8 files changed, 294 insertions, 122 deletions

diff --git a/src/revocation/Makefile.am b/src/revocation/Makefile.am
index 9d98502a6..b1a079a0d 100644
--- a/src/revocation/Makefile.am
+++ b/src/revocation/Makefile.am
@@ -30,6 +30,7 @@ libgnunet_plugin_block_revocation_la_LIBADD = \
   $(top_builddir)/src/block/libgnunetblockgroup.la \
   $(top_builddir)/src/block/libgnunetblock.la \
   $(top_builddir)/src/util/libgnunetutil.la  \
+  $(top_builddir)/src/identity/libgnunetidentity.la  \
   $(LTLIBINTL)
 libgnunet_plugin_block_revocation_la_DEPENDENCIES = \
   libgnunetrevocation.la \
@@ -63,6 +64,7 @@ libgnunetrevocation_la_SOURCES = \
   revocation_api.c revocation.h
 libgnunetrevocation_la_LIBADD = \
   $(top_builddir)/src/util/libgnunetutil.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la \
   $(LIBGCRYPT_LIBS) \
   $(GN_LIBINTL) $(XLIB) -lgcrypt
 libgnunetrevocation_la_LDFLAGS = \
@@ -80,6 +82,7 @@ gnunet_service_revocation_LDADD = \
   $(top_builddir)/src/core/libgnunetcore.la \
   $(top_builddir)/src/setu/libgnunetsetu.la \
   $(top_builddir)/src/statistics/libgnunetstatistics.la \
+  $(top_builddir)/src/identity/libgnunetidentity.la  \
   $(top_builddir)/src/util/libgnunetutil.la \
   -lm \
   $(GN_LIBINTL)
diff --git a/src/revocation/gnunet-revocation-tvg.c b/src/revocation/gnunet-revocation-tvg.c
index 29df1bb4d..1692472bb 100644
--- a/src/revocation/gnunet-revocation-tvg.c
+++ b/src/revocation/gnunet-revocation-tvg.c
@@ -65,25 +65,26 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
-  struct GNUNET_CRYPTO_EcdsaPrivateKey id_priv;
-  struct GNUNET_CRYPTO_EcdsaPublicKey id_pub;
-  struct GNUNET_REVOCATION_PowP pow;
+  struct GNUNET_IDENTITY_PrivateKey id_priv;
+  struct GNUNET_IDENTITY_PublicKey id_pub;
+  struct GNUNET_REVOCATION_PowP *pow;
   struct GNUNET_REVOCATION_PowCalculationHandle *ph;
   struct GNUNET_TIME_Relative exp;
 
-  GNUNET_CRYPTO_ecdsa_key_create (&id_priv);
-  GNUNET_CRYPTO_ecdsa_key_get_public (&id_priv,
-                                      &id_pub);
+  id_priv.type = htonl (GNUNET_IDENTITY_TYPE_ECDSA);
+  GNUNET_CRYPTO_ecdsa_key_create (&id_priv.ecdsa_key);
+  GNUNET_IDENTITY_key_get_public (&id_priv,
+                                  &id_pub);
   fprintf (stdout, "Zone private key (d, little-endian scalar):\n");
   print_bytes (&id_priv, sizeof(id_priv), 0);
   fprintf (stdout, "\n");
   fprintf (stdout, "Zone public key (zk):\n");
   print_bytes (&id_pub, sizeof(id_pub), 0);
   fprintf (stdout, "\n");
-  memset (&pow, 0, sizeof (pow));
+  pow = GNUNET_malloc (GNUNET_REVOCATION_MAX_PROOF_SIZE);
   GNUNET_REVOCATION_pow_init (&id_priv,
-                              &pow);
-  ph = GNUNET_REVOCATION_pow_start (&pow,
+                              pow);
+  ph = GNUNET_REVOCATION_pow_start (pow,
                                     TEST_EPOCHS,
                                     TEST_DIFFICULTY);
   fprintf (stdout, "Difficulty (%d base difficulty + %d epochs): %d\n\n",
@@ -97,12 +98,12 @@ run (void *cls,
   }
   exp = GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_YEARS,
                                        TEST_EPOCHS);
-  GNUNET_assert (GNUNET_OK == GNUNET_REVOCATION_check_pow (&pow,
+  GNUNET_assert (GNUNET_OK == GNUNET_REVOCATION_check_pow (pow,
                                                            TEST_DIFFICULTY,
                                                            exp));
   fprintf (stdout, "Proof:\n");
-  print_bytes (&pow,
-               sizeof (pow),
+  print_bytes (pow,
+               GNUNET_REVOCATION_proof_get_size (pow),
                8);
 }
 
