Finished the bulk of changes for gnupg 1.9. This included switching

to libgcrypt functions, using shared error codes from libgpg-error,
replacing the old functions we used to have in ../util by those in
../jnlib and ../common, renaming the malloc functions and a couple of
types.  Note, that not all changes are listed below becuause they are
too similar and done at far too many places.  As of today the code
builds using the current libgcrypt from CVS but it is very unlikely
that it actually works.

65 files changed, 3299 insertions, 2434 deletions

diff --git a/g10/ChangeLog b/g10/ChangeLog
index 176ec10fa..1ff227fdc 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,4 +1,71 @@
-2003-06-04  Werner Koch  <wk@gnupg.org>
+2003-06-18  Werner Koch  <wk@gnupg.org>
+
+        Finished the bulk of changes for gnupg 1.9.  This included
+	switching to libgcrypt functions, using shared error codes from
+	libgpg-error, replacing the old functions we used to have in
+	../util by those in ../jnlib and ../common, renaming the malloc
+	functions and a couple of types.  Note, that not all changes are
+	listed below becuause they are too similar and done at far too
+	many places.  As of today the code builds using the current
+	libgcrypt from CVS but it is very unlikely that it actually works.
+	
+	* sig-check.c (cmp_help): Removed.  Was never used.
+
+	* pkglue.c: New. Most stuff taken from gnupg 1.1.2.
+	* pkglue.h: New.
+
+	* misc.c (pull_in_libs): Removed.
+
+	* keygen.c (count_chr): New.
+	(ask_user_id): Removed faked RNG support.
+
+	* misc.c (openpgp_md_map_name,openpgp_cipher_map_name)
+	(openpgp_pk_map_name): New.
+
+	* skclist.c (build_sk_list): Removed faked RNG support.
+	(is_insecure): Removed.
+
+	* comment.c (make_mpi_comment_node): Use gcry MPI print function.
+
+	* keyid.c (v3_keyid): New.
+
+	* misc.c (mpi_write,mpi_write_opaque,mpi_read,mpi_read_opaque)
+	(mpi_print): New.  Taken from gnupg 1.1.2.
+	(checksum_mpi): Replaced by implementation from 1.1.2.
+
+	* g10.c (my_strusage): Renamed from strusage and return NULL
+	instead calling a default function.
+	(add_to_strlist2): New.  Taken from ../util/strgutil.c of gnupg 1.2.
+
+	* plaintext.c (handle_plaintext): New arg CREATE_FILE to cope with
+	the fact that gpg-error does not have this error code anymore.
+
+	* mainproc.c (symkey_decrypt_sesskey): Ditto.
+
+	* seskey.c (make_session_key): Adjusted for use with libgcrypt.
+	(encode_session_key): Ditto.
+	(do_encode_md): Ditto.
+	(encode_md_value): Ditto.
+
+	* keyring.c: Use libgpg-error instead of READ_ERROR etc.
+
+	* g10.c: Adjusted all algorithm name/id mapping functions.
+	(set_debug): Pass MPI and CRYPTO debug values to libgcrypt.
+
+	* Makefile.am (INCLUDES): Define LOCALEDIR and the default error
+	source.
+
+	* g10.c (i18n_init): s/G10_LOCALEDIR/LOCALEDIR/.
+
+	Renamed m_alloc et al to xmalloc et al.
+	s/g10_errstr/gpg_strerror/
+	s/MPI/gcry_mpi_t/
+	Adjusted all md_open calls to the libgcrypt API.
+	
+	* build-packet.c (do_comment): Return error code from iobuf write
+	function.
+	(do_user_id): Ditto.
+	(do_public_key): Ditto.
 
 	* Makefile.am: Add new files, link gpg with libgpg-error.
 	* g10.c, options.h: New option --agent-program.
diff --git a/g10/Makefile.am b/g10/Makefile.am
index 91438741a..6940be67a 100644
--- a/g10/Makefile.am
+++ b/g10/Makefile.am
@@ -19,16 +19,17 @@
 
 ## Process this file with automake to produce Makefile.in
 
-INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/intl
+localedir = $(datadir)/locale
+INCLUDES = -I$(top_srcdir)/common -I$(top_srcdir)/include -I$(top_srcdir)/intl -DLOCALEDIR=\"$(localedir)\"
+
 EXTRA_DIST = options.skel
 # it seems that we can't use this with automake 1.5
 #OMIT_DEPENDENCIES = zlib.h zconf.h
 libexecdir = @libexecdir@/@PACKAGE@
-# FIXME: Windows support currently not enabled
-#if ! HAVE_DOSISH_SYSTEM
-#AM_CFLAGS = -DGNUPG_LIBEXECDIR="\"$(libexecdir)\""
-#endif
-needed_libs = ../cipher/libcipher.a ../mpi/libmpi.a ../util/libutil.a
+if ! HAVE_DOSISH_SYSTEM
+AM_CFLAGS = -DGNUPG_LIBEXECDIR="\"$(libexecdir)\""
+endif
+needed_libs = ../common/libcommon.a ../jnlib/libjnlib.a
 
 #noinst_PROGRAMS = gpgd
 bin_PROGRAMS = gpg gpgv
@@ -62,6 +63,7 @@ common_source =  \
 	      plaintext.c	\
 	      sig-check.c	\
 	      keylist.c 	\
+	      pkglue.c pkglue.h \
 	      signal.c
 
 gpg_SOURCES  = g10.c		\
@@ -108,8 +110,9 @@ gpgv_SOURCES = gpgv.c           \
 #	       ks-db.h \
 #	       $(common_source)
 
-LDADD =  $(needed_libs) @INTLLIBS@ @CAPLIBS@ @ZLIBS@
-gpg_LDADD = $(LDADD) @DLLIBS@ @EGDLIBS@ -lgpg-error
+LDADD =  $(needed_libs) @INTLLIBS@ @CAPLIBS@ @ZLIBS@ 
+gpg_LDADD = $(LIBGCRYPT_LIBS) $(LDADD) -lassuan -lgpg-error
+gpgv_LDADD = $(LIBGCRYPT_LIBS) $(LDADD) -lassuan -lgpg-error
 
 $(PROGRAMS): $(needed_libs)
 
diff --git a/g10/armor.c b/g10/armor.c
index f00742295..c6930e22a 100644
--- a/g10/armor.c
+++ b/g10/armor.c
@@ -27,6 +27,7 @@
 #include <assert.h>
 #include <ctype.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -192,7 +193,7 @@ is_armored( const byte *buf )
  *	   filter to do further processing.
  */
 int
-use_armor_filter( IOBUF a )
+use_armor_filter( iobuf_t a )
 {
     byte buf[1];
     int n;
@@ -337,7 +338,7 @@ parse_header_line( armor_filter_context_t *afx, byte *line, unsigned int len )
     int hashes=0;
     unsigned int len2;
 
-    len2 = check_trailing_ws( line, len );
+    len2 = length_sans_trailing_ws( line, len );
     if( !len2 ) {
         afx->buffer_pos = len2;  /* (it is not the fine way to do it here) */
 	return 0; /* WS only: same as empty line */
@@ -376,7 +377,7 @@ parse_header_line( armor_filter_context_t *afx, byte *line, unsigned int len )
 
 /* figure out whether the data is armored or not */
 static int
-check_input( armor_filter_context_t *afx, IOBUF a )
+check_input( armor_filter_context_t *afx, iobuf_t a )
 {
     int rc = 0;
     int i;
@@ -418,7 +419,7 @@ check_input( armor_filter_context_t *afx, IOBUF a )
 	    if( hdr_line == BEGIN_SIGNED_MSG_IDX ) {
 		if( afx->in_cleartext ) {
 		    log_error(_("nested clear text signatures\n"));
-		    rc = G10ERR_INVALID_ARMOR;
+		    rc = GPG_ERR_INV_ARMOR;
 		}
 		afx->in_cleartext = 1;
 	    }
@@ -448,7 +449,7 @@ check_input( armor_filter_context_t *afx, IOBUF a )
 	i = parse_header_line( afx, line, len );
 	if( i <= 0 ) {
 	    if( i )
-		rc = G10ERR_INVALID_ARMOR;
+		rc = GPG_ERR_INV_ARMOR;
 	    break;
 	}
     }
@@ -476,7 +477,7 @@ check_input( armor_filter_context_t *afx, IOBUF a )
  *	  not implemented/checked.
  */
 static int
-fake_packet( armor_filter_context_t *afx, IOBUF a,
+fake_packet( armor_filter_context_t *afx, iobuf_t a,
 	     size_t *retn, byte *buf, size_t size  )
 {
     int rc = 0;
@@ -615,12 +616,12 @@ invalid_crc(void)
     if ( opt.ignore_crc_error )
         return 0;
     log_inc_errorcount();
-    return G10ERR_INVALID_ARMOR;
+    return GPG_ERR_INV_ARMOR;
 }
 
 
 static int
-radix64_read( armor_filter_context_t *afx, IOBUF a, size_t *retn,
+radix64_read( armor_filter_context_t *afx, iobuf_t a, size_t *retn,
 	      byte *buf, size_t size )
 {
     byte val;
@@ -785,11 +786,11 @@ radix64_read( armor_filter_context_t *afx, IOBUF a, size_t *retn,
 		    rc = 0;
 		else if( rc == 2 ) {
 		    log_error(_("premature eof (in Trailer)\n"));
-		    rc = G10ERR_INVALID_ARMOR;
+		    rc = GPG_ERR_INV_ARMOR;
 		}
 		else {
 		    log_error(_("error in trailer line\n"));
-		    rc = G10ERR_INVALID_ARMOR;
+		    rc = GPG_ERR_INV_ARMOR;
 		}
 #endif
 	    }
@@ -808,7 +809,7 @@ radix64_read( armor_filter_context_t *afx, IOBUF a, size_t *retn,
  */
 int
 armor_filter( void *opaque, int control,
-	     IOBUF a, byte *buf, size_t *ret_len)
+	     iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     armor_filter_context_t *afx = opaque;
@@ -1081,7 +1082,7 @@ armor_filter( void *opaque, int control,
 	if( afx->qp_detected )
 	    log_error(_("quoted printable character in armor - "
 			"probably a buggy MTA has been used\n") );
-	m_free( afx->buffer );
+	xfree ( afx->buffer );
 	afx->buffer = NULL;
     }
     else if( control == IOBUFCTRL_DESC )
@@ -1098,7 +1099,7 @@ make_radix64_string( const byte *data, size_t len )
 {
     char *buffer, *p;
 
-    buffer = p = m_alloc( (len+2)/3*4 + 1 );
+    buffer = p = xmalloc ( (len+2)/3*4 + 1 );
     for( ; len >= 3 ; len -= 3, data += 3 ) {
 	*p++ = bintoasc[(data[0] >> 2) & 077];
 	*p++ = bintoasc[(((data[0] <<4)&060)|((data[1] >> 4)&017))&077];
@@ -1158,14 +1159,14 @@ unarmor_pump_new (void)
 
     if( !is_initialized )
         initialize();
-    x = m_alloc_clear (sizeof *x);
+    x = xcalloc (1,sizeof *x);
     return x;
 }
 
 void
 unarmor_pump_release (UnarmorPump x)
 {
-    m_free (x);
+    xfree (x);
 }
 
 /* 
diff --git a/g10/build-packet.c b/g10/build-packet.c
index 86aa07dc2..a3177525e 100644
--- a/g10/build-packet.c
+++ b/g10/build-packet.c
@@ -25,6 +25,7 @@
 #include <string.h>
 #include <assert.h>
 
+#include "gpg.h"
 #include "packet.h"
 #include "errors.h"
 #include "iobuf.h"
@@ -35,28 +36,28 @@
 #include "options.h"
 
 
-static int do_comment( IOBUF out, int ctb, PKT_comment *rem );
-static int do_user_id( IOBUF out, int ctb, PKT_user_id *uid );
-static int do_public_key( IOBUF out, int ctb, PKT_public_key *pk );
-static int do_secret_key( IOBUF out, int ctb, PKT_secret_key *pk );
-static int do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc );
-static int do_pubkey_enc( IOBUF out, int ctb, PKT_pubkey_enc *enc );
+static int do_comment( iobuf_t out, int ctb, PKT_comment *rem );
+static int do_user_id( iobuf_t out, int ctb, PKT_user_id *uid );
+static int do_public_key( iobuf_t out, int ctb, PKT_public_key *pk );
+static int do_secret_key( iobuf_t out, int ctb, PKT_secret_key *pk );
+static int do_symkey_enc( iobuf_t out, int ctb, PKT_symkey_enc *enc );
+static int do_pubkey_enc( iobuf_t out, int ctb, PKT_pubkey_enc *enc );
 static u32 calc_plaintext( PKT_plaintext *pt );
-static int do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt );
-static int do_encrypted( IOBUF out, int ctb, PKT_encrypted *ed );
-static int do_encrypted_mdc( IOBUF out, int ctb, PKT_encrypted *ed );
-static int do_compressed( IOBUF out, int ctb, PKT_compressed *cd );
-static int do_signature( IOBUF out, int ctb, PKT_signature *sig );
-static int do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops );
+static int do_plaintext( iobuf_t out, int ctb, PKT_plaintext *pt );
+static int do_encrypted( iobuf_t out, int ctb, PKT_encrypted *ed );
+static int do_encrypted_mdc( iobuf_t out, int ctb, PKT_encrypted *ed );
+static int do_compressed( iobuf_t out, int ctb, PKT_compressed *cd );
+static int do_signature( iobuf_t out, int ctb, PKT_signature *sig );
+static int do_onepass_sig( iobuf_t out, int ctb, PKT_onepass_sig *ops );
 
 static int calc_header_length( u32 len, int new_ctb );
-static int write_16(IOBUF inp, u16 a);
-static int write_32(IOBUF inp, u32 a);
-static int write_header( IOBUF out, int ctb, u32 len );
-static int write_sign_packet_header( IOBUF out, int ctb, u32 len );
-static int write_header2( IOBUF out, int ctb, u32 len, int hdrlen, int blkmode );
-static int write_new_header( IOBUF out, int ctb, u32 len, int hdrlen );
-static int write_version( IOBUF out, int ctb );
+static int write_16(iobuf_t inp, u16 a);
+static int write_32(iobuf_t inp, u32 a);
+static int write_header( iobuf_t out, int ctb, u32 len );
+static int write_sign_packet_header( iobuf_t out, int ctb, u32 len );
+static int write_header2( iobuf_t out, int ctb, u32 len, int hdrlen, int blkmode );
+static int write_new_header( iobuf_t out, int ctb, u32 len, int hdrlen );
+static int write_version( iobuf_t out, int ctb );
 
 /****************
  * Build a packet and write it to INP
@@ -65,7 +66,7 @@ static int write_version( IOBUF out, int ctb );
  * Note: Caller must free the packet
  */
 int
-build_packet( IOBUF out, PACKET *pkt )
+build_packet( iobuf_t out, PACKET *pkt )
 {
     int new_ctb=0, rc=0, ctb;
     int pkttype;
@@ -179,51 +180,56 @@ calc_packet_length( PACKET *pkt )
 }
 
 static void
-write_fake_data( IOBUF out, MPI a )
+write_fake_data( iobuf_t out, gcry_mpi_t a )
 {
     if( a ) {
-	int i;
+	unsigned int n;
 	void *p;
 
-	p = mpi_get_opaque( a, &i );
-	iobuf_write( out, p, i );
+        assert( gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE));
+        p = gcry_mpi_get_opaque (a, &n);
+        iobuf_write (out, p, (n+7)/8);
     }
 }
 
 
 static int
-do_comment( IOBUF out, int ctb, PKT_comment *rem )
+do_comment (iobuf_t out, int ctb, PKT_comment *rem)
 {
-    if( opt.sk_comments ) {
-	write_header(out, ctb, rem->len);
-	if( iobuf_write( out, rem->data, rem->len ) )
-	    return G10ERR_WRITE_FILE;
+  int rc = 0;
+
+  if (opt.sk_comments)
+    {
+      write_header(out, ctb, rem->len);
+      rc = iobuf_write( out, rem->data, rem->len );
     }
-    return 0;
+  return rc;
 }
 
 static int
-do_user_id( IOBUF out, int ctb, PKT_user_id *uid )
+do_user_id( iobuf_t out, int ctb, PKT_user_id *uid )
 {
-    if( uid->attrib_data ) {
-	write_header(out, ctb, uid->attrib_len);
-	if( iobuf_write( out, uid->attrib_data, uid->attrib_len ) )
-	    return G10ERR_WRITE_FILE;
+  int rc;
+
+  if (uid->attrib_data)
+    {
+      write_header (out, ctb, uid->attrib_len);
+      rc = iobuf_write (out, uid->attrib_data, uid->attrib_len );
     }
-    else {
-	write_header(out, ctb, uid->len);
-	if( iobuf_write( out, uid->name, uid->len ) )
-	    return G10ERR_WRITE_FILE;
+  else
+    {
+      write_header (out, ctb, uid->len);
+      rc = iobuf_write (out, uid->name, uid->len );
     }
-    return 0;
+  return rc;
 }
 
 static int
-do_public_key( IOBUF out, int ctb, PKT_public_key *pk )
+do_public_key( iobuf_t out, int ctb, PKT_public_key *pk )
 {
     int rc = 0;
     int n, i;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 
     if( !pk->version )
 	iobuf_put( a, 3 );
@@ -246,8 +252,7 @@ do_public_key( IOBUF out, int ctb, PKT_public_key *pk )
 	mpi_write(a, pk->pkey[i] );
 
     write_header2(out, ctb, iobuf_get_temp_length(a), pk->hdrbytes, 1 );
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a);
 
     iobuf_close(a);
     return rc;
@@ -265,7 +270,7 @@ hash_public_key( MD_HANDLE md, PKT_public_key *pk )
     int ctb;
     ulong pktlen;
     int c;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 #if 0
     FILE *fp = fopen("dump.pk", "a");
     int i=0;
@@ -278,7 +283,7 @@ hash_public_key( MD_HANDLE md, PKT_public_key *pk )
     pkt.pkttype = PKT_PUBLIC_KEY;
     pkt.pkt.public_key = pk;
     if( (rc = build_packet( a, &pkt )) )
-	log_fatal("build public_key for hashing failed: %s\n", g10_errstr(rc));
+	log_fatal("build public_key for hashing failed: %s\n", gpg_strerror (rc));
 
     if( !(pk->version == 3 && pk->pubkey_algo == 16) ) {
 	/* skip the constructed header but don't do this for our very old
@@ -309,10 +314,10 @@ hash_public_key( MD_HANDLE md, PKT_public_key *pk )
 	    }
 	}
 	/* hash a header */
-	md_putc( md, 0x99 );
+	gcry_md_putc ( md, 0x99 );
 	pktlen &= 0xffff; /* can't handle longer packets */
-	md_putc( md, pktlen >> 8 );
-	md_putc( md, pktlen & 0xff );
+	gcry_md_putc ( md, pktlen >> 8 );
+	gcry_md_putc ( md, pktlen & 0xff );
     }
     /* hash the packet body */
     while( (c=iobuf_get(a)) != -1 ) {
@@ -323,7 +328,7 @@ hash_public_key( MD_HANDLE md, PKT_public_key *pk )
 	    i=0;
 	}
 #endif
-	md_putc( md, c );
+	gcry_md_putc ( md, c );
     }
 #if 0
     putc('\n', fp);
@@ -334,11 +339,11 @@ hash_public_key( MD_HANDLE md, PKT_public_key *pk )
 
 
 static int
-do_secret_key( IOBUF out, int ctb, PKT_secret_key *sk )
+do_secret_key( iobuf_t out, int ctb, PKT_secret_key *sk )
 {
     int rc = 0;
     int i, nskey, npkey;
-    IOBUF a = iobuf_temp(); /* build in a self-enlarging buffer */
+    iobuf_t a = iobuf_temp(); /* build in a self-enlarging buffer */
 
     /* Write the version number - if none is specified, use 3 */
     if( !sk->version )
@@ -366,7 +371,7 @@ do_secret_key( IOBUF out, int ctb, PKT_secret_key *sk )
 
     /* If we don't have any public parameters - which is the case if
        we don't know the algorithm used - the parameters are stored as
-       one blob in a faked (opaque) MPI */
+       one blob in a faked (opaque) gcry_mpi_t */
     if( !npkey ) {
 	write_fake_data( a, sk->skey[0] );
 	goto leave;
@@ -423,19 +428,19 @@ do_secret_key( IOBUF out, int ctb, PKT_secret_key *sk )
     else if( sk->is_protected && sk->version >= 4 ) {
         /* The secret key is protected - write it out as it is */
 	byte *p;
-	assert( mpi_is_opaque( sk->skey[npkey] ) );
-	p = mpi_get_opaque( sk->skey[npkey], &i );
-	iobuf_write(a, p, i );
+	assert( gcry_mpi_get_flag( sk->skey[npkey], GCRYMPI_FLAG_OPAQUE ) );
+	p = gcry_mpi_get_opaque( sk->skey[npkey], &i );
+	iobuf_write(a, p, (i+7)/8 );
     }
     else if( sk->is_protected ) {
-        /* The secret key is protected te old v4 way. */
+        /* The secret key is protected the old v4 way. */
 	for(   ; i < nskey; i++ ) {
             byte *p;
-            int ndata;
+            size_t n;
 
-            assert (mpi_is_opaque (sk->skey[i]));
-            p = mpi_get_opaque (sk->skey[i], &ndata);
-            iobuf_write (a, p, ndata);
+            assert( gcry_mpi_get_flag (sk->skey[i], GCRYMPI_FLAG_OPAQUE));
+            p = gcry_mpi_get_opaque( sk->skey[i], &n );
+            iobuf_write (a, p, (n+7)/8);
         }
 	write_16(a, sk->csum );
     }
@@ -451,18 +456,17 @@ do_secret_key( IOBUF out, int ctb, PKT_secret_key *sk )
        the other stuff, so that we know the length of the packet */
     write_header2(out, ctb, iobuf_get_temp_length(a), sk->hdrbytes, 1 );
     /* And finally write it out the real stream */
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a );
 
     iobuf_close(a); /* close the remporary buffer */
     return rc;
 }
 
 static int
-do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc )
+do_symkey_enc( iobuf_t out, int ctb, PKT_symkey_enc *enc )
 {
     int rc = 0;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 
     assert( enc->version == 4 );
     switch( enc->s2k.mode ) {
@@ -482,8 +486,7 @@ do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc )
 	iobuf_write(a, enc->seskey, enc->seskeylen );
 
     write_header(out, ctb, iobuf_get_temp_length(a) );
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a);
 
     iobuf_close(a);
     return rc;
@@ -493,11 +496,11 @@ do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc )
 
 
 static int
-do_pubkey_enc( IOBUF out, int ctb, PKT_pubkey_enc *enc )
+do_pubkey_enc( iobuf_t out, int ctb, PKT_pubkey_enc *enc )
 {
     int rc = 0;
     int n, i;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 
     write_version( a, ctb );
     if( enc->throw_keyid ) {
@@ -516,8 +519,7 @@ do_pubkey_enc( IOBUF out, int ctb, PKT_pubkey_enc *enc )
 	mpi_write(a, enc->data[i] );
 
     write_header(out, ctb, iobuf_get_temp_length(a) );
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a);
 
     iobuf_close(a);
     return rc;
@@ -533,7 +535,7 @@ calc_plaintext( PKT_plaintext *pt )
 }
 
 static int
-do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt )
+do_plaintext( iobuf_t out, int ctb, PKT_plaintext *pt )
 {
     int i, rc = 0;
     u32 n;
@@ -551,15 +553,13 @@ do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt )
     iobuf_put(out, pt->namelen );
     for(i=0; i < pt->namelen; i++ )
 	iobuf_put(out, pt->name[i] );
-    if( write_32(out, pt->timestamp ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = write_32 (out, pt->timestamp);
 
     n = 0;
     while( (nbytes=iobuf_read(pt->buf, buf, 1000)) != -1 ) {
-	if( iobuf_write(out, buf, nbytes) == -1 ) {
-	    rc = G10ERR_WRITE_FILE;
-	    break;
-	}
+        rc = iobuf_write(out, buf, nbytes);
+        if (rc)
+          break;
 	n += nbytes;
     }
     wipememory(buf,1000); /* burn the buffer */
@@ -575,7 +575,7 @@ do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt )
 
 
 static int
-do_encrypted( IOBUF out, int ctb, PKT_encrypted *ed )
+do_encrypted( iobuf_t out, int ctb, PKT_encrypted *ed )
 {
     int rc = 0;
     u32 n;
@@ -589,7 +589,7 @@ do_encrypted( IOBUF out, int ctb, PKT_encrypted *ed )
 }
 
 static int
-do_encrypted_mdc( IOBUF out, int ctb, PKT_encrypted *ed )
+do_encrypted_mdc( iobuf_t out, int ctb, PKT_encrypted *ed )
 {
     int rc = 0;
     u32 n;
@@ -608,7 +608,7 @@ do_encrypted_mdc( IOBUF out, int ctb, PKT_encrypted *ed )
 
 
 static int
-do_compressed( IOBUF out, int ctb, PKT_compressed *cd )
+do_compressed( iobuf_t out, int ctb, PKT_compressed *cd )
 {
     int rc = 0;
 
@@ -816,12 +816,12 @@ build_sig_subpkt (PKT_signature *sig, sigsubpkttype_t type,
         /*log_debug ("updating area for type %d\n", type );*/
     }
     else if (oldarea) {
-        newarea = m_realloc (oldarea, sizeof (*newarea) + n - 1);
+        newarea = xrealloc (oldarea, sizeof (*newarea) + n - 1);
         newarea->size = n;
         /*log_debug ("reallocating area for type %d\n", type );*/
     }
     else {
-        newarea = m_alloc (sizeof (*newarea) + n - 1);
+        newarea = xmalloc (sizeof (*newarea) + n - 1);
         newarea->size = n;
         /*log_debug ("allocating area for type %d\n", type );*/
     }
@@ -922,7 +922,7 @@ build_attribute_subpkt(PKT_user_id *uid,byte type,
 
   /* realloc uid->attrib_data to the right size */
 
-  uid->attrib_data=m_realloc(uid->attrib_data,
+  uid->attrib_data=xrealloc(uid->attrib_data,
 			     uid->attrib_len+idx+1+headerlen+buflen);
 
   attrib=&uid->attrib_data[uid->attrib_len];
@@ -954,11 +954,11 @@ build_attribute_subpkt(PKT_user_id *uid,byte type,
 }
 
 static int
-do_signature( IOBUF out, int ctb, PKT_signature *sig )
+do_signature( iobuf_t out, int ctb, PKT_signature *sig )
 {
     int rc = 0;
     int n, i;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 
     if( !sig->version )
 	iobuf_put( a, 3 );
@@ -1000,8 +1000,7 @@ do_signature( IOBUF out, int ctb, PKT_signature *sig )
 	write_sign_packet_header(out, ctb, iobuf_get_temp_length(a) );
     else
 	write_header(out, ctb, iobuf_get_temp_length(a) );
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a);
 
     iobuf_close(a);
     return rc;
@@ -1009,10 +1008,10 @@ do_signature( IOBUF out, int ctb, PKT_signature *sig )
 
 
 static int
-do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops )
+do_onepass_sig( iobuf_t out, int ctb, PKT_onepass_sig *ops )
 {
     int rc = 0;
-    IOBUF a = iobuf_temp();
+    iobuf_t a = iobuf_temp();
 
     write_version( a, ctb );
     iobuf_put(a, ops->sig_class );
@@ -1023,8 +1022,7 @@ do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops )
     iobuf_put(a, ops->last );
 
     write_header(out, ctb, iobuf_get_temp_length(a) );
-    if( iobuf_write_temp( out, a ) )
-	rc = G10ERR_WRITE_FILE;
+    rc = iobuf_write_temp (out, a);
 
     iobuf_close(a);
     return rc;
@@ -1032,23 +1030,19 @@ do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops )
 
 
 static int
-write_16(IOBUF out, u16 a)
+write_16(iobuf_t out, u16 a)
 {
     iobuf_put(out, a>>8);
-    if( iobuf_put(out,a) )
-	return -1;
-    return 0;
+    return iobuf_put(out,a);
 }
 
 static int
-write_32(IOBUF out, u32 a)
+write_32(iobuf_t out, u32 a)
 {
     iobuf_put(out, a>> 24);
     iobuf_put(out, a>> 16);
     iobuf_put(out, a>> 8);
-    if( iobuf_put(out, a) )
-	return -1;
-    return 0;
+    return iobuf_put (out, a);
 }
 
 
@@ -1081,14 +1075,14 @@ calc_header_length( u32 len, int new_ctb )
  * Write the CTB and the packet length
  */
 static int
-write_header( IOBUF out, int ctb, u32 len )
+write_header( iobuf_t out, int ctb, u32 len )
 {
     return write_header2( out, ctb, len, 0, 1 );
 }
 
 
 static int
-write_sign_packet_header( IOBUF out, int ctb, u32 len )
+write_sign_packet_header( iobuf_t out, int ctb, u32 len )
 {
     /* work around a bug in the pgp read function for signature packets,
      * which are not correctly coded and silently assume at some
@@ -1103,7 +1097,7 @@ write_sign_packet_header( IOBUF out, int ctb, u32 len )
  * we need this, so that we can hash packets without reading them again.
  */
 static int
-write_header2( IOBUF out, int ctb, u32 len, int hdrlen, int blkmode )
+write_header2( iobuf_t out, int ctb, u32 len, int hdrlen, int blkmode )
 {
     if( ctb & 0x40 )
 	return write_new_header( out, ctb, len, hdrlen );
@@ -1149,7 +1143,7 @@ write_header2( IOBUF out, int ctb, u32 len, int hdrlen, int blkmode )
 
 
 static int
-write_new_header( IOBUF out, int ctb, u32 len, int hdrlen )
+write_new_header( iobuf_t out, int ctb, u32 len, int hdrlen )
 {
     if( hdrlen )
 	log_bug("can't cope with hdrlen yet\n");
@@ -1188,7 +1182,7 @@ write_new_header( IOBUF out, int ctb, u32 len, int hdrlen )
 }
 
 static int
-write_version( IOBUF out, int ctb )
+write_version( iobuf_t out, int ctb )
 {
     if( iobuf_put( out, 3 ) )
 	return -1;
diff --git a/g10/call-agent.c b/g10/call-agent.c
index 6cc514dca..e888820cc 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -30,14 +30,21 @@
 #include <unistd.h> 
 #include <time.h>
 #include <assert.h>
-#include <gcrypt.h>
 #ifdef HAVE_LOCALE_H
 #include <locale.h>
 #endif
 #include <assuan.h>
 
 #include "gpg.h"
+#include "util.h"
+#include "membuf.h"
+#include "options.h"
 #include "i18n.h"
+#include "call-agent.h"
+
+#ifndef DBG_ASSUAN
+# define DBG_ASSUAN 1
+#endif
 
 static ASSUAN_CONTEXT agent_ctx = NULL;
 static int force_pipe_server = 0;
@@ -175,7 +182,7 @@ start_agent (void)
       char *optstr;
       if (asprintf (&optstr, "OPTION display=%s",
 		    opt.display ? opt.display : dft_display) < 0)
-	return OUT_OF_CORE (errno);
+	return gpg_error_from_errno (errno);
       rc = assuan_transact (agent_ctx, optstr, NULL, NULL, NULL, NULL, NULL,
 			    NULL);
       free (optstr);
@@ -193,7 +200,7 @@ start_agent (void)
       char *optstr;
       if (asprintf (&optstr, "OPTION ttyname=%s",
 		    opt.ttyname ? opt.ttyname : dft_ttyname) < 0)
-	return OUT_OF_CORE (errno);
+	return gpg_error_from_errno (errno);
       rc = assuan_transact (agent_ctx, optstr, NULL, NULL, NULL, NULL, NULL,
 			    NULL);
       free (optstr);
@@ -206,7 +213,7 @@ start_agent (void)
       char *optstr;
       if (asprintf (&optstr, "OPTION ttytype=%s",
 		    opt.ttyname ? opt.ttytype : dft_ttytype) < 0)
-	return OUT_OF_CORE (errno);
+	return gpg_error_from_errno (errno);
       rc = assuan_transact (agent_ctx, optstr, NULL, NULL, NULL, NULL, NULL,
 			    NULL);
       free (optstr);
@@ -219,7 +226,8 @@ start_agent (void)
     {
       old_lc = strdup (old_lc);
       if (!old_lc)
-        return OUT_OF_CORE (errno);
+        return gpg_error_from_errno (errno);
+
     }
   dft_lc = setlocale (LC_CTYPE, "");
 #endif
@@ -228,7 +236,7 @@ start_agent (void)
       char *optstr;
       if (asprintf (&optstr, "OPTION lc-ctype=%s",
 		    opt.lc_ctype ? opt.lc_ctype : dft_lc) < 0)
-	rc = OUT_OF_CORE (errno);
+	rc = gpg_error_from_errno (errno);
       else
 	{
 	  rc = assuan_transact (agent_ctx, optstr, NULL, NULL, NULL, NULL, NULL,
@@ -253,7 +261,7 @@ start_agent (void)
     {
       old_lc = strdup (old_lc);
       if (!old_lc)
-        return OUT_OF_CORE (errno);
+        return gpg_error_from_errno (errno);
     }
   dft_lc = setlocale (LC_MESSAGES, "");
 #endif
@@ -262,7 +270,7 @@ start_agent (void)
       char *optstr;
       if (asprintf (&optstr, "OPTION lc-messages=%s",
 		    opt.lc_messages ? opt.lc_messages : dft_lc) < 0)
-	rc = OUT_OF_CORE (errno);
+	rc = gpg_error_from_errno (errno);
       else
 	{
 	  rc = assuan_transact (agent_ctx, optstr, NULL, NULL, NULL, NULL, NULL,
diff --git a/g10/cipher.c b/g10/cipher.c
index ab7c9b676..3d51a874a 100644
--- a/g10/cipher.c
+++ b/g10/cipher.c
@@ -1,5 +1,5 @@
 /* cipher.c - En-/De-ciphering filter
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -25,6 +25,7 @@
 #include <errno.h>
 #include <assert.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -40,15 +41,16 @@
 
 
 static void
-write_header( cipher_filter_context_t *cfx, IOBUF a )
+write_header( cipher_filter_context_t *cfx, iobuf_t a )
 {
     PACKET pkt;
     PKT_encrypted ed;
     byte temp[18];
-    unsigned blocksize;
-    unsigned nprefix;
+    unsigned int blocksize;
+    unsigned int nprefix;
+    gpg_error_t rc;
 
-    blocksize = cipher_get_blocksize( cfx->dek->algo );
+    blocksize = gcry_cipher_get_algo_blklen ( cfx->dek->algo );
     if( blocksize < 8 || blocksize > 16 )
 	log_fatal("unsupported blocksize %u\n", blocksize );
 
@@ -58,9 +60,9 @@ write_header( cipher_filter_context_t *cfx, IOBUF a )
     ed.new_ctb = !ed.len && !RFC1991;
     if( cfx->dek->use_mdc ) {
 	ed.mdc_method = DIGEST_ALGO_SHA1;
-	cfx->mdc_hash = md_open( DIGEST_ALGO_SHA1, 0 );
+	gcry_md_open (&cfx->mdc_hash, GCRY_MD_SHA1, 0 );
 	if ( DBG_HASHING )
-	    md_start_debug( cfx->mdc_hash, "creatmdc" );
+	    gcry_md_start_debug ( cfx->mdc_hash, "creatmdc" );
     }
 
     {
@@ -76,21 +78,28 @@ write_header( cipher_filter_context_t *cfx, IOBUF a )
     if( build_packet( a, &pkt ))
 	log_bug("build_packet(ENCR_DATA) failed\n");
     nprefix = blocksize;
-    randomize_buffer( temp, nprefix, 1 );
+    gcry_randomize ( temp, nprefix, GCRY_STRONG_RANDOM);
     temp[nprefix] = temp[nprefix-2];
     temp[nprefix+1] = temp[nprefix-1];
     print_cipher_algo_note( cfx->dek->algo );
-    cfx->cipher_hd = cipher_open( cfx->dek->algo,
-				  cfx->dek->use_mdc? CIPHER_MODE_CFB
-					 : CIPHER_MODE_AUTO_CFB, 1 );
+    rc = gcry_cipher_open (&cfx->cipher_hd, cfx->dek->algo,
+                           GCRY_CIPHER_MODE_CFB,
+                           GCRY_CIPHER_SECURE
+                           | ((cfx->dek->use_mdc || cfx->dek->algo >= 100) ?
+                              0 : GCRY_CIPHER_ENABLE_SYNC));
+    if (rc) {
+	/* we should never get an error here cause we already checked, that
+	 * the algorithm is available. */
+	BUG();
+    }
 /*   log_hexdump( "thekey", cfx->dek->key, cfx->dek->keylen );*/
-    cipher_setkey( cfx->cipher_hd, cfx->dek->key, cfx->dek->keylen );
-    cipher_setiv( cfx->cipher_hd, NULL, 0 );
+    gcry_cipher_setkey( cfx->cipher_hd, cfx->dek->key, cfx->dek->keylen );
+    gcry_cipher_setiv( cfx->cipher_hd, NULL, 0 );
 /*  log_hexdump( "prefix", temp, nprefix+2 ); */
     if( cfx->mdc_hash ) /* hash the "IV" */
-	md_write( cfx->mdc_hash, temp, nprefix+2 );
-    cipher_encrypt( cfx->cipher_hd, temp, temp, nprefix+2);
-    cipher_sync( cfx->cipher_hd );
+	gcry_md_write( cfx->mdc_hash, temp, nprefix+2 );
+    gcry_cipher_encrypt( cfx->cipher_hd, temp, nprefix+2, NULL, 0);
+    gcry_cipher_sync( cfx->cipher_hd );
     iobuf_write(a, temp, nprefix+2);
     cfx->header=1;
 }
@@ -102,7 +111,7 @@ write_header( cipher_filter_context_t *cfx, IOBUF a )
  */
 int
 cipher_filter( void *opaque, int control,
-	       IOBUF a, byte *buf, size_t *ret_len)
+	       iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     cipher_filter_context_t *cfx = opaque;
@@ -117,36 +126,40 @@ cipher_filter( void *opaque, int control,
 	    write_header( cfx, a );
 	}
 	if( cfx->mdc_hash )
-	    md_write( cfx->mdc_hash, buf, size );
-	cipher_encrypt( cfx->cipher_hd, buf, buf, size);
-	if( iobuf_write( a, buf, size ) )
-	    rc = G10ERR_WRITE_FILE;
+	    gcry_md_write( cfx->mdc_hash, buf, size );
+	gcry_cipher_encrypt( cfx->cipher_hd, buf, size, NULL, 0);
+	rc = iobuf_write( a, buf, size );
     }
     else if( control == IOBUFCTRL_FREE ) {
 	if( cfx->mdc_hash ) {
 	    byte *hash;
-	    int hashlen = md_digest_length( md_get_algo( cfx->mdc_hash ) );
+	    int hashlen = gcry_md_get_algo_dlen (gcry_md_get_algo (
+                                                            cfx->mdc_hash));
 	    byte temp[22];
 
 	    assert( hashlen == 20 );
 	    /* we must hash the prefix of the MDC packet here */
 	    temp[0] = 0xd3;
 	    temp[1] = 0x14;
-	    md_putc( cfx->mdc_hash, temp[0] );
-	    md_putc( cfx->mdc_hash, temp[1] );
+	    gcry_md_putc ( cfx->mdc_hash, temp[0] );
+	    gcry_md_putc ( cfx->mdc_hash, temp[1] );
 
-	    md_final( cfx->mdc_hash );
-	    hash = md_read( cfx->mdc_hash, 0 );
+	    gcry_md_final ( cfx->mdc_hash );
+	    hash = gcry_md_read ( cfx->mdc_hash, 0 );
 	    memcpy(temp+2, hash, 20);
-	    cipher_encrypt( cfx->cipher_hd, temp, temp, 22 );
-	    md_close( cfx->mdc_hash ); cfx->mdc_hash = NULL;
-	    if( iobuf_write( a, temp, 22 ) )
+	    gcry_cipher_encrypt( cfx->cipher_hd, temp, 22, NULL, 0 );
+	    gcry_md_close ( cfx->mdc_hash ); cfx->mdc_hash = NULL;
+	    rc = iobuf_write( a, temp, 22 );
+            if (rc)
 		log_error("writing MDC packet failed\n" );
 	}
-	cipher_close(cfx->cipher_hd);
+	gcry_cipher_close (cfx->cipher_hd);
     }
     else if( control == IOBUFCTRL_DESC ) {
 	*(char**)buf = "cipher_filter";
     }
     return rc;
 }
+
+
+
diff --git a/g10/comment.c b/g10/comment.c
index 6d27e481b..3108351e4 100644
--- a/g10/comment.c
+++ b/g10/comment.c
@@ -1,5 +1,5 @@
 /* comment.c - write comment stuff
- *	Copyright (C) 1998 Free Software Foundation, Inc.
+ *	Copyright (C) 1998, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -37,7 +37,7 @@
 
 
 int
-write_comment( IOBUF out, const char *s )
+write_comment( iobuf_t out, const char *s )
 {
     PACKET pkt;
     size_t n = strlen(s);
@@ -45,18 +45,18 @@ write_comment( IOBUF out, const char *s )
 
     pkt.pkttype = PKT_COMMENT;
     if( *s != '#' ) {
-       pkt.pkt.comment = m_alloc( sizeof *pkt.pkt.comment + n );
+       pkt.pkt.comment = xmalloc ( sizeof *pkt.pkt.comment + n );
        pkt.pkt.comment->len = n+1;
        *pkt.pkt.comment->data = '#';
        strcpy(pkt.pkt.comment->data+1, s);
     }
     else {
-       pkt.pkt.comment = m_alloc( sizeof *pkt.pkt.comment + n - 1 );
+       pkt.pkt.comment = xmalloc ( sizeof *pkt.pkt.comment + n - 1 );
        pkt.pkt.comment->len = n;
        strcpy(pkt.pkt.comment->data, s);
     }
     if( (rc = build_packet( out, &pkt )) )
-	log_error("build_packet(comment) failed: %s\n", g10_errstr(rc) );
+	log_error("build_packet(comment) failed: %s\n", gpg_strerror (rc) );
     free_packet( &pkt );
     return rc;
 }
@@ -68,9 +68,9 @@ make_comment_node( const char *s )
     PACKET *pkt;
     size_t n = strlen(s);
 
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_COMMENT;
-    pkt->pkt.comment = m_alloc( sizeof *pkt->pkt.comment + n - 1 );
+    pkt->pkt.comment = xmalloc ( sizeof *pkt->pkt.comment + n - 1 );
     pkt->pkt.comment->len = n;
     strcpy(pkt->pkt.comment->data, s);
     return new_kbnode( pkt );
@@ -78,25 +78,29 @@ make_comment_node( const char *s )
 
 
 KBNODE
-make_mpi_comment_node( const char *s, MPI a )
+make_mpi_comment_node( const char *s, gcry_mpi_t a )
 {
     PACKET *pkt;
-    byte *buf, *p, *pp;
-    unsigned n1, nb1;
+    byte *buf, *pp;
+    size_t n1, nb1;
     size_t n = strlen(s);
 
     nb1 = mpi_get_nbits( a );
-    p = buf = mpi_get_buffer( a, &n1, NULL );
-    pkt = m_alloc_clear( sizeof *pkt );
+    if (gcry_mpi_print (GCRYMPI_FMT_PGP, NULL, &n1, a))
+      BUG ();
+    /* fixme: allocate it on the stack */
+    buf = xmalloc (n1);
+    if (gcry_mpi_print (GCRYMPI_FMT_PGP, buf, &n1, a))
+      BUG ();
+
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_COMMENT;
-    pkt->pkt.comment = m_alloc( sizeof *pkt->pkt.comment + n + 2 + n1 );
+    pkt->pkt.comment = xmalloc ( sizeof *pkt->pkt.comment + n + 2 + n1 );
     pkt->pkt.comment->len = n+1+2+n1;
     pp = pkt->pkt.comment->data;
     memcpy(pp, s, n+1);
-    pp[n+1] = nb1 >> 8;
-    pp[n+2] = nb1 ;
-    memcpy(pp+n+3, p, n1 );
-    m_free(buf);
+    memcpy(pp+n+1, buf, n1 );
+    xfree (buf);
     return new_kbnode( pkt );
 }
 
diff --git a/g10/compress.c b/g10/compress.c
index 8d9327cc3..7dce1790a 100644
--- a/g10/compress.c
+++ b/g10/compress.c
@@ -1,5 +1,6 @@
 /* compress.c - compress filter
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -30,6 +31,7 @@
 # include "zlib-riscos.h"
 #endif
 
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "packet.h"
@@ -73,12 +75,13 @@ init_compress( compress_filter_context_t *zfx, z_stream *zs )
     }
 
     zfx->outbufsize = 8192;
-    zfx->outbuf = m_alloc( zfx->outbufsize );
+    zfx->outbuf = xmalloc ( zfx->outbufsize );
 }
 
 static int
-do_compress( compress_filter_context_t *zfx, z_stream *zs, int flush, IOBUF a )
+do_compress( compress_filter_context_t *zfx, z_stream *zs, int flush, iobuf_t a )
 {
+    gpg_error_t rc;
     int zrc;
     unsigned n;
 
@@ -108,10 +111,12 @@ do_compress( compress_filter_context_t *zfx, z_stream *zs, int flush, IOBUF a )
 		(unsigned)zs->avail_in, (unsigned)zs->avail_out,
 					       (unsigned)n, zrc );
 
-	if( iobuf_write( a, zfx->outbuf, n ) ) {
+	rc = iobuf_write (a, zfx->outbuf, n);
+        if (rc)
+          {
 	    log_debug("deflate: iobuf_write failed\n");
-	    return G10ERR_WRITE_FILE;
-	}
+	    return rc;
+          }
     } while( zs->avail_in || (flush == Z_FINISH && zrc != Z_STREAM_END) );
     return 0;
 }
@@ -140,13 +145,13 @@ init_uncompress( compress_filter_context_t *zfx, z_stream *zs )
     }
 
     zfx->inbufsize = 2048;
-    zfx->inbuf = m_alloc( zfx->inbufsize );
+    zfx->inbuf = xmalloc ( zfx->inbufsize );
     zs->avail_in = 0;
 }
 
 static int
 do_uncompress( compress_filter_context_t *zfx, z_stream *zs,
-	       IOBUF a, size_t *ret_len )
+	       iobuf_t a, size_t *ret_len )
 {
     int zrc;
     int rc=0;
@@ -210,7 +215,7 @@ do_uncompress( compress_filter_context_t *zfx, z_stream *zs,
 
 int
 compress_filter( void *opaque, int control,
-		 IOBUF a, byte *buf, size_t *ret_len)
+		 iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     compress_filter_context_t *zfx = opaque;
@@ -219,7 +224,7 @@ compress_filter( void *opaque, int control,
 
     if( control == IOBUFCTRL_UNDERFLOW ) {
 	if( !zfx->status ) {
-	    zs = zfx->opaque = m_alloc_clear( sizeof *zs );
+	    zs = zfx->opaque = xcalloc (1, sizeof *zs );
 	    init_uncompress( zfx, zs );
 	    zfx->status = 1;
 	}
@@ -250,7 +255,7 @@ compress_filter( void *opaque, int control,
 	    pkt.pkt.compressed = &cd;
 	    if( build_packet( a, &pkt ))
 		log_bug("build_packet(PKT_COMPRESSED) failed\n");
-	    zs = zfx->opaque = m_alloc_clear( sizeof *zs );
+	    zs = zfx->opaque = xcalloc (1, sizeof *zs );
 	    init_compress( zfx, zs );
 	    zfx->status = 2;
 	}
@@ -266,9 +271,9 @@ compress_filter( void *opaque, int control,
     else if( control == IOBUFCTRL_FREE ) {
 	if( zfx->status == 1 ) {
 	    inflateEnd(zs);
-	    m_free(zs);
+	    xfree (zs);
 	    zfx->opaque = NULL;
-	    m_free(zfx->outbuf); zfx->outbuf = NULL;
+	    xfree (zfx->outbuf); zfx->outbuf = NULL;
 	}
 	else if( zfx->status == 2 ) {
 #ifndef __riscos__
@@ -279,9 +284,9 @@ compress_filter( void *opaque, int control,
 	    zs->avail_in = 0;
 	    do_compress( zfx, zs, Z_FINISH, a );
 	    deflateEnd(zs);
-	    m_free(zs);
+	    xfree (zs);
 	    zfx->opaque = NULL;
-	    m_free(zfx->outbuf); zfx->outbuf = NULL;
+	    xfree (zfx->outbuf); zfx->outbuf = NULL;
 	}
         if (zfx->release)
           zfx->release (zfx);
@@ -295,7 +300,7 @@ compress_filter( void *opaque, int control,
 static void
 release_context (compress_filter_context_t *ctx)
 {
-  m_free (ctx);
+  xfree (ctx);
 }
 
 /****************
@@ -303,14 +308,14 @@ release_context (compress_filter_context_t *ctx)
  */
 int
 handle_compressed( void *procctx, PKT_compressed *cd,
-		   int (*callback)(IOBUF, void *), void *passthru )
+		   int (*callback)(iobuf_t, void *), void *passthru )
 {
     compress_filter_context_t *cfx;
     int rc;
 
     if( cd->algorithm < 1 || cd->algorithm > 2	)
-	return G10ERR_COMPR_ALGO;
-    cfx = m_alloc_clear (sizeof *cfx);
+	return GPG_ERR_COMPR_ALGO;
+    cfx = xcalloc (1,sizeof *cfx);
     cfx->algo = cd->algorithm;
     cfx->release = release_context;
     iobuf_push_filter( cd->buf, compress_filter, cfx );
diff --git a/g10/dearmor.c b/g10/dearmor.c
index 4ec8fa012..4f9fa2db7 100644
--- a/g10/dearmor.c
+++ b/g10/dearmor.c
@@ -1,5 +1,5 @@
 /* dearmor.c - Armor utility
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -25,6 +25,7 @@
 #include <errno.h>
 #include <assert.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -42,7 +43,7 @@ int
 dearmor_file( const char *fname )
 {
     armor_filter_context_t afx;
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     int rc = 0;
     int c;
 
@@ -50,9 +51,9 @@ dearmor_file( const char *fname )
 
