diff --git a/.flowconfig b/.flowconfig
index 81200dce27..631759874d 100644
--- a/.flowconfig
+++ b/.flowconfig
@@ -12,7 +12,6 @@
 .*/frontend/assets/.*
 .*/frontend/controller/service-worker.js
 .*/frontend/utils/blockies.js
-.*/frontend/utils/crypto.js
 .*/frontend/utils/vuexQueue.js
 .*/frontend/model/contracts/misc/flowTyper.js
 .*/historical/.*
diff --git a/Gruntfile.js b/Gruntfile.js
index 588e36ecae..ec57935222 100644
--- a/Gruntfile.js
+++ b/Gruntfile.js
@@ -1,5 +1,7 @@
 'use strict'
 
+if (process.env['CI']) process.exit(1)
+
 // =======================
 // Entry point.
 //
diff --git a/backend/database.js b/backend/database.js
index c47eb9e689..b97468f479 100644
--- a/backend/database.js
+++ b/backend/database.js
@@ -38,7 +38,7 @@ export default (sbp('sbp/selectors/register', {
           const json = `"${strToB64(entry.serialize())}"`
           if (currentHEAD !== hash) {
             this.push(prefix + json)
-            currentHEAD = entry.message().previousHEAD
+            currentHEAD = entry.head().previousHEAD
             prefix = ','
           } else {
             this.push(prefix + json + ']')
@@ -74,7 +74,7 @@ export default (sbp('sbp/selectors/register', {
             this.push(prefix + json)
             prefix = ','
             limit--
-            currentHEAD = entry.message().previousHEAD
+            currentHEAD = entry.head().previousHEAD
           }
         } catch (e) {
           // TODO: properly return an error to caller, see https://nodejs.org/api/stream.html#errors-while-reading
@@ -109,7 +109,7 @@ export default (sbp('sbp/selectors/register', {
             offset--
           }
 
-          currentHEAD = entry.message().previousHEAD
+          currentHEAD = entry.head().previousHEAD
           if (!currentHEAD || (isMet && !offset)) {
             this.push(']')
             this.push(null)
diff --git a/backend/routes.js b/backend/routes.js
index be6114b222..689e764abf 100644
--- a/backend/routes.js
+++ b/backend/routes.js
@@ -9,6 +9,7 @@ import { SERVER_INSTANCE } from './instance-keys.js'
 import path from 'path'
 import chalk from 'chalk'
 import './database.js'
+import { registrationKey, register, getChallenge, getContractSalt, update } from './zkppSalt.js'
 
 const Boom = require('@hapi/boom')
 const Joi = require('@hapi/joi')
@@ -247,3 +248,115 @@ route.GET('/app/{path*}', {}, {
 route.GET('/', {}, function (req, h) {
   return h.redirect('/app/')
 })
+
+route.POST('/zkpp/{contract}', {
+  validate: {
+    payload: Joi.alternatives([
+      {
+        b: Joi.string().required()
+      },
+      {
+        r: Joi.string().required(),
+        s: Joi.string().required(),
+        sig: Joi.string().required(),
+        Eh: Joi.string().required()
+      }
+    ])
+  }
+}, async function (req, h) {
+  try {
+    if (req.payload['b']) {
+      const result = await registrationKey(req.params['contract'], req.payload['b'])
+
+      if (result) {
+        return result
+      }
+    } else {
+      const result = await register(req.params['contract'], req.payload['r'], req.payload['s'], req.payload['sig'], req.payload['Eh'])
+
+      if (result) {
+        return result
+      }
+    }
+  } catch (e) {
+    const ip = req.info.remoteAddress
+    console.error('Error at POST /zkpp/{contract}: ' + e.message, { ip })
+  }
+
+  return Boom.internal('internal error')
+})
+
+route.GET('/zkpp/{contract}/auth_hash', {}, async function (req, h) {
+  if (!req.query['b']) {
+    return Boom.badRequest('b query param required')
+  }
+
+  try {
+    const challenge = await getChallenge(req.params['contract'], req.query['b'])
+
+    if (challenge) {
+      return challenge
+    }
+  } catch (e) {
+    const ip = req.info.remoteAddress
+    console.error('Error at GET /zkpp/{contract}/auth_hash: ' + e.message, { ip })
+  }
+
+  return Boom.internal('internal error')
+})
+
+route.GET('/zkpp/{contract}/contract_hash', {}, async function (req, h) {
+  if (!req.query['r']) {
+    return Boom.badRequest('r query param required')
+  }
+
+  if (!req.query['s']) {
+    return Boom.badRequest('s query param required')
+  }
+
+  if (!req.query['sig']) {
+    return Boom.badRequest('sig query param required')
+  }
+
+  if (!req.query['hc']) {
+    return Boom.badRequest('hc query param required')
+  }
+
+  try {
+    const salt = await getContractSalt(req.params['contract'], req.query['r'], req.query['s'], req.query['sig'], req.query['hc'])
+
+    if (salt) {
+      return salt
+    }
+  } catch (e) {
+    const ip = req.info.remoteAddress
+    console.error('Error at GET /zkpp/{contract}/contract_hash: ' + e.message, { ip })
+  }
+
+  return Boom.internal('internal error')
+})
+
+route.PUT('/zkpp/{contract}', {
+  validate: {
+    payload: Joi.object({
+      r: Joi.string().required(),
+      s: Joi.string().required(),
+      sig: Joi.string().required(),
+      hc: Joi.string().required(),
+      Ea: Joi.string().required()
+    })
+  }
+}, async function (req, h) {
+  try {
+    const result = await update(req.params['contract'], req.payload['r'], req.payload['s'], req.payload['sig'], req.payload['hc'], req.payload['Ea'])
+
+    if (result) {
+      return result
+    }
+  } catch (e) {
+    const ip = req.info.remoteAddress
+    console.error('Error at GET /zkpp/{contract}/contract_hash: ' + e.message, { ip })
+  }
+
+  return Boom.internal('internal error')
+})
diff --git a/backend/zkppSalt.js b/backend/zkppSalt.js
new file mode 100644
index 0000000000..c0da218d34
--- /dev/null
+++ b/backend/zkppSalt.js
@@ -0,0 +1,252 @@
+import { blake32Hash } from '~/shared/functions.js'
+import { timingSafeEqual } from 'crypto'
+import nacl from 'tweetnacl'
+import sbp from '@sbp/sbp'
+import { boxKeyPair, encryptContractSalt, hashStringArray, hashRawStringArray, hash, parseRegisterSalt, randomNonce, computeCAndHc, base64urlToBase64, base64ToBase64url } from '~/shared/zkpp.js'
+
+// TODO HARDCODED VALUES
+// These values will eventually come from server the configuration
+const recordPepper = 'pepper'
+const recordMasterKey = 'masterKey'
+const challengeSecret = 'secret'
+const registrationSecret = 'secret'
+const maxAge = 30
+
+const getZkppSaltRecord = async (contract: string) => {
+  const recordId = blake32Hash(hashStringArray('RID', contract, recordPepper))
+  const record = await sbp('chelonia/db/get', recordId)
+
+  if (record) {
+    const encryptionKey = hashStringArray('REK', contract, recordMasterKey).slice(0, nacl.secretbox.keyLength)
+
+    const recordBuf = Buffer.from(base64urlToBase64(record), 'base64')
+    const nonce = recordBuf.slice(0, nacl.secretbox.nonceLength)
+    const recordCiphertext = recordBuf.slice(nacl.secretbox.nonceLength)
+    const recordPlaintext = nacl.secretbox.open(recordCiphertext, nonce, encryptionKey)
+
+    if (!recordPlaintext) {
+      return null
+    }
+
+    const recordString = Buffer.from(recordPlaintext).toString('utf-8')
+
+    try {
+      const recordObj = JSON.parse(recordString)
+
+      if (!Array.isArray(recordObj) || recordObj.length !== 3 || !recordObj.reduce((acc, cv) => acc && typeof cv === 'string', true)) {
+        console.error('Error validating encrypted JSON object ' + recordId)
+        return null
+      }
+
+      const [hashedPassword, authSalt, contractSalt] = recordObj
+
+      return {
+        hashedPassword,
+        authSalt,
+        contractSalt
+      }
+    } catch {
+      console.error('Error parsing encrypted JSON object ' + recordId)
+    }
+  }
+
+  return null
+}
+
+const setZkppSaltRecord = async (contract: string, hashedPassword: string, authSalt: string, contractSalt: string) => {
+  const recordId = blake32Hash(hashStringArray('RID', contract, recordPepper))
+  const encryptionKey = hashStringArray('REK', contract, recordMasterKey).slice(0, nacl.secretbox.keyLength)
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+  const recordPlaintext = JSON.stringify([hashedPassword, authSalt, contractSalt])
+  const recordCiphertext = nacl.secretbox(Buffer.from(recordPlaintext), nonce, encryptionKey)
+  const recordBuf = Buffer.concat([nonce, recordCiphertext])
+  const record = base64ToBase64url(recordBuf.toString('base64'))
+  await sbp('chelonia/db/set', recordId, record)
+}
+
+export const getChallenge = async (contract: string, b: string): Promise<false | {authSalt: string; s: string; sig: string;}> => {
+  const record = await getZkppSaltRecord(contract)
+  if (!record) {
+    console.debug('getChallenge: Error obtaining ZKPP salt record for contract ID ' + contract)
+    return false
+  }
+  const { authSalt } = record
+  const s = randomNonce()
+  const now = (Date.now() / 1000 | 0).toString(16)
+  const sig = [now, base64ToBase64url(Buffer.from(hashStringArray(contract, b, s, now, challengeSecret)).toString('base64'))].join(',')
+
+  return {
+    authSalt,
+    s,
+    sig
+  }
+}
+
+const verifyChallenge = (contract: string, r: string, s: string, userSig: string): boolean => {
+  // Check sig has the right format
+  if (!/^[a-fA-F0-9]{1,11},[a-zA-Z0-9_-]{86}(?:==)?$/.test(userSig)) {
+    return false
+  }
+
+  const [then, mac] = userSig.split(',')
+  const now = Date.now() / 1000 | 0
+  const iThen = Number.parseInt(then, 16)
+
+  // Check that sig is no older than Xs
+  if (!(iThen <= now) || !(iThen >= (now - maxAge))) {
+    return false
+  }
+
+  const b = hash(r)
+  const sig = hashStringArray(contract, b, s, then, challengeSecret)
+  const macBuf = Buffer.from(base64urlToBase64(mac), 'base64')
+
+  return sig.byteLength === macBuf.byteLength && timingSafeEqual(sig, macBuf)
+}
+
+export const registrationKey = async (contract: string, b: string): Promise<false | {s: string; p: string; sig: string;}> => {
+  const record = await getZkppSaltRecord(contract)
+  if (record) {
+    throw new Error('registrationKey: User record already exists')
+  }
+
+  const encryptionKey = hashStringArray('REG', contract, registrationSecret).slice(0, nacl.secretbox.keyLength)
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+  const keyPair = boxKeyPair()
+  const s = base64ToBase64url(Buffer.concat([nonce, nacl.secretbox(keyPair.secretKey, nonce, encryptionKey)]).toString('base64'))
+  const now = (Date.now() / 1000 | 0).toString(16)
+  const sig = [now, base64ToBase64url(Buffer.from(hashStringArray(contract, b, s, now, challengeSecret)).toString('base64'))].join(',')
+
+  return {
+    s,
+    p: base64ToBase64url(Buffer.from(keyPair.publicKey).toString('base64')),
+    sig
+  }
+}
+
+export const register = async (contract: string, clientPublicKey: string, encryptedSecretKey: string, userSig: string, encryptedHashedPassword: string): Promise<boolean> => {
+  if (!verifyChallenge(contract, clientPublicKey, encryptedSecretKey, userSig)) {
+    console.debug('register: Error validating challenge: ' + JSON.stringify({ contract, clientPublicKey, userSig }))
+    throw new Error('register: Invalid challenge')
+  }
+
+  const record = await getZkppSaltRecord(contract)
+
+  if (record) {
+    console.error('register: Error: ZKPP salt record for contract ID ' + contract + ' already exists')
+    return false
+  }
+
+  const encryptedSecretKeyBuf = Buffer.from(base64urlToBase64(encryptedSecretKey), 'base64')
+  const encryptionKey = hashStringArray('REG', contract, registrationSecret).slice(0, nacl.secretbox.keyLength)
+  const secretKeyBuf = nacl.secretbox.open(encryptedSecretKeyBuf.slice(nacl.secretbox.nonceLength), encryptedSecretKeyBuf.slice(0, nacl.secretbox.nonceLength), encryptionKey)
+
+  // Likely a bad implementation on the client side
+  if (!secretKeyBuf) {
+    console.debug(`register: Error decrypting arguments for contract ID ${contract} (${JSON.stringify({ clientPublicKey, userSig })})`)
+    return false
+  }
+
+  const parseRegisterSaltRes = parseRegisterSalt(clientPublicKey, secretKeyBuf, encryptedHashedPassword)
+
+  // Likely a bad implementation on the client side
+  if (!parseRegisterSaltRes) {
+    console.debug(`register: Error parsing registration salt for contract ID ${contract} (${JSON.stringify({ clientPublicKey, userSig })})`)
+    return false
+  }
+
+  const [authSalt, contractSalt, hashedPasswordBuf] = parseRegisterSaltRes
+
+  await setZkppSaltRecord(contract, Buffer.from(hashedPasswordBuf).toString(), authSalt, contractSalt)
+
+  return true
+}
+
+const contractSaltVerifyC = (h: string, r: string, s: string, userHc: string) => {
+  const [c, hc] = computeCAndHc(r, s, h)
+  const userHcBuf = Buffer.from(base64urlToBase64(userHc), 'base64')
+
+  if (hc.byteLength === userHcBuf.byteLength && timingSafeEqual(hc, userHcBuf)) {
+    return c
+  }
+
+  return false
+}
+
+export const getContractSalt = async (contract: string, r: string, s: string, sig: string, hc: string): Promise<false | string> => {
+  if (!verifyChallenge(contract, r, s, sig)) {
+    console.debug('getContractSalt: Error validating challenge: ' + JSON.stringify({ contract, r, s, sig }))
+    throw new Error('getContractSalt: Bad challenge')
+  }
+
+  const record = await getZkppSaltRecord(contract)
+  if (!record) {
+    // This shouldn't happen at this stage as the record was already obtained
+    console.error('getContractSalt: Error obtaining ZKPP salt record for contract ID ' + contract)
+    return false
+  }
+
+  const { hashedPassword, contractSalt } = record
+
+  const c = contractSaltVerifyC(hashedPassword, r, s, hc)
+
+  if (!c) {
+    console.error(`getContractSalt: Error verifying challenge for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+    throw new Error('getContractSalt: Bad challenge')
+  }
+
+  return encryptContractSalt(c, contractSalt)
+}
+
+export const update = async (contract: string, r: string, s: string, sig: string, hc: string, encryptedArgs: string): Promise<boolean> => {
+  if (!verifyChallenge(contract, r, s, sig)) {
+    console.debug('update: Error validating challenge: ' + JSON.stringify({ contract, r, s, sig }))
+    throw new Error('update: Bad challenge')
+  }
+
+  const record = await getZkppSaltRecord(contract)
+  if (!record) {
+    // This shouldn't happen at this stage as the record was already obtained
+    console.error('update: Error obtaining ZKPP salt record for contract ID ' + contract)
+    return false
+  }
+  const { hashedPassword } = record
+
+  const c = contractSaltVerifyC(hashedPassword, r, s, hc)
+
+  if (!c) {
+    console.error(`update: Error verifying challenge for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+    throw new Error('update: Bad challenge')
+  }
+
+  const encryptionKey = hashRawStringArray('SU', c).slice(0, nacl.secretbox.keyLength)
+  const encryptedArgsBuf = Buffer.from(base64urlToBase64(encryptedArgs), 'base64')
+  const nonce = encryptedArgsBuf.slice(0, nacl.secretbox.nonceLength)
+  const encryptedArgsCiphertext = encryptedArgsBuf.slice(nacl.secretbox.nonceLength)
+
+  const args = nacl.secretbox.open(encryptedArgsCiphertext, nonce, encryptionKey)
+
+  if (!args) {
+    console.error(`update: Error decrypting arguments for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+    return false
+  }
+
+  try {
+    const argsObj = JSON.parse(Buffer.from(args).toString())
+
+    if (!Array.isArray(argsObj) || argsObj.length !== 3 || !argsObj.reduce((acc, cv) => acc && typeof cv === 'string', true)) {
+      console.error(`update: Error validating the encrypted arguments for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+      return false
+    }
+
+    const [hashedPassword, authSalt, contractSalt] = argsObj
+
+    await setZkppSaltRecord(contract, hashedPassword, authSalt, contractSalt)
+
+    return true
+  } catch {
+    console.error(`update: Error parsing encrypted arguments for contract ID ${contract} (${JSON.stringify({ r, s, hc })})`)
+  }
+
+  return false
+}
diff --git a/backend/zkppSalt.test.js b/backend/zkppSalt.test.js
new file mode 100644
index 0000000000..12e1cac75d
--- /dev/null
+++ b/backend/zkppSalt.test.js
@@ -0,0 +1,111 @@
+/* eslint-env mocha */
+
+import nacl from 'tweetnacl'
+import should from 'should'
+import 'should-sinon'
+
+import { registrationKey, register, getChallenge, getContractSalt, update } from './zkppSalt.js'
+
+const saltsAndEncryptedHashedPassword = (p: string, secretKey: Uint8Array, hash: string) => {
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+  const dhKey = nacl.hash(nacl.box.before(Buffer.from(p, 'base64url'), secretKey))
+  const authSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from('AUTHSALT')), dhKey]))).slice(0, 18).toString('base64')
+  const contractSalt = Buffer.from(nacl.hash(Buffer.concat([nacl.hash(Buffer.from('CONTRACTSALT')), dhKey]))).slice(0, 18).toString('base64')
+  const encryptionKey = nacl.hash(Buffer.from(authSalt + contractSalt)).slice(0, nacl.secretbox.keyLength)
+  const encryptedHashedPassword = Buffer.concat([nonce, nacl.secretbox(Buffer.from(hash), nonce, encryptionKey)]).toString('base64url')
+
+  return [authSalt, contractSalt, encryptedHashedPassword]
+}
+
+describe('ZKPP Salt functions', () => {
+  it('register() conforms to the API to register a new salt', async () => {
+    const keyPair = nacl.box.keyPair()
+    const publicKey = Buffer.from(keyPair.publicKey).toString('base64url')
+    const publicKeyHash = Buffer.from(nacl.hash(Buffer.from(publicKey))).toString('base64url')
+
+    const regKeyAlice1 = await registrationKey('alice', publicKeyHash)
+    const regKeyAlice2 = await registrationKey('alice', publicKeyHash)
+    should(regKeyAlice1).be.of.type('object')
+    should(regKeyAlice2).be.of.type('object')
+    const [, , encryptedHashedPasswordAlice1] = saltsAndEncryptedHashedPassword(regKeyAlice1.p, keyPair.secretKey, 'hash')
+    const res1 = await register('alice', publicKey, regKeyAlice1.s, regKeyAlice1.sig, encryptedHashedPasswordAlice1)
+    should(res1).equal(true, 'register should allow new entry (alice)')
+
+    const [, , encryptedHashedPasswordAlice2] = saltsAndEncryptedHashedPassword(regKeyAlice1.p, keyPair.secretKey, 'hash')
+    const res2 = await register('alice', publicKey, regKeyAlice2.s, regKeyAlice2.sig, encryptedHashedPasswordAlice2)
+    should(res2).equal(false, 'register should not overwrite entry (alice)')
+
+    const regKeyBob1 = await registrationKey('bob', publicKeyHash)
+    should(regKeyBob1).be.of.type('object')
+    const [, , encryptedHashedPasswordBob1] = saltsAndEncryptedHashedPassword(regKeyBob1.p, keyPair.secretKey, 'hash')
+    const res3 = await register('bob', publicKey, regKeyBob1.s, regKeyBob1.sig, encryptedHashedPasswordBob1)
+    should(res3).equal(true, 'register should allow new entry (bob)')
+  })
+
+  it('getContractSalt() conforms to the API to obtain salt', async () => {
+    const keyPair = nacl.box.keyPair()
+    const publicKey = Buffer.from(keyPair.publicKey).toString('base64url')
+    const publicKeyHash = Buffer.from(nacl.hash(Buffer.from(publicKey))).toString('base64url')
+
+    const [contract, hash, r] = ['getContractSalt', 'hash', 'r']
+    const regKey = await registrationKey(contract, publicKeyHash)
+    should(regKey).be.of.type('object')
+
+    const [authSalt, contractSalt, encryptedHashedPassword] = saltsAndEncryptedHashedPassword(regKey.p, keyPair.secretKey, hash)
+
+    const res = await register(contract, publicKey, regKey.s, regKey.sig, encryptedHashedPassword)
+    should(res).equal(true, 'register should allow new entry (' + contract + ')')
+
+    const b = Buffer.from(nacl.hash(Buffer.from(r))).toString('base64url')
+    const challenge = await getChallenge(contract, b)
+    should(challenge).be.of.type('object', 'challenge should be object')
+    should(challenge.authSalt).equal(authSalt, 'mismatched authSalt')
+
+    const ħ = nacl.hash(Buffer.concat([nacl.hash(Buffer.from(r)), nacl.hash(Buffer.from(challenge.s))]))
+    const c = nacl.hash(Buffer.concat([nacl.hash(Buffer.from(hash)), nacl.hash(ħ)]))
+    const hc = nacl.hash(c)
+
+    const salt = await getContractSalt(contract, r, challenge.s, challenge.sig, Buffer.from(hc).toString('base64url'))
+    should(salt).be.of.type('string', 'salt response should be string')
+
+    const saltBuf = Buffer.from(salt, 'base64url')
+    const nonce = saltBuf.slice(0, nacl.secretbox.nonceLength)
+    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from('CS'), c])).slice(0, nacl.secretbox.keyLength)
+    const retrievedContractSalt = Buffer.from(nacl.secretbox.open(saltBuf.slice(nacl.secretbox.nonceLength), nonce, encryptionKey)).toString()
+    should(retrievedContractSalt).equal(contractSalt, 'mismatched contractSalt')
+  })
+
+  it('update() conforms to the API to update salt', async () => {
+    const keyPair = nacl.box.keyPair()
+    const publicKey = Buffer.from(keyPair.publicKey).toString('base64url')
+    const publicKeyHash = Buffer.from(nacl.hash(Buffer.from(publicKey))).toString('base64url')
+
+    const [contract, hash, r] = ['update', 'hash', 'r']
+    const regKey = await registrationKey(contract, publicKeyHash)
+    should(regKey).be.of.type('object')
+
+    const [authSalt, , encryptedHashedPassword] = saltsAndEncryptedHashedPassword(regKey.p, keyPair.secretKey, hash)
+
+    const res = await register(contract, publicKey, regKey.s, regKey.sig, encryptedHashedPassword)
+    should(res).equal(true, 'register should allow new entry (' + contract + ')')
+
+    const b = Buffer.from(nacl.hash(Buffer.from(r))).toString('base64url')
+    const challenge = await getChallenge(contract, b)
+    should(challenge).be.of.type('object', 'challenge should be object')
+    should(challenge.authSalt).equal(authSalt, 'mismatched authSalt')
+
+    const ħ = nacl.hash(Buffer.concat([nacl.hash(Buffer.from(r)), nacl.hash(Buffer.from(challenge.s))]))
+    const c = nacl.hash(Buffer.concat([nacl.hash(Buffer.from(hash)), nacl.hash(ħ)]))
+    const hc = nacl.hash(c)
+
+    const encryptionKey = nacl.hash(Buffer.concat([Buffer.from('SU'), c])).slice(0, nacl.secretbox.keyLength)
+    const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+
+    const encryptedArgsCiphertext = nacl.secretbox(Buffer.from(JSON.stringify(['a', 'b', 'c'])), nonce, encryptionKey)
+
+    const encryptedArgs = Buffer.concat([nonce, encryptedArgsCiphertext]).toString('base64url')
+
+    const updateRes = await update(contract, r, challenge.s, challenge.sig, Buffer.from(hc).toString('base64url'), encryptedArgs)
+    should(updateRes).equal(true, 'update should be successful')
+  })
+})
diff --git a/frontend/controller/actions/chatroom.js b/frontend/controller/actions/chatroom.js
index 54e2bc33f2..29fb1ca00b 100644
--- a/frontend/controller/actions/chatroom.js
+++ b/frontend/controller/actions/chatroom.js
@@ -1,22 +1,161 @@
 'use strict'
 import sbp from '@sbp/sbp'
+
+// Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
+import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, keyId, keygen, serializeKey, encrypt } from '../../../shared/domains/chelonia/crypto.js'
 import { L, GIErrorUIRuntimeError } from '@common/common.js'
 import { omit } from '@model/contracts/shared/giLodash.js'
 import { encryptedAction } from './utils.js'
+import { GIMessage } from '~/shared/domains/chelonia/GIMessage.js'
+import type { GIKey } from '~/shared/domains/chelonia/GIMessage.js'
 import type { GIRegParams } from './types.js'
+import { ChelErrorUnexpected } from '../../../shared/domains/chelonia/errors.js'
 