diff --git a/src/revocation/gnunet-revocation.c b/src/revocation/gnunet-revocation.c
index 0e1e482ab..d59ea7c81 100644
--- a/src/revocation/gnunet-revocation.c
+++ b/src/revocation/gnunet-revocation.c
@@ -101,7 +101,7 @@ static struct GNUNET_SCHEDULER_Task *pow_task;
 /**
  * Proof-of-work object
  */
-static struct GNUNET_REVOCATION_PowP proof_of_work;
+static struct GNUNET_REVOCATION_PowP *proof_of_work;
 
 /**
  * Function run if the user aborts with CTRL-C.
@@ -213,7 +213,7 @@ static void
 perform_revocation ()
 {
   h = GNUNET_REVOCATION_revoke (cfg,
-                                &proof_of_work,
+                                proof_of_work,
                                 &print_revocation_result,
                                 NULL);
 }
@@ -228,11 +228,12 @@ perform_revocation ()
 static void
 sync_pow ()
 {
+  size_t psize = GNUNET_REVOCATION_proof_get_size (proof_of_work);
   if ((NULL != filename) &&
-      (sizeof(struct GNUNET_REVOCATION_PowP) !=
+      (psize !=
        GNUNET_DISK_fn_write (filename,
-                             &proof_of_work,
-                             sizeof(struct GNUNET_REVOCATION_PowP),
+                             proof_of_work,
+                             psize,
                              GNUNET_DISK_PERM_USER_READ
                              | GNUNET_DISK_PERM_USER_WRITE)))
     GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "write", filename);
@@ -269,6 +270,7 @@ static void
 calculate_pow (void *cls)
 {
   struct GNUNET_REVOCATION_PowCalculationHandle *ph = cls;
+  size_t psize;
 
   /* store temporary results */
   pow_task = NULL;
@@ -277,11 +279,12 @@ calculate_pow (void *cls)
   /* actually do POW calculation */
   if (GNUNET_OK == GNUNET_REVOCATION_pow_round (ph))
   {
+    psize = GNUNET_REVOCATION_proof_get_size (proof_of_work);
     if ((NULL != filename) &&
-        (sizeof(struct GNUNET_REVOCATION_PowP) !=
+        (psize !=
          GNUNET_DISK_fn_write (filename,
-                               &proof_of_work,
-                               sizeof(struct GNUNET_REVOCATION_PowP),
+                               proof_of_work,
+                               psize,
                                GNUNET_DISK_PERM_USER_READ
                                | GNUNET_DISK_PERM_USER_WRITE)))
       GNUNET_log_strerror_file (GNUNET_ERROR_TYPE_ERROR, "write", filename);
@@ -325,9 +328,10 @@ calculate_pow (void *cls)
 static void
 ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+  struct GNUNET_IDENTITY_PublicKey key;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
   struct GNUNET_REVOCATION_PowCalculationHandle *ph = NULL;
+  size_t psize;
 