     /* prepare iobufs */
     if( !(inp = iobuf_open(fname)) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("can't open %s: %s\n", fname? fname: "[stdin]",
 					strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
 
@@ -84,7 +85,7 @@ int
 enarmor_file( const char *fname )
 {
     armor_filter_context_t afx;
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     int rc = 0;
     int c;
 
@@ -92,9 +93,9 @@ enarmor_file( const char *fname )
 
     /* prepare iobufs */
     if( !(inp = iobuf_open(fname)) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("can't open %s: %s\n", fname? fname: "[stdin]",
 					strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
 
diff --git a/g10/decrypt.c b/g10/decrypt.c
index df778d1ad..98a270cfb 100644
--- a/g10/decrypt.c
+++ b/g10/decrypt.c
@@ -49,7 +49,7 @@
 int
 decrypt_message( const char *filename )
 {
-    IOBUF fp;
+    iobuf_t fp;
     armor_filter_context_t afx;
     progress_filter_context_t pfx;
     int rc;
@@ -58,8 +58,9 @@ decrypt_message( const char *filename )
     /* open the message file */
     fp = iobuf_open(filename);
     if( !fp ) {
+        rc = gpg_error_from_errno (errno);
 	log_error(_("can't open `%s'\n"), print_fname_stdin(filename));
-	return G10ERR_OPEN_FILE;
+	return rc;
     }
 
     handle_progress (&pfx, fp, filename);
@@ -85,7 +86,7 @@ decrypt_message( const char *filename )
 void
 decrypt_messages(int nfiles, char **files)
 {
-  IOBUF fp;
+  iobuf_t fp;
   armor_filter_context_t afx;  
   progress_filter_context_t pfx;
   char *p, *output = NULL;
@@ -125,15 +126,15 @@ decrypt_messages(int nfiles, char **files)
       iobuf_close(fp);
       if (rc)
         log_error("%s: decryption failed: %s\n", print_fname_stdin(*files),
-                  g10_errstr(rc));
+                  gpg_strerror (rc));
       p = get_last_passphrase();
       set_next_passphrase(p);
-      m_free (p);
+      xfree (p);
 
     next_file:
       /* Note that we emit file_done even after an error. */
       write_status( STATUS_FILE_DONE );
-      m_free(output);
+      xfree (output);
       files++;
     }
   set_next_passphrase(NULL);  
diff --git a/g10/delkey.c b/g10/delkey.c
index 35c903cc0..34a2e1b32 100644
--- a/g10/delkey.c
+++ b/g10/delkey.c
@@ -68,9 +68,9 @@ do_delete_key( const char *username, int secret, int *r_sec_avail )
     exactmatch = (desc.mode == KEYDB_SEARCH_MODE_FPR
                   || desc.mode == KEYDB_SEARCH_MODE_FPR16
                   || desc.mode == KEYDB_SEARCH_MODE_FPR20);
-    rc = desc.mode? keydb_search (hd, &desc, 1):G10ERR_INV_USER_ID;
+    rc = desc.mode? keydb_search (hd, &desc, 1):GPG_ERR_INV_USER_ID;
     if (rc) {
-	log_error (_("key `%s' not found: %s\n"), username, g10_errstr (rc));
+	log_error (_("key `%s' not found: %s\n"), username, gpg_strerror (rc));
 	write_status_text( STATUS_DELETE_PROBLEM, "1" );
 	goto leave;
     }
@@ -78,7 +78,7 @@ do_delete_key( const char *username, int secret, int *r_sec_avail )
     /* read the keyblock */
     rc = keydb_get_keyblock (hd, &keyblock );
     if (rc) {
-	log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
+	log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
 	goto leave;
     }
 
@@ -86,7 +86,7 @@ do_delete_key( const char *username, int secret, int *r_sec_avail )
     node = find_kbnode( keyblock, secret? PKT_SECRET_KEY:PKT_PUBLIC_KEY );
     if( !node ) {
 	log_error("Oops; key not found anymore!\n");
-	rc = G10ERR_GENERAL;
+	rc = GPG_ERR_GENERAL;
 	goto leave;
     }
 
@@ -103,8 +103,8 @@ do_delete_key( const char *username, int secret, int *r_sec_avail )
             rc = -1;
             goto leave;
 	}
-	else if( rc != G10ERR_NO_SECKEY ) {
-	    log_error("%s: get secret key: %s\n", username, g10_errstr(rc) );
+	else if( rc != GPG_ERR_NO_SECKEY ) {
+	    log_error("%s: get secret key: %s\n", username, gpg_strerror (rc) );
 	}
 	else
 	    rc = 0;
@@ -153,7 +153,7 @@ do_delete_key( const char *username, int secret, int *r_sec_avail )
     if( okay ) {
 	rc = keydb_delete_keyblock (hd);
 	if (rc) {
-	    log_error (_("deleting keyblock failed: %s\n"), g10_errstr(rc) );
+	    log_error (_("deleting keyblock failed: %s\n"), gpg_strerror (rc) );
 	    goto leave;
 	}
 
@@ -200,7 +200,7 @@ delete_keys( STRLIST names, int secret, int allow_both )
        }
 
        if(rc) {
-	 log_error("%s: delete key failed: %s\n", names->d, g10_errstr(rc) );
+	 log_error("%s: delete key failed: %s\n", names->d, gpg_strerror (rc) );
 	 return rc;
        }
     }
diff --git a/g10/encode.c b/g10/encode.c
index 66ce57c35..ba40c0aef 100644
--- a/g10/encode.c
+++ b/g10/encode.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <assert.h>
 
+#include "gpg.h"
 #include "options.h"
 #include "packet.h"
 #include "errors.h"
@@ -38,9 +39,11 @@
 #include "trustdb.h"
 #include "i18n.h"
 #include "status.h"
+#include "pkglue.h"
+
 
 static int encode_simple( const char *filename, int mode, int compat );
-static int write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out );
+static int write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, iobuf_t out );
 
 
 
@@ -77,13 +80,14 @@ encode_store( const char *filename )
 static void
 encode_sesskey( DEK *dek, DEK **ret_dek, byte *enckey )
 {
+#warning This functions needs a review.
     CIPHER_HANDLE hd;
     DEK *c;
     byte buf[33];
 
     assert ( dek->keylen < 32 );
     
-    c = m_alloc_clear( sizeof *c );
+    c = xcalloc (1, sizeof *c );
     c->keylen = dek->keylen;
     c->algo = dek->algo;
     make_session_key( c );
@@ -92,11 +96,12 @@ encode_sesskey( DEK *dek, DEK **ret_dek, byte *enckey )
     buf[0] = c->algo;
     memcpy( buf + 1, c->key, c->keylen );
     
-    hd = cipher_open( dek->algo, CIPHER_MODE_CFB, 1 );
-    cipher_setkey( hd, dek->key, dek->keylen );
-    cipher_setiv( hd, NULL, 0 );
-    cipher_encrypt( hd, buf, buf, c->keylen + 1 );
-    cipher_close( hd );
+
+    gcry_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1 );
+    gcry_cipher_setkey( hd, dek->key, dek->keylen );
+    gcry_cipher_setiv( hd, NULL, 0 );
+    gcry_cipher_encrypt( hd, buf, c->keylen + 1, NULL, 0 );
+    gcry_cipher_close( hd );
 
     memcpy( enckey, buf, c->keylen + 1 );
     wipememory( buf, sizeof buf ); /* burn key */
@@ -143,7 +148,7 @@ use_mdc(PK_LIST pk_list,int algo)
 
   /* Last try.  Use MDC for the modern ciphers. */
 
-  if(cipher_get_blocksize(algo)!=8)
+  if( gcry_cipher_get_algo_blklen (algo) != 8)
     return 1;
 
   return 0; /* No MDC */
@@ -152,7 +157,7 @@ use_mdc(PK_LIST pk_list,int algo)
 static int
 encode_simple( const char *filename, int mode, int compat )
 {
-    IOBUF inp, out;
+    iobuf_t inp, out;
     PACKET pkt;
     DEK *dek = NULL;
     PKT_plaintext *pt = NULL;
@@ -176,9 +181,10 @@ encode_simple( const char *filename, int mode, int compat )
     
     /* prepare iobufs */
     if( !(inp = iobuf_open(filename)) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error(_("%s: can't open: %s\n"), filename? filename: "[stdin]",
 					strerror(errno) );
-	return G10ERR_OPEN_FILE;
+	return rc;
     }
 
     handle_progress (&pfx, inp, filename);
@@ -194,18 +200,18 @@ encode_simple( const char *filename, int mode, int compat )
     
     cfx.dek = NULL;
     if( mode ) {
-	s2k = m_alloc_clear( sizeof *s2k );
+	s2k = xcalloc (1, sizeof *s2k );
 	s2k->mode = RFC1991? 0:opt.s2k_mode;
 	s2k->hash_algo = opt.s2k_digest_algo;
 	cfx.dek = passphrase_to_dek( NULL, 0,
 				     default_cipher_algo(), s2k, 2,
                                      NULL, NULL);
 	if( !cfx.dek || !cfx.dek->keylen ) {
-	    rc = G10ERR_PASSPHRASE;
-	    m_free(cfx.dek);
-	    m_free(s2k);
+            rc = gpg_error (GPG_ERR_INV_PASSPHRASE);
+	    xfree (cfx.dek);
+	    xfree (s2k);
 	    iobuf_close(inp);
-	    log_error(_("error creating passphrase: %s\n"), g10_errstr(rc) );
+	    log_error(_("error creating passphrase: %s\n"), gpg_strerror (rc) );
 	    return rc;
 	}
         if (!compat && s2k->mode != 1 && s2k->mode != 3) {
@@ -215,9 +221,9 @@ encode_simple( const char *filename, int mode, int compat )
         }
 
         if ( !compat ) {            
-            seskeylen = cipher_get_keylen( default_cipher_algo() ) / 8;
+            seskeylen = gcry_cipher_get_algo_keylen (default_cipher_algo());
             encode_sesskey( cfx.dek, &dek, enckey );
-            m_free( cfx.dek ); cfx.dek = dek;
+            xfree (cfx.dek); cfx.dek = dek;
         }
 
 	cfx.dek->use_mdc=use_mdc(NULL,cfx.dek->algo);
@@ -233,8 +239,8 @@ encode_simple( const char *filename, int mode, int compat )
 
     if( rc || (rc = open_outfile( filename, opt.armor? 1:0, &out )) ) {
 	iobuf_cancel(inp);
-	m_free(cfx.dek);
-	m_free(s2k);
+	xfree (cfx.dek);
+	xfree (s2k);
 	return rc;
     }
 
@@ -249,7 +255,7 @@ encode_simple( const char *filename, int mode, int compat )
     }
 #endif
     if( s2k && !RFC1991 ) {
-	PKT_symkey_enc *enc = m_alloc_clear( sizeof *enc + seskeylen + 1 );
+	PKT_symkey_enc *enc = xcalloc (1, sizeof *enc + seskeylen + 1 );
 	enc->version = 4;
 	enc->cipher_algo = cfx.dek->algo;
 	enc->s2k = *s2k;
@@ -260,23 +266,25 @@ encode_simple( const char *filename, int mode, int compat )
 	pkt.pkttype = PKT_SYMKEY_ENC;
 	pkt.pkt.symkey_enc = enc;
 	if( (rc = build_packet( out, &pkt )) )
-	    log_error("build symkey packet failed: %s\n", g10_errstr(rc) );
-	m_free(enc);
+	    log_error("build symkey packet failed: %s\n", gpg_strerror (rc) );
+	xfree (enc);
     }
 
     if (!opt.no_literal) {
 	/* setup the inner packet */
 	if( filename || opt.set_filename ) {
-	    char *s = make_basename( opt.set_filename ? opt.set_filename
-						      : filename,
-				     iobuf_get_real_fname( inp ) );
-	    pt = m_alloc( sizeof *pt + strlen(s) - 1 );
+	    char *s = make_basename ( opt.set_filename ? opt.set_filename
+						      : filename
+                                      /* for riscos?
+                                         .iobuf_get_real_fname( inp ) */
+                                      );
+	    pt = xmalloc ( sizeof *pt + strlen(s) - 1 );
 	    pt->namelen = strlen(s);
 	    memcpy(pt->name, s, pt->namelen );
-	    m_free(s);
+	    xfree (s);
 	}
 	else { /* no filename */
-	    pt = m_alloc( sizeof *pt - 1 );
+	    pt = xmalloc ( sizeof *pt - 1 );
 	    pt->namelen = 0;
 	}
     }
@@ -342,7 +350,7 @@ encode_simple( const char *filename, int mode, int compat )
     /* do the work */
     if (!opt.no_literal) {
 	if( (rc = build_packet( out, &pkt )) )
-	    log_error("build_packet failed: %s\n", g10_errstr(rc) );
+	    log_error("build_packet failed: %s\n", gpg_strerror (rc) );
     }
     else {
 	/* user requested not to create a literal packet,
@@ -350,9 +358,8 @@ encode_simple( const char *filename, int mode, int compat )
 	byte copy_buffer[4096];
 	int  bytes_copied;
 	while ((bytes_copied = iobuf_read(inp, copy_buffer, 4096)) != -1)
-	    if (iobuf_write(out, copy_buffer, bytes_copied) == -1) {
-		rc = G10ERR_WRITE_FILE;
-		log_error("copying input to output failed: %s\n", g10_errstr(rc) );
+	    if ( (rc=iobuf_write(out, copy_buffer, bytes_copied))) {
+		log_error("copying input to output failed: %s\n", gpg_strerror (rc) );
 		break;
 	    }
 	wipememory(copy_buffer, 4096); /* burn buffer */
@@ -370,8 +377,8 @@ encode_simple( const char *filename, int mode, int compat )
     if (pt)
 	pt->buf = NULL;
     free_packet(&pkt);
-    m_free(cfx.dek);
-    m_free(s2k);
+    xfree (cfx.dek);
+    xfree (s2k);
     return rc;
 }
 
@@ -382,7 +389,7 @@ encode_simple( const char *filename, int mode, int compat )
 int
 encode_crypt( const char *filename, STRLIST remusr )
 {
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     PACKET pkt;
     PKT_plaintext *pt = NULL;
     int rc = 0, rc2 = 0;
@@ -419,9 +426,9 @@ encode_crypt( const char *filename, STRLIST remusr )
 
     /* prepare iobufs */
     if( !(inp = iobuf_open(filename)) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error(_("can't open %s: %s\n"), filename? filename: "[stdin]",
 					strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
     else if( opt.verbose )
@@ -447,7 +454,7 @@ encode_crypt( const char *filename, STRLIST remusr )
     }
 #endif
     /* create a session key */
-    cfx.dek = m_alloc_secure_clear (sizeof *cfx.dek);
+    cfx.dek = xcalloc_secure (1, sizeof *cfx.dek);
     if( !opt.def_cipher_algo ) { /* try to get it from the prefs */
 	cfx.dek->algo = select_algo_from_prefs(pk_list,PREFTYPE_SYM,-1,NULL);
 	/* The only way select_algo_from_prefs can fail here is when
@@ -473,7 +480,7 @@ encode_crypt( const char *filename, STRLIST remusr )
 				opt.def_cipher_algo,NULL)!=opt.def_cipher_algo)
 	log_info(_("forcing symmetric cipher %s (%d) "
 		   "violates recipient preferences\n"),
-		 cipher_algo_to_string(opt.def_cipher_algo),
+		 gcry_cipher_algo_name (opt.def_cipher_algo),
 		 opt.def_cipher_algo);
 
       cfx.dek->algo = opt.def_cipher_algo;
@@ -501,7 +508,7 @@ encode_crypt( const char *filename, STRLIST remusr )
 
     make_session_key( cfx.dek );
     if( DBG_CIPHER )
-	log_hexdump("DEK is: ", cfx.dek->key, cfx.dek->keylen );
+	log_printhex ("DEK is: ", cfx.dek->key, cfx.dek->keylen );
 
     rc = write_pubkey_enc_from_list( pk_list, cfx.dek, out );
     if( rc  )
@@ -511,15 +518,15 @@ encode_crypt( const char *filename, STRLIST remusr )
 	/* setup the inner packet */
 	if( filename || opt.set_filename ) {
 	    char *s = make_basename( opt.set_filename ? opt.set_filename
-						      : filename,
-				     iobuf_get_real_fname( inp ) );
-	    pt = m_alloc( sizeof *pt + strlen(s) - 1 );
+						      : filename
+				     /* ,iobuf_get_real_fname( inp )*/ );
+	    pt = xmalloc ( sizeof *pt + strlen(s) - 1 );
 	    pt->namelen = strlen(s);
 	    memcpy(pt->name, s, pt->namelen );
-	    m_free(s);
+	    xfree (s);
 	}
 	else { /* no filename */
-	    pt = m_alloc( sizeof *pt - 1 );
+	    pt = xmalloc ( sizeof *pt - 1 );
 	    pt->namelen = 0;
 	}
     }
@@ -590,7 +597,7 @@ encode_crypt( const char *filename, STRLIST remusr )
     /* do the work */
     if (!opt.no_literal) {
 	if( (rc = build_packet( out, &pkt )) )
-	    log_error("build_packet failed: %s\n", g10_errstr(rc) );
+	    log_error("build_packet failed: %s\n", gpg_strerror (rc) );
     }
     else {
 	/* user requested not to create a literal packet, so we copy
@@ -598,10 +605,9 @@ encode_crypt( const char *filename, STRLIST remusr )
 	byte copy_buffer[4096];
 	int  bytes_copied;
 	while ((bytes_copied = iobuf_read(inp, copy_buffer, 4096)) != -1)
-	    if (iobuf_write(out, copy_buffer, bytes_copied) == -1) {
-		rc = G10ERR_WRITE_FILE;
+	    if ((rc=iobuf_write(out, copy_buffer, bytes_copied))) {
 		log_error("copying input to output failed: %s\n",
-                          g10_errstr(rc) );
+                          gpg_strerror (rc) );
 		break;
 	    }
 	wipememory(copy_buffer, 4096); /* burn buffer */
@@ -619,7 +625,7 @@ encode_crypt( const char *filename, STRLIST remusr )
     if( pt )
 	pt->buf = NULL;
     free_packet(&pkt);
-    m_free(cfx.dek);
+    xfree (cfx.dek);
     release_pk_list( pk_list );
     return rc;
 }
@@ -632,7 +638,7 @@ encode_crypt( const char *filename, STRLIST remusr )
  */
 int
 encrypt_filter( void *opaque, int control,
-	       IOBUF a, byte *buf, size_t *ret_len)
+	       iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     encrypt_filter_context_t *efx = opaque;
@@ -643,7 +649,7 @@ encrypt_filter( void *opaque, int control,
     }
     else if( control == IOBUFCTRL_FLUSH ) { /* encrypt */
 	if( !efx->header_okay ) {
-	    efx->cfx.dek = m_alloc_secure_clear( sizeof *efx->cfx.dek );
+	    efx->cfx.dek = xcalloc_secure (1, sizeof *efx->cfx.dek );
 
 	    if( !opt.def_cipher_algo  ) { /* try to get it from the prefs */
 		efx->cfx.dek->algo =
@@ -661,7 +667,7 @@ encrypt_filter( void *opaque, int control,
 					NULL)!=opt.def_cipher_algo)
 		log_info(_("forcing symmetric cipher %s (%d) "
 			   "violates recipient preferences\n"),
-			 cipher_algo_to_string(opt.def_cipher_algo),
+			 gcry_cipher_algo_name (opt.def_cipher_algo),
 			 opt.def_cipher_algo);
 
 	      efx->cfx.dek->algo = opt.def_cipher_algo;
@@ -671,8 +677,8 @@ encrypt_filter( void *opaque, int control,
 
 	    make_session_key( efx->cfx.dek );
 	    if( DBG_CIPHER )
-		log_hexdump("DEK is: ",
-			     efx->cfx.dek->key, efx->cfx.dek->keylen );
+		log_printhex ("DEK is: ",
+                              efx->cfx.dek->key, efx->cfx.dek->keylen );
 
 	    rc = write_pubkey_enc_from_list( efx->pk_list, efx->cfx.dek, a );
 	    if( rc )
@@ -698,7 +704,7 @@ encrypt_filter( void *opaque, int control,
  * Write pubkey-enc packets from the list of PKs to OUT.
  */
 static int
-write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out )
+write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, iobuf_t out )
 {
     PACKET pkt;
     PKT_public_key *pk;
@@ -706,12 +712,12 @@ write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out )
     int rc;
 
     for( ; pk_list; pk_list = pk_list->next ) {
-	MPI frame;
+	gcry_mpi_t frame;
 
 	pk = pk_list->pk;
 
 	print_pubkey_algo_note( pk->pubkey_algo );
-	enc = m_alloc_clear( sizeof *enc );
+	enc = xcalloc (1, sizeof *enc );
 	enc->pubkey_algo = pk->pubkey_algo;
 	keyid_from_pk( pk, enc->keyid );
 	enc->throw_keyid = (opt.throw_keyid || (pk_list->flags&1));
@@ -738,17 +744,17 @@ write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out )
 	 */
 	frame = encode_session_key( dek, pubkey_nbits( pk->pubkey_algo,
 							  pk->pkey ) );
-	rc = pubkey_encrypt( pk->pubkey_algo, enc->data, frame, pk->pkey );
-	mpi_free( frame );
+	rc = pk_encrypt( pk->pubkey_algo, enc->data, frame, pk->pkey );
+	gcry_mpi_release ( frame );
 	if( rc )
-	    log_error("pubkey_encrypt failed: %s\n", g10_errstr(rc) );
+	    log_error("pubkey_encrypt failed: %s\n", gpg_strerror (rc) );
 	else {
 	    if( opt.verbose ) {
 		char *ustr = get_user_id_string_printable (enc->keyid);
 		log_info(_("%s/%s encrypted for: \"%s\"\n"),
-		    pubkey_algo_to_string(enc->pubkey_algo),
-		    cipher_algo_to_string(dek->algo), ustr );
-		m_free(ustr);
+		    gcry_pk_algo_name (enc->pubkey_algo),
+		    gcry_cipher_algo_name (dek->algo), ustr );
+		xfree (ustr);
 	    }
 	    /* and write it */
 	    init_packet(&pkt);
@@ -756,7 +762,7 @@ write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, IOBUF out )
 	    pkt.pkt.pubkey_enc = enc;
 	    rc = build_packet( out, &pkt );
 	    if( rc )
-	       log_error("build_packet(pubkey_enc) failed: %s\n", g10_errstr(rc));
+	       log_error("build_packet(pubkey_enc) failed: %s\n", gpg_strerror (rc));
 	}
 	free_pubkey_enc(enc);
 	if( rc )
@@ -792,7 +798,7 @@ encode_crypt_files(int nfiles, char **files, STRLIST remusr)
           print_file_status(STATUS_FILE_START, line, 2);
           if ( (rc = encode_crypt(line, remusr)) )
             log_error("%s: encryption failed: %s\n",
-                      print_fname_stdin(line), g10_errstr(rc) );
+                      print_fname_stdin(line), gpg_strerror (rc) );
           write_status( STATUS_FILE_DONE );
         }
     }
@@ -803,7 +809,7 @@ encode_crypt_files(int nfiles, char **files, STRLIST remusr)
           print_file_status(STATUS_FILE_START, *files, 2);
           if ( (rc = encode_crypt(*files, remusr)) )
             log_error("%s: encryption failed: %s\n",
-                      print_fname_stdin(*files), g10_errstr(rc) );
+                      print_fname_stdin(*files), gpg_strerror (rc) );
           write_status( STATUS_FILE_DONE );
           files++;
         }
diff --git a/g10/encr-data.c b/g10/encr-data.c
index c8a8c85db..074408404 100644
--- a/g10/encr-data.c
+++ b/g10/encr-data.c
@@ -1,5 +1,5 @@
 /* encr-data.c -  process an encrypted data packet
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,6 +23,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "packet.h"
@@ -32,9 +34,9 @@
 #include "i18n.h"
 
 
-static int mdc_decode_filter( void *opaque, int control, IOBUF a,
+static int mdc_decode_filter( void *opaque, int control, iobuf_t a,
 					      byte *buf, size_t *ret_len);
-static int decode_filter( void *opaque, int control, IOBUF a,
+static int decode_filter( void *opaque, int control, iobuf_t a,
 					byte *buf, size_t *ret_len);
 
 typedef struct {
@@ -61,16 +63,16 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
 
     memset( &dfx, 0, sizeof dfx );
     if( opt.verbose && !dek->algo_info_printed ) {
-	const char *s = cipher_algo_to_string( dek->algo );
-	if( s )
+	const char *s = gcry_cipher_algo_name (dek->algo);
+	if (s && *s)
 	    log_info(_("%s encrypted data\n"), s );
 	else
 	    log_info(_("encrypted with unknown algorithm %d\n"), dek->algo );
         dek->algo_info_printed = 1;
     }
-    if( (rc=check_cipher_algo(dek->algo)) )
+    if( (rc=openpgp_cipher_test_algo(dek->algo)) )
 	goto leave;
-    blocksize = cipher_get_blocksize(dek->algo);
+    blocksize = gcry_cipher_get_algo_blklen (dek->algo);
     if( !blocksize || blocksize > 16 )
 	log_fatal("unsupported blocksize %u\n", blocksize );
     nprefix = blocksize;
@@ -78,20 +80,29 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
 	BUG();
 
     if( ed->mdc_method ) {
-	dfx.mdc_hash = md_open( ed->mdc_method, 0 );
+	gcry_md_open (&dfx.mdc_hash, ed->mdc_method, 0 );
 	if ( DBG_HASHING )
-	    md_start_debug(dfx.mdc_hash, "checkmdc");
+	    gcry_md_start_debug (dfx.mdc_hash, "checkmdc");
     }
-    dfx.cipher_hd = cipher_open( dek->algo,
-				 ed->mdc_method? CIPHER_MODE_CFB
-					       : CIPHER_MODE_AUTO_CFB, 1 );
-/* log_hexdump( "thekey", dek->key, dek->keylen );*/
-    rc = cipher_setkey( dfx.cipher_hd, dek->key, dek->keylen );
-    if( rc == G10ERR_WEAK_KEY )
+    rc = gcry_cipher_open (&dfx.cipher_hd, dek->algo,
+                           GCRY_CIPHER_MODE_CFB,
+                           GCRY_CIPHER_SECURE
+                           | ((ed->mdc_method || dek->algo >= 100)?
+                              0 : GCRY_CIPHER_ENABLE_SYNC) );
+     if (rc)
+       {
+         /* we should never get an error here cause we already
+          * checked, that the algorithm is available. What about a
+          * flag to let the function die in this case? */
+	BUG();
+       }
+    /* log_hexdump( "thekey", dek->key, dek->keylen );*/
+    rc = gcry_cipher_setkey (dfx.cipher_hd, dek->key, dek->keylen);
+    if( gpg_err_code (rc) == GPG_ERR_WEAK_KEY )
 	log_info(_("WARNING: message was encrypted with "
 		    "a weak key in the symmetric cipher.\n"));
     else if( rc ) {
-	log_error("key setup failed: %s\n", g10_errstr(rc) );
+	log_error("key setup failed: %s\n", gpg_strerror (rc) );
 	goto leave;
     }
     if (!ed->buf) {
@@ -99,9 +110,9 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
         goto leave;
     }
 
-    cipher_setiv( dfx.cipher_hd, NULL, 0 );
+    gcry_cipher_setiv (dfx.cipher_hd, NULL, 0);
 
-    if( ed->len ) {
+    if (ed->len) {
 	for(i=0; i < (nprefix+2) && ed->len; i++, ed->len-- ) {
 	    if( (c=iobuf_get(ed->buf)) == -1 )
 		break;
@@ -116,17 +127,17 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
 	    else
 		temp[i] = c;
     }
-    cipher_decrypt( dfx.cipher_hd, temp, temp, nprefix+2);
-    cipher_sync( dfx.cipher_hd );
+    gcry_cipher_decrypt( dfx.cipher_hd, temp, nprefix+2, NULL, 0);
+    gcry_cipher_sync( dfx.cipher_hd );
     p = temp;
 /* log_hexdump( "prefix", temp, nprefix+2 ); */
     if( p[nprefix-2] != p[nprefix] || p[nprefix-1] != p[nprefix+1] ) {
-	rc = G10ERR_BAD_KEY;
+	rc = GPG_ERR_BAD_KEY;
 	goto leave;
     }
 
     if( dfx.mdc_hash )
-	md_write( dfx.mdc_hash, temp, nprefix+2 );
+	gcry_md_write( dfx.mdc_hash, temp, nprefix+2 );
 
     if( ed->mdc_method )
 	iobuf_push_filter( ed->buf, mdc_decode_filter, &dfx );
@@ -136,23 +147,23 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
     proc_packets( procctx, ed->buf );
     ed->buf = NULL;
     if( ed->mdc_method && dfx.eof_seen == 2 )
-	rc = G10ERR_INVALID_PACKET;
+	rc = gpg_error (GPG_ERR_INV_PACKET);
     else if( ed->mdc_method ) { /* check the mdc */
-	int datalen = md_digest_length( ed->mdc_method );
+	int datalen = gcry_md_get_algo_dlen (ed->mdc_method);
 
-	cipher_decrypt( dfx.cipher_hd, dfx.defer, dfx.defer, 20);
-	md_final( dfx.mdc_hash );
+	gcry_cipher_decrypt (dfx.cipher_hd, dfx.defer, 20, NULL, 0);
+	gcry_md_final ( dfx.mdc_hash );
 	if( datalen != 20
-	    || memcmp(md_read( dfx.mdc_hash, 0 ), dfx.defer, datalen) )
-	    rc = G10ERR_BAD_SIGN;
-	/*log_hexdump("MDC calculated:", md_read( dfx.mdc_hash, 0), datalen);*/
+	    || memcmp(gcry_md_read ( dfx.mdc_hash, 0 ), dfx.defer, datalen) )
+	    rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
+	/*log_hexdump("MDC calculated:", gcry_md_read ( dfx.mdc_hash, 0), datalen);*/
 	/*log_hexdump("MDC message   :", dfx.defer, 20);*/
     }
     
 
   leave:
-    cipher_close(dfx.cipher_hd);
-    md_close( dfx.mdc_hash );
+    gcry_cipher_close(dfx.cipher_hd);
+    gcry_md_close ( dfx.mdc_hash );
     return rc;
 }
 
@@ -160,7 +171,7 @@ decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
 
 /* I think we should merge this with cipher_filter */
 static int
-mdc_decode_filter( void *opaque, int control, IOBUF a,
+mdc_decode_filter( void *opaque, int control, iobuf_t a,
 					      byte *buf, size_t *ret_len)
 {
     decode_filter_ctx_t *dfx = opaque;
@@ -218,8 +229,8 @@ mdc_decode_filter( void *opaque, int control, IOBUF a,
 	}
 
 	if( n ) {
-	    cipher_decrypt( dfx->cipher_hd, buf, buf, n);
-	    md_write( dfx->mdc_hash, buf, n );
+	    gcry_cipher_decrypt( dfx->cipher_hd, buf, n, NULL, 0);
+	    gcry_md_write( dfx->mdc_hash, buf, n );
 	}
 	else {
 	    assert( dfx->eof_seen );
@@ -234,7 +245,7 @@ mdc_decode_filter( void *opaque, int control, IOBUF a,
 }
 
 static int
-decode_filter( void *opaque, int control, IOBUF a, byte *buf, size_t *ret_len)
+decode_filter( void *opaque, int control, iobuf_t a, byte *buf, size_t *ret_len)
 {
     decode_filter_ctx_t *fc = opaque;
     size_t n, size = *ret_len;
@@ -245,7 +256,7 @@ decode_filter( void *opaque, int control, IOBUF a, byte *buf, size_t *ret_len)
 	n = iobuf_read( a, buf, size );
 	if( n == -1 ) n = 0;
 	if( n )
-	    cipher_decrypt( fc->cipher_hd, buf, buf, n);
+	    gcry_cipher_decrypt( fc->cipher_hd, buf, n, NULL, 0);
 	else
 	    rc = -1; /* eof */
 	*ret_len = n;
diff --git a/g10/exec.c b/g10/exec.c
index 0278438f6..f3b58aa3c 100644
--- a/g10/exec.c
+++ b/g10/exec.c
@@ -46,12 +46,12 @@ int exec_write(struct exec_info **info,const char *program,
 	       const char *args_in,const char *name,int writeonly,int binary)
 {
   log_error(_("no remote program execution supported\n"));
-  return G10ERR_GENERAL;
+  return GPG_ERR_GENERAL;
 }
 
-int exec_read(struct exec_info *info) { return G10ERR_GENERAL; }
-int exec_finish(struct exec_info *info) { return G10ERR_GENERAL; }
-int set_exec_path(const char *path,int method) { return G10ERR_GENERAL; }
+int exec_read(struct exec_info *info) { return GPG_ERR_GENERAL; }
+int exec_finish(struct exec_info *info) { return GPG_ERR_GENERAL; }
+int set_exec_path(const char *path,int method) { return GPG_ERR_GENERAL; }
 
 #else /* ! NO_EXEC */
 
@@ -71,7 +71,7 @@ static int win_system(const char *command)
 
   /* We must use a copy of the command as CreateProcess modifies this
      argument. */
-  string=m_strdup(command);
+  string=xstrdup (command);
 
   memset(&pi,0,sizeof(pi));
   memset(&si,0,sizeof(si));
@@ -85,7 +85,7 @@ static int win_system(const char *command)
 
   CloseHandle(pi.hProcess);
   CloseHandle(pi.hThread);
-  m_free(string);
+  xfree (string);
 
   return 0;
 }
@@ -101,7 +101,7 @@ int set_exec_path(const char *path,int method)
   if(method==1 && (curpath=getenv("PATH")))
     curlen=strlen(curpath)+1;
 
-  p=m_alloc(5+curlen+strlen(path)+1);
+  p=xmalloc (5+curlen+strlen(path)+1);
   strcpy(p,"PATH=");
 
   if(curpath)
@@ -120,7 +120,7 @@ int set_exec_path(const char *path,int method)
      set_exec_path multiple times. */
 
   if(putenv(p)!=0)
-    return G10ERR_GENERAL;
+    return GPG_ERR_GENERAL;
   else
     return 0;
 }
@@ -140,7 +140,7 @@ static int make_tempdir(struct exec_info *info)
   if(tmp==NULL)
     {
 #if defined (__MINGW32__)
-      tmp=m_alloc(256);
+      tmp=xmalloc (256);
       if(GetTempPath(256,tmp)==0)
 	strcpy(tmp,"c:\\windows\\temp");
       else
@@ -172,12 +172,12 @@ static int make_tempdir(struct exec_info *info)
 #endif
     }
 
-  info->tempdir=m_alloc(strlen(tmp)+strlen(DIRSEP_S)+10+1);
+  info->tempdir=xmalloc (strlen(tmp)+strlen(DIRSEP_S)+10+1);
 
   sprintf(info->tempdir,"%s" DIRSEP_S "gpg-XXXXXX",tmp);
 
 #if defined (__MINGW32__)
-  m_free(tmp);
+  xfree (tmp);
 #endif
 
   if(mkdtemp(info->tempdir)==NULL)
@@ -187,19 +187,19 @@ static int make_tempdir(struct exec_info *info)
     {
       info->madedir=1;
 
-      info->tempfile_in=m_alloc(strlen(info->tempdir)+
+      info->tempfile_in=xmalloc (strlen(info->tempdir)+
 				strlen(DIRSEP_S)+strlen(namein)+1);
       sprintf(info->tempfile_in,"%s" DIRSEP_S "%s",info->tempdir,namein);
 
       if(!info->writeonly)
 	{
-	  info->tempfile_out=m_alloc(strlen(info->tempdir)+
+	  info->tempfile_out=xmalloc (strlen(info->tempdir)+
 				     strlen(DIRSEP_S)+strlen(nameout)+1);
 	  sprintf(info->tempfile_out,"%s" DIRSEP_S "%s",info->tempdir,nameout);
 	}
     }
 
-  return info->madedir?0:G10ERR_GENERAL;
+  return info->madedir?0:GPG_ERR_GENERAL;
 }
 
 /* Expands %i and %o in the args to the full temp files within the
@@ -216,7 +216,7 @@ static int expand_args(struct exec_info *info,const char *args_in)
     log_debug("expanding string \"%s\"\n",args_in);
 
   size=100;
-  info->command=m_alloc(size);
+  info->command=xmalloc (size);
   len=0;
   info->command[0]='\0';
 
@@ -273,7 +273,7 @@ static int expand_args(struct exec_info *info,const char *args_in)
 		    applen=100;
 
 		  size+=applen;
-		  info->command=m_realloc(info->command,size);
+		  info->command=xrealloc(info->command,size);
 		}
 
 	      strcat(info->command,append);
@@ -285,7 +285,7 @@ static int expand_args(struct exec_info *info,const char *args_in)
 	  if(len==size-1) /* leave room for the \0 */
 	    {
 	      size+=100;
-	      info->command=m_realloc(info->command,size);
+	      info->command=xrealloc(info->command,size);
 	    }
 
 	  info->command[len++]=*ch;
@@ -303,10 +303,10 @@ static int expand_args(struct exec_info *info,const char *args_in)
 
  fail:
 
-  m_free(info->command);
+  xfree (info->command);
   info->command=NULL;
 
-  return G10ERR_GENERAL;
+  return GPG_ERR_GENERAL;
 }
 
 /* Either handles the tempfile creation, or the fork/exec.  If it
@@ -318,7 +318,7 @@ static int expand_args(struct exec_info *info,const char *args_in)
 int exec_write(struct exec_info **info,const char *program,
 	       const char *args_in,const char *name,int writeonly,int binary)
 {
-  int ret=G10ERR_GENERAL;
+  int ret=GPG_ERR_GENERAL;
 
   if(opt.exec_disable && !opt.no_perm_warn)
     {
@@ -338,10 +338,10 @@ int exec_write(struct exec_info **info,const char *program,
   if(program==NULL && args_in==NULL)
     BUG();
 
-  *info=m_alloc_clear(sizeof(struct exec_info));
+  *info=xcalloc (1,sizeof(struct exec_info));
 
   if(name)
-    (*info)->name=m_strdup(name);
+    (*info)->name=xstrdup (name);
   (*info)->binary=binary;
   (*info)->writeonly=writeonly;
 
@@ -449,8 +449,8 @@ int exec_write(struct exec_info **info,const char *program,
       (*info)->tochild=fdopen(to[1],binary?"wb":"w");
       if((*info)->tochild==NULL)
 	{
+          ret = gpg_error_from_errno (errno);
 	  close(to[1]);
-	  ret=G10ERR_WRITE_FILE;
 	  goto fail;
 	}
 
@@ -459,8 +459,8 @@ int exec_write(struct exec_info **info,const char *program,
       (*info)->fromchild=iobuf_fdopen(from[0],"r");
       if((*info)->fromchild==NULL)
 	{
+          ret = gpg_error_from_errno (errno);
 	  close(from[0]);
-	  ret=G10ERR_READ_FILE;
 	  goto fail;
 	}
 
@@ -478,9 +478,9 @@ int exec_write(struct exec_info **info,const char *program,
   (*info)->tochild=fopen((*info)->tempfile_in,binary?"wb":"w");
   if((*info)->tochild==NULL)
     {
+      ret = gpg_error_from_errno (errno);
       log_error(_("can't create `%s': %s\n"),
 		(*info)->tempfile_in,strerror(errno));
-      ret=G10ERR_WRITE_FILE;
       goto fail;
     }
 
@@ -492,7 +492,7 @@ int exec_write(struct exec_info **info,const char *program,
 
 int exec_read(struct exec_info *info)
 {
-  int ret=G10ERR_GENERAL;
+  int ret=GPG_ERR_GENERAL;
 
   fclose(info->tochild);
   info->tochild=NULL;
@@ -545,9 +545,9 @@ int exec_read(struct exec_info *info)
 	  info->fromchild=iobuf_open(info->tempfile_out);
 	  if(info->fromchild==NULL)
 	    {
+              ret = gpg_error_from_errno (errno);
 	      log_error(_("unable to read external program response: %s\n"),
 			strerror(errno));
-	      ret=G10ERR_READ_FILE;
 	      goto fail;
 	    }
 
@@ -607,12 +607,12 @@ int exec_finish(struct exec_info *info)
 		 info->tempdir,strerror(errno));
     }
 
-  m_free(info->command);
-  m_free(info->name);
-  m_free(info->tempdir);
-  m_free(info->tempfile_in);
-  m_free(info->tempfile_out);
-  m_free(info);
+  xfree (info->command);
+  xfree (info->name);
+  xfree (info->tempdir);
+  xfree (info->tempfile_in);
+  xfree (info->tempfile_out);
+  xfree (info);
 
   return ret;
 }
diff --git a/g10/exec.h b/g10/exec.h
index 25369dc34..eda406894 100644
--- a/g10/exec.h
+++ b/g10/exec.h
@@ -1,5 +1,5 @@
 /* exec.h
- * Copyright (C) 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 2001, 2002, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,14 +23,14 @@
 
 #include <unistd.h>
 #include <stdio.h>
-#include "iobuf.h"
+#include "../common/iobuf.h"
 
 struct exec_info
 {
   int progreturn,binary,writeonly,madedir,use_temp_files,keep_temp_files;
   pid_t child;
   FILE *tochild;
-  IOBUF fromchild;
+  iobuf_t fromchild;
   char *command,*name,*tempdir,*tempfile_in,*tempfile_out;
 };
 
diff --git a/g10/export.c b/g10/export.c
index 5783f6ac1..6c2c19f14 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -35,7 +35,7 @@
 #include "i18n.h"
 
 static int do_export( STRLIST users, int secret, unsigned int options );
-static int do_export_stream( IOBUF out, STRLIST users, int secret,
+static int do_export_stream( iobuf_t out, STRLIST users, int secret,
 			     KBNODE *keyblock_out, unsigned int options,
 			     int *any );
 
@@ -71,7 +71,7 @@ export_pubkeys( STRLIST users, unsigned int options )
  * been exported
  */
 int
-export_pubkeys_stream( IOBUF out, STRLIST users,
+export_pubkeys_stream( iobuf_t out, STRLIST users,
 		       KBNODE *keyblock_out, unsigned int options )
 {
     int any, rc;
@@ -97,7 +97,7 @@ export_secsubkeys( STRLIST users )
 static int
 do_export( STRLIST users, int secret, unsigned int options )
 {
-    IOBUF out = NULL;
+    iobuf_t out = NULL;
     int any, rc;
     armor_filter_context_t afx;
     compress_filter_context_t zfx;
@@ -129,7 +129,7 @@ do_export( STRLIST users, int secret, unsigned int options )
    contains a pointer to the first keyblock found and exported.  No
    other keyblocks are exported.  The caller must free it. */
 static int
-do_export_stream( IOBUF out, STRLIST users, int secret,
+do_export_stream( iobuf_t out, STRLIST users, int secret,
 		  KBNODE *keyblock_out, unsigned int options, int *any )
 {
     int rc = 0;
@@ -147,20 +147,20 @@ do_export_stream( IOBUF out, STRLIST users, int secret,
 
     if (!users) {
         ndesc = 1;
-        desc = m_alloc_clear ( ndesc * sizeof *desc);
+        desc = xcalloc (1, ndesc * sizeof *desc);
         desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
     }
     else {
         for (ndesc=0, sl=users; sl; sl = sl->next, ndesc++) 
             ;
-        desc = m_alloc ( ndesc * sizeof *desc);
+        desc = xmalloc ( ndesc * sizeof *desc);
         
         for (ndesc=0, sl=users; sl; sl = sl->next) {
 	    if (classify_user_id (sl->d, desc+ndesc))
                 ndesc++;
             else
                 log_error (_("key `%s' not found: %s\n"),
-                           sl->d, g10_errstr (G10ERR_INV_USER_ID));
+                           sl->d, gpg_strerror (GPG_ERR_INV_USER_ID));
         }
 
         /* it would be nice to see which of the given users did
@@ -181,7 +181,7 @@ do_export_stream( IOBUF out, STRLIST users, int secret,
         /* read the keyblock */
         rc = keydb_get_keyblock (kdbhd, &keyblock );
 	if( rc ) {
-            log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
+            log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
 	    goto leave;
 	}
 
@@ -370,8 +370,7 @@ do_export_stream( IOBUF out, STRLIST users, int secret,
 
 	    if( rc ) {
 		log_error("build_packet(%d) failed: %s\n",
-			    node->pkt->pkttype, g10_errstr(rc) );
-		rc = G10ERR_WRITE_FILE;
+			    node->pkt->pkttype, gpg_strerror (rc) );
 		goto leave;
 	    }
 	}
@@ -386,7 +385,7 @@ do_export_stream( IOBUF out, STRLIST users, int secret,
 	rc = 0;
 
   leave:
-    m_free(desc);
+    xfree (desc);
     keydb_release (kdbhd);
     if(rc || keyblock_out==NULL)
       release_kbnode( keyblock );
diff --git a/g10/filter.h b/g10/filter.h
index 9f235fd6b..12c5cebed 100644
--- a/g10/filter.h
+++ b/g10/filter.h
@@ -22,6 +22,7 @@
 
 #include "types.h"
 #include "cipher.h"
+#include "iobuf.h"
 
 typedef struct {
     MD_HANDLE md;      /* catch all */
@@ -120,35 +121,35 @@ typedef struct {
 /* encrypt_filter_context_t defined in main.h */
 
 /*-- mdfilter.c --*/
-int md_filter( void *opaque, int control, IOBUF a, byte *buf, size_t *ret_len);
+int md_filter( void *opaque, int control, iobuf_t a, byte *buf, size_t *ret_len);
 void free_md_filter_context( md_filter_context_t *mfx );
 
 /*-- armor.c --*/
-int use_armor_filter( IOBUF a );
+int use_armor_filter( iobuf_t a );
 int armor_filter( void *opaque, int control,
-		  IOBUF chain, byte *buf, size_t *ret_len);
+		  iobuf_t chain, byte *buf, size_t *ret_len);
 UnarmorPump unarmor_pump_new (void);
 void        unarmor_pump_release (UnarmorPump x);
 int         unarmor_pump (UnarmorPump x, int c);
 
 /*-- compress.c --*/
 int compress_filter( void *opaque, int control,
-		     IOBUF chain, byte *buf, size_t *ret_len);
+		     iobuf_t chain, byte *buf, size_t *ret_len);
 
 /*-- cipher.c --*/
 int cipher_filter( void *opaque, int control,
-		   IOBUF chain, byte *buf, size_t *ret_len);
+		   iobuf_t chain, byte *buf, size_t *ret_len);
 
 /*-- textfilter.c --*/
 int text_filter( void *opaque, int control,
-		 IOBUF chain, byte *buf, size_t *ret_len);
-int copy_clearsig_text( IOBUF out, IOBUF inp, MD_HANDLE md,
+		 iobuf_t chain, byte *buf, size_t *ret_len);
+int copy_clearsig_text( iobuf_t out, iobuf_t inp, MD_HANDLE md,
 			  int escape_dash, int escape_from, int pgp2mode );
 
 /*-- progress.c --*/
 int progress_filter (void *opaque, int control,
-		     IOBUF a, byte *buf, size_t *ret_len);
+		     iobuf_t a, byte *buf, size_t *ret_len);
 void handle_progress (progress_filter_context_t *pfx,
-		      IOBUF inp, const char *name);
+		      iobuf_t inp, const char *name);
 
 #endif /*G10_FILTER_H*/
diff --git a/g10/free-packet.c b/g10/free-packet.c
index ce3568ca5..7ced327f5 100644
--- a/g10/free-packet.c
+++ b/g10/free-packet.c
@@ -36,7 +36,7 @@
 void
 free_symkey_enc( PKT_symkey_enc *enc )
 {
-    m_free(enc);
+    xfree (enc);
 }
 
 void
@@ -45,10 +45,10 @@ free_pubkey_enc( PKT_pubkey_enc *enc )
     int n, i;
     n = pubkey_get_nenc( enc->pubkey_algo );
     if( !n )
-	mpi_free(enc->data[0]);
+	mpi_release (enc->data[0]);
     for(i=0; i < n; i++ )
-	mpi_free( enc->data[i] );
-    m_free(enc);
+	mpi_release ( enc->data[i] );
+    xfree (enc);
 }
 
 void
@@ -58,14 +58,14 @@ free_seckey_enc( PKT_signature *sig )
 
   n = pubkey_get_nsig( sig->pubkey_algo );
   if( !n )
-    mpi_free(sig->data[0]);
+    mpi_release (sig->data[0]);
   for(i=0; i < n; i++ )
-    mpi_free( sig->data[i] );
+    mpi_release ( sig->data[i] );
   
-  m_free(sig->revkey);
-  m_free(sig->hashed);
-  m_free(sig->unhashed);
-  m_free(sig);
+  xfree (sig->revkey);
+  xfree (sig->hashed);
+  xfree (sig->unhashed);
+  xfree (sig);
 }
 
 
@@ -75,13 +75,13 @@ release_public_key_parts( PKT_public_key *pk )
     int n, i;
     n = pubkey_get_npkey( pk->pubkey_algo );
     if( !n )
-	mpi_free(pk->pkey[0]);
+	mpi_release (pk->pkey[0]);
     for(i=0; i < n; i++ ) {
-	mpi_free( pk->pkey[i] );
+	mpi_release ( pk->pkey[i] );
 	pk->pkey[i] = NULL;
     }
     if (pk->prefs) {
-        m_free (pk->prefs);
+        xfree (pk->prefs);
         pk->prefs = NULL;
     }
     if (pk->user_id) {
@@ -89,7 +89,7 @@ release_public_key_parts( PKT_public_key *pk )
         pk->user_id = NULL;
     }
     if (pk->revkey) {
-        m_free(pk->revkey);
+        xfree (pk->revkey);
 	pk->revkey=NULL;
 	pk->numrevkeys=0;
     }
@@ -100,7 +100,7 @@ void
 free_public_key( PKT_public_key *pk )
 {
     release_public_key_parts( pk );
-    m_free(pk);
+    xfree (pk);
 }
 