 export default (sbp('sbp/selectors/register', {
   'gi.actions/chatroom/create': async function (params: GIRegParams) {
     try {
-      return await sbp('chelonia/out/registerContract', {
+      // Create the necessary keys to initialise the contract
+      // eslint-disable-next-line camelcase
+      const CSK = keygen(EDWARDS25519SHA512BATCH)
+      const CEK = keygen(CURVE25519XSALSA20POLY1305)
+
+      // Key IDs
+      const CSKid = keyId(CSK)
+      const CEKid = keyId(CEK)
+
+      // Public keys to be stored in the contract
+      const CSKp = serializeKey(CSK, false)
+      const CEKp = serializeKey(CEK, false)
+
+      // Secret keys to be stored encrypted in the contract
+      const CSKs = encrypt(CEK, serializeKey(CSK, true))
+      const CEKs = encrypt(CEK, serializeKey(CEK, true))
+
+      const rootState = sbp('state/vuex/state')
+
+      const joinKey = params.options?.joinKey
+
+      if (!joinKey) {
+        throw new ChelErrorUnexpected('joinKey is required to create a chatroom')
+      }
+
+      console.log('Chatroom create', {
+        ...omit(params, ['options']), // any 'options' are for this action, not for Chelonia
+        signingKeyId: CSKid,
+        actionSigningKeyId: CSKid,
+        actionEncryptionKeyId: CEKid,
+        keys: [
+          {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp,
+            permissions: [GIMessage.OP_CONTRACT, GIMessage.OP_KEY_ADD, GIMessage.OP_KEY_DEL, GIMessage.OP_ACTION_UNENCRYPTED, GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ATOMIC, GIMessage.OP_CONTRACT_AUTH, GIMessage.OP_CONTRACT_DEAUTH, GIMessage.OP_KEY_REQUEST_RESPONSE],
+            meta: {
+              type: 'csk',
+              private: {
+                keyId: CEKid,
+                content: CSKs
+              }
+            }
+          },
+          {
+            id: CEKid,
+            type: CEK.type,
+            data: CEKp,
+            permissions: [GIMessage.OP_ACTION_ENCRYPTED],
+            meta: {
+              type: 'cek',
+              private: {
+                keyId: CEKid,
+                content: CEKs
+              }
+            }
+          },
+          {
+            id: joinKey.id,
+            type: joinKey.type,
+            data: joinKey.data,
+            permissions: [GIMessage.OP_KEY_REQUEST],
+            meta: {
+              type: 'joinKey'
+            }
+          }
+        ],
+        contractName: 'gi.contracts/chatroom'
+      })
+
+      await sbp('chelonia/configure', {
+        transientSecretKeys: {
+          [CSKid]: CSK,
+          [CEKid]: CEK
+        }
+      })
+
+      const chatroom = await sbp('chelonia/out/registerContract', {
         ...omit(params, ['options']), // any 'options' are for this action, not for Chelonia
+        signingKeyId: CSKid,
+        actionSigningKeyId: CSKid,
+        actionEncryptionKeyId: CEKid,
+        keys: [
+          {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp,
+            permissions: [GIMessage.OP_CONTRACT, GIMessage.OP_KEY_ADD, GIMessage.OP_KEY_DEL, GIMessage.OP_ACTION_UNENCRYPTED, GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ATOMIC, GIMessage.OP_CONTRACT_AUTH, GIMessage.OP_CONTRACT_DEAUTH, GIMessage.OP_KEY_REQUEST_RESPONSE],
+            meta: {
+              type: 'csk',
+              private: {
+                keyId: CEKid,
+                content: CSKs
+              }
+            }
+          },
+          {
+            id: CEKid,
+            type: CEK.type,
+            data: CEKp,
+            permissions: [GIMessage.OP_ACTION_ENCRYPTED],
+            meta: {
+              type: 'cek',
+              private: {
+                keyId: CEKid,
+                content: CEKs
+              }
+            }
+          },
+          {
+            id: joinKey.id,
+            type: joinKey.type,
+            data: joinKey.data,
+            permissions: [GIMessage.OP_KEY_REQUEST],
+            meta: {
+              type: 'joinKey'
+            }
+          }
+        ],
         contractName: 'gi.contracts/chatroom'
       })
+
+      const contractID = chatroom.contractID()
+
+      await sbp('chelonia/contract/sync', contractID)
+
+      const userID = rootState.loggedIn.identityContractID
+      await sbp('gi.actions/identity/shareKeysWithSelf', { userID, contractID })
+
+      return chatroom
     } catch (e) {
       console.error('gi.actions/chatroom/register failed!', e)
       throw new GIErrorUIRuntimeError(L('Failed to create chat channel.'))
     }
   },
+  'gi.contracts/chatroom/getShareableKeys': async function (contractID) {
+    const state = await sbp('chelonia/currentContractState', contractID)
+    return {
+      signingKeyId: (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'csk')?.id: ?string),
+      keys: state._volatile?.keys
+    }
+  },
   ...encryptedAction('gi.actions/chatroom/addMessage', L('Failed to add message.')),
   ...encryptedAction('gi.actions/chatroom/editMessage', L('Failed to edit message.')),
   ...encryptedAction('gi.actions/chatroom/deleteMessage', L('Failed to delete message.')),
diff --git a/frontend/controller/actions/group.js b/frontend/controller/actions/group.js
index 7abf382bc4..2ee9252bed 100644
--- a/frontend/controller/actions/group.js
+++ b/frontend/controller/actions/group.js
@@ -1,8 +1,9 @@
 'use strict'
 
 import sbp from '@sbp/sbp'
+// Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
+import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, keyId, keygen, serializeKey, encrypt } from '../../../shared/domains/chelonia/crypto.js'
 import { GIErrorUIRuntimeError, L, LError } from '@common/common.js'
-import { createInvite } from '@model/contracts/shared/functions.js'
 import {
   INVITE_INITIAL_CREATOR,
   INVITE_EXPIRES_IN_DAYS,
@@ -23,9 +24,11 @@ import { imageUpload } from '@utils/image.js'
 import { merge, omit, randomIntFromRange } from '@model/contracts/shared/giLodash.js'
 import { dateToPeriodStamp, addTimeToDate, DAYS_MILLIS } from '@model/contracts/shared/time.js'
 import { encryptedAction } from './utils.js'
+import { GIMessage } from '~/shared/domains/chelonia/chelonia.js'
 import { VOTE_FOR } from '@model/contracts/shared/voting/rules.js'
+import type { GIKey } from '~/shared/domains/chelonia/GIMessage.js'
 import type { GIActionParams } from './types.js'
-import type { GIMessage } from '~/shared/domains/chelonia/chelonia.js'
+import type { ChelKeyRequestParams } from '~/shared/domains/chelonia/chelonia.js'
 import { REPLACE_MODAL } from '@utils/events.js'
 
 export async function leaveAllChatRooms (groupContractID: string, member: string) {
@@ -81,12 +84,30 @@ export default (sbp('sbp/selectors/register', {
       }
     }
 
+    // Create the necessary keys to initialise the contract
+    // eslint-disable-next-line camelcase
+    const CSK = keygen(EDWARDS25519SHA512BATCH)
+    const CEK = keygen(CURVE25519XSALSA20POLY1305)
+    const inviteKey = keygen(EDWARDS25519SHA512BATCH)
+
+    // Key IDs
+    const CSKid = keyId(CSK)
+    const CEKid = keyId(CEK)
+    const inviteKeyId = keyId(inviteKey)
+
+    // Public keys to be stored in the contract
+    const CSKp = serializeKey(CSK, false)
+    const CEKp = serializeKey(CEK, false)
+    const inviteKeyP = serializeKey(inviteKey, false)
+
+    // Secret keys to be stored encrypted in the contract
+    const CSKs = encrypt(CEK, serializeKey(CSK, true))
+    const CEKs = encrypt(CEK, serializeKey(CEK, true))
+    const inviteKeyS = encrypt(CEK, serializeKey(inviteKey, true))
+
+    const rootState = sbp('state/vuex/state')
+
     try {
-      const initialInvite = createInvite({
-        quantity: 60,
-        creator: INVITE_INITIAL_CREATOR,
-        expires: INVITE_EXPIRES_IN_DAYS.ON_BOARDING
-      })
       const proposalSettings = {
         rule: ruleName,
         ruleSettings: {
@@ -102,13 +123,66 @@ export default (sbp('sbp/selectors/register', {
         // handle Flowtype annotations, even though our .babelrc should make it work.
         distributionDate = dateToPeriodStamp(addTimeToDate(new Date(), 3 * DAYS_MILLIS))
       }
+
+      await sbp('chelonia/configure', {
+        transientSecretKeys: {
+          [CSKid]: CSK,
+          [CEKid]: CEK,
+          [inviteKeyId]: inviteKey
+        }
+      })
+
       const message = await sbp('chelonia/out/registerContract', {
         contractName: 'gi.contracts/group',
         publishOptions,
-        data: {
-          invites: {
-            [initialInvite.inviteSecret]: initialInvite
+        signingKeyId: CSKid,
+        actionSigningKeyId: CSKid,
+        actionEncryptionKeyId: CEKid,
+        keys: [
+          {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp,
+            permissions: [GIMessage.OP_CONTRACT, GIMessage.OP_KEY_ADD, GIMessage.OP_KEY_DEL, GIMessage.OP_ACTION_UNENCRYPTED, GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ATOMIC, GIMessage.OP_CONTRACT_AUTH, GIMessage.OP_CONTRACT_DEAUTH, GIMessage.OP_KEYSHARE, GIMessage.OP_KEY_REQUEST_RESPONSE],
+            meta: {
+              type: 'csk',
+              private: {
+                keyId: CEKid,
+                content: CSKs
+              }
+            }
+          },
+          {
+            id: CEKid,
+            type: CEK.type,
+            data: CEKp,
+            permissions: [GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_KEYSHARE],
+            meta: {
+              type: 'cek',
+              private: {
+                keyId: CEKid,
+                content: CEKs
+              }
+            }
           },
+          {
+            id: inviteKeyId,
+            type: inviteKey.type,
+            data: inviteKeyP,
+            permissions: [GIMessage.OP_KEY_REQUEST],
+            meta: {
+              type: 'inviteKey',
+              quantity: 60,
+              creator: INVITE_INITIAL_CREATOR,
+              expires: Date.now() + DAYS_MILLIS * INVITE_EXPIRES_IN_DAYS.ON_BOARDING,
+              private: {
+                keyId: CEKid,
+                content: inviteKeyS
+              }
+            }
+          }
+        ],
+        data: {
           settings: {
             // authorizations: [contracts.CanModifyAuths.dummyAuth()], // TODO: this
             groupName: name,
@@ -144,12 +218,14 @@ export default (sbp('sbp/selectors/register', {
         }
       })
 
-      await sbp('chelonia/contract/sync', message.contractID())
-      saveLoginState('creating', message.contractID())
+      const contractID = message.contractID()
+
+      await sbp('chelonia/contract/sync', contractID)
+      saveLoginState('creating', contractID)
 
       // create a 'General' chatroom contract and let the creator join
       await sbp('gi.actions/group/addAndJoinChatRoom', {
-        contractID: message.contractID(),
+        contractID,
         data: {
           attributes: {
             name: CHATROOM_GENERAL_NAME,
@@ -157,40 +233,59 @@ export default (sbp('sbp/selectors/register', {
             description: '',
             privacyLevel: CHATROOM_PRIVACY_LEVEL.GROUP
           }
-        }
+        },
+        options: {
+          joinKey: {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp
+          }
+        },
+        signingKeyId: CSKid,
+        encryptionKeyId: CEKid
       })
 
+      const userID = rootState.loggedIn.identityContractID
+      await sbp('gi.actions/identity/shareKeysWithSelf', { userID, contractID })
+
       return message
     } catch (e) {
       console.error('gi.actions/group/create failed!', e)
       throw new GIErrorUIRuntimeError(L('Failed to create the group: {reportError}', LError(e)))
     }
   },
+  'gi.contracts/group/getShareableKeys': async function (contractID) {
+    const state = await sbp('chelonia/latestContractState', contractID)
+    return {
+      signingKeyId: (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'csk')?.id: ?string),
+      keys: state._volatile?.keys
+    }
+  },
   'gi.actions/group/createAndSwitch': async function (params: GIActionParams) {
     const message = await sbp('gi.actions/group/create', params)
     sbp('gi.actions/group/switch', message.contractID())
     return message
   },
-  'gi.actions/group/join': async function (params: $Exact<GIActionParams>) {
+  'gi.actions/group/join': async function (params: $Exact<ChelKeyRequestParams> & { options?: { skipInviteAccept: boolean } }) {
     try {
       sbp('okTurtles.data/set', 'JOINING_GROUP', true)
+      // sync the group's contract state
+      await sbp('chelonia/withEnv', params.contractID, { skipActionProcessing: !params?.options?.skipInviteAccept }, ['chelonia/contract/sync', params.contractID])
       // post acceptance event to the group contract, unless this is being called
       // by the loginState synchronization via the identity contract
       if (!params.options?.skipInviteAccept) {
-        await sbp('chelonia/out/actionEncrypted', {
+        await sbp('chelonia/out/keyRequest', {
           ...omit(params, ['options']),
-          action: 'gi.contracts/group/inviteAccept',
           hooks: {
             prepublish: params.hooks?.prepublish,
             postpublish: null
           }
         })
       }
-      // sync the group's contract state
-      await sbp('chelonia/contract/sync', params.contractID)
 
       const rootState = sbp('state/vuex/state')
       if (!params.options?.skipInviteAccept) {
+        /*
         // join the 'General' chatroom by default
         const generalChatRoomId = rootState[params.contractID].generalChatRoomId
         if (generalChatRoomId) {
@@ -206,7 +301,7 @@ export default (sbp('sbp/selectors/register', {
           })
         } else {
           alert(L("Couldn't join the #{chatroomName} in the group. Doesn't exist.", { chatroomName: CHATROOM_GENERAL_NAME }))
-        }
+        } */
 
         saveLoginState('joining', params.contractID)
       } else {
@@ -216,8 +311,8 @@ export default (sbp('sbp/selectors/register', {
          * but he should sync all the contracts he was syncing in the previous device
          */
         const me = rootState.loggedIn.username
-        const chatRoomIds = Object.keys(rootState[params.contractID].chatRooms)
-          .filter(cId => rootState[params.contractID].chatRooms[cId].users.includes(me))
+        const chatRoomIds = Object.keys(rootState[params.contractID].chatRooms ?? {})
+          .filter(cId => rootState[params.contractID].chatRooms?.[cId].users.includes(me))
 
         await sbp('chelonia/contract/sync', chatRoomIds)
         sbp('state/vuex/commit', 'setCurrentChatRoomId', {
@@ -232,7 +327,7 @@ export default (sbp('sbp/selectors/register', {
       throw new GIErrorUIRuntimeError(L('Failed to join the group: {codeError}', { codeError: e.message }))
     }
   },
-  'gi.actions/group/joinAndSwitch': async function (params: GIActionParams) {
+  'gi.actions/group/joinAndSwitch': async function (params: $Exact<ChelKeyRequestParams> & { options?: { skipInviteAccept: boolean } }) {
     await sbp('gi.actions/group/join', params)
     // after joining, we can set the current group
     sbp('gi.actions/group/switch', params.contractID)
@@ -251,6 +346,7 @@ export default (sbp('sbp/selectors/register', {
 
     const message = await sbp('gi.actions/chatroom/create', {
       data: params.data,
+      options: params.options,
       hooks: {
         prepublish: params.hooks?.prepublish,
         postpublish: null
@@ -321,6 +417,7 @@ export default (sbp('sbp/selectors/register', {
   'gi.actions/group/addAndJoinChatRoom': async function (params: GIActionParams) {
     const message = await sbp('gi.actions/group/addChatRoom', {
       ...omit(params, ['options']),
+      options: { joinKey: params.options?.joinKey },
       hooks: {
         prepublish: params.hooks?.prepublish,
         postpublish: null
diff --git a/frontend/controller/actions/identity.js b/frontend/controller/actions/identity.js
index 584dd014a3..3060d73fae 100644
--- a/frontend/controller/actions/identity.js
+++ b/frontend/controller/actions/identity.js
@@ -1,12 +1,18 @@
 'use strict'
 
 import sbp from '@sbp/sbp'
+// Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
+import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, keyId, keygen, deriveKeyFromPassword, deserializeKey, serializeKey, encrypt } from '../../../shared/domains/chelonia/crypto.js'
 import { GIErrorUIRuntimeError, L, LError } from '@common/common.js'
 import { imageUpload } from '@utils/image.js'
 import { pickWhere, difference } from '@model/contracts/shared/giLodash.js'
 import { SETTING_CURRENT_USER } from '~/frontend/model/database.js'
 import { LOGIN, LOGOUT } from '~/frontend/utils/events.js'
 import { encryptedAction } from './utils.js'
+import { handleFetchResult } from '../utils/misc.js'
+import { GIMessage } from '~/shared/domains/chelonia/GIMessage.js'
+import type { GIKey } from '~/shared/domains/chelonia/GIMessage.js'
+import { boxKeyPair, buildRegisterSaltRequest, computeCAndHc, decryptContractSalt, hash, hashPassword, randomNonce } from '~/shared/zkpp.js'
 