   el = NULL;
   if (NULL == ego)
@@ -338,12 +342,15 @@ ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   }
   GNUNET_IDENTITY_ego_get_public_key (ego, &key);
   privkey = GNUNET_IDENTITY_ego_get_private_key (ego);
-  memset (&proof_of_work, 0, sizeof (proof_of_work));
+  proof_of_work = GNUNET_malloc (GNUNET_REVOCATION_MAX_PROOF_SIZE);
   if ((NULL != filename) && (GNUNET_YES == GNUNET_DISK_file_test (filename)) &&
-      (sizeof(proof_of_work) ==
-       GNUNET_DISK_fn_read (filename, &proof_of_work, sizeof(proof_of_work))))
+      (0 < (psize =
+              GNUNET_DISK_fn_read (filename, proof_of_work,
+                                   GNUNET_REVOCATION_MAX_PROOF_SIZE))))
   {
-    if (0 != GNUNET_memcmp (&proof_of_work.key, &key))
+    size_t ksize = GNUNET_IDENTITY_key_get_length (&key);
+    if (((psize - sizeof (*proof_of_work)) < ksize) || // Key too small
+        (0 != memcmp (&proof_of_work[1], &key, ksize))) // Keys do not match
     {
       fprintf (stderr,
                _ ("Error: revocation certificate in `%s' is not for `%s'\n"),
@@ -352,7 +359,7 @@ ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
       return;
     }
     if (GNUNET_YES ==
-        GNUNET_REVOCATION_check_pow (&proof_of_work,
+        GNUNET_REVOCATION_check_pow (proof_of_work,
                                      (unsigned int) matching_bits,
                                      epoch_duration))
     {
@@ -369,7 +376,7 @@ ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     fprintf (stderr,
              "%s",
              _ ("Continuing calculation where left off...\n"));
-    ph = GNUNET_REVOCATION_pow_start (&proof_of_work,
+    ph = GNUNET_REVOCATION_pow_start (proof_of_work,
                                       epochs,
                                       matching_bits);
   }
@@ -379,8 +386,8 @@ ego_callback (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   if (NULL == ph)
   {
     GNUNET_REVOCATION_pow_init (privkey,
-                                &proof_of_work);
-    ph = GNUNET_REVOCATION_pow_start (&proof_of_work,
+                                proof_of_work);
+    ph = GNUNET_REVOCATION_pow_start (proof_of_work,
                                       epochs, /* Epochs */
                                       matching_bits);
   }
@@ -403,15 +410,15 @@ run (void *cls,
      const char *cfgfile,
      const struct GNUNET_CONFIGURATION_Handle *c)
 {
-  struct GNUNET_CRYPTO_EcdsaPublicKey pk;
+  struct GNUNET_IDENTITY_PublicKey pk;
+  size_t psize;
 
   cfg = c;
   if (NULL != test_ego)
   {
     if (GNUNET_OK !=
-        GNUNET_CRYPTO_ecdsa_public_key_from_string (test_ego,
-                                                    strlen (test_ego),
-                                                    &pk))
+        GNUNET_IDENTITY_public_key_from_string (test_ego,
+                                                &pk))
     {
       fprintf (stderr, _ ("Public key `%s' malformed\n"), test_ego);
       return;
@@ -463,23 +470,33 @@ run (void *cls,
   }
   if ((NULL != filename) && (perform))
   {
-    if (sizeof(proof_of_work) != GNUNET_DISK_fn_read (filename,
-                                                      &proof_of_work,
-                                                      sizeof(proof_of_work)))
+    size_t bread;
+    proof_of_work = GNUNET_malloc (GNUNET_REVOCATION_MAX_PROOF_SIZE);
+    if (0 < (bread = GNUNET_DISK_fn_read (filename,
+                                          proof_of_work,
+                                          GNUNET_REVOCATION_MAX_PROOF_SIZE)))
     {
       fprintf (stderr,
                _ ("Failed to read revocation certificate from `%s'\n"),
                filename);
       return;
     }
+    psize = GNUNET_REVOCATION_proof_get_size (proof_of_work);
+    if (bread != psize)
+    {
+      fprintf (stderr,
+               _ ("Revocation certificate corrupted in `%s'\n"),
+               filename);
+      return;
+    }
     GNUNET_SCHEDULER_add_shutdown (&do_shutdown, NULL);
     if (GNUNET_YES !=
-        GNUNET_REVOCATION_check_pow (&proof_of_work,
+        GNUNET_REVOCATION_check_pow (proof_of_work,
                                      (unsigned int) matching_bits,
                                      epoch_duration))
     {
       struct GNUNET_REVOCATION_PowCalculationHandle *ph;
-      ph = GNUNET_REVOCATION_pow_start (&proof_of_work,
+      ph = GNUNET_REVOCATION_pow_start (proof_of_work,
                                         epochs, /* Epochs */
                                         matching_bits);
 
diff --git a/src/revocation/gnunet-service-revocation.c b/src/revocation/gnunet-service-revocation.c
index ddebb38ad..0fa92f4a6 100644
--- a/src/revocation/gnunet-service-revocation.c
+++ b/src/revocation/gnunet-service-revocation.c
@@ -172,7 +172,8 @@ new_peer_entry (const struct GNUNET_PeerIdentity *peer)
 static int
 verify_revoke_message (const struct RevokeMessage *rm)
 {
-  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (&rm->proof_of_work,
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
+  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
                                                  (unsigned
                                                   int) revocation_work_required,
                                                  epoch_duration))
@@ -236,7 +237,7 @@ handle_query_message (void *cls,
   int res;
 