 
@@ -111,7 +111,7 @@ cp_subpktarea (subpktarea_t *s )
 
     if( !s )
 	return NULL;
-    d = m_alloc (sizeof (*d) + s->size - 1 );
+    d = xmalloc (sizeof (*d) + s->size - 1 );
     d->size = s->size;
     d->len = s->len;
     memcpy (d->data, s->data, s->len);
@@ -132,7 +132,7 @@ copy_prefs (const prefitem_t *prefs)
     
     for (n=0; prefs[n].type; n++)
         ;
-    new = m_alloc ( sizeof (*new) * (n+1));
+    new = xmalloc ( sizeof (*new) * (n+1));
     for (n=0; prefs[n].type; n++) {
         new[n].type = prefs[n].type;
         new[n].value = prefs[n].value;
@@ -150,7 +150,7 @@ copy_public_key ( PKT_public_key *d, PKT_public_key *s)
     int n, i;
 
     if( !d )
-	d = m_alloc(sizeof *d);
+	d = xmalloc (sizeof *d);
     memcpy( d, s, sizeof *d );
     d->user_id = scopy_user_id (s->user_id);
     d->prefs = copy_prefs (s->prefs);
@@ -164,7 +164,7 @@ copy_public_key ( PKT_public_key *d, PKT_public_key *s)
     if( !s->revkey && s->numrevkeys )
         BUG();
     if( s->numrevkeys ) {
-        d->revkey = m_alloc(sizeof(struct revocation_key)*s->numrevkeys);
+        d->revkey = xmalloc (sizeof(struct revocation_key)*s->numrevkeys);
         memcpy(d->revkey,s->revkey,sizeof(struct revocation_key)*s->numrevkeys);
     }
     else
@@ -200,7 +200,7 @@ copy_signature( PKT_signature *d, PKT_signature *s )
     int n, i;
 
     if( !d )
-	d = m_alloc(sizeof *d);
+	d = xmalloc (sizeof *d);
     memcpy( d, s, sizeof *d );
     n = pubkey_get_nsig( s->pubkey_algo );
     if( !n )
@@ -241,9 +241,9 @@ release_secret_key_parts( PKT_secret_key *sk )
 
     n = pubkey_get_nskey( sk->pubkey_algo );
     if( !n )
-	mpi_free(sk->skey[0]);
+	mpi_release (sk->skey[0]);
     for(i=0; i < n; i++ ) {
-	mpi_free( sk->skey[i] );
+	mpi_release ( sk->skey[i] );
 	sk->skey[i] = NULL;
     }
 }
@@ -252,7 +252,7 @@ void
 free_secret_key( PKT_secret_key *sk )
 {
     release_secret_key_parts( sk );
-    m_free(sk);
+    xfree (sk);
 }
 
 PKT_secret_key *
@@ -261,7 +261,7 @@ copy_secret_key( PKT_secret_key *d, PKT_secret_key *s )
     int n, i;
 
     if( !d )
-	d = m_alloc(sizeof *d);
+	d = xmalloc (sizeof *d);
     memcpy( d, s, sizeof *d );
     n = pubkey_get_nskey( s->pubkey_algo );
     if( !n )
@@ -276,14 +276,14 @@ copy_secret_key( PKT_secret_key *d, PKT_secret_key *s )
 void
 free_comment( PKT_comment *rem )
 {
-    m_free(rem);
+    xfree (rem);
 }
 
 void
 free_attributes(PKT_user_id *uid)
 {
-  m_free(uid->attribs);
-  m_free(uid->attrib_data);
+  xfree (uid->attribs);
+  xfree (uid->attrib_data);
 
   uid->attribs=NULL;
   uid->attrib_data=NULL;
@@ -298,9 +298,9 @@ free_user_id (PKT_user_id *uid)
         return;
 
     free_attributes(uid);
-    m_free (uid->prefs);
-    m_free (uid->namehash);
-    m_free (uid);
+    xfree (uid->prefs);
+    xfree (uid->namehash);
+    xfree (uid);
 }
 
 void
@@ -312,7 +312,7 @@ free_compressed( PKT_compressed *zd )
 	while( iobuf_read( zd->buf, NULL, 1<<30 ) != -1 )
 	    ;
     }
-    m_free(zd);
+    xfree (zd);
 }
 
 void
@@ -333,7 +333,7 @@ free_encrypted( PKT_encrypted *ed )
 	   }
 	}
     }
-    m_free(ed);
+    xfree (ed);
 }
 
 
@@ -355,7 +355,7 @@ free_plaintext( PKT_plaintext *pt )
 	   }
 	}
     }
-    m_free(pt);
+    xfree (pt);
 }
 
 /****************
@@ -405,7 +405,7 @@ free_packet( PACKET *pkt )
 	free_plaintext( pkt->pkt.plaintext );
 	break;
       default:
-	m_free( pkt->pkt.generic );
+	xfree ( pkt->pkt.generic );
 	break;
     }
     pkt->pkt.generic = NULL;
diff --git a/g10/g10.c b/g10/g10.c
index d17422c12..cf6240d55 100644
--- a/g10/g10.c
+++ b/g10/g10.c
@@ -34,6 +34,7 @@
 #endif
 
 #define INCLUDED_BY_MAIN_MODULE 1
+#include "gpg.h"
 #include "packet.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -48,7 +49,6 @@
 #include "ttyio.h"
 #include "i18n.h"
 #include "status.h"
-#include "g10defs.h"
 #include "keyserver-internal.h"
 #include "exec.h"
 
@@ -644,8 +644,15 @@ static void add_policy_url( const char *string, int which );
 RISCOS_GLOBAL_STATICS("GnuPG Heap")
 #endif /* __riscos__ */
 
-const char *
-strusage( int level )
+static int
+pk_test_algo (int algo)
+{
+  return openpgp_pk_test_algo (algo, 0);
+}
+
+
+static const char *
+my_strusage( int level )
 {
   static char *digests, *pubkeys, *ciphers, *zips;
     const char *p;
@@ -676,20 +683,20 @@ strusage( int level )
       case 33: p = _("\nSupported algorithms:\n"); break;
       case 34:
 	if( !pubkeys )
-	    pubkeys = build_list(_("Pubkey: "), 0, pubkey_algo_to_string,
-							check_pubkey_algo );
+	    pubkeys = build_list(_("Pubkey: "), 0, gcry_pk_algo_name,
+                                 pk_test_algo );
 	p = pubkeys;
 	break;
       case 35:
 	if( !ciphers )
-	    ciphers = build_list(_("Cipher: "), 'S', cipher_algo_to_string,
-							check_cipher_algo );
+	    ciphers = build_list(_("Cipher: "), 'S', gcry_cipher_algo_name,
+                                 openpgp_cipher_test_algo );
 	p = ciphers;
 	break;
       case 36:
 	if( !digests )
-	    digests = build_list(_("Hash: "), 'H', digest_algo_to_string,
-							check_digest_algo );
+	    digests = build_list(_("Hash: "), 'H', gcry_md_algo_name,
+					openpgp_md_test_algo );
 	p = digests;
 	break;
       case 37:
@@ -699,7 +706,7 @@ strusage( int level )
 	p = zips;
 	break;
 
-      default:	p = default_strusage(level);
+      default:	p = NULL;
     }
     return p;
 }
@@ -715,12 +722,12 @@ build_list( const char *text, char letter,
     char *list, *p, *line=NULL;
 
     if( maybe_setuid )
-	secmem_init( 0 );    /* drop setuid */
+        gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* drop setuid */
 
     for(i=0; i <= 110; i++ )
 	if( !chkf(i) && (s=mapf(i)) )
 	    n += strlen(s) + 7 + 2;
-    list = m_alloc( 21 + n ); *list = 0;
+    list = xmalloc ( 21 + n ); *list = 0;
     for(p=NULL, i=0; i <= 110; i++ ) {
 	if( !chkf(i) && (s=mapf(i)) ) {
 	    if( !p ) {
@@ -733,7 +740,7 @@ build_list( const char *text, char letter,
 	    if(strlen(line)>60) {
 	      int spaces=strlen(text);
 
-	      list=m_realloc(list,n+spaces+1);
+	      list = xrealloc(list,n+spaces+1);
 	      /* realloc could move the block, so find the end again */
 	      p=list;
 	      while(*p)
@@ -768,7 +775,7 @@ i18n_init(void)
 #else
 #ifdef ENABLE_NLS
     setlocale( LC_ALL, "" );
-    bindtextdomain( PACKAGE, G10_LOCALEDIR );
+    bindtextdomain( PACKAGE, LOCALEDIR );
     textdomain( PACKAGE );
 #endif
 #endif
@@ -784,32 +791,58 @@ wrong_args( const char *text)
 }
 
 
+static void
+log_set_strict (int yesno)
+{
+  /* FIXME-XXX*/
+}
+
 static char *
 make_username( const char *string )
 {
     char *p;
     if( utf8_strings )
-	p = m_strdup(string);
+	p = xstrdup (string);
     else
 	p = native_to_utf8( string );
     return p;
 }
 
 
+/*
+ * same as add_to_strlist() but if is_utf8 is *not* set a conversion
+ * to UTF8 is done  
+ */
+static STRLIST
+add_to_strlist2 ( STRLIST *list, const char *string, int is_utf8)
+{
+  STRLIST sl;
+  
+  if (is_utf8)
+    sl = add_to_strlist( list, string );
+  else 
+    {
+      char *p = native_to_utf8( string );
+      sl = add_to_strlist( list, p );
+      xfree( p );
+    }
+  return sl;
+}
+
+
 static void
 set_debug(void)
 {
-    if( opt.debug & DBG_MEMORY_VALUE )
-	memory_debug_mode = 1;
-    if( opt.debug & DBG_MEMSTAT_VALUE )
-	memory_stat_debug_mode = 1;
-    if( opt.debug & DBG_MPI_VALUE )
-	mpi_debug_mode = 1;
-    if( opt.debug & DBG_CIPHER_VALUE )
-	g10c_debug_mode = 1;
-    if( opt.debug & DBG_IOBUF_VALUE )
-	iobuf_debug_mode = 1;
-
+  if (opt.debug & DBG_MEMORY_VALUE )
+    memory_debug_mode = 1;
+  if (opt.debug & DBG_MEMSTAT_VALUE )
+    memory_stat_debug_mode = 1;
+  if (opt.debug & DBG_MPI_VALUE)
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 2);
+  if (opt.debug & DBG_CIPHER_VALUE )
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
+  if (opt.debug & DBG_IOBUF_VALUE )
+    iobuf_debug_mode = 1;
 }
 
 
@@ -876,7 +909,7 @@ static void add_group(char *string)
         add_to_strlist2 (&values,value,utf8_strings);
     }
 
-  item=m_alloc(sizeof(struct groupitem));
+  item=xmalloc (sizeof(struct groupitem));
   item->name=name;
   item->values=values;
   item->next=opt.grouplist;
@@ -920,7 +953,7 @@ check_permissions(const char *path,int item)
 	tmppath=make_filename(GNUPG_LIBDIR,path,NULL);
     }
   else
-    tmppath=m_strdup(path);
+    tmppath=xstrdup (path);
 
   /* If the item is located in the homedir, but isn't the homedir,
      don't continue if we already checked the homedir itself.  This is
@@ -953,7 +986,7 @@ check_permissions(const char *path,int item)
       goto end;
     }
 
-  m_free(dir);
+  xfree (dir);
 
   /* Assume failure */
   ret=1;
@@ -1076,7 +1109,7 @@ check_permissions(const char *path,int item)
     }
 
  end:
-  m_free(tmppath);
+  xfree (tmppath);
 
   if(homedir)
     homedir_cache=ret;
@@ -1092,7 +1125,7 @@ int
 main( int argc, char **argv )
 {
     ARGPARSE_ARGS pargs;
-    IOBUF a;
+    iobuf_t a;
     int rc=0;
     int orig_argc;
     char **orig_argv;
@@ -1137,17 +1170,31 @@ main( int argc, char **argv )
 #endif /* __riscos__ */
 
     trap_unaligned();
-    secmem_set_flags( secmem_get_flags() | 2 ); /* suspend warnings */
+    set_strusage (my_strusage);
+    gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
+    /* We don't need any locking in libgcrypt unless we use any kind of
+       threading. */
+    gcry_control (GCRYCTL_DISABLE_INTERNAL_LOCKING);
     /* Please note that we may running SUID(ROOT), so be very CAREFUL
      * when adding any stuff between here and the call to
      * secmem_init()  somewhere after the option parsing
      */
-    log_set_name("gpg");
-    secure_random_alloc(); /* put random number into secure memory */
+    log_set_prefix ("gpg", 1);
+    /* check that the libraries are suitable.  Do it here because the
+       option parse may need services of the library */
+    if (!gcry_check_version (NEED_LIBGCRYPT_VERSION) )
+      {
+        log_fatal( _("libgcrypt is too old (need %s, have %s)\n"),
+                   NEED_LIBGCRYPT_VERSION, gcry_check_version (NULL) );
+      }
+
+    gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
+
     may_coredump = disable_core_dumps();
-    init_signals();
-    create_dotlock(NULL); /* register locking cleanup */
+    init_signals (); /* why not gnupg_init_signals. */
+    create_dotlock (NULL); /* register locking cleanup */
     i18n_init();
+
     opt.command_fd = -1; /* no command fd */
     opt.compress = -1; /* defaults to standard compress level */
     /* note: if you change these lines, look at oOpenPGP */
@@ -1238,7 +1285,7 @@ main( int argc, char **argv )
 
 #ifdef HAVE_DOSISH_SYSTEM
     if ( strchr (opt.homedir,'\\') ) {
-        char *d, *buf = m_alloc (strlen (opt.homedir)+1);
+        char *d, *buf = xmalloc (strlen (opt.homedir)+1);
         const char *s = opt.homedir;
         for (d=buf,s=opt.homedir; *s; s++)
             *d++ = *s == '\\'? '/': *s;
@@ -1251,11 +1298,13 @@ main( int argc, char **argv )
 	init_shm_coprocessing(requested_shm_size, 1 );
     }
 #endif
-    /* initialize the secure memory. */
-    secmem_init( 32768 );
+    /* Initialize the secure memory. */
+    gcry_control (GCRYCTL_INIT_SECMEM, 32768, 0);
     maybe_setuid = 0;
     /* Okay, we are now working under our real uid */
 
+    /* malloc hooks gohere ... */
+
     set_native_charset (NULL); /* Try to auto set the character set */
 
     if( default_config )
@@ -1265,7 +1314,7 @@ main( int argc, char **argv )
 				   "gpg" EXTSEP_S "conf-" SAFE_VERSION, NULL );
 	if(access(configname,R_OK))
 	  {
-	    m_free(configname);
+	    xfree (configname);
 	    configname = make_filename(opt.homedir,
 				       "gpg" EXTSEP_S "conf", NULL );
 	  }
@@ -1274,11 +1323,11 @@ main( int argc, char **argv )
             char *p = make_filename(opt.homedir, "options", NULL );
             if (!access (p, R_OK))
               log_info (_("NOTE: old default options file `%s' ignored\n"), p);
-            m_free (p);
+            xfree (p);
           }
         else
           { /* Keep on using the old default one. */
-            m_free (configname);
+            xfree (configname);
             configname = make_filename(opt.homedir, "options", NULL );
           }
       }
@@ -1317,7 +1366,7 @@ main( int argc, char **argv )
 				    configname, strerror(errno) );
 		g10_exit(2);
 	    }
-	    m_free(configname); configname = NULL;
+	    xfree (configname); configname = NULL;
 	}
 	if( parse_debug && configname )
 	    log_info(_("reading options from `%s'\n"), configname );
@@ -1437,8 +1486,7 @@ main( int argc, char **argv )
             break;
 #endif /* __riscos__ */
 	  case oLoggerFD:
-            log_set_logfile( NULL,
-                             iobuf_translate_file_handle (pargs.r.ret_int, 1) );
+            log_set_fd (iobuf_translate_file_handle (pargs.r.ret_int, 1));
             break;
 #ifdef __riscos__
 	  case oLoggerFile:
@@ -1454,8 +1502,8 @@ main( int argc, char **argv )
 	  case oOptions:
 	    /* config files may not be nested (silently ignore them) */
 	    if( !configfp ) {
-		m_free(configname);
-		configname = m_strdup(pargs.r.ret_str);
+		xfree (configname);
+		configname = xstrdup (pargs.r.ret_str);
 		goto next_pass;
 	    }
 	    break;
@@ -1465,7 +1513,8 @@ main( int argc, char **argv )
 	  case oNoGreeting: nogreeting = 1; break;
 	  case oNoVerbose: g10_opt_verbose = 0;
 			   opt.verbose = 0; opt.list_sigs=0; break;
-	  case oQuickRandom: quick_random_gen(1); break;
+      /* disabled for now: 
+          case oQuickRandom: quick_random_gen(1); break; */
 	  case oSKComments: opt.sk_comments=1; break;
 	  case oNoSKComments: opt.sk_comments=0; break;
 	  case oEmitVersion: opt.no_version=0; break;
@@ -1480,11 +1529,11 @@ main( int argc, char **argv )
 			opt.def_recipient = make_username(pargs.r.ret_str);
 		    break;
 	  case oDefRecipientSelf:
-		    m_free(opt.def_recipient); opt.def_recipient = NULL;
+		    xfree (opt.def_recipient); opt.def_recipient = NULL;
 		    opt.def_recipient_self = 1;
 		    break;
 	  case oNoDefRecipient:
-		    m_free(opt.def_recipient); opt.def_recipient = NULL;
+		    xfree (opt.def_recipient); opt.def_recipient = NULL;
 		    opt.def_recipient_self = 0;
 		    break;
 	  case oNoOptions: opt.no_homedir_creation = 1; break; /* no-options */
@@ -1621,8 +1670,8 @@ main( int argc, char **argv )
 	  case oDisableMDC: opt.disable_mdc = 1; break;
 	  case oNoDisableMDC: opt.disable_mdc = 0; break;
 	  case oS2KMode:   opt.s2k_mode = pargs.r.ret_int; break;
-	  case oS2KDigest: s2k_digest_string = m_strdup(pargs.r.ret_str); break;
-	  case oS2KCipher: s2k_cipher_string = m_strdup(pargs.r.ret_str); break;
+	  case oS2KDigest: s2k_digest_string = xstrdup (pargs.r.ret_str); break;
+	  case oS2KCipher: s2k_cipher_string = xstrdup (pargs.r.ret_str); break;
           case oSimpleSKChecksum: opt.simple_sk_checksum = 1; break;
 	  case oNoEncryptTo: opt.no_encrypt_to = 1; break;
 	  case oEncryptTo: /* store the recipient in the second list */
@@ -1671,8 +1720,8 @@ main( int argc, char **argv )
             opt.command_fd = iobuf_translate_file_handle ( riscos_fdopenfile (pargs.r.ret_str, 0), 0);
             break;
 #endif /* __riscos__ */
-	  case oCipherAlgo: def_cipher_string = m_strdup(pargs.r.ret_str); break;
-	  case oDigestAlgo: def_digest_string = m_strdup(pargs.r.ret_str); break;
+	  case oCipherAlgo: def_cipher_string = xstrdup (pargs.r.ret_str); break;
+	  case oDigestAlgo: def_digest_string = xstrdup (pargs.r.ret_str); break;
 	  case oCompressAlgo:
 	    /* If it is all digits, stick a Z in front of it for
 	       later.  This is for backwards compatibility with
@@ -1689,16 +1738,19 @@ main( int argc, char **argv )
 
 	      if(*pt=='\0')
 		{
-		  def_compress_string=m_alloc(strlen(pargs.r.ret_str)+2);
+		  def_compress_string=xmalloc (strlen(pargs.r.ret_str)+2);
 		  strcpy(def_compress_string,"Z");
 		  strcat(def_compress_string,pargs.r.ret_str);
 		}
 	      else
-		def_compress_string = m_strdup(pargs.r.ret_str);
+		def_compress_string = xstrdup (pargs.r.ret_str);
 	    }
 	    break;
-	  case oCertDigestAlgo: cert_digest_string = m_strdup(pargs.r.ret_str); break;
-	  case oNoSecmemWarn: secmem_set_flags( secmem_get_flags() | 1 ); break;
+	  case oCertDigestAlgo: cert_digest_string = xstrdup (pargs.r.ret_str); break;
+	  case oNoSecmemWarn:
+#warning add secmem_get_flags
+/*              secmem_set_flags( secmem_get_flags() | 1 ); */
+            break;
 	  case oNoPermissionWarn: opt.no_perm_warn=1; break;
 	  case oNoMDCWarn: opt.no_mdc_warn=1; break;
           case oCharset:
@@ -1719,7 +1771,7 @@ main( int argc, char **argv )
 #endif /* __riscos__ */
             break;
 	  case oKeyServer:
-	    opt.keyserver_uri=m_strdup(pargs.r.ret_str);
+	    opt.keyserver_uri=xstrdup (pargs.r.ret_str);
 	    if(parse_keyserver_uri(pargs.r.ret_str,configname,configlineno))
 	      log_error(_("could not parse keyserver URI\n"));
 	    break;
@@ -1813,11 +1865,19 @@ main( int argc, char **argv )
 	  case oUtf8Strings: utf8_strings = 1; break;
 	  case oNoUtf8Strings: utf8_strings = 0; break;
 	  case oDisableCipherAlgo:
-		disable_cipher_algo( string_to_cipher_algo(pargs.r.ret_str) );
-		break;
+            {
+              int algo = gcry_cipher_map_name (pargs.r.ret_str);
+              gcry_cipher_ctl (NULL, GCRYCTL_DISABLE_ALGO,
+                               &algo, sizeof algo);
+            }
+            break;
 	  case oDisablePubkeyAlgo:
-		disable_pubkey_algo( string_to_pubkey_algo(pargs.r.ret_str) );
-		break;
+            {
+              int algo = gcry_pk_map_name (pargs.r.ret_str);
+              gcry_pk_ctl (GCRYCTL_DISABLE_ALGO,
+                           &algo, sizeof algo );
+            }
+            break;
           case oNoSigCache: opt.no_sig_cache = 1; break;
           case oNoSigCreateCheck: opt.no_sig_create_check = 1; break;
 	  case oAllowNonSelfsignedUID: opt.allow_non_selfsigned_uid = 1; break;
@@ -1900,10 +1960,10 @@ main( int argc, char **argv )
     if( configfp ) {
 	fclose( configfp );
 	configfp = NULL;
-	m_free(configname); configname = NULL;
+	xfree (configname); configname = NULL;
 	goto next_pass;
     }
-    m_free( configname ); configname = NULL;
+    xfree ( configname ); configname = NULL;
     if( log_get_errorcount(0) )
 	g10_exit(2);
     if( nogreeting )
@@ -1952,8 +2012,10 @@ main( int argc, char **argv )
     if( opt.batch )
 	tty_batchmode( 1 );
 
+#warning fix that
+#if 0
     secmem_set_flags( secmem_get_flags() & ~2 ); /* resume warnings */
-
+#endif
     set_debug();
 
     /* Do these after the switch(), so they can override settings. */
@@ -1986,7 +2048,7 @@ main( int argc, char **argv )
 	       preference, but those have their own error
 	       messages). */
 
-	    if(check_cipher_algo(CIPHER_ALGO_IDEA))
+	    if(openpgp_cipher_test_algo (CIPHER_ALGO_IDEA))
 	      {
 		log_info(_("encrypting a message in --pgp2 mode requires "
 			   "the IDEA cipher\n"));
@@ -1998,8 +2060,8 @@ main( int argc, char **argv )
 		/* This only sets IDEA for symmetric encryption
 		   since it is set via select_algo_from_prefs for
 		   pk encryption. */
-		m_free(def_cipher_string);
-		def_cipher_string = m_strdup("idea");
+		xfree (def_cipher_string);
+		def_cipher_string = xstrdup ("idea");
 	      }
 
 	    /* PGP2 can't handle the output from the textmode
@@ -2024,8 +2086,8 @@ main( int argc, char **argv )
 	    opt.pgp2_workarounds = 1;
 	    opt.ask_sig_expire = 0;
 	    opt.ask_cert_expire = 0;
-	    m_free(def_digest_string);
-	    def_digest_string = m_strdup("md5");
+	    xfree (def_digest_string);
+	    def_digest_string = xstrdup ("md5");
 	    opt.def_compress_algo = 1;
 	  }
       }
@@ -2053,43 +2115,43 @@ main( int argc, char **argv )
     /* must do this after dropping setuid, because string_to...
      * may try to load an module */
     if( def_cipher_string ) {
-	opt.def_cipher_algo = string_to_cipher_algo(def_cipher_string);
+	opt.def_cipher_algo = gcry_cipher_map_name (def_cipher_string);
 	if(opt.def_cipher_algo==0 &&
 	   (ascii_strcasecmp(def_cipher_string,"idea")==0
 	    || ascii_strcasecmp(def_cipher_string,"s1")==0))
 	  idea_cipher_warn(1);
-	m_free(def_cipher_string); def_cipher_string = NULL;
-	if( check_cipher_algo(opt.def_cipher_algo) )
+	xfree (def_cipher_string); def_cipher_string = NULL;
+	if( openpgp_cipher_test_algo (opt.def_cipher_algo) )
 	    log_error(_("selected cipher algorithm is invalid\n"));
     }
     if( def_digest_string ) {
-	opt.def_digest_algo = string_to_digest_algo(def_digest_string);
-	m_free(def_digest_string); def_digest_string = NULL;
-	if( check_digest_algo(opt.def_digest_algo) )
+	opt.def_digest_algo = gcry_md_map_name (def_digest_string);
+	xfree (def_digest_string); def_digest_string = NULL;
+	if( openpgp_md_test_algo (opt.def_digest_algo) )
 	    log_error(_("selected digest algorithm is invalid\n"));
     }
     if( def_compress_string ) {
 	opt.def_compress_algo = string_to_compress_algo(def_compress_string);
-	m_free(def_compress_string); def_compress_string = NULL;
+	xfree (def_compress_string); def_compress_string = NULL;
 	if( check_compress_algo(opt.def_compress_algo) )
 	    log_error(_("selected compression algorithm is invalid\n"));
     }
     if( cert_digest_string ) {
-	opt.cert_digest_algo = string_to_digest_algo(cert_digest_string);
-	m_free(cert_digest_string); cert_digest_string = NULL;
-	if( check_digest_algo(opt.cert_digest_algo) )
+	opt.cert_digest_algo = gcry_md_map_name (cert_digest_string);
+	xfree (cert_digest_string); cert_digest_string = NULL;
+	if( openpgp_md_test_algo(opt.cert_digest_algo) )
 	    log_error(_("selected certification digest algorithm is invalid\n"));
     }
     if( s2k_cipher_string ) {
-	opt.s2k_cipher_algo = string_to_cipher_algo(s2k_cipher_string);
-	m_free(s2k_cipher_string); s2k_cipher_string = NULL;
-	if( check_cipher_algo(opt.s2k_cipher_algo) )
+	opt.s2k_cipher_algo = gcry_cipher_map_name (s2k_cipher_string);
+	xfree (s2k_cipher_string); s2k_cipher_string = NULL;
+	if( openpgp_cipher_test_algo (opt.s2k_cipher_algo) )
 	    log_error(_("selected cipher algorithm is invalid\n"));
     }
     if( s2k_digest_string ) {
-	opt.s2k_digest_algo = string_to_digest_algo(s2k_digest_string);
-	m_free(s2k_digest_string); s2k_digest_string = NULL;
-	if( check_digest_algo(opt.s2k_digest_algo) )
+	opt.s2k_digest_algo = gcry_md_map_name (s2k_digest_string);
+	xfree (s2k_digest_string); s2k_digest_string = NULL;
+	if( openpgp_md_test_algo (opt.s2k_digest_algo) )
 	    log_error(_("selected digest algorithm is invalid\n"));
     }
     if( opt.completes_needed < 1 )
@@ -2143,32 +2205,32 @@ main( int argc, char **argv )
 	const char *badalg=NULL;
 	preftype_t badtype=PREFTYPE_NONE;
 
-	if(opt.def_cipher_algo
-	   && !algo_available(PREFTYPE_SYM,opt.def_cipher_algo,NULL))
+	if (opt.def_cipher_algo
+            && !algo_available (PREFTYPE_SYM,opt.def_cipher_algo,NULL))
 	  {
-	    badalg=cipher_algo_to_string(opt.def_cipher_algo);
-	    badtype=PREFTYPE_SYM;
+	    badalg = gcry_cipher_algo_name (opt.def_cipher_algo);
+	    badtype = PREFTYPE_SYM;
 	  }
-	else if(opt.def_digest_algo
-		&& !algo_available(PREFTYPE_HASH,opt.def_digest_algo,NULL))
+	else if (opt.def_digest_algo
+		&& !algo_available (PREFTYPE_HASH,opt.def_digest_algo,NULL))
 	  {
-	    badalg=digest_algo_to_string(opt.def_digest_algo);
-	    badtype=PREFTYPE_HASH;
+	    badalg = gcry_md_algo_name (opt.def_digest_algo);
+	    badtype = PREFTYPE_HASH;
 	  }
-	else if(opt.cert_digest_algo
-		&& !algo_available(PREFTYPE_HASH,opt.cert_digest_algo,NULL))
+	else if (opt.cert_digest_algo
+		 && !algo_available (PREFTYPE_HASH,opt.cert_digest_algo,NULL))
 	  {
-	    badalg=digest_algo_to_string(opt.cert_digest_algo);
-	    badtype=PREFTYPE_HASH;
+	    badalg = gcry_md_algo_name (opt.cert_digest_algo);
+	    badtype = PREFTYPE_HASH;
 	  }
-	else if(opt.def_compress_algo!=-1
-		&& !algo_available(PREFTYPE_ZIP,opt.def_compress_algo,NULL))
+	else if (opt.def_compress_algo!=-1
+                 && !algo_available (PREFTYPE_ZIP,opt.def_compress_algo,NULL))
 	  {
-	    badalg=compress_algo_to_string(opt.def_compress_algo);
-	    badtype=PREFTYPE_ZIP;
+	    badalg = compress_algo_to_string (opt.def_compress_algo);
+	    badtype = PREFTYPE_ZIP;
 	  }
 
-	if(badalg)
+	if (badalg)
 	  {
 	    switch(badtype)
 	      {
@@ -2198,8 +2260,11 @@ main( int argc, char **argv )
     /* set the random seed file */
     if( use_random_seed ) {
 	char *p = make_filename(opt.homedir, "random_seed", NULL );
+#warning No random seed file yet
+#if 0
 	set_random_seed_file(p);
-	m_free(p);
+#endif
+	xfree (p);
     }
 
     if( !cmd && opt.fingerprint && !with_fpr ) {
@@ -2276,7 +2341,7 @@ main( int argc, char **argv )
       default: rc = setup_trustdb(1, trustdb_name ); break;
     }
     if( rc )
-	log_error(_("failed to initialize the TrustDB: %s\n"), g10_errstr(rc));
+	log_error(_("failed to initialize the TrustDB: %s\n"), gpg_strerror (rc));
 
 
     switch (cmd) {
@@ -2298,22 +2363,23 @@ main( int argc, char **argv )
 	if( argc > 1 )
 	    wrong_args(_("--store [filename]"));
 	if( (rc = encode_store(fname)) )
-	    log_error_f( print_fname_stdin(fname),
-			"store failed: %s\n", g10_errstr(rc) );
+	    log_error ("\b%s: store failed: %s\n",
+                       print_fname_stdin(fname), gpg_strerror (rc) );
 	break;
       case aSym: /* encrypt the given file only with the symmetric cipher */
 	if( argc > 1 )
 	    wrong_args(_("--symmetric [filename]"));
 	if( (rc = encode_symmetric(fname)) )
-	    log_error_f(print_fname_stdin(fname),
-			"symmetric encryption failed: %s\n",g10_errstr(rc) );
+	    log_error ("\b%s: symmetric encryption failed: %s\n",
+                       print_fname_stdin(fname), gpg_strerror (rc) );
 	break;
 
       case aEncr: /* encrypt the given file */
 	if( argc > 1 )
 	    wrong_args(_("--encrypt [filename]"));
 	if( (rc = encode_crypt(fname,remusr)) )
-	    log_error("%s: encryption failed: %s\n", print_fname_stdin(fname), g10_errstr(rc) );
+	    log_error("%s: encryption failed: %s\n",
+                      print_fname_stdin(fname), gpg_strerror (rc) );
 	break;
 
       case aEncrFiles: /* encrypt the given files */
@@ -2330,12 +2396,12 @@ main( int argc, char **argv )
 	    if( argc > 1 )
 		wrong_args(_("--sign [filename]"));
 	    if( argc ) {
-		sl = m_alloc_clear( sizeof *sl + strlen(fname));
+		sl = xcalloc (1, sizeof *sl + strlen(fname));
 		strcpy(sl->d, fname);
 	    }
 	}
 	if( (rc = sign_file( sl, detached_sig, locusr, 0, NULL, NULL)) )
-	    log_error("signing failed: %s\n", g10_errstr(rc) );
+	    log_error("signing failed: %s\n", gpg_strerror (rc) );
 	free_strlist(sl);
 	break;
 
@@ -2343,13 +2409,13 @@ main( int argc, char **argv )
 	if( argc > 1 )
 	    wrong_args(_("--sign --encrypt [filename]"));
 	if( argc ) {
-	    sl = m_alloc_clear( sizeof *sl + strlen(fname));
+	    sl = xcalloc (1, sizeof *sl + strlen(fname));
 	    strcpy(sl->d, fname);
 	}
 	else
 	    sl = NULL;
 	if( (rc = sign_file(sl, detached_sig, locusr, 1, remusr, NULL)) )
-	    log_error("%s: sign+encrypt failed: %s\n", print_fname_stdin(fname), g10_errstr(rc) );
+	    log_error("%s: sign+encrypt failed: %s\n", print_fname_stdin(fname), gpg_strerror (rc) );
 	free_strlist(sl);
 	break;
 
@@ -2359,7 +2425,7 @@ main( int argc, char **argv )
 	rc = sign_symencrypt_file (fname, locusr);
         if (rc)
 	    log_error("%s: sign+symmetric failed: %s\n",
-                      print_fname_stdin(fname), g10_errstr(rc) );
+                      print_fname_stdin(fname), gpg_strerror (rc) );
 	break;
 
       case aClearsign: /* make a clearsig */
@@ -2367,24 +2433,24 @@ main( int argc, char **argv )
 	    wrong_args(_("--clearsign [filename]"));
 	if( (rc = clearsign_file(fname, locusr, NULL)) )
 	    log_error("%s: clearsign failed: %s\n",
-                      print_fname_stdin(fname), g10_errstr(rc) );
+                      print_fname_stdin(fname), gpg_strerror (rc) );
 	break;
 
       case aVerify:
 	if( (rc = verify_signatures( argc, argv ) ))
-	    log_error("verify signatures failed: %s\n", g10_errstr(rc) );
+	    log_error("verify signatures failed: %s\n", gpg_strerror (rc) );
 	break;
 
       case aVerifyFiles:
 	if( (rc = verify_files( argc, argv ) ))
-	    log_error("verify files failed: %s\n", g10_errstr(rc) );
+	    log_error("verify files failed: %s\n", gpg_strerror (rc) );
 	break;
 
       case aDecrypt:
 	if( argc > 1 )
 	    wrong_args(_("--decrypt [filename]"));
 	if( (rc = decrypt_message( fname ) ))
-	    log_error("decrypt_message failed: %s\n", g10_errstr(rc) );
+	    log_error("decrypt_message failed: %s\n", gpg_strerror (rc) );
 	break;
 
       case aDecryptFiles:
@@ -2396,7 +2462,7 @@ main( int argc, char **argv )
 	    wrong_args(_("--sign-key user-id"));
 	username = make_username( fname );
 	keyedit_menu(fname, locusr, NULL, 1 );
-	m_free(username);
+	xfree (username);
 	break;
 
       case aLSignKey:
@@ -2404,7 +2470,7 @@ main( int argc, char **argv )
 	    wrong_args(_("--lsign-key user-id"));
 	username = make_username( fname );
 	keyedit_menu(fname, locusr, NULL, 2 );
-	m_free(username);
+	xfree (username);
 	break;
 
       case aNRSignKey:
@@ -2412,7 +2478,7 @@ main( int argc, char **argv )
 	    wrong_args(_("--nrsign-key user-id"));
 	username = make_username( fname );
 	keyedit_menu(fname, locusr, NULL, 3 );
-        m_free(username);
+        xfree (username);
         break;
 
       case aNRLSignKey:
@@ -2420,7 +2486,7 @@ main( int argc, char **argv )
 	    wrong_args(_("--nrlsign-key user-id"));
 	username = make_username( fname );
 	keyedit_menu(fname, locusr, NULL, 4 );
-        m_free(username);
+        xfree (username);
         break;
 
       case aEditKey: /* Edit a key signature */
@@ -2436,7 +2502,7 @@ main( int argc, char **argv )
 	}
 	else
 	    keyedit_menu(username, locusr, NULL, 0 );
-	m_free(username);
+	xfree (username);
 	break;
 
       case aDeleteKeys:
@@ -2534,11 +2600,11 @@ main( int argc, char **argv )
 	if(rc)
 	  {
 	    if(cmd==aSendKeys)
-	      log_error(_("keyserver send failed: %s\n"),g10_errstr(rc));
+	      log_error(_("keyserver send failed: %s\n"),gpg_strerror (rc));
 	    else if(cmd==aRecvKeys)
-	      log_error(_("keyserver receive failed: %s\n"),g10_errstr(rc));
+	      log_error(_("keyserver receive failed: %s\n"),gpg_strerror (rc));
 	    else
-	      log_error(_("key export failed: %s\n"),g10_errstr(rc));
+	      log_error(_("key export failed: %s\n"),gpg_strerror (rc));
 	  }
 	free_strlist(sl);
 	break;
@@ -2546,11 +2612,20 @@ main( int argc, char **argv )
      case aSearchKeys:
 	sl = NULL;
 	for( ; argc; argc--, argv++ )
-	  append_to_strlist2( &sl, *argv, utf8_strings );
+          {
+            if (utf8_strings)
+              sl = append_to_strlist ( &sl, *argv );
+            else
+              {
+                char *p = native_to_utf8 ( *argv );
+                sl = append_to_strlist( &sl, p );
+                xfree( p );
+              }
+          }
 
 	rc=keyserver_search( sl );
 	if(rc)
-	  log_error(_("keyserver search failed: %s\n"),g10_errstr(rc));
+	  log_error(_("keyserver search failed: %s\n"),gpg_strerror (rc));
 	free_strlist(sl);
 	break;
 
@@ -2560,7 +2635,7 @@ main( int argc, char **argv )
 	    add_to_strlist2( &sl, *argv, utf8_strings );
 	rc=keyserver_refresh(sl);
 	if(rc)
-	  log_error(_("keyserver refresh failed: %s\n"),g10_errstr(rc));
+	  log_error(_("keyserver refresh failed: %s\n"),gpg_strerror (rc));
 	free_strlist(sl);
 	break;
 
@@ -2585,7 +2660,7 @@ main( int argc, char **argv )
 	    wrong_args("--gen-revoke user-id");
 	username =  make_username(*argv);
 	gen_revoke( username );
-	m_free( username );
+	xfree ( username );
 	break;
 
       case aDesigRevoke:
@@ -2593,7 +2668,7 @@ main( int argc, char **argv )
 	    wrong_args("--desig-revoke user-id");
 	username =  make_username(*argv);
 	gen_desig_revoke( username );
-	m_free( username );
+	xfree ( username );
 	break;
 
       case aDeArmor:
@@ -2601,7 +2676,7 @@ main( int argc, char **argv )
 	    wrong_args("--dearmor [file]");
 	rc = dearmor_file( argc? *argv: NULL );
 	if( rc )
-	    log_error(_("dearmoring failed: %s\n"), g10_errstr(rc));
+	    log_error(_("dearmoring failed: %s\n"), gpg_strerror (rc));
 	break;
 
       case aEnArmor:
@@ -2609,11 +2684,12 @@ main( int argc, char **argv )
 	    wrong_args("--enarmor [file]");
 	rc = enarmor_file( argc? *argv: NULL );
 	if( rc )
-	    log_error(_("enarmoring failed: %s\n"), g10_errstr(rc));
+	    log_error(_("enarmoring failed: %s\n"), gpg_strerror (rc));
 	break;
 
 
       case aPrimegen:
+#if 0 /*FIXME-XXX*/
 	{   int mode = argc < 2 ? 0 : atoi(*argv);
 
 	    if( mode == 1 && argc == 2 ) {
@@ -2625,7 +2701,7 @@ main( int argc, char **argv )
 					     atoi(argv[2]), NULL,NULL ), 1);
 	    }
 	    else if( mode == 3 && argc == 3 ) {
-		MPI *factors;
+		gcry_mpi_t *factors;
 		mpi_print( stdout, generate_elg_prime(
 					     1, atoi(argv[1]),
 					     atoi(argv[2]), NULL,&factors ), 1);
@@ -2633,7 +2709,7 @@ main( int argc, char **argv )
 		mpi_print( stdout, factors[0], 1 ); /* print q */
 	    }
 	    else if( mode == 4 && argc == 3 ) {
-		MPI g = mpi_alloc(1);
+		gcry_mpi_t g = mpi_alloc(1);
 		mpi_print( stdout, generate_elg_prime(
 						 0, atoi(argv[1]),
 						 atoi(argv[2]), g, NULL ), 1);
@@ -2645,6 +2721,7 @@ main( int argc, char **argv )
 		wrong_args("--gen-prime mode bits [qbits] ");
 	    putchar('\n');
 	}
+#endif
 	break;
 
       case aGenRandom:
@@ -2664,14 +2741,14 @@ main( int argc, char **argv )
                    other tools */
 		size_t n = !endless && count < 99? count : 99;
 
-		p = get_random_bits( n*8, level, 0);
+		p = gcry_random_bytes (n, level);
 #ifdef HAVE_DOSISH_SYSTEM
 		setmode ( fileno(stdout), O_BINARY );
 #endif
                 if (opt.armor) {
                     char *tmp = make_radix64_string (p, n);
                     fputs (tmp, stdout);
-                    m_free (tmp);
+                    xfree (tmp);
                     if (n%3 == 1)
                       putchar ('=');
                     if (n%3)
@@ -2679,7 +2756,7 @@ main( int argc, char **argv )
                 } else {
                     fwrite( p, n, 1, stdout );
                 }
-		m_free(p);
+		xfree (p);
 		if( !endless )
 		    count -= n;
 	    }
@@ -2693,7 +2770,7 @@ main( int argc, char **argv )
 	    wrong_args("--print-md algo [files]");
 	{
 	    int all_algos = (**argv=='*' && !(*argv)[1]);
-	    int algo = all_algos? 0 : string_to_digest_algo(*argv);
+	    int algo = all_algos? 0 : gcry_md_map_name (*argv);
 
 	    if( !algo && !all_algos )
 		log_error(_("invalid hash algorithm `%s'\n"), *argv );
@@ -2750,7 +2827,7 @@ main( int argc, char **argv )
 	for( ; argc; argc--, argv++ ) {
 	    username = make_username( *argv );
 	    list_trust_path( username );
-	    m_free(username);
+	    xfree (username);
 	}
 	break;
 
@@ -2804,7 +2881,7 @@ main( int argc, char **argv )
 	    }
 	    rc = proc_packets(NULL, a );
 	    if( rc )
-		log_error("processing message failed: %s\n", g10_errstr(rc) );
+		log_error("processing message failed: %s\n", gpg_strerror (rc) );
 	    iobuf_close(a);
 	}
 	break;
@@ -2821,14 +2898,14 @@ main( int argc, char **argv )
 void
 g10_exit( int rc )
 {
-    update_random_seed_file();
-    if( opt.debug & DBG_MEMSTAT_VALUE ) {
-	m_print_stats("on exit");
-	random_dump_stats();
-    }
-    if( opt.debug )
-	secmem_dump_stats();
-    secmem_term();
+  /* FIXME-XX update_random_seed_file(); */
+/*      if( opt.debug & DBG_MEMSTAT_VALUE ) { */
+/*          m_print_stats("on exit"); */
+/*  	random_dump_stats(); */
+/*      } */
+/*      if( opt.debug ) */
+/*  	secmem_dump_stats(); */
+    gcry_control (GCRYCTL_TERM_SECMEM );
     rc = rc? rc : log_get_errorcount(0)? 2 :
 			g10_errors_seen? 1 : 0;
     exit(rc );
@@ -2858,14 +2935,14 @@ print_hex( MD_HANDLE md, int algo, const char *fname )
   else if(algo==DIGEST_ALGO_TIGER)
     indent+=printf(" TIGER = ");
   else if(algo>0)
-    indent+=printf("%6s = ",digest_algo_to_string(algo));
+    indent+=printf("%6s = ", gcry_md_algo_name (algo));
   else
     algo=abs(algo);
 
   count=indent;
 
-  p = md_read( md, algo );
-  n = md_digest_length(algo);
+  p = gcry_md_read (md, algo);
+  n = gcry_md_get_algo_dlen (algo);
 
   count+=printf("%02X",*p++);
 
@@ -2936,8 +3013,8 @@ print_hashline( MD_HANDLE md, int algo, const char *fname )
     }
     putchar(':');
     printf("%d:", algo );
-    p = md_read( md, algo );
-    n = md_digest_length(algo);
+    p = gcry_md_read (md, algo );
+    n = gcry_md_get_algo_dlen (algo);
     for(i=0; i < n ; i++, p++ ) 
         printf("%02X", *p );
     putchar(':');
@@ -2966,47 +3043,47 @@ print_mds( const char *fname, int algo )
 	return;
     }
 
-    md = md_open( 0, 0 );
+    gcry_md_open (&md, 0, 0 );
     if( algo )
-	md_enable( md, algo );
+	gcry_md_enable ( md, algo );
     else {
-	md_enable( md, DIGEST_ALGO_MD5 );
-	md_enable( md, DIGEST_ALGO_SHA1 );
-	md_enable( md, DIGEST_ALGO_RMD160 );
+	gcry_md_enable (md, GCRY_MD_MD5 );
+	gcry_md_enable (md, GCRY_MD_SHA1 );
+	gcry_md_enable (md, GCRY_MD_RMD160 );
 #ifdef USE_TIGER192
-	md_enable( md, DIGEST_ALGO_TIGER );
+	gcry_md_enable (md, GCRY_MD_TIGER );
 #endif
 #ifdef USE_SHA256
-	md_enable( md, DIGEST_ALGO_SHA256 );
+	gcry_md_enable (md, GCRY_MD_SHA256 );
 #endif
 #ifdef USE_SHA512
-	md_enable( md, DIGEST_ALGO_SHA384 );
-	md_enable( md, DIGEST_ALGO_SHA512 );
+	gcry_md_enable (md, GCRY_MD_SHA384 );
+	gcry_md_enable (md, GCRY_MD_SHA512 );
 #endif
     }
 
     while( (n=fread( buf, 1, DIM(buf), fp )) )
-	md_write( md, buf, n );
+	gcry_md_write (md, buf, n);
     if( ferror(fp) )
 	log_error("%s: %s\n", fname?fname:"[stdin]", strerror(errno) );
     else {
-	md_final(md);
+	gcry_md_final (md);
         if ( opt.with_colons ) {
             if ( algo ) 
                 print_hashline( md, algo, fname );
             else {
-                print_hashline( md, DIGEST_ALGO_MD5, fname );
-                print_hashline( md, DIGEST_ALGO_SHA1, fname );
-                print_hashline( md, DIGEST_ALGO_RMD160, fname );
+                print_hashline( md, GCRY_MD_MD5, fname );
+                print_hashline( md, GCRY_MD_SHA1, fname );
+                print_hashline( md, GCRY_MD_RMD160, fname );
 #ifdef USE_TIGER192
-		print_hashline( md, DIGEST_ALGO_TIGER, fname );
+		print_hashline( md, GCRY_MD_TIGER, fname );
 #endif
 #ifdef USE_SHA256
-                print_hashline( md, DIGEST_ALGO_SHA256, fname );
+                print_hashline( md, GCRY_MD_SHA256, fname );
 #endif
 #ifdef USE_SHA512
-		print_hashline( md, DIGEST_ALGO_SHA384, fname );
-		print_hashline( md, DIGEST_ALGO_SHA512, fname );
+		print_hashline( md, GCRY_MD_SHA384, fname );
+		print_hashline( md, GCRY_MD_SHA512, fname );
 #endif
             }
         }
@@ -3014,23 +3091,23 @@ print_mds( const char *fname, int algo )
             if( algo )
 	       print_hex(md,-algo,fname);
             else {
-                print_hex( md, DIGEST_ALGO_MD5, fname );
-                print_hex( md, DIGEST_ALGO_SHA1, fname );
-                print_hex( md, DIGEST_ALGO_RMD160, fname );
+                print_hex( md, GCRY_MD_MD5, fname );
+                print_hex( md, GCRY_MD_SHA1, fname );
+                print_hex( md, GCRY_MD_RMD160, fname );
 #ifdef USE_TIGER192
-		print_hex( md, DIGEST_ALGO_TIGER, fname );
+		print_hex( md, GCRY_MD_TIGER, fname );
 #endif
 #ifdef USE_SHA256
-                print_hex( md, DIGEST_ALGO_SHA256, fname );
+                print_hex( md, GCRY_MD_SHA256, fname );
 #endif
 #ifdef USE_SHA512
-		print_hex( md, DIGEST_ALGO_SHA384, fname );
-		print_hex( md, DIGEST_ALGO_SHA512, fname );
+		print_hex( md, GCRY_MD_SHA384, fname );
+		print_hex( md, GCRY_MD_SHA512, fname );
 #endif
             }
         }
     }
-    md_close(md);
+    gcry_md_close (md);
 
     if( fp != stdin )
 	fclose(fp);
diff --git a/g10/getkey.c b/g10/getkey.c
index 1944c2a8d..79fcaf3e2 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -25,6 +25,8 @@
 #include <string.h>
 #include <assert.h>
 #include <ctype.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "packet.h"
 #include "memory.h"
@@ -152,7 +154,7 @@ cache_public_key( PKT_public_key *pk )
 	return;
     }
     pk_cache_entries++;
-    ce = m_alloc( sizeof *ce );
+    ce = xmalloc ( sizeof *ce );
     ce->next = pk_cache;
     pk_cache = ce;
     ce->pk = copy_public_key( NULL, pk );
@@ -195,7 +197,7 @@ release_keyid_list ( keyid_list_t k )
 {
     while (  k ) {
         keyid_list_t k2 = k->next;
-        m_free (k);
+        xfree (k);
         k = k2;
     }
 }
@@ -216,7 +218,7 @@ cache_user_id( KBNODE keyblock )
     for (k=keyblock; k; k = k->next ) {
         if ( k->pkt->pkttype == PKT_PUBLIC_KEY
              || k->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
-            keyid_list_t a = m_alloc_clear ( sizeof *a );
+            keyid_list_t a = xcalloc (1, sizeof *a );
             /* Hmmm: For a long list of keyids it might be an advantage
              * to append the keys */
             keyid_from_pk( k->pkt->pkt.public_key, a->keyid );
@@ -229,7 +231,7 @@ cache_user_id( KBNODE keyblock )
                         if( DBG_CACHE )
                             log_debug("cache_user_id: already in cache\n");
                         release_keyid_list ( keyids );
-                        m_free ( a );
+                        xfree ( a );
                         return;
                     }
                 }
@@ -250,10 +252,10 @@ cache_user_id( KBNODE keyblock )
 	r = user_id_db;
 	user_id_db = r->next;
         release_keyid_list ( r->keyids );
-	m_free(r);
+	xfree (r);
 	uid_cache_entries--;
     }
-    r = m_alloc( sizeof *r + uidlen-1 );
+    r = xmalloc ( sizeof *r + uidlen-1 );
     r->keyids = keyids;
     r->len = uidlen;
     memcpy(r->name, uid, r->len);
@@ -273,7 +275,7 @@ getkey_disable_caches()
 	for( ce = pk_cache; ce; ce = ce2 ) {
 	    ce2 = ce->next;
 	    free_public_key( ce->pk );
-	    m_free( ce );
+	    xfree ( ce );
 	}
 	pk_cache_disabled=1;
 	pk_cache_entries = 0;
@@ -333,7 +335,7 @@ get_pubkey( PKT_public_key *pk, u32 *keyid )
 #endif
     /* more init stuff */
     if( !pk ) {
-	pk = m_alloc_clear( sizeof *pk );
+	pk = xcalloc (1, sizeof *pk );
 	internal++;
     }
 