 function generatedLoginState () {
   const { contracts } = sbp('state/vuex/state')
@@ -25,6 +31,27 @@ function diffLoginStates (s1: ?Object, s2: ?Object) {
 }
 
 export default (sbp('sbp/selectors/register', {
+  'gi.actions/identity/retrieveSalt': async (username: string, password: string) => {
+    const r = randomNonce()
+    const b = hash(r)
+    const authHash = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/user=${encodeURIComponent(username)}/auth_hash?b=${encodeURIComponent(b)}`)
+      .then(handleFetchResult('json'))
+
+    const { authSalt, s, sig } = authHash
+
+    const h = await hashPassword(password, authSalt)
+
+    const [c, hc] = computeCAndHc(r, s, h)
+
+    const contractHash = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/user=${encodeURIComponent(username)}/contract_hash?${(new URLSearchParams({
+      'r': r,
+      's': s,
+      'sig': sig,
+      'hc': Buffer.from(hc).toString('base64').replace(/\//g, '_').replace(/\+/g, '-').replace(/=*$/, '')
+    })).toString()}`).then(handleFetchResult('text'))
+
+    return decryptContractSalt(c, contractHash)
+  },
   'gi.actions/identity/create': async function ({
     data: { username, email, password, picture },
     publishOptions
@@ -57,17 +84,133 @@ export default (sbp('sbp/selectors/register', {
       options: { sync: true }
     })
     const mailboxID = mailbox.contractID()
+
+    const keyPair = boxKeyPair()
+    const r = Buffer.from(keyPair.publicKey).toString('base64').replace(/\//g, '_').replace(/\+/g, '-')
+    const b = hash(r)
+    const registrationRes = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/user=${encodeURIComponent(username)}`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded'
+      },
+      body: `b=${encodeURIComponent(b)}`
+    })
+      .then(handleFetchResult('json'))
+
+    const { p, s, sig } = registrationRes
+
+    const [contractSalt, Eh] = await buildRegisterSaltRequest(p, keyPair.secretKey, password)
+
+    const res = await fetch(`${sbp('okTurtles.data/get', 'API_URL')}/zkpp/user=${encodeURIComponent(username)}`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded'
+      },
+      body: new URLSearchParams({
+        'r': r,
+        's': s,
+        'sig': sig,
+        'Eh': Eh
+      })
+    })
+
+    if (!res.ok) {
+      throw new Error('Unable to register hash')
+    }
+
+    // Create the necessary keys to initialise the contract
+    const IPK = await deriveKeyFromPassword(EDWARDS25519SHA512BATCH, password, contractSalt)
+    const IEK = await deriveKeyFromPassword(CURVE25519XSALSA20POLY1305, password, contractSalt)
+    const CSK = keygen(EDWARDS25519SHA512BATCH)
+    const CEK = keygen(CURVE25519XSALSA20POLY1305)
+
+    // Key IDs
+    const IPKid = keyId(IPK)
+    const IEKid = keyId(IEK)
+    const CSKid = keyId(CSK)
+    const CEKid = keyId(CEK)
+
+    // Public keys to be stored in the contract
+    const IPKp = serializeKey(IPK, false)
+    const IEKp = serializeKey(IEK, false)
+    const CSKp = serializeKey(CSK, false)
+    const CEKp = serializeKey(CEK, false)
+
+    // Secret keys to be stored encrypted in the contract
+    const CSKs = encrypt(IEK, serializeKey(CSK, true))
+    const CEKs = encrypt(IEK, serializeKey(CEK, true))
+
     let userID
     // next create the identity contract itself and associate it with the mailbox
     try {
+      await sbp('chelonia/configure', {
+        transientSecretKeys: {
+          [IPKid]: IPK,
+          [IEKid]: IEK,
+          [CSKid]: CSK,
+          [CEKid]: CEK
+        }
+      })
+
       const user = await sbp('chelonia/out/registerContract', {
         contractName: 'gi.contracts/identity',
         publishOptions,
+        signingKeyId: IPKid,
+        actionSigningKeyId: CSKid,
+        actionEncryptionKeyId: CEKid,
+        keys: [
+          {
+            id: IPKid,
+            type: IPK.type,
+            data: IPKp,
+            permissions: [GIMessage.OP_CONTRACT, GIMessage.OP_KEY_ADD, GIMessage.OP_KEY_DEL],
+            meta: {
+              type: 'ipk'
+            }
+          },
+          {
+            id: IEKid,
+            type: IEK.type,
+            data: IEKp,
+            permissions: ['gi.contracts/identity/keymeta'],
+            meta: {
+              type: 'iek'
+            }
+          },
+          {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp,
+            permissions: [GIMessage.OP_ACTION_UNENCRYPTED, GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ATOMIC, GIMessage.OP_CONTRACT_AUTH, GIMessage.OP_CONTRACT_DEAUTH, GIMessage.OP_KEYSHARE],
+            meta: {
+              type: 'csk',
+              private: {
+                keyId: IEKid,
+                content: CSKs
+              }
+            }
+          },
+          {
+            id: CEKid,
+            type: CEK.type,
+            data: CEKp,
+            permissions: [GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_KEYSHARE],
+            meta: {
+              type: 'cek',
+              private: {
+                keyId: IEKid,
+                content: CEKs
+              }
+            }
+          }
+        ],
         data: {
           attributes: { username, email, picture: finalPicture, mailbox: mailboxID }
         }
       })
+
       userID = user.contractID()
+
       await sbp('chelonia/contract/sync', userID)
     } catch (e) {
       console.error('gi.actions/identity/create failed!', e)
@@ -75,6 +218,39 @@ export default (sbp('sbp/selectors/register', {
     }
     return [userID, mailboxID]
   },
+  'gi.actions/identity/shareKeysWithSelf': async function ({ userID, contractID }) {
+    if (userID === contractID) {
+      return
+    }
+
+    const contractState = await sbp('chelonia/latestContractState', contractID)
+
+    if (contractState?._volatile?.keys) {
+      const state = await sbp('chelonia/latestContractState', userID)
+
+      const CEKid = (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'cek')?.id: ?string)
+      const CSKid = (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'csk')?.id: ?string)
+      const CEK = deserializeKey(state?._volatile?.keys?.[CEKid])
+
+      await sbp('chelonia/out/keyShare', {
+        destinationContractID: userID,
+        destinationContractName: 'gi.contracts/identity',
+        data: {
+          contractID: contractID,
+          keys: Object.entries(contractState._volatile.keys).map(([keyId, key]: [string, mixed]) => ({
+            id: keyId,
+            meta: {
+              private: {
+                keyId: CEKid,
+                content: encrypt(CEK, (key: any))
+              }
+            }
+          }))
+        },
+        signingKeyId: CSKid
+      })
+    }
+  },
   'gi.actions/identity/signup': async function ({ username, email, password }, publishOptions) {
     try {
       const randomAvatar = sbp('gi.utils/avatar/create')
@@ -169,13 +345,25 @@ export default (sbp('sbp/selectors/register', {
     }
   },
   'gi.actions/identity/login': async function ({ username, password }: {
-    username: string, password?: string
+    username: string, password: ?string
   }) {
     // TODO: Insert cryptography here
     const identityContractID = await sbp('namespace/lookup', username)
+
     if (!identityContractID) {
       throw new GIErrorUIRuntimeError(L('Invalid username or password'))
     }
+
+    const transientSecretKeys = password
+      ? await (async () => {
+        const salt = await sbp('gi.actions/identity/retrieveSalt', username, password)
+        const IEK = await deriveKeyFromPassword(CURVE25519XSALSA20POLY1305, password, salt)
+        const IEKid = keyId(IEK)
+
+        return { [IEKid]: IEK }
+      })()
+      : {}
+
     try {
       sbp('appLogs/startCapture', username)
       const state = await sbp('gi.db/settings/load', username)
@@ -194,6 +382,7 @@ export default (sbp('sbp/selectors/register', {
       }
       await sbp('gi.db/settings/save', SETTING_CURRENT_USER, username)
       sbp('state/vuex/commit', 'login', { username, identityContractID })
+      await sbp('chelonia/configure', { transientSecretKeys })
       // IMPORTANT: we avoid using 'await' on the syncs so that Vue.js can proceed
       //            loading the website instead of stalling out.
       sbp('chelonia/contract/sync', contractIDs).then(async function () {
@@ -232,8 +421,11 @@ export default (sbp('sbp/selectors/register', {
       console.info('logging out, waiting for any events to finish...')
       await sbp('chelonia/contract/wait')
       await sbp('state/vuex/save')
+      const username = await sbp('gi.db/settings/load', SETTING_CURRENT_USER)
       await sbp('gi.db/settings/save', SETTING_CURRENT_USER, null)
       await sbp('chelonia/contract/remove', Object.keys(state.contracts))
+      await sbp('gi.db/settings/delete', username)
+      await sbp('chelonia/configure', { transientSecretKeys: null })
       console.info('successfully logged out')
     } catch (e) {
       console.error(`${e.name} during logout: ${e.message}`, e)
diff --git a/frontend/controller/actions/mailbox.js b/frontend/controller/actions/mailbox.js
index 16137a47a0..164b05ebce 100644
--- a/frontend/controller/actions/mailbox.js
+++ b/frontend/controller/actions/mailbox.js
@@ -1,25 +1,84 @@
 'use strict'
 
 import sbp from '@sbp/sbp'
+// Using relative path to crypto.js instead of ~-path to workaround some esbuild bug
+import { CURVE25519XSALSA20POLY1305, EDWARDS25519SHA512BATCH, keyId, keygen, serializeKey, encrypt } from '../../../shared/domains/chelonia/crypto.js'
 import { GIErrorUIRuntimeError, L, LError } from '@common/common.js'
 import { omit } from '@model/contracts/shared/giLodash.js'
 import { CHATROOM_PRIVACY_LEVEL, CHATROOM_TYPES } from '@model/contracts/shared/constants.js'
 import { encryptedAction } from './utils.js'
+import { GIMessage } from '~/shared/domains/chelonia/chelonia.js'
 import type { GIActionParams } from './types.js'
-import type { GIMessage } from '~/shared/domains/chelonia/chelonia.js'
 
 export default (sbp('sbp/selectors/register', {
   'gi.actions/mailbox/create': async function ({
-    data = {},
-    options: { sync = true } = {},
-    publishOptions
+    data = {}, options: { sync = true } = {}, publishOptions
   }): Promise<GIMessage> {
     try {
+      // Create the necessary keys to initialise the contract
+      // eslint-disable-next-line camelcase
+      const CSK = keygen(EDWARDS25519SHA512BATCH)
+      const CEK = keygen(CURVE25519XSALSA20POLY1305)
+
+      // Key IDs
+      const CSKid = keyId(CSK)
+      const CEKid = keyId(CEK)
+
+      // Public keys to be stored in the contract
+      const CSKp = serializeKey(CSK, false)
+      const CEKp = serializeKey(CEK, false)
+
+      // Secret keys to be stored encrypted in the contract
+      const CSKs = encrypt(CEK, serializeKey(CSK, true))
+      const CEKs = encrypt(CEK, serializeKey(CEK, true))
+
+      await sbp('chelonia/configure', {
+        transientSecretKeys: {
+          [CSKid]: CSK,
+          [CEKid]: CEK
+        }
+      })
+
       const mailbox = await sbp('chelonia/out/registerContract', {
-        contractName: 'gi.contracts/mailbox', publishOptions, data
+        contractName: 'gi.contracts/mailbox',
+        publishOptions,
+        signingKeyId: CSKid,
+        actionSigningKeyId: CSKid,
+        actionEncryptionKeyId: CEKid,
+        keys: [
+          {
+            id: CSKid,
+            type: CSK.type,
+            data: CSKp,
+            permissions: [GIMessage.OP_CONTRACT, GIMessage.OP_KEY_ADD, GIMessage.OP_KEY_DEL, GIMessage.OP_ACTION_UNENCRYPTED, GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ATOMIC, GIMessage.OP_CONTRACT_AUTH, GIMessage.OP_CONTRACT_DEAUTH],
+            meta: {
+              type: 'csk',
+              private: {
+                keyId: CEKid,
+                content: CSKs
+              }
+            }
+          },
+          {
+            id: CEKid,
+            type: CEK.type,
+            data: CEKp,
+            permissions: [GIMessage.OP_ACTION_ENCRYPTED],
+            meta: {
+              type: 'cek',
+              private: {
+                keyId: CEKid,
+                content: CEKs
+              }
+            }
+          }
+        ],
+        data
       })
+      console.log('gi.actions/mailbox/create', { mailbox })
+      const contractID = mailbox.contractID()
       if (sync) {
-        await sbp('chelonia/contract/sync', mailbox.contractID())
+        await sbp('chelonia/contract/sync', contractID)
       }
       return mailbox
     } catch (e) {
diff --git a/frontend/controller/actions/types.js b/frontend/controller/actions/types.js
index d624b3b3ab..f456b3f8f6 100644
--- a/frontend/controller/actions/types.js
+++ b/frontend/controller/actions/types.js
@@ -11,9 +11,16 @@ export type GIRegParams = {
 
 // keep in sync with ChelActionParams
 export type GIActionParams = {
+  action: string;
   contractID: string;
   data: Object;
   options?: Object; // these are options for the action wrapper
-  hooks?: Object;
-  publishOptions?: Object
+  signingKeyId: string;
+  encryptionKeyId: ?string;
+  hooks?: {
+    prepublishContract?: (Object) => void;
+    prepublish?: (Object) => void;
+    postpublish?: (Object) => void;
+  };
+  publishOptions?: { maxAttempts: number };
 }
diff --git a/frontend/controller/actions/utils.js b/frontend/controller/actions/utils.js
index 68389be984..803b73404a 100644
--- a/frontend/controller/actions/utils.js
+++ b/frontend/controller/actions/utils.js
@@ -3,13 +3,18 @@
 import sbp from '@sbp/sbp'
 import { GIErrorUIRuntimeError, LError } from '@common/common.js'
 import type { GIActionParams } from './types.js'
+import type { GIKey } from '~/shared/domains/chelonia/GIMessage.js'
 
 export function encryptedAction (action: string, humanError: string | Function): Object {
   return {
     [action]: async function (params: GIActionParams) {
       try {
+        const state = await sbp('chelonia/latestContractState', params.contractID)
         return await sbp('chelonia/out/actionEncrypted', {
-          ...params, action: action.replace('gi.actions', 'gi.contracts')
+          ...params,
+          signingKeyId: (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'csk')?.id: ?string),
+          encryptionKeyId: (((Object.values(Object(state?._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'cek')?.id: ?string),
+          action: action.replace('gi.actions', 'gi.contracts')
         })
       } catch (e) {
         console.error(`${action} failed!`, e)
diff --git a/frontend/model/contracts/chatroom.js b/frontend/model/contracts/chatroom.js
index 85ca337985..40abbf0fd2 100644
--- a/frontend/model/contracts/chatroom.js
+++ b/frontend/model/contracts/chatroom.js
@@ -23,6 +23,7 @@ import { objectOf, string, optional } from '~/frontend/model/contracts/misc/flow
 
 function createNotificationData (
   notificationType: string,
+
   moreParams: Object = {}
 ): Object {
   return {
diff --git a/frontend/model/contracts/group.js b/frontend/model/contracts/group.js
index 3ecc0b503b..22ffeb8315 100644
--- a/frontend/model/contracts/group.js
+++ b/frontend/model/contracts/group.js
@@ -18,7 +18,8 @@ import { addTimeToDate, dateToPeriodStamp, compareISOTimestamps, dateFromPeriodS
 import { unadjustedDistribution, adjustedDistribution } from './shared/distribution/distribution.js'
 import currencies, { saferFloat } from './shared/currencies.js'
 import { inviteType, chatRoomAttributesType } from './shared/types.js'
-import { arrayOf, mapOf, objectOf, objectMaybeOf, optional, string, number, boolean, object, unionOf, tupleOf } from '~/frontend/model/contracts/misc/flowTyper.js'
+import { arrayOf, objectOf, objectMaybeOf, optional, string, number, boolean, object, unionOf, tupleOf } from '~/frontend/model/contracts/misc/flowTyper.js'
+import type { GIKey } from '~/shared/domains/chelonia/GIMessage.js'
 
 function vueFetchInitKV (obj: Object, key: string, initialValue: any): any {
   let value = obj[key]
@@ -395,7 +396,7 @@ sbp('chelonia/defineContract', {
       return getters.groupMembersByUsername.length
     },
     groupMembersPending (state, getters) {
-      const invites = getters.currentGroupState.invites
+      const invites = getters.currentGroupState._vm.invites
       const pendingMembers = {}
       for (const inviteId in invites) {
         const invite = invites[inviteId]
@@ -517,7 +518,6 @@ sbp('chelonia/defineContract', {
     // this is the constructor
     'gi.contracts/group': {
       validate: objectMaybeOf({
-        invites: mapOf(string, inviteType),
         settings: objectMaybeOf({
           // TODO: add 'groupPubkey'
           groupName: string,
@@ -1022,7 +1022,7 @@ sbp('chelonia/defineContract', {
           inviteSecret: string // NOTE: simulate the OP_KEY_* stuff for now
         })(data)
 
-        if (!state.invites[data.inviteSecret]) {
+        if (!state._vm.invites[data.inviteSecret]) {
           throw new TypeError(L('The link does not exist.'))
         }
       },
@@ -1147,6 +1147,31 @@ sbp('chelonia/defineContract', {
         if (!state.generalChatRoomId) {
           Vue.set(state, 'generalChatRoomId', data.chatRoomID)
         }
+      },
+      async sideEffect ({ data, meta, contractID }, { state: Rstate }) {
+        const rootState = sbp('state/vuex/state')
+        const contracts = rootState.contracts || {}
+        const { identityContractID } = rootState.loggedIn
+        const userState = rootState[identityContractID]
+        const state = rootState[contractID]
+
+        if (rootState[data.chatRoomID]?._volatile) {
+          return
+        }
+
+        await sbp('chelonia/out/keyRequest', {
+          originatingContractID: identityContractID,
+          originatingContractName: contracts[identityContractID].type,
+          contractID: data.chatRoomID,
+          contractName: 'gi.contracts/chatroom',
+          signingKey: state._volatile?.keys?.[(((Object.values(Object(state._vm?.authorizedKeys)): any): GIKey[]).find((k) => k?.meta?.type === 'csk')?.id: ?string)],
+          innerSigningKeyId: ((Object.values(userState._vm.authorizedKeys): any): GIKey[]).find((k) => k.meta?.type === 'csk')?.id,
+          encryptionKeyId: ((Object.values(userState._vm.authorizedKeys): any): GIKey[]).find((k) => k.meta?.type === 'cek')?.id,
+          hooks: {
+            prepublish: null,
+            postpublish: null
+          }
+        })
       }
     },
     'gi.contracts/group/deleteChatRoom': {
diff --git a/frontend/model/contracts/identity.js b/frontend/model/contracts/identity.js
index fed324908a..9dff1e85d5 100644
--- a/frontend/model/contracts/identity.js
+++ b/frontend/model/contracts/identity.js
@@ -1,7 +1,6 @@
 'use strict'
 
 import sbp from '@sbp/sbp'
-
 import { Vue, L } from '@common/common.js'
 import { merge } from './shared/giLodash.js'
 import { objectOf, objectMaybeOf, arrayOf, string, object } from '~/frontend/model/contracts/misc/flowTyper.js'
diff --git a/frontend/model/contracts/manifests.json b/frontend/model/contracts/manifests.json
index 98fad76b62..fdd9a43379 100644
--- a/frontend/model/contracts/manifests.json
+++ b/frontend/model/contracts/manifests.json
@@ -1,8 +1,8 @@
 {
   "manifests": {
-    "gi.contracts/chatroom": "21XWnNY7UtqVpH4GFi7MeXLHwY9wNjXqYtcLs88Dw2YdPMTfTf",
-    "gi.contracts/group": "21XWnNSk3XLo5oH2ad1ptE4jX6xu8XaYbNxs14srPsbFoU8yNi",
+    "gi.contracts/chatroom": "21XWnNH52jSfnEAR6QaLhtQHPdTKjFcupcimH2ZM2PUiwaCoSZ",
+    "gi.contracts/group": "21XWnNPdGDsza8tr4mQRJKJPwdbiR2kpCWNmDuNmL6UzV6F1cf",
     "gi.contracts/identity": "21XWnNQcokaP76xh4SVnW5wE1KjuwCYgiPFmqEvr2BEnMuMSHZ",
-    "gi.contracts/mailbox": "21XWnNKPBQz9LSHLWk41VzqCj3JHfgujkgyVjgPcArtFSXtNyY"
+    "gi.contracts/mailbox": "21XWnNJj8jep4qPprXVjVeDYyDiErrRGZFFV37Zr5h2bUMW7SG"
   }
 }
diff --git a/frontend/model/contracts/shared/constants.js b/frontend/model/contracts/shared/constants.js
index 584d8981be..ae28818e84 100644
--- a/frontend/model/contracts/shared/constants.js
+++ b/frontend/model/contracts/shared/constants.js
@@ -7,6 +7,8 @@ export const IDENTITY_USERNAME_MAX_CHARS = 80
 