   GNUNET_CRYPTO_hash (&qm->key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+                      sizeof(struct GNUNET_IDENTITY_PublicKey),
                       &hc);
   res = GNUNET_CONTAINER_multihashmap_contains (revocation_map,
                                                 &hc);
@@ -276,9 +277,11 @@ do_flood (void *cls,
     return GNUNET_OK; /* peer connected to us via SET,
                          but we have no direct CORE
                          connection for flooding */
-  e = GNUNET_MQ_msg (cp,
+  e = GNUNET_MQ_msg_extra (cp,
+                     htonl (rm->pow_size),
                      GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
   *cp = *rm;
+  memcpy (&cp[1], &rm[1], htonl (rm->pow_size));
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Flooding revocation to `%s'\n",
               GNUNET_i2s (target));
@@ -303,9 +306,12 @@ publicize_rm (const struct RevokeMessage *rm)
   struct RevokeMessage *cp;
   struct GNUNET_HashCode hc;
   struct GNUNET_SETU_Element e;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
 
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  GNUNET_CRYPTO_hash (pk,
+                      GNUNET_IDENTITY_key_get_length (pk),
                       &hc);
   if (GNUNET_YES ==
       GNUNET_CONTAINER_multihashmap_contains (revocation_map,
@@ -371,6 +377,23 @@ publicize_rm (const struct RevokeMessage *rm)
 }
 
 
+static int
+check_revoke_message (void *cls,
+                      const struct RevokeMessage *rm)
+{
+  uint16_t size;
+
+  size = ntohs (rm->header.size);
+  if (size <= sizeof(struct RevokeMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+
+}
+
+
 /**
  * Handle REVOKE message from client.
  *
@@ -403,6 +426,23 @@ handle_revoke_message (void *cls,
 }
 
 
+static int
+check_p2p_revoke (void *cls,
+                  const struct RevokeMessage *rm)
+{
+  uint16_t size;
+
+  size = ntohs (rm->header.size);
+  if (size <= sizeof(struct RevokeMessage))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+
+}
+
+
 /**
  * Core handler for flooded revocation messages.
  *
@@ -784,16 +824,17 @@ run (void *cls,
      struct GNUNET_SERVICE_Handle *service)
 {
   struct GNUNET_MQ_MessageHandler core_handlers[] = {
-    GNUNET_MQ_hd_fixed_size (p2p_revoke,
-                             GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
-                             struct RevokeMessage,
-                             NULL),
+    GNUNET_MQ_hd_var_size (p2p_revoke,
+                           GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
+                           struct RevokeMessage,
+                           NULL),
     GNUNET_MQ_handler_end ()
   };
   char *fn;
   uint64_t left;
   struct RevokeMessage *rm;
   struct GNUNET_HashCode hc;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
 
   GNUNET_CRYPTO_hash ("revocation-set-union-application-id",
                       strlen ("revocation-set-union-application-id"),
@@ -892,9 +933,11 @@ run (void *cls,
       GNUNET_free (fn);
       return;
     }
-    GNUNET_break (0 == ntohl (rm->reserved));
-    GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                        sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+    struct GNUNET_REVOCATION_PowP *pow = (struct
+                                          GNUNET_REVOCATION_PowP *) &rm[1];
+    pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+    GNUNET_CRYPTO_hash (pk,
+                        GNUNET_IDENTITY_key_get_length (pk),
                         &hc);
     GNUNET_break (GNUNET_OK ==
                   GNUNET_CONTAINER_multihashmap_put (revocation_map,
@@ -939,10 +982,10 @@ GNUNET_SERVICE_MAIN
                            GNUNET_MESSAGE_TYPE_REVOCATION_QUERY,
                            struct QueryMessage,
                            NULL),
-  GNUNET_MQ_hd_fixed_size (revoke_message,
-                           GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
-                           struct RevokeMessage,
-                           NULL),
+  GNUNET_MQ_hd_var_size (revoke_message,
+                         GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE,
+                         struct RevokeMessage,
+                         NULL),
   GNUNET_MQ_handler_end ());
 