@@ -361,7 +363,7 @@ get_pubkey( PKT_public_key *pk, u32 *keyid )
     if( !rc )
 	goto leave;
 
-    rc = G10ERR_NO_PUBKEY;
+    rc = GPG_ERR_NO_PUBKEY;
 
   leave:
     if( !rc )
@@ -404,14 +406,14 @@ get_pubkey_fast (PKT_public_key *pk, u32 *keyid)
   if (rc == -1)
     {
       keydb_release (hd);
-      return G10ERR_NO_PUBKEY;
+      return GPG_ERR_NO_PUBKEY;
     }
   rc = keydb_get_keyblock (hd, &keyblock);
   keydb_release (hd);
   if (rc) 
     {
-      log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
-      return G10ERR_NO_PUBKEY;
+      log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
+      return GPG_ERR_NO_PUBKEY;
     }
   
   assert ( keyblock->pkt->pkttype == PKT_PUBLIC_KEY
@@ -494,7 +496,7 @@ get_seckey( PKT_secret_key *sk, u32 *keyid )
  * check and does not tell us whether the secret key is valid.  It
  * merely tells other whether there is some secret key.
  * Returns: 0 := key is available
- * G10ERR_NO_SECKEY := not availabe
+ * GPG_ERR_NO_SECKEY := not availabe
  */
 int
 seckey_available( u32 *keyid )
@@ -504,7 +506,7 @@ seckey_available( u32 *keyid )
 
     rc = keydb_search_kid (hd, keyid);
     if ( rc == -1 )
-        rc = G10ERR_NO_SECKEY;
+        rc = GPG_ERR_NO_SECKEY;
     keydb_release (hd);
     return rc;
 }
@@ -729,13 +731,13 @@ static int
 skip_disabled(void *dummy,u32 *keyid)
 {
   int rc,disabled=0;
-  PKT_public_key *pk=m_alloc_clear(sizeof(PKT_public_key));
+  PKT_public_key *pk=xcalloc (1,sizeof(PKT_public_key));
 
   rc = get_pubkey(pk, keyid);
   if(rc)
     {
       log_error("error checking disabled status of %08lX: %s\n",
- 		(ulong)keyid[1],g10_errstr(rc));
+ 		(ulong)keyid[1],gpg_strerror (rc));
       goto leave;
     }
  
@@ -778,7 +780,7 @@ key_byname( GETKEY_CTX *retctx, STRLIST namelist,
     /* build the search context */
     for(n=0, r=namelist; r; r = r->next )
 	n++;
-    ctx = m_alloc_clear (sizeof *ctx + (n-1)*sizeof ctx->items );
+    ctx = xcalloc (1,sizeof *ctx + (n-1)*sizeof ctx->items );
     ctx->nitems = n;
 
     for(n=0, r=namelist; r; r = r->next, n++ ) {
@@ -787,8 +789,8 @@ key_byname( GETKEY_CTX *retctx, STRLIST namelist,
         if (ctx->items[n].exact)
             ctx->exact = 1;
         if (!ctx->items[n].mode) {
-	    m_free (ctx);
-	    return G10ERR_INV_USER_ID;
+	    xfree (ctx);
+	    return GPG_ERR_INV_USER_ID;
 	}
 	if(!include_disabled
  	   && ctx->items[n].mode!=KEYDB_SEARCH_MODE_SHORT_KID
@@ -886,7 +888,7 @@ get_pubkey_end( GETKEY_CTX ctx )
         memset (&ctx->kbpos, 0, sizeof ctx->kbpos);
         keydb_release (ctx->kr_handle);
 	if( !ctx->not_allocated )
-	    m_free( ctx );
+	    xfree ( ctx );
     }
 }
 
@@ -924,7 +926,7 @@ get_pubkey_byfprint( PKT_public_key *pk,
 	get_pubkey_end( &ctx );
     }
     else
-	rc = G10ERR_GENERAL; /* Oops */
+	rc = GPG_ERR_GENERAL; /* Oops */
     return rc;
 }
 
@@ -954,14 +956,14 @@ get_pubkey_byfprint_fast (PKT_public_key *pk,
   if (rc == -1)
     {
       keydb_release (hd);
-      return G10ERR_NO_PUBKEY;
+      return GPG_ERR_NO_PUBKEY;
     }
   rc = keydb_get_keyblock (hd, &keyblock);
   keydb_release (hd);
   if (rc) 
     {
-      log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
-      return G10ERR_NO_PUBKEY;
+      log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
+      return GPG_ERR_NO_PUBKEY;
     }
   
   assert ( keyblock->pkt->pkttype == PKT_PUBLIC_KEY
@@ -1000,7 +1002,7 @@ get_keyblock_byfprint( KBNODE *ret_keyblock, const byte *fprint,
 	get_pubkey_end( &ctx );
     }
     else
-	rc = G10ERR_GENERAL; /* Oops */
+	rc = GPG_ERR_GENERAL; /* Oops */
 
     return rc;
 }
@@ -1118,7 +1120,7 @@ get_seckey_byfprint( PKT_secret_key *sk,
 	get_pubkey_end( &ctx );
     }
     else
-	rc = G10ERR_GENERAL; /* Oops */
+	rc = GPG_ERR_GENERAL; /* Oops */
     return rc;
 }
 
@@ -1290,12 +1292,12 @@ fixup_uidnode ( KBNODE uidnode, KBNODE signode, u32 keycreated )
     p = parse_sig_subpkt ( sig->hashed, SIGSUBPKT_PREF_COMPR, &n );
     zip = p; nzip = p?n:0;
     if (uid->prefs) 
-        m_free (uid->prefs);
+        xfree (uid->prefs);
     n = nsym + nhash + nzip;
     if (!n)
         uid->prefs = NULL;
     else {
-        uid->prefs = m_alloc (sizeof (*uid->prefs) * (n+1));
+        uid->prefs = xmalloc (sizeof (*uid->prefs) * (n+1));
         n = 0;
         for (; nsym; nsym--, n++) {
             uid->prefs[n].type = PREFTYPE_SYM;
@@ -1364,7 +1366,7 @@ merge_selfsigs_main( KBNODE keyblock, int *r_revoked )
      */
 
     /* In case this key was already merged */
-    m_free(pk->revkey);
+    xfree (pk->revkey);
     pk->revkey=NULL;
     pk->numrevkeys=0;
 
@@ -1400,7 +1402,7 @@ merge_selfsigs_main( KBNODE keyblock, int *r_revoked )
 		    int i;
 
 		    pk->revkey=
-		      m_realloc(pk->revkey,sizeof(struct revocation_key)*
+		      xrealloc(pk->revkey,sizeof(struct revocation_key)*
 				(pk->numrevkeys+sig->numrevkeys));
 
 		    for(i=0;i<sig->numrevkeys;i++)
@@ -1451,7 +1453,7 @@ merge_selfsigs_main( KBNODE keyblock, int *r_revoked )
 	  }
 
 	if(changed)
-	  pk->revkey=m_realloc(pk->revkey,
+	  pk->revkey=xrealloc(pk->revkey,
 			       pk->numrevkeys*sizeof(struct revocation_key));
       }
 
@@ -1594,7 +1596,7 @@ merge_selfsigs_main( KBNODE keyblock, int *r_revoked )
 		  {
 		    PKT_public_key *ultimate_pk;
 
-		    ultimate_pk=m_alloc_clear(sizeof(*ultimate_pk));
+		    ultimate_pk=xcalloc (1,sizeof(*ultimate_pk));
 
                     /* We don't want to use the full get_pubkey to
                        avoid infinite recursion in certain cases.
@@ -1969,7 +1971,7 @@ merge_selfsigs( KBNODE keyblock )
              || k->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
             PKT_public_key *pk = k->pkt->pkt.public_key;
             if (pk->prefs)
-                m_free (pk->prefs);
+                xfree (pk->prefs);
             pk->prefs = copy_prefs (prefs);
             pk->mdc_feature = mdc_feature;
         }
@@ -2326,7 +2328,7 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
 
         rc = keydb_get_keyblock (ctx->kr_handle, &ctx->keyblock);
         if (rc) {
-            log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
+            log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
             rc = 0;
             goto skip;
         }
@@ -2383,16 +2385,16 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
 
   found:
     if( rc && rc != -1 )
-	log_error("keydb_search failed: %s\n", g10_errstr(rc));
+	log_error("keydb_search failed: %s\n", gpg_strerror (rc));
 
     if( !rc ) {
         *ret_keyblock = ctx->keyblock; /* return the keyblock */
         ctx->keyblock = NULL;
     }
     else if (rc == -1 && no_suitable_key)
-        rc = secmode ? G10ERR_UNU_SECKEY : G10ERR_UNU_PUBKEY;
+         rc = secmode ? GPG_ERR_UNUSABLE_SECKEY : GPG_ERR_UNUSABLE_PUBKEY;
     else if( rc == -1 )
-	rc = secmode ? G10ERR_NO_SECKEY : G10ERR_NO_PUBKEY;
+	rc = secmode ? GPG_ERR_NO_SECKEY : GPG_ERR_NO_PUBKEY;
 
     if ( secmode ) {
         release_kbnode( secblock );
@@ -2442,7 +2444,7 @@ enum_secret_keys( void **context, PKT_secret_key *sk,
 
 
     if( !c ) { /* make a new context */
-	c = m_alloc_clear( sizeof *c );
+	c = xcalloc (1, sizeof *c );
 	*context = c;
 	c->hd = keydb_new (1);
         c->first = 1;
@@ -2453,7 +2455,7 @@ enum_secret_keys( void **context, PKT_secret_key *sk,
     if( !sk ) { /* free the context */
         keydb_release (c->hd);
         release_kbnode (c->keyblock);
-	m_free( c );
+	xfree ( c );
 	*context = NULL;
 	return 0;
     }
@@ -2514,7 +2516,7 @@ get_user_id_string( u32 *keyid )
             keyid_list_t a;
             for (a=r->keyids; a; a= a->next ) {
                 if( a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1] ) {
-                    p = m_alloc( r->len + 10 );
+                    p = xmalloc ( r->len + 10 );
                     sprintf(p, "%08lX %.*s",
                             (ulong)keyid[1], r->len, r->name );
                     return p;
@@ -2522,7 +2524,7 @@ get_user_id_string( u32 *keyid )
             }
         }
     } while( ++pass < 2 && !get_pubkey( NULL, keyid ) );
-    p = m_alloc( 15 );
+    p = xmalloc ( 15 );
     sprintf(p, "%08lX [?]", (ulong)keyid[1] );
     return p;
 }
@@ -2533,9 +2535,9 @@ get_user_id_string_printable ( u32 *keyid )
 {
     char *p = get_user_id_string( keyid );
     char *p2 = utf8_to_native( p, strlen(p), 0 );
-    m_free(p);
+    xfree (p);
     p = make_printable_string (p2, strlen (p2), 0);
-    m_free (p2);
+    xfree (p2);
     return p;
 }
 
@@ -2552,7 +2554,7 @@ get_long_user_id_string( u32 *keyid )
             keyid_list_t a;
             for (a=r->keyids; a; a= a->next ) {
                 if( a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1] ) {
-                    p = m_alloc( r->len + 20 );
+                    p = xmalloc ( r->len + 20 );
                     sprintf(p, "%08lX%08lX %.*s",
                             (ulong)keyid[0], (ulong)keyid[1],
                             r->len, r->name );
@@ -2561,7 +2563,7 @@ get_long_user_id_string( u32 *keyid )
             }
         }
     } while( ++pass < 2 && !get_pubkey( NULL, keyid ) );
-    p = m_alloc( 25 );
+    p = xmalloc ( 25 );
     sprintf(p, "%08lX%08lX [?]", (ulong)keyid[0], (ulong)keyid[1] );
     return p;
 }
@@ -2579,7 +2581,7 @@ get_user_id( u32 *keyid, size_t *rn )
             keyid_list_t a;
             for (a=r->keyids; a; a= a->next ) {
                 if( a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1] ) {
-                    p = m_alloc( r->len );
+                    p = xmalloc ( r->len );
                     memcpy(p, r->name, r->len );
                     *rn = r->len;
                     return p;
@@ -2587,7 +2589,7 @@ get_user_id( u32 *keyid, size_t *rn )
             }
         }
     } while( ++pass < 2 && !get_pubkey( NULL, keyid ) );
-    p = m_strdup( _("[User id not found]") );
+    p = xstrdup ( _("[User id not found]") );
     *rn = strlen(p);
     return p;
 }
@@ -2598,9 +2600,9 @@ get_user_id_printable( u32 *keyid )
     size_t rn;
     char *p = get_user_id( keyid, &rn );
     char *p2 = utf8_to_native( p, rn, 0 );
-    m_free(p);
+    xfree (p);
     p = make_printable_string (p2, strlen (p2), 0);
-    m_free (p2);
+    xfree (p2);
     return p;
 }
 
diff --git a/g10/global.h b/g10/global.h
index 3c4e59ec4..d1c554dce 100644
--- a/g10/global.h
+++ b/g10/global.h
@@ -26,4 +26,6 @@
 typedef struct kbnode_struct *KBNODE;
 typedef struct keydb_search_desc KEYDB_SEARCH_DESC;
 
+#include "gpg.h"
+
 #endif /*GPG_GLOBAL_H*/
diff --git a/g10/gpg.h b/g10/gpg.h
index ca7699bca..bf61411f7 100644
--- a/g10/gpg.h
+++ b/g10/gpg.h
@@ -20,6 +20,11 @@
 #ifndef GNUPG_G10_GPG_H
 #define GNUPG_G10_GPG_H 
 
+/* Note, that this file should be the first one after the system
+   header files.  This is required to set the error source to the
+   correct value and may be of advantage if we ever have to do
+   special things. */
+
 #ifdef GPG_ERR_SOURCE_DEFAULT
 #error GPG_ERR_SOURCE_DEFAULT already defined
 #endif
diff --git a/g10/gpgv.c b/g10/gpgv.c
index 67ecceabf..91574a78b 100644
--- a/g10/gpgv.c
+++ b/g10/gpgv.c
@@ -30,6 +30,7 @@
 #endif
 
 #define INCLUDED_BY_MAIN_MODULE 1
+#include "gpg.h"
 #include "packet.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -82,8 +83,8 @@ int g10_errors_seen = 0;
 RISCOS_GLOBAL_STATICS("GnuPG (gpgv) Heap")
 #endif /* __riscos__ */
 
-const char *
-strusage( int level )
+static const char *
+my_strusage( int level )
 {
     const char *p;
     switch( level ) {
@@ -103,7 +104,7 @@ strusage( int level )
 	      "Check signatures against known trusted keys\n");
 	break;
 
-      default:	p = default_strusage(level);
+      default:	p = NULL;
     }
     return p;
 }
@@ -124,7 +125,7 @@ i18n_init(void)
 #else
        setlocale( LC_ALL, "" );
 #endif
-    bindtextdomain( PACKAGE, G10_LOCALEDIR );
+    bindtextdomain( PACKAGE, LOCALEDIR );
     textdomain( PACKAGE );
 #endif
 #endif
@@ -144,7 +145,8 @@ main( int argc, char **argv )
     riscos_global_defaults();
 #endif /* __riscos__ */
 
-    log_set_name("gpgv");
+    set_strusage (my_strusage);
+    log_set_prefix ("gpgv", 1);
     init_signals();
     i18n_init();
     opt.command_fd = -1; /* no command fd */
@@ -177,7 +179,9 @@ main( int argc, char **argv )
 		  opt.verbose++; opt.list_sigs=1; break;
           case oKeyring: append_to_strlist( &nrings, pargs.r.ret_str); break;
 	  case oStatusFD: set_status_fd( pargs.r.ret_int ); break;
-	  case oLoggerFD: log_set_logfile( NULL, pargs.r.ret_int ); break;
+	  case oLoggerFD: 
+            log_set_fd (iobuf_translate_file_handle (pargs.r.ret_int, 1));
+            break;
 	  case oHomedir: opt.homedir = pargs.r.ret_str; break;
 	  case oIgnoreTimeConflict: opt.ignore_time_conflict = 1; break;
 	  default : pargs.err = 2; break;
@@ -200,7 +204,7 @@ main( int argc, char **argv )
     FREE_STRLIST(nrings);
     
     if( (rc = verify_signatures( argc, argv ) ))
-        log_error("verify signatures failed: %s\n", g10_errstr(rc) );
+        log_error("verify signatures failed: %s\n", gpg_strerror (rc) );
 
     /* cleanup */
     g10_exit(0);
@@ -287,19 +291,19 @@ keyserver_import_keyid( u32 *keyid, void *dummy )
 int
 get_session_key( PKT_pubkey_enc *k, DEK *dek )
 {
-    return G10ERR_GENERAL;
+    return GPG_ERR_GENERAL;
 }
 /* Stub: */
 int
 get_override_session_key( DEK *dek, const char *string )
 {
-    return G10ERR_GENERAL;
+    return GPG_ERR_GENERAL;
 }
 /* Stub: */
 int
 decrypt_data( void *procctx, PKT_encrypted *ed, DEK *dek )
 {
-    return G10ERR_GENERAL;
+    return GPG_ERR_GENERAL;
 }
 
 
@@ -317,7 +321,7 @@ display_online_help( const char *keyword )
 int
 check_secret_key( PKT_secret_key *sk, int n )
 {
-    return G10ERR_GENERAL;
+    return GPG_ERR_GENERAL;
 }
 
 /* Stub:
@@ -355,26 +359,6 @@ void cipher_decrypt( CIPHER_HANDLE c, byte *outbuf,
                      byte *inbuf, unsigned nbytes ) {}
 void cipher_sync( CIPHER_HANDLE c ) {}
 
-/* Stubs to avoid linking to ../cipher/random.c */
-void random_dump_stats(void) {}
-int quick_random_gen( int onoff ) { return -1;}
-void randomize_buffer( byte *buffer, size_t length, int level ) {}
-int random_is_faked() { return -1;}
-byte *get_random_bits( size_t nbits, int level, int secure ) { return NULL;}
-void set_random_seed_file( const char *name ) {}
-void update_random_seed_file() {}
-void fast_random_poll() {}
-
-/* Stubs to avoid linking of ../cipher/primegen.c */
-void register_primegen_progress ( void (*cb)( void *, int), void *cb_data ) {}
-MPI generate_secret_prime( unsigned  nbits ) { return NULL;}
-MPI generate_public_prime( unsigned  nbits ) { return NULL;}
-MPI generate_elg_prime( int mode, unsigned pbits, unsigned qbits,
-                        MPI g, MPI **ret_factors ) { return NULL;}
-
-/* Do not link to ../cipher/rndlinux.c */
-void rndlinux_constructor(void) {}
-
 
 /* Stubs to avoid linking to ../util/ttyio.c */
 int tty_batchmode( int onoff ) { return 0; }
@@ -393,4 +377,4 @@ void disable_dotlock(void) {}
 DOTLOCK create_dotlock( const char *file_to_lock ) { return NULL; }
 int make_dotlock( DOTLOCK h, long timeout ) { return 0;}
 int release_dotlock( DOTLOCK h ) {return 0;}
-void remove_lockfiles(void) {}
+void dotlock_remove_lockfiles(void) {}
diff --git a/g10/helptext.c b/g10/helptext.c
index 0150c549c..4a65314eb 100644
--- a/g10/helptext.c
+++ b/g10/helptext.c
@@ -22,6 +22,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "ttyio.h"
 #include "main.h"
diff --git a/g10/import.c b/g10/import.c
index 1b955c412..94e8914ec 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -56,9 +56,9 @@ struct stats_s {
 };
 
 
-static int import( IOBUF inp, const char* fname,
+static int import( iobuf_t inp, const char* fname,
                    struct stats_s *stats, unsigned int options );
-static int read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root );
+static int read_block( iobuf_t a, PACKET **pending_pkt, KBNODE *ret_root );
 static void revocation_present(KBNODE keyblock);
 static int import_one( const char *fname, KBNODE keyblock,
                        struct stats_s *stats, unsigned int options);
@@ -101,13 +101,13 @@ parse_import_options(char *str,unsigned int *options)
 void *
 import_new_stats_handle (void)
 {
-    return m_alloc_clear ( sizeof (struct stats_s) );
+    return xcalloc (1, sizeof (struct stats_s) );
 }
 
 void
 import_release_stats_handle (void *p)
 {
-    m_free (p);
+    xfree (p);
 }
 
 /****************
@@ -142,7 +142,7 @@ import_release_stats_handle (void *p)
  *
  */
 static int
-import_keys_internal( IOBUF inp, char **fnames, int nnames,
+import_keys_internal( iobuf_t inp, char **fnames, int nnames,
 		      void *stats_handle, unsigned int options )
 {
     int i, rc = 0;
@@ -160,7 +160,7 @@ import_keys_internal( IOBUF inp, char **fnames, int nnames,
 
 	for(i=0; i < nnames; i++ ) {
 	    const char *fname = fnames? fnames[i] : NULL;
-	    IOBUF inp2 = iobuf_open(fname);
+	    iobuf_t inp2 = iobuf_open(fname);
 	    if( !fname )
 	        fname = "[stdin]";
 	    if( !inp2 )
@@ -170,7 +170,7 @@ import_keys_internal( IOBUF inp, char **fnames, int nnames,
 	        iobuf_close(inp2);
 	        if( rc )
 		    log_error("import from `%s' failed: %s\n", fname,
-       	                      g10_errstr(rc) );
+       	                      gpg_strerror (rc) );
 	    }
 	    if( !fname )
 	        break;
@@ -204,13 +204,13 @@ import_keys( char **fnames, int nnames,
 }
 
 int
-import_keys_stream( IOBUF inp, void *stats_handle, unsigned int options )
+import_keys_stream( iobuf_t inp, void *stats_handle, unsigned int options )
 {
     return import_keys_internal( inp, NULL, 0, stats_handle, options);
 }
 
 static int
-import( IOBUF inp, const char* fname,
+import( iobuf_t inp, const char* fname,
 	struct stats_s *stats, unsigned int options )
 {
     PACKET *pending_pkt = NULL;
@@ -220,7 +220,7 @@ import( IOBUF inp, const char* fname,
     getkey_disable_caches();
 
     if( !opt.no_armor ) { /* armored reading is not disabled */
-	armor_filter_context_t *afx = m_alloc_clear( sizeof *afx );
+	armor_filter_context_t *afx = xcalloc (1, sizeof *afx );
 	afx->only_keyblocks = 1;
 	iobuf_push_filter2( inp, armor_filter, afx, 1 );
     }
@@ -247,8 +247,8 @@ import( IOBUF inp, const char* fname,
     }
     if( rc == -1 )
 	rc = 0;
-    else if( rc && rc != G10ERR_INV_KEYRING )
-	log_error( _("error reading `%s': %s\n"), fname, g10_errstr(rc));
+    else if( rc && rc != GPG_ERR_INV_KEYRING )
+	log_error( _("error reading `%s': %s\n"), fname, gpg_strerror (rc));
 
     return rc;
 }
@@ -321,7 +321,7 @@ import_print_stats (void *hd)
  * Retunr: 0 = okay, -1 no more blocks or another errorcode.
  */
 static int
-read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
+read_block( iobuf_t a, PACKET **pending_pkt, KBNODE *ret_root )
 {
     int rc;
     PACKET *pkt;
@@ -335,13 +335,13 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
     }
     else
 	in_cert = 0;
-    pkt = m_alloc( sizeof *pkt );
+    pkt = xmalloc ( sizeof *pkt );
     init_packet(pkt);
     while( (rc=parse_packet(a, pkt)) != -1 ) {
 	if( rc ) {  /* ignore errors */
-	    if( rc != G10ERR_UNKNOWN_PACKET ) {
-		log_error("read_block: read error: %s\n", g10_errstr(rc) );
-		rc = G10ERR_INV_KEYRING;
+	    if( rc != GPG_ERR_UNKNOWN_PACKET ) {
+		log_error("read_block: read error: %s\n", gpg_strerror (rc) );
+		rc = GPG_ERR_INV_KEYRING;
 		goto ready;
 	    }
 	    free_packet( pkt );
@@ -363,11 +363,11 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
 	  case PKT_COMPRESSED:
 	    if( pkt->pkt.compressed->algorithm < 1
 		|| pkt->pkt.compressed->algorithm > 2 ) {
-		rc = G10ERR_COMPR_ALGO;
+		rc = GPG_ERR_COMPR_ALGO;
 		goto ready;
 	    }
 	    {
-		compress_filter_context_t *cfx = m_alloc_clear( sizeof *cfx );
+		compress_filter_context_t *cfx = xcalloc (1, sizeof *cfx );
 		cfx->algo = pkt->pkt.compressed->algorithm;
 		pkt->pkt.compressed->buf = NULL;
 		iobuf_push_filter2( a, compress_filter, cfx, 1 );
@@ -396,7 +396,7 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
 		    root = new_kbnode( pkt );
 		else
 		    add_kbnode( root, new_kbnode( pkt ) );
-		pkt = m_alloc( sizeof *pkt );
+		pkt = xmalloc ( sizeof *pkt );
 	    }
 	    init_packet(pkt);
 	    break;
@@ -411,7 +411,7 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
     else
 	*ret_root = root;
     free_packet( pkt );
-    m_free( pkt );
+    xfree ( pkt );
     return rc;
 }
 
@@ -513,7 +513,7 @@ print_import_check (PKT_public_key * pk, PKT_user_id * id)
     u32 keyid[2];
     size_t i, pos = 0, n;
 
-    buf = m_alloc (17+41+id->len+32);
+    buf = xmalloc (17+41+id->len+32);
     keyid_from_pk (pk, keyid);
     sprintf (buf, "%08X%08X ", keyid[0], keyid[1]);
     pos = 17;
@@ -524,7 +524,7 @@ print_import_check (PKT_public_key * pk, PKT_user_id * id)
     pos += 1;
     strcat (buf, id->name);
     write_status_text (STATUS_IMPORT_CHECK, buf);
-    m_free (buf);
+    xfree (buf);
 }
 
 /****************
@@ -607,7 +607,7 @@ import_one( const char *fname, KBNODE keyblock,
 	    node->flag |= 1;
 	    log_info( _("key %08lX: accepted non self-signed user ID '%s'\n"),
 		      (ulong)keyid[1],user);
-	    m_free(user);
+	    xfree (user);
 	  }
 
     if( !delete_inv_parts( fname, keyblock, keyid, options ) ) {
@@ -621,11 +621,12 @@ import_one( const char *fname, KBNODE keyblock,
     }
 
     /* do we have this key already in one of our pubrings ? */
-    pk_orig = m_alloc_clear( sizeof *pk_orig );
+    pk_orig = xcalloc (1, sizeof *pk_orig );
     rc = get_pubkey_fast ( pk_orig, keyid );
-    if( rc && rc != G10ERR_NO_PUBKEY && rc != G10ERR_UNU_PUBKEY ) {
+    if( rc && gpg_err_code (rc) != GPG_ERR_NO_PUBKEY
+        && gpg_err_code (rc) != GPG_ERR_UNUSABLE_PUBKEY ) {
 	log_error( _("key %08lX: public key not found: %s\n"),
-				(ulong)keyid[1], g10_errstr(rc));
+				(ulong)keyid[1], gpg_strerror (rc));
     }
     else if ( rc && opt.merge_only ) {
 	if( opt.verbose )
@@ -638,16 +639,16 @@ import_one( const char *fname, KBNODE keyblock,
 
         rc = keydb_locate_writable (hd, NULL);
 	if (rc) {
-	    log_error (_("no writable keyring found: %s\n"), g10_errstr (rc));
+	    log_error (_("no writable keyring found: %s\n"), gpg_strerror (rc));
             keydb_release (hd);
-	    return G10ERR_GENERAL;
+	    return GPG_ERR_GENERAL;
 	}
 	if( opt.verbose > 1 )
 	    log_info (_("writing to `%s'\n"), keydb_get_resource_name (hd) );
 	rc = keydb_insert_keyblock (hd, keyblock );
         if (rc)
 	   log_error (_("error writing keyring `%s': %s\n"),
-		       keydb_get_resource_name (hd), g10_errstr(rc));
+		       keydb_get_resource_name (hd), gpg_strerror (rc));
 	else
 	  {
 	    /* This should not be possible since we delete the
@@ -666,12 +667,12 @@ import_one( const char *fname, KBNODE keyblock,
 	    char *p=get_user_id_printable (keyid);
 	    log_info( _("key %08lX: public key \"%s\" imported\n"),
 		      (ulong)keyid[1],p);
-	    m_free(p);
+	    xfree (p);
 	}
 	if( is_status_enabled() ) {
 	    char *us = get_long_user_id_string( keyid );
 	    write_status_text( STATUS_IMPORTED, us );
-	    m_free(us);
+	    xfree (us);
             print_import_ok (pk,NULL, 1);
 	}
 	stats->imported++;
@@ -704,14 +705,14 @@ import_one( const char *fname, KBNODE keyblock,
         }
 	if( rc ) {
 	    log_error (_("key %08lX: can't locate original keyblock: %s\n"),
-				     (ulong)keyid[1], g10_errstr(rc));
+				     (ulong)keyid[1], gpg_strerror (rc));
             keydb_release (hd);
 	    goto leave;
 	}
 	rc = keydb_get_keyblock (hd, &keyblock_orig );
 	if (rc) {
 	    log_error (_("key %08lX: can't read original keyblock: %s\n"),
-					    (ulong)keyid[1], g10_errstr(rc));
+					    (ulong)keyid[1], gpg_strerror (rc));
             keydb_release (hd);
 	    goto leave;
 	}
@@ -733,7 +734,7 @@ import_one( const char *fname, KBNODE keyblock,
 	    rc = keydb_update_keyblock (hd, keyblock_orig);
             if (rc)
 		log_error (_("error writing keyring `%s': %s\n"),
-			     keydb_get_resource_name (hd), g10_errstr(rc) );
+			     keydb_get_resource_name (hd), gpg_strerror (rc) );
 	    else if(non_self)
 	      revalidation_mark ();
 
@@ -758,7 +759,7 @@ import_one( const char *fname, KBNODE keyblock,
 		else if( n_subk )
 		    log_info( _("key %08lX: \"%s\" %d new subkeys\n"),
 					     (ulong)keyid[1], p, n_subk );
-		m_free(p);
+		xfree (p);
 	    }
 
 	    stats->n_uids +=n_uids;
@@ -777,7 +778,7 @@ import_one( const char *fname, KBNODE keyblock,
 	        char *p=get_user_id_printable(keyid);
 		log_info( _("key %08lX: \"%s\" not changed\n"),
 			  (ulong)keyid[1],p);
-		m_free(p);
+		xfree (p);
 	    }
 	    stats->unchanged++;
 	}
@@ -810,8 +811,8 @@ sec_to_pub_keyblock(KBNODE sec_keyblock)
 	     write the keyblock out. */
 
 	  PKT_secret_key *sk=secnode->pkt->pkt.secret_key;
-	  PACKET *pkt=m_alloc_clear(sizeof(PACKET));
-	  PKT_public_key *pk=m_alloc_clear(sizeof(PKT_public_key));
+	  PACKET *pkt=xcalloc (1,sizeof(PACKET));
+	  PKT_public_key *pk=xcalloc (1,sizeof(PKT_public_key));
 	  int n;
 
 	  if(secnode->pkt->pkttype==PKT_SECRET_KEY)
@@ -905,20 +906,20 @@ import_secret_one( const char *fname, KBNODE keyblock,
 
     /* do we have this key already in one of our secrings ? */
     rc = seckey_available( keyid );
-    if( rc == G10ERR_NO_SECKEY && !opt.merge_only ) { /* simply insert this key */
+    if( rc == GPG_ERR_NO_SECKEY && !opt.merge_only ) { /* simply insert this key */
         KEYDB_HANDLE hd = keydb_new (1);
 
 	/* get default resource */
         rc = keydb_locate_writable (hd, NULL);
 	if (rc) {
-	    log_error (_("no default secret keyring: %s\n"), g10_errstr (rc));
+	    log_error (_("no default secret keyring: %s\n"), gpg_strerror (rc));
             keydb_release (hd);
-	    return G10ERR_GENERAL;
+	    return GPG_ERR_GENERAL;
 	}
 	rc = keydb_insert_keyblock (hd, keyblock );
         if (rc)
 	    log_error (_("error writing keyring `%s': %s\n"),
-                       keydb_get_resource_name (hd), g10_errstr(rc) );
+                       keydb_get_resource_name (hd), gpg_strerror (rc) );
         keydb_release (hd);
 	/* we are ready */
 	if( !opt.quiet )
@@ -949,7 +950,7 @@ import_secret_one( const char *fname, KBNODE keyblock,
     }
     else
 	log_error( _("key %08lX: secret key not found: %s\n"),
-				(ulong)keyid[1], g10_errstr(rc));
+				(ulong)keyid[1], gpg_strerror (rc));
 
     return rc;
 }
@@ -974,9 +975,9 @@ import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats )
     keyid[0] = node->pkt->pkt.signature->keyid[0];
     keyid[1] = node->pkt->pkt.signature->keyid[1];
 
-    pk = m_alloc_clear( sizeof *pk );
+    pk = xcalloc (1, sizeof *pk );
     rc = get_pubkey( pk, keyid );
-    if( rc == G10ERR_NO_PUBKEY ) {
+    if( rc == GPG_ERR_NO_PUBKEY ) {
 	log_info( _("key %08lX: no public key - "
 		 "can't apply revocation certificate\n"), (ulong)keyid[1]);
 	rc = 0;
@@ -984,7 +985,7 @@ import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats )
     }
     else if( rc ) {
 	log_error( _("key %08lX: public key not found: %s\n"),
-				       (ulong)keyid[1], g10_errstr(rc));
+				       (ulong)keyid[1], gpg_strerror (rc));
 	goto leave;
     }
 
@@ -1001,13 +1002,13 @@ import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats )
     }
     if (rc) {
 	log_error (_("key %08lX: can't locate original keyblock: %s\n"),
-                   (ulong)keyid[1], g10_errstr(rc));
+                   (ulong)keyid[1], gpg_strerror (rc));
 	goto leave;
     }
     rc = keydb_get_keyblock (hd, &keyblock );
     if (rc) {
 	log_error (_("key %08lX: can't read original keyblock: %s\n"),
-                   (ulong)keyid[1], g10_errstr(rc));
+                   (ulong)keyid[1], gpg_strerror (rc));
 	goto leave;
     }
 
@@ -1018,7 +1019,7 @@ import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats )
     rc = check_key_signature( keyblock, node, NULL);
     if( rc ) {
 	log_error( _("key %08lX: invalid revocation certificate"
-		  ": %s - rejected\n"), (ulong)keyid[1], g10_errstr(rc));
+		  ": %s - rejected\n"), (ulong)keyid[1], gpg_strerror (rc));
 	goto leave;
     }
 
@@ -1044,14 +1045,14 @@ import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats )
     rc = keydb_update_keyblock (hd, keyblock );
     if (rc)
 	log_error (_("error writing keyring `%s': %s\n"),
-                   keydb_get_resource_name (hd), g10_errstr(rc) );
+                   keydb_get_resource_name (hd), gpg_strerror (rc) );
     keydb_release (hd); hd = NULL;
     /* we are ready */
     if( !opt.quiet ) {
         char *p=get_user_id_printable (keyid);
 	log_info( _("key %08lX: \"%s\" revocation certificate imported\n"),
 					(ulong)keyid[1],p);
-	m_free(p);
+	xfree (p);
     }
     stats->n_revoc++;
 
@@ -1125,13 +1126,13 @@ chk_self_sigs( const char *fname, KBNODE keyblock,
 		    {
 		      char *p=utf8_to_native(unode->pkt->pkt.user_id->name,
 				      strlen(unode->pkt->pkt.user_id->name),0);
-		      log_info( rc == G10ERR_PUBKEY_ALGO ?
+		      log_info( rc == GPG_ERR_PUBKEY_ALGO ?
 				_("key %08lX: unsupported public key "
 				  "algorithm on user id \"%s\"\n"):
 				_("key %08lX: invalid self-signature "
 				  "on user id \"%s\"\n"),
 				(ulong)keyid[1],p);
-		      m_free(p);
+		      xfree (p);
 		    }
 		  else
 		    unode->flag |= 1; /* mark that signature checked */
@@ -1150,7 +1151,7 @@ chk_self_sigs( const char *fname, KBNODE keyblock,
 		else {
 		  rc = check_key_signature( keyblock, n, NULL);
 		  if( rc ) {
-		    log_info(  rc == G10ERR_PUBKEY_ALGO ?
+		    log_info(  rc == GPG_ERR_PUBKEY_ALGO ?
 			    _("key %08lX: unsupported public key algorithm\n"):
 		            _("key %08lX: invalid subkey binding\n"),
 		            (ulong)keyid[1]);
@@ -1191,7 +1192,7 @@ chk_self_sigs( const char *fname, KBNODE keyblock,
 		else {
 		  rc = check_key_signature( keyblock, n, NULL);
 		  if( rc ) {
-		    log_info(  rc == G10ERR_PUBKEY_ALGO ?
+		    log_info(  rc == GPG_ERR_PUBKEY_ALGO ?
 			    _("key %08lX: unsupported public key algorithm\n"):
 		            _("key %08lX: invalid subkey revocation\n"),
 			       (ulong)keyid[1]);
@@ -1281,7 +1282,8 @@ delete_inv_parts( const char *fname, KBNODE keyblock,
 	      subkey_seen = 1;
 	}
 	else if( node->pkt->pkttype == PKT_SIGNATURE
-		 && check_pubkey_algo( node->pkt->pkt.signature->pubkey_algo)
+		 && openpgp_pk_test_algo( node->pkt->pkt.signature
+                                                     ->pubkey_algo, 0)
 		 && node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA )
 	    delete_kbnode( node ); /* build_packet() can't handle this */
 	else if( node->pkt->pkttype == PKT_SIGNATURE &&
@@ -1320,7 +1322,7 @@ delete_inv_parts( const char *fname, KBNODE keyblock,
 		    {
 		      log_error( _("key %08lX: invalid revocation "
 				   "certificate: %s - skipped\n"),
-				 (ulong)keyid[1], g10_errstr(rc));
+				 (ulong)keyid[1], gpg_strerror (rc));
 		      delete_kbnode( node );
 		    }
 		}
@@ -1489,7 +1491,8 @@ revocation_present(KBNODE keyblock)
 
 		      rc=get_pubkey_byfprint_fast (NULL,sig->revkey[idx]->fpr,
                                                    MAX_FINGERPRINT_LEN);
-		      if(rc==G10ERR_NO_PUBKEY || rc==G10ERR_UNU_PUBKEY)
+		      if ( gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
+                          || gpg_err_code (rc) == GPG_ERR_UNUSABLE_PUBKEY)
 			{
 			  /* No, so try and get it */
 			  if(opt.keyserver_scheme &&
@@ -1508,7 +1511,8 @@ revocation_present(KBNODE keyblock)
 						     MAX_FINGERPRINT_LEN);
 			    }
 
-			  if(rc==G10ERR_NO_PUBKEY || rc==G10ERR_UNU_PUBKEY)
+			  if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
+                              || gpg_err_code (rc) == GPG_ERR_UNUSABLE_PUBKEY)
 			    log_info(_("WARNING: key %08lX may be revoked: "
 				       "revocation key %08lX not present.\n"),
 				     (ulong)keyid_from_pk(pk,NULL),
@@ -1568,7 +1572,7 @@ merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock,
                 ++*n_sigs;
 		log_info(_("key %08lX: \"%s\" revocation certificate added\n"),
 					 (ulong)keyid[1],p);
-		m_free(p);
+		xfree (p);
 	    }
 	}
     }
diff --git a/g10/kbnode.c b/g10/kbnode.c
index 5df6d8d74..58daad871 100644
--- a/g10/kbnode.c
+++ b/g10/kbnode.c
@@ -23,6 +23,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "packet.h"
@@ -41,7 +43,7 @@ alloc_node(void)
     if( n )
 	unused_nodes = n->next;
     else
-	n = m_alloc( sizeof *n );
+	n = xmalloc ( sizeof *n );
     n->next = NULL;
     n->pkt = NULL;
     n->flag = 0;
@@ -58,7 +60,7 @@ free_node( KBNODE n )
 	n->next = unused_nodes;
 	unused_nodes = n;
 #else
-	m_free( n );
+	xfree ( n );
 #endif
     }
 }
@@ -94,7 +96,7 @@ release_kbnode( KBNODE n )
 	n2 = n->next;
 	if( !is_cloned_kbnode(n) ) {
 	    free_packet( n->pkt );
-	    m_free( n->pkt );
+	    xfree ( n->pkt );
 	}
 	free_node( n );
 	n = n2;
@@ -267,7 +269,7 @@ commit_kbnode( KBNODE *root )
 		nl->next = n->next;
 	    if( !is_cloned_kbnode(n) ) {
 		free_packet( n->pkt );
-		m_free( n->pkt );
+		xfree ( n->pkt );
 	    }
 	    free_node( n );
 	    changed = 1;
@@ -291,7 +293,7 @@ remove_kbnode( KBNODE *root, KBNODE node )
 		nl->next = n->next;
 	    if( !is_cloned_kbnode(n) ) {
 		free_packet( n->pkt );
-		m_free( n->pkt );
+		xfree ( n->pkt );
 	    }
 	    free_node( n );
 	}
diff --git a/g10/keydb.c b/g10/keydb.c
index c67c36110..b64f38cbc 100644
--- a/g10/keydb.c
+++ b/g10/keydb.c
@@ -28,6 +28,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include "gpg.h"
 #include "util.h"
 #include "options.h"
 #include "main.h" /*try_make_homedir ()*/
@@ -84,7 +85,7 @@ keydb_add_resource (const char *url, int flags, int secret)
 {
     static int any_secret, any_public;
     const char *resname = url;
-    IOBUF iobuf = NULL;
+    iobuf_t iobuf = NULL;
     char *filename = NULL;
     int force=(flags&1);
     int rc = 0;
@@ -103,7 +104,7 @@ keydb_add_resource (const char *url, int flags, int secret)
 #if !defined(HAVE_DRIVE_LETTERS) && !defined(__riscos__)
 	else if (strchr (resname, ':')) {
 	    log_error ("invalid key resource URL `%s'\n", url );
-	    rc = G10ERR_GENERAL;
+	    rc = GPG_ERR_GENERAL;
 	    goto leave;
 	}
 #endif /* !HAVE_DRIVE_LETTERS && !__riscos__ */
@@ -116,7 +117,7 @@ keydb_add_resource (const char *url, int flags, int secret)
 	    filename = make_filename (opt.homedir, resname, NULL);
     }
     else
-	filename = m_strdup (resname);
+	filename = xstrdup (resname);
 
     if (!force)
 	force = secret? !any_secret : !any_public;
@@ -145,7 +146,7 @@ keydb_add_resource (const char *url, int flags, int secret)
     switch (rt) {
       case KEYDB_RESOURCE_TYPE_NONE:
 	log_error ("unknown type of key resource `%s'\n", url );
-	rc = G10ERR_GENERAL;
+	rc = GPG_ERR_GENERAL;
 	goto leave;
 
       case KEYDB_RESOURCE_TYPE_KEYRING:
@@ -156,7 +157,7 @@ keydb_add_resource (const char *url, int flags, int secret)
 
             if (!force) 
               {
-                rc = G10ERR_OPEN_FILE;
+                rc = gpg_error_from_errno (errno);
                 goto leave;
               }
 
@@ -174,7 +175,7 @@ keydb_add_resource (const char *url, int flags, int secret)
                   }
          	if (access (filename, F_OK))
                   {
-                    rc = G10ERR_OPEN_FILE;
+                    rc = gpg_error_from_errno (errno);
                     *last_slash_in_filename = DIRSEP_C;
                     goto leave;
                   }
@@ -188,7 +189,7 @@ keydb_add_resource (const char *url, int flags, int secret)
               {
 		log_error ( _("error creating keyring `%s': %s\n"),
                             filename, strerror(errno));
-		rc = G10ERR_OPEN_FILE;
+                rc = gpg_error_from_errno (errno);
 		goto leave;
               }
 
@@ -203,7 +204,7 @@ keydb_add_resource (const char *url, int flags, int secret)
         if(keyring_register_filename (filename, secret, &token))
 	  {
 	    if (used_resources >= MAX_KEYDB_RESOURCES)
-	      rc = G10ERR_RESOURCE_LIMIT;
+	      rc = GPG_ERR_RESOURCE_LIMIT;
 	    else 
 	      {
 		if(flags&2)
@@ -227,7 +228,7 @@ keydb_add_resource (const char *url, int flags, int secret)
 
       default:
 	log_error ("resource type of `%s' not supported\n", url);
-	rc = G10ERR_GENERAL;
+	rc = GPG_ERR_GENERAL;
 	goto leave;
     }
 
@@ -235,12 +236,12 @@ keydb_add_resource (const char *url, int flags, int secret)
 
   leave:
     if (rc)
-	log_error ("keyblock resource `%s': %s\n", filename, g10_errstr(rc));
+	log_error ("keyblock resource `%s': %s\n", filename, gpg_strerror (rc));
     else if (secret)
 	any_secret = 1;
     else
 	any_public = 1;
-    m_free (filename);
+    xfree (filename);
     return rc;
 }
 
@@ -253,7 +254,7 @@ keydb_new (int secret)
   KEYDB_HANDLE hd;
   int i, j;
   
-  hd = m_alloc_clear (sizeof *hd);
+  hd = xcalloc (1,sizeof *hd);
   hd->found = -1;
   
   assert (used_resources <= MAX_KEYDB_RESOURCES);
@@ -271,7 +272,7 @@ keydb_new (int secret)
           hd->active[j].secret = all_resources[i].secret;
           hd->active[j].u.kr = keyring_new (all_resources[i].token, secret);
           if (!hd->active[j].u.kr) {
-            m_free (hd);
+            xfree (hd);
             return NULL; /* fixme: release all previously allocated handles*/
           }
           j++;
@@ -305,7 +306,7 @@ keydb_release (KEYDB_HANDLE hd)
         }
     }
 
-    m_free (hd);
+    xfree (hd);
 }
 
 
@@ -413,14 +414,14 @@ keydb_get_keyblock (KEYDB_HANDLE hd, KBNODE *ret_kb)
     int rc = 0;
 
     if (!hd)
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     if ( hd->found < 0 || hd->found >= hd->used) 
         return -1; /* nothing found */
 
     switch (hd->active[hd->found].type) {
       case KEYDB_RESOURCE_TYPE_NONE:
-        rc = G10ERR_GENERAL; /* oops */
+        rc = GPG_ERR_GENERAL; /* oops */
         break;
       case KEYDB_RESOURCE_TYPE_KEYRING:
         rc = keyring_get_keyblock (hd->active[hd->found].u.kr, ret_kb);
@@ -439,7 +440,7 @@ keydb_update_keyblock (KEYDB_HANDLE hd, KBNODE kb)
     int rc = 0;
 
     if (!hd)
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     if ( hd->found < 0 || hd->found >= hd->used) 
         return -1; /* nothing found */
@@ -453,7 +454,7 @@ keydb_update_keyblock (KEYDB_HANDLE hd, KBNODE kb)
 
     switch (hd->active[hd->found].type) {
       case KEYDB_RESOURCE_TYPE_NONE:
-        rc = G10ERR_GENERAL; /* oops */
+        rc = GPG_ERR_GENERAL; /* oops */
         break;
       case KEYDB_RESOURCE_TYPE_KEYRING:
         rc = keyring_update_keyblock (hd->active[hd->found].u.kr, kb);
@@ -475,7 +476,7 @@ keydb_insert_keyblock (KEYDB_HANDLE hd, KBNODE kb)
     int idx;
 
     if (!hd) 
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     if( opt.dry_run )
 	return 0;
@@ -485,7 +486,7 @@ keydb_insert_keyblock (KEYDB_HANDLE hd, KBNODE kb)
     else if ( hd->current >= 0 && hd->current < hd->used) 
         idx = hd->current;
     else
-        return G10ERR_GENERAL;
+        return GPG_ERR_GENERAL;
 
     rc = lock_all (hd);
     if (rc)
@@ -493,7 +494,7 @@ keydb_insert_keyblock (KEYDB_HANDLE hd, KBNODE kb)
 
     switch (hd->active[idx].type) {
       case KEYDB_RESOURCE_TYPE_NONE:
-        rc = G10ERR_GENERAL; /* oops */
+        rc = GPG_ERR_GENERAL; /* oops */
         break;
       case KEYDB_RESOURCE_TYPE_KEYRING:
         rc = keyring_insert_keyblock (hd->active[idx].u.kr, kb);
@@ -514,7 +515,7 @@ keydb_delete_keyblock (KEYDB_HANDLE hd)
     int rc = -1;
 
     if (!hd)
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     if ( hd->found < 0 || hd->found >= hd->used) 
         return -1; /* nothing found */
@@ -528,7 +529,7 @@ keydb_delete_keyblock (KEYDB_HANDLE hd)
 
     switch (hd->active[hd->found].type) {
       case KEYDB_RESOURCE_TYPE_NONE:
-        rc = G10ERR_GENERAL; /* oops */
+        rc = GPG_ERR_GENERAL; /* oops */
         break;
       case KEYDB_RESOURCE_TYPE_KEYRING:
         rc = keyring_delete_keyblock (hd->active[hd->found].u.kr);
@@ -551,7 +552,7 @@ keydb_locate_writable (KEYDB_HANDLE hd, const char *reserved)
   int rc;
   
   if (!hd)
-    return G10ERR_INV_ARG;
+    return GPG_ERR_INV_ARG;
   
   rc = keydb_search_reset (hd); /* this does reset hd->current */
   if (rc)
@@ -613,7 +614,7 @@ keydb_rebuild_caches (void)
           rc = keyring_rebuild_cache (all_resources[i].token);
           if (rc)
             log_error (_("failed to rebuild keyring cache: %s\n"),
-                       g10_errstr (rc));
+                       gpg_strerror (rc));
           break;
         }
     }
@@ -630,7 +631,7 @@ keydb_search_reset (KEYDB_HANDLE hd)
     int i, rc = 0;
 
     if (!hd)
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     hd->current = 0; 
     hd->found = -1;
@@ -659,7 +660,7 @@ keydb_search2 (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc,
     int rc = -1;
 
     if (!hd)
-        return G10ERR_INV_ARG;
+        return GPG_ERR_INV_ARG;
 
     while (rc == -1 && hd->current >= 0 && hd->current < hd->used) {
         switch (hd->active[hd->current].type) {
diff --git a/g10/keydb.h b/g10/keydb.h
index 7be5e7fff..6652db32a 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -75,7 +75,7 @@ struct keyblock_pos_struct {
     enum resource_type rt;
     off_t offset;    /* position information */
     unsigned count;  /* length of the keyblock in packets */
-    IOBUF  fp;	     /* used by enum_keyblocks */
+    iobuf_t  fp;	     /* used by enum_keyblocks */
     int secret;      /* working on a secret keyring */
     PACKET *pkt;     /* ditto */
     int valid;
@@ -235,6 +235,7 @@ KEYDB_HANDLE get_ctx_handle(GETKEY_CTX ctx);
 
