMY);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "listen cb called\n");
+  oh2 = GNUNET_SET_accept (request,
+                           GNUNET_SET_RESULT_ADDED,
+                           (struct GNUNET_SET_Option[]){ 0 },
+                           &result_cb_set2,
+                           NULL);
+  GNUNET_SET_commit (oh2, set2);
+}
+
+
+/**
+ * Start the set operation.
+ *
+ * @param cls closure, unused
+ */
+static void
+start (void *cls)
+{
+  struct GNUNET_MessageHeader context_msg;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Starting reconciliation\n");
+  context_msg.size = htons (sizeof context_msg);
+  context_msg.type = htons (GNUNET_MESSAGE_TYPE_DUMMY);
+  listen_handle = GNUNET_SET_listen (config,
+                                     GNUNET_SET_OPERATION_UNION,
+                                     &app_id,
+                                     &listen_cb,
+                                     NULL);
+  oh1 = GNUNET_SET_prepare (&local_id,
+                            &app_id,
+                            &context_msg,
+                            GNUNET_SET_RESULT_ADDED,
+                            (struct GNUNET_SET_Option[]){ 0 },
+                            &result_cb_set1,
+                            NULL);
+  GNUNET_SET_commit (oh1, set1);
+}
+
+
+/**
+ * Initialize the second set, continue
+ *
+ * @param cls closure, unused
+ */
+static void
+init_set2 (void *cls)
+{
+  struct GNUNET_SET_Element element;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "initializing set 2\n");
+
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2, &element, NULL, NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2, &element, NULL, NULL);
+  element.data = "baz";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2, &element, &start, NULL);
+}
+
+
+/**
+ * Initialize the first set, continue.
+ */
+static void
+init_set1 (void)
+{
+  struct GNUNET_SET_Element element;
+
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1, &element, NULL, NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1, &element, &init_set2, NULL);
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO, "initialized set 1\n");
+}
+
+
+static int
+iter_cb (void *cls, const struct GNUNET_SET_Element *element)
+{
+  struct GNUNET_SET_Handle *set = cls;
+
+  if (NULL == element)
+  {
+    GNUNET_assert (3 == iter_count);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Iteration finished, destroying set %p\n",
+                set);
+    GNUNET_SET_destroy (set);
+    return GNUNET_YES;
+  }
+  iter_count++;
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "iter: got element %u\n", iter_count);
+  return GNUNET_YES;
+}
+
+
+static void
+test_iter ()
+{
+  struct GNUNET_SET_Element element;
+  struct GNUNET_SET_Handle *iter_set;
+
+  iter_set = GNUNET_SET_create (config, GNUNET_SET_OPERATION_UNION);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Testing iteration over 3 elements on set %p\n",
+              iter_set);
+  element.element_type = 0;
+
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+  GNUNET_SET_iterate (iter_set, &iter_cb, iter_set);
+}
+
+
+/**
+ * Function run on timeout.
+ *
+ * @param cls closure
+ */
+static void
+timeout_fail (void *cls)
+{
+  tt = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE, "Testcase failed with timeout\n");
+  GNUNET_SCHEDULER_shutdown ();
+  ret = 1;
+}
+
+
+/**
+ * Function run on shutdown.
+ *
+ * @param cls closure
+ */
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != tt)
+  {
+    GNUNET_SCHEDULER_cancel (tt);
+    tt = NULL;
+  }
+  if (NULL != oh1)
+  {
+    GNUNET_SET_operation_cancel (oh1);
+    oh1 = NULL;
+  }
+  if (NULL != oh2)
+  {
+    GNUNET_SET_operation_cancel (oh2);
+    oh2 = NULL;
+  }
+  if (NULL != set1)
+  {
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+  }
+  if (NULL != set2)
+  {
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+  }
+  if (NULL != listen_handle)
+  {
+    GNUNET_SET_listen_cancel (listen_handle);
+    listen_handle = NULL;
+  }
+}
+
+
+/**
+ * Signature of the 'main' function for a (single-peer) testcase that
+ * is run using 'GNUNET_TESTING_peer_run'.