 
diff --git a/src/revocation/plugin_block_revocation.c b/src/revocation/plugin_block_revocation.c
index 291c56f70..3c9344a49 100644
--- a/src/revocation/plugin_block_revocation.c
+++ b/src/revocation/plugin_block_revocation.c
@@ -143,16 +143,18 @@ block_plugin_revocation_evaluate (void *cls,
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
-  if (0 >=
-      GNUNET_REVOCATION_check_pow (&rm->proof_of_work,
-                                   ic->matching_bits,
-                                   ic->epoch_duration))
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  if (GNUNET_YES != GNUNET_REVOCATION_check_pow (pow,
+                                                 ic->matching_bits,
+                                                 ic->epoch_duration))
   {
     GNUNET_break_op (0);
     return GNUNET_BLOCK_EVALUATION_RESULT_INVALID;
   }
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  GNUNET_CRYPTO_hash (pk,
+                      GNUNET_IDENTITY_key_get_length (pk),
                       &chash);
   if (GNUNET_YES ==
       GNUNET_BLOCK_GROUP_bf_test_and_set (group,
@@ -182,13 +184,16 @@ block_plugin_revocation_get_key (void *cls,
 {
   const struct RevokeMessage *rm = block;
 
-  if (block_size != sizeof(*rm))
+  if (block_size <= sizeof(*rm))
   {
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
-  GNUNET_CRYPTO_hash (&rm->proof_of_work.key,
-                      sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
+  struct GNUNET_REVOCATION_PowP *pow = (struct GNUNET_REVOCATION_PowP *) &rm[1];
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  GNUNET_CRYPTO_hash (pk,
+                      GNUNET_IDENTITY_key_get_length (pk),
                       key);
   return GNUNET_OK;
 }
diff --git a/src/revocation/revocation.h b/src/revocation/revocation.h
index 635c56cfc..c3a9c9e6b 100644
--- a/src/revocation/revocation.h
+++ b/src/revocation/revocation.h
@@ -49,7 +49,7 @@ struct QueryMessage
   /**
    * Key to check.
    */
-  struct GNUNET_CRYPTO_EcdsaPublicKey key;
+  struct GNUNET_IDENTITY_PublicKey key;
 };
 
 
@@ -85,14 +85,11 @@ struct RevokeMessage
   struct GNUNET_MessageHeader header;
 
   /**
-   * For alignment.
+   * Length of PoW with signature.
    */
-  uint32_t reserved GNUNET_PACKED;
+  uint32_t pow_size GNUNET_PACKED;
 
-  /**
-   * Number that causes a hash collision with the @e public_key.
-   */
-  struct GNUNET_REVOCATION_PowP proof_of_work;
+  /** Followed by the PoW **/
 };
 
 
diff --git a/src/revocation/revocation_api.c b/src/revocation/revocation_api.c
index 75cfd8761..94fbc7022 100644
--- a/src/revocation/revocation_api.c
+++ b/src/revocation/revocation_api.c
@@ -160,7 +160,7 @@ handle_revocation_query_response (void *cls,
  */
 struct GNUNET_REVOCATION_Query *
 GNUNET_REVOCATION_query (const struct GNUNET_CONFIGURATION_Handle *cfg,
-                         const struct GNUNET_CRYPTO_EcdsaPublicKey *key,
+                         const struct GNUNET_IDENTITY_PublicKey *key,
                          GNUNET_REVOCATION_Callback func,
                          void *func_cls)
 {
@@ -359,10 +359,12 @@ GNUNET_REVOCATION_revoke (const struct GNUNET_CONFIGURATION_Handle *cfg,
   }
   h->func = func;
   h->func_cls = func_cls;
-  env = GNUNET_MQ_msg (rm,
-                       GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
-  rm->reserved = htonl (0);
-  rm->proof_of_work = *pow;
+  size_t extra_len = GNUNET_REVOCATION_proof_get_size (pow);
+  env = GNUNET_MQ_msg_extra (rm,
+                             extra_len,
+                             GNUNET_MESSAGE_TYPE_REVOCATION_REVOKE);
+  rm->pow_size = htonl (extra_len);
+  memcpy (&rm[1], pow, extra_len);
   GNUNET_MQ_send (h->mq,
                   env);
   return h;
@@ -420,6 +422,58 @@ calculate_score (const struct GNUNET_REVOCATION_PowCalculationHandle *ph)
 }
 