 // group.js related
 
+export const DAYS_MILLIS = 86400e3
+
 export const INVITE_INITIAL_CREATOR = 'invite-initial-creator'
 export const INVITE_STATUS = {
   REVOKED: 'revoked',
diff --git a/frontend/model/contracts/shared/functions.js b/frontend/model/contracts/shared/functions.js
index c06ae2b85b..a858403bf7 100644
--- a/frontend/model/contracts/shared/functions.js
+++ b/frontend/model/contracts/shared/functions.js
@@ -1,8 +1,7 @@
 'use strict'
 
 import sbp from '@sbp/sbp'
-import { INVITE_STATUS, MESSAGE_TYPES } from './constants.js'
-import { DAYS_MILLIS } from './time.js'
+import { INVITE_STATUS, MESSAGE_TYPES, DAYS_MILLIS } from './constants.js'
 import { logExceptNavigationDuplicated } from '~/frontend/views/utils/misc.js'
 
 // !!!!!!!!!!!!!!!
diff --git a/frontend/model/contracts/shared/voting/proposals.js b/frontend/model/contracts/shared/voting/proposals.js
index f3afd9aa40..9576f1067b 100644
--- a/frontend/model/contracts/shared/voting/proposals.js
+++ b/frontend/model/contracts/shared/voting/proposals.js
@@ -30,7 +30,7 @@ export function archiveProposal (
 }
 
 export function buildInvitationUrl (groupId: string, inviteSecret: string): string {
-  return `${location.origin}/app/join?groupId=${groupId}&secret=${inviteSecret}`
+  return `${location.origin}/app/join?${(new URLSearchParams({ groupId: groupId, secret: inviteSecret })).toString()}`
 }
 
 export const proposalSettingsType: any = objectOf({
diff --git a/frontend/model/notifications/templates.js b/frontend/model/notifications/templates.js
index 83ac4dea1b..eb51dd880f 100644
--- a/frontend/model/notifications/templates.js
+++ b/frontend/model/notifications/templates.js
@@ -12,7 +12,7 @@ const contractName = (contractID) => sbp('state/vuex/state').contracts[contractI
 // Note: this escaping is not intended as a protection against XSS.
 // It is only done to enable correct rendering of special characters in usernames.
 // To guard against XSS when rendering usernames, use the `v-safe-html` directive.
-const escapeForHtml = (text) => text.replace(/[<>&]/g, '\\$&')
+const escapeForHtml = (text) => text.replace(/[<>&]/g, (c) => ('&#' + c.codePointAt(0) + ';'))
 const strong = (text) => `<strong>${escapeForHtml(text)}</strong>`
 
 export default ({
diff --git a/frontend/model/state.js b/frontend/model/state.js
index 5bcb3f0758..a769959334 100644
--- a/frontend/model/state.js
+++ b/frontend/model/state.js
@@ -529,6 +529,12 @@ const getters = {
   currentChatRoomId (state, getters) {
     return state.currentChatRoomIDs[state.currentGroupId] || null
   },
+  currentChatVolatile (state, getters) {
+    return state?.[getters.currentChatRoomId]?._volatile || null
+  },
+  currentChatVm (state, getters) {
+    return state?.[getters.currentChatRoomId]?._vm || null
+  },
   currentChatRoomScrollPosition (state, getters) {
     return state.chatRoomScrollPosition[getters.currentChatRoomId] // undefined means to the latest
   },
@@ -571,7 +577,7 @@ const getters = {
   },
   isPrivateChatRoom (state, getters) {
     return (chatRoomId: string) => {
-      return state[chatRoomId]?.attributes.privacyLevel === CHATROOM_PRIVACY_LEVEL.PRIVATE
+      return state[chatRoomId]?.attributes?.privacyLevel === CHATROOM_PRIVACY_LEVEL.PRIVATE
     }
   },
   isJoinedChatRoom (state, getters) {
diff --git a/frontend/utils/crypto.js b/frontend/utils/crypto.js
deleted file mode 100644
index 7ca84479d0..0000000000
--- a/frontend/utils/crypto.js
+++ /dev/null
@@ -1,51 +0,0 @@
-'use strict'
-
-import scrypt from 'scrypt-async'
-
-export class Key {
-  constructor (privKey, pubKey, salt) {
-    this.privKey = privKey
-    this.pubKey = pubKey // optional
-    this.salt = salt // optional
-  }
-
-  encrypt (data) {}
-
-  decrypt (data) {}
-
-  signMessage (msg) {}
-
-  verifySignature (msg, sig) {}
-
-  // serialization
-  serialize (savePrivKey = false) {
-  }
-}
-
-// To store user's private key:
-// var keys = Crypto.randomKeypair()
-// var passKey = Crypto.keyFromPassword(password)
-// var encryptedKeys = passKey.encrypt(keys.serialize(true))
-export class Crypto {
-  // TODO: make sure to NEVER store private key to the log.
-  static randomKeypair () {
-    // return randomly generated asymettric keypair via new Key()
-  }
-
-  static randomKey () {
-    // return randomly generated symmetric key via new Key()
-  }
-
-  static randomSalt () {
-    // return random salt
-  }
-
-  // we use dchest/scrypt-async-js in browser
-  // TODO: use barrysteyn/node-scrypt in node/electrum
-  static keyFromPassword (password) {
-    const salt = Crypto.randomSalt()
-    // TODO: use proper parameters. https://github.com/dchest/scrypt-async-js
-    const opts = { N: 16384, r: 8, p: 1 }
-    return new Promise(resolve => scrypt(password, salt, opts, resolve))
-  }
-}
diff --git a/frontend/views/containers/chatroom/ChatMain.vue b/frontend/views/containers/chatroom/ChatMain.vue
index 30adefd9ea..98cf552496 100644
--- a/frontend/views/containers/chatroom/ChatMain.vue
+++ b/frontend/views/containers/chatroom/ChatMain.vue
@@ -196,7 +196,9 @@ export default ({
       'currentChatRoomScrollPosition',
       'currentChatRoomUnreadSince',
       'currentGroupNotifications',
-      'currentChatRoomUnreadMentions'
+      'currentChatRoomUnreadMentions',
+      'currentChatVolatile',
+      'currentChatVm'
     ]),
     currentUserAttr () {
       return {
@@ -276,7 +278,7 @@ export default ({
         data: !replyingMessage ? data : { ...data, replyingMessage },
         hooks: {
           prepublish: (message) => {
-            const msgValue = JSON.parse(message.opValue())
+            const msgValue = message.decryptedValue()
             const { meta, data } = msgValue
             this.messages.push({
               ...createMessage({ meta, data, hash: message.hash() }),
@@ -412,7 +414,9 @@ export default ({
         attributes: cloneDeep(this.chatRoomAttributes),
         users: cloneDeep(this.chatRoomUsers),
         messages: initialize ? [] : this.messages,
-        saveMessage: true
+        saveMessage: true,
+        _volatile: cloneDeep(this.currentChatVolatile),
+        _vm: cloneDeep(this.currentChatVm)
       }
     },
     async renderMoreMessages (refresh = false) {
diff --git a/frontend/views/containers/chatroom/ChatroomMixin.js b/frontend/views/containers/chatroom/ChatroomMixin.js
index 83d0b6b55e..fdd25f6fb4 100644
--- a/frontend/views/containers/chatroom/ChatroomMixin.js
+++ b/frontend/views/containers/chatroom/ChatroomMixin.js
@@ -169,13 +169,18 @@ const ChatroomMixin: Object = {
       this.ephemeral.loadedDetails = initChatChannelDetails
       const { chatRoomId } = this.$route.params
       const state = await sbp('chelonia/latestContractState', chatRoomId)
-      const { name, type, description, creator, privacyLevel } = state.attributes
+
+      if (!state.attributes || !state.users) {
+        return
+      }
+
+      const { name, type, description, creator, privacyLevel } = state.attributes ?? {}
 
       this.ephemeral.loadedSummary = {
         type,
         title: name,
         description,
-        private: state.attributes.privacyLevel === CHATROOM_PRIVACY_LEVEL.PRIVATE,
+        private: state.attributes?.privacyLevel === CHATROOM_PRIVACY_LEVEL.PRIVATE,
         privacyLevel,
         joined: false,
         creator
@@ -186,7 +191,7 @@ const ChatroomMixin: Object = {
       for (const username in this.currentGroupState.profiles) {
         const { displayName, picture, email } = this.globalProfile(username) || {}
         participants[username] = {
-          ...state.users[username],
+          ...state.users?.[username],
           username: username || '',
           displayName: displayName || '',
           picture: picture || '',
diff --git a/frontend/views/containers/group-settings/InvitationLinkModal.vue b/frontend/views/containers/group-settings/InvitationLinkModal.vue
index 145b08e1ee..3bf25a268b 100644
--- a/frontend/views/containers/group-settings/InvitationLinkModal.vue
+++ b/frontend/views/containers/group-settings/InvitationLinkModal.vue
@@ -19,6 +19,7 @@ import ModalTemplate from '@components/modal/ModalTemplate.vue'
 import LinkToCopy from '@components/LinkToCopy.vue'
 import { INVITE_INITIAL_CREATOR } from '@model/contracts/shared/constants.js'
 import { buildInvitationUrl } from '@model/contracts/shared/voting/proposals.js'
+import { serializeKey } from '../../../../shared/domains/chelonia/crypto.js'
 
 export default ({
   name: 'InvitationLinkModal',
@@ -31,8 +32,17 @@ export default ({
       'currentGroupState'
     ]),
     welcomeInviteSecret () {
-      const invites = this.currentGroupState.invites
-      return Object.keys(invites).find(invite => invites[invite].creator === INVITE_INITIAL_CREATOR)
+      const invites = this.currentGroupState._vm.invites
+      console.log({ invites })
+      const initialInvite = Object.keys(invites).find(invite => invites[invite].creator === INVITE_INITIAL_CREATOR)
+      console.log({ initialInvite })
+      const key = this.currentGroupState._volatile.keys[initialInvite]
+      console.log({ key })
+      if (typeof key !== 'string') {
+        return serializeKey(key, true)
+      } else {
+        return key
+      }
     },
     link () {
       return buildInvitationUrl(this.$store.state.currentGroupId, this.welcomeInviteSecret)
diff --git a/frontend/views/containers/group-settings/InvitationsTable.vue b/frontend/views/containers/group-settings/InvitationsTable.vue
index f9f43e2efb..61e15c34bb 100644
--- a/frontend/views/containers/group-settings/InvitationsTable.vue
+++ b/frontend/views/containers/group-settings/InvitationsTable.vue
@@ -152,19 +152,24 @@ export default ({
       'currentGroupId'
     ]),
     invitesToShow () {
-      const { invites } = this.currentGroupState
+      const { invites } = this.currentGroupState._vm
 
       if (!invites) { return [] }
 
       const invitesList = Object.values(invites)
         .filter(invite => invite.creator === INVITE_INITIAL_CREATOR || invite.creator === this.ourUsername)
         .map(this.mapInvite)
-      const options = {
+
+      return invitesList
+
+      // TODO: Make active and all work
+
+      /* const options = {
         Active: () => invitesList.filter(invite => invite.status.isActive || (invite.status.isRevoked && invite.inviteSecret === this.ephemeral.inviteRevokedNow)),
         All: () => invitesList
-      }
+      } */
 
-      return options[this.ephemeral.selectbox.selectedOption]()
+      // return options[this.ephemeral.selectbox.selectedOption]()
     }
   },
   methods: {
@@ -218,15 +223,15 @@ export default ({
       expires: expiryTime,
       invitee,
       inviteSecret,
+      initialQuantity,
       quantity,
-      responses,
       status
     }) {
       const isAnyoneLink = creator === INVITE_INITIAL_CREATOR
       const isInviteExpired = expiryTime < Date.now()
       const isInviteRevoked = status === INVITE_STATUS.REVOKED
-      const numberOfResponses = Object.keys(responses).length
-      const isAllInviteUsed = numberOfResponses === quantity
+      const numberOfResponses = initialQuantity - quantity
+      const isAllInviteUsed = (quantity === 0)
 
       return {
         isAnyoneLink,
@@ -234,7 +239,7 @@ export default ({
         inviteSecret,
         inviteLink: buildInvitationUrl(this.currentGroupId, inviteSecret),
         description: this.inviteStatusDescription({
-          isAnyoneLink, isInviteExpired, isInviteRevoked, isAllInviteUsed, quantity, numberOfResponses
+          isAnyoneLink, isInviteExpired, isInviteRevoked, isAllInviteUsed, quantity: initialQuantity, numberOfResponses
         }),
         expiryInfo: isInviteExpired ? L('Expired') : isInviteRevoked ? L('Revoked') : isAllInviteUsed ? '' : this.readableExpiryInfo(expiryTime),
         status: {
diff --git a/frontend/views/containers/proposals/ProposalVoteOptions.vue b/frontend/views/containers/proposals/ProposalVoteOptions.vue
index 7f536c53dd..b8c8c09d45 100644
--- a/frontend/views/containers/proposals/ProposalVoteOptions.vue
+++ b/frontend/views/containers/proposals/ProposalVoteOptions.vue
@@ -29,7 +29,6 @@ import { L } from '@common/common.js'
 import { VOTE_FOR, VOTE_AGAINST } from '@model/contracts/shared/voting/rules.js'
 import { oneVoteToPass } from '@model/contracts/shared/voting/proposals.js'
 import { PROPOSAL_INVITE_MEMBER, PROPOSAL_REMOVE_MEMBER } from '@model/contracts/shared/constants.js'
-import { createInvite } from '@model/contracts/shared/functions.js'
 import ButtonSubmit from '@components/ButtonSubmit.vue'
 import { leaveAllChatRooms } from '@controller/actions/group.js'
 
@@ -107,11 +106,11 @@ export default ({
 
         if (oneVoteToPass(proposalHash)) {
           if (this.type === PROPOSAL_INVITE_MEMBER) {
-            passPayload = createInvite({
+            /* passPayload = createInvite({
               invitee: this.proposal.data.proposalData.member,
               creator: this.proposal.meta.username,
               expires: this.currentGroupState.settings.inviteExpiryProposal
-            })
+            }) */
           } else if (this.type === PROPOSAL_REMOVE_MEMBER) {
             passPayload = {
               secret: `${parseInt(Math.random() * 10000)}` // TODO: this
diff --git a/frontend/views/pages/GroupChat.vue b/frontend/views/pages/GroupChat.vue
index e6517af63f..316f542557 100644
--- a/frontend/views/pages/GroupChat.vue
+++ b/frontend/views/pages/GroupChat.vue
@@ -190,7 +190,7 @@ export default ({
       })
       if (this.isDirectMessage(chatRoomId)) {
         this.updateCurrentChatRoomID(chatRoomId)
-      } else if (chatRoomId && chatRoomId !== this.currentChatRoomId) {
+      } else if (chatRoomId) {
         if (!this.isJoinedChatRoom(chatRoomId) && this.isPrivateChatRoom(chatRoomId)) {
           this.redirectChat('GroupChatConversation')
         } else {
diff --git a/frontend/views/pages/Join.vue b/frontend/views/pages/Join.vue
index ba1f468903..2e75535adb 100644
--- a/frontend/views/pages/Join.vue
+++ b/frontend/views/pages/Join.vue
@@ -48,7 +48,7 @@ div
 <script>
 import sbp from '@sbp/sbp'
 import { mapGetters, mapState } from 'vuex'
-import { INVITE_INITIAL_CREATOR, INVITE_STATUS } from '@model/contracts/shared/constants.js'
+import { INVITE_INITIAL_CREATOR /* , INVITE_STATUS */ } from '@model/contracts/shared/constants.js'
 import { LOGIN } from '@utils/events.js'
 import SignupForm from '@containers/access/SignupForm.vue'
 import LoginForm from '@containers/access/LoginForm.vue'
@@ -57,6 +57,7 @@ import Avatar from '@components/Avatar.vue'
 import GroupWelcome from '@components/GroupWelcome.vue'
 import SvgBrokenLink from '@svgs/broken-link.svg'
 import { L } from '@common/common.js'
+import { deserializeKey, keyId } from '../../../shared/domains/chelonia/crypto.js'
 
 let syncFinished = false
 sbp('okTurtles.events/once', LOGIN, () => { syncFinished = true })
@@ -115,8 +116,11 @@ export default ({
           return
         }
         const state = await sbp('chelonia/latestContractState', this.ephemeral.query.groupId)
-        const invite = state.invites[this.ephemeral.query.secret]
-        if (!invite || invite.status !== INVITE_STATUS.VALID) {
+        // TODO: Derive public key from secret
+        const secretKey = deserializeKey(this.ephemeral.query.secret)
+        const publicKey = keyId(secretKey)
+        const invite = state._vm.invites[publicKey]
+        if (!invite /* || invite.status !== INVITE_STATUS.VALID */) {
           console.error('Join.vue error: Link is not valid.')
           this.ephemeral.errorMsg = L('You should ask for a new one. Sorry about that!')
           this.pageStatus = 'INVALID'
@@ -165,11 +169,19 @@ export default ({
     async accept () {
       this.ephemeral.errorMsg = null
       try {
+        const originatingContractID = this.$store.state['loggedIn']['identityContractID']
+        const userState = this.$store.state[originatingContractID]
+
         const { groupId, secret } = this.ephemeral.query
 
         await sbp('gi.actions/group/joinAndSwitch', {
+          originatingContractID,
+          originatingContractName: 'gi.contracts/identity',
           contractID: groupId,
-          data: { inviteSecret: secret }
+          contractName: 'gi.contracts/group',
+          signingKey: secret,
+          innerSigningKeyId: Object.values(userState._vm.authorizedKeys).find((k) => k.meta?.type === 'csk').id,
+          encryptionKeyId: Object.values(userState._vm.authorizedKeys).find((k) => k.meta?.type === 'cek').id
         })
         this.pageStatus = 'WELCOME'
       } catch (e) {
diff --git a/frontend/views/pages/Payments.vue b/frontend/views/pages/Payments.vue
index 84bee7bcd1..4c29e38fe1 100644
--- a/frontend/views/pages/Payments.vue
+++ b/frontend/views/pages/Payments.vue
@@ -365,7 +365,7 @@ export default ({
       }[this.ephemeral.activeTab]()
     },
     hasIncomeDetails () {
-      return !!this.ourGroupProfile.incomeDetailsType
+      return !!this.ourGroupProfile?.incomeDetailsType
     },
     paymentsFiltered () {
       return this.paymentsListData.filter(this.filterPayment)
diff --git a/shared/domains/chelonia/GIMessage.js b/shared/domains/chelonia/GIMessage.js
index 4af2f1134a..8f7673bd74 100644
--- a/shared/domains/chelonia/GIMessage.js
+++ b/shared/domains/chelonia/GIMessage.js
@@ -2,33 +2,48 @@
 
 // TODO: rename GIMessage to CMessage or something similar
 
+import { EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305 } from './crypto.js'
 import { blake32Hash } from '~/shared/functions.js'
 import type { JSONType, JSONObject } from '~/shared/types.js'
 
-export type GIKeyType = ''
+export type GIKeyType = typeof EDWARDS25519SHA512BATCH | typeof CURVE25519XSALSA20POLY1305 | typeof XSALSA20POLY1305
 
 export type GIKey = {
+  id: string;
   type: GIKeyType;
-  data: Object; // based on GIKeyType this will change
+  data: string;
+  permissions: string[];
   meta: Object;
 }
 // Allows server to check if the user is allowed to register this type of contract
 // TODO: rename 'type' to 'contractName':
-export type GIOpContract = { type: string; keyJSON: string, parentContract?: string }
+export type GIOpContract = { type: string; keys: GIKey[], nonce: string, parentContract?: string }
 export type GIOpActionEncrypted = string // encrypted version of GIOpActionUnencrypted
 export type GIOpActionUnencrypted = { action: string; data: JSONType; meta: JSONObject }
-export type GIOpKeyAdd = { keyHash: string, keyJSON: ?string, context: string }
+export type GIOpKeyAdd = GIKey[]
+export type GIOpKeyDel = string[]
 export type GIOpPropSet = { key: string, value: JSONType }
+export type GIOpKeyShare = { contractID: string, keys: GIKey[] }
+export type GIOpKeyRequest = {
+  keyId: string;
+  outerKeyId: string;
+  encryptionKeyId: string;
+  data: string;
+}
+export type GIOpKeyRequestResponse = string
 