 /*-- keyid.c --*/
 int pubkey_letter( int algo );
+u32 v3_keyid (gcry_mpi_t a, u32 *ki);
 u32 keyid_from_sk( PKT_secret_key *sk, u32 *keyid );
 u32 keyid_from_pk( PKT_public_key *pk, u32 *keyid );
 u32 keyid_from_sig( PKT_signature *sig, u32 *keyid );
diff --git a/g10/keyedit.c b/g10/keyedit.c
index d36623a6a..38248a3d0 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -27,6 +27,7 @@
 #include <assert.h>
 #include <ctype.h>
 
+#include "gpg.h"
 #include "options.h"
 #include "packet.h"
 #include "errors.h"
@@ -107,19 +108,20 @@ print_and_check_one_sig( KBNODE keyblock, KBNODE node,
     /* TODO: Make sure a cached sig record here still has the pk that
        issued it.  See also keylist.c:list_keyblock_print */
 
-    switch( (rc = check_key_signature( keyblock, node, is_selfsig)) ) {
+    rc = check_key_signature (keyblock, node, is_selfsig);
+    switch ( gpg_err_code (rc) ) {
       case 0:
 	node->flag &= ~(NODFLG_BADSIG|NODFLG_NOKEY|NODFLG_SIGERR);
 	sigrc = '!';
 	break;
-      case G10ERR_BAD_SIGN:
+      case GPG_ERR_BAD_SIGNATURE:
 	node->flag = NODFLG_BADSIG;
 	sigrc = '-';
 	if( inv_sigs )
 	    ++*inv_sigs;
 	break;
-      case G10ERR_NO_PUBKEY:
-      case G10ERR_UNU_PUBKEY:
+      case GPG_ERR_NO_PUBKEY:
+      case GPG_ERR_UNUSABLE_PUBKEY:
 	node->flag = NODFLG_NOKEY;
 	sigrc = '?';
 	if( no_key )
@@ -146,7 +148,7 @@ print_and_check_one_sig( KBNODE keyblock, KBNODE node,
 		   (sig->trust_depth>0)?'0'+sig->trust_depth:' ',
 		   (ulong)sig->keyid[1], datestr_from_sig(sig));
 	if( sigrc == '%' )
-	    tty_printf("[%s] ", g10_errstr(rc) );
+	    tty_printf("[%s] ", gpg_strerror (rc) );
 	else if( sigrc == '?' )
 	    ;
 	else if( *is_selfsig ) {
@@ -157,7 +159,7 @@ print_and_check_one_sig( KBNODE keyblock, KBNODE node,
 	    size_t n;
 	    char *p = get_user_id( sig->keyid, &n );
 	    tty_print_utf8_string2( p, n, 40 );
-	    m_free(p);
+	    xfree (p);
 	}
 	tty_printf("\n");
 
@@ -313,7 +315,7 @@ trustsig_prompt(byte *trust_value,byte *trust_depth,char **regexp)
 	*trust_value=60;
       else if(p[0]=='2' && !p[1])
 	*trust_value=120;
-      m_free(p);
+      xfree (p);
     }
 
   tty_printf("\n");
@@ -330,7 +332,7 @@ trustsig_prompt(byte *trust_value,byte *trust_depth,char **regexp)
       trim_spaces(p);
       cpr_kill_prompt();
       *trust_depth=atoi(p);
-      m_free(p);
+      xfree (p);
       if(*trust_depth<1 || *trust_depth>255)
 	*trust_depth=0;
     }
@@ -351,7 +353,7 @@ trustsig_prompt(byte *trust_value,byte *trust_depth,char **regexp)
       char *q=p;
       int regexplen=100,ind;
 
-      *regexp=m_alloc(regexplen);
+      *regexp=xmalloc (regexplen);
 
       /* Now mangle the domain the user entered into a regexp.  To do
 	 this, \-escape everything that isn't alphanumeric, and attach
@@ -371,7 +373,7 @@ trustsig_prompt(byte *trust_value,byte *trust_depth,char **regexp)
 	  if((regexplen-ind)<3)
 	    {
 	      regexplen+=100;
-	      *regexp=m_realloc(*regexp,regexplen);
+	      *regexp=xrealloc(*regexp,regexplen);
 	    }
 
 	  q++;
@@ -381,7 +383,7 @@ trustsig_prompt(byte *trust_value,byte *trust_depth,char **regexp)
       strcat(*regexp,">$");
     }
 
-  m_free(p);
+  xfree (p);
   tty_printf("\n");
 }
 
@@ -504,7 +506,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 				     "self-signed.\n"),user);
 		      }
 
-		    m_free(user);
+		    xfree (user);
 		  }
 	    }
 	    else if( uidnode && node->pkt->pkttype == PKT_SIGNATURE
@@ -534,7 +536,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 			    {
 			      force_v4=1;
 			      node->flag|=NODFLG_DELSIG;
-			      m_free(user);
+			      xfree (user);
 			      continue;
 			    }
 		      }
@@ -558,7 +560,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
                                in place. */
 
 			    node->flag|=NODFLG_DELSIG;
-			    m_free(user);
+			    xfree (user);
 			    continue;
 			  }
 		      }
@@ -583,7 +585,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
                                in place. */
 
 			    node->flag|=NODFLG_DELSIG;
-			    m_free(user);
+			    xfree (user);
 			    continue;
 			  }
 		      }
@@ -606,7 +608,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 		      {
 			/* Don't delete the old sig here since this is
 			   an --expert thing. */
-			m_free(user);
+			xfree (user);
 			continue;
 		      }
 
@@ -615,7 +617,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
                     write_status_text (STATUS_ALREADY_SIGNED, buf);
 		    uidnode->flag &= ~NODFLG_MARK_A; /* remove mark */
 
-		    m_free(user);
+		    xfree (user);
 		}
 	    }
 	}
@@ -675,7 +677,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 		  }
 
 		cpr_kill_prompt();
-		m_free(answer);
+		xfree (answer);
 	      }
 	  }
 
@@ -752,7 +754,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 		    else
 		      tty_printf(_("Invalid selection.\n"));
 
-		    m_free(answer);
+		    xfree (answer);
 		  }
 	      }
 
@@ -764,7 +766,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 		     "with your key: \""));
 	p = get_user_id( sk_keyid, &n );
 	tty_print_utf8_string( p, n );
-	m_free(p); p = NULL;
+	xfree (p); p = NULL;
 	tty_printf("\" (%08lX)\n",(ulong)sk_keyid[1]);
 
 	if(selfsig)
@@ -856,14 +858,14 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
 					   timestamp, duration,
 					   sign_mk_attrib, &attrib );
 		if( rc ) {
-		    log_error(_("signing failed: %s\n"), g10_errstr(rc));
+		    log_error(_("signing failed: %s\n"), gpg_strerror (rc));
 		    goto leave;
 		}
 
 		*ret_modified = 1; /* we changed the keyblock */
 		update_trust = 1;
 
-		pkt = m_alloc_clear( sizeof *pkt );
+		pkt = xcalloc (1, sizeof *pkt );
 		pkt->pkttype = PKT_SIGNATURE;
 		pkt->pkt.signature = sig;
 		insert_kbnode( node, new_kbnode(pkt), PKT_SIGNATURE );
@@ -909,7 +911,7 @@ change_passphrase( KBNODE keyblock )
 
     switch( is_secret_key_protected( sk ) ) {
       case -1:
-	rc = G10ERR_PUBKEY_ALGO;
+	rc = GPG_ERR_PUBKEY_ALGO;
 	break;
       case 0:
 	tty_printf(_("This key is not protected.\n"));
@@ -940,10 +942,10 @@ change_passphrase( KBNODE keyblock )
     }
 
     if( rc )
-	tty_printf(_("Can't edit this key: %s\n"), g10_errstr(rc));
+	tty_printf(_("Can't edit this key: %s\n"), gpg_strerror (rc));
     else {
 	DEK *dek = NULL;
-	STRING2KEY *s2k = m_alloc_secure( sizeof *s2k );
+	STRING2KEY *s2k = xmalloc_secure ( sizeof *s2k );
         const char *errtext = NULL;
 
 	tty_printf(_("Enter the new passphrase for this secret key.\n\n") );
@@ -983,18 +985,18 @@ change_passphrase( KBNODE keyblock )
 		    }
 		}
 		if( rc )
-		    log_error("protect_secret_key failed: %s\n", g10_errstr(rc) );
+		    log_error("protect_secret_key failed: %s\n", gpg_strerror (rc) );
 		else
 		    changed++;
 		break;
 	    }
 	}
-	m_free(s2k);
-	m_free(dek);
+	xfree (s2k);
+	xfree (dek);
     }
 
   leave:
-    m_free( passphrase );
+    xfree ( passphrase );
     set_next_passphrase( NULL );
     return changed && !rc;
 }
@@ -1172,7 +1174,7 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
 	    rc = keydb_get_keyblock (sec_kdbhd, &sec_keyblock);
 	    if (rc) {
 		log_error (_("error reading secret keyblock `%s': %s\n"),
-						username, g10_errstr(rc));
+						username, gpg_strerror (rc));
 	    }
             else {
                 merge_keys_and_selfsig( sec_keyblock );
@@ -1207,14 +1209,14 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
 	    redisplay = 0;
 	}
 	do {
-	    m_free(answer);
+	    xfree (answer);
 	    if( have_commands ) {
 		if( commands ) {
-		    answer = m_strdup( commands->d );
+		    answer = xstrdup ( commands->d );
 		    commands = commands->next;
 		}
 		else if( opt.batch ) {
-		    answer = m_strdup("quit");
+		    answer = xstrdup ("quit");
 		}
 		else
 		    have_commands = 0;
@@ -1543,7 +1545,7 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
 	      PKT_user_id *temp=keygen_get_std_prefs();
 	      tty_printf(_("Current preference list:\n"));
 	      show_prefs(temp,1);
-	      m_free(temp);
+	      xfree (temp);
             }
             if (cpr_get_answer_is_yes ("keyedit.updpref.okay",
                                         count_selected_uids (keyblock)?
@@ -1601,7 +1603,7 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
 		if( modified ) {
 		    rc = keydb_update_keyblock (kdbhd, keyblock);
 		    if( rc ) {
-			log_error(_("update failed: %s\n"), g10_errstr(rc) );
+			log_error(_("update failed: %s\n"), gpg_strerror (rc) );
 			break;
 		    }
 		}
@@ -1609,7 +1611,7 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
 		    rc = keydb_update_keyblock (sec_kdbhd, sec_keyblock );
 		    if( rc ) {
 			log_error( _("update secret failed: %s\n"),
-                                   g10_errstr(rc) );
+                                   gpg_strerror (rc) );
 			break;
 		    }
 		}
@@ -1636,7 +1638,7 @@ keyedit_menu( const char *username, STRLIST locusr, STRLIST commands,
     release_kbnode( keyblock );
     release_kbnode( sec_keyblock );
     keydb_release (kdbhd);
-    m_free(answer);
+    xfree (answer);
 }
 
 
@@ -1666,7 +1668,7 @@ show_prefs (PKT_user_id *uid, int verbose)
 	tty_printf (_("Cipher: "));
         for(i=any=0; prefs[i].type; i++ ) {
             if( prefs[i].type == PREFTYPE_SYM ) {
-                const char *s = cipher_algo_to_string (prefs[i].value);
+                const char *s = gcry_cipher_algo_name (prefs[i].value);
                 
                 if (any)
                     tty_printf (", ");
@@ -1683,13 +1685,13 @@ show_prefs (PKT_user_id *uid, int verbose)
         if (!des_seen) {
             if (any)
                 tty_printf (", ");
-            tty_printf ("%s",cipher_algo_to_string(CIPHER_ALGO_3DES));
+            tty_printf ("%s", gcry_cipher_algo_name (CIPHER_ALGO_3DES));
         }
         tty_printf ("\n     ");
 	tty_printf (_("Digest: "));
         for(i=any=0; prefs[i].type; i++ ) {
             if( prefs[i].type == PREFTYPE_HASH ) {
-                const char *s = digest_algo_to_string (prefs[i].value);
+                const char *s = gcry_md_algo_name (prefs[i].value);
                 
                 if (any)
                     tty_printf (", ");
@@ -1706,7 +1708,7 @@ show_prefs (PKT_user_id *uid, int verbose)
         if (!sha1_seen) {
             if (any)
                 tty_printf (", ");
-            tty_printf ("%s",digest_algo_to_string(DIGEST_ALGO_SHA1));
+            tty_printf ("%s", gcry_md_algo_name (DIGEST_ALGO_SHA1));
         }
         tty_printf ("\n     ");
 	tty_printf (_("Compression: "));
@@ -1984,7 +1986,7 @@ show_key_with_all_names( KBNODE keyblock, int only_marked, int with_revoker,
                         u32 r_keyid[2];
                         char *user;
 			const char *algo=
-			  pubkey_algo_to_string(pk->revkey[i].algid);
+                                  gcry_pk_algo_name (pk->revkey[i].algid);
 
                         keyid_from_fingerprint(pk->revkey[i].fpr,
                                                MAX_FINGERPRINT_LEN,r_keyid);
@@ -1996,7 +1998,7 @@ show_key_with_all_names( KBNODE keyblock, int only_marked, int with_revoker,
                         if ((pk->revkey[i].class&0x40))
                           tty_printf (_(" (sensitive)"));
                         tty_printf ("\n");
-                        m_free(user);
+                        xfree (user);
                       }
             }
 
@@ -2052,11 +2054,11 @@ show_key_with_all_names( KBNODE keyblock, int only_marked, int with_revoker,
 	    if( !rc )
 		tty_printf( _("rev! subkey has been revoked: %s\n"),
 			    datestr_from_sig( sig ) );
-	    else if( rc == G10ERR_BAD_SIGN )
+	    else if( gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE )
 		tty_printf( _("rev- faked revocation found\n") );
 	    else if( rc )
 		tty_printf( _("rev? problem checking revocation: %s\n"),
-							 g10_errstr(rc) );
+							 gpg_strerror (rc) );
 	}
     }
     /* the user ids */
@@ -2311,13 +2313,13 @@ menu_adduid( KBNODE pub_keyblock, KBNODE sec_keyblock, int photo)
 			     keygen_add_std_prefs, pk );
     free_secret_key( sk );
     if( rc ) {
-	log_error("signing failed: %s\n", g10_errstr(rc) );
+	log_error("signing failed: %s\n", gpg_strerror (rc) );
 	free_user_id(uid);
 	return 0;
     }
 
     /* insert/append to secret keyblock */
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_USER_ID;
     pkt->pkt.user_id = scopy_user_id(uid);
     node = new_kbnode(pkt);
@@ -2325,7 +2327,7 @@ menu_adduid( KBNODE pub_keyblock, KBNODE sec_keyblock, int photo)
 	insert_kbnode( sec_where, node, 0 );
     else
 	add_kbnode( sec_keyblock, node );
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_SIGNATURE;
     pkt->pkt.signature = copy_signature(NULL, sig);
     if( sec_where )
@@ -2333,7 +2335,7 @@ menu_adduid( KBNODE pub_keyblock, KBNODE sec_keyblock, int photo)
     else
 	add_kbnode( sec_keyblock, new_kbnode(pkt) );
     /* insert/append to public keyblock */
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_USER_ID;
     pkt->pkt.user_id = uid;
     node = new_kbnode(pkt);
@@ -2341,7 +2343,7 @@ menu_adduid( KBNODE pub_keyblock, KBNODE sec_keyblock, int photo)
 	insert_kbnode( pub_where, node, 0 );
     else
 	add_kbnode( pub_keyblock, node );
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_SIGNATURE;
     pkt->pkt.signature = copy_signature(NULL, sig);
     if( pub_where )
@@ -2586,7 +2588,7 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
       if(revoker_pk)
 	free_public_key(revoker_pk);
 
-      revoker_pk=m_alloc_clear(sizeof(*revoker_pk));
+      revoker_pk=xcalloc (1,sizeof(*revoker_pk));
 
       tty_printf("\n");
 
@@ -2599,7 +2601,7 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
 
       if(rc)
 	{
-	  log_error (_("key `%s' not found: %s\n"),answer,g10_errstr(rc));
+	  log_error (_("key `%s' not found: %s\n"),answer,gpg_strerror (rc));
 	  continue;
 	}
 
@@ -2667,7 +2669,7 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
 
       p = get_user_id( keyid, &n );
       tty_print_utf8_string( p, n );
-      m_free(p);
+      xfree (p);
       tty_printf("\n");
       print_fingerprint(revoker_pk,NULL,2);
       tty_printf("\n");
@@ -2693,7 +2695,7 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
 			   keygen_add_revkey,&revkey );
   if( rc )
     {
-      log_error("signing failed: %s\n", g10_errstr(rc) );
+      log_error("signing failed: %s\n", gpg_strerror (rc) );
       goto fail;
     }
 
@@ -2701,13 +2703,13 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
   sk=NULL;
 
   /* insert into secret keyblock */
-  pkt = m_alloc_clear( sizeof *pkt );
+  pkt = xcalloc (1, sizeof *pkt );
   pkt->pkttype = PKT_SIGNATURE;
   pkt->pkt.signature = copy_signature(NULL, sig);
   insert_kbnode( sec_keyblock, new_kbnode(pkt), PKT_SIGNATURE );
 
   /* insert into public keyblock */
-  pkt = m_alloc_clear( sizeof *pkt );
+  pkt = xcalloc (1, sizeof *pkt );
   pkt->pkttype = PKT_SIGNATURE;
   pkt->pkt.signature = sig;
   insert_kbnode( pub_keyblock, new_kbnode(pkt), PKT_SIGNATURE );
@@ -2821,23 +2823,23 @@ menu_expire( KBNODE pub_keyblock, KBNODE sec_keyblock )
 					    sk, keygen_add_key_expire, sub_pk );
 		if( rc ) {
 		    log_error("make_keysig_packet failed: %s\n",
-						    g10_errstr(rc));
+						    gpg_strerror (rc));
 		    free_secret_key( sk );
 		    return 0;
 		}
 		/* replace the packet */
-		newpkt = m_alloc_clear( sizeof *newpkt );
+		newpkt = xcalloc (1, sizeof *newpkt );
 		newpkt->pkttype = PKT_SIGNATURE;
 		newpkt->pkt.signature = newsig;
 		free_packet( node->pkt );
-		m_free( node->pkt );
+		xfree ( node->pkt );
 		node->pkt = newpkt;
 		if( sn ) {
-		    newpkt = m_alloc_clear( sizeof *newpkt );
+		    newpkt = xcalloc (1, sizeof *newpkt );
 		    newpkt->pkttype = PKT_SIGNATURE;
 		    newpkt->pkt.signature = copy_signature( NULL, newsig );
 		    free_packet( sn->pkt );
-		    m_free( sn->pkt );
+		    xfree ( sn->pkt );
 		    sn->pkt = newpkt;
 		}
 		sub_pk = NULL;
@@ -2930,7 +2932,7 @@ menu_set_primary_uid ( KBNODE pub_keyblock, KBNODE sec_keyblock )
 
 		log_info(_("skipping v3 self-signature on user id \"%s\"\n"),
 			 user);
-		m_free(user);
+		xfree (user);
 	      }
 	      else {
 	        /* This is a selfsignature which is to be replaced.
@@ -2969,16 +2971,16 @@ menu_set_primary_uid ( KBNODE pub_keyblock, KBNODE sec_keyblock )
                                                action > 0? "x":NULL );
                     if( rc ) {
                         log_error ("update_keysig_packet failed: %s\n",
-                                   g10_errstr(rc));
+                                   gpg_strerror (rc));
                         free_secret_key( sk );
                         return 0;
                     }
                     /* replace the packet */
-                    newpkt = m_alloc_clear( sizeof *newpkt );
+                    newpkt = xcalloc (1, sizeof *newpkt );
                     newpkt->pkttype = PKT_SIGNATURE;
                     newpkt->pkt.signature = newsig;
                     free_packet( node->pkt );
-                    m_free( node->pkt );
+                    xfree ( node->pkt );
                     node->pkt = newpkt;
                     modified = 1;
 		}
@@ -3039,7 +3041,7 @@ menu_set_preferences (KBNODE pub_keyblock, KBNODE sec_keyblock )
 
 		log_info(_("skipping v3 self-signature on user id \"%s\"\n"),
 			 user);
-		m_free(user);
+		xfree (user);
 	      }
 	      else {
 		/* This is a selfsignature which is to be replaced 
@@ -3056,16 +3058,16 @@ menu_set_preferences (KBNODE pub_keyblock, KBNODE sec_keyblock )
                                            NULL );
                 if( rc ) {
                     log_error ("update_keysig_packet failed: %s\n",
-                               g10_errstr(rc));
+                               gpg_strerror (rc));
                     free_secret_key( sk );
                     return 0;
                 }
                 /* replace the packet */
-                newpkt = m_alloc_clear( sizeof *newpkt );
+                newpkt = xcalloc (1, sizeof *newpkt );
                 newpkt->pkttype = PKT_SIGNATURE;
                 newpkt->pkt.signature = newsig;
                 free_packet( node->pkt );
-                m_free( node->pkt );
+                xfree ( node->pkt );
                 node->pkt = newpkt;
                 modified = 1;
 	      }
@@ -3397,7 +3399,7 @@ menu_revsig( KBNODE keyblock )
 	attrib.non_exportable=!node->pkt->pkt.signature->flags.exportable;
 
 	node->flag &= ~NODFLG_MARK_A;
-	sk = m_alloc_secure_clear( sizeof *sk );
+	sk = xcalloc_secure (1, sizeof *sk );
 	if( get_seckey( sk, node->pkt->pkt.signature->keyid ) ) {
 	    log_info(_("no secret key\n"));
 	    continue;
@@ -3411,7 +3413,7 @@ menu_revsig( KBNODE keyblock )
 				       &attrib );
 	free_secret_key(sk);
 	if( rc ) {
-	    log_error(_("signing failed: %s\n"), g10_errstr(rc));
+	    log_error(_("signing failed: %s\n"), gpg_strerror (rc));
 	    release_revocation_reason_info( reason );
 	    return changed;
 	}
@@ -3421,7 +3423,7 @@ menu_revsig( KBNODE keyblock )
 	if(primary_pk->keyid[0]==sig->keyid[0] &&
 	   primary_pk->keyid[1]==sig->keyid[1])
 	  unode->pkt->pkt.user_id->is_revoked=1;
-	pkt = m_alloc_clear( sizeof *pkt );
+	pkt = xcalloc (1, sizeof *pkt );
 	pkt->pkttype = PKT_SIGNATURE;
 	pkt->pkt.signature = sig;
 	insert_kbnode( unode, new_kbnode(pkt), 0 );
@@ -3470,7 +3472,7 @@ menu_revuid( KBNODE pub_keyblock, KBNODE sec_keyblock )
 	  {
 	    char *user=utf8_to_native(uid->name,uid->len,0);
 	    log_info(_("user ID \"%s\" is already revoked\n"),user);
-	    m_free(user);
+	    xfree (user);
 	  }
 	else
 	  {
@@ -3502,12 +3504,12 @@ menu_revuid( KBNODE pub_keyblock, KBNODE sec_keyblock )
 				     sign_mk_attrib, &attrib );
 	    if( rc )
 	      {
-		log_error(_("signing failed: %s\n"), g10_errstr(rc));
+		log_error(_("signing failed: %s\n"), gpg_strerror (rc));
 		goto leave;
 	      }
 	    else
 	      {
-		pkt = m_alloc_clear( sizeof *pkt );
+		pkt = xcalloc (1, sizeof *pkt );
 		pkt->pkttype = PKT_SIGNATURE;
 		pkt->pkt.signature = sig;
 		insert_kbnode( node, new_kbnode(pkt), 0 );
@@ -3575,13 +3577,13 @@ menu_revkey( KBNODE pub_keyblock, KBNODE sec_keyblock )
 				     sign_mk_attrib, &attrib );
 	    free_secret_key(sk);
 	    if( rc ) {
-		log_error(_("signing failed: %s\n"), g10_errstr(rc));
+		log_error(_("signing failed: %s\n"), gpg_strerror (rc));
 		release_revocation_reason_info( reason );
 		return changed;
 	    }
 	    changed = 1; /* we changed the keyblock */
 
-	    pkt = m_alloc_clear( sizeof *pkt );
+	    pkt = xcalloc (1, sizeof *pkt );
 	    pkt->pkttype = PKT_SIGNATURE;
 	    pkt->pkt.signature = sig;
 	    insert_kbnode( node, new_kbnode(pkt), 0 );
diff --git a/g10/keygen.c b/g10/keygen.c
index ff6fec852..041a495bd 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -26,6 +26,8 @@
 #include <ctype.h>
 #include <errno.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "main.h"
 #include "packet.h"
@@ -81,13 +83,13 @@ struct output_control_s {
     struct {
 	char  *fname;
 	char  *newfname;
-	IOBUF stream;
+	iobuf_t stream;
 	armor_filter_context_t afx;
     } pub;
     struct {
 	char  *fname;
 	char  *newfname;
-	IOBUF stream;
+	iobuf_t stream;
 	armor_filter_context_t afx;
     } sec;
 };
@@ -110,17 +112,17 @@ static int mdc_available,ks_modify;
 
 static void do_generate_keypair( struct para_data_s *para,
 				 struct output_control_s *outctrl );
-static int  write_keyblock( IOBUF out, KBNODE node );
+static int  write_keyblock( iobuf_t out, KBNODE node );
 
 
 static void
 write_uid( KBNODE root, const char *s )
 {
-    PACKET *pkt = m_alloc_clear(sizeof *pkt );
+    PACKET *pkt = xcalloc (1,sizeof *pkt );
     size_t n = strlen(s);
 
     pkt->pkttype = PKT_USER_ID;
-    pkt->pkt.user_id = m_alloc_clear( sizeof *pkt->pkt.user_id + n - 1 );
+    pkt->pkt.user_id = xcalloc (1, sizeof *pkt->pkt.user_id + n - 1 );
     pkt->pkt.user_id->len = n;
     pkt->pkt.user_id->ref = 1;
     strcpy(pkt->pkt.user_id->name, s);
@@ -241,7 +243,7 @@ keygen_set_std_prefs (const char *string,int personal)
     if (!string || !ascii_strcasecmp (string, "default")) {
       if (opt.def_preference_list)
 	string=opt.def_preference_list;
-      else if ( !check_cipher_algo(CIPHER_ALGO_IDEA) )
+      else if ( !openpgp_cipher_test_algo(CIPHER_ALGO_IDEA) )
         string = AES CAST5 "S2 S1 H2 H3 Z2 Z1";
       else
         string = AES CAST5 "S2 H2 H3 Z2 Z1";
@@ -261,16 +263,16 @@ keygen_set_std_prefs (const char *string,int personal)
       {
 	char *tok,*prefstring;
 
-	prefstring=m_strdup(string); /* need a writable string! */
+	prefstring=xstrdup (string); /* need a writable string! */
 
 	while((tok=strsep(&prefstring," ,")))
 	  {
-	    if((val=string_to_cipher_algo(tok)))
+	    if((val=openpgp_cipher_map_name(tok)))
 	      {
 		if(set_one_pref(val,1,tok,sym,&nsym))
 		  rc=-1;
 	      }
-	    else if((val=string_to_digest_algo(tok)))
+	    else if((val=openpgp_md_map_name(tok)))
 	      {
 		if(set_one_pref(val,2,tok,hash,&nhash))
 		  rc=-1;
@@ -301,7 +303,7 @@ keygen_set_std_prefs (const char *string,int personal)
 	      }
 	  }
 
-	m_free(prefstring);
+	xfree (prefstring);
       }
 
     if(!rc)
@@ -310,7 +312,7 @@ keygen_set_std_prefs (const char *string,int personal)
 	  {
 	    if(personal==PREFTYPE_SYM)
 	      {
-		m_free(opt.personal_cipher_prefs);
+		xfree (opt.personal_cipher_prefs);
 
 		if(nsym==0)
 		  opt.personal_cipher_prefs=NULL;
@@ -319,7 +321,7 @@ keygen_set_std_prefs (const char *string,int personal)
 		    int i;
 
 		    opt.personal_cipher_prefs=
-		      m_alloc(sizeof(prefitem_t *)*(nsym+1));
+		      xmalloc (sizeof(prefitem_t *)*(nsym+1));
 
 		    for (i=0; i<nsym; i++)
 		      {
@@ -333,7 +335,7 @@ keygen_set_std_prefs (const char *string,int personal)
 	      }
 	    else if(personal==PREFTYPE_HASH)
 	      {
-		m_free(opt.personal_digest_prefs);
+		xfree (opt.personal_digest_prefs);
 
 		if(nhash==0)
 		  opt.personal_digest_prefs=NULL;
@@ -342,7 +344,7 @@ keygen_set_std_prefs (const char *string,int personal)
 		    int i;
 
 		    opt.personal_digest_prefs=
-		      m_alloc(sizeof(prefitem_t *)*(nhash+1));
+		      xmalloc (sizeof(prefitem_t *)*(nhash+1));
 
 		    for (i=0; i<nhash; i++)
 		      {
@@ -356,7 +358,7 @@ keygen_set_std_prefs (const char *string,int personal)
 	      }
 	    else if(personal==PREFTYPE_ZIP)
 	      {
-		m_free(opt.personal_compress_prefs);
+		xfree (opt.personal_compress_prefs);
 
 		if(nzip==0)
 		  opt.personal_compress_prefs=NULL;
@@ -365,7 +367,7 @@ keygen_set_std_prefs (const char *string,int personal)
 		    int i;
 
 		    opt.personal_compress_prefs=
-		      m_alloc(sizeof(prefitem_t *)*(nzip+1));
+		      xmalloc (sizeof(prefitem_t *)*(nzip+1));
 
 		    for (i=0; i<nzip; i++)
 		      {
@@ -400,12 +402,12 @@ keygen_set_std_prefs (const char *string,int personal)
 PKT_user_id *keygen_get_std_prefs(void)
 {
   int i,j=0;
-  PKT_user_id *uid=m_alloc_clear(sizeof(PKT_user_id));
+  PKT_user_id *uid=xcalloc (1,sizeof(PKT_user_id));
 
   if(!prefs_initialized)
     keygen_set_std_prefs(NULL,0);
 
-  uid->prefs=m_alloc((sizeof(prefitem_t *)*
+  uid->prefs=xmalloc ((sizeof(prefitem_t *)*
 		      (nsym_prefs+nhash_prefs+nzip_prefs+1)));
 
   for(i=0;i<nsym_prefs;i++,j++)
@@ -451,10 +453,10 @@ add_feature_mdc (PKT_signature *sig,int enabled)
 
     if (!s || !n) { /* create a new one */
         n = 1;
-        buf = m_alloc_clear (n);
+        buf = xcalloc (1,n);
     }
     else {
-        buf = m_alloc (n);
+        buf = xmalloc (n);
         memcpy (buf, s, n);
     }
 
@@ -473,7 +475,7 @@ add_feature_mdc (PKT_signature *sig,int enabled)
     else
       build_sig_subpkt (sig, SIGSUBPKT_FEATURES, buf, n);
 
-    m_free (buf);
+    xfree (buf);
 }
 
 static void
@@ -495,10 +497,10 @@ add_keyserver_modify (PKT_signature *sig,int enabled)
 
   if (!s || !n) { /* create a new one */
     n = 1;
-    buf = m_alloc_clear (n);
+    buf = xcalloc (1,n);
   }
   else {
-    buf = m_alloc (n);
+    buf = xmalloc (n);
     memcpy (buf, s, n);
   }
 
@@ -517,7 +519,7 @@ add_keyserver_modify (PKT_signature *sig,int enabled)
   else
     build_sig_subpkt (sig, SIGSUBPKT_KS_FLAGS, buf, n);
 
-  m_free (buf);
+  xfree (buf);
 }
 
 int
@@ -624,11 +626,11 @@ write_direct_sig( KBNODE root, KBNODE pub_root, PKT_secret_key *sk,
     rc = make_keysig_packet(&sig,pk,NULL,NULL,sk,0x1F,0,0,0,0,
 			    keygen_add_revkey,revkey);
     if( rc ) {
-	log_error("make_keysig_packet failed: %s\n", g10_errstr(rc) );
+	log_error("make_keysig_packet failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_SIGNATURE;
     pkt->pkt.signature = sig;
     add_kbnode( root, new_kbnode( pkt ) );
@@ -668,11 +670,11 @@ write_selfsig( KBNODE root, KBNODE pub_root, PKT_secret_key *sk,
     rc = make_keysig_packet( &sig, pk, uid, NULL, sk, 0x13, 0, 0, 0, 0,
         		     keygen_add_std_prefs, pk );
     if( rc ) {
-	log_error("make_keysig_packet failed: %s\n", g10_errstr(rc) );
+	log_error("make_keysig_packet failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_SIGNATURE;
     pkt->pkt.signature = sig;
     add_kbnode( root, new_kbnode( pkt ) );
@@ -717,11 +719,11 @@ write_keybinding( KBNODE root, KBNODE pub_root, PKT_secret_key *sk,
     rc = make_keysig_packet( &sig, pk, NULL, subpk, sk, 0x18, 0, 0, 0, 0,
         		     keygen_add_key_flags_and_expire, &oduap );
     if( rc ) {
-	log_error("make_keysig_packet failed: %s\n", g10_errstr(rc) );
+	log_error("make_keysig_packet failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    pkt = m_alloc_clear( sizeof *pkt );
+    pkt = xcalloc (1, sizeof *pkt );
     pkt->pkttype = PKT_SIGNATURE;
     pkt->pkt.signature = sig;
     add_kbnode( root, new_kbnode( pkt ) );
@@ -738,8 +740,8 @@ gen_elg(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
     PACKET *pkt;
     PKT_secret_key *sk;
     PKT_public_key *pk;
-    MPI skey[4];
-    MPI *factors;
+    gcry_mpi_t skey[4];
+    gcry_mpi_t *factors;
 
     assert( is_ELGAMAL(algo) );
 
@@ -753,14 +755,15 @@ gen_elg(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	log_info(_("keysize rounded up to %u bits\n"), nbits );
     }
 
-    rc = pubkey_generate( algo, nbits, skey, &factors );
+#warning need to implement this
+    rc = -1 /*pubkey_generate( algo, nbits, skey, &factors )*/;
     if( rc ) {
-	log_error("pubkey_generate failed: %s\n", g10_errstr(rc) );
+	log_error("pubkey_generate failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    sk = m_alloc_clear( sizeof *sk );
-    pk = m_alloc_clear( sizeof *pk );
+    sk = xcalloc (1, sizeof *sk );
+    pk = xcalloc (1, sizeof *pk );
     sk->timestamp = pk->timestamp = make_timestamp();
     sk->version = pk->version = 4;
     if( expireval ) {
@@ -786,21 +789,21 @@ gen_elg(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	sk->protect.s2k = *s2k;
 	rc = protect_secret_key( sk, dek );
 	if( rc ) {
-	    log_error("protect_secret_key failed: %s\n", g10_errstr(rc) );
+	    log_error("protect_secret_key failed: %s\n", gpg_strerror (rc) );
 	    free_public_key(pk);
 	    free_secret_key(sk);
 	    return rc;
 	}
     }
 
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_PUBLIC_KEY : PKT_PUBLIC_SUBKEY;
     pkt->pkt.public_key = pk;
     add_kbnode(pub_root, new_kbnode( pkt ));
 
     /* don't know whether it makes sense to have the factors, so for now
      * we store them in the secret keyring (but they are not secret) */
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_SECRET_KEY : PKT_SECRET_SUBKEY;
     pkt->pkt.secret_key = sk;
     add_kbnode(sec_root, new_kbnode( pkt ));
@@ -824,8 +827,8 @@ gen_dsa(unsigned int nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
     PACKET *pkt;
     PKT_secret_key *sk;
     PKT_public_key *pk;
-    MPI skey[5];
-    MPI *factors;
+    gcry_mpi_t skey[5];
+    gcry_mpi_t *factors;
 
     if( nbits > 1024 || nbits < 512 ) {
 	nbits = 1024;
@@ -837,14 +840,15 @@ gen_dsa(unsigned int nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	log_info(_("keysize rounded up to %u bits\n"), nbits );
     }
 
-    rc = pubkey_generate( PUBKEY_ALGO_DSA, nbits, skey, &factors );
+#warning need to implement this
+    rc = -1 /*pubkey_generate( PUBKEY_ALGO_DSA, nbits, skey, &factors )*/;
     if( rc ) {
-	log_error("pubkey_generate failed: %s\n", g10_errstr(rc) );
+	log_error("pubkey_generate failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    sk = m_alloc_clear( sizeof *sk );
-    pk = m_alloc_clear( sizeof *pk );
+    sk = xcalloc (1, sizeof *sk );
+    pk = xcalloc (1, sizeof *pk );
     sk->timestamp = pk->timestamp = make_timestamp();
     sk->version = pk->version = 4;
     if( expireval ) {
@@ -872,14 +876,14 @@ gen_dsa(unsigned int nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	sk->protect.s2k = *s2k;
 	rc = protect_secret_key( sk, dek );
 	if( rc ) {
-	    log_error("protect_secret_key failed: %s\n", g10_errstr(rc) );
+	    log_error("protect_secret_key failed: %s\n", gpg_strerror (rc) );
 	    free_public_key(pk);
 	    free_secret_key(sk);
 	    return rc;
 	}
     }
 
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_PUBLIC_KEY : PKT_PUBLIC_SUBKEY;
     pkt->pkt.public_key = pk;
     add_kbnode(pub_root, new_kbnode( pkt ));
@@ -890,7 +894,7 @@ gen_dsa(unsigned int nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
      * We store only f1 to f_n-1;  fn can be calculated because p and q
      * are known.
      */
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_SECRET_KEY : PKT_SECRET_SUBKEY;
     pkt->pkt.secret_key = sk;
     add_kbnode(sec_root, new_kbnode( pkt ));
@@ -913,8 +917,8 @@ gen_rsa(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
     PACKET *pkt;
     PKT_secret_key *sk;
     PKT_public_key *pk;
-    MPI skey[6];
-    MPI *factors;
+    gcry_mpi_t skey[6];
+    gcry_mpi_t *factors;
 
     assert( is_RSA(algo) );
 
@@ -928,14 +932,15 @@ gen_rsa(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	log_info(_("keysize rounded up to %u bits\n"), nbits );
     }
 
-    rc = pubkey_generate( algo, nbits, skey, &factors );
+#warning need to implement this
+    rc = -1 /*pubkey_generate( algo, nbits, skey, &factors )*/;
     if( rc ) {
-	log_error("pubkey_generate failed: %s\n", g10_errstr(rc) );
+	log_error("pubkey_generate failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
-    sk = m_alloc_clear( sizeof *sk );
-    pk = m_alloc_clear( sizeof *pk );
+    sk = xcalloc (1, sizeof *sk );
+    pk = xcalloc (1, sizeof *pk );
     sk->timestamp = pk->timestamp = make_timestamp();
     sk->version = pk->version = 4;
     if( expireval ) {
@@ -965,19 +970,19 @@ gen_rsa(int algo, unsigned nbits, KBNODE pub_root, KBNODE sec_root, DEK *dek,
 	sk->protect.s2k = *s2k;
 	rc = protect_secret_key( sk, dek );
 	if( rc ) {
-	    log_error("protect_secret_key failed: %s\n", g10_errstr(rc) );
+	    log_error("protect_secret_key failed: %s\n", gpg_strerror (rc) );
 	    free_public_key(pk);
 	    free_secret_key(sk);
 	    return rc;
 	}
     }
 
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_PUBLIC_KEY : PKT_PUBLIC_SUBKEY;
     pkt->pkt.public_key = pk;
     add_kbnode(pub_root, new_kbnode( pkt ));
 
-    pkt = m_alloc_clear(sizeof *pkt);
+    pkt = xcalloc (1,sizeof *pkt);
     pkt->pkttype = ret_sk ? PKT_SECRET_KEY : PKT_SECRET_SUBKEY;
     pkt->pkt.secret_key = sk;
     add_kbnode(sec_root, new_kbnode( pkt ));
@@ -1043,7 +1048,7 @@ ask_algo (int addmode, unsigned int *r_usage)
 	answer = cpr_get("keygen.algo",_("Your selection? "));
 	cpr_kill_prompt();
 	algo = *answer? atoi(answer): 1;
-	m_free(answer);
+	xfree (answer);
 	if( algo == 1 && !addmode ) {
 	    algo = 0;	/* create both keys */
 	    break;
@@ -1103,7 +1108,7 @@ ask_keysize( int algo )
                       "              minimum keysize is  768 bits\n"
                       "              default keysize is 1024 bits\n"
                       "    highest suggested keysize is 2048 bits\n"),
-                    pubkey_algo_to_string(algo) );
+                    gcry_pk_algo_name (algo) );
     }
 
     for(;;) {
@@ -1111,7 +1116,7 @@ ask_keysize( int algo )
 			  _("What keysize do you want? (1024) "));
 	cpr_kill_prompt();
 	nbits = *answer? atoi(answer): 1024;
-	m_free(answer);
+	xfree (answer);
 	if( algo == PUBKEY_ALGO_DSA && (nbits < 512 || nbits > 1024) )
 	    tty_printf(_("DSA only allows keysizes from 512 to 1024\n"));
 	else if( algo == PUBKEY_ALGO_RSA && nbits < 1024 )
@@ -1234,7 +1239,7 @@ ask_expire_interval(int object)
     for(;;) {
 	u32 curtime=make_timestamp();
 
-	m_free(answer);
+	xfree (answer);
 	if(object==0)
 	  answer = cpr_get("keygen.valid",_("Key is valid for? (0) "));
 	else
@@ -1269,7 +1274,7 @@ ask_expire_interval(int object)
 					    _("Is this correct (y/n)? ")) )
 	    break;
     }
-    m_free(answer);
+    xfree (answer);
     return interval;
 }
 
@@ -1280,6 +1285,19 @@ ask_expiredate()
     return x? make_timestamp() + x : 0;
 }
 
+
+static int
+count_chr( const char *string, int c )
+{
+  int count;
+
+  for (count=0; *string; string++ )
+    if ( *string == c )
+      count++;
+  return count;
+}
+
+
 static int
 has_invalid_email_chars( const char *s )
 {
@@ -1320,7 +1338,7 @@ ask_user_id( int mode )
 
 	if( !aname ) {
 	    for(;;) {
-		m_free(aname);
+		xfree (aname);
 		aname = cpr_get("keygen.name",_("Real name: "));
 		trim_spaces(aname);
 		cpr_kill_prompt();
@@ -1340,14 +1358,14 @@ ask_user_id( int mode )
 	}
 	if( !amail ) {
 	    for(;;) {
-		m_free(amail);
+		xfree (amail);
 		amail = cpr_get("keygen.email",_("Email address: "));
 		trim_spaces(amail);
 		cpr_kill_prompt();
 		if( !*amail )
 		    break;   /* no email address is okay */
 		else if( has_invalid_email_chars(amail)
-			 || string_count_chr(amail,'@') != 1
+			 || count_chr(amail,'@') != 1
 			 || *amail == '@'
 			 || amail[strlen(amail)-1] == '@'
 			 || amail[strlen(amail)-1] == '.'
@@ -1359,7 +1377,7 @@ ask_user_id( int mode )
 	}
 	if( !acomment ) {
 	    for(;;) {
-		m_free(acomment);
+		xfree (acomment);
 		acomment = cpr_get("keygen.comment",_("Comment: "));
 		trim_spaces(acomment);
 		cpr_kill_prompt();
@@ -1373,19 +1391,14 @@ ask_user_id( int mode )
 	}
 
 
-	m_free(uid);
-	uid = p = m_alloc(strlen(aname)+strlen(amail)+strlen(acomment)+12+10);
+	xfree (uid);
+	uid = p = xmalloc (strlen(aname)+strlen(amail)+strlen(acomment)+12+10);
 	p = stpcpy(p, aname );
 	if( *acomment )
 	    p = stpcpy(stpcpy(stpcpy(p," ("), acomment),")");
 	if( *amail )
 	    p = stpcpy(stpcpy(stpcpy(p," <"), amail),">");
 
-	/* append a warning if we do not have dev/random
-	 * or it is switched into  quick testmode */
-	if( quick_random_gen(-1) )
-	    strcpy(p, " (INSECURE!)" );
-
 	/* print a note in case that UTF8 mapping has to be done */
 	for(p=uid; *p; p++ ) {
 	    if( *p & 0x80 ) {
@@ -1409,7 +1422,7 @@ ask_user_id( int mode )
 	    if( strlen(ansstr) != 10 )
 		BUG();
 	    if( cpr_enabled() ) {
-		answer = m_strdup(ansstr+6);
+		answer = xstrdup (ansstr+6);
 		answer[1] = 0;
 	    }
 	    else {
@@ -1421,15 +1434,15 @@ ask_user_id( int mode )
 	    if( strlen(answer) > 1 )
 		;
 	    else if( *answer == ansstr[0] || *answer == ansstr[1] ) {
-		m_free(aname); aname = NULL;
+		xfree (aname); aname = NULL;
 		break;
 	    }
 	    else if( *answer == ansstr[2] || *answer == ansstr[3] ) {
-		m_free(acomment); acomment = NULL;
+		xfree (acomment); acomment = NULL;
 		break;
 	    }
 	    else if( *answer == ansstr[4] || *answer == ansstr[5] ) {
-		m_free(amail); amail = NULL;
+		xfree (amail); amail = NULL;
 		break;
 	    }
 	    else if( *answer == ansstr[6] || *answer == ansstr[7] ) {
@@ -1437,29 +1450,29 @@ ask_user_id( int mode )
 		    tty_printf(_("Please correct the error first\n"));
 		}
 		else {
-		    m_free(aname); aname = NULL;
-		    m_free(acomment); acomment = NULL;
-		    m_free(amail); amail = NULL;
+		    xfree (aname); aname = NULL;
+		    xfree (acomment); acomment = NULL;
+		    xfree (amail); amail = NULL;
 		    break;
 		}
 	    }
 	    else if( *answer == ansstr[8] || *answer == ansstr[9] ) {
-		m_free(aname); aname = NULL;
-		m_free(acomment); acomment = NULL;
-		m_free(amail); amail = NULL;
-		m_free(uid); uid = NULL;
+		xfree (aname); aname = NULL;
+		xfree (acomment); acomment = NULL;
+		xfree (amail); amail = NULL;
+		xfree (uid); uid = NULL;
 		break;
 	    }
-	    m_free(answer);
+	    xfree (answer);
 	}
-	m_free(answer);
+	xfree (answer);
 	if( !amail && !acomment && !amail )
 	    break;
-	m_free(uid); uid = NULL;
+	xfree (uid); uid = NULL;
     }
     if( uid ) {
 	char *p = native_to_utf8( uid );
-	m_free( uid );
+	xfree ( uid );
 	uid = p;
     }
     return uid;
@@ -1475,7 +1488,7 @@ ask_passphrase( STRING2KEY **ret_s2k )
 
     tty_printf(_("You need a Passphrase to protect your secret key.\n\n") );
 
-    s2k = m_alloc_secure( sizeof *s2k );
+    s2k = xmalloc_secure ( sizeof *s2k );
     for(;;) {
 	s2k->mode = opt.s2k_mode;
 	s2k->hash_algo = opt.s2k_digest_algo;
@@ -1486,8 +1499,8 @@ ask_passphrase( STRING2KEY **ret_s2k )
 	    tty_printf(_("%s.\n"), _(errtext));
 	}
 	else if( !dek->keylen ) {
-	    m_free(dek); dek = NULL;
-	    m_free(s2k); s2k = NULL;
+	    xfree (dek); dek = NULL;
+	    xfree (s2k); s2k = NULL;
 	    tty_printf(_(
 	    "You don't want a passphrase - this is probably a *bad* idea!\n"
 	    "I will do it anyway.  You can change your passphrase at any time,\n"
@@ -1552,7 +1565,7 @@ generate_user_id()
     if( !p )
 	return NULL;
     n = strlen(p);
-    uid = m_alloc_clear( sizeof *uid + n - 1 );
+    uid = xcalloc (1, sizeof *uid + n - 1 );
     uid->len = n;
     strcpy(uid->name, p);
     uid->ref = 1;
@@ -1568,11 +1581,11 @@ release_parameter_list( struct para_data_s *r )
     for( ; r ; r = r2 ) {
 	r2 = r->next;
 	if( r->key == pPASSPHRASE_DEK )
-	    m_free( r->u.dek );
+	    xfree ( r->u.dek );
 	else if( r->key == pPASSPHRASE_S2K )
-	    m_free( r->u.s2k );
+	    xfree ( r->u.s2k );
 