 
+enum GNUNET_GenericReturnValue
+check_signature_ecdsa (const struct GNUNET_REVOCATION_PowP *pow,
+                       const struct GNUNET_CRYPTO_EcdsaPublicKey *key)
+{
+  struct GNUNET_REVOCATION_EcdsaSignaturePurposePS spurp;
+  struct GNUNET_CRYPTO_EcdsaSignature *sig;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+  size_t ksize;
+
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  ksize = GNUNET_IDENTITY_key_get_length (pk);
+
+  spurp.ktype = pk->type;
+  spurp.key = pk->ecdsa_key;
+  spurp.timestamp = pow->timestamp;
+  spurp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
+  spurp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
+                              + GNUNET_IDENTITY_key_get_length (pk)
+                              + sizeof (struct GNUNET_TIME_AbsoluteNBO));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Expected signature payload len: %u\n",
+              ntohl (spurp.purpose.size));
+  sig = (struct GNUNET_CRYPTO_EcdsaSignature *) ((char*)&pow[1] + ksize);
+  if (GNUNET_OK !=
+      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REVOCATION,
+                                   &spurp.purpose,
+                                   sig,
+                                   key))
+  {
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_OK;
+}
+
+
+enum GNUNET_GenericReturnValue
+check_signature (const struct GNUNET_REVOCATION_PowP *pow)
+{
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  switch (ntohl (pk->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return check_signature_ecdsa (pow, &pk->ecdsa_key);
+  default:
+    return GNUNET_SYSERR;
+  }
+  return GNUNET_SYSERR;
+}
+
+
 /**
  * Check if the given proof-of-work is valid.
  *
@@ -433,10 +487,9 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
                              unsigned int difficulty,
                              struct GNUNET_TIME_Relative epoch_duration)
 {
-  char buf[sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+  char buf[sizeof(struct GNUNET_IDENTITY_PublicKey)
            + sizeof (struct GNUNET_TIME_AbsoluteNBO)
            + sizeof (uint64_t)] GNUNET_ALIGN;
-  struct GNUNET_REVOCATION_SignaturePurposePS spurp;
   struct GNUNET_HashCode result;
   struct GNUNET_TIME_Absolute ts;
   struct GNUNET_TIME_Absolute exp;
@@ -446,25 +499,18 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
   unsigned int tmp_score = 0;
   unsigned int epochs;
   uint64_t pow_val;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
 
   /**
    * Check if signature valid
    */
-  spurp.key = pow->key;
-  spurp.timestamp = pow->timestamp;
-  spurp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
-  spurp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-                              + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
-                              + sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_ecdsa_verify_ (GNUNET_SIGNATURE_PURPOSE_REVOCATION,
-                                   &spurp.purpose,
-                                   &pow->signature,
-                                   &pow->key))
+  if (GNUNET_OK != check_signature (pow))
   {
     GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                 "Proof of work signature invalid!\n");
-    return GNUNET_NO;
+    return GNUNET_SYSERR;
   }
 
   /**
@@ -479,8 +525,8 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
                  &pow->timestamp,
                  sizeof (uint64_t));
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
-                 &pow->key,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey));
+                 pk,
+                 GNUNET_IDENTITY_key_get_length (pk));
   for (unsigned int i = 0; i < POW_COUNT; i++)
   {
     pow_val = GNUNET_ntohll (pow->pow[i]);
@@ -529,18 +575,15 @@ GNUNET_REVOCATION_check_pow (const struct GNUNET_REVOCATION_PowP *pow,
 }
 
 
-/**
- * Initializes a fresh PoW computation.
- *
- * @param key the key to calculate the PoW for.
- * @param[out] pow starting point for PoW calculation (not yet valid)
- */
-void
-GNUNET_REVOCATION_pow_init (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
-                            struct GNUNET_REVOCATION_PowP *pow)
+enum GNUNET_GenericReturnValue
+sign_pow_ecdsa (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
+                struct GNUNET_REVOCATION_PowP *pow)
 {
   struct GNUNET_TIME_Absolute ts = GNUNET_TIME_absolute_get ();
-  struct GNUNET_REVOCATION_SignaturePurposePS rp;
+  struct GNUNET_REVOCATION_EcdsaSignaturePurposePS rp;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+  size_t ksize;
+  char *sig;
 