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer that was started
+ * @param peer identity of the peer that was created
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  struct GNUNET_SET_OperationHandle *my_oh;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Running preparatory tests\n");
+  tt = GNUNET_SCHEDULER_add_delayed (
+    GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5),
+    &timeout_fail,
+    NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown, NULL);
+
+  config = cfg;
+  GNUNET_assert (GNUNET_OK == GNUNET_CRYPTO_get_peer_identity (cfg, &local_id));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "my id (from CRYPTO): %s\n",
+              GNUNET_i2s (&local_id));
+  GNUNET_TESTING_peer_get_identity (peer, &local_id);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "my id (from TESTING): %s\n",
+              GNUNET_i2s (&local_id));
+  test_iter ();
+
+  set1 = GNUNET_SET_create (cfg, GNUNET_SET_OPERATION_UNION);
+  set2 = GNUNET_SET_create (cfg, GNUNET_SET_OPERATION_UNION);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Created sets %p and %p for union operation\n",
+              set1,
+              set2);
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, &app_id);
+
+  /* test if canceling an uncommitted request works! */
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Launching and instantly stopping set operation\n");
+  my_oh = GNUNET_SET_prepare (&local_id,
+                              &app_id,
+                              NULL,
+                              GNUNET_SET_RESULT_ADDED,
+                              (struct GNUNET_SET_Option[]){ 0 },
+                              NULL,
+                              NULL);
+  GNUNET_SET_operation_cancel (my_oh);
+
+  /* test the real set reconciliation */
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Running real set-reconciliation\n");
+  init_set1 ();
+}
+
+
+int
+main (int argc, char **argv)
+{
+  GNUNET_log_setup ("test_set_api", "WARNING", NULL);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Launching peer\n");
+  if (0 !=
+      GNUNET_TESTING_peer_run ("test_set_api", "test_set.conf", &run, NULL))
+  {
+    return 1;
+  }
+  return ret;
+}
diff --git a/src/contrib/service/set/test_set_intersection_result_full.c b/src/contrib/service/set/test_set_intersection_result_full.c
new file mode 100644
index 000000000..42dedb846
--- /dev/null
+++ b/src/contrib/service/set/test_set_intersection_result_full.c
@@ -0,0 +1,393 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012-2014 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/test_set_intersection_result_full.c
+ * @brief testcase for full result mode of the intersection set operation
+ * @author Christian Fuchs
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_set_service.h"
+
+
+static int ret;
+
+static struct GNUNET_PeerIdentity local_id;
+
+static struct GNUNET_HashCode app_id;
+
+static struct GNUNET_SET_Handle *set1;
+
+static struct GNUNET_SET_Handle *set2;
+
+static struct GNUNET_SET_ListenHandle *listen_handle;
+
+static const struct GNUNET_CONFIGURATION_Handle *config;
+
+static int iter_count;
+
+static struct GNUNET_SCHEDULER_Task *tt;
+
+static struct GNUNET_SET_OperationHandle *oh1;
+
+static struct GNUNET_SET_OperationHandle *oh2;
+
+
+static void
+result_cb_set1 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t current_size,
+                enum GNUNET_SET_Status status)
+{
+  static int count;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Processing result set 1 (%d)\n",
+              status);
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_OK:
+    count++;
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    oh1 = NULL;
+    ret = 1;
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    oh1 = NULL;
+    GNUNET_assert (1 == count);
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+    if (NULL == set2)
+      GNUNET_SCHEDULER_shutdown ();
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+result_cb_set2 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t current_size,
+                enum GNUNET_SET_Status status)
+{
+  static int count;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "Processing result set 2 (%d)\n",
+              status);
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_OK:
+    count++;
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    oh2 = NULL;
+    ret = 1;
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    oh2 = NULL;
+    GNUNET_assert (1 == count);
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+    if (NULL == set1)
+      GNUNET_SCHEDULER_shutdown ();
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+listen_cb (void *cls,
+           const struct GNUNET_PeerIdentity *other_peer,
+           const struct GNUNET_MessageHeader *context_msg,
+           struct GNUNET_SET_Request *request)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "starting intersection by accepting and committing\n");
+  GNUNET_assert (NULL != context_msg);
+  GNUNET_assert (ntohs (context_msg->type) == GNUNET_MESSAGE_TYPE_DUMMY);
+  oh2 = GNUNET_SET_accept (request,
+                           GNUNET_SET_RESULT_FULL,
+                           (struct GNUNET_SET_Option[]) { 0 },
+                           &result_cb_set2,
+                           NULL);
+  GNUNET_SET_commit (oh2,
+                     set2);
+}
+
+
+/**
+ * Start the set operation.