-	m_free(r);
+	xfree (r);
     }
 }
 
@@ -1603,7 +1616,7 @@ get_parameter_algo( struct para_data_s *para, enum para_name key )
     if( isdigit( *r->u.value ) )
 	i = atoi( r->u.value );
     else
-        i = string_to_pubkey_algo( r->u.value );
+        i = openpgp_pk_map_name ( r->u.value );
     if (i == PUBKEY_ALGO_RSA_E || i == PUBKEY_ALGO_RSA_S)
       i = 0; /* we don't want to allow generation of these algorithms */
     return i;
@@ -1750,7 +1763,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
     /* check that we have all required parameters */
     assert( get_parameter( para, pKEYTYPE ) );
     i = get_parameter_algo( para, pKEYTYPE );
-    if( i < 1 || check_pubkey_algo2( i, PUBKEY_USAGE_SIG ) ) {
+    if( i < 1 || openpgp_pk_test_algo ( i, PUBKEY_USAGE_SIG ) ) {
 	r = get_parameter( para, pKEYTYPE );
 	log_error("%s:%d: invalid algorithm\n", fname, r->lnr );
 	return -1;
@@ -1760,7 +1773,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
         return -1;
 
     i = get_parameter_algo( para, pSUBKEYTYPE );
-    if( i > 0 && check_pubkey_algo( i ) ) {
+    if( i > 0 && openpgp_pk_test_algo ( i, 0 ) ) {
 	r = get_parameter( para, pSUBKEYTYPE );
 	log_error("%s:%d: invalid algorithm\n", fname, r->lnr );
 	return -1;
@@ -1776,7 +1789,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
 	s3 = get_parameter_value( para, pNAMEEMAIL );
 	if( s1 || s2 || s3 ) {
 	    n = (s1?strlen(s1):0) + (s2?strlen(s2):0) + (s3?strlen(s3):0);
-	    r = m_alloc_clear( sizeof *r + n + 20 );
+	    r = xcalloc (1, sizeof *r + n + 20 );
 	    r->key = pUSERID;
 	    p = r->u.value;
 	    if( s1 )
@@ -1806,7 +1819,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
 	STRING2KEY *s2k;
 	DEK *dek;
 
-	s2k = m_alloc_secure( sizeof *s2k );
+	s2k = xmalloc_secure ( sizeof *s2k );
 	s2k->mode = opt.s2k_mode;
 	s2k->hash_algo = opt.s2k_digest_algo;
 	set_next_passphrase( r->u.value );
@@ -1816,12 +1829,12 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
 	assert( dek );
 	memset( r->u.value, 0, strlen(r->u.value) );
 
-	r = m_alloc_clear( sizeof *r );
+	r = xcalloc (1, sizeof *r );
 	r->key = pPASSPHRASE_S2K;
 	r->u.s2k = s2k;
 	r->next = para;
 	para = r;
-	r = m_alloc_clear( sizeof *r );
+	r = xcalloc (1, sizeof *r );
 	r->key = pPASSPHRASE_DEK;
 	r->u.dek = dek;
 	r->next = para;
@@ -1839,7 +1852,7 @@ proc_parameter_file( struct para_data_s *para, const char *fname,
 	r->u.expire = i * 86400L;
 	r->key = pKEYEXPIRE;  /* change hat entry */
 	/* also set it for the subkey */
-	r = m_alloc_clear( sizeof *r + 20 );
+	r = xcalloc (1, sizeof *r + 20 );
 	r->key = pSUBKEYEXPIRE;
 	r->u.expire = i * 86400L;
 	r->next = para;
@@ -1943,8 +1956,8 @@ read_parameter_file( const char *fname )
 		if( outctrl.pub.fname && !strcmp( outctrl.pub.fname, value ) )
 		    ; /* still the same file - ignore it */
 		else {
-		    m_free( outctrl.pub.newfname );
-		    outctrl.pub.newfname = m_strdup( value );
+		    xfree ( outctrl.pub.newfname );
+		    outctrl.pub.newfname = xstrdup ( value );
 		    outctrl.use_files = 1;
 		}
 	    }
@@ -1952,8 +1965,8 @@ read_parameter_file( const char *fname )
 		if( outctrl.sec.fname && !strcmp( outctrl.sec.fname, value ) )
 		    ; /* still the same file - ignore it */
 		else {
-		   m_free( outctrl.sec.newfname );
-		   outctrl.sec.newfname = m_strdup( value );
+		   xfree ( outctrl.sec.newfname );
+		   outctrl.sec.newfname = xstrdup ( value );
 		   outctrl.use_files = 1;
 		}
 	    }
@@ -2009,7 +2022,7 @@ read_parameter_file( const char *fname )
 		break;
 	    }
 	}
-	r = m_alloc_clear( sizeof *r + strlen( value ) );
+	r = xcalloc (1, sizeof *r + strlen( value ) );
 	r->lnr = lnr;
 	r->key = keywords[i].key;
 	strcpy( r->u.value, value );
@@ -2029,10 +2042,10 @@ read_parameter_file( const char *fname )
     if( outctrl.use_files ) { /* close open streams */
 	iobuf_close( outctrl.pub.stream );
 	iobuf_close( outctrl.sec.stream );
-	m_free( outctrl.pub.fname );
-	m_free( outctrl.pub.newfname );
-	m_free( outctrl.sec.fname );
-	m_free( outctrl.sec.newfname );
+	xfree ( outctrl.pub.fname );
+	xfree ( outctrl.pub.newfname );
+	xfree ( outctrl.sec.fname );
+	xfree ( outctrl.sec.newfname );
     }
 
     release_parameter_list( para );
@@ -2070,34 +2083,34 @@ generate_keypair( const char *fname )
     algo = ask_algo( 0, &use );
     if( !algo ) { /* default: DSA with ElG subkey of the specified size */
 	both = 1;
-	r = m_alloc_clear( sizeof *r + 20 );
+	r = xcalloc (1, sizeof *r + 20 );
 	r->key = pKEYTYPE;
 	sprintf( r->u.value, "%d", PUBKEY_ALGO_DSA );
 	r->next = para;
 	para = r;
 	tty_printf(_("DSA keypair will have 1024 bits.\n"));
-	r = m_alloc_clear( sizeof *r + 20 );
+	r = xcalloc (1, sizeof *r + 20 );
 	r->key = pKEYLENGTH;
 	strcpy( r->u.value, "1024" );
 	r->next = para;
 	para = r;
 
 	algo = PUBKEY_ALGO_ELGAMAL_E;
-	r = m_alloc_clear( sizeof *r + 20 );
+	r = xcalloc (1, sizeof *r + 20 );
 	r->key = pSUBKEYTYPE;
 	sprintf( r->u.value, "%d", algo );
 	r->next = para;
 	para = r;
     }
     else {
-	r = m_alloc_clear( sizeof *r + 20 );
+	r = xcalloc (1, sizeof *r + 20 );
 	r->key = pKEYTYPE;
 	sprintf( r->u.value, "%d", algo );
 	r->next = para;
 	para = r;
 
         if (use) {
-            r = m_alloc_clear( sizeof *r + 20 );
+            r = xcalloc (1, sizeof *r + 20 );
             r->key = pKEYUSAGE;
             sprintf( r->u.value, "%s%s",
                      (use & PUBKEY_USAGE_SIG)? "sign ":"",
@@ -2109,19 +2122,19 @@ generate_keypair( const char *fname )
     }
 
     nbits = ask_keysize( algo );
-    r = m_alloc_clear( sizeof *r + 20 );
+    r = xcalloc (1, sizeof *r + 20 );
     r->key = both? pSUBKEYLENGTH : pKEYLENGTH;
     sprintf( r->u.value, "%u", nbits);
     r->next = para;
     para = r;
 
     expire = ask_expire_interval(0);
-    r = m_alloc_clear( sizeof *r + 20 );
+    r = xcalloc (1, sizeof *r + 20 );
     r->key = pKEYEXPIRE;
     r->u.expire = expire;
     r->next = para;
     para = r;
-    r = m_alloc_clear( sizeof *r + 20 );
+    r = xcalloc (1, sizeof *r + 20 );
     r->key = pSUBKEYEXPIRE;
     r->u.expire = expire;
     r->next = para;
@@ -2133,7 +2146,7 @@ generate_keypair( const char *fname )
 	release_parameter_list( para );
 	return;
     }
-    r = m_alloc_clear( sizeof *r + strlen(uid) );
+    r = xcalloc (1, sizeof *r + strlen(uid) );
     r->key = pUSERID;
     strcpy( r->u.value, uid );
     r->next = para;
@@ -2141,12 +2154,12 @@ generate_keypair( const char *fname )
 
     dek = ask_passphrase( &s2k );
     if( dek ) {
-	r = m_alloc_clear( sizeof *r );
+	r = xcalloc (1, sizeof *r );
 	r->key = pPASSPHRASE_DEK;
 	r->u.dek = dek;
 	r->next = para;
 	para = r;
-	r = m_alloc_clear( sizeof *r );
+	r = xcalloc (1, sizeof *r );
 	r->key = pPASSPHRASE_S2K;
 	r->u.s2k = s2k;
 	r->next = para;
@@ -2198,7 +2211,7 @@ do_generate_keypair( struct para_data_s *para,
 	if( outctrl->pub.newfname ) {
 	    iobuf_close(outctrl->pub.stream);
 	    outctrl->pub.stream = NULL;
-	    m_free( outctrl->pub.fname );
+	    xfree ( outctrl->pub.fname );
 	    outctrl->pub.fname =  outctrl->pub.newfname;
 	    outctrl->pub.newfname = NULL;
 
@@ -2217,7 +2230,7 @@ do_generate_keypair( struct para_data_s *para,
 	if( outctrl->sec.newfname ) {
 	    iobuf_close(outctrl->sec.stream);
 	    outctrl->sec.stream = NULL;
-	    m_free( outctrl->sec.fname );
+	    xfree ( outctrl->sec.fname );
 	    outctrl->sec.fname =  outctrl->sec.newfname;
 	    outctrl->sec.newfname = NULL;
 
@@ -2298,11 +2311,11 @@ do_generate_keypair( struct para_data_s *para,
     if( !rc && outctrl->use_files ) { /* direct write to specified files */
 	rc = write_keyblock( outctrl->pub.stream, pub_root );
 	if( rc )
-	    log_error("can't write public key: %s\n", g10_errstr(rc) );
+	    log_error("can't write public key: %s\n", gpg_strerror (rc) );
 	if( !rc ) {
 	    rc = write_keyblock( outctrl->sec.stream, sec_root );
 	    if( rc )
-		log_error("can't write secret key: %s\n", g10_errstr(rc) );
+		log_error("can't write secret key: %s\n", gpg_strerror (rc) );
 	}
 
     }
@@ -2314,13 +2327,13 @@ do_generate_keypair( struct para_data_s *para,
         rc = keydb_locate_writable (pub_hd, NULL);
         if (rc) 
     	    log_error (_("no writable public keyring found: %s\n"),
-                       g10_errstr (rc));
+                       gpg_strerror (rc));
 
         if (!rc) {  
             rc = keydb_locate_writable (sec_hd, NULL);
             if (rc) 
                 log_error (_("no writable secret keyring found: %s\n"),
-                           g10_errstr (rc));
+                           gpg_strerror (rc));
         }
 
         if (!rc && opt.verbose) {
@@ -2334,14 +2347,14 @@ do_generate_keypair( struct para_data_s *para,
 	    rc = keydb_insert_keyblock (pub_hd, pub_root);
             if (rc)
                 log_error (_("error writing public keyring `%s': %s\n"),
-                           keydb_get_resource_name (pub_hd), g10_errstr(rc));
+                           keydb_get_resource_name (pub_hd), gpg_strerror (rc));
         }
 
         if (!rc) {
 	    rc = keydb_insert_keyblock (sec_hd, sec_root);
             if (rc)
                 log_error (_("error writing secret keyring `%s': %s\n"),
-                           keydb_get_resource_name (pub_hd), g10_errstr(rc));
+                           keydb_get_resource_name (pub_hd), gpg_strerror (rc));
         }
 
         keydb_release (pub_hd);
@@ -2382,9 +2395,9 @@ do_generate_keypair( struct para_data_s *para,
 
     if( rc ) {
 	if( opt.batch )
-	    log_error("key generation failed: %s\n", g10_errstr(rc) );
+	    log_error("key generation failed: %s\n", gpg_strerror (rc) );
 	else
-	    tty_printf(_("Key generation failed: %s\n"), g10_errstr(rc) );
+	    tty_printf(_("Key generation failed: %s\n"), gpg_strerror (rc) );
     }
     else {
         PKT_public_key *pk = find_kbnode (pub_root, 
@@ -2435,7 +2448,7 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock )
 		       : _("key has been created %lu seconds "
 			   "in future (time warp or clock problem)\n"), d );
 	if( !opt.ignore_time_conflict ) {
-	    rc = G10ERR_TIME_CONFLICT;
+	    rc = GPG_ERR_TIME_CONFLICT;
 	    goto leave;
 	}
     }
@@ -2449,7 +2462,7 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock )
     /* unprotect to get the passphrase */
     switch( is_secret_key_protected( sk ) ) {
       case -1:
-	rc = G10ERR_PUBKEY_ALGO;
+	rc = GPG_ERR_PUBKEY_ALGO;
 	break;
       case 0:
 	tty_printf("This key is not protected.\n");
@@ -2474,7 +2487,7 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock )
 	goto leave;
 
     if( passphrase ) {
-	s2k = m_alloc_secure( sizeof *s2k );
+	s2k = xmalloc_secure ( sizeof *s2k );
 	s2k->mode = opt.s2k_mode;
 	s2k->hash_algo = opt.s2k_digest_algo;
 	set_next_passphrase( passphrase );
@@ -2495,10 +2508,10 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock )
 
   leave:
     if( rc )
-	log_error(_("Key generation failed: %s\n"), g10_errstr(rc) );
-    m_free( passphrase );
-    m_free( dek );
-    m_free( s2k );
+	log_error(_("Key generation failed: %s\n"), gpg_strerror (rc) );
+    xfree ( passphrase );
+    xfree ( dek );
+    xfree ( s2k );
     if( sk ) /* release the copy of the (now unprotected) secret key */
 	free_secret_key(sk);
     set_next_passphrase( NULL );
@@ -2509,14 +2522,14 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock )
  * Write a keyblock to an output stream
  */
 static int
-write_keyblock( IOBUF out, KBNODE node )
+write_keyblock( iobuf_t out, KBNODE node )
 {
     for( ; node ; node = node->next ) {
 	int rc = build_packet( out, node->pkt );
 	if( rc ) {
 	    log_error("build_packet(%d) failed: %s\n",
-			node->pkt->pkttype, g10_errstr(rc) );
-	    return G10ERR_WRITE_FILE;
+			node->pkt->pkttype, gpg_strerror (rc) );
+	    return rc;
 	}
     }
     return 0;
diff --git a/g10/keyid.c b/g10/keyid.c
index 09f24e8ea..78b637481 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -1,5 +1,5 @@
 /* keyid.c - key ID and fingerprint handling
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -25,6 +25,8 @@
 #include <errno.h>
 #include <time.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "main.h"
 #include "packet.h"
@@ -48,10 +50,10 @@ pubkey_letter( int algo )
     }
 }
 
-static MD_HANDLE
+static gcry_md_hd_t
 do_fingerprint_md( PKT_public_key *pk )
 {
-    MD_HANDLE md;
+    gcry_md_hd_t md;
     unsigned n;
     unsigned nb[PUBKEY_MAX_NPKEY];
     unsigned nn[PUBKEY_MAX_NPKEY];
@@ -59,27 +61,35 @@ do_fingerprint_md( PKT_public_key *pk )
     int i;
     int npkey = pubkey_get_npkey( pk->pubkey_algo );
 
-    md = md_open( pk->version < 4 ? DIGEST_ALGO_RMD160 : DIGEST_ALGO_SHA1, 0);
+    gcry_md_open (&md, pk->version < 4 ? DIGEST_ALGO_RMD160
+                                       : DIGEST_ALGO_SHA1, 0);
     n = pk->version < 4 ? 8 : 6;
     for(i=0; i < npkey; i++ ) {
-	nb[i] = mpi_get_nbits(pk->pkey[i]);
-	pp[i] = mpi_get_buffer( pk->pkey[i], nn+i, NULL );
+	size_t nbytes;
+
+	if (gcry_mpi_print( GCRYMPI_FMT_PGP, NULL, &nbytes, pk->pkey[i] ))
+          BUG ();
+	/* fixme: we should try to allocate a buffer on the stack */
+	pp[i] = xmalloc(nbytes);
+	if (gcry_mpi_print ( GCRYMPI_FMT_PGP, pp[i], &nbytes, pk->pkey[i] ))
+          BUG ();
+	nn[i] = nbytes;
 	n += 2 + nn[i];
     }
 
-    md_putc( md, 0x99 );     /* ctb */
-    md_putc( md, n >> 8 );   /* 2 byte length header */
-    md_putc( md, n );
+    gcry_md_putc ( md, 0x99 );     /* ctb */
+    gcry_md_putc ( md, n >> 8 );   /* 2 byte length header */
+    gcry_md_putc ( md, n );
     if( pk->version < 4 )
-	md_putc( md, 3 );
+	gcry_md_putc ( md, 3 );
     else
-	md_putc( md, 4 );
+	gcry_md_putc ( md, 4 );
 
     {	u32 a = pk->timestamp;
-	md_putc( md, a >> 24 );
-	md_putc( md, a >> 16 );
-	md_putc( md, a >>  8 );
-	md_putc( md, a	     );
+	gcry_md_putc ( md, a >> 24 );
+	gcry_md_putc ( md, a >> 16 );
+	gcry_md_putc ( md, a >>  8 );
+	gcry_md_putc ( md, a	     );
     }
     if( pk->version < 4 ) {
 	u16 a;
@@ -88,22 +98,22 @@ do_fingerprint_md( PKT_public_key *pk )
 	    a = (u16)((pk->expiredate - pk->timestamp) / 86400L);
 	else
 	    a = 0;
-	md_putc( md, a >> 8 );
-	md_putc( md, a	    );
+	gcry_md_putc ( md, a >> 8 );
+	gcry_md_putc ( md, a	    );
     }
-    md_putc( md, pk->pubkey_algo );
+    gcry_md_putc ( md, pk->pubkey_algo );
     for(i=0; i < npkey; i++ ) {
-	md_putc( md, nb[i]>>8);
-	md_putc( md, nb[i] );
-	md_write( md, pp[i], nn[i] );
-	m_free(pp[i]);
+	gcry_md_putc ( md, nb[i]>>8);
+	gcry_md_putc ( md, nb[i] );
+	gcry_md_write( md, pp[i], nn[i] );
+	xfree (pp[i]);
     }
-    md_final( md );
+    gcry_md_final ( md );
 
     return md;
 }
 
-static MD_HANDLE
+static gcry_md_hd_t
 do_fingerprint_md_sk( PKT_secret_key *sk )
 {
     PKT_public_key pk;
@@ -121,6 +131,31 @@ do_fingerprint_md_sk( PKT_secret_key *sk )
 }
 
 
+u32
+v3_keyid (gcry_mpi_t a, u32 *ki)
+{
+  byte *buffer;
+  size_t nbytes;
+
+  if (gcry_mpi_print (GCRYMPI_FMT_USG, NULL, &nbytes, a ))
+    BUG ();
+  /* fixme: allocate it on the stack */
+  buffer = xmalloc (nbytes);
+  if (gcry_mpi_print( GCRYMPI_FMT_USG, buffer, &nbytes, a ))
+    BUG ();
+  if (nbytes < 8) /* oops */
+    ki[0] = ki[1] = 0;
+  else 
+    {
+      memcpy (ki+0, buffer+nbytes-8, 4);
+      memcpy (ki+1, buffer+nbytes-4, 4);
+    }
+  xfree (buffer);
+  return ki[1];
+}
+
+
+
 /****************
  * Get the keyid from the secret key and put it into keyid
  * if this is not NULL. Return the 32 low bits of the keyid.
@@ -135,18 +170,19 @@ keyid_from_sk( PKT_secret_key *sk, u32 *keyid )
 	keyid = dummy_keyid;
 
     if( sk->version < 4 && is_RSA(sk->pubkey_algo) ) {
+        keyid[0] = keyid[1] = 0;
 	lowbits = pubkey_get_npkey(sk->pubkey_algo) ?
-		     mpi_get_keyid( sk->skey[0], keyid ) : 0; /* take n */
+		     v3_keyid (sk->skey[0], keyid) : 0; 
     }
     else {
 	const byte *dp;
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 	md = do_fingerprint_md_sk(sk);
-	dp = md_read( md, 0 );
+	dp = gcry_md_read ( md, 0 );
 	keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
 	keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
 	lowbits = keyid[1];
-	md_close(md);
+	gcry_md_close (md);
     }
 
     return lowbits;
@@ -172,20 +208,21 @@ keyid_from_pk( PKT_public_key *pk, u32 *keyid )
 	lowbits = keyid[1];
     }
     else if( pk->version < 4 && is_RSA(pk->pubkey_algo) ) {
+        keyid[0] = keyid[1] = 0;
 	lowbits = pubkey_get_npkey(pk->pubkey_algo) ?
-		     mpi_get_keyid( pk->pkey[0], keyid ) : 0 ; /* from n */
+		     v3_keyid (pk->pkey[0], keyid) : 0 ; 
 	pk->keyid[0] = keyid[0];
 	pk->keyid[1] = keyid[1];
     }
     else {
 	const byte *dp;
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 	md = do_fingerprint_md(pk);
-	dp = md_read( md, 0 );
+	dp = gcry_md_read ( md, 0 );
 	keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
 	keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
 	lowbits = keyid[1];
-	md_close(md);
+	gcry_md_close (md);
 	pk->keyid[0] = keyid[0];
 	pk->keyid[1] = keyid[1];
     }
@@ -246,12 +283,14 @@ namehash_from_uid(PKT_user_id *uid)
 {
   if(uid->namehash==NULL)
     {
-      uid->namehash=m_alloc(20);
+      uid->namehash=xmalloc (20);
 
       if(uid->attrib_data)
-	rmd160_hash_buffer(uid->namehash,uid->attrib_data,uid->attrib_len);
+        gcry_md_hash_buffer (GCRY_MD_RMD160, uid->namehash,
+                             uid->attrib_data,uid->attrib_len);
       else
-	rmd160_hash_buffer(uid->namehash,uid->name,uid->len);
+	gcry_md_hash_buffer (GCRY_MD_RMD160, uid->namehash,
+                             uid->name,uid->len);
     }
 
   return uid->namehash;
@@ -427,43 +466,54 @@ colon_expirestr_from_sig (PKT_signature *sig)
 byte *
 fingerprint_from_pk( PKT_public_key *pk, byte *array, size_t *ret_len )
 {
-    byte *p, *buf;
+    byte *buf;
     const byte *dp;
     size_t len;
-    unsigned int n;
 
     if( pk->version < 4 && is_RSA(pk->pubkey_algo) ) {
 	/* RSA in version 3 packets is special */
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 
-	md = md_open( DIGEST_ALGO_MD5, 0);
+	gcry_md_open (&md, DIGEST_ALGO_MD5, 0);
 	if( pubkey_get_npkey( pk->pubkey_algo ) > 1 ) {
-	    p = buf = mpi_get_buffer( pk->pkey[0], &n, NULL );
-	    md_write( md, p, n );
-	    m_free(buf);
-	    p = buf = mpi_get_buffer( pk->pkey[1], &n, NULL );
-	    md_write( md, p, n );
-	    m_free(buf);
+	    size_t nbytes;
+
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, NULL, &nbytes, pk->pkey[0]))
+              BUG ();
+	    /* fixme: allocate it on the stack */
+	    buf = xmalloc(nbytes);
+	    if (gcry_mpi_print (GCRYMPI_FMT_USG, buf, &nbytes, pk->pkey[0]))
+              BUG ();
+	    gcry_md_write (md, buf, nbytes);
+	    xfree (buf);
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, NULL, &nbytes, pk->pkey[1]))
+              BUG ();
+	    /* fixme: allocate it on the stack */
+	    buf = xmalloc(nbytes);
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, buf, &nbytes, pk->pkey[1]))
+              BUG ();
+	    gcry_md_write( md, buf, nbytes );
+	    xfree(buf);
 	}
-	md_final(md);
+	gcry_md_final (md);
 	if( !array )
-	    array = m_alloc( 16 );
+	    array = xmalloc ( 16 );
 	len = 16;
-	memcpy(array, md_read(md, DIGEST_ALGO_MD5), 16 );
-	md_close(md);
+	memcpy(array, gcry_md_read (md, DIGEST_ALGO_MD5), 16 );
+	gcry_md_close (md);
     }
     else {
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 	md = do_fingerprint_md(pk);
-	dp = md_read( md, 0 );
-	len = md_digest_length( md_get_algo( md ) );
+	dp = gcry_md_read ( md, 0 );
+	len = gcry_md_get_algo_dlen (gcry_md_get_algo (md));
 	assert( len <= MAX_FINGERPRINT_LEN );
 	if( !array )
-	    array = m_alloc( len );
+	    array = xmalloc ( len );
 	memcpy(array, dp, len );
 	pk->keyid[0] = dp[12] << 24 | dp[13] << 16 | dp[14] << 8 | dp[15] ;
 	pk->keyid[1] = dp[16] << 24 | dp[17] << 16 | dp[18] << 8 | dp[19] ;
-	md_close(md);
+	gcry_md_close (md);
     }
 
     *ret_len = len;
@@ -473,41 +523,53 @@ fingerprint_from_pk( PKT_public_key *pk, byte *array, size_t *ret_len )
 byte *
 fingerprint_from_sk( PKT_secret_key *sk, byte *array, size_t *ret_len )
 {
-    byte *p, *buf;
+    byte  *buf;
     const char *dp;
     size_t len;
-    unsigned n;
 
     if( sk->version < 4 && is_RSA(sk->pubkey_algo) ) {
 	/* RSA in version 3 packets is special */
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 
-	md = md_open( DIGEST_ALGO_MD5, 0);
+	gcry_md_open (&md, DIGEST_ALGO_MD5, 0);
 	if( pubkey_get_npkey( sk->pubkey_algo ) > 1 ) {
-	    p = buf = mpi_get_buffer( sk->skey[0], &n, NULL );
-	    md_write( md, p, n );
-	    m_free(buf);
-	    p = buf = mpi_get_buffer( sk->skey[1], &n, NULL );
-	    md_write( md, p, n );
-	    m_free(buf);
+	    size_t nbytes;
+
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, NULL, &nbytes, sk->skey[0]))
+              BUG ();
+	    /* fixme: allocate it on the stack */
+	    buf = xmalloc(nbytes);
+	    if (gcry_mpi_print (GCRYMPI_FMT_USG, buf, &nbytes, sk->skey[0]))
+              BUG ();
+	    gcry_md_write (md, buf, nbytes);
+	    xfree (buf);
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, NULL, &nbytes, sk->skey[1]))
+              BUG ();
+	    /* fixme: allocate it on the stack */
+	    buf = xmalloc(nbytes);
+	    if (gcry_mpi_print( GCRYMPI_FMT_USG, buf, &nbytes, sk->skey[1]))
+              BUG ();
+	    gcry_md_write( md, buf, nbytes );
+	    xfree(buf);
 	}
-	md_final(md);
+	gcry_md_final (md);
 	if( !array )
-	    array = m_alloc( 16 );
+	    array = xmalloc ( 16 );
 	len = 16;
-	memcpy(array, md_read(md, DIGEST_ALGO_MD5), 16 );
-	md_close(md);
+	memcpy(array, gcry_md_read (md, DIGEST_ALGO_MD5), 16 );
+	gcry_md_close (md);
     }
     else {
-	MD_HANDLE md;
+	gcry_md_hd_t md;
+
 	md = do_fingerprint_md_sk(sk);
-	dp = md_read( md, 0 );
-	len = md_digest_length( md_get_algo( md ) );
+	dp = gcry_md_read ( md, 0 );
+	len = gcry_md_get_algo_dlen (gcry_md_get_algo (md));
 	assert( len <= MAX_FINGERPRINT_LEN );
 	if( !array )
-	    array = m_alloc( len );
+	    array = xmalloc ( len );
 	memcpy(array, dp, len );
-	md_close(md);
+	gcry_md_close (md);
     }
 
     *ret_len = len;
diff --git a/g10/keylist.c b/g10/keylist.c
index 616cea8c9..ef2cb5676 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -88,7 +88,7 @@ print_seckey_info (PKT_secret_key *sk)
     
     p = get_user_id (sk_keyid, &n);
     tty_print_utf8_string (p, n);
-    m_free (p);
+    xfree (p);
 
     tty_printf ("\n");   
 }
@@ -109,7 +109,7 @@ print_pubkey_info (PKT_public_key *pk)
 
   p = get_user_id (pk_keyid, &n);
   tty_print_utf8_string (p, n);
-  m_free (p);
+  xfree (p);
   
   tty_printf ("\n\n"); 
 }
@@ -126,7 +126,7 @@ show_policy_url(PKT_signature *sig,int indent,int mode)
   const byte *p;
   size_t len;
   int seq=0,crit;
-  FILE *fp=mode?log_stream():stdout;
+  FILE *fp=mode?log_get_stream():stdout;
 
   while((p=enum_sig_subpkt(sig->hashed,SIGSUBPKT_POLICY,&len,&seq,&crit)))
     {
@@ -168,7 +168,7 @@ show_notation(PKT_signature *sig,int indent,int mode)
   const byte *p;
   size_t len;
   int seq=0,crit;
-  FILE *fp=mode?log_stream():stdout;
+  FILE *fp=mode?log_get_stream():stdout;
 
   /* There may be multiple notations in the same sig. */
 
@@ -254,12 +254,12 @@ list_all( int secret )
 
     hd = keydb_new (secret);
     if (!hd)
-        rc = G10ERR_GENERAL;
+        rc = GPG_ERR_GENERAL;
     else
         rc = keydb_search_first (hd);
     if( rc ) {
 	if( rc != -1 )
-	    log_error("keydb_search_first failed: %s\n", g10_errstr(rc) );
+	    log_error("keydb_search_first failed: %s\n", gpg_strerror (rc) );
 	goto leave;
     }
 
@@ -267,7 +267,7 @@ list_all( int secret )
     do {
         rc = keydb_get_keyblock (hd, &keyblock);
         if (rc) {
-            log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
+            log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
             goto leave;
         }
 	if(!opt.with_colons)
@@ -291,7 +291,7 @@ list_all( int secret )
         keyblock = NULL;
     } while (!(rc = keydb_search_next (hd)));
     if( rc && rc != -1 )
-	log_error ("keydb_search_next failed: %s\n", g10_errstr(rc));
+	log_error ("keydb_search_next failed: %s\n", gpg_strerror (rc));
 
     if(opt.check_sigs && !opt.with_colons)
       print_signature_stats(&stats);
@@ -327,7 +327,7 @@ list_one( STRLIST names, int secret )
     if( secret ) {
 	rc = get_seckey_bynames( &ctx, NULL, names, &keyblock );
 	if( rc ) {
-	    log_error("error reading key: %s\n",  g10_errstr(rc) );
+	    log_error("error reading key: %s\n",  gpg_strerror (rc) );
 	    get_seckey_end( ctx );
 	    return;
 	}
@@ -347,7 +347,7 @@ list_one( STRLIST names, int secret )
     else {
 	rc = get_pubkey_bynames( &ctx, NULL, names, &keyblock );
 	if( rc ) {
-	    log_error("error reading key: %s\n", g10_errstr(rc) );
+	    log_error("error reading key: %s\n", gpg_strerror (rc) );
 	    get_pubkey_end( ctx );
 	    return;
 	}
@@ -680,11 +680,11 @@ list_keyblock_print ( KBNODE keyblock, int secret, int fpr, void *opaque )
 	    if( stats ) {
                 /*fflush(stdout);*/
 		rc = check_key_signature( keyblock, node, NULL );
-		switch( rc ) {
+		switch( gpg_err_code (rc) ) {
 		 case 0:		 sigrc = '!'; break;
-		 case G10ERR_BAD_SIGN:   stats->inv_sigs++; sigrc = '-'; break;
-		 case G10ERR_NO_PUBKEY: 
-		 case G10ERR_UNU_PUBKEY: stats->no_key++; continue;
+		 case GPG_ERR_BAD_SIGNATURE:   stats->inv_sigs++; sigrc = '-'; break;
+		 case GPG_ERR_NO_PUBKEY: 
+		 case GPG_ERR_UNUSABLE_PUBKEY: stats->no_key++; continue;
 		 default:		 stats->oth_err++; sigrc = '%'; break;
 		}
 
@@ -748,14 +748,14 @@ list_keyblock_print ( KBNODE keyblock, int secret, int fpr, void *opaque )
 	      printf("%08lX",(ulong)sig->keyid[1]);
 	    printf(" %s   ", datestr_from_sig(sig));
 	    if( sigrc == '%' )
-		printf("[%s] ", g10_errstr(rc) );
+		printf("[%s] ", gpg_strerror (rc) );
 	    else if( sigrc == '?' )
 		;
 	    else if ( !opt.fast_list_mode ) {
 		size_t n;
 		char *p = get_user_id( sig->keyid, &n );
                 print_utf8_string( stdout, p, n );
-		m_free(p);
+		xfree (p);
 	    }
 	    putchar('\n');
 
@@ -1024,11 +1024,11 @@ list_keyblock_colon( KBNODE keyblock, int secret, int fpr )
 	    if( opt.check_sigs ) {
 		fflush(stdout);
 		rc = check_key_signature( keyblock, node, NULL );
-		switch( rc ) {
+		switch( gpg_err_code (rc) ) {
 		  case 0:		   sigrc = '!'; break;
-		  case G10ERR_BAD_SIGN:    sigrc = '-'; break;
-		  case G10ERR_NO_PUBKEY: 
-		  case G10ERR_UNU_PUBKEY:  sigrc = '?'; break;
+		  case GPG_ERR_BAD_SIGNATURE:    sigrc = '-'; break;
+		  case GPG_ERR_NO_PUBKEY: 
+		  case GPG_ERR_UNUSABLE_PUBKEY:  sigrc = '?'; break;
 		  default:		   sigrc = '%'; break;
 		}
 	    }
@@ -1055,14 +1055,14 @@ list_keyblock_colon( KBNODE keyblock, int secret, int fpr )
 	    printf(":");
 
 	    if( sigrc == '%' )
-		printf("[%s] ", g10_errstr(rc) );
+		printf("[%s] ", gpg_strerror (rc) );
 	    else if( sigrc == '?' )
 		;
 	    else if ( !opt.fast_list_mode ) {
 		size_t n;
 		char *p = get_user_id( sig->keyid, &n );
                 print_string( stdout, p, n, ':' );
-		m_free(p);
+		xfree (p);
 	    }
             printf(":%02x%c:\n", sig->sig_class,sig->flags.exportable?'x':'l');
 	    /* fixme: check or list other sigs here */
@@ -1170,14 +1170,14 @@ print_fingerprint (PKT_public_key *pk, PKT_secret_key *sk, int mode )
       {
 	if(sk)
 	  {
-	    PKT_secret_key *primary_sk=m_alloc_clear(sizeof(*primary_sk));
+	    PKT_secret_key *primary_sk=xcalloc (1,sizeof(*primary_sk));
 	    get_seckey(primary_sk,sk->main_keyid);
 	    print_fingerprint(NULL,primary_sk,mode|0x80);
 	    free_secret_key(primary_sk);
 	  }
 	else
 	  {
-	    PKT_public_key *primary_pk=m_alloc_clear(sizeof(*primary_pk));
+	    PKT_public_key *primary_pk=xcalloc (1,sizeof(*primary_pk));
 	    get_pubkey(primary_pk,pk->main_keyid);
 	    print_fingerprint(primary_pk,NULL,mode|0x80);
 	    free_public_key(primary_pk);
@@ -1185,7 +1185,7 @@ print_fingerprint (PKT_public_key *pk, PKT_secret_key *sk, int mode )
       }
 
     if (mode == 1) {
-        fp = log_stream ();
+        fp = log_get_stream ();
 	if(primary)
 	  text = _("Primary key fingerprint:");
 	else
diff --git a/g10/keyring.c b/g10/keyring.c
index f8b6e1520..cc1150065 100644
--- a/g10/keyring.c
+++ b/g10/keyring.c
@@ -1,5 +1,5 @@
 /* keyring.c - keyring file handling
- * Copyright (C) 2001 Free Software Foundation, Inc.
+ * Copyright (C) 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -28,6 +28,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
+#include "gpg.h"
 #include "util.h"
 #include "keyring.h"
 #include "packet.h"
@@ -72,7 +73,7 @@ struct keyring_handle {
   int secret;             /* this is for a secret keyring */
   struct {
     CONST_KR_NAME kr;
-    IOBUF iobuf;
+    iobuf_t iobuf;
     int eof;
     int error;
   } current;
@@ -101,7 +102,7 @@ new_offset_item (void)
 {
   struct off_item *k;
   
-  k = m_alloc_clear (sizeof *k);
+  k = xcalloc (1,sizeof *k);
   return k;
 }
 
@@ -114,7 +115,7 @@ release_offset_items (struct off_item *k)
   for (; k; k = k2)
     {
       k2 = k->next;
-      m_free (k);
+      xfree (k);
     }
 }
 #endif
@@ -124,7 +125,7 @@ new_offset_hash_table (void)
 {
   struct off_item **tbl;
 
-  tbl = m_alloc_clear (2048 * sizeof *tbl);
+  tbl = xcalloc (1,2048 * sizeof *tbl);
   return tbl;
 }
 
@@ -138,7 +139,7 @@ release_offset_hash_table (OffsetHashTable tbl)
     return;
   for (i=0; i < 2048; i++)
     release_offset_items (tbl[i]);
-  m_free (tbl);
+  xfree (tbl);
 }
 #endif
 
@@ -213,7 +214,7 @@ keyring_register_filename (const char *fname, int secret, void **ptr)
 	  }
       }
 
-    kr = m_alloc (sizeof *kr + strlen (fname));
+    kr = xmalloc (sizeof *kr + strlen (fname));
     strcpy (kr->fname, fname);
     kr->secret = !!secret;
     kr->lockhd = NULL;
@@ -254,7 +255,7 @@ keyring_new (void *token, int secret)
 
   assert (resource && !resource->secret == !secret);
   
-  hd = m_alloc_clear (sizeof *hd);
+  hd = xcalloc (1,sizeof *hd);
   hd->resource = resource;
   hd->secret = !!secret;
   active_handles++;
@@ -268,10 +269,10 @@ keyring_release (KEYRING_HANDLE hd)
         return;
     assert (active_handles > 0);
     active_handles--;
-    m_free (hd->word_match.name);
-    m_free (hd->word_match.pattern);
+    xfree (hd->word_match.name);
+    xfree (hd->word_match.pattern);
     iobuf_close (hd->current.iobuf);
-    m_free (hd);
+    xfree (hd);
 }
 
 
@@ -303,7 +304,7 @@ keyring_lock (KEYRING_HANDLE hd, int yes)
                 kr->lockhd = create_dotlock( kr->fname );
                 if (!kr->lockhd) {
                     log_info ("can't allocate lock for `%s'\n", kr->fname );
-                    rc = G10ERR_GENERAL;
+                    rc = GPG_ERR_GENERAL;
                 }
             }
         }
@@ -318,7 +319,7 @@ keyring_lock (KEYRING_HANDLE hd, int yes)
                 ;
             else if (make_dotlock (kr->lockhd, -1) ) {
                 log_info ("can't lock `%s'\n", kr->fname );
-                rc = G10ERR_GENERAL;
+                rc = GPG_ERR_GENERAL;
             }
             else 
                 kr->is_locked = 1;
@@ -355,7 +356,7 @@ keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb)
     PACKET *pkt;
     int rc;
     KBNODE keyblock = NULL, node, lastnode;
-    IOBUF a;
+    iobuf_t a;
     int in_cert = 0;
     int pk_no = 0;
     int uid_no = 0;
@@ -370,31 +371,31 @@ keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb)
     a = iobuf_open (hd->found.kr->fname);
     if (!a) {
 	log_error ("can't open `%s'\n", hd->found.kr->fname);
-	return G10ERR_KEYRING_OPEN;
+	return GPG_ERR_KEYRING_OPEN;
     }
 
     if (iobuf_seek (a, hd->found.offset) ) {
         log_error ("can't seek `%s'\n", hd->found.kr->fname);
 	iobuf_close(a);
-	return G10ERR_KEYRING_OPEN;
+	return GPG_ERR_KEYRING_OPEN;
     }
 
-    pkt = m_alloc (sizeof *pkt);
+    pkt = xmalloc (sizeof *pkt);
     init_packet (pkt);
     hd->found.n_packets = 0;;
     lastnode = NULL;
     save_mode = set_packet_list_mode(0);
     while ((rc=parse_packet (a, pkt)) != -1) {
         hd->found.n_packets++;
-        if (rc == G10ERR_UNKNOWN_PACKET) {
+        if (rc == GPG_ERR_UNKNOWN_PACKET) {
 	    free_packet (pkt);
 	    init_packet (pkt);
 	    continue;
 	}
 	if (rc) {  
             log_error ("keyring_get_keyblock: read error: %s\n",
-                       g10_errstr(rc) );
-            rc = G10ERR_INV_KEYRING;
+                       gpg_strerror (rc) );
+            rc = GPG_ERR_INV_KEYRING;
             break;
         }
 	if (pkt->pkttype == PKT_COMPRESSED) {
@@ -448,7 +449,7 @@ keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb)
             }
         }
 
-        pkt = m_alloc (sizeof *pkt);
+        pkt = xmalloc (sizeof *pkt);
         init_packet(pkt);
     }
     set_packet_list_mode(save_mode);
@@ -471,13 +472,13 @@ keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb)
 	*ret_kb = keyblock;
     }
     free_packet (pkt);
-    m_free (pkt);
+    xfree (pkt);
     iobuf_close(a);
 
     /* Make sure that future search operations fail immediately when
      * we know that we are working on a invalid keyring 
      */
-    if (rc == G10ERR_INV_KEYRING)
+    if (rc == GPG_ERR_INV_KEYRING)
         hd->current.error = rc;
 
     return rc;
@@ -495,7 +496,7 @@ keyring_update_keyblock (KEYRING_HANDLE hd, KBNODE kb)
         /* need to know the number of packets - do a dummy get_keyblock*/
         rc = keyring_get_keyblock (hd, NULL);
         if (rc) {
-            log_error ("re-reading keyblock failed: %s\n", g10_errstr (rc));
+            log_error ("re-reading keyblock failed: %s\n", gpg_strerror (rc));
             return rc;
         }
         if (!hd->found.n_packets)
@@ -539,7 +540,7 @@ keyring_insert_keyblock (KEYRING_HANDLE hd, KBNODE kb)
         fname = hd->resource? hd->resource->fname:NULL;
 
     if (!fname)
-        return G10ERR_GENERAL; 
+        return GPG_ERR_GENERAL; 
 
     /* close this one otherwise we will lose the position for
      * a next search.  Fixme: it would be better to adjust the position
@@ -571,7 +572,7 @@ keyring_delete_keyblock (KEYRING_HANDLE hd)
         /* need to know the number of packets - do a dummy get_keyblock*/
         rc = keyring_get_keyblock (hd, NULL);
         if (rc) {
-            log_error ("re-reading keyblock failed: %s\n", g10_errstr (rc));
+            log_error ("re-reading keyblock failed: %s\n", gpg_strerror (rc));
             return rc;
         }
         if (!hd->found.n_packets)
@@ -628,7 +629,7 @@ prepare_search (KEYRING_HANDLE hd)
 
     if (hd->current.kr && !hd->current.eof) {
         if ( !hd->current.iobuf )
-            return G10ERR_GENERAL; /* position invalid after a modify */
+            return GPG_ERR_GENERAL; /* position invalid after a modify */
         return 0; /* okay */
     }
 
@@ -654,8 +655,9 @@ prepare_search (KEYRING_HANDLE hd)
     hd->current.eof = 0;
     hd->current.iobuf = iobuf_open (hd->current.kr->fname);
     if (!hd->current.iobuf) {
+        hd->current.error = gpg_error_from_errno (errno);
         log_error ("can't open `%s'\n", hd->current.kr->fname );
-        return (hd->current.error = G10ERR_OPEN_FILE);
+        return hd->current.error;
     }
 
     return 0;
@@ -774,7 +776,7 @@ prepare_word_match (const byte *name)
     int c;
 
     /* the original length is always enough for the pattern */
-    p = pattern = m_alloc(strlen(name)+1);
+    p = pattern = xmalloc (strlen(name)+1);
     do {
 	/* skip leading delimiters */
 	while( *name && !word_match_chars[*name] )
@@ -951,9 +953,9 @@ keyring_search (KEYRING_HANDLE hd, KEYDB_SEARCH_DESC *desc,
       if ( !hd->word_match.name || strcmp (hd->word_match.name, name) ) 
         {
           /* name changed */
-          m_free (hd->word_match.name);
-          m_free (hd->word_match.pattern);
-          hd->word_match.name = m_strdup (name);
+          xfree (hd->word_match.name);
+          xfree (hd->word_match.pattern);
+          hd->word_match.name = xstrdup (name);
           hd->word_match.pattern = prepare_word_match (name);
         }
       name = hd->word_match.pattern;
@@ -1069,7 +1071,7 @@ keyring_search (KEYRING_HANDLE hd, KEYDB_SEARCH_DESC *desc,
               goto found;
             break;
           default: 
-            rc = G10ERR_INV_ARG;
+            rc = GPG_ERR_INV_ARG;
             goto found;
           }
 	}
@@ -1139,7 +1141,7 @@ keyring_search (KEYRING_HANDLE hd, KEYDB_SEARCH_DESC *desc,
 
 static int
 create_tmp_file (const char *template,
-                 char **r_bakfname, char **r_tmpfname, IOBUF *r_fp)
+                 char **r_bakfname, char **r_tmpfname, iobuf_t *r_fp)
 {  
   char *bakfname, *tmpfname;
   mode_t oldmask;
@@ -1156,27 +1158,27 @@ create_tmp_file (const char *template,
   if (strlen (template) > 4
       && !strcmp (template+strlen(template)-4, EXTSEP_S "gpg") )
     {
-      bakfname = m_alloc (strlen (template) + 1);
+      bakfname = xmalloc (strlen (template) + 1);
       strcpy (bakfname, template);
       strcpy (bakfname+strlen(template)-4, EXTSEP_S "bak");
 
-      tmpfname = m_alloc (strlen( template ) + 1 );
+      tmpfname = xmalloc (strlen( template ) + 1 );
       strcpy (tmpfname,template);
       strcpy (tmpfname+strlen(template)-4, EXTSEP_S "tmp");
     }
     else 
       { /* file does not end with gpg; hmmm */
-	bakfname = m_alloc (strlen( template ) + 5);
+	bakfname = xmalloc (strlen( template ) + 5);
 	strcpy (stpcpy(bakfname, template), EXTSEP_S "bak");
 
-	tmpfname = m_alloc (strlen( template ) + 5);
+	tmpfname = xmalloc (strlen( template ) + 5);
 	strcpy (stpcpy(tmpfname, template), EXTSEP_S "tmp");
     }
 # else /* Posix file names */
-    bakfname = m_alloc (strlen( template ) + 2);
+    bakfname = xmalloc (strlen( template ) + 2);
     strcpy (stpcpy (bakfname,template),"~");
 
-    tmpfname = m_alloc (strlen( template ) + 5);
+    tmpfname = xmalloc (strlen( template ) + 5);
     strcpy (stpcpy(tmpfname,template), EXTSEP_S "tmp");
 # endif /* Posix filename */
 
@@ -1185,10 +1187,11 @@ create_tmp_file (const char *template,
     *r_fp = iobuf_create (tmpfname);
     umask(oldmask);
     if (!*r_fp) {
+        int tmperr = gpg_error_from_errno (errno);
 	log_error ("can't create `%s': %s\n", tmpfname, strerror(errno) );
-        m_free (tmpfname);
-        m_free (bakfname);
-	return G10ERR_OPEN_FILE;
+        xfree (tmpfname);
+        xfree (bakfname);
+	return tmperr;
     }
     
     *r_bakfname = bakfname;
@@ -1216,9 +1219,10 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
 #endif
       if (rename (fname, bakfname) )
         {
+          int tmperr = gpg_error_from_errno (errno);
           log_error ("renaming `%s' to `%s' failed: %s\n",
                      fname, bakfname, strerror(errno) );
-          return G10ERR_RENAME_FILE;
+          return tmperr;
 	}
     }
   