-export type GIOpType = 'c' | 'ae' | 'au' | 'ka' | 'kd' | 'pu' | 'ps' | 'pd'
-export type GIOpValue = GIOpContract | GIOpActionEncrypted | GIOpActionUnencrypted | GIOpKeyAdd | GIOpPropSet
-export type GIOp = [GIOpType, GIOpValue]
+export type GIOpType = 'c' | 'ae' | 'au' | 'ka' | 'kd' | 'pu' | 'ps' | 'pd' | 'ks' | 'kr' | 'krr'
+export type GIOpValue = GIOpContract | GIOpActionEncrypted | GIOpActionUnencrypted | GIOpKeyAdd | GIOpKeyDel | GIOpPropSet | GIOpKeyShare | GIOpKeyRequest | GIOpKeyRequestResponse
+export type GIOp = [GIOpType, GIOpValue] | [GIOpType, GIOpValue, GIOpValue]
 
 export class GIMessage {
   // flow type annotations to make flow happy
   _decrypted: GIOpValue
   _mapping: Object
+  _head: Object
   _message: Object
+  _signature: string
+  _signedPayload: string
 
   static OP_CONTRACT: 'c' = 'c'
   static OP_ACTION_ENCRYPTED: 'ae' = 'ae' // e2e-encrypted action
@@ -38,59 +53,97 @@ export class GIMessage {
   static OP_PROTOCOL_UPGRADE: 'pu' = 'pu'
   static OP_PROP_SET: 'ps' = 'ps' // set a public key/value pair
   static OP_PROP_DEL: 'pd' = 'pd' // delete a public key/value pair
+  static OP_CONTRACT_AUTH: 'ca' = 'ca' // authorize a contract
+  static OP_CONTRACT_DEAUTH: 'cd' = 'cd' // deauthorize a contract
+  static OP_ATOMIC: 'at' = 'at' // atomic op
+  static OP_KEYSHARE: 'ks' = 'ks' // key share
+  static OP_KEY_REQUEST: 'kr' = 'kr' // key request
+  static OP_KEY_REQUEST_RESPONSE: 'krr' = 'krr' // key request response
 
   // eslint-disable-next-line camelcase
   static createV1_0 (
-    contractID: string | null = null,
-    previousHEAD: string | null = null,
-    op: GIOp,
-    manifest: string,
-    signatureFn?: Function = defaultSignatureFn
+    {
+      contractID,
+      originatingContractID,
+      previousHEAD = null,
+      op,
+      manifest,
+      signatureFn = defaultSignatureFn
+    }: {
+      contractID: string | null,
+      originatingContractID?: string,
+      previousHEAD?: string | null,
+      op: GIOp,
+      manifest: string,
+      signatureFn?: Function
+    }
   ): this {
-    const message = {
+    const head = {
       version: '1.0.0',
       previousHEAD,
       contractID,
-      op,
-      manifest,
-      // the nonce makes it difficult to predict message contents
-      // and makes it easier to prevent conflicts during development
-      nonce: Math.random()
+      originatingContractID,
+      op: op[0],
+      manifest
     }
+    console.log('createV1_0', { op, head })
+    const message = op[1]
     // NOTE: the JSON strings generated here must be preserved forever.
     //       do not ever regenerate this message using the contructor.
     //       instead store it using serialize() and restore it using
     //       deserialize().
+    const headJSON = JSON.stringify(head)
     const messageJSON = JSON.stringify(message)
+    const signedPayload = blake32Hash(`${blake32Hash(headJSON)}${blake32Hash(messageJSON)}`)
+    const signature = signatureFn(signedPayload)
     const value = JSON.stringify({
+      head: headJSON,
       message: messageJSON,
-      sig: signatureFn(messageJSON)
+      sig: signature
     })
     return new this({
       mapping: { key: blake32Hash(value), value },
-      message
+      head,
+      message,
+      decryptedValue: op.length === 3 ? op[2] : op[1],
+      signature,
+      signedPayload
     })
   }
 
   // TODO: we need signature verification upon decryption somewhere...
   static deserialize (value: string): this {
     if (!value) throw new Error(`deserialize bad value: ${value}`)
+    const parsedValue = JSON.parse(value)
     return new this({
       mapping: { key: blake32Hash(value), value },
-      message: JSON.parse(JSON.parse(value).message)
+      head: JSON.parse(parsedValue.head),
+      message: JSON.parse(parsedValue.message),
+      signature: parsedValue.sig,
+      signedPayload: blake32Hash(`${blake32Hash(parsedValue.head)}${blake32Hash(parsedValue.message)}`)
     })
   }
 
-  constructor ({ mapping, message }: { mapping: Object, message: Object }) {
+  constructor ({ mapping, head, message, signature, signedPayload, decryptedValue }: { mapping: Object, head: Object, message: Object, signature: string, signedPayload: string, decryptedValue?: Object }) {
     this._mapping = mapping
+    this._head = head
     this._message = message
+    this._signature = signature
+    this._signedPayload = signedPayload
+    if (decryptedValue) {
+      this._decrypted = decryptedValue
+    }
     // perform basic sanity check
-    const [type] = this.message().op
+    const type = this.opType()
     switch (type) {
       case GIMessage.OP_CONTRACT:
         if (!this.isFirstMessage()) throw new Error('OP_CONTRACT: must be first message')
         break
+      case GIMessage.OP_KEYSHARE:
+      case GIMessage.OP_KEY_REQUEST:
+      case GIMessage.OP_KEY_REQUEST_RESPONSE:
       case GIMessage.OP_ACTION_ENCRYPTED:
+      case GIMessage.OP_KEY_ADD:
         // nothing for now
         break
       default:
@@ -109,15 +162,21 @@ export class GIMessage {
     return this._decrypted
   }
 
+  head (): Object { return this._head }
+
   message (): Object { return this._message }
 
-  op (): GIOp { return this.message().op }
+  op (): GIOp { return [this.head().op, this.message(), this.decryptedValue()] }
 
-  opType (): GIOpType { return this.op()[0] }
+  opType (): GIOpType { return this.head().op }
 
-  opValue (): GIOpValue { return this.op()[1] }
+  opValue (): GIOpValue { return this.message() }
 
-  manifest (): string { return this.message().manifest }
+  signature (): Object { return this._signature }
+
+  signedPayload (): string { return this._signedPayload }
+
+  manifest (): string { return this.head().manifest }
 
   description (): string {
     const type = this.opType()
@@ -136,9 +195,11 @@ export class GIMessage {
     return `${desc}|${this.hash()} of ${this.contractID()}>`
   }
 
-  isFirstMessage (): boolean { return !this.message().previousHEAD }
+  isFirstMessage (): boolean { return !this.head().previousHEAD }
+
+  contractID (): string { return this.head().contractID || this.hash() }
 
-  contractID (): string { return this.message().contractID || this.hash() }
+  originatingContractID (): string { return this.head().originatingContractID || this.contractID() }
 
   serialize (): string { return this._mapping.value }
 
diff --git a/shared/domains/chelonia/chelonia.js b/shared/domains/chelonia/chelonia.js
index d6896e0401..2c7a901583 100644
--- a/shared/domains/chelonia/chelonia.js
+++ b/shared/domains/chelonia/chelonia.js
@@ -12,7 +12,9 @@ import { handleFetchResult } from '~/frontend/controller/utils/misc.js'
 // TODO: rename this to ChelMessage
 import { GIMessage } from './GIMessage.js'
 import { ChelErrorUnrecoverable } from './errors.js'
-import type { GIOpContract, GIOpActionUnencrypted } from './GIMessage.js'
+import type { GIKey, GIOpContract, GIOpActionUnencrypted, GIOpKeyAdd, GIOpKeyDel, GIOpKeyShare, GIOpKeyRequest, GIOpKeyRequestResponse } from './GIMessage.js'
+import { keyId, sign, encrypt, decrypt, generateSalt } from './crypto.js'
+import type { Key } from './crypto.js'
 
 // TODO: define ChelContractType for /defineContract
 
@@ -20,6 +22,10 @@ export type ChelRegParams = {
   contractName: string;
   server?: string; // TODO: implement!
   data: Object;
+  signingKeyId: string;
+  actionSigningKeyId: string;
+  actionEncryptionKeyId: ?string;
+  keys: GIKey[];
   hooks?: {
     prepublishContract?: (GIMessage) => void;
     prepublish?: (GIMessage) => void;
@@ -33,6 +39,78 @@ export type ChelActionParams = {
   server?: string; // TODO: implement!
   contractID: string;
   data: Object;
+  signingKeyId: string;
+  encryptionKeyId: ?string;
+  hooks?: {
+    prepublishContract?: (GIMessage) => void;
+    prepublish?: (GIMessage) => void;
+    postpublish?: (GIMessage) => void;
+  };
+  publishOptions?: { maxAttempts: number };
+}
+
+export type ChelKeyAddParams = {
+  contractName: string;
+  contractID: string;
+  data: GIOpKeyAdd;
+  signingKeyId: string;
+  hooks?: {
+    prepublishContract?: (GIMessage) => void;
+    prepublish?: (GIMessage) => void;
+    postpublish?: (GIMessage) => void;
+  };
+  publishOptions?: { maxAttempts: number };
+}
+
+export type ChelKeyDelParams = {
+  contractName: string;
+  contractID: string;
+  data: GIOpKeyDel;
+  signingKeyId: string;
+  hooks?: {
+    prepublishContract?: (GIMessage) => void;
+    prepublish?: (GIMessage) => void;
+    postpublish?: (GIMessage) => void;
+  };
+  publishOptions?: { maxAttempts: number };
+}
+
+export type ChelKeyShareParams = {
+  originatingContractID?: string;
+  originatingContractName?: string;
+  destinationContractID: string;
+  destinationContractName: string;
+  data: GIOpKeyShare;
+  signingKeyId: string;
+  hooks?: {
+    prepublishContract?: (GIMessage) => void;
+    prepublish?: (GIMessage) => void;
+    postpublish?: (GIMessage) => void;
+  };
+  publishOptions?: { maxAttempts: number };
+}
+
+export type ChelKeyRequestParams = {
+  originatingContractID: string;
+  originatingContractName: string;
+  contractName: string;
+  contractID: string;
+  signingKey: Key,
+  innerSigningKeyId: string;
+  encryptionKeyId: string;
+  hooks?: {
+    prepublishContract?: (GIMessage) => void;
+    prepublish?: (GIMessage) => void;
+    postpublish?: (GIMessage) => void;
+  };
+  publishOptions?: { maxAttempts: number };
+}
+
+export type ChelKeyRequestResponseParams = {
+  contractName: string;
+  contractID: string;
+  data: GIOpKeyRequestResponse;
+  signingKeyId: string;
   hooks?: {
     prepublishContract?: (GIMessage) => void;
     prepublish?: (GIMessage) => void;
@@ -52,6 +130,45 @@ export const ACTION_REGEX: RegExp = /^((([\w.]+)\/([^/]+))(?:\/(?:([^/]+)\/)?)?)
 // 4 => 'group'
 // 5 => 'payment'
 
+const signatureFnBuilder = (key) => {
+  return (data) => {
+    return {
+      type: key.type,
+      keyId: keyId(key),
+      data: sign(key, data)
+    }
+  }
+}
+
+const encryptFn = function (message: Object, eKeyId: string, state: ?Object) {
+  const key = this.config.transientSecretKeys?.[eKeyId] || state?._volatile?.keys?.[eKeyId]
+
+  if (!key) {
+    return JSON.stringify(message)
+  }
+
+  return {
+    keyId: keyId(key),
+    content: encrypt(key, JSON.stringify(message))
+  }
+}
+
+const decryptFn = function (message: Object, state: ?Object) {
+  if (typeof message === 'string') {
+    return JSON.parse(message)
+  }
+
+  const keyId = message.keyId
+  const key = this.config.transientSecretKeys?.[keyId] || state?._volatile?.keys?.[keyId]
+
+  if (!key) {
+    console.log({ message, state, keyId, env: this.env })
+    throw new Error(`Key ${keyId} not found`)
+  }
+
+  return JSON.parse(decrypt(key, message.content))
+}
+
 export default (sbp('sbp/selectors/register', {
   // https://www.wordnik.com/words/chelonia
   // https://gitlab.okturtles.org/okturtles/group-income/-/wikis/E2E-Protocol/Framework.md#alt-names
@@ -59,8 +176,8 @@ export default (sbp('sbp/selectors/register', {
     this.config = {
       // TODO: handle connecting to multiple servers for federation
       connectionURL: null, // override!
-      decryptFn: JSON.parse, // override!
-      encryptFn: JSON.stringify, // override!
+      decryptFn: decryptFn,
+      encryptFn: encryptFn,
       stateSelector: 'chelonia/private/state', // override to integrate with, for example, vuex
       contracts: {
         defaults: {
@@ -91,7 +208,8 @@ export default (sbp('sbp/selectors/register', {
         handleEventError: null, // (e: Error, message: GIMessage) => {}
         syncContractError: null, // (e: Error, contractID: string) => {}
         pubsubError: null // (e:Error, socket: Socket)
-      }
+      },
+      transientSecretKeys: {}
     }
     this.state = {
       contracts: {}, // contractIDs => { type, HEAD } (contracts we've subscribed to)
@@ -101,6 +219,7 @@ export default (sbp('sbp/selectors/register', {
     this.whitelistedActions = {}
     this.currentSyncs = {}
     this.sideEffectStacks = {} // [contractID]: Array<*>
+    this.env = {}
     this.sideEffectStack = (contractID: string): Array<*> => {
       let stack = this.sideEffectStacks[contractID]
       if (!stack) {
@@ -109,6 +228,15 @@ export default (sbp('sbp/selectors/register', {
       return stack
     }
   },
+  'chelonia/withEnv': async function (contractID: string, env: Object, sbpInvocation: Array<*>) {
+    const savedEnv = this.env
+    this.env = env
+    try {
+      return await sbp('okTurtles.eventQueue/queueEvent', `chelonia/withEnv/${contractID}`, sbpInvocation)
+    } finally {
+      this.env = savedEnv
+    }
+  },
   'chelonia/config': function () {
     return cloneDeep(this.config)
   },
@@ -117,12 +245,20 @@ export default (sbp('sbp/selectors/register', {
     // merge will strip the hooks off of config.hooks when merging from the root of the object
     // because they are functions and cloneDeep doesn't clone functions
     Object.assign(this.config.hooks, config.hooks || {})
+    // The same goes for transientSecretKeys, as cloneDeep will not work properly with Key objects (Uint8Array is converted to Object, and non-enumerable properties fail to be merged)
+    if (config.transientSecretKeys === null) {
+      this.config.transientSecretKeys = {}
+    } else {
+      Object.assign(this.config.transientSecretKeys, config.transientSecretKeys || {})
+    }
     // using Object.assign here instead of merge to avoid stripping away imported modules
-    Object.assign(this.config.contracts.defaults, config.contracts.defaults || {})
-    const manifests = this.config.contracts.manifests
-    console.debug('[chelonia] preloading manifests:', Object.keys(manifests))
-    for (const contractName in manifests) {
-      await sbp('chelonia/private/loadManifest', manifests[contractName])
+    if (config.contracts) {
+      Object.assign(this.config.contracts.defaults, config.contracts.defaults || {})
+      const manifests = this.config.contracts.manifests
+      console.debug('[chelonia] preloading manifests:', Object.keys(manifests))
+      for (const contractName in manifests) {
+        await sbp('chelonia/private/loadManifest', manifests[contractName])
+      }
     }
   },
   // TODO: allow connecting to multiple servers at once
@@ -348,9 +484,21 @@ export default (sbp('sbp/selectors/register', {
       return events.reverse().map(b64ToStr)
     }
   },
+  'chelonia/currentContractState': function (contractID: string) {
+    if (sbp(this.config.stateSelector)[contractID]) {
+      return cloneDeep(sbp(this.config.stateSelector)[contractID])
+    }
+  },
   'chelonia/latestContractState': async function (contractID: string) {
-    const events = await sbp('chelonia/out/eventsSince', contractID, contractID)
-    let state = {}
+    const rootState = sbp(this.config.stateSelector)
+    if (rootState[contractID] && Object.keys(rootState[contractID]).some((x) => x !== '_volatile')) {
+      return cloneDeep(rootState[contractID])
+    }
+    const events = await sbp('chelonia/private/out/eventsSince', contractID, contractID)
+    let state = Object.create(null)
+    if (rootState[contractID]?._volatile?.keys) {
+      state._volatile = { keys: rootState[contractID]._volatile.keys }
+    }
     // fast-path
     try {
       for (const event of events) {
@@ -358,8 +506,11 @@ export default (sbp('sbp/selectors/register', {
       }
       return state
     } catch (e) {
-      console.warn(`[chelonia] latestContractState(${contractID}): fast-path failed due to ${e.name}: ${e.message}`)
-      state = {}
+      console.warn(`[chelonia] latestContractState(${contractID}): fast-path failed due to ${e.name}: ${e.message}`, e.stack)
+      state = Object.create(null)
+      if (rootState[contractID]?._volatile?.keys) {
+        state._volatile = { keys: rootState[contractID]._volatile.keys }
+      }
     }
     // more error-tolerant but slower due to cloning state on each message
     for (const event of events) {
@@ -367,7 +518,7 @@ export default (sbp('sbp/selectors/register', {
       try {
         await sbp('chelonia/private/in/processMessage', GIMessage.deserialize(event), state)
       } catch (e) {
-        console.warn(`[chelonia] latestContractState: '${e.name}': ${e.message} processing:`, event)
+        console.warn(`[chelonia] latestContractState: '${e.name}': ${e.message} processing:`, event, e.stack)
         if (e instanceof ChelErrorUnrecoverable) throw e
         state = stateCopy
       }
@@ -376,26 +527,49 @@ export default (sbp('sbp/selectors/register', {
   },
   // 'chelonia/out' - selectors that send data out to the server
   'chelonia/out/registerContract': async function (params: ChelRegParams) {
-    const { contractName, hooks, publishOptions } = params
+    console.log('Register contract', { params })
+    const { contractName, keys, hooks, publishOptions, signingKeyId, actionSigningKeyId, actionEncryptionKeyId } = params
     const manifestHash = this.config.contracts.manifests[contractName]
     const contractInfo = this.manifestToContract[manifestHash]
     if (!contractInfo) throw new Error(`contract not defined: ${contractName}`)
-    const contractMsg = GIMessage.createV1_0(null, null,
-      [
+    const signingKey = this.config.transientSecretKeys?.[signingKeyId]
+    const signatureFn = signingKey ? signatureFnBuilder(signingKey) : undefined
+    const payload = ({
+      type: contractName,
+      keys: keys,
+      nonce: generateSalt()
+    }: GIOpContract)
+    const contractMsg = GIMessage.createV1_0({
+      contractID: null,
+      previousHEAD: null,
+      op: [
         GIMessage.OP_CONTRACT,
-        ({
-          type: contractName,
-          keyJSON: 'TODO: add group public key here'
-        }: GIOpContract)
+        payload
       ],
-      manifestHash
-    )
+      manifest: manifestHash,
+      signatureFn
+    })
     hooks && hooks.prepublishContract && hooks.prepublishContract(contractMsg)
-    await sbp('chelonia/private/out/publishEvent', contractMsg, publishOptions)
+    await sbp('chelonia/private/out/publishEvent', contractMsg, publishOptions, signatureFn)
+    const contractID = contractMsg.hash()
+    console.log('Register contract, sending action', {
+      params,
+      xx: {
+        action: contractName,
+        contractID,
+        data: params.data,
+        signingKeyId: actionSigningKeyId,
+        encryptionKeyId: actionEncryptionKeyId,
+        hooks,
+        publishOptions
+      }
+    })
     const msg = await sbp('chelonia/out/actionEncrypted', {
       action: contractName,
-      contractID: contractMsg.hash(),
+      contractID,
       data: params.data,
+      signingKeyId: actionSigningKeyId,
+      encryptionKeyId: actionEncryptionKeyId,
       hooks,
       publishOptions
     })
@@ -409,11 +583,169 @@ export default (sbp('sbp/selectors/register', {
   'chelonia/out/actionUnencrypted': function (params: ChelActionParams): Promise<GIMessage> {
     return outEncryptedOrUnencryptedAction.call(this, GIMessage.OP_ACTION_UNENCRYPTED, params)
   },
-  'chelonia/out/keyAdd': async function () {
+  'chelonia/out/keyShare': async function (params: ChelKeyShareParams): Promise<GIMessage> {
+    const { originatingContractName, originatingContractID, destinationContractName, destinationContractID, data, hooks, publishOptions } = params
+    const originatingManifestHash = this.config.contracts.manifests[originatingContractName]
+    const destinationManifestHash = this.config.contracts.manifests[destinationContractName]
+    const originatingContract = originatingContractID ? this.manifestToContract[originatingManifestHash]?.contract : undefined
+    const destinationContract = this.manifestToContract[destinationManifestHash]?.contract
+    let originatingState
 
-  },
-  'chelonia/out/keyDel': async function () {
+    if ((originatingContractID && !originatingContract) || !destinationContract) {
+      throw new Error('Contract name not found')
+    }
+
+    if (originatingContractID && originatingContract) {
+      originatingState = originatingContract.state(originatingContractID)
+    }
+
+    const destinationState = destinationContract.state(destinationContractID)
+    const previousHEAD = await sbp('chelonia/private/out/latestHash', destinationContractID)
+
+    const payload = (data: GIOpKeyShare)
+
+    const signingKey = this.config.transientSecretKeys?.[params.signingKeyId] || ((originatingContractID ? originatingState : destinationState)?._volatile?.keys?.[params.signingKeyId])
 