+ *
+ * @param cls closure, unused
+ */
+static void
+start (void *cls)
+{
+  struct GNUNET_MessageHeader context_msg;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "starting listener\n");
+  context_msg.size = htons (sizeof context_msg);
+  context_msg.type = htons (GNUNET_MESSAGE_TYPE_DUMMY);
+  listen_handle = GNUNET_SET_listen (config,
+                                     GNUNET_SET_OPERATION_INTERSECTION,
+                                     &app_id,
+                                     &listen_cb,
+                                     NULL);
+  oh1 = GNUNET_SET_prepare (&local_id,
+                            &app_id,
+                            &context_msg,
+                            GNUNET_SET_RESULT_FULL,
+                            (struct GNUNET_SET_Option[]) { 0 },
+                            &result_cb_set1,
+                            NULL);
+  GNUNET_SET_commit (oh1,
+                     set1);
+}
+
+
+/**
+ * Initialize the second set, continue
+ *
+ * @param cls closure, unused
+ */
+static void
+init_set2 (void *cls)
+{
+  struct GNUNET_SET_Element element;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "initializing set 2\n");
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "baz";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          &start,
+                          NULL);
+}
+
+
+/**
+ * Initialize the first set, continue.
+ */
+static void
+init_set1 (void)
+{
+  struct GNUNET_SET_Element element;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+              "initializing set 1\n");
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1,
+                          &element,
+                          &init_set2,
+                          NULL);
+}
+
+
+static int
+iter_cb (void *cls,
+         const struct GNUNET_SET_Element *element)
+{
+  if (NULL == element)
+  {
+    GNUNET_assert (iter_count == 3);
+    GNUNET_SET_destroy (cls);
+    return GNUNET_YES;
+  }
+  iter_count++;
+  return GNUNET_YES;
+}
+
+
+static void
+test_iter ()
+{
+  struct GNUNET_SET_Element element;
+  struct GNUNET_SET_Handle *iter_set;
+
+  iter_set = GNUNET_SET_create (config,
+                                GNUNET_SET_OPERATION_INTERSECTION);
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set,
+                          &element,
+                          NULL,
+                          NULL);
+  GNUNET_SET_iterate (iter_set,
+                      &iter_cb,
+                      iter_set);
+}
+
+
+/**
+ * Function run on shutdown.
+ *
+ * @param cls closure
+ */
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != tt)
+  {
+    GNUNET_SCHEDULER_cancel (tt);
+    tt = NULL;
+  }
+  if (NULL != oh1)
+  {
+    GNUNET_SET_operation_cancel (oh1);
+    oh1 = NULL;
+  }
+  if (NULL != oh2)
+  {
+    GNUNET_SET_operation_cancel (oh2);
+    oh2 = NULL;
+  }
+  if (NULL != set1)
+  {
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+  }
+  if (NULL != set2)
+  {
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+  }
+  if (NULL != listen_handle)
+  {
+    GNUNET_SET_listen_cancel (listen_handle);
+    listen_handle = NULL;
+  }
+}
+
+
+/**
+ * Function run on timeout.
+ *
+ * @param cls closure
+ */
+static void
+timeout_fail (void *cls)
+{
+  tt = NULL;
+  GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
+              "Testcase failed with timeout\n");
+  GNUNET_SCHEDULER_shutdown ();
+  ret = 1;
+}
+
+
+/**
+ * Signature of the 'main' function for a (single-peer) testcase that
+ * is run using 'GNUNET_TESTING_peer_run'.
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer that was started
+ * @param peer identity of the peer that was created
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  config = cfg;
+  GNUNET_TESTING_peer_get_identity (peer,
+                                    &local_id);
+  if (0)
+    test_iter ();
+
+  tt = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply (
+                                       GNUNET_TIME_UNIT_SECONDS, 5),
+                                     &timeout_fail,
+                                     NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+
+  set1 = GNUNET_SET_create (cfg,
+                            GNUNET_SET_OPERATION_INTERSECTION);
+  set2 = GNUNET_SET_create (cfg,
+                            GNUNET_SET_OPERATION_INTERSECTION);
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK,
+                                    &app_id);
+
+  /* test the real set reconciliation */
+  init_set1 ();
+}
+
+
+int
+main (int argc,
+      char **argv)
+{
+  if (0 != GNUNET_TESTING_peer_run ("test_set_intersection_result_full",
+                                    "test_set.conf",
+                                    &run, NULL))
+    return 1;
+  return ret;
+}
diff --git a/src/contrib/service/set/test_set_union_copy.c b/src/contrib/service/set/test_set_union_copy.c
new file mode 100644
index 000000000..908527017
--- /dev/null
+++ b/src/contrib/service/set/test_set_union_copy.c
@@ -0,0 +1,311 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2015, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/test_set_union_copy.c
+ * @brief testcase for lazy copying of union sets
+ * @author Florian Dold
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_common.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_set_service.h"
+
+
+/**
+ * Value to return from #main().