@@ -1228,9 +1232,9 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
 #endif
   if (rename (tmpfname, fname) )
     {
+      rc = gpg_error_from_errno (errno);
       log_error ("renaming `%s' to `%s' failed: %s\n",
                  tmpfname, fname, strerror(errno) );
-      rc = G10ERR_RENAME_FILE;
       if (secret)
         {
           log_info(_("WARNING: 2 files with confidential"
@@ -1265,7 +1269,7 @@ rename_tmp_file (const char *bakfname, const char *tmpfname,
 
 
 static int
-write_keyblock (IOBUF fp, KBNODE keyblock)
+write_keyblock (iobuf_t fp, KBNODE keyblock)
 {
   KBNODE kbctx = NULL, node;
   int rc;
@@ -1278,7 +1282,7 @@ write_keyblock (IOBUF fp, KBNODE keyblock)
       if ( (rc = build_packet (fp, node->pkt) ))
         {
           log_error ("build_packet(%d) failed: %s\n",
-                     node->pkt->pkttype, g10_errstr(rc) );
+                     node->pkt->pkttype, gpg_strerror (rc) );
           return rc;
         }
       if (node->pkt->pkttype == PKT_SIGNATURE) 
@@ -1296,8 +1300,9 @@ write_keyblock (IOBUF fp, KBNODE keyblock)
           iobuf_put (fp, 2);    /* 2 bytes */
           iobuf_put (fp, 0);    /* unused */
           if (iobuf_put (fp, cacheval)) {
+            int tmperr = gpg_error_from_errno (errno);
             log_error ("writing sigcache packet failed\n");
-            return G10ERR_WRITE_FILE;
+            return tmperr;
           }
         }
     }
@@ -1316,7 +1321,7 @@ keyring_rebuild_cache (void *token)
   KEYDB_SEARCH_DESC desc;
   KBNODE keyblock = NULL, node;
   const char *lastresname = NULL, *resname;
-  IOBUF tmpfp = NULL;
+  iobuf_t tmpfp = NULL;
   char *tmpfilename = NULL;
   char *bakfilename = NULL;
   int rc;
@@ -1340,9 +1345,9 @@ keyring_rebuild_cache (void *token)
             {
               if (iobuf_close (tmpfp))
                 {
+                  rc = gpg_error_from_errno (errno);
                   log_error ("error closing `%s': %s\n",
                              tmpfilename, strerror (errno));
-                  rc = G10ERR_CLOSE_FILE;
                   goto leave;
                 }
               /* because we have switched resources, we can be sure that
@@ -1351,8 +1356,8 @@ keyring_rebuild_cache (void *token)
             }
           rc = lastresname? rename_tmp_file (bakfilename, tmpfilename, 
                                              lastresname, 0) : 0;
-          m_free (tmpfilename);  tmpfilename = NULL;
-          m_free (bakfilename);  bakfilename = NULL;
+          xfree (tmpfilename);  tmpfilename = NULL;
+          xfree (bakfilename);  bakfilename = NULL;
           if (rc)
             goto leave;
           lastresname = resname;
@@ -1367,7 +1372,7 @@ keyring_rebuild_cache (void *token)
       rc = keyring_get_keyblock (hd, &keyblock);
       if (rc) 
         {
-          log_error ("keyring_get_keyblock failed: %s\n", g10_errstr(rc));
+          log_error ("keyring_get_keyblock failed: %s\n", gpg_strerror (rc));
           goto leave;
         }
       assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
@@ -1396,7 +1401,7 @@ keyring_rebuild_cache (void *token)
     rc = 0;
   if (rc) 
     {
-      log_error ("keyring_search failed: %s\n", g10_errstr(rc));
+      log_error ("keyring_search failed: %s\n", gpg_strerror (rc));
       goto leave;
     }
   log_info(_("%lu keys checked (%lu signatures)\n"), count, sigcount );
@@ -1404,9 +1409,9 @@ keyring_rebuild_cache (void *token)
     {
       if (iobuf_close (tmpfp))
         {
+          rc = gpg_error_from_errno (errno);
           log_error ("error closing `%s': %s\n",
                      tmpfilename, strerror (errno));
-          rc = G10ERR_CLOSE_FILE;
           goto leave;
         }
       /* because we have switched resources, we can be sure that
@@ -1415,14 +1420,14 @@ keyring_rebuild_cache (void *token)
     }
   rc = lastresname? rename_tmp_file (bakfilename, tmpfilename,
                                      lastresname, 0) : 0;
-  m_free (tmpfilename);  tmpfilename = NULL;
-  m_free (bakfilename);  bakfilename = NULL;
+  xfree (tmpfilename);  tmpfilename = NULL;
+  xfree (bakfilename);  bakfilename = NULL;
 
  leave:
   if (tmpfp)
     iobuf_cancel (tmpfp);
-  m_free (tmpfilename);  
-  m_free (bakfilename);  
+  xfree (tmpfilename);  
+  xfree (bakfilename);  
   release_kbnode (keyblock);
   keyring_lock (hd, 0);
   keyring_release (hd);
@@ -1440,7 +1445,7 @@ static int
 do_copy (int mode, const char *fname, KBNODE root, int secret,
          off_t start_offset, unsigned int n_packets )
 {
-    IOBUF fp, newfp;
+    iobuf_t fp, newfp;
     int rc=0;
     char *bakfname = NULL;
     char *tmpfname = NULL;
@@ -1448,7 +1453,8 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
     /* Open the source file. Because we do a rname, we have to check the 
        permissions of the file */
     if (access (fname, W_OK))
-      return G10ERR_WRITE_FILE;
+      return gpg_error_from_errno (errno);
+
 
     fp = iobuf_open (fname);
     if (mode == 1 && !fp && errno == ENOENT) { 
@@ -1460,9 +1466,10 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	newfp = iobuf_create (fname);
 	umask(oldmask);
 	if( !newfp ) {
+            int tmperr = gpg_error_from_errno (errno);
 	    log_error (_("%s: can't create: %s\n"),
                        fname, strerror(errno));
-	    return G10ERR_OPEN_FILE;
+	    return tmperr;
 	}
 	if( !opt.quiet )
 	    log_info(_("%s: keyring created\n"), fname );
@@ -1471,21 +1478,22 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	while ( (node = walk_kbnode( root, &kbctx, 0 )) ) {
 	    if( (rc = build_packet( newfp, node->pkt )) ) {
 		log_error("build_packet(%d) failed: %s\n",
-			    node->pkt->pkttype, g10_errstr(rc) );
+			    node->pkt->pkttype, gpg_strerror (rc) );
 		iobuf_cancel(newfp);
-		return G10ERR_WRITE_FILE;
+		return rc;
 	    }
 	}
-	if( iobuf_close(newfp) ) {
+	if (iobuf_close(newfp)) {
+            int tmperr = gpg_error_from_errno (errno);
 	    log_error ("%s: close failed: %s\n", fname, strerror(errno));
-	    return G10ERR_CLOSE_FILE;
+	    return tmperr;
 	}
 	return 0; /* ready */
     }
 
     if( !fp ) {
+        rc = gpg_error_from_errno (errno);
 	log_error ("%s: can't open: %s\n", fname, strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
 
@@ -1500,7 +1508,7 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	rc = copy_all_packets (fp, newfp);
 	if( rc != -1 ) {
 	    log_error("%s: copy to `%s' failed: %s\n",
-		      fname, tmpfname, g10_errstr(rc) );
+		      fname, tmpfname, gpg_strerror (rc) );
 	    iobuf_close(fp);
 	    iobuf_cancel(newfp);
 	    goto leave;
@@ -1513,7 +1521,7 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	rc = copy_some_packets( fp, newfp, start_offset );
 	if( rc ) { /* should never get EOF here */
 	    log_error ("%s: copy to `%s' failed: %s\n",
-                       fname, tmpfname, g10_errstr(rc) );
+                       fname, tmpfname, gpg_strerror (rc) );
 	    iobuf_close(fp);
 	    iobuf_cancel(newfp);
 	    goto leave;
@@ -1523,7 +1531,7 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	rc = skip_some_packets( fp, n_packets );
 	if( rc ) {
 	    log_error("%s: skipping %u packets failed: %s\n",
-			    fname, n_packets, g10_errstr(rc));
+			    fname, n_packets, gpg_strerror (rc));
 	    iobuf_close(fp);
 	    iobuf_cancel(newfp);
 	    goto leave;
@@ -1544,7 +1552,7 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 	rc = copy_all_packets( fp, newfp );
 	if( rc != -1 ) {
 	    log_error("%s: copy to `%s' failed: %s\n",
-		      fname, tmpfname, g10_errstr(rc) );
+		      fname, tmpfname, gpg_strerror (rc) );
 	    iobuf_close(fp);
 	    iobuf_cancel(newfp);
 	    goto leave;
@@ -1554,20 +1562,20 @@ do_copy (int mode, const char *fname, KBNODE root, int secret,
 
     /* close both files */
     if( iobuf_close(fp) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("%s: close failed: %s\n", fname, strerror(errno) );
-	rc = G10ERR_CLOSE_FILE;
 	goto leave;
     }
     if( iobuf_close(newfp) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("%s: close failed: %s\n", tmpfname, strerror(errno) );
-	rc = G10ERR_CLOSE_FILE;
 	goto leave;
     }
 
     rc = rename_tmp_file (bakfname, tmpfname, fname, secret);
 
   leave:
-    m_free(bakfname);
-    m_free(tmpfname);
+    xfree (bakfname);
+    xfree (tmpfname);
     return rc;
 }
diff --git a/g10/keyserver-internal.h b/g10/keyserver-internal.h
index c341578fa..314d7898e 100644
--- a/g10/keyserver-internal.h
+++ b/g10/keyserver-internal.h
@@ -5,7 +5,7 @@
 
 #include <time.h>
 #include "keyserver.h"
-#include "iobuf.h"
+#include "../common/iobuf.h"
 #include "types.h"
 
 void parse_keyserver_options(char *options);
diff --git a/g10/keyserver.c b/g10/keyserver.c
index 7759de198..e4f56ca3b 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1,5 +1,5 @@
 /* keyserver.c - generic keyserver code
- * Copyright (C) 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 2001, 2002, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -24,6 +24,8 @@
 #include <string.h>
 #include <stdlib.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "filter.h"
 #include "keydb.h"
 #include "status.h"
@@ -48,7 +50,7 @@ struct keyrec
   time_t createtime,expiretime;
   int size,flags;
   byte type;
-  IOBUF uidbuf;
+  iobuf_t uidbuf;
   int lines;
 };
 
@@ -186,7 +188,7 @@ parse_keyserver_uri(char *uri,const char *configname,unsigned int configlineno)
       /* Get the host */
       opt.keyserver_host=strsep(&uri,":/");
       if(opt.keyserver_host[0]=='\0')
-	return G10ERR_BAD_URI;
+	return GPG_ERR_BAD_URI;
 
       if(uri==NULL || uri[0]=='\0')
 	opt.keyserver_port=NULL;
@@ -202,7 +204,7 @@ parse_keyserver_uri(char *uri,const char *configname,unsigned int configlineno)
 	  while(*ch!='\0')
 	    {
 	      if(!isdigit(*ch))
-		return G10ERR_BAD_URI;
+		return GPG_ERR_BAD_URI;
 
 	      ch++;
 	    }
@@ -227,11 +229,11 @@ parse_keyserver_uri(char *uri,const char *configname,unsigned int configlineno)
     {
       /* One slash means absolute path.  We don't need to support that
 	 yet. */
-      return G10ERR_BAD_URI;
+      return GPG_ERR_BAD_URI;
     }
 
   if(opt.keyserver_scheme[0]=='\0')
-    return G10ERR_BAD_URI;
+    return GPG_ERR_BAD_URI;
 
   return 0;
 }
@@ -250,7 +252,7 @@ print_keyrec(int number,struct keyrec *keyrec)
 
   if(keyrec->type)
     {
-      const char *str=pubkey_algo_to_string(keyrec->type);
+      const char *str = gcry_pk_algo_name (keyrec->type);
 
       if(str)
 	printf("%s ",str);
@@ -319,7 +321,7 @@ parse_keyrec(char *keystring)
 	return NULL;
       else if(work->desc.mode==KEYDB_SEARCH_MODE_NONE)
 	{
-	  m_free(work);
+	  xfree (work);
 	  return NULL;
 	}
       else
@@ -332,7 +334,7 @@ parse_keyrec(char *keystring)
 
   if(work==NULL)
     {
-      work=m_alloc_clear(sizeof(struct keyrec));
+      work=xcalloc (1,sizeof(struct keyrec));
       work->uidbuf=iobuf_temp();
     }
 
@@ -353,7 +355,7 @@ parse_keyrec(char *keystring)
       if(work->desc.mode)
 	{
 	  ret=work;
-	  work=m_alloc_clear(sizeof(struct keyrec));
+	  work=xcalloc (1,sizeof(struct keyrec));
 	  work->uidbuf=iobuf_temp();
 	}
 
@@ -458,7 +460,7 @@ parse_keyrec(char *keystring)
 
       decoded=utf8_to_native(userid,i,0);
       iobuf_writestr(work->uidbuf,decoded);
-      m_free(decoded);
+      xfree (decoded);
       iobuf_writestr(work->uidbuf,"\n\t");
       work->lines++;
     }
@@ -496,7 +498,7 @@ show_prompt(KEYDB_SEARCH_DESC *desc,int numdesc,int count,const char *search)
 
   if(answer[0]=='q' || answer[0]=='Q')
     {
-      m_free(answer);
+      xfree (answer);
       return 1;
     }
   else if(atoi(answer)>=1 && atoi(answer)<=numdesc)
@@ -507,7 +509,7 @@ show_prompt(KEYDB_SEARCH_DESC *desc,int numdesc,int count,const char *search)
 	if(atoi(num)>=1 && atoi(num)<=numdesc)
 	  keyserver_work(GET,NULL,&desc[atoi(num)-1],1);
 
-      m_free(answer);
+      xfree (answer);
       return 1;
     }
 
@@ -518,7 +520,7 @@ show_prompt(KEYDB_SEARCH_DESC *desc,int numdesc,int count,const char *search)
    small, it will grow safely.  If negative it disables the "Key x-y
    of z" messages. */
 static void
-keyserver_search_prompt(IOBUF buffer,const char *searchstr)
+keyserver_search_prompt(iobuf_t buffer,const char *searchstr)
 {
   int i=0,validcount=0,started=0,header=0,count=1;
   unsigned int maxlen,buflen;
@@ -527,7 +529,7 @@ keyserver_search_prompt(IOBUF buffer,const char *searchstr)
   /* TODO: Something other than 23?  That's 24-1 (the prompt). */
   int maxlines=23,numlines=0;
 
-  desc=m_alloc(count*sizeof(KEYDB_SEARCH_DESC));
+  desc=xmalloc (count*sizeof(KEYDB_SEARCH_DESC));
 
   for(;;)
     {
@@ -582,7 +584,7 @@ keyserver_search_prompt(IOBUF buffer,const char *searchstr)
 	      else
 		validcount=1;
 
-	      desc=m_realloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
+	      desc=xrealloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
 	    }
 
 	  started=1;
@@ -622,7 +624,7 @@ keyserver_search_prompt(IOBUF buffer,const char *searchstr)
 	  /* keyserver helper sent more keys than they claimed in the
 	     info: line. */
 	  count+=10;
-	  desc=m_realloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
+	  desc=xrealloc(desc,count*sizeof(KEYDB_SEARCH_DESC));
 	  validcount=0;
 	}
 
@@ -645,15 +647,15 @@ keyserver_search_prompt(IOBUF buffer,const char *searchstr)
 
 	  numlines+=keyrec->lines;
 	  iobuf_close(keyrec->uidbuf);
-	  m_free(keyrec);
+	  xfree (keyrec);
 
 	  started=1;
 	  i++;
 	}
     }
 
-  m_free(desc);
-  m_free(line);
+  xfree (desc);
+  xfree (line);
 
  notfound:
   if(count==0)
@@ -694,7 +696,7 @@ keyserver_spawn(int action,STRLIST list,
 #endif
 
   /* Build the filename for the helper to execute */
-  command=m_alloc(strlen("gpgkeys_")+strlen(opt.keyserver_scheme)+1);
+  command=xmalloc (strlen("gpgkeys_")+strlen(opt.keyserver_scheme)+1);
   strcpy(command,"gpgkeys_");
   strcat(command,opt.keyserver_scheme);
 
@@ -702,13 +704,13 @@ keyserver_spawn(int action,STRLIST list,
     {
       if(opt.keyserver_options.keep_temp_files)
 	{
-	  command=m_realloc(command,strlen(command)+
+	  command=xrealloc(command,strlen(command)+
 			    strlen(KEYSERVER_ARGS_KEEP)+1);
 	  strcat(command,KEYSERVER_ARGS_KEEP);
 	}
       else
 	{
-	  command=m_realloc(command,strlen(command)+
+	  command=xrealloc(command,strlen(command)+
 			    strlen(KEYSERVER_ARGS_NOKEEP)+1);
 	  strcat(command,KEYSERVER_ARGS_NOKEEP);  
 	}
@@ -806,7 +808,7 @@ keyserver_spawn(int action,STRLIST list,
 	for(key=list;key!=NULL;key=key->next)
 	  {
 	    armor_filter_context_t afx;
-	    IOBUF buffer=iobuf_temp();
+	    iobuf_t buffer=iobuf_temp();
 	    KBNODE block;
 
 	    temp=NULL;
@@ -930,13 +932,13 @@ keyserver_spawn(int action,STRLIST list,
 	    fprintf(spawn->tochild,"%s\n",key->d);
 	    if(key!=list)
 	      {
-		searchstr=m_realloc(searchstr,
+		searchstr=xrealloc(searchstr,
 				    strlen(searchstr)+strlen(key->d)+2);
 		strcat(searchstr," ");
 	      }
 	    else
 	      {
-		searchstr=m_alloc(strlen(key->d)+1);
+		searchstr=xmalloc (strlen(key->d)+1);
 		searchstr[0]='\0';
 	      }
 
@@ -968,7 +970,7 @@ keyserver_spawn(int action,STRLIST list,
       maxlen=1024;
       if(iobuf_read_line(spawn->fromchild,&line,&buflen,&maxlen)==0)
 	{
-	  ret=G10ERR_READ_FILE;
+	  ret = iobuf_error (spawn->fromchild);
 	  goto fail; /* i.e. EOF */
 	}
 
@@ -1052,7 +1054,7 @@ keyserver_spawn(int action,STRLIST list,
       }
 
  fail:
-  m_free(line);
+  xfree (line);
 
   *prog=exec_finish(spawn);
 
@@ -1067,13 +1069,13 @@ keyserver_work(int action,STRLIST list,KEYDB_SEARCH_DESC *desc,int count)
   if(opt.keyserver_scheme==NULL)
     {
       log_error(_("no keyserver known (use option --keyserver)\n"));
-      return G10ERR_BAD_URI;
+      return GPG_ERR_BAD_URI;
     }
 
 #ifdef DISABLE_KEYSERVER_HELPERS
 
   log_error(_("external keyserver calls are not supported in this build\n"));
-  return G10ERR_KEYSERVER;
+  return GPG_ERR_KEYSERVER;
 
 #else
   /* Spawn a handler */
@@ -1107,12 +1109,12 @@ keyserver_work(int action,STRLIST list,KEYDB_SEARCH_DESC *desc,int count)
 	  break;
 	}
 
-      return G10ERR_KEYSERVER;
+      return GPG_ERR_KEYSERVER;
     }
 
   if(rc)
     {
-      log_error(_("keyserver communications error: %s\n"),g10_errstr(rc));
+      log_error(_("keyserver communications error: %s\n"),gpg_strerror (rc));
 
       return rc;
     }
@@ -1146,7 +1148,7 @@ keyserver_import(STRLIST users)
   int rc=0;
 
   /* Build a list of key ids */
-  desc=m_alloc(sizeof(KEYDB_SEARCH_DESC)*num);
+  desc=xmalloc (sizeof(KEYDB_SEARCH_DESC)*num);
 
   for(;users;users=users->next)
     {
@@ -1164,14 +1166,14 @@ keyserver_import(STRLIST users)
       if(count==num)
 	{
 	  num+=100;
-	  desc=m_realloc(desc,sizeof(KEYDB_SEARCH_DESC)*num);
+	  desc=xrealloc(desc,sizeof(KEYDB_SEARCH_DESC)*num);
 	}
     }
 
   if(count>0)
     rc=keyserver_work(GET,NULL,desc,count);
 
-  m_free(desc);
+  xfree (desc);
 
   return rc;
 }
@@ -1221,21 +1223,21 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
 
   *count=0;
 
-  *klist=m_alloc(sizeof(KEYDB_SEARCH_DESC)*num);
+  *klist=xmalloc (sizeof(KEYDB_SEARCH_DESC)*num);
 
   kdbhd=keydb_new(0);
 
   if(!users)
     {
       ndesc = 1;
-      desc = m_alloc_clear ( ndesc * sizeof *desc);
+      desc = xcalloc (1, ndesc * sizeof *desc);
       desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
     }
   else
     {
       for (ndesc=0, sl=users; sl; sl = sl->next, ndesc++) 
 	;
-      desc = m_alloc ( ndesc * sizeof *desc);
+      desc = xmalloc ( ndesc * sizeof *desc);
         
       for (ndesc=0, sl=users; sl; sl = sl->next)
 	{
@@ -1243,7 +1245,7 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
 	    ndesc++;
 	  else
 	    log_error (_("key `%s' not found: %s\n"),
-		       sl->d, g10_errstr (G10ERR_INV_USER_ID));
+		       sl->d, gpg_strerror (GPG_ERR_INV_USER_ID));
 	}
     }
 
@@ -1256,7 +1258,7 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
       rc = keydb_get_keyblock (kdbhd, &keyblock );
       if( rc )
 	{
-	  log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
+	  log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
 	  goto leave;
 	}
 
@@ -1273,14 +1275,14 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
 	     node->pkt->pkt.public_key->version>=4)
 	    {
 	      (*klist)[*count].mode=KEYDB_SEARCH_MODE_LONG_KID;
-	      mpi_get_keyid(node->pkt->pkt.public_key->pkey[0],
-			    (*klist)[*count].u.kid);
+	      v3_keyid (node->pkt->pkt.public_key->pkey[0],
+                        (*klist)[*count].u.kid);
 	      (*count)++;
 
 	      if(*count==num)
 		{
 		  num+=100;
-		  *klist=m_realloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
+		  *klist=xrealloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
 		}
 	    }
 
@@ -1308,7 +1310,7 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
 	  if(*count==num)
 	    {
 	      num+=100;
-	      *klist=m_realloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
+	      *klist=xrealloc(*klist,sizeof(KEYDB_SEARCH_DESC)*num);
 	    }
 	}
     }
@@ -1317,7 +1319,7 @@ keyidlist(STRLIST users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
     rc=0;
   
  leave:
-  m_free(desc);
+  xfree (desc);
   keydb_release(kdbhd);
   release_kbnode(keyblock);
 
@@ -1363,7 +1365,7 @@ keyserver_refresh(STRLIST users)
       rc=keyserver_work(GET,NULL,desc,count);
     }
 
-  m_free(desc);
+  xfree (desc);
 
   return rc;
 }
diff --git a/g10/main.h b/g10/main.h
index a7526c8bc..a4f4e3b84 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -20,7 +20,8 @@
 #ifndef G10_MAIN_H
 #define G10_MAIN_H
 #include "types.h"
-#include "iobuf.h"
+#include "gpg.h"
+#include "../common/iobuf.h"
 #include "mpi.h"
 #include "cipher.h"
 #include "keydb.h"
@@ -65,13 +66,16 @@ void trap_unaligned(void);
 int disable_core_dumps(void);
 u16 checksum_u16( unsigned n );
 u16 checksum( byte *p, unsigned n );
-u16 checksum_mpi( MPI a );
+u16 checksum_mpi( gcry_mpi_t a );
 u32 buffer_to_u32( const byte *buffer );
 const byte *get_session_marker( size_t *rlen );
 int openpgp_cipher_test_algo( int algo );
 int openpgp_pk_test_algo( int algo, unsigned int usage_flags );
 int openpgp_pk_algo_usage ( int algo );
 int openpgp_md_test_algo( int algo );
+int openpgp_md_map_name (const char *string);
+int openpgp_cipher_map_name (const char *string);
+int openpgp_pk_map_name (const char *string);
 
 #ifdef USE_IDEA
 void idea_cipher_warn( int show );
@@ -106,6 +110,24 @@ struct parse_options
 
 int parse_options(char *str,unsigned int *options,struct parse_options *opts);
 
+
+/* Temporary helpers. */
+int pubkey_get_npkey( int algo );
+int pubkey_get_nskey( int algo );
+int pubkey_get_nsig( int algo );
+int pubkey_get_nenc( int algo );
+unsigned int pubkey_nbits( int algo, gcry_mpi_t *pkey );
+
+/* MPI helpers. */
+int mpi_write( iobuf_t out, gcry_mpi_t a );
+int mpi_write_opaque( iobuf_t out, gcry_mpi_t a );
+gcry_mpi_t mpi_read(iobuf_t inp, unsigned int *ret_nread, int secure );
+gcry_mpi_t mpi_read_opaque(iobuf_t inp, unsigned int *ret_nread );
+int mpi_print( FILE *fp, gcry_mpi_t a, int mode );
+
+
+
+
 /*-- helptext.c --*/
 void display_online_help( const char *keyword );
 
@@ -115,7 +137,7 @@ int encode_store( const char *filename );
 int encode_crypt( const char *filename, STRLIST remusr );
 void encode_crypt_files(int nfiles, char **files, STRLIST remusr);
 int encrypt_filter( void *opaque, int control,
-		    IOBUF a, byte *buf, size_t *ret_len);
+		    iobuf_t a, byte *buf, size_t *ret_len);
 
 
 /*-- sign.c --*/
@@ -155,25 +177,25 @@ int generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock );
 int overwrite_filep( const char *fname );
 char *make_outfile_name( const char *iname );
 char *ask_outfile_name( const char *name, size_t namelen );
-int   open_outfile( const char *iname, int mode, IOBUF *a );
-IOBUF open_sigfile( const char *iname, progress_filter_context_t *pfx );
+int   open_outfile( const char *iname, int mode, iobuf_t *a );
+iobuf_t open_sigfile( const char *iname, progress_filter_context_t *pfx );
 void try_make_homedir( const char *fname );
 
 /*-- seskey.c --*/
 void make_session_key( DEK *dek );
-MPI encode_session_key( DEK *dek, unsigned nbits );
-MPI encode_md_value( int pubkey_algo,  MD_HANDLE md,
+gcry_mpi_t encode_session_key( DEK *dek, unsigned nbits );
+gcry_mpi_t encode_md_value( int pubkey_algo,  MD_HANDLE md,
 		     int hash_algo, unsigned nbits, int v3compathack );
 
 /*-- comment.c --*/
 KBNODE make_comment_node( const char *s );
-KBNODE make_mpi_comment_node( const char *s, MPI a );
+KBNODE make_mpi_comment_node( const char *s, gcry_mpi_t a );
 
 /*-- import.c --*/
 int parse_import_options(char *str,unsigned int *options);
 void import_keys( char **fnames, int nnames,
 		  void *stats_hd, unsigned int options );
-int import_keys_stream( IOBUF inp,
+int import_keys_stream( iobuf_t inp,
 			void *stats_hd, unsigned int options );
 void *import_new_stats_handle (void);
 void import_release_stats_handle (void *p);
@@ -184,7 +206,7 @@ int collapse_uids( KBNODE *keyblock );
 /*-- export.c --*/
 int parse_export_options(char *str,unsigned int *options);
 int export_pubkeys( STRLIST users, unsigned int options );
-int export_pubkeys_stream( IOBUF out, STRLIST users,
+int export_pubkeys_stream( iobuf_t out, STRLIST users,
 			   KBNODE *keyblock_out, unsigned int options );
 int export_seckeys( STRLIST users );
 int export_secsubkeys( STRLIST users );
diff --git a/g10/mainproc.c b/g10/mainproc.c
index faba197fe..e9b7a4b66 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -68,7 +68,7 @@ struct mainproc_context {
     int last_was_session_key;
     KBNODE list;   /* the current list of packets */
     int have_data;
-    IOBUF iobuf;    /* used to get the filename etc. */
+    iobuf_t iobuf;    /* used to get the filename etc. */
     int trustletter; /* temp usage in list_node */
     ulong local_id;    /* ditto */
     struct kidlist_item *pkenc_list;	/* list of encryption packets */
@@ -79,7 +79,7 @@ struct mainproc_context {
 };
 
 
-static int do_proc_packets( CTX c, IOBUF a );
+static int do_proc_packets( CTX c, iobuf_t a );
 
 static void list_node( CTX c, KBNODE node );
 static void proc_tree( CTX c, KBNODE node );
@@ -94,7 +94,7 @@ release_list( CTX c )
     release_kbnode( c->list );
     while( c->pkenc_list ) {
 	struct kidlist_item *tmp = c->pkenc_list->next;
-	m_free( c->pkenc_list );
+	xfree ( c->pkenc_list );
 	c->pkenc_list = tmp;
     }
     c->pkenc_list = NULL;
@@ -103,7 +103,7 @@ release_list( CTX c )
     c->last_was_session_key = 0;
     c->pipemode.op = 0;
     c->pipemode.stop_now = 0;
-    m_free(c->dek); c->dek = NULL;
+    xfree (c->dek); c->dek = NULL;
 }
 
 
@@ -249,25 +249,25 @@ symkey_decrypt_sesskey( DEK *dek, byte *sesskey, size_t slen )
 		    (int)slen);
         return;   
     }
-    hd = cipher_open( dek->algo, CIPHER_MODE_CFB, 1 );
-    cipher_setkey( hd, dek->key, dek->keylen );
-    cipher_setiv( hd, NULL, 0 );
-    cipher_decrypt( hd, sesskey, sesskey, slen );
-    cipher_close( hd );
+    gcry_cipher_open ( &hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1 );
+    gcry_cipher_setkey( hd, dek->key, dek->keylen );
+    gcry_cipher_setiv( hd, NULL, 0 );
+    gcry_cipher_decrypt( hd, sesskey, slen, NULL, 0);
+    gcry_cipher_close( hd );
     /* check first byte (the cipher algo) */
     if ( sesskey[0] > 10 ) {
         log_error ( _("invalid symkey algorithm detected (%d)\n"),
                     sesskey[0] );
         return;
     }
-    n = cipher_get_keylen (sesskey[0]) / 8;
+    n = gcry_cipher_get_algo_keylen (sesskey[0]);
     if (n > DIM(dek->key))
          BUG ();
     /* now we replace the dek components with the real session key
        to decrypt the contents of the sequencing packet. */
-    dek->keylen = cipher_get_keylen( sesskey[0] ) / 8;
+    dek->keylen = gcry_cipher_get_algo_keylen (sesskey[0]);
     dek->algo = sesskey[0];
-    memcpy( dek->key, sesskey + 1, dek->keylen );
+    memcpy (dek->key, sesskey + 1, dek->keylen);
     /*log_hexdump( "thekey", dek->key, dek->keylen );*/
 }   
 
@@ -283,8 +283,8 @@ proc_symkey_enc( CTX c, PACKET *pkt )
         int algo = enc->cipher_algo;
 	const char *s;
 
-	s = cipher_algo_to_string (algo);
-	if( s )
+	s = gcry_cipher_algo_name (algo);
+	if (s && *s)
 	    log_info(_("%s encrypted data\n"), s );
 	else
 	    log_info(_("encrypted with unknown algorithm %d\n"), algo );
@@ -328,10 +328,10 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
 	/* It does not make much sense to store the session key in
 	 * secure memory because it has already been passed on the
 	 * command line and the GCHQ knows about it */
-	c->dek = m_alloc_clear( sizeof *c->dek );
+	c->dek = xcalloc (1, sizeof *c->dek );
 	result = get_override_session_key ( c->dek, opt.override_session_key );
 	if ( result ) {
-	    m_free(c->dek); c->dek = NULL;
+	    xfree (c->dek); c->dek = NULL;
 	}
     }
     else if( is_ELGAMAL(enc->pubkey_algo)
@@ -343,18 +343,18 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
 	    if( opt.list_only )
 		result = -1;
 	    else {
-		c->dek = m_alloc_secure_clear( sizeof *c->dek );
+		c->dek = xcalloc_secure (1, sizeof *c->dek);
 		if( (result = get_session_key( enc, c->dek )) ) {
 		    /* error: delete the DEK */
-		    m_free(c->dek); c->dek = NULL;
+		    xfree (c->dek); c->dek = NULL;
 		}
 	    }
 	}
 	else
-	    result = G10ERR_NO_SECKEY;
+	    result = GPG_ERR_NO_SECKEY;
     }
     else
-	result = G10ERR_PUBKEY_ALGO;
+	result = GPG_ERR_PUBKEY_ALGO;
 
     if( result == -1 )
 	;
@@ -364,7 +364,7 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
                 log_info( _("public key encrypted data: good DEK\n") );
             if ( opt.show_session_key ) {
                 int i;
-                char *buf = m_alloc ( c->dek->keylen*2 + 20 );
+                char *buf = xmalloc ( c->dek->keylen*2 + 20 );
                 sprintf ( buf, "%d:", c->dek->algo );
                 for(i=0; i < c->dek->keylen; i++ )
                     sprintf(buf+strlen(buf), "%02X", c->dek->key[i] );
@@ -374,7 +374,7 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
         }
         /* store it for later display */
         {
-            struct kidlist_item *x = m_alloc( sizeof *x );
+            struct kidlist_item *x = xmalloc ( sizeof *x );
             x->kid[0] = enc->keyid[0];
             x->kid[1] = enc->keyid[1];
             x->pubkey_algo = enc->pubkey_algo;
@@ -404,11 +404,11 @@ print_pkenc_list( struct kidlist_item *list, int failed )
         if ( !failed && list->reason )
             continue;
 
-        algstr = pubkey_algo_to_string( list->pubkey_algo );
-        pk = m_alloc_clear( sizeof *pk );
+        algstr = gcry_pk_algo_name (list->pubkey_algo);
+        pk = xcalloc (1, sizeof *pk );
 
-	if( !algstr )
-	    algstr = "[?]";
+	if (!algstr || !*algstr)
+          algstr = "[?]";
 	pk->pubkey_algo = list->pubkey_algo;
 	if( !get_pubkey( pk, list->kid ) ) {
 	    size_t n;
@@ -416,11 +416,11 @@ print_pkenc_list( struct kidlist_item *list, int failed )
 	    log_info( _("encrypted with %u-bit %s key, ID %08lX, created %s\n"),
 		       nbits_from_pk( pk ), algstr, (ulong)list->kid[1],
 		       strtimestamp(pk->timestamp) );
-	    fputs("      \"", log_stream() );
+	    fputs("      \"", log_get_stream() );
 	    p = get_user_id( list->kid, &n );
-	    print_utf8_string2 ( log_stream(), p, n, '"' );
-	    m_free(p);
-	    fputs("\"\n", log_stream() );
+	    print_utf8_string2 ( log_get_stream(), p, n, '"' );
+	    xfree (p);
+	    fputs("\"\n", log_get_stream() );
 	}
 	else {
 	    log_info(_("encrypted with %s key, ID %08lX\n"),
@@ -428,7 +428,7 @@ print_pkenc_list( struct kidlist_item *list, int failed )
 	}
 	free_public_key( pk );
 
-	if( list->reason == G10ERR_NO_SECKEY ) {
+	if( list->reason == GPG_ERR_NO_SECKEY ) {
 	    if( is_status_enabled() ) {
 		char buf[20];
 		sprintf(buf,"%08lX%08lX", (ulong)list->kid[0],
@@ -438,7 +438,7 @@ print_pkenc_list( struct kidlist_item *list, int failed )
 	}
 	else if (list->reason)
 	    log_info(_("public key decryption failed: %s\n"),
-						g10_errstr(list->reason));
+						gpg_strerror (list->reason));
     }
 }
 
@@ -465,22 +465,22 @@ proc_encrypted( CTX c, PACKET *pkt )
 	/* assume this is old style conventional encrypted data */
         if ( (algo = opt.def_cipher_algo))
             log_info (_("assuming %s encrypted data\n"),
-                        cipher_algo_to_string(algo));
-        else if ( check_cipher_algo(CIPHER_ALGO_IDEA) ) {
+                        gcry_cipher_algo_name (algo));
+        else if ( gcry_cipher_test_algo(CIPHER_ALGO_IDEA) ) {
             algo = opt.def_cipher_algo;
             if (!algo)
                 algo = opt.s2k_cipher_algo;
 	    idea_cipher_warn(1);
             log_info (_("IDEA cipher unavailable, "
                         "optimistically attempting to use %s instead\n"),
-                       cipher_algo_to_string(algo));
+                       gcry_cipher_algo_name (algo));
         }
         else {
             algo = CIPHER_ALGO_IDEA;
             if (!opt.s2k_digest_algo) {
                 /* If no digest is given we assume MD5 */
                 s2kbuf.mode = 0;
-                s2kbuf.hash_algo = DIGEST_ALGO_MD5;
+                s2kbuf.hash_algo = GCRY_MD_MD5;
                 s2k = &s2kbuf;
             }
             log_info (_("assuming %s encrypted data\n"), "IDEA");
@@ -491,14 +491,15 @@ proc_encrypted( CTX c, PACKET *pkt )
             c->dek->algo_info_printed = 1;
     }
     else if( !c->dek )
-	result = G10ERR_NO_SECKEY;
+	result = GPG_ERR_NO_SECKEY;
     if( !result )
 	result = decrypt_data( c, pkt->pkt.encrypted, c->dek );
 
-    m_free(c->dek); c->dek = NULL;
+    xfree (c->dek); c->dek = NULL;
     if( result == -1 )
 	;
-    else if( !result || (result==G10ERR_BAD_SIGN && opt.ignore_mdc_error)) {
+    else if( !result || (gpg_err_code (result)==GPG_ERR_BAD_SIGNATURE
+                         && opt.ignore_mdc_error)) {
 	write_status( STATUS_DECRYPTION_OKAY );
 	if( opt.verbose > 1 )
 	    log_info(_("decryption okay\n"));
@@ -507,14 +508,14 @@ proc_encrypted( CTX c, PACKET *pkt )
 	else if(!opt.no_mdc_warn)
 	    log_info (_("WARNING: message was not integrity protected\n"));
     }
-    else if( result == G10ERR_BAD_SIGN ) {
+    else if( gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE ) {
 	log_error(_("WARNING: encrypted message has been manipulated!\n"));
 	write_status( STATUS_BADMDC );
 	write_status( STATUS_DECRYPTION_FAILED );
     }
     else {
 	write_status( STATUS_DECRYPTION_FAILED );
-	log_error(_("decryption failed: %s\n"), g10_errstr(result));
+	log_error(_("decryption failed: %s\n"), gpg_strerror (result));
 	/* Hmmm: does this work when we have encrypted using multiple
 	 * ways to specify the session key (symmmetric and PK)*/
     }
@@ -537,7 +538,7 @@ proc_plaintext( CTX c, PACKET *pkt )
     else if( opt.verbose )
 	log_info(_("original file name='%.*s'\n"), pt->namelen, pt->name);
     free_md_filter_context( &c->mfx );
-    c->mfx.md = md_open( 0, 0);
+    gcry_md_open (&c->mfx.md, 0, 0);
     /* fixme: we may need to push the textfilter if we have sigclass 1
      * and no armoring - Not yet tested
      * Hmmm, why don't we need it at all if we have sigclass 1
@@ -548,7 +549,7 @@ proc_plaintext( CTX c, PACKET *pkt )
     for(n=c->list; n; n = n->next ) {
 	if( n->pkt->pkttype == PKT_ONEPASS_SIG ) {
 	    if( n->pkt->pkt.onepass_sig->digest_algo ) {
-		md_enable( c->mfx.md, n->pkt->pkt.onepass_sig->digest_algo );
+		gcry_md_enable ( c->mfx.md, n->pkt->pkt.onepass_sig->digest_algo );
 		if( !any && n->pkt->pkt.onepass_sig->digest_algo
 						      == DIGEST_ALGO_MD5 )
 		    only_md5 = 1;
@@ -572,7 +573,7 @@ proc_plaintext( CTX c, PACKET *pkt )
              * documents */
             clearsig = (*data == 0x01);
             for( data++, datalen--; datalen; datalen--, data++ )
-                md_enable( c->mfx.md, *data );
+                gcry_md_enable ( c->mfx.md, *data );
             any = 1;
             break;  /* no pass signature pakets are expected */
         }
@@ -580,9 +581,9 @@ proc_plaintext( CTX c, PACKET *pkt )
 
     if( !any && !opt.skip_verify ) {
 	/* no onepass sig packet: enable all standard algos */
-	md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
-	md_enable( c->mfx.md, DIGEST_ALGO_SHA1 );
-	md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
+	gcry_md_enable ( c->mfx.md, DIGEST_ALGO_RMD160 );
+	gcry_md_enable ( c->mfx.md, DIGEST_ALGO_SHA1 );
+	gcry_md_enable ( c->mfx.md, DIGEST_ALGO_MD5 );
     }
     if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) {
 	/* This is a kludge to work around a bug in pgp2.  It does only
@@ -590,25 +591,27 @@ proc_plaintext( CTX c, PACKET *pkt )
 	 * pgp mails we could see whether there is the signature packet
 	 * in front of the plaintext.  If someone needs this, send me a patch.
 	 */
-	c->mfx.md2 = md_open( DIGEST_ALGO_MD5, 0);
+	gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0);
     }
     if ( DBG_HASHING ) {
-	md_start_debug( c->mfx.md, "verify" );
+	gcry_md_start_debug ( c->mfx.md, "verify" );
 	if ( c->mfx.md2  )
-	    md_start_debug( c->mfx.md2, "verify2" );
+	    gcry_md_start_debug ( c->mfx.md2, "verify2" );
     }
     if ( c->pipemode.op == 'B' )
-        rc = handle_plaintext( pt, &c->mfx, 1, 0 );
+        rc = handle_plaintext( pt, &c->mfx, 1, 0, NULL );
     else {
-        rc = handle_plaintext( pt, &c->mfx, c->sigs_only, clearsig );
-        if( rc == G10ERR_CREATE_FILE && !c->sigs_only) {
+        int failed;
+
+        rc = handle_plaintext( pt, &c->mfx, c->sigs_only, clearsig, &failed);
+        if( rc && failed && !c->sigs_only) {
             /* can't write output but we hash it anyway to
              * check the signature */
-            rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
+            rc = handle_plaintext( pt, &c->mfx, 1, clearsig, NULL );
         }
     }
     if( rc )
-	log_error( "handle plaintext failed: %s\n", g10_errstr(rc));
+	log_error( "handle plaintext failed: %s\n", gpg_strerror (rc));
     free_packet(pkt);
     c->last_was_session_key = 0;
 
@@ -624,14 +627,14 @@ proc_plaintext( CTX c, PACKET *pkt )
 
 
 static int
-proc_compressed_cb( IOBUF a, void *info )
+proc_compressed_cb( iobuf_t a, void *info )
 {
     return proc_signature_packets( info, a, ((CTX)info)->signed_data,
 					    ((CTX)info)->sigfilename );
 }
 
 static int
-proc_encrypt_cb( IOBUF a, void *info )
+proc_encrypt_cb( iobuf_t a, void *info )
 {
     return proc_encryption_packets( info, a );
 }
@@ -650,7 +653,7 @@ proc_compressed( CTX c, PACKET *pkt )
     else
 	rc = handle_compressed( c, zd, NULL, NULL );
     if( rc )
-	log_error("uncompressing failed: %s\n", g10_errstr(rc));
+	log_error("uncompressing failed: %s\n", gpg_strerror (rc));
     free_packet(pkt);
     c->last_was_session_key = 0;
 }
@@ -676,27 +679,29 @@ do_check_sig( CTX c, KBNODE node, int *is_selfsig, int *is_expkey )
     sig = node->pkt->pkt.signature;
 
     algo = sig->digest_algo;
-    if( (rc=check_digest_algo(algo)) )
+    if( (rc = gcry_md_test_algo(algo)) )
 	return rc;
 
     if( sig->sig_class == 0x00 ) {
 	if( c->mfx.md )
-	    md = md_copy( c->mfx.md );
+	    gcry_md_copy (&md,c->mfx.md);
 	else /* detached signature */
-	    md = md_open( 0, 0 ); /* signature_check() will enable the md*/
+	    gcry_md_open (&md, 0, 0 ); /* signature_check() will
+                                          enable the md*/
     }
     else if( sig->sig_class == 0x01 ) {
 	/* how do we know that we have to hash the (already hashed) text
 	 * in canonical mode ??? (calculating both modes???) */
 	if( c->mfx.md ) {
-	    md = md_copy( c->mfx.md );
-	    if( c->mfx.md2 )
-	       md2 = md_copy( c->mfx.md2 );
+	    gcry_md_copy (&md, c->mfx.md);
+	    if (c->mfx.md2)
+	       gcry_md_copy (&md2, c->mfx.md2);
 	}
 	else { /* detached signature */
 	  log_debug("Do we really need this here?");
-	    md = md_open( 0, 0 ); /* signature_check() will enable the md*/
-	    md2 = md_open( 0, 0 );
+	    gcry_md_open (&md, 0, 0 ); /* signature_check() will
+                                          enable the md*/
+	    gcry_md_open (&md2, 0, 0 );
 	}
     }
     else if( (sig->sig_class&~3) == 0x10
@@ -712,21 +717,21 @@ do_check_sig( CTX c, KBNODE node, int *is_selfsig, int *is_expkey )
 	else if( sig->sig_class == 0x20 ) {
 	    log_info(_("standalone revocation - "
 		       "use \"gpg --import\" to apply\n"));
-	    return G10ERR_NOT_PROCESSED;
+	    return GPG_ERR_NOT_PROCESSED;
 	}
 	else {
 	    log_error("invalid root packet for sigclass %02x\n",
 							sig->sig_class);
-	    return G10ERR_SIG_CLASS;
+	    return GPG_ERR_SIG_CLASS;
 	}
     }
     else
-	return G10ERR_SIG_CLASS;
+	return GPG_ERR_SIG_CLASS;
     rc = signature_check2( sig, md, &dummy, is_expkey );
-    if( rc == G10ERR_BAD_SIGN && md2 )
+    if( gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2 )
 	rc = signature_check2( sig, md2, &dummy, is_expkey );
-    md_close(md);
-    md_close(md2);
+    gcry_md_close (md);
+    gcry_md_close (md2);
 
     return rc;
 }
@@ -947,12 +952,13 @@ list_node( CTX c, KBNODE node )
 	    fputs("sig", stdout);
 	if( opt.check_sigs ) {
 	    fflush(stdout);
-	    switch( (rc2=do_check_sig( c, node, &is_selfsig, NULL )) ) {
-	      case 0:		       sigrc = '!'; break;
-	      case G10ERR_BAD_SIGN:    sigrc = '-'; break;
-	      case G10ERR_NO_PUBKEY: 
-	      case G10ERR_UNU_PUBKEY:  sigrc = '?'; break;
-	      default:		       sigrc = '%'; break;
+	    switch( gpg_err_code (rc2=do_check_sig( c, node,
+                                                    &is_selfsig, NULL )) ) {
+	      case 0:		          sigrc = '!'; break;
+	      case GPG_ERR_BAD_SIGNATURE: sigrc = '-'; break;
+	      case GPG_ERR_NO_PUBKEY: 
+	      case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
+	      default:		          sigrc = '%'; break;
 	    }
 	}
 	else {	/* check whether this is a self signature */
@@ -991,7 +997,7 @@ list_node( CTX c, KBNODE node )
 	    printf("%c       %08lX %s   ",
 		    sigrc, (ulong)sig->keyid[1], datestr_from_sig(sig));
 	if( sigrc == '%' )
-	    printf("[%s] ", g10_errstr(rc2) );
+	    printf("[%s] ", gpg_strerror (rc2) );
 	else if( sigrc == '?' )
 	    ;
 	else if( is_selfsig ) {
@@ -1004,7 +1010,7 @@ list_node( CTX c, KBNODE node )
 	else if( !opt.fast_list_mode ) {
 	    p = get_user_id( sig->keyid, &n );
 	    print_string( stdout, p, n, opt.with_colons );
-	    m_free(p);
+	    xfree (p);
 	}
 	if( opt.with_colons )
 	    printf(":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
@@ -1017,24 +1023,24 @@ list_node( CTX c, KBNODE node )
 
 
 int
-proc_packets( void *anchor, IOBUF a )
+proc_packets( void *anchor, iobuf_t a )
 {
     int rc;
-    CTX c = m_alloc_clear( sizeof *c );
+    CTX c = xcalloc (1, sizeof *c );
 
     c->anchor = anchor;
     rc = do_proc_packets( c, a );
-    m_free( c );
+    xfree ( c );
     return rc;
 }
 