+    const msg = GIMessage.createV1_0({
+      contractID: destinationContractID,
+      originatingContractID,
+      previousHEAD,
+      op: [
+        GIMessage.OP_KEYSHARE,
+        payload
+      ],
+      manifest: destinationManifestHash,
+      signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+    })
+    hooks && hooks.prepublish && hooks.prepublish(msg)
+    await sbp('chelonia/private/out/publishEvent', msg, publishOptions)
+    hooks && hooks.postpublish && hooks.postpublish(msg)
+    return msg
+  },
+  'chelonia/out/keyAdd': async function (params: ChelKeyAddParams): Promise<GIMessage> {
+    const { contractID, contractName, data, hooks, publishOptions } = params
+    const manifestHash = this.config.contracts.manifests[contractName]
+    const contract = this.manifestToContract[manifestHash]?.contract
+    if (!contract) {
+      throw new Error('Contract name not found')
+    }
+    const state = contract.state(contractID)
+    const previousHEAD = await sbp('chelonia/private/out/latestHash', contractID)
+    const payload = (data: GIOpKeyAdd)
+    const signingKey = this.config.transientSecretKeys?.[params.signingKeyId] || state?._volatile?.keys?.[params.signingKeyId]
+    const msg = GIMessage.createV1_0({
+      contractID,
+      previousHEAD,
+      op: [
+        GIMessage.OP_KEY_ADD,
+        payload
+      ],
+      manifest: manifestHash,
+      signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+    })
+    hooks && hooks.prepublish && hooks.prepublish(msg)
+    await sbp('chelonia/private/out/publishEvent', msg, publishOptions)
+    hooks && hooks.postpublish && hooks.postpublish(msg)
+    return msg
+  },
+  'chelonia/out/keyDel': async function (params: ChelKeyDelParams): Promise<GIMessage> {
+    const { contractID, contractName, data, hooks, publishOptions } = params
+    const manifestHash = this.config.contracts.manifests[contractName]
+    const contract = this.manifestToContract[manifestHash]?.contract
+    if (!contract) {
+      throw new Error('Contract name not found')
+    }
+    const state = contract.state(contractID)
+    const previousHEAD = await sbp('chelonia/private/out/latestHash', contractID)
+    const payload = (data: GIOpKeyDel)
+    const signingKey = this.config.transientSecretKeys?.[params.signingKeyId] || state?._volatile?.keys?.[params.signingKeyId]
+    const msg = GIMessage.createV1_0({
+      contractID,
+      previousHEAD,
+      op: [
+        GIMessage.OP_KEY_DEL,
+        payload
+      ],
+      manifest: manifestHash,
+      signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+    })
+    hooks && hooks.prepublish && hooks.prepublish(msg)
+    await sbp('chelonia/private/out/publishEvent', msg, publishOptions)
+    hooks && hooks.postpublish && hooks.postpublish(msg)
+    return msg
+  },
+  'chelonia/out/keyRequest': async function (params: ChelKeyRequestParams): Promise<GIMessage> {
+    const { originatingContractID, originatingContractName, contractID, contractName, hooks, publishOptions, signingKey, innerSigningKeyId, encryptionKeyId } = params
+    const manifestHash = this.config.contracts.manifests[contractName]
+    const originatingManifestHash = this.config.contracts.manifests[originatingContractName]
+    const contract = this.manifestToContract[manifestHash]?.contract
+    const originatingContract = this.manifestToContract[originatingManifestHash]?.contract
+    if (!contract) {
+      throw new Error('Contract name not found')
+    }
+    const rootState = sbp(this.config.stateSelector)
+    const state = await sbp('chelonia/withEnv', contractID, { skipActionProcessing: true }, [
+      'chelonia/latestContractState', contractID
+    ])
+    if (!rootState[contractID]) this.config.reactiveSet(rootState, contractID, state)
+    const originatingState = originatingContract.state(originatingContractID)
+    const previousHEAD = await sbp('chelonia/private/out/latestHash', contractID)
+    const outerKeyId = keyId(signingKey)
+    const innerSigningKey = this.config.transientSecretKeys?.[innerSigningKeyId] || originatingState?._volatile?.keys?.[innerSigningKeyId]
+    const payload = ({
+      keyId: innerSigningKeyId,
+      outerKeyId: outerKeyId,
+      encryptionKeyId: encryptionKeyId,
+      data: sign(innerSigningKey, [originatingContractID, outerKeyId, GIMessage.OP_KEY_REQUEST, contractID, previousHEAD].map(encodeURIComponent).join('|'))
+    }: GIOpKeyRequest)
+    const msg = GIMessage.createV1_0({
+      originatingContractID,
+      contractID,
+      previousHEAD,
+      op: [
+        GIMessage.OP_KEY_REQUEST,
+        payload
+      ],
+      manifest: manifestHash,
+      signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+    })
+    hooks && hooks.prepublish && hooks.prepublish(msg)
+    const keyShareKeys = ((Object.values(state._vm?.authorizedKeys ?? {}): any): GIKey[]).filter((k) => k?.permissions.includes(GIMessage.OP_KEY_REQUEST_RESPONSE)).map((k) => ({ ...k, permissions: [GIMessage.OP_KEYSHARE], meta: undefined }))
+    console.log({ keyShareKeys, originatingContractID, contractID, st: state, svm: state._vm?.authorizedKeys })
+    keyShareKeys.length && await sbp('chelonia/out/keyAdd', {
+      contractID: originatingContractID,
+      contractName: originatingContractName,
+      data: keyShareKeys
+    })
+    await sbp('chelonia/private/out/publishEvent', msg, publishOptions).then(() => (rootState[contractID] && (rootState[contractID]._volatile = ({ ...rootState[contractID]._volatile, pendingKeys: true }))))
+    hooks && hooks.postpublish && hooks.postpublish(msg)
+    return msg
+  },
+  'chelonia/out/keyRequestResponse': async function (params: ChelKeyRequestResponseParams): Promise<GIMessage> {
+    const { contractID, contractName, data, hooks, publishOptions } = params
+    const manifestHash = this.config.contracts.manifests[contractName]
+    const contract = this.manifestToContract[manifestHash]?.contract
+    if (!contract) {
+      throw new Error('Contract name not found')
+    }
+    const state = contract.state(contractID)
+    const previousHEAD = await sbp('chelonia/private/out/latestHash', contractID)
+    const payload = (data: GIOpKeyRequestResponse)
+    const signingKey = this.config.transientSecretKeys?.[params.signingKeyId] || state?._volatile?.keys?.[params.signingKeyId]
+    const msg = GIMessage.createV1_0({
+      contractID,
+      previousHEAD,
+      op: [
+        GIMessage.OP_KEY_REQUEST_RESPONSE,
+        payload
+      ],
+      manifest: manifestHash,
+      signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+    })
+    hooks && hooks.prepublish && hooks.prepublish(msg)
+    await sbp('chelonia/private/out/publishEvent', msg, publishOptions)
+    hooks && hooks.postpublish && hooks.postpublish(msg)
+    return msg
   },
   'chelonia/out/protocolUpgrade': async function () {
 
@@ -448,14 +780,21 @@ async function outEncryptedOrUnencryptedAction (
   contract.metadata.validate(meta, { state, ...gProxy, contractID })
   contract.actions[action].validate(data, { state, ...gProxy, meta, contractID })
   const unencMessage = ({ action, data, meta }: GIOpActionUnencrypted)
-  const message = GIMessage.createV1_0(contractID, previousHEAD,
-    [
+  const signingKey = this.config.transientSecretKeys?.[params.signingKeyId] || state?._volatile?.keys?.[params.signingKeyId]
+  const payload = opType === GIMessage.OP_ACTION_UNENCRYPTED ? unencMessage : this.config.encryptFn.call(this, unencMessage, params.encryptionKeyId, state)
+  // TODO: Remove this console.log
+  console.log({ unencMessage, ekid: params.encryptionKeyId, state, payload })
+  const message = GIMessage.createV1_0({
+    contractID,
+    previousHEAD,
+    op: [
       opType,
-      opType === GIMessage.OP_ACTION_UNENCRYPTED ? unencMessage : this.config.encryptFn(unencMessage)
+      payload,
+      unencMessage
     ],
-    manifestHash
-    // TODO: add the signature function here to sign the message whether encrypted or not
-  )
+    manifest: manifestHash,
+    signatureFn: signingKey ? signatureFnBuilder(signingKey) : undefined
+  })
   hooks && hooks.prepublish && hooks.prepublish(message)
   await sbp('chelonia/private/out/publishEvent', message, publishOptions)
   hooks && hooks.postpublish && hooks.postpublish(message)
diff --git a/shared/domains/chelonia/crypto.js b/shared/domains/chelonia/crypto.js
new file mode 100644
index 0000000000..91f720547c
--- /dev/null
+++ b/shared/domains/chelonia/crypto.js
@@ -0,0 +1,338 @@
+'use strict'
+
+import nacl from 'tweetnacl'
+
+import { blake32Hash, bytesToB64, b64ToBuf, strToBuf } from '~/shared/functions.js'
+
+import scrypt from 'scrypt-async'
+
+export const EDWARDS25519SHA512BATCH = 'edwards25519sha512batch'
+export const CURVE25519XSALSA20POLY1305 = 'curve25519xsalsa20poly1305'
+export const XSALSA20POLY1305 = 'xsalsa20poly1305'
+
+const bytesOrObjectToB64 = (ary: Object | Uint8Array) => {
+  if (ary instanceof Uint8Array) {
+    return bytesToB64(ary)
+  }
+  return bytesToB64(new Uint8Array(((Object.values(ary): any[]): number[])))
+}
+
+export type Key = {
+  type: string;
+  secretKey?: any;
+  publicKey?: any;
+}
+
+export const keygen = (type: string): Key => {
+  if (type === EDWARDS25519SHA512BATCH) {
+    const key = nacl.sign.keyPair()
+
+    const res: Key = {
+      type: type,
+      publicKey: key.publicKey
+    }
+
+    Object.defineProperty(res, 'secretKey', { value: key.secretKey })
+
+    return res
+  } else if (type === CURVE25519XSALSA20POLY1305) {
+    const key = nacl.box.keyPair()
+
+    const res: Key = {
+      type: type,
+      publicKey: key.publicKey
+    }
+
+    Object.defineProperty(res, 'secretKey', { value: key.secretKey })
+
+    return res
+  } else if (type === XSALSA20POLY1305) {
+    const res: Key = {
+      type: type
+    }
+
+    Object.defineProperty(res, 'secretKey', { value: nacl.randomBytes(nacl.secretbox.keyLength) })
+
+    return res
+  }
+
+  throw new Error('Unsupported key type')
+}
+export const generateSalt = (): string => {
+  return bytesOrObjectToB64(nacl.randomBytes(18))
+}
+export const deriveKeyFromPassword = (type: string, password: string, salt: string): Promise<Key> => {
+  if (![EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305].includes(type)) {
+    return Promise.reject(new Error('Unsupported type'))
+  }
+
+  return new Promise((resolve) => {
+    scrypt(password, salt, {
+      N: 16384,
+      r: 8,
+      p: 1,
+      dkLen: type === EDWARDS25519SHA512BATCH ? nacl.sign.keyLength : type === CURVE25519XSALSA20POLY1305 ? nacl.box.keyLength : type === XSALSA20POLY1305 ? nacl.secretbox.keyLength : 0,
+      encoding: 'binary'
+    }, (derivedKey) => {
+      if (type === EDWARDS25519SHA512BATCH) {
+        const key = nacl.sign.keyPair.fromSeed(derivedKey)
+
+        resolve({
+          type: type,
+          secretKey: key.secretKey,
+          publicKey: key.publicKey
+        })
+      } else if (type === CURVE25519XSALSA20POLY1305) {
+        const key = nacl.box.keyPair.fromSecretKey(derivedKey)
+
+        resolve({
+          type: type,
+          secretKey: key.secretKey,
+          publicKey: key.publicKey
+        })
+      } else if (type === XSALSA20POLY1305) {
+        resolve({
+          type: type,
+          secretKey: derivedKey
+        })
+      }
+    })
+  })
+}
+export const serializeKey = (key: Key, saveSecretKey: boolean): string => {
+  if (key.type === EDWARDS25519SHA512BATCH || key.type === CURVE25519XSALSA20POLY1305) {
+    if (!saveSecretKey) {
+      if (!key.publicKey) {
+        throw new Error('Unsupported operation: no public key to export')
+      }
+
+      return JSON.stringify({
+        type: key.type,
+        publicKey: bytesOrObjectToB64(key.publicKey)
+      })
+    }
+
+    if (!key.secretKey) {
+      throw new Error('Unsupported operation: no secret key to export')
+    }
+
+    return JSON.stringify({
+      type: key.type,
+      secretKey: bytesOrObjectToB64(key.secretKey)
+    })
+  } else if (key.type === XSALSA20POLY1305) {
+    if (!saveSecretKey) {
+      throw new Error('Unsupported operation: no public key to export')
+    }
+
+    if (!key.secretKey) {
+      throw new Error('Unsupported operation: no secret key to export')
+    }
+
+    return JSON.stringify({
+      type: key.type,
+      secretKey: bytesOrObjectToB64(key.secretKey)
+    })
+  }
+
+  throw new Error('Unsupported key type')
+}
+export const deserializeKey = (data: string): Key => {
+  const keyData = JSON.parse(data)
+
+  if (!keyData || !keyData.type) {
+    throw new Error('Invalid key object')
+  }
+
+  if (keyData.type === EDWARDS25519SHA512BATCH) {
+    if (keyData.secretKey) {
+      const key = nacl.sign.keyPair.fromSecretKey(b64ToBuf(keyData.secretKey))
+
+      const res: Key = {
+        type: keyData.type,
+        publicKey: key.publicKey
+      }
+
+      Object.defineProperty(res, 'secretKey', { value: key.secretKey })
+
+      return res
+    } else if (keyData.publicKey) {
+      return {
+        type: keyData.type,
+        publicKey: new Uint8Array(b64ToBuf(keyData.publicKey))
+      }
+    }
+
+    throw new Error('Missing secret or public key')
+  } else if (keyData.type === CURVE25519XSALSA20POLY1305) {
+    if (keyData.secretKey) {
+      const key = nacl.box.keyPair.fromSecretKey(b64ToBuf(keyData.secretKey))
+
+      const res: Key = {
+        type: keyData.type,
+        publicKey: key.publicKey
+      }
+
+      Object.defineProperty(res, 'secretKey', { value: key.secretKey })
+
+      return res
+    } else if (keyData.publicKey) {
+      return {
+        type: keyData.type,
+        publicKey: new Uint8Array(b64ToBuf(keyData.publicKey))
+      }
+    }
+
+    throw new Error('Missing secret or public key')
+  } else if (keyData.type === XSALSA20POLY1305) {
+    if (!keyData.secretKey) {
+      throw new Error('Secret key missing')
+    }
+
+    const res: Key = {
+      type: keyData.type
+    }
+
+    Object.defineProperty(res, 'secretKey', { value: new Uint8Array(b64ToBuf(keyData.secretKey)) })
+
+    return res
+  }
+
+  throw new Error('Unsupported key type')
+}
+export const keyId = (inKey: Key | string): string => {
+  const key = (Object(inKey) instanceof String) ? deserializeKey(((inKey: any): string)) : ((inKey: any): Key)
+
+  const serializedKey = serializeKey(key, !key.publicKey)
+  return blake32Hash(serializedKey)
+}
+export const sign = (inKey: Key | string, data: string): string => {
+  const key = (Object(inKey) instanceof String) ? deserializeKey(((inKey: any): string)) : ((inKey: any): Key)
+
+  if (key.type !== EDWARDS25519SHA512BATCH) {
+    throw new Error('Unsupported algorithm')
+  }
+
+  if (!key.secretKey) {
+    throw new Error('Secret key missing')
+  }
+
+  const messageUint8 = strToBuf(data)
+  const signature = nacl.sign.detached(messageUint8, key.secretKey)
+  const base64Signature = bytesOrObjectToB64(signature)
+
+  return base64Signature
+}
+export const verifySignature = (inKey: Key | string, data: string, signature: string): void => {
+  const key = (Object(inKey) instanceof String) ? deserializeKey(((inKey: any): string)) : ((inKey: any): Key)
+
+  if (key.type !== EDWARDS25519SHA512BATCH) {
+    throw new Error('Unsupported algorithm')
+  }
+
+  if (!key.publicKey) {
+    throw new Error('Public key missing')
+  }
+
+  const decodedSignature = b64ToBuf(signature)
+  const messageUint8 = strToBuf(data)
+
+  const result = nacl.sign.detached.verify(messageUint8, decodedSignature, key.publicKey)
+
+  if (!result) {
+    throw new Error('Invalid signature')
+  }
+}
+export const encrypt = (inKey: Key | string, data: string): string => {
+  const key = (Object(inKey) instanceof String) ? deserializeKey(((inKey: any): string)) : ((inKey: any): Key)
+
+  if (key.type === XSALSA20POLY1305) {
+    if (!key.secretKey) {
+      throw new Error('Secret key missing')
+    }
+
+    const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+
+    const messageUint8 = strToBuf(data)
+    const box = nacl.secretbox(messageUint8, nonce, key.secretKey)
+
+    const fullMessage = new Uint8Array(nonce.length + box.length)
+
+    fullMessage.set(nonce)
+    fullMessage.set(box, nonce.length)
+
+    const base64FullMessage = bytesOrObjectToB64(fullMessage)
+
+    return base64FullMessage
+  } else if (key.type === CURVE25519XSALSA20POLY1305) {
+    if (!key.publicKey) {
+      throw new Error('Public key missing')
+    }
+
+    const nonce = nacl.randomBytes(nacl.box.nonceLength)
+
+    const messageUint8 = strToBuf(data)
+    const ephemeralKey = nacl.box.keyPair()
+    const box = nacl.box(messageUint8, nonce, key.publicKey, ephemeralKey.secretKey)
+    ephemeralKey.secretKey.fill(0)
+
+    const fullMessage = new Uint8Array(nacl.box.publicKeyLength + nonce.length + box.length)
+
+    fullMessage.set(ephemeralKey.publicKey)
+    fullMessage.set(nonce, nacl.box.publicKeyLength)
+    fullMessage.set(box, nacl.box.publicKeyLength + nonce.length)
+
+    const base64FullMessage = bytesOrObjectToB64(fullMessage)
+
+    return base64FullMessage
+  }
+
+  throw new Error('Unsupported algorithm')
+}
+export const decrypt = (inKey: Key | string, data: string): string => {
+  const key = (Object(inKey) instanceof String) ? deserializeKey(((inKey: any): string)) : ((inKey: any): Key)
+
+  if (key.type === XSALSA20POLY1305) {
+    if (!key.secretKey) {
+      throw new Error('Secret key missing')
+    }
+
+    const messageWithNonceAsUint8Array = b64ToBuf(data)
+
+    const nonce = messageWithNonceAsUint8Array.slice(0, nacl.secretbox.nonceLength)
+    const message = messageWithNonceAsUint8Array.slice(
+      nacl.secretbox.nonceLength,
+      messageWithNonceAsUint8Array.length
+    )
+
+    const decrypted = nacl.secretbox.open(message, nonce, key.secretKey)
+
+    if (!decrypted) {
+      throw new Error('Could not decrypt message')
+    }
+
+    return Buffer.from(decrypted).toString('utf-8')
+  } else if (key.type === CURVE25519XSALSA20POLY1305) {
+    if (!key.secretKey) {
+      throw new Error('Secret key missing')
+    }
+
+    const messageWithNonceAsUint8Array = b64ToBuf(data)
+
+    const ephemeralPublicKey = messageWithNonceAsUint8Array.slice(0, nacl.box.publicKeyLength)
+    const nonce = messageWithNonceAsUint8Array.slice(nacl.box.publicKeyLength, nacl.box.publicKeyLength + nacl.box.nonceLength)
+    const message = messageWithNonceAsUint8Array.slice(
+      nacl.box.publicKeyLength + nacl.box.nonceLength
+    )
+
+    const decrypted = nacl.box.open(message, nonce, ephemeralPublicKey, key.secretKey)
+
+    if (!decrypted) {
+      throw new Error('Could not decrypt message')
+    }
+
+    return Buffer.from(decrypted).toString('utf-8')
+  }
+
+  throw new Error('Unsupported algorithm')
+}
diff --git a/shared/domains/chelonia/crypto.test.js b/shared/domains/chelonia/crypto.test.js
new file mode 100644
index 0000000000..f0cb4364d3
--- /dev/null
+++ b/shared/domains/chelonia/crypto.test.js
@@ -0,0 +1,126 @@
+/* eslint-env mocha */
+
+import should from 'should'
+import 'should-sinon'
+import { EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305, keygen, deriveKeyFromPassword, generateSalt, serializeKey, deserializeKey, encrypt, decrypt, sign, verifySignature } from './crypto.js'
+
+describe('Crypto suite', () => {
+  it('should deserialize to the same contents as when serializing', () => {
+    for (const type of [EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const key = keygen(type)
+      const serializedKey = serializeKey(key, true)
+      const deserializedKey = deserializeKey(serializedKey)
+      should(key).deepEqual(deserializedKey)
+    }
+  })
+
+  it('should deserialize to the same contents as when serializing (public)', () => {
+    for (const type of [EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305]) {
+      const key = keygen(type)
+      const serializedKey = serializeKey(key, false)
+      const publicKey = { type: key.type, publicKey: key.publicKey }
+      const deserializedKey = deserializeKey(serializedKey)
+      should(publicKey).deepEqual(deserializedKey)
+    }
+  })
+
+  it('should derive the same key for the same password/salt combination', async () => {
+    for (const type of [EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const salt = generateSalt()
+
+      should(salt).not.be.empty()
+
+      const invocation1 = await deriveKeyFromPassword(type, 'password123', salt)
+      const invocation2 = await deriveKeyFromPassword(type, 'password123', salt)
+
+      should(invocation1).deepEqual(invocation2)
+    }
+  })
+
+  it('should derive different keys for the different password/salt combination', async () => {
+    const salt1 = 'salt1'
+    const salt2 = 'salt2'
+
+    for (const type of [EDWARDS25519SHA512BATCH, CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const invocation1 = await deriveKeyFromPassword(type, 'password123', salt1)
+      const invocation2 = await deriveKeyFromPassword(type, 'password123', salt2)
+      const invocation3 = await deriveKeyFromPassword(type, 'p4ssw0rd321', salt1)
+
+      should(invocation1).not.deepEqual(invocation2)
+      should(invocation2).not.deepEqual(invocation3)
+      should(invocation1).not.deepEqual(invocation3)
+    }
+  })
+
+  it('should correctly sign and verify messages', () => {
+    const key = keygen(EDWARDS25519SHA512BATCH)
+    const data = 'data'
+
+    const signature = sign(key, data)
+
+    should(() => verifySignature(key, data, signature)).not.throw()
+  })
+
+  it('should not verify signatures made with a different key', () => {
+    const key1 = keygen(EDWARDS25519SHA512BATCH)
+    const key2 = keygen(EDWARDS25519SHA512BATCH)
+    const data = 'data'
+
+    const signature = sign(key1, data)
+
+    should(() => verifySignature(key2, data, signature)).throw()
+  })
+
+  it('should not verify signatures made with different data', () => {
+    const key = keygen(EDWARDS25519SHA512BATCH)
+    const data1 = 'data1'
+    const data2 = 'data2'
+
+    const signature = sign(key, data1)
+
+    should(() => verifySignature(key, data2, signature)).throw()
+  })
+
+  it('should not verify invalid signatures', () => {
+    const key = keygen(EDWARDS25519SHA512BATCH)
+    const data = 'data'
+
+    should(() => verifySignature(key, data, 'INVALID SIGNATURE')).throw()
+  })
+
+  it('should correctly encrypt and decrypt messages', () => {
+    const data = 'data'
+
+    for (const type of [CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const key = keygen(type)
+      const encryptedMessage = encrypt(key, data)
+
+      should(encryptedMessage).not.equal(data)
+
+      const result = decrypt(key, encryptedMessage)
+
+      should(result).equal(data)
+    }
+  })
+
+  it('should not decrypt messages encrypted with a different key', () => {
+    const data = 'data'
+
+    for (const type of [CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const key1 = keygen(type)
+      const key2 = keygen(type)
+      const encryptedMessage = encrypt(key1, data)
+
+      should(encryptedMessage).not.equal(data)
+
+      should(() => decrypt(key2, encryptedMessage)).throw()
+    }
+  })
+
+  it('should not decrypt invalid messages', () => {
+    for (const type of [CURVE25519XSALSA20POLY1305, XSALSA20POLY1305]) {
+      const key = keygen(type)
+      should(() => decrypt(key, 'Invalid message')).throw()
+    }
+  })
+})
diff --git a/shared/domains/chelonia/db.js b/shared/domains/chelonia/db.js
index 68818fa86f..2eb136d070 100644
--- a/shared/domains/chelonia/db.js
+++ b/shared/domains/chelonia/db.js
@@ -64,7 +64,7 @@ export default (sbp('sbp/selectors/register', {
   // NEVER call this directly yourself! _always_ call 'chelonia/db/addEntry' instead
   'chelonia/private/db/addEntry': async function (entry: GIMessage): Promise<string> {
     try {
-      const { previousHEAD } = entry.message()
+      const { previousHEAD } = entry.head()
       const contractID: string = entry.contractID()
       if (await sbp('chelonia/db/get', entry.hash())) {
         console.warn(`[chelonia.db] entry exists: ${entry.hash()}`)
diff --git a/shared/domains/chelonia/internals.js b/shared/domains/chelonia/internals.js
index f745e2900c..22a2108be5 100644
--- a/shared/domains/chelonia/internals.js
+++ b/shared/domains/chelonia/internals.js
@@ -2,15 +2,19 @@
 