+ */
+static int ret;
+
+static struct GNUNET_PeerIdentity local_id;
+
+static struct GNUNET_SET_Handle *set1;
+
+static struct GNUNET_SET_Handle *set2;
+
+static const struct GNUNET_CONFIGURATION_Handle *config;
+
+static struct GNUNET_SCHEDULER_Task *tt;
+
+
+static void
+add_element_str (struct GNUNET_SET_Handle *set,
+                 char *str)
+{
+  struct GNUNET_SET_Element element;
+
+  element.element_type = 0;
+  element.data = str;
+  element.size = strlen (str);
+  GNUNET_SET_add_element (set,
+                          &element,
+                          NULL,
+                          NULL);
+}
+
+
+static void
+remove_element_str (struct GNUNET_SET_Handle *set,
+                    char *str)
+{
+  struct GNUNET_SET_Element element;
+
+  element.element_type = 0;
+  element.data = str;
+  element.size = strlen (str);
+  GNUNET_SET_remove_element (set,
+                             &element,
+                             NULL,
+                             NULL);
+}
+
+
+/**
+ * Signature of the main function of a task.
+ *
+ * @param cls closure
+ */
+static void
+timeout_fail (void *cls)
+{
+  tt = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+  ret = 1;
+}
+
+
+struct CountIterClosure
+{
+  unsigned int expected_count;
+  unsigned int ongoing_count;
+  GNUNET_SCHEDULER_TaskCallback cont;
+  void *cont_cls;
+  char *what;
+};
+
+
+static int
+check_count_iter (void *cls,
+                  const struct GNUNET_SET_Element *element)
+{
+  struct CountIterClosure *ci_cls = cls;
+
+  if (NULL == element)
+  {
+    if (ci_cls->expected_count != ci_cls->ongoing_count)
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                  "Expected count (what: %s) to be %u, but it's actually %u\n",
+                  ci_cls->what,
+                  ci_cls->expected_count,
+                  ci_cls->ongoing_count);
+      ret = 1;
+      GNUNET_SCHEDULER_shutdown ();
+      return GNUNET_NO;
+    }
+    ci_cls->cont (ci_cls->cont_cls);
+    GNUNET_free (ci_cls);
+    return GNUNET_NO;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Set `%s' has element %.*s\n",
+              ci_cls->what,
+              (int) element->size,
+              (const char *) element->data);
+
+  ci_cls->ongoing_count++;
+  return GNUNET_YES;
+}
+
+
+static void
+check_count (struct GNUNET_SET_Handle *set,
+             char *what,
+             unsigned int expected_count,
+             GNUNET_SCHEDULER_TaskCallback cont,
+             void *cont_cls)
+{
+  struct CountIterClosure *ci_cls = GNUNET_new (struct CountIterClosure);
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Checking count of %s\n",
+              what);
+
+  ci_cls->expected_count = expected_count;
+  ci_cls->ongoing_count = 0;
+  ci_cls->cont = cont;
+  ci_cls->cont_cls = cont_cls;
+  ci_cls->what = what;
+
+  GNUNET_assert (GNUNET_YES ==
+                 GNUNET_SET_iterate (set,
+                                     &check_count_iter,
+                                     ci_cls));
+}
+
+
+static void
+test_done (void *cls)
+{
+  GNUNET_SCHEDULER_shutdown ();
+}
+
+
+static void
+check_new_set_count (void *cls)
+{
+  check_count (set2,
+               "new set",
+               3,
+               &test_done,
+               NULL);
+}
+
+
+static void
+copy_done (void *cls,
+           struct GNUNET_SET_Handle *new_set)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "copy done\n");
+  set2 = new_set;
+  remove_element_str (set2,
+                      "k5555");
+  add_element_str (set2,
+                   "n66666");
+  add_element_str (set2,
+                   "new2butremoved");
+  remove_element_str (set2,
+                      "new2butremoved");
+  remove_element_str (set2,
+                      "new3justremoved");
+  // Check that set1 didn't change.