   /**
    * Predate the validity period to prevent rejections due to
@@ -548,19 +591,57 @@ GNUNET_REVOCATION_pow_init (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
    */
   ts = GNUNET_TIME_absolute_subtract (ts,
                                       GNUNET_TIME_UNIT_WEEKS);
-
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  ksize = GNUNET_IDENTITY_key_get_length (pk);
   pow->timestamp = GNUNET_TIME_absolute_hton (ts);
   rp.timestamp = pow->timestamp;
   rp.purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_REVOCATION);
   rp.purpose.size = htonl (sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose)
-                           + sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+                           + ksize
                            + sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  GNUNET_CRYPTO_ecdsa_key_get_public (key, &pow->key);
-  rp.key = pow->key;
-  GNUNET_assert (GNUNET_OK ==
-                 GNUNET_CRYPTO_ecdsa_sign_ (key,
-                                            &rp.purpose,
-                                            &pow->signature));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Signature payload len: %u\n",
+              ntohl (rp.purpose.size));
+  rp.ktype = pk->type;
+  rp.key = pk->ecdsa_key;
+  sig = ((char*)&pow[1]) + ksize;
+  return GNUNET_CRYPTO_ecdsa_sign_ (key,
+                                    &rp.purpose,
+                                    (void*) sig);
+
+}
+
+
+enum GNUNET_GenericReturnValue
+sign_pow (const struct GNUNET_IDENTITY_PrivateKey *key,
+          struct GNUNET_REVOCATION_PowP *pow)
+{
+  struct GNUNET_IDENTITY_PublicKey *pk;
+
+  pk = (struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  GNUNET_IDENTITY_key_get_public (key, pk);
+  switch (ntohl (pk->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return sign_pow_ecdsa (&key->ecdsa_key, pow);
+  default:
+    return GNUNET_NO;
+  }
+  return GNUNET_NO;
+}
+
+
+/**
+ * Initializes a fresh PoW computation.
+ *
+ * @param key the key to calculate the PoW for.
+ * @param[out] pow starting point for PoW calculation (not yet valid)
+ */
+void
+GNUNET_REVOCATION_pow_init (const struct GNUNET_IDENTITY_PrivateKey *key,
+                            struct GNUNET_REVOCATION_PowP *pow)
+{
+  GNUNET_assert (GNUNET_OK == sign_pow (key, pow));
 }
 
 
@@ -622,15 +703,17 @@ cmp_pow_value (const void *a, const void *b)
 enum GNUNET_GenericReturnValue
 GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
 {
-  char buf[sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey)
+  char buf[sizeof(struct GNUNET_IDENTITY_PublicKey)
            + sizeof (uint64_t)
            + sizeof (uint64_t)] GNUNET_ALIGN;
   struct GNUNET_HashCode result;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
   unsigned int zeros;
   int ret;
   uint64_t pow_nbo;
 
   pc->current_pow++;
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &(pc->pow[1]);
 
   /**
    * Do not try duplicates
@@ -644,8 +727,8 @@ GNUNET_REVOCATION_pow_round (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
                  &pc->pow->timestamp,
                  sizeof (uint64_t));
   GNUNET_memcpy (&buf[sizeof(uint64_t) * 2],
-                 &pc->pow->key,
-                 sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey));
+                 pk,
+                 GNUNET_IDENTITY_key_get_length (pk));
   GNUNET_CRYPTO_pow_hash (&salt,
                           buf,
                           sizeof(buf),
@@ -690,4 +773,25 @@ GNUNET_REVOCATION_pow_stop (struct GNUNET_REVOCATION_PowCalculationHandle *pc)
 }
 