 import sbp, { domainFromSelector } from '@sbp/sbp'
 import './db.js'
+import { encrypt, decrypt, verifySignature } from './crypto.js'
+import type { GIKey, GIOpActionEncrypted, GIOpActionUnencrypted, GIOpContract, GIOpKeyAdd, GIOpKeyDel, GIOpKeyShare, GIOpPropSet, GIOpType, GIOpKeyRequest, GIOpKeyRequestResponse } from './GIMessage.js'
 import { GIMessage } from './GIMessage.js'
 import { randomIntFromRange, delay, cloneDeep, debounce, pick } from '~/frontend/model/contracts/shared/giLodash.js'
 import { ChelErrorUnexpected, ChelErrorUnrecoverable } from './errors.js'
 import { CONTRACT_IS_SYNCING, CONTRACTS_MODIFIED, EVENT_HANDLED } from './events.js'
 import { handleFetchResult } from '~/frontend/controller/utils/misc.js'
-import { blake32Hash } from '~/shared/functions.js'
+import { b64ToStr, blake32Hash } from '~/shared/functions.js'
 // import 'ses'
 
-import type { GIOpContract, GIOpType, GIOpActionEncrypted, GIOpActionUnencrypted, GIOpPropSet, GIOpKeyAdd } from './GIMessage.js'
+const keysToMap = (keys: GIKey[]): Object => {
+  return Object.fromEntries(keys.map(key => [key.id, key]))
+}
 