+  check_count (set1,
+               "old set",
+               3,
+               &check_new_set_count,
+               NULL);
+}
+
+
+static void
+test_copy (void *cls)
+{
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "about to copy\n");
+  GNUNET_SET_copy_lazy (set1,
+                        &copy_done,
+                        NULL);
+}
+
+
+/**
+ * Function run on shutdown.
+ *
+ * @param cls closure
+ */
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != tt)
+  {
+    GNUNET_SCHEDULER_cancel (tt);
+    tt = NULL;
+  }
+  if (NULL != set1)
+  {
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+  }
+  if (NULL != set2)
+  {
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+  }
+}
+
+
+/**
+ * Signature of the 'main' function for a (single-peer) testcase that
+ * is run using #GNUNET_TESTING_peer_run().
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer that was started
+ * @param peer identity of the peer that was created
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  tt = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply (
+                                       GNUNET_TIME_UNIT_SECONDS, 5),
+                                     &timeout_fail,
+                                     NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  config = cfg;
+  GNUNET_TESTING_peer_get_identity (peer,
+                                    &local_id);
+
+  set1 = GNUNET_SET_create (cfg,
+                            GNUNET_SET_OPERATION_UNION);
+  add_element_str (set1,
+                   "333");
+  add_element_str (set1,
+                   "k444");
+  /* duplicate -- ignored */
+  add_element_str (set1,
+                   "k444");
+  remove_element_str (set1,
+                      "333");
+  /* non-existent -- ignored */
+  remove_element_str (set1,
+                      "999999999");
+  add_element_str (set1,
+                   "k5555");
+  /* duplicate -- ignored */
+  remove_element_str (set1,
+                      "333");
+  add_element_str (set1,
+                   "k2");
+
+  check_count (set1,
+               "initial test",
+               3,
+               &test_copy,
+               NULL);
+}
+
+
+int
+main (int argc, char **argv)
+{
+  if (0 != GNUNET_TESTING_peer_run ("test_set_union_copy",
+                                    "test_set.conf",
+                                    &run, NULL))
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                "failed to start testing peer\n");
+    return 1;
+  }
+  return ret;
+}
diff --git a/src/contrib/service/set/test_set_union_result_symmetric.c b/src/contrib/service/set/test_set_union_result_symmetric.c
new file mode 100644
index 000000000..b6c7a82f6
--- /dev/null
+++ b/src/contrib/service/set/test_set_union_result_symmetric.c
@@ -0,0 +1,455 @@
+/*
+     This file is part of GNUnet.
+     Copyright (C) 2012, 2016 GNUnet e.V.
+
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
+
+     GNUnet is distributed in the hope that it will be useful, but
+     WITHOUT ANY WARRANTY; without even the implied warranty of
+     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+     Affero General Public License for more details.
+
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+     SPDX-License-Identifier: AGPL3.0-or-later
+ */
+
+/**
+ * @file set/test_set_union_result_smmetric
+ * @brief testcase for symmetric result mode of the union set operation
+ * @author Florian Dold
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+#include "gnunet_testing_lib.h"
+#include "gnunet_set_service.h"
+
+
+/**
+ * Value to return from #main().
+ */
+static int ret;
+
+static struct GNUNET_PeerIdentity local_id;
+
+static struct GNUNET_HashCode app_id;
+
+static struct GNUNET_SET_Handle *set1;
+
+static struct GNUNET_SET_Handle *set2;
+
+static struct GNUNET_SET_ListenHandle *listen_handle;
+
+static const struct GNUNET_CONFIGURATION_Handle *config;
+
+static struct GNUNET_SET_OperationHandle *oh1;
+
+static struct GNUNET_SET_OperationHandle *oh2;
+
+static int iter_count;
+
+/**
+ * Are we testing correctness for the empty set union?
+ */
+static int empty;
+
+/**
+ * Number of elements found in set 1
+ */
+static unsigned int count_set1;
+
+/**
+ * Number of elements found in set 2
+ */
+static unsigned int count_set2;
+
+/**
+ * Task that is run when the test times out.