 
+size_t
+GNUNET_REVOCATION_proof_get_size (const struct GNUNET_REVOCATION_PowP *pow)
+{
+  size_t size;
+  const struct GNUNET_IDENTITY_PublicKey *pk;
+
+  size = sizeof (struct GNUNET_REVOCATION_PowP);
+  pk = (const struct GNUNET_IDENTITY_PublicKey *) &pow[1];
+  size += GNUNET_IDENTITY_key_get_length (pk);
+
+  switch (ntohl (pk->type))
+  {
+  case GNUNET_IDENTITY_TYPE_ECDSA:
+    return size + sizeof (struct GNUNET_CRYPTO_EcdsaSignature);
+  default:
+    return 0;
+  }
+  return 0;
+}
+
+
 /* end of revocation_api.c */
diff --git a/src/revocation/test_revocation.c b/src/revocation/test_revocation.c
index b65567d79..c6457016f 100644
--- a/src/revocation/test_revocation.c
+++ b/src/revocation/test_revocation.c
@@ -38,8 +38,8 @@ struct TestPeer
   struct GNUNET_TESTBED_Operation *core_op;
   struct GNUNET_IDENTITY_Handle *idh;
   const struct GNUNET_CONFIGURATION_Handle *cfg;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
-  struct GNUNET_CRYPTO_EcdsaPublicKey pubkey;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
+  struct GNUNET_IDENTITY_PublicKey pubkey;
   struct GNUNET_CRYPTO_EcdsaSignature sig;
   struct GNUNET_IDENTITY_Operation *create_id_op;
   struct GNUNET_IDENTITY_EgoLookup *ego_lookup;
@@ -142,13 +142,13 @@ revocation_cb (void *cls, enum GNUNET_GenericReturnValue is_valid)
 }
 
 
-static struct GNUNET_REVOCATION_PowP proof_of_work;
+static struct GNUNET_REVOCATION_PowP *proof_of_work;
 
 static void
 ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 {
   static int completed = 0;
-  const struct GNUNET_CRYPTO_EcdsaPrivateKey *privkey;
+  const struct GNUNET_IDENTITY_PrivateKey *privkey;
 
   if ((NULL != ego) && (cls == &testpeers[0]))
   {
@@ -164,10 +164,10 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
     GNUNET_IDENTITY_ego_get_public_key (ego, &testpeers[1].pubkey);
     GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Calculating proof of work...\n");
     privkey = GNUNET_IDENTITY_ego_get_private_key (ego);
-    memset (&proof_of_work, 0, sizeof (proof_of_work));
+    proof_of_work = GNUNET_malloc (GNUNET_REVOCATION_MAX_PROOF_SIZE);
     GNUNET_REVOCATION_pow_init (privkey,
-                                &proof_of_work);
-    testpeers[1].pow = GNUNET_REVOCATION_pow_start (&proof_of_work,
+                                proof_of_work);
+    testpeers[1].pow = GNUNET_REVOCATION_pow_start (proof_of_work,
                                                     1,
                                                     5);
     int res =
@@ -184,7 +184,7 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
   {
     GNUNET_log (GNUNET_ERROR_TYPE_INFO, "Egos retrieved\n");
     testpeers[1].revok_handle = GNUNET_REVOCATION_revoke (testpeers[1].cfg,
-                                                          &proof_of_work,
+                                                          proof_of_work,
                                                           &revocation_cb,
                                                           NULL);
     GNUNET_REVOCATION_pow_stop (testpeers[1].pow);
@@ -194,7 +194,7 @@ ego_cb (void *cls, struct GNUNET_IDENTITY_Ego *ego)
 
 static void
 identity_create_cb (void *cls,
-                    const struct GNUNET_CRYPTO_EcdsaPrivateKey *pk,
+                    const struct GNUNET_IDENTITY_PrivateKey *pk,
                     const char *emsg)
 {
   static int completed = 0;
@@ -238,11 +238,13 @@ identity_completion_cb (void *cls,
   testpeers[0].create_id_op = GNUNET_IDENTITY_create (testpeers[0].idh,
                                                       "client",
                                                       NULL,
+                                                      GNUNET_IDENTITY_TYPE_ECDSA,
                                                       &identity_create_cb,
                                                       &testpeers[0]);
   testpeers[1].create_id_op = GNUNET_IDENTITY_create (testpeers[1].idh,
                                                       "toberevoked",
                                                       NULL,
+                                                      GNUNET_IDENTITY_TYPE_ECDSA,
                                                       &identity_create_cb,
                                                       &testpeers[1]);
 }