 // export const FERAL_FUNCTION = Function
 
@@ -36,7 +40,7 @@ export default (sbp('sbp/selectors/register', {
       throw new Error(`bad hash ${sourceHash} for contract '${contractInfo.file}'! Should be: ${contractInfo.hash}`)
     }
     function reduceAllow (acc, v) { acc[v] = true; return acc }
-    const allowedSels = ['okTurtles.events/on', 'chelonia/defineContract']
+    const allowedSels = ['okTurtles.events/on', 'chelonia/defineContract', 'chelonia/out/keyRequest']
       .concat(this.config.contracts.defaults.allowedSelectors)
       .reduce(reduceAllow, {})
     const allowedDoms = this.config.contracts.defaults.allowedDomains
@@ -127,7 +131,7 @@ export default (sbp('sbp/selectors/register', {
   },
   // used by, e.g. 'chelonia/contract/wait'
   'chelonia/private/noop': function () {},
-  'chelonia/private/out/publishEvent': async function (entry: GIMessage, { maxAttempts = 3 } = {}) {
+  'chelonia/private/out/publishEvent': async function (entry: GIMessage, { maxAttempts = 3 } = {}, signatureFn?: Function) {
     const contractID = entry.contractID()
     let attempt = 1
     // auto resend after short random delay
@@ -156,8 +160,8 @@ export default (sbp('sbp/selectors/register', {
         await delay(randDelay) // wait half a second before sending it again
         // if this isn't OP_CONTRACT, get latestHash, recreate and resend message
         if (!entry.isFirstMessage()) {
-          const previousHEAD = await sbp('chelonia/out/latestHash', contractID)
-          entry = GIMessage.createV1_0(contractID, previousHEAD, entry.op(), entry.manifest())
+          const previousHEAD = await sbp('chelonia/private/out/latestHash', contractID)
+          entry = GIMessage.createV1_0({ contractID, previousHEAD, op: entry.op(), manifest: entry.manifest(), signatureFn })
         }
       } else {
         const message = (await r.json())?.message
@@ -166,28 +170,71 @@ export default (sbp('sbp/selectors/register', {
       }
     }
   },
+  'chelonia/private/out/latestHash': function (contractID: string) {
+    return fetch(`${this.config.connectionURL}/latestHash/${contractID}`, {
+      cache: 'no-store'
+    }).then(handleFetchResult('text'))
+  },
+  // TODO: r.body is a stream.Transform, should we use a callback to process
+  //       the events one-by-one instead of converting to giant json object?
+  //       however, note if we do that they would be processed in reverse...
+  'chelonia/private/out/eventsSince': async function (contractID: string, since: string) {
+    const events = await fetch(`${this.config.connectionURL}/eventsSince/${contractID}/${since}`)
+      .then(handleFetchResult('json'))
+    if (Array.isArray(events)) {
+      return events.reverse().map(b64ToStr)
+    }
+  },
   'chelonia/private/in/processMessage': async function (message: GIMessage, state: Object) {
     const [opT, opV] = message.op()
     const hash = message.hash()
     const contractID = message.contractID()
     const manifestHash = message.manifest()
     const config = this.config
-    if (!state._vm) state._vm = {}
+    const signature = message.signature()
+    const signedPayload = message.signedPayload()
+    const env = this.env
+    const self = this
+    if (!state._vm) state._vm = Object.create(null)
     const opFns: { [GIOpType]: (any) => void } = {
       [GIMessage.OP_CONTRACT] (v: GIOpContract) {
-        // TODO: shouldn't each contract have its own set of authorized keys?
-        if (!state._vm.authorizedKeys) state._vm.authorizedKeys = []
-        // TODO: we probably want to be pushing the de-JSON-ified key here
-        state._vm.authorizedKeys.push({ key: v.keyJSON, context: 'owner' })
+        const keys = { ...config.transientSecretKeys, ...state._volatile?.keys }
+        state._vm.type = v.type
+        state._vm.authorizedKeys = keysToMap(v.keys)
+
+        for (const key of v.keys) {
+          if (key.meta?.private) {
+            if (key.id && key.meta.private.keyId in keys && key.meta.private.content) {
+              if (!state._volatile) state._volatile = Object.create(null)
+              if (!state._volatile.keys) state._volatile.keys = Object.create(null)
+              try {
+                state._volatile.keys[key.id] = decrypt(keys[key.meta.private.keyId], key.meta.private.content)
+              } catch (e) {
+                console.error(`OP_CONTRACT decryption error '${e.message || e}':`, e)
+              }
+            }
+          }
+          if (key.meta?.type === 'inviteKey') {
+            if (!state._vm.invites) state._vm.invites = Object.create(null)
+            state._vm.invites[key.id] = {
+              creator: key.meta.creator,
+              initialQuantity: key.meta.quantity,
+              quantity: key.meta.quantity,
+              expires: key.meta.expires,
+              inviteSecret: state._volatile?.keys?.[key.id],
+              responses: []
+            }
+          }
+        }
       },
       [GIMessage.OP_ACTION_ENCRYPTED] (v: GIOpActionEncrypted) {
-        if (!config.skipActionProcessing) {
-          const decrypted = message.decryptedValue(config.decryptFn)
+        if (!config.skipActionProcessing && !env.skipActionProcessing) {
+          const decrypted = config.decryptFn.call(self, message.opValue(), state)
           opFns[GIMessage.OP_ACTION_UNENCRYPTED](decrypted)
         }
       },
       [GIMessage.OP_ACTION_UNENCRYPTED] (v: GIOpActionUnencrypted) {
-        if (!config.skipActionProcessing) {
+        if (!config.skipActionProcessing && !env.skipActionProcessing) {
           const { data, meta, action } = v
           if (!config.whitelisted(action)) {
             throw new Error(`chelonia: action not whitelisted: '${action}'`)
@@ -195,18 +242,156 @@ export default (sbp('sbp/selectors/register', {
           sbp(`${manifestHash}/${action}/process`, { data, meta, hash, contractID }, state)
         }
       },
+      [GIMessage.OP_KEYSHARE] (v: GIOpKeyShare) {
+        console.log('Processing OP_KEYSHARE')
+        // TODO: Prompt to user if contract not in pending
+        if (message.originatingContractID() !== contractID && v.contractID !== message.originatingContractID()) {
+          throw new Error('External contracts can only set keys for themselves')
+        }
+
+        const cheloniaState = sbp(self.config.stateSelector)
+
+        if (!cheloniaState[v.contractID]) {
+          config.reactiveSet(cheloniaState, v.contractID, Object.create(null))
+        }
+        const targetState = cheloniaState[v.contractID]
+
+        const keys = { ...config.transientSecretKeys, ...state._volatile?.keys }
+
+        const sharedKeys = Object.create(null)
+
+        for (const key of v.keys) {
+          if (key.meta?.private) {
+            if (key.id && key.meta.private.keyId in keys && key.meta.private.content) {
+              try {
+                const decrypted = decrypt(keys[key.meta.private.keyId], key.meta.private.content)
+                sharedKeys[key.id] = decrypted
+                if (config.transientSecretKeys) {
+                  config.transientSecretKeys[key.id] = decrypted
+                }
+              } catch (e) {
+                console.error(`OP_KEYSHARE decryption error '${e.message || e}':`, e)
+              }
+            }
+          }
+        }
+        new Promise((resolve, reject) => {
+          console.log('Processing OP_KEYSHARE (inside promise)')
+          if (targetState._volatile?.pendingKeys) {
+            console.log('Inside pendingKeys if')
+            sbp('chelonia/contract/removeImmediately', v.contractID)
+            // Sync...
+            sbp('chelonia/configure', {
+              transientSecretKeys: {
+                ...keys,
+                ...sharedKeys
+              }
+            }).then(() =>
+              resolve(sbp('chelonia/withEnv', v.contractID, {
+                ...env
+              }, [
+                'chelonia/private/in/syncContract', v.contractID
+              ]))
+            ).catch(reject)
+          } else {
+            console.log('No pendingKeys')
+            resolve()
+          }
+        }).then(() => {
+          if (!targetState._volatile) targetState._volatile = Object.create(null)
+          if (!targetState._volatile.keys) {
+            targetState._volatile.keys = sharedKeys
+          } else {
+            Object.entries((sharedKeys: any)).forEach(([k, v]) => { targetState._volatile.keys[k] = v })
+          }
+        })
+      },
+      [GIMessage.OP_KEY_REQUEST] (v: GIOpKeyRequest) {
+        // TODO: Verify that v.outerKeyId matches actual signing key
+        if (state._vm?.invites?.[v.outerKeyId]?.quantity != null) {
+          if (state._vm.invites[v.outerKeyId].quantity > 0) {
+            state._vm.invites[v.outerKeyId].quantity--
+          } else {
+            console.error('Ignoring OP_KEY_REQUEST because it exceeds allowed quantity: ' + JSON.stringify(v))
+            return
+          }
+        }
+
+        if (state._vm?.invites?.[v.outerKeyId]?.expires != null) {
+          if (state._vm.invites[v.outerKeyId].expires < Date.now()) {
+            console.error('Ignoring OP_KEY_REQUEST because it expired at ' + state._vm.invites[v.outerKeyId].expires + ': ' + JSON.stringify(v))
+            return
+          }
+        }
+
+        if (config.skipActionProcessing || env.skipActionProcessing || state?._volatile?.pendingKeys) {
+          return
+        }
+
+        if (!state._vm.pending_key_requests) state._vm.pending_key_requests = Object.create(null)
+        state._vm.pending_key_requests[message.hash()] = [
+          message.originatingContractID(),
+          message.head().previousHEAD,
+          v
+        ]
+      },
+      [GIMessage.OP_KEY_REQUEST_RESPONSE] (v: GIOpKeyRequestResponse) {
+        if (config.skipActionProcessing || env.skipActionProcessing || state?._volatile?.pendingKeys) {
+          return
+        }
+
+        if (state._vm.pending_key_requests && v in state._vm.pending_key_requests) {
+          const keyId = state._vm.pending_key_requests[v][2].outerKeyId
+          if (Array.isArray(state._vm?.invites?.[keyId]?.responses)) {
+            state._vm?.invites?.[keyId]?.responses.push(state._vm.pending_key_requests[v][0])
+          }
+          delete state._vm.pending_key_requests[v]
+        }
+      },
       [GIMessage.OP_PROP_DEL]: notImplemented,
       [GIMessage.OP_PROP_SET] (v: GIOpPropSet) {
         if (!state._vm.props) state._vm.props = {}
         state._vm.props[v.key] = v.value
       },
       [GIMessage.OP_KEY_ADD] (v: GIOpKeyAdd) {
-        // TODO: implement this. consider creating a function so that
-        //       we're not duplicating code in [GIMessage.OP_CONTRACT]
-        // if (!state._vm.authorizedKeys) state._vm.authorizedKeys = []
-        // state._vm.authorizedKeys.push(v)
+        const keys = { ...config.transientSecretKeys, ...state._volatile?.keys }
+        if (!state._vm.authorizedKeys) state._vm.authorizedKeys = {}
+        // Order is so that KEY_ADD doesn't overwrite existing keys
+        state._vm.authorizedKeys = { ...keysToMap(v), ...state._vm.authorizedKeys }
+        // TODO: Move to different function, as this is implemented in OP_CONTRACT as well
+        for (const key of v) {
+          if (key.meta?.private) {
+            if (key.id && key.meta.private.keyId in keys && key.meta.private.content) {
+              if (!state._volatile) state._volatile = Object.create(null)
+              if (!state._volatile.keys) state._volatile.keys = Object.create(null)
+              try {
+                state._volatile.keys[key.id] = decrypt(keys[key.meta.private.keyId], key.meta.private.content)
+              } catch (e) {
+                console.error(`OP_KEY_ADD decryption error '${e.message || e}':`, e)
+              }
+            }
+          }
+          if (key.meta?.type === 'inviteKey') {
+            if (state._vm.invites) state._vm.invites = Object.create(null)
+            state._vm.invites[key.id] = {
+              creator: key.meta.creator,
+              initialQuantity: key.meta.quantity,
+              quantity: key.meta.quantity,
+              expires: key.meta.expires,
+              inviteSecret: state._volatile?.keys?.[key.id],
+              responses: []
+            }
+          }
+        }
+      },
+      [GIMessage.OP_KEY_DEL] (v: GIOpKeyDel) {
+        if (!state._vm.authorizedKeys) state._vm.authorizedKeys = {}
+        v.forEach(key => {
+          delete state._vm.authorizedKeys[v]
+          if (state._volatile?.keys) { delete state._volatile.keys[v] }
+        })
+        // TODO: Revoke invite keys if (key.meta?.type === 'inviteKey')
       },
-      [GIMessage.OP_KEY_DEL]: notImplemented,
       [GIMessage.OP_PROTOCOL_UPGRADE]: notImplemented
     }
     if (!this.manifestToContract[manifestHash]) {
@@ -216,22 +401,54 @@ export default (sbp('sbp/selectors/register', {
     if (config.preOp) {
       processOp = config.preOp(message, state) !== false && processOp
     }
+
+    // Signature verification
+    // TODO: Temporary. Skip verifying default signatures
+    if (!isNaN(0) && signature.type !== 'default') {
+      // This sync code has potential issues
+      // The first issue is that it can deadlock if there are circular references
+      // The second issue is that it doesn't handle key rotation. If the key used for signing is invalidated / removed from the originating contract, we won't have it in the state
+      // Both of these issues can be resolved by introducing a parameter with the message ID the state is based on. This requires implementing a separate, ephemeral, state container for operations that refer to a different contract.
+      // The difficulty of this is how to securely determine the message ID to use.
+      // The server can assist with this.
+
+      const authorizedKeys = opT === GIMessage.OP_CONTRACT ? keysToMap(((opV: any): GIOpContract).keys) : state._vm.authorizedKeys
+      let signingKey = authorizedKeys?.[signature.keyId]
+
+      if (!signingKey && opT !== GIMessage.OP_CONTRACT && message.originatingContractID() !== message.contractID()) {
+        const originatingContractState = await sbp('chelonia/withEnv', message.originatingContractID(), { skipActionProcessing: true }, [
+          'chelonia/latestContractState', message.originatingContractID()
+        ])
+
+        signingKey = originatingContractState._vm?.authorizedKeys?.[signature.keyId]
+      }
+
+      if (!signingKey || !Array.isArray(signingKey.permissions) || !signingKey.permissions.includes(opT)) {
+        throw new Error('No matching signing key was defined')
+      }
+
+      verifySignature(signingKey.data, signedPayload, signature.data)
+    }
+
     if (config[`preOp_${opT}`]) {
       processOp = config[`preOp_${opT}`](message, state) !== false && processOp
     }
-    if (processOp && !config.skipProcessing) {
-      opFns[opT](opV)
+    opFns[opT](opV)
+    if (processOp && !config.skipActionProcessing && !env.skipActionProcessing) {
       config.postOp && config.postOp(message, state)
       config[`postOp_${opT}`] && config[`postOp_${opT}`](message, state)
     }
   },
-  'chelonia/private/in/enqueueHandleEvent': function (event: GIMessage) {
+  'chelonia/private/in/enqueueHandleEvent': async function (event: GIMessage) {
     // make sure handleEvent is called AFTER any currently-running invocations
     // to 'chelonia/contract/sync', to prevent gi.db from throwing
     // "bad previousHEAD" errors
-    return sbp('okTurtles.eventQueue/queueEvent', event.contractID(), [
+    const result = await sbp('okTurtles.eventQueue/queueEvent', event.contractID(), [
       'chelonia/private/in/handleEvent', event
     ])
+    // TODO: Handle race conditions
+    await sbp('chelonia/private/respondToKeyRequests', event.contractID())
+    return result
   },
   'chelonia/private/in/syncContract': async function (contractID: string) {
     const state = sbp(this.config.stateSelector)
@@ -265,15 +482,98 @@ export default (sbp('sbp/selectors/register', {
         console.debug(`[chelonia] contract ${contractID} was already synchronized`)
       }
       sbp('okTurtles.events/emit', CONTRACT_IS_SYNCING, contractID, false)
+      await sbp('chelonia/private/respondToKeyRequests', contractID)
       this.currentSyncs[contractID] = false
     } catch (e) {
-      console.error(`[chelonia] syncContract error: ${e.message}`, e)
+      console.error(`[chelonia] syncContract error: ${e.message || e}`, e)
       sbp('okTurtles.events/emit', CONTRACT_IS_SYNCING, contractID, false)
       this.currentSyncs[contractID] = false
       this.config.hooks.syncContractError?.(e, contractID)
       throw e
     }
   },
+  'chelonia/private/respondToKeyRequests': async function (contractID: string) {
+    const state = sbp(this.config.stateSelector)
+    const contractState = state[contractID] ?? {}
+
+    if (!contractState._vm || !contractState._vm.pending_key_requests) {
+      return
+    }
+
+    const pending = contractState._vm.pending_key_requests
+
+    delete contractState._vm.pending_key_requests
+
+    await Promise.all(Object.entries(pending).map(async ([hash, entry]) => {
+      if (!Array.isArray(entry) || entry.length !== 3) {
+        return
+      }
+
+      const [originatingContractID, previousHEAD, v] = ((entry: any): [string, string, GIOpKeyRequest])
+
+      // 1. Sync (originating) identity contract
+
+      const originatingState = await sbp('chelonia/withEnv', originatingContractID, { skipActionProcessing: true }, [
+        'chelonia/latestContractState', originatingContractID
+      ])
+
+      const contractName = state.contracts[contractID].type
+      const originatingContractName = originatingState._vm.type
+
+      try {
+        // 2. Verify 'data'
+        const { data, keyId, encryptionKeyId, outerKeyId } = v
+
+        const signingKey = originatingState._vm?.authorizedKeys[keyId]
+
+        if (!signingKey || !signingKey.data) {
+          throw new Error('Unable to find signing key')
+        }
+
+        // sign(originatingContractID + GIMessage.OP_KEY_REQUEST + contractID + HEAD)
+        verifySignature(signingKey.data, [originatingContractID, outerKeyId, GIMessage.OP_KEY_REQUEST, contractID, previousHEAD].map(encodeURIComponent).join('|'), data)
+
+        const encryptionKey = originatingState._vm.authorizedKeys[encryptionKeyId]
+
+        if (!encryptionKey || !encryptionKey.data) {
+          throw new Error('Unable to find encryption key')
+        }
+
+        const { keys, signingKeyId } = await sbp(`${contractName}/getShareableKeys`, contractID)
+
+        if (!signingKeyId || !keys || Object.keys(keys).length === 0) {
+          console.info('respondToKeyRequests: no keys to share', { contractID, originatingContractID })
+          return
+        }
+
+        // 3. Send OP_KEYSHARE to identity contract
+        await sbp('chelonia/out/keyShare', {
+          destinationContractID: originatingContractID,
+          destinationContractName: originatingContractName,
+          originatingContractName: contractName,
+          originatingContractID: contractID,
+          data: {
+            contractID: contractID,
+            keys: Object.entries(keys).map(([keyId, key]: [string, mixed]) => ({
+              id: keyId,
+              meta: {
+                private: {
+                  keyId: encryptionKeyId,
+                  content: encrypt(encryptionKey.data, (key: any))
+                }
+              }
+            }))
+          },
+          signingKeyId
+        })
+      } catch (e) {
+        console.error('Error at respondToKeyRequests', e)
+      } finally {
+        // 4. Remove originating contract and update current contract with information
+        await sbp('chelonia/out/keyRequestResponse', { contractID, contractName, data: hash })
+      }
+    }))
+  },
   'chelonia/private/in/handleEvent': async function (message: GIMessage) {
     const state = sbp(this.config.stateSelector)
     const contractID = message.contractID()
@@ -285,7 +585,7 @@ export default (sbp('sbp/selectors/register', {
     try {
       preHandleEvent && await preHandleEvent(message)
       // verify we're expecting to hear from this contract
-      if (!state.pending.includes(contractID) && !state.contracts[contractID]) {
+      if (isNaN(1) && !state.pending.includes(contractID) && !state.contracts[contractID]) {
         console.warn(`[chelonia] WARN: ignoring unexpected event ${message.description()}:`, message.serialize())
         throw new ChelErrorUnexpected()
       }
@@ -306,7 +606,7 @@ export default (sbp('sbp/selectors/register', {
       try {
         await handleEvent.processMutation.call(this, message, state)
       } catch (e) {
-        console.error(`[chelonia] ERROR '${e.name}' in processMutation for ${message.description()}: ${e.message}`, e, message.serialize())
+        console.error(`[chelonia] ERROR '${e.name}' in processMutation for ${message.description()}: ${e.message || e}`, e, message.serialize())
         // we revert any changes to the contract state that occurred, ignoring this mutation
         handleEvent.revertProcess.call(this, { message, state, contractID, contractStateCopy })
         processingErrored = true
@@ -316,18 +616,23 @@ export default (sbp('sbp/selectors/register', {
       }
       // whether or not there was an exception, we proceed ahead with updating the head
       // you can prevent this by throwing an exception in the processError hook
-      state.contracts[contractID].HEAD = hash
+      /* if (!state.contracts[contractID]) {
+        state.contracts[contractID] = Object.create(null)
+      } */
+      if (state.contracts[contractID]) {
+        state.contracts[contractID].HEAD = hash
+      }
       // process any side-effects (these must never result in any mutation to the contract state!)
       if (!processingErrored) {
         try {
-          if (!this.config.skipActionProcessing && !this.config.skipSideEffects) {
-            await handleEvent.processSideEffects.call(this, message)
+          if (!this.config.skipActionProcessing && !this.config.skipSideEffects && !this.env.skipActionProcessing && !this.env.skipSideEffects) {
+            await handleEvent.processSideEffects.call(this, message, state[contractID])
           }
           postHandleEvent && await postHandleEvent(message)
           sbp('okTurtles.events/emit', hash, contractID, message)
           sbp('okTurtles.events/emit', EVENT_HANDLED, contractID, message)
         } catch (e) {
-          console.error(`[chelonia] ERROR '${e.name}' in side-effects for ${message.description()}: ${e.message}`, e, message.serialize())
+          console.error(`[chelonia] ERROR '${e.name}' in side-effects for ${message.description()}: ${e.message || e}`, e, message.serialize())
           // revert everything
           handleEvent.revertSideEffect.call(this, { message, state, contractID, contractStateCopy, stateCopy })
           this.config.hooks.sideEffectError?.(e, message)
@@ -335,7 +640,7 @@ export default (sbp('sbp/selectors/register', {
         }
       }
     } catch (e) {
-      console.error(`[chelonia] ERROR in handleEvent: ${e.message}`, e)
+      console.error(`[chelonia] ERROR in handleEvent: ${e.message || e}`, e)
       handleEventError?.(e, message)
       if (!(e instanceof ChelErrorUnexpected)) {
         // sometimes we get this error in the following situation:
@@ -387,11 +692,13 @@ const handleEvent = {
       // Flow doesn't understand that a first message must be a contract,
       // so we have to help it a bit in order to acces the 'type' property.
       const { type } = ((message.opValue(): any): GIOpContract)
-      if (!state[contractID]) {
-        console.debug(`contract ${type} registered for ${contractID}`)
-        this.config.reactiveSet(state, contractID, {})
-        this.config.reactiveSet(state.contracts, contractID, { type, HEAD: contractID })
+      // Allow having _volatile but nothing else
+      if (state[contractID] && Object.keys(state[contractID]).length > 0 && !('_volatile' in state[contractID])) {
+        throw new ChelErrorUnrecoverable(`state[contractID] (contractID ${contractID}) is already set`)
       }
+      console.debug(`contract ${type} registered for ${contractID}`)
+      if (!state[contractID]) this.config.reactiveSet(state, contractID, {})
+      this.config.reactiveSet(state.contracts, contractID, { type, HEAD: contractID })
       // we've successfully received it back, so remove it from expectation pending
       const index = state.pending.indexOf(contractID)
       index !== -1 && state.pending.splice(index, 1)
@@ -399,12 +706,12 @@ const handleEvent = {
     }
     await sbp('chelonia/private/in/processMessage', message, state[contractID])
   },
-  async processSideEffects (message: GIMessage) {
+  async processSideEffects (message: GIMessage, state: Object) {
     if ([GIMessage.OP_ACTION_ENCRYPTED, GIMessage.OP_ACTION_UNENCRYPTED].includes(message.opType())) {
       const contractID = message.contractID()
       const manifestHash = message.manifest()
       const hash = message.hash()
-      const { action, data, meta } = message.decryptedValue()
+      const { action, data, meta } = this.config.decryptFn.call(this, message.opValue(), state)
       const mutation = { data, meta, hash, contractID, description: message.description() }
       await sbp(`${manifestHash}/${action}/sideEffect`, mutation)
     }
@@ -457,11 +764,11 @@ function loadScript (file, source, hash) {
     // script.type = 'application/javascript'
     script.type = 'module'
     // problem with this is that scripts will step on each other's feet
-    script.innerHTML = source
+    script.text = source
     // NOTE: this will work if the file route adds .header('Content-Type', 'application/javascript')
     // script.src = `${this.config.connectionURL}/file/${hash}`
     // this results in: "SyntaxError: import declarations may only appear at top level of a module"
-    // script.innerHTML = `(function () {
+    // script.text = `(function () {
     //   ${source}
     // })()`
     script.onload = () => resolve(script)
diff --git a/shared/zkpp.js b/shared/zkpp.js
new file mode 100644
index 0000000000..324274e596
--- /dev/null
+++ b/shared/zkpp.js
@@ -0,0 +1,115 @@
+import nacl from 'tweetnacl'
+import scrypt from 'scrypt-async'
+
+export const base64ToBase64url = (s: string): string => s.replace(/\//g, '_').replace(/\+/g, '-').replace(/=*$/, '')
+
+export const base64urlToBase64 = (s: string): string => s.replace(/_/g, '/').replace(/-/g, '+') + '='.repeat((4 - s.length % 4) % 4)
+
+export const hashStringArray = (...args: Array<Uint8Array | string>): Uint8Array => {
+  return nacl.hash(Buffer.concat(args.map((s) => nacl.hash(Buffer.from(s)))))
+}
+
+export const hashRawStringArray = (...args: Array<Uint8Array | string>): Uint8Array => {
+  return nacl.hash(Buffer.concat(args.map((s) => Buffer.from(s))))
+}
+
+export const randomNonce = (): string => {
+  return base64ToBase64url(Buffer.from(nacl.randomBytes(12)).toString('base64'))
+}
+
+export const hash = (v: string): string => {
+  return base64ToBase64url(Buffer.from(nacl.hash(Buffer.from(v))).toString('base64'))
+}
+
+export const computeCAndHc = (r: string, s: string, h: string): [Uint8Array, Uint8Array] => {
+  const ħ = hashStringArray(r, s)
+  const c = hashStringArray(h, ħ)
+  const hc = nacl.hash(c)
+
+  return [c, hc]
+}
+
+export const encryptContractSalt = (c: Uint8Array, contractSalt: string): string => {
+  const encryptionKey = hashRawStringArray('CS', c).slice(0, nacl.secretbox.keyLength)
+  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength)
+
+  const encryptedContractSalt = nacl.secretbox(Buffer.from(contractSalt), nonce, encryptionKey)
+
+  return base64ToBase64url(Buffer.concat([nonce, encryptedContractSalt]).toString('base64'))
+}
+
+export const decryptContractSalt = (c: Uint8Array, encryptedContractSaltBox: string): string => {
+  const encryptionKey = hashRawStringArray('CS', c).slice(0, nacl.secretbox.keyLength)
+  const encryptedContractSaltBoxBuf = Buffer.from(base64urlToBase64(encryptedContractSaltBox), 'base64')
+
+  const nonce = encryptedContractSaltBoxBuf.slice(0, nacl.secretbox.nonceLength)
+  const encryptedContractSalt = encryptedContractSaltBoxBuf.slice(nacl.secretbox.nonceLength)
+
+  return Buffer.from(nacl.secretbox.open(encryptedContractSalt, nonce, encryptionKey)).toString()
+}
+
+export const hashPassword = (password: string, salt: string): Promise<string> => {
+  return new Promise(resolve => scrypt(password, salt, {
+    N: 16384,
+    r: 8,
+    p: 1,
+    dkLen: 32,
+    encoding: 'hex'
+  }, resolve))
+}
+
+export const boxKeyPair = (): any => {
+  return nacl.box.keyPair()
+}
+
+export const saltAgreement = (publicKey: string, secretKey: Uint8Array): false | [string, string] => {
+  const publicKeyBuf = Buffer.from(base64urlToBase64(publicKey), 'base64')
+  const dhKey = nacl.box.before(publicKeyBuf, secretKey)
+
+  if (!publicKeyBuf || publicKeyBuf.byteLength !== nacl.box.publicKeyLength) {
+    return false
+  }
+
+  const authSalt = Buffer.from(hashStringArray('AUTHSALT', dhKey)).slice(0, 18).toString('base64')
+  const contractSalt = Buffer.from(hashStringArray('CONTRACTSALT', dhKey)).slice(0, 18).toString('base64')
+
+  return [authSalt, contractSalt]
+}
+
+export const parseRegisterSalt = (publicKey: string, secretKey: Uint8Array, encryptedHashedPassword: string): false | [string, string, Uint8Array] => {
+  const saltAgreementRes = saltAgreement(publicKey, secretKey)
+  if (!saltAgreementRes) {
+    return false
+  }
+
+  const [authSalt, contractSalt] = saltAgreementRes
+
+  const encryptionKey = nacl.hash(Buffer.from(authSalt + contractSalt)).slice(0, nacl.secretbox.keyLength)
+  const encryptedHashedPasswordBuf = Buffer.from(base64urlToBase64(encryptedHashedPassword), 'base64')
+
+  const hashedPasswordBuf = nacl.secretbox.open(encryptedHashedPasswordBuf.slice(nacl.box.nonceLength), encryptedHashedPasswordBuf.slice(0, nacl.box.nonceLength), encryptionKey)
+
+  if (!hashedPasswordBuf) {
+    return false
+  }
+
+  return [authSalt, contractSalt, hashedPasswordBuf]
+}
+
+export const buildRegisterSaltRequest = async (publicKey: string, secretKey: Uint8Array, password: string): Promise<[string, string]> => {
+  const saltAgreementRes = saltAgreement(publicKey, secretKey)
+  if (!saltAgreementRes) {
+    throw new Error('Invalid public or secret key')
+  }
+
+  const [authSalt, contractSalt] = saltAgreementRes
+
+  const hashedPassword = await hashPassword(password, authSalt)
+
+  const nonce = nacl.randomBytes(nacl.box.nonceLength)
+  const encryptionKey = nacl.hash(Buffer.from(authSalt + contractSalt)).slice(0, nacl.secretbox.keyLength)
+
+  const encryptedHashedPasswordBuf = nacl.secretbox(Buffer.from(hashedPassword), nonce, encryptionKey)
+
+  return [contractSalt, base64ToBase64url(Buffer.concat([nonce, encryptedHashedPasswordBuf]).toString('base64'))]
+}
diff --git a/test/backend.test.js b/test/backend.test.js
index 75237c4b24..7762b7b5f3 100644
--- a/test/backend.test.js
+++ b/test/backend.test.js
@@ -9,8 +9,7 @@ import { blake32Hash } from '~/shared/functions.js'
 import * as Common from '@common/common.js'
 import proposals from '~/frontend/model/contracts/shared/voting/proposals.js'
 import { PAYMENT_PENDING, PAYMENT_TYPE_MANUAL } from '~/frontend/model/contracts/shared/payments/index.js'
-import { INVITE_INITIAL_CREATOR, INVITE_EXPIRES_IN_DAYS, PROPOSAL_INVITE_MEMBER, PROPOSAL_REMOVE_MEMBER, PROPOSAL_GROUP_SETTING_CHANGE, PROPOSAL_PROPOSAL_SETTING_CHANGE, PROPOSAL_GENERIC } from '~/frontend/model/contracts/shared/constants.js'
-import { createInvite } from '~/frontend/model/contracts/shared/functions.js'
+import { PROPOSAL_INVITE_MEMBER, PROPOSAL_REMOVE_MEMBER, PROPOSAL_GROUP_SETTING_CHANGE, PROPOSAL_PROPOSAL_SETTING_CHANGE, PROPOSAL_GENERIC } from '~/frontend/model/contracts/shared/constants.js'
 import '~/frontend/controller/namespace.js'
 import chalk from 'chalk'
 import { THEME_LIGHT } from '~/frontend/model/settings/themes.js'
@@ -125,6 +124,7 @@ describe('Full walkthrough', function () {
     username = `${username}-${Math.floor(Math.random() * 1000)}`
     const msg = await sbp('chelonia/out/registerContract', {
       contractName: 'gi.contracts/identity',
+      keys: [],
       data: {
         // authorizations: [Events.CanModifyAuths.dummyAuth(name)],
         attributes: { username, email }
@@ -137,17 +137,15 @@ describe('Full walkthrough', function () {
     return msg
   }
   function createGroup (name: string, hooks: Object = {}): Promise {
-    const initialInvite = createInvite({
+    /* const initialInvite = createInvite({
       quantity: 60,
       creator: INVITE_INITIAL_CREATOR,
       expires: INVITE_EXPIRES_IN_DAYS.ON_BOARDING
-    })
+    }) */
     return sbp('chelonia/out/registerContract', {
       contractName: 'gi.contracts/group',
+      keys: [],
       data: {
-        invites: {
-          [initialInvite.inviteSecret]: initialInvite
-        },
         settings: {
           // authorizations: [Events.CanModifyAuths.dummyAuth(name)],
           groupName: name,
@@ -188,6 +186,7 @@ describe('Full walkthrough', function () {
     const { username } = users.bob.decryptedValue().data.attributes
     const mailbox = await sbp('chelonia/out/registerContract', {
       contractName: 'gi.contracts/mailbox',
+      keys: [],
       data: { username }
     })
     await sbp('chelonia/out/actionEncrypted', {
diff --git a/test/cypress/integration/group-chat-message.spec.js b/test/cypress/integration/group-chat-message.spec.js
index 683a0dda36..0ed52c3503 100644
--- a/test/cypress/integration/group-chat-message.spec.js
+++ b/test/cypress/integration/group-chat-message.spec.js
@@ -143,6 +143,7 @@ describe('Send/edit/remove messages & add/remove emoticons inside group chat', (
   it(`user2 joins ${groupName} group`, () => {
     cy.giAcceptGroupInvite(invitationLinkAnyone, {
       username: user2,
+      existingMemberUsername: user1,
       groupName: groupName,
       shouldLogoutAfter: false,
       bypassUI: true
diff --git a/test/cypress/support/commands.js b/test/cypress/support/commands.js
index 1b11015b9a..c3ef979750 100644
--- a/test/cypress/support/commands.js
+++ b/test/cypress/support/commands.js
@@ -273,6 +273,7 @@ Cypress.Commands.add('giInviteMember', (
 
 Cypress.Commands.add('giAcceptGroupInvite', (invitationLink, {
   username,
+  existingMemberUsername,
   groupName,
   isLoggedIn,
   inviteCreator,
@@ -285,13 +286,35 @@ Cypress.Commands.add('giAcceptGroupInvite', (invitationLink, {
     if (!isLoggedIn) {
       cy.giSignup(username, { bypassUI: true })
     }
+
     const params = new URLSearchParams(new URL(invitationLink).search)
     const groupId = params.get('groupId')
     const inviteSecret = params.get('secret')
 
     cy.window().its('sbp').then(async sbp => {
-      await sbp('gi.actions/group/joinAndSwitch', { contractID: groupId, data: { inviteSecret } })
-      await sbp('controller/router').push({ path: '/dashboard' }).catch(e => {})
+      const state = await sbp('state/vuex/state')
+      const originatingContractID = state['loggedIn']['identityContractID']
+      const userState = state[originatingContractID]
+
+      await sbp('gi.actions/group/joinAndSwitch', {
+        originatingContractID,
+        originatingContractName: 'gi.contracts/identity',
+        contractID: groupId,
+        contractName: 'gi.contracts/group',
+        signingKey: inviteSecret,
+        innerSigningKeyId: Object.values(userState._vm.authorizedKeys).find((k) => k.meta?.type === 'csk').id,
+        encryptionKeyId: Object.values(userState._vm.authorizedKeys).find((k) => k.meta?.type === 'cek').id
+      })
+
+      for (let i = 0; i < 2; i++) {
+        await new Promise(resolve => setTimeout(resolve, 2000))
+        await sbp('gi.actions/identity/logout')
+        await sbp('gi.actions/identity/login', { username: existingMemberUsername, password: '123456789' })
+        await new Promise(resolve => setTimeout(resolve, 2000))
+        await sbp('gi.actions/identity/logout')
+        await sbp('gi.actions/identity/login', { username: username, password: '123456789' })
+        await sbp('controller/router').push({ path: '/dashboard' }).catch(e => {})
+      }
     })
   } else {
     cy.visit(invitationLink)