+ */
+static struct GNUNET_SCHEDULER_Task *timeout_task;
+
+
+static void
+result_cb_set1 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t current_size,
+                enum GNUNET_SET_Status status)
+{
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_ADD_LOCAL:
+    count_set1++;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 1: got element\n");
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 1: failure\n");
+    oh1 = NULL;
+    ret = 1;
+    if (NULL != timeout_task)
+    {
+      GNUNET_SCHEDULER_cancel (timeout_task);
+      timeout_task = NULL;
+    }
+    GNUNET_SCHEDULER_shutdown ();
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    oh1 = NULL;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 1: done\n");
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+    if (NULL == set2)
+    {
+      if (NULL != timeout_task)
+      {
+        GNUNET_SCHEDULER_cancel (timeout_task);
+        timeout_task = NULL;
+      }
+      GNUNET_SCHEDULER_shutdown ();
+    }
+    break;
+
+  case GNUNET_SET_STATUS_ADD_REMOTE:
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+result_cb_set2 (void *cls,
+                const struct GNUNET_SET_Element *element,
+                uint64_t current_size,
+                enum GNUNET_SET_Status status)
+{
+  switch (status)
+  {
+  case GNUNET_SET_STATUS_ADD_LOCAL:
+    count_set2++;
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 2: got element\n");
+    break;
+
+  case GNUNET_SET_STATUS_FAILURE:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 2: failure\n");
+    oh2 = NULL;
+    ret = 1;
+    if (NULL != timeout_task)
+    {
+      GNUNET_SCHEDULER_cancel (timeout_task);
+      timeout_task = NULL;
+    }
+    GNUNET_SCHEDULER_shutdown ();
+    break;
+
+  case GNUNET_SET_STATUS_DONE:
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "set 2: done\n");
+    oh2 = NULL;
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+    if (NULL == set1)
+    {
+      if (NULL != timeout_task)
+      {
+        GNUNET_SCHEDULER_cancel (timeout_task);
+        timeout_task = NULL;
+      }
+      GNUNET_SCHEDULER_shutdown ();
+    }
+    break;
+
+  case GNUNET_SET_STATUS_ADD_REMOTE:
+    break;
+
+  default:
+    GNUNET_assert (0);
+  }
+}
+
+
+static void
+listen_cb (void *cls,
+           const struct GNUNET_PeerIdentity *other_peer,
+           const struct GNUNET_MessageHeader *context_msg,
+           struct GNUNET_SET_Request *request)
+{
+  GNUNET_assert (NULL != context_msg);
+  GNUNET_assert (ntohs (context_msg->type) == GNUNET_MESSAGE_TYPE_DUMMY);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "listen cb called\n");
+  oh2 = GNUNET_SET_accept (request,
+                           GNUNET_SET_RESULT_SYMMETRIC,
+                           (struct GNUNET_SET_Option[]) { 0 },
+                           &result_cb_set2,
+                           NULL);
+  GNUNET_SET_commit (oh2,
+                     set2);
+}
+
+
+/**
+ * Start the set operation.
+ *
+ * @param cls closure, unused
+ */
+static void
+start (void *cls)
+{
+  struct GNUNET_MessageHeader context_msg;
+
+  context_msg.size = htons (sizeof context_msg);
+  context_msg.type = htons (GNUNET_MESSAGE_TYPE_DUMMY);
+
+  listen_handle = GNUNET_SET_listen (config,
+                                     GNUNET_SET_OPERATION_UNION,
+                                     &app_id,
+                                     &listen_cb, NULL);
+  oh1 = GNUNET_SET_prepare (&local_id,
+                            &app_id,
+                            &context_msg,
+                            GNUNET_SET_RESULT_SYMMETRIC,
+                            (struct GNUNET_SET_Option[]) { 0 },
+                            &result_cb_set1, NULL);
+  GNUNET_SET_commit (oh1, set1);
+}
+
+
+/**
+ * Initialize the second set, continue
+ *
+ * @param cls closure, unused
+ */
+static void
+init_set2 (void *cls)
+{
+  struct GNUNET_SET_Element element;
+
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "initializing set 2\n");
+  if (empty)
+  {
+    start (NULL);
+    return;
+  }
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "baz";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set2,
+                          &element,
+                          &start, NULL);
+}
+
+
+/**
+ * Initialize the first set, continue.
+ */
+static void
+init_set1 (void)
+{
+  struct GNUNET_SET_Element element;
+
+  if (empty)
+  {
+    init_set2 (NULL);
+    return;
+  }
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1,
+                          &element,
+                          NULL,
+                          NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (set1,
+                          &element,
+                          &init_set2,
+                          NULL);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "initialized set 1\n");
+}
+
+
+static int
+iter_cb (void *cls,
+         const struct GNUNET_SET_Element *element)
+{
+  if (NULL == element)
+  {
+    GNUNET_assert (iter_count == 3);
+    GNUNET_SET_destroy (cls);
+    return GNUNET_YES;
+  }
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "iter: got element\n");
+  iter_count++;
+  return GNUNET_YES;
+}
+
+
+static void
+test_iter ()
+{
+  struct GNUNET_SET_Element element;
+  struct GNUNET_SET_Handle *iter_set;
+
+  iter_count = 0;
+  iter_set = GNUNET_SET_create (config, GNUNET_SET_OPERATION_UNION);
+  element.element_type = 0;
+  element.data = "hello";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+  element.data = "bar";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+  element.data = "quux";
+  element.size = strlen (element.data);
+  GNUNET_SET_add_element (iter_set, &element, NULL, NULL);
+
+  GNUNET_SET_iterate (iter_set,
+                      &iter_cb,
+                      iter_set);
+}
+
+
+/**
+ * Signature of the main function of a task.
+ *
+ * @param cls closure
+ */
+static void
+timeout_fail (void *cls)
+{
+  timeout_task = NULL;
+  GNUNET_SCHEDULER_shutdown ();
+  GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+              "test timed out\n");
+  ret = 1;
+}
+
+
+/**
+ * Function run on shutdown.
+ *
+ * @param cls closure
+ */
+static void
+do_shutdown (void *cls)
+{
+  if (NULL != timeout_task)
+  {
+    GNUNET_SCHEDULER_cancel (timeout_task);
+    timeout_task = NULL;
+  }
+  if (NULL != oh1)
+  {
+    GNUNET_SET_operation_cancel (oh1);
+    oh1 = NULL;
+  }
+  if (NULL != oh2)
+  {
+    GNUNET_SET_operation_cancel (oh2);
+    oh2 = NULL;
+  }
+  if (NULL != set1)
+  {
+    GNUNET_SET_destroy (set1);
+    set1 = NULL;
+  }
+  if (NULL != set2)
+  {
+    GNUNET_SET_destroy (set2);
+    set2 = NULL;
+  }
+  if (NULL != listen_handle)
+  {
+    GNUNET_SET_listen_cancel (listen_handle);
+    listen_handle = NULL;
+  }
+}
+
+
+/**
+ * Signature of the 'main' function for a (single-peer) testcase that
+ * is run using 'GNUNET_TESTING_peer_run'.
+ *
+ * @param cls closure
+ * @param cfg configuration of the peer that was started
+ * @param peer identity of the peer that was created
+ */
+static void
+run (void *cls,
+     const struct GNUNET_CONFIGURATION_Handle *cfg,
+     struct GNUNET_TESTING_Peer *peer)
+{
+  timeout_task = GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_relative_multiply (
+                                                 GNUNET_TIME_UNIT_SECONDS, 5),
+                                               &timeout_fail,
+                                               NULL);
+  GNUNET_SCHEDULER_add_shutdown (&do_shutdown,
+                                 NULL);
+  config = cfg;
+  GNUNET_TESTING_peer_get_identity (peer,
+                                    &local_id);
+
+  if (0)
+    test_iter ();
+
+  set1 = GNUNET_SET_create (cfg, GNUNET_SET_OPERATION_UNION);
+  set2 = GNUNET_SET_create (cfg, GNUNET_SET_OPERATION_UNION);
+  GNUNET_CRYPTO_hash_create_random (GNUNET_CRYPTO_QUALITY_WEAK, &app_id);
+
+  /* test the real set reconciliation */
+  init_set1 ();
+}
+
+
+int
+main (int argc, char **argv)
+{
+  empty = 1;
+  if (0 != GNUNET_TESTING_peer_run ("test_set_api",
+                                    "test_set.conf",
+                                    &run, NULL))
+  {
+    return 1;
+  }
+  GNUNET_assert (0 == count_set1);
+  GNUNET_assert (0 == count_set2);
+  empty = 0;
+  if (0 != GNUNET_TESTING_peer_run ("test_set_api",
+                                    "test_set.conf",
+                                    &run, NULL))
+  {
+    return 1;
+  }
+  GNUNET_break (2 == count_set1);
+  GNUNET_break (1 == count_set2);
+  return ret;
+}