 
 
 int
-proc_signature_packets( void *anchor, IOBUF a,
+proc_signature_packets( void *anchor, iobuf_t a,
 			STRLIST signedfiles, const char *sigfilename )
 {
-    CTX c = m_alloc_clear( sizeof *c );
+    CTX c = xcalloc (1, sizeof *c );
     int rc;
 
     c->anchor = anchor;
@@ -1042,28 +1048,28 @@ proc_signature_packets( void *anchor, IOBUF a,
     c->signed_data = signedfiles;
     c->sigfilename = sigfilename;
     rc = do_proc_packets( c, a );
-    m_free( c );
+    xfree ( c );
     return rc;
 }
 
 int
-proc_encryption_packets( void *anchor, IOBUF a )
+proc_encryption_packets( void *anchor, iobuf_t a )
 {
-    CTX c = m_alloc_clear( sizeof *c );
+    CTX c = xcalloc (1, sizeof *c );
     int rc;
 
     c->anchor = anchor;
     c->encrypt_only = 1;
     rc = do_proc_packets( c, a );
-    m_free( c );
+    xfree ( c );
     return rc;
 }
 
 
 int
-do_proc_packets( CTX c, IOBUF a )
+do_proc_packets( CTX c, iobuf_t a )
 {
-    PACKET *pkt = m_alloc( sizeof *pkt );
+    PACKET *pkt = xmalloc ( sizeof *pkt );
     int rc=0;
     int any_data=0;
     int newpkt;
@@ -1076,7 +1082,7 @@ do_proc_packets( CTX c, IOBUF a )
 	    free_packet(pkt);
             /* stop processing when an invalid packet has been encountered
              * but don't do so when we are doing a --list-packet. */
-	    if( rc == G10ERR_INVALID_PACKET && opt.list_packets != 2 )
+	    if( gpg_err_code (rc) == GPG_ERR_INV_PACKET && opt.list_packets != 2 )
 		break;
 	    continue;
 	}
@@ -1101,7 +1107,7 @@ do_proc_packets( CTX c, IOBUF a )
 	      case PKT_ENCRYPTED:
 	      case PKT_ENCRYPTED_MDC:
                 write_status_text( STATUS_UNEXPECTED, "0" );
-		rc = G10ERR_UNEXPECTED;
+		rc = GPG_ERR_UNEXPECTED;
 		goto leave;
 	      case PKT_SIGNATURE:   newpkt = add_signature( c, pkt ); break;
 	      case PKT_PLAINTEXT:   proc_plaintext( c, pkt ); break;
@@ -1117,7 +1123,7 @@ do_proc_packets( CTX c, IOBUF a )
 	      case PKT_SECRET_KEY:
 	      case PKT_USER_ID:
                 write_status_text( STATUS_UNEXPECTED, "0" );
-		rc = G10ERR_UNEXPECTED;
+		rc = GPG_ERR_UNEXPECTED;
 		goto leave;
 	      case PKT_SIGNATURE:   newpkt = add_signature( c, pkt ); break;
 	      case PKT_SYMKEY_ENC:  proc_symkey_enc( c, pkt ); break;
@@ -1171,7 +1177,7 @@ do_proc_packets( CTX c, IOBUF a )
 	if( newpkt == -1 )
 	    ;
 	else if( newpkt ) {
-	    pkt = m_alloc( sizeof *pkt );
+	    pkt = xmalloc ( sizeof *pkt );
 	    init_packet(pkt);
 	}
 	else
@@ -1183,7 +1189,7 @@ do_proc_packets( CTX c, IOBUF a )
             break;
         }
     }
-    if( rc == G10ERR_INVALID_PACKET )
+    if( rc == GPG_ERR_INV_PACKET )
 	write_status_text( STATUS_NODATA, "3" );
     if( any_data )
 	rc = 0;
@@ -1193,9 +1199,9 @@ do_proc_packets( CTX c, IOBUF a )
 
   leave:
     release_list( c );
-    m_free(c->dek);
+    xfree (c->dek);
     free_packet( pkt );
-    m_free( pkt );
+    xfree ( pkt );
     free_md_filter_context( &c->mfx );
     return rc;
 }
@@ -1269,16 +1275,16 @@ check_sig_and_print( CTX c, KBNODE node )
     }
 
     tstr = asctimestamp(sig->timestamp);
-    astr = pubkey_algo_to_string( sig->pubkey_algo );
+    astr = gcry_pk_algo_name (sig->pubkey_algo);
     log_info(_("Signature made %.*s using %s key ID %08lX\n"),
 	    (int)strlen(tstr), tstr, astr? astr: "?", (ulong)sig->keyid[1] );
 
     rc = do_check_sig(c, node, NULL, &is_expkey );
-    if( rc == G10ERR_NO_PUBKEY && opt.keyserver_scheme && opt.keyserver_options.auto_key_retrieve) {
+    if( rc == GPG_ERR_NO_PUBKEY && opt.keyserver_scheme && opt.keyserver_options.auto_key_retrieve) {
 	if( keyserver_import_keyid ( sig->keyid )==0 )
 	    rc = do_check_sig(c, node, NULL, &is_expkey );
     }
-    if( !rc || rc == G10ERR_BAD_SIGN ) {
+    if( !rc || gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE ) {
 	KBNODE un, keyblock;
 	int count=0, statno;
         char keyid_str[50];
@@ -1322,9 +1328,9 @@ check_sig_and_print( CTX c, KBNODE node )
             log_info(rc? _("BAD signature from \"")
                        : sig->flags.expired ? _("Expired signature from \"")
 		       : _("Good signature from \""));
-	    print_utf8_string( log_stream(), un->pkt->pkt.user_id->name,
+	    print_utf8_string( log_get_stream(), un->pkt->pkt.user_id->name,
 					     un->pkt->pkt.user_id->len );
-	    fputs("\"\n", log_stream() );
+	    fputs("\"\n", log_get_stream() );
             count++;
 	}
 	if( !count ) {	/* just in case that we have no valid textual
@@ -1356,13 +1362,13 @@ check_sig_and_print( CTX c, KBNODE node )
                        : sig->flags.expired ? _("Expired signature from \"")
 		       : _("Good signature from \""));
             if (opt.trust_model!=TM_ALWAYS && un) {
-                fputs(_("[uncertain]"), log_stream() );
-                putc(' ', log_stream() );
+                fputs(_("[uncertain]"), log_get_stream() );
+                putc(' ', log_get_stream() );
             }
-            print_utf8_string( log_stream(),
+            print_utf8_string( log_get_stream(),
                                un? un->pkt->pkt.user_id->name:"[?]",
                                un? un->pkt->pkt.user_id->len:3 );
-	    fputs("\"\n", log_stream() );
+	    fputs("\"\n", log_get_stream() );
 	}
 
         /* If we have a good signature and already printed 
@@ -1393,9 +1399,9 @@ check_sig_and_print( CTX c, KBNODE node )
 		  }
 
 		log_info(    _("                aka \""));
-                print_utf8_string( log_stream(), un->pkt->pkt.user_id->name,
+                print_utf8_string( log_get_stream(), un->pkt->pkt.user_id->name,
                                                  un->pkt->pkt.user_id->len );
-                fputs("\"\n", log_stream() );
+                fputs("\"\n", log_get_stream() );
             }
 	}
 	release_kbnode( keyblock );
@@ -1408,7 +1414,7 @@ check_sig_and_print( CTX c, KBNODE node )
 
 	if( !rc && is_status_enabled() ) {
 	    /* print a status response with the fingerprint */
-	    PKT_public_key *pk = m_alloc_clear( sizeof *pk );
+	    PKT_public_key *pk = xcalloc (1, sizeof *pk );
 
 	    if( !get_pubkey( pk, sig->keyid ) ) {
 		byte array[MAX_FINGERPRINT_LEN], *p;
@@ -1436,7 +1442,7 @@ check_sig_and_print( CTX c, KBNODE node )
                    akid[0] = pk->main_keyid[0];
                    akid[1] = pk->main_keyid[1];
                    free_public_key (pk);
-                   pk = m_alloc_clear( sizeof *pk );
+                   pk = xcalloc (1, sizeof *pk );
                    if (get_pubkey (pk, akid)) {
                      /* impossible error, we simply return a zeroed out fpr */
                      n = MAX_FINGERPRINT_LEN < 20? MAX_FINGERPRINT_LEN : 20;
@@ -1460,7 +1466,7 @@ check_sig_and_print( CTX c, KBNODE node )
 	  {
 	    log_info(_("Signature expired %s\n"),
 		     asctimestamp(sig->expiredate));
-	    rc=G10ERR_GENERAL; /* need a better error here? */
+	    rc=GPG_ERR_GENERAL; /* need a better error here? */
 	  }
 	else if(sig->expiredate)
 	  log_info(_("Signature expires %s\n"),asctimestamp(sig->expiredate));
@@ -1469,7 +1475,7 @@ check_sig_and_print( CTX c, KBNODE node )
 	  log_info(_("%s signature, digest algorithm %s\n"),
 		   sig->sig_class==0x00?_("binary"):
 		   sig->sig_class==0x01?_("textmode"):_("unknown"),
-		   digest_algo_to_string(sig->digest_algo));
+		   gcry_md_algo_name (sig->digest_algo));
 
 	if( rc )
 	    g10_errors_seen = 1;
@@ -1483,12 +1489,12 @@ check_sig_and_print( CTX c, KBNODE node )
 		     sig->pubkey_algo, sig->digest_algo,
 		     sig->sig_class, (ulong)sig->timestamp, rc );
 	write_status_text( STATUS_ERRSIG, buf );
-	if( rc == G10ERR_NO_PUBKEY ) {
+	if( rc == GPG_ERR_NO_PUBKEY ) {
 	    buf[16] = 0;
 	    write_status_text( STATUS_NO_PUBKEY, buf );
 	}
-	if( rc != G10ERR_NOT_PROCESSED )
-	    log_error(_("Can't check signature: %s\n"), g10_errstr(rc) );
+	if( rc != GPG_ERR_NOT_PROCESSED )
+	    log_error(_("Can't check signature: %s\n"), gpg_strerror (rc) );
     }
     return rc;
 }
@@ -1534,11 +1540,11 @@ proc_tree( CTX c, KBNODE node )
 	if( !c->have_data ) {
 	    free_md_filter_context( &c->mfx );
 	    /* prepare to create all requested message digests */
-	    c->mfx.md = md_open(0, 0);
+	    gcry_md_open (&c->mfx.md, 0, 0);
 
 	    /* fixme: why looking for the signature packet and not 1passpacket*/
 	    for( n1 = node; (n1 = find_next_kbnode(n1, PKT_SIGNATURE )); ) {
-		md_enable( c->mfx.md, n1->pkt->pkt.signature->digest_algo);
+		gcry_md_enable ( c->mfx.md, n1->pkt->pkt.signature->digest_algo);
 	    }
 	    /* ask for file and hash it */
 	    if( c->sigs_only ) {
@@ -1552,7 +1558,7 @@ proc_tree( CTX c, KBNODE node )
 			n1? (n1->pkt->pkt.onepass_sig->sig_class == 0x01):0 );
 	    }
 	    if( rc ) {
-		log_error("can't hash datafile: %s\n", g10_errstr(rc));
+		log_error("can't hash datafile: %s\n", gpg_strerror (rc));
 		return;
 	    }
 	}
@@ -1613,20 +1619,20 @@ proc_tree( CTX c, KBNODE node )
 	else if( !c->have_data ) {
 	    /* detached signature */
 	    free_md_filter_context( &c->mfx );
-	    c->mfx.md = md_open(sig->digest_algo, 0);
+	    gcry_md_open (&c->mfx.md, sig->digest_algo, 0);
 	    if( !opt.pgp2_workarounds )
 		;
 	    else if( sig->digest_algo == DIGEST_ALGO_MD5
 		     && is_RSA( sig->pubkey_algo ) ) {
 		/* enable a workaround for a pgp2 bug */
-		c->mfx.md2 = md_open( DIGEST_ALGO_MD5, 0 );
+		gcry_md_open (&c->mfx.md2, DIGEST_ALGO_MD5, 0 );
 	    }
 	    else if( sig->digest_algo == DIGEST_ALGO_SHA1
 		     && sig->pubkey_algo == PUBKEY_ALGO_DSA
 		     && sig->sig_class == 0x01 ) {
 		/* enable the workaround also for pgp5 when the detached
 		 * signature has been created in textmode */
-		c->mfx.md2 = md_open( sig->digest_algo, 0 );
+		gcry_md_open (&c->mfx.md2, sig->digest_algo, 0 );
 	    }
 #if 0 /* workaround disabled */
 	    /* Here we have another hack to work around a pgp 2 bug
@@ -1639,9 +1645,9 @@ proc_tree( CTX c, KBNODE node )
 		    /*	c->mfx.md2? 0 :(sig->sig_class == 0x01) */
 #endif
             if ( DBG_HASHING ) {
-                md_start_debug( c->mfx.md, "verify" );
+                gcry_md_start_debug ( c->mfx.md, "verify" );
                 if ( c->mfx.md2  )
-                    md_start_debug( c->mfx.md2, "verify2" );
+                    gcry_md_start_debug ( c->mfx.md2, "verify2" );
             }
 	    if( c->sigs_only ) {
 		rc = hash_datafiles( c->mfx.md, c->mfx.md2,
@@ -1654,7 +1660,7 @@ proc_tree( CTX c, KBNODE node )
 						(sig->sig_class == 0x01) );
 	    }
 	    if( rc ) {
-		log_error("can't hash datafile: %s\n", g10_errstr(rc));
+		log_error("can't hash datafile: %s\n", gpg_strerror (rc));
 		return;
 	    }
 	}
diff --git a/g10/mdfilter.c b/g10/mdfilter.c
index d6ccacecf..b58189146 100644
--- a/g10/mdfilter.c
+++ b/g10/mdfilter.c
@@ -38,7 +38,7 @@
  */
 int
 md_filter( void *opaque, int control,
-	       IOBUF a, byte *buf, size_t *ret_len)
+	       iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     md_filter_context_t *mfx = opaque;
@@ -50,9 +50,9 @@ md_filter( void *opaque, int control,
 	i = iobuf_read( a, buf, size );
 	if( i == -1 ) i = 0;
 	if( i ) {
-	    md_write(mfx->md, buf, i );
+	    gcry_md_write(mfx->md, buf, i );
 	    if( mfx->md2 )
-		md_write(mfx->md2, buf, i );
+		gcry_md_write(mfx->md2, buf, i );
 	}
 	else
 	    rc = -1; /* eof */
@@ -67,8 +67,8 @@ md_filter( void *opaque, int control,
 void
 free_md_filter_context( md_filter_context_t *mfx )
 {
-    md_close(mfx->md);
-    md_close(mfx->md2);
+    gcry_md_close (mfx->md);
+    gcry_md_close (mfx->md2);
     mfx->md = NULL;
     mfx->md2 = NULL;
     mfx->maxbuf_size = 0;
diff --git a/g10/misc.c b/g10/misc.c
index 1b8e6172a..19586624f 100644
--- a/g10/misc.c
+++ b/g10/misc.c
@@ -1,5 +1,6 @@
 /* misc.c -  miscellaneous functions
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -24,6 +25,7 @@
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
+#include <assert.h>
 #if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
 #include <asm/sysinfo.h>
 #include <asm/unistd.h>
@@ -33,27 +35,15 @@
 #include <sys/time.h>
 #include <sys/resource.h>
 #endif
+
+#include "gpg.h"
 #include "util.h"
 #include "main.h"
 #include "photoid.h"
 #include "options.h"
 #include "i18n.h"
 
-
-const char *g10m_revision_string(int);
-const char *g10c_revision_string(int);
-const char *g10u_revision_string(int);
-
-#ifdef __GNUC__
-volatile
-#endif
-	 void
-pull_in_libs(void)
-{
-    g10m_revision_string(0);
-    g10c_revision_string(0);
-    g10u_revision_string(0);
-}
+#define MAX_EXTERN_MPI_BITS 16384
 
 
 #if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
@@ -125,19 +115,26 @@ checksum( byte *p, unsigned n )
 }
 
 u16
-checksum_mpi( MPI a )
+checksum_mpi( gcry_mpi_t a )
 {
-    u16 csum;
-    byte *buffer;
-    unsigned nbytes;
-    unsigned nbits;
-
-    buffer = mpi_get_buffer( a, &nbytes, NULL );
-    nbits = mpi_get_nbits(a);
-    csum = checksum_u16( nbits );
-    csum += checksum( buffer, nbytes );
-    m_free( buffer );
-    return csum;
+  int rc;
+  u16 csum;
+  byte *buffer;
+  size_t nbytes;
+
+  rc = gcry_mpi_print( GCRYMPI_FMT_PGP, NULL, &nbytes, a );
+  if (rc)
+    BUG ();
+  /* fixme: for numbers not in secure memory we should use a stack
+   * based buffer and only allocate a larger one if mpi_print return
+   * an error */
+  buffer = gcry_is_secure(a)? gcry_xmalloc_secure(nbytes) : gcry_xmalloc(nbytes);
+  rc = gcry_mpi_print( GCRYMPI_FMT_PGP, buffer, &nbytes, a );
+  if (rc)
+    BUG ();
+  csum = checksum (buffer, nbytes );
+  xfree (buffer );
+  return csum;
 }
 
 u32
@@ -238,16 +235,18 @@ int
 openpgp_cipher_test_algo( int algo )
 {
     if( algo < 0 || algo > 110 )
-        return G10ERR_CIPHER_ALGO;
-    return check_cipher_algo(algo);
+        return GPG_ERR_CIPHER_ALGO;
+    return gcry_cipher_test_algo (algo);
 }
 
 int
 openpgp_pk_test_algo( int algo, unsigned int usage_flags )
 {
-    if( algo < 0 || algo > 110 )
-	return G10ERR_PUBKEY_ALGO;
-    return check_pubkey_algo2( algo, usage_flags );
+  size_t value = usage_flags;
+
+  if (algo < 0 || algo > 110)
+    return GPG_ERR_PUBKEY_ALGO;
+  return gcry_pk_algo_info (algo, GCRYCTL_TEST_ALGO, NULL, &value);
 }
 
 int 
@@ -285,8 +284,29 @@ int
 openpgp_md_test_algo( int algo )
 {
     if( algo < 0 || algo > 110 )
-        return G10ERR_DIGEST_ALGO;
-    return check_digest_algo(algo);
+        return GPG_ERR_DIGEST_ALGO;
+    return gcry_md_test_algo (algo);
+}
+
+int
+openpgp_md_map_name (const char *string)
+{
+  int i = gcry_md_map_name (string);
+  return i < 0 || i > 110? 0 : i;
+}
+
+int
+openpgp_cipher_map_name (const char *string)
+{
+  int i = gcry_cipher_map_name (string);
+  return i < 0 || i > 110? 0 : i;
+}
+
+int
+openpgp_pk_map_name (const char *string)
+{
+  int i = gcry_pk_map_name (string);
+  return i < 0 || i > 110? 0 : i;
 }
 
 #ifdef USE_IDEA
@@ -336,7 +356,7 @@ pct_expando(const char *string,struct expando_args *args)
 	    goto fail;
 
 	  maxlen+=1024;
-	  ret=m_realloc(ret,maxlen);
+	  ret= xrealloc(ret,maxlen);
 	}
 
       done=0;
@@ -467,7 +487,7 @@ pct_expando(const char *string,struct expando_args *args)
   return ret;
 
  fail:
-  m_free(ret);
+  xfree (ret);
   return NULL;
 }
 
@@ -565,7 +585,7 @@ check_compress_algo(int algo)
   if(algo>=0 && algo<=2)
     return 0;
 
-  return G10ERR_COMPR_ALGO;
+  return GPG_ERR_COMPR_ALGO;
 }
 
 int
@@ -676,3 +696,233 @@ parse_options(char *str,unsigned int *options,struct parse_options *opts)
 
   return 1;
 }
+
+
+
+/* Temporary helper. */
+int
+pubkey_get_npkey( int algo )
+{
+    int n = gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NPKEY, NULL, 0 );
+    return n > 0? n : 0;
+}
+
+/* Temporary helper. */
+int
+pubkey_get_nskey( int algo )
+{
+    int n = gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NSKEY, NULL, 0 );
+    return n > 0? n : 0;
+}
+
+/* Temporary helper. */
+int
+pubkey_get_nsig( int algo )
+{
+    int n = gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NSIGN, NULL, 0 );
+    return n > 0? n : 0;
+}
+
+/* Temporary helper. */
+int
+pubkey_get_nenc( int algo )
+{
+    int n = gcry_pk_algo_info( algo, GCRYCTL_GET_ALGO_NENCR, NULL, 0 );
+    return n > 0? n : 0;
+}
+
+
+/* Temporary helper. */
+unsigned int
+pubkey_nbits( int algo, gcry_mpi_t *key )
+{
+    int rc, nbits;
+    gcry_sexp_t sexp;
+
+    if( algo == GCRY_PK_DSA ) {
+	rc = gcry_sexp_build ( &sexp, NULL,
+			      "(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
+				  key[0], key[1], key[2], key[3] );
+    }
+    else if( algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E ) {
+	rc = gcry_sexp_build ( &sexp, NULL,
+			      "(public-key(elg(p%m)(g%m)(y%m)))",
+				  key[0], key[1], key[2] );
+    }
+    else if( algo == GCRY_PK_RSA ) {
+	rc = gcry_sexp_build ( &sexp, NULL,
+			      "(public-key(rsa(n%m)(e%m)))",
+				  key[0], key[1] );
+    }
+    else
+	return 0;
+
+    if ( rc )
+	BUG ();
+
+    nbits = gcry_pk_get_nbits( sexp );
+    gcry_sexp_release( sexp );
+    return nbits;
+}
+
+
+/* MPI helper functions. */
+
+
+/****************
+ * write an mpi to out.
+ */
+int
+mpi_write( iobuf_t out, gcry_mpi_t a )
+{
+    char buffer[(MAX_EXTERN_MPI_BITS+7)/8];
+    size_t nbytes;
+    int rc;
+
+    nbytes = (MAX_EXTERN_MPI_BITS+7)/8;
+    rc = gcry_mpi_print( GCRYMPI_FMT_PGP, buffer, &nbytes, a );
+    if( !rc )
+	rc = iobuf_write( out, buffer, nbytes );
+
+    return rc;
+}
+
+/****************
+ * Writye a MPI to out, but in this case it is an opaque one,
+ * s used vor v3 protected keys.
+ */
+int
+mpi_write_opaque( iobuf_t out, gcry_mpi_t a )
+{
+    size_t nbytes, nbits;
+    int rc;
+    char *p;
+
+    assert( gcry_mpi_get_flag( a, GCRYMPI_FLAG_OPAQUE ) );
+    p = gcry_mpi_get_opaque( a, &nbits );
+    nbytes = (nbits+7) / 8;
+    iobuf_put( out, nbits >> 8 );
+    iobuf_put( out, nbits );
+    rc = iobuf_write( out, p, nbytes );
+    return rc;
+}
+
+
+/****************
+ * Read an external representation of an mpi and return the MPI
+ * The external format is a 16 bit unsigned value stored in network byte order,
+ * giving the number of bits for the following integer. The integer is stored
+ * with MSB first (left padded with zeroes to align on a byte boundary).
+ */
+gcry_mpi_t
+mpi_read(iobuf_t inp, unsigned int *ret_nread, int secure)
+{
+    int c, c1, c2, i;
+    unsigned int nbits, nbytes, nread=0;
+    gcry_mpi_t a = NULL;
+    byte *buf = NULL;
+    byte *p;
+
+    if( (c = c1 = iobuf_get(inp)) == -1 )
+	goto leave;
+    nbits = c << 8;
+    if( (c = c2 = iobuf_get(inp)) == -1 )
+	goto leave;
+    nbits |= c;
+    if( nbits > MAX_EXTERN_MPI_BITS ) {
+	log_error("mpi too large (%u bits)\n", nbits);
+	goto leave;
+    }
+    nread = 2;
+    nbytes = (nbits+7) / 8;
+    buf = secure? gcry_xmalloc_secure( nbytes+2 ) : gcry_xmalloc( nbytes+2 );
+    p = buf;
+    p[0] = c1;
+    p[1] = c2;
+    for( i=0 ; i < nbytes; i++ ) {
+	p[i+2] = iobuf_get(inp) & 0xff;
+	nread++;
+    }
+    nread += nbytes;
+    if( gcry_mpi_scan( &a, GCRYMPI_FMT_PGP, buf, &nread ) )
+	a = NULL;
+
+  leave:
+    gcry_free(buf);
+    if( nread > *ret_nread )
+	log_bug("mpi larger than packet");
+    else
+	*ret_nread = nread;
+    return a;
+}
+
+/****************
+ * Same as mpi_read but the value is stored as an opaque MPI.
+ * This function is used to read encrypted MPI of v3 packets.
+ */
+gcry_mpi_t
+mpi_read_opaque(iobuf_t inp, unsigned *ret_nread )
+{
+    int c, c1, c2, i;
+    unsigned nbits, nbytes, nread=0;
+    gcry_mpi_t a = NULL;
+    byte *buf = NULL;
+    byte *p;
+
+    if( (c = c1 = iobuf_get(inp)) == -1 )
+	goto leave;
+    nbits = c << 8;
+    if( (c = c2 = iobuf_get(inp)) == -1 )
+	goto leave;
+    nbits |= c;
+    if( nbits > MAX_EXTERN_MPI_BITS ) {
+	log_error("mpi too large (%u bits)\n", nbits);
+	goto leave;
+    }
+    nread = 2;
+    nbytes = (nbits+7) / 8;
+    buf = gcry_xmalloc( nbytes );
+    p = buf;
+    for( i=0 ; i < nbytes; i++ ) {
+	p[i] = iobuf_get(inp) & 0xff;
+    }
+    nread += nbytes;
+    a = gcry_mpi_set_opaque(NULL, buf, nbits );
+    buf = NULL;
+
+  leave:
+    gcry_free(buf);
+    if( nread > *ret_nread )
+	log_bug("mpi larger than packet");
+    else
+	*ret_nread = nread;
+    return a;
+}
+
+
+int
+mpi_print( FILE *fp, gcry_mpi_t a, int mode )
+{
+    int n=0;
+
+    if( !a )
+	return fprintf(fp, "[MPI_NULL]");
+    if( !mode ) {
+	unsigned int n1;
+	n1 = gcry_mpi_get_nbits(a);
+	n += fprintf(fp, "[%u bits]", n1);
+    }
+    else {
+	int rc;
+	char *buffer;
+
+	rc = gcry_mpi_aprint( GCRYMPI_FMT_HEX, (void **)&buffer, NULL, a );
+	assert( !rc );
+	fputs( buffer, fp );
+	n += strlen(buffer);
+	gcry_free( buffer );
+    }
+    return n;
+}
+
+
diff --git a/g10/mkdtemp.c b/g10/mkdtemp.c
index 3abdc1da6..55e5b189f 100644
--- a/g10/mkdtemp.c
+++ b/g10/mkdtemp.c
@@ -85,7 +85,7 @@ char *mkdtemp(char *template)
       if(remaining>0)
 	sprintf(marker,"%X",randombits[idx]&0xF);
 
-      m_free(randombits);
+      xfree (randombits);
 
       if(mkdir(template,0700)==0)
 	break;
diff --git a/g10/openfile.c b/g10/openfile.c
index 6f4541e80..b36e0d8e0 100644
--- a/g10/openfile.c
+++ b/g10/openfile.c
@@ -28,6 +28,8 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <unistd.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "ttyio.h"
@@ -99,19 +101,19 @@ make_outfile_name( const char *iname )
     size_t n;
 
     if( (!iname || (*iname=='-' && !iname[1]) ))
-	return m_strdup("-");
+	return xstrdup ("-");
 
     n = strlen(iname);
     if( n > 4 && (    !CMP_FILENAME(iname+n-4, EXTSEP_S "gpg")
 		   || !CMP_FILENAME(iname+n-4, EXTSEP_S "pgp")
 		   || !CMP_FILENAME(iname+n-4, EXTSEP_S "sig")
 		   || !CMP_FILENAME(iname+n-4, EXTSEP_S "asc") ) ) {
-	char *buf = m_strdup( iname );
+	char *buf = xstrdup ( iname );
 	buf[n-4] = 0;
 	return buf;
     }
     else if( n > 5 && !CMP_FILENAME(iname+n-5, EXTSEP_S "sign") ) {
-	char *buf = m_strdup( iname );
+	char *buf = xstrdup ( iname );
 	buf[n-5] = 0;
 	return buf;
     }
@@ -142,19 +144,19 @@ ask_outfile_name( const char *name, size_t namelen )
 
     n = strlen(s) + namelen + 10;
     defname = name && namelen? make_printable_string( name, namelen, 0): NULL;
-    prompt = m_alloc(n);
+    prompt = xmalloc (n);
     if( defname )
 	sprintf(prompt, "%s [%s]: ", s, defname );
     else
 	sprintf(prompt, "%s: ", s );
     fname = cpr_get("openfile.askoutname", prompt );
     cpr_kill_prompt();
-    m_free(prompt);
+    xfree (prompt);
     if( !*fname ) {
-	m_free( fname ); fname = NULL;
+	xfree ( fname ); fname = NULL;
 	fname = defname; defname = NULL;
     }
-    m_free(defname);
+    xfree (defname);
     if (fname)
         trim_spaces (fname);
     return fname;
@@ -163,21 +165,21 @@ ask_outfile_name( const char *name, size_t namelen )
 
 /****************
  * Make an output filename for the inputfile INAME.
- * Returns an IOBUF and an errorcode
+ * Returns an iobuf_t and an errorcode
  * Mode 0 = use ".gpg"
  *	1 = use ".asc"
  *	2 = use ".sig"
  */
 int
-open_outfile( const char *iname, int mode, IOBUF *a )
+open_outfile( const char *iname, int mode, iobuf_t *a )
 {
   int rc = 0;
 
   *a = NULL;
   if( (!iname || (*iname=='-' && !iname[1])) && !opt.outfile ) {
     if( !(*a = iobuf_create(NULL)) ) {
+      rc = gpg_error_from_errno (errno);
       log_error(_("%s: can't open: %s\n"), "[stdout]", strerror(errno) );
-      rc = G10ERR_CREATE_FILE;
     }
     else if( opt.verbose )
       log_info(_("writing to stdout\n"));
@@ -205,7 +207,7 @@ open_outfile( const char *iname, int mode, IOBUF *a )
           const char *newsfx = mode==1 ? ".asc" :
                                mode==2 ? ".sig" : ".gpg";
           
-          buf = m_alloc(strlen(iname)+4+1);
+          buf = xmalloc (strlen(iname)+4+1);
           strcpy(buf,iname);
           dot = strchr(buf, '.' );
           if ( dot && dot > buf && dot[1] && strlen(dot) <= 4
@@ -221,7 +223,7 @@ open_outfile( const char *iname, int mode, IOBUF *a )
       if (!buf)
 #endif /* USE_ONLY_8DOT3 */
         {
-          buf = m_alloc(strlen(iname)+4+1);
+          buf = xmalloc (strlen(iname)+4+1);
           strcpy(stpcpy(buf,iname), mode==1 ? EXTSEP_S "asc" :
 		                   mode==2 ? EXTSEP_S "sig" : EXTSEP_S "gpg");
         }
@@ -234,11 +236,11 @@ open_outfile( const char *iname, int mode, IOBUF *a )
         char *tmp = ask_outfile_name (NULL, 0);
         if ( !tmp || !*tmp )
           {
-            m_free (tmp);
-            rc = G10ERR_FILE_EXISTS;
+            xfree (tmp);
+            rc = GPG_ERR_EEXIST;
             break;
           }
-        m_free (buf);
+        xfree (buf);
         name = buf = tmp;
       }
     
@@ -246,13 +248,13 @@ open_outfile( const char *iname, int mode, IOBUF *a )
       {
         if( !(*a = iobuf_create( name )) )
           {
+            rc = gpg_error_from_errno (errno);
             log_error(_("%s: can't create: %s\n"), name, strerror(errno) );
-            rc = G10ERR_CREATE_FILE;
           }
         else if( opt.verbose )
           log_info(_("writing to `%s'\n"), name );
       }
-    m_free(buf);
+    xfree (buf);
   }
 
   return rc;
@@ -263,10 +265,10 @@ open_outfile( const char *iname, int mode, IOBUF *a )
  * Try to open a file without the extension ".sig" or ".asc"
  * Return NULL if such a file is not available.
  */
-IOBUF
+iobuf_t
 open_sigfile( const char *iname, progress_filter_context_t *pfx )
 {
-    IOBUF a = NULL;
+    iobuf_t a = NULL;
     size_t len;
 
     if( iname && !(*iname == '-' && !iname[1]) ) {
@@ -275,14 +277,14 @@ open_sigfile( const char *iname, progress_filter_context_t *pfx )
                         || ( len > 5 && !strcmp(iname + len - 5, EXTSEP_S "sign") )
                         || !strcmp(iname + len - 4, EXTSEP_S "asc")) ) {
 	    char *buf;
-	    buf = m_strdup(iname);
+	    buf = xstrdup (iname);
 	    buf[len-(buf[len-1]=='n'?5:4)] = 0 ;
 	    a = iobuf_open( buf );
 	    if( a && opt.verbose )
 		log_info(_("assuming signed data in `%s'\n"), buf );
 	    if (a && pfx)
 	      handle_progress (pfx, a, buf);
-            m_free(buf);
+            xfree (buf);
 	}
     }
     return a;
@@ -306,12 +308,12 @@ copy_options_file( const char *destdir )
     if( opt.dry_run )
 	return;
 
-    fname = m_alloc( strlen(datadir) + strlen(destdir) + 15 );
+    fname = xmalloc ( strlen(datadir) + strlen(destdir) + 15 );
     strcpy(stpcpy(fname, datadir), DIRSEP_S "options" SKELEXT );
     src = fopen( fname, "r" );
     if( !src ) {
 	log_error(_("%s: can't open: %s\n"), fname, strerror(errno) );
-	m_free(fname);
+	xfree (fname);
 	return;
     }
     strcpy(stpcpy(fname, destdir), DIRSEP_S "gpg" EXTSEP_S "conf" );
@@ -321,7 +323,7 @@ copy_options_file( const char *destdir )
     if( !dst ) {
 	log_error(_("%s: can't create: %s\n"), fname, strerror(errno) );
 	fclose( src );
-	m_free(fname);
+	xfree (fname);
 	return;
     }
 
@@ -351,7 +353,7 @@ copy_options_file( const char *destdir )
         log_info (_("WARNING: options in `%s'"
                     " are not yet active during this run\n"),
                   fname);
-    m_free(fname);
+    xfree (fname);
 }
 
 
diff --git a/g10/packet.h b/g10/packet.h
index c391c53a4..81851373d 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -1,6 +1,6 @@
 /* packet.h - packet definitions
- * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003
- *                                             Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002, 
+ *               2003  Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -22,9 +22,12 @@
 #ifndef G10_PACKET_H
 #define G10_PACKET_H
 
+#include "gpg.h"
+#include <gcrypt.h>
+
 #include "types.h"
-#include "iobuf.h"
-#include "mpi.h"
+#include "../common/iobuf.h"
+#include "../jnlib/strlist.h"
 #include "cipher.h"
 #include "filter.h"
 #include "global.h"
@@ -96,7 +99,7 @@ typedef struct {
     byte    version;
     byte    pubkey_algo;    /* algorithm used for public key scheme */
     byte    throw_keyid;
-    MPI     data[PUBKEY_MAX_NENC];
+    gcry_mpi_t     data[PUBKEY_MAX_NENC];
 } PKT_pubkey_enc;
 
 
@@ -149,7 +152,7 @@ typedef struct {
     subpktarea_t *hashed;    /* all subpackets with hashed  data (v4 only) */
     subpktarea_t *unhashed;  /* ditto for unhashed data */
     byte digest_start[2];   /* first 2 bytes of the digest */
-    MPI  data[PUBKEY_MAX_NSIG];
+    gcry_mpi_t  data[PUBKEY_MAX_NSIG];
 } PKT_signature;
 
 #define ATTRIB_IMAGE 1
@@ -221,7 +224,7 @@ typedef struct {
     byte    trust_depth;
     byte    trust_value;
     const byte *trust_regexp;
-    MPI     pkey[PUBKEY_MAX_NPKEY];
+    gcry_mpi_t     pkey[PUBKEY_MAX_NPKEY];
 } PKT_public_key;
 
 /* Evaluates as true if the pk is disabled, and false if it isn't.  If
@@ -255,7 +258,7 @@ typedef struct {
 	byte ivlen;  /* used length of the iv */
 	byte iv[16]; /* initialization vector for CFB mode */
     } protect;
-    MPI skey[PUBKEY_MAX_NSKEY];
+    gcry_mpi_t skey[PUBKEY_MAX_NSKEY];
     u16 csum;		/* checksum */
 } PKT_secret_key;
 
@@ -269,7 +272,7 @@ typedef struct {
     u32  len;		  /* reserved */
     byte  new_ctb;
     byte  algorithm;
-    IOBUF buf;		  /* IOBUF reference */
+    iobuf_t buf;		  /* iobuf_t reference */
 } PKT_compressed;
 
 typedef struct {
@@ -277,7 +280,7 @@ typedef struct {
     int  extralen;        /* this is (blocksize+2) */
     byte new_ctb;	  /* uses a new CTB */
     byte mdc_method;	  /* > 0: integrity protected encrypted data packet */
-    IOBUF buf;		  /* IOBUF reference */
+    iobuf_t buf;		  /* iobuf_t reference */
 } PKT_encrypted;
 
 typedef struct {
@@ -291,7 +294,7 @@ typedef struct {
 
 typedef struct {
     u32  len;		  /* length of encrypted data */
-    IOBUF buf;		  /* IOBUF reference */
+    iobuf_t buf;		  /* iobuf_t reference */
     byte new_ctb;
     byte is_partial;      /* partial length encoded */
     int mode;
@@ -365,25 +368,25 @@ typedef enum {
 
 
 /*-- mainproc.c --*/
-int proc_packets( void *ctx, IOBUF a );
-int proc_signature_packets( void *ctx, IOBUF a,
+int proc_packets( void *ctx, iobuf_t a );
+int proc_signature_packets( void *ctx, iobuf_t a,
 			    STRLIST signedfiles, const char *sigfile );
-int proc_encryption_packets( void *ctx, IOBUF a );
-int list_packets( IOBUF a );
+int proc_encryption_packets( void *ctx, iobuf_t a );
+int list_packets( iobuf_t a );
 
 /*-- parse-packet.c --*/
 int set_packet_list_mode( int mode );
 
 #if DEBUG_PARSE_PACKET
-int dbg_search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid,
+int dbg_search_packet( iobuf_t inp, PACKET *pkt, off_t *retpos, int with_uid,
                        const char* file, int lineno  );
-int dbg_parse_packet( IOBUF inp, PACKET *ret_pkt,
+int dbg_parse_packet( iobuf_t inp, PACKET *ret_pkt,
                       const char* file, int lineno );
-int dbg_copy_all_packets( IOBUF inp, IOBUF out,
+int dbg_copy_all_packets( iobuf_t inp, iobuf_t out,
                           const char* file, int lineno  );
-int dbg_copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff,
+int dbg_copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff,
                            const char* file, int lineno  );
-int dbg_skip_some_packets( IOBUF inp, unsigned n,
+int dbg_skip_some_packets( iobuf_t inp, unsigned n,
                            const char* file, int lineno	);
 #define search_packet( a,b,c,d )   \
              dbg_search_packet( (a), (b), (c), (d), __FILE__, __LINE__ )
@@ -396,11 +399,11 @@ int dbg_skip_some_packets( IOBUF inp, unsigned n,
 #define skip_some_packets( a,b ) \
              dbg_skip_some_packets((a),(b), __FILE__, __LINE__ )
 #else
-int search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid );
-int parse_packet( IOBUF inp, PACKET *ret_pkt);
-int copy_all_packets( IOBUF inp, IOBUF out );
-int copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff );
-int skip_some_packets( IOBUF inp, unsigned n );
+int search_packet( iobuf_t inp, PACKET *pkt, off_t *retpos, int with_uid );
+int parse_packet( iobuf_t inp, PACKET *ret_pkt);
+int copy_all_packets( iobuf_t inp, iobuf_t out );
+int copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff );
+int skip_some_packets( iobuf_t inp, unsigned n );
 #endif
 
 const byte *enum_sig_subpkt ( const subpktarea_t *subpkts,
@@ -421,7 +424,7 @@ PACKET *create_gpg_control ( ctrlpkttype_t type,
                              size_t datalen );
 
 /*-- build-packet.c --*/
-int build_packet( IOBUF inp, PACKET *pkt );
+int build_packet( iobuf_t inp, PACKET *pkt );
 u32 calc_packet_length( PACKET *pkt );
 void hash_public_key( MD_HANDLE md, PKT_public_key *pk );
 void build_sig_subpkt( PKT_signature *sig, sigsubpkttype_t type,
@@ -474,19 +477,19 @@ int get_override_session_key( DEK *dek, const char *string );
 
 /*-- compress.c --*/
 int handle_compressed( void *ctx, PKT_compressed *cd,
-		       int (*callback)(IOBUF, void *), void *passthru );
+		       int (*callback)(iobuf_t, void *), void *passthru );
 
 /*-- encr-data.c --*/
 int decrypt_data( void *ctx, PKT_encrypted *ed, DEK *dek );
 
 /*-- plaintext.c --*/
 int handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
-					int nooutput, int clearsig );
+                      int nooutput, int clearsig, int *create_failed );
 int ask_for_detached_datafile( MD_HANDLE md, MD_HANDLE md2,
 			       const char *inname, int textmode );
 
 /*-- comment.c --*/
-int write_comment( IOBUF out, const char *s );
+int write_comment( iobuf_t out, const char *s );
 
 /*-- sign.c --*/
 int make_keysig_packet( PKT_signature **ret_sig, PKT_public_key *pk,
diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index a881840b2..c1a716b1d 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -40,48 +40,48 @@
 static int mpi_print_mode = 0;
 static int list_mode = 0;
 
-static int  parse( IOBUF inp, PACKET *pkt, int onlykeypkts,
-                  off_t *retpos, int *skip, IOBUF out, int do_skip
+static int  parse( iobuf_t inp, PACKET *pkt, int onlykeypkts,
+                  off_t *retpos, int *skip, iobuf_t out, int do_skip
 #ifdef DEBUG_PARSE_PACKET
 		   ,const char *dbg_w, const char *dbg_f, int dbg_l
 #endif
 		 );
-static int  copy_packet( IOBUF inp, IOBUF out, int pkttype,
+static int  copy_packet( iobuf_t inp, iobuf_t out, int pkttype,
 					       unsigned long pktlen );
-static void skip_packet( IOBUF inp, int pkttype, unsigned long pktlen );
-static void skip_rest( IOBUF inp, unsigned long pktlen );
-static void *read_rest( IOBUF inp, size_t pktlen );
-static int  parse_symkeyenc( IOBUF inp, int pkttype, unsigned long pktlen,
+static void skip_packet( iobuf_t inp, int pkttype, unsigned long pktlen );
+static void skip_rest( iobuf_t inp, unsigned long pktlen );
+static void *read_rest( iobuf_t inp, size_t pktlen );
+static int  parse_symkeyenc( iobuf_t inp, int pkttype, unsigned long pktlen,
 							     PACKET *packet );
-static int  parse_pubkeyenc( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_pubkeyenc( iobuf_t inp, int pkttype, unsigned long pktlen,
 							     PACKET *packet );
-static int  parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_signature( iobuf_t inp, int pkttype, unsigned long pktlen,
 							 PKT_signature *sig );
-static int  parse_onepass_sig( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_onepass_sig( iobuf_t inp, int pkttype, unsigned long pktlen,
 							PKT_onepass_sig *ops );
-static int  parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_key( iobuf_t inp, int pkttype, unsigned long pktlen,
 				      byte *hdr, int hdrlen, PACKET *packet );
-static int  parse_user_id( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_user_id( iobuf_t inp, int pkttype, unsigned long pktlen,
 							   PACKET *packet );
-static int  parse_attribute( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_attribute( iobuf_t inp, int pkttype, unsigned long pktlen,
 							   PACKET *packet );
-static int  parse_comment( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_comment( iobuf_t inp, int pkttype, unsigned long pktlen,
 							   PACKET *packet );
-static void parse_trust( IOBUF inp, int pkttype, unsigned long pktlen,
+static void parse_trust( iobuf_t inp, int pkttype, unsigned long pktlen,
 							   PACKET *packet );
-static int  parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_plaintext( iobuf_t inp, int pkttype, unsigned long pktlen,
 					       PACKET *packet, int new_ctb);
-static int  parse_compressed( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_compressed( iobuf_t inp, int pkttype, unsigned long pktlen,
 					       PACKET *packet, int new_ctb );
-static int  parse_encrypted( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_encrypted( iobuf_t inp, int pkttype, unsigned long pktlen,
 					       PACKET *packet, int new_ctb);
-static int  parse_mdc( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_mdc( iobuf_t inp, int pkttype, unsigned long pktlen,
 					       PACKET *packet, int new_ctb);
-static int  parse_gpg_control( IOBUF inp, int pkttype, unsigned long pktlen,
+static int  parse_gpg_control( iobuf_t inp, int pkttype, unsigned long pktlen,
                                PACKET *packet );
 
 static unsigned short
-read_16(IOBUF inp)
+read_16(iobuf_t inp)
 {
     unsigned short a;
     a = iobuf_get_noeof(inp) << 8;
@@ -90,7 +90,7 @@ read_16(IOBUF inp)
 }
 
 static unsigned long
-read_32(IOBUF inp)
+read_32(iobuf_t inp)
 {
     unsigned long a;
     a =  iobuf_get_noeof(inp) << 24;
@@ -106,7 +106,7 @@ set_packet_list_mode( int mode )
 {
     int old = list_mode;
     list_mode = mode;
-    mpi_print_mode = DBG_MPI;
+    /* FIXME(gcrypt) mpi_print_mode = DBG_MPI; */
     return old;
 }
 
@@ -133,7 +133,7 @@ unknown_pubkey_warning( int algo )
  */
 #ifdef DEBUG_PARSE_PACKET
 int
-dbg_parse_packet( IOBUF inp, PACKET *pkt, const char *dbg_f, int dbg_l )
+dbg_parse_packet( iobuf_t inp, PACKET *pkt, const char *dbg_f, int dbg_l )
 {
     int skip, rc;
 
@@ -144,7 +144,7 @@ dbg_parse_packet( IOBUF inp, PACKET *pkt, const char *dbg_f, int dbg_l )
 }
 #else
 int
-parse_packet( IOBUF inp, PACKET *pkt )
+parse_packet( iobuf_t inp, PACKET *pkt )
 {
     int skip, rc;
 
@@ -160,7 +160,7 @@ parse_packet( IOBUF inp, PACKET *pkt )
  */
 #ifdef DEBUG_PARSE_PACKET
 int
-dbg_search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid,
+dbg_search_packet( iobuf_t inp, PACKET *pkt, off_t *retpos, int with_uid,
 		   const char *dbg_f, int dbg_l )
 {
     int skip, rc;
@@ -172,7 +172,7 @@ dbg_search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid,
 }
 #else
 int
-search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid )
+search_packet( iobuf_t inp, PACKET *pkt, off_t *retpos, int with_uid )
 {
     int skip, rc;
 
@@ -188,7 +188,7 @@ search_packet( IOBUF inp, PACKET *pkt, off_t *retpos, int with_uid )
  */
 #ifdef DEBUG_PARSE_PACKET
 int
-dbg_copy_all_packets( IOBUF inp, IOBUF out,
+dbg_copy_all_packets( iobuf_t inp, iobuf_t out,
 		   const char *dbg_f, int dbg_l )
 {
     PACKET pkt;
@@ -200,7 +200,7 @@ dbg_copy_all_packets( IOBUF inp, IOBUF out,
 }
 #else
 int
-copy_all_packets( IOBUF inp, IOBUF out )
+copy_all_packets( iobuf_t inp, iobuf_t out )
 {
     PACKET pkt;
     int skip, rc=0;
@@ -217,7 +217,7 @@ copy_all_packets( IOBUF inp, IOBUF out )
  */
 #ifdef DEBUG_PARSE_PACKET
 int
-dbg_copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff,
+dbg_copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff,
 		   const char *dbg_f, int dbg_l )
 {
     PACKET pkt;
@@ -232,7 +232,7 @@ dbg_copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff,
 }
 #else
 int
-copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff )
+copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff )
 {
     PACKET pkt;
     int skip, rc=0;
@@ -250,7 +250,7 @@ copy_some_packets( IOBUF inp, IOBUF out, off_t stopoff )
  */
 #ifdef DEBUG_PARSE_PACKET
 int
-dbg_skip_some_packets( IOBUF inp, unsigned n,
+dbg_skip_some_packets( iobuf_t inp, unsigned n,
 		   const char *dbg_f, int dbg_l )
 {
     int skip, rc=0;
@@ -264,7 +264,7 @@ dbg_skip_some_packets( IOBUF inp, unsigned n,
 }
 #else
 int
-skip_some_packets( IOBUF inp, unsigned n )
+skip_some_packets( iobuf_t inp, unsigned n )
 {
     int skip, rc=0;
     PACKET pkt;
@@ -286,8 +286,8 @@ skip_some_packets( IOBUF inp, unsigned n )
  * if OUT is not NULL, a special copymode is used.
  */
 static int
-parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
-       int *skip, IOBUF out, int do_skip
+parse( iobuf_t inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
+       int *skip, iobuf_t out, int do_skip
 #ifdef DEBUG_PARSE_PACKET
        ,const char *dbg_w, const char *dbg_f, int dbg_l
 #endif
@@ -313,7 +313,7 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
     hdr[hdrlen++] = ctb;
     if( !(ctb & 0x80) ) {
         log_error("%s: invalid packet (ctb=%02x)\n", iobuf_where(inp), ctb );
-	rc = G10ERR_INVALID_PACKET;
+	rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     pktlen = 0;
@@ -322,7 +322,7 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
         pkttype = ctb & 0x3f;
 	if( (c = iobuf_get(inp)) == -1 ) {
 	    log_error("%s: 1st length byte missing\n", iobuf_where(inp) );
-	    rc = G10ERR_INVALID_PACKET;
+	    rc = GPG_ERR_INV_PACKET;
 	    goto leave;
 	}
         if (pkttype == PKT_COMPRESSED) {
@@ -338,7 +338,7 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
                   if( (c = iobuf_get(inp)) == -1 ) {
                        log_error("%s: 2nd length byte missing\n",
                                  iobuf_where(inp) );
-                       rc = G10ERR_INVALID_PACKET;
+                       rc = GPG_ERR_INV_PACKET;
                        goto leave;
                   }
                   hdr[hdrlen++] = c;
@@ -351,7 +351,7 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
                   if( (c = iobuf_get(inp)) == -1 ) {
                        log_error("%s: 4 byte length invalid\n",
                                  iobuf_where(inp) );
-                       rc = G10ERR_INVALID_PACKET;
+                       rc = GPG_ERR_INV_PACKET;
                        goto leave;
                   }
                   pktlen |= (hdr[hdrlen++] = c );
@@ -387,9 +387,8 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
     }
 
     if( out && pkttype	) {
-	if( iobuf_write( out, hdr, hdrlen ) == -1 )
-	    rc = G10ERR_WRITE_FILE;
-	else
+        rc = iobuf_write( out, hdr, hdrlen );
+	if (!rc)
 	    rc = copy_packet(inp, out, pkttype, pktlen );
 	goto leave;
     }
@@ -419,16 +418,16 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
 #endif
     }
     pkt->pkttype = pkttype;
-    rc = G10ERR_UNKNOWN_PACKET; /* default error */
+    rc = GPG_ERR_UNKNOWN_PACKET; /* default error */
     switch( pkttype ) {
       case PKT_PUBLIC_KEY:
       case PKT_PUBLIC_SUBKEY:
-	pkt->pkt.public_key = m_alloc_clear(sizeof *pkt->pkt.public_key );
+	pkt->pkt.public_key = xcalloc (1,sizeof *pkt->pkt.public_key );
 	rc = parse_key(inp, pkttype, pktlen, hdr, hdrlen, pkt );
 	break;
       case PKT_SECRET_KEY:
       case PKT_SECRET_SUBKEY:
-	pkt->pkt.secret_key = m_alloc_clear(sizeof *pkt->pkt.secret_key );
+	pkt->pkt.secret_key = xcalloc (1,sizeof *pkt->pkt.secret_key );
 	rc = parse_key(inp, pkttype, pktlen, hdr, hdrlen, pkt );
 	break;
       case PKT_SYMKEY_ENC:
@@ -438,11 +437,11 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
 	rc = parse_pubkeyenc(inp, pkttype, pktlen, pkt );
 	break;
       case PKT_SIGNATURE:
-	pkt->pkt.signature = m_alloc_clear(sizeof *pkt->pkt.signature );
+	pkt->pkt.signature = xcalloc (1,sizeof *pkt->pkt.signature );
 	rc = parse_signature(inp, pkttype, pktlen, pkt->pkt.signature );
 	break;
       case PKT_ONEPASS_SIG:
-	pkt->pkt.onepass_sig = m_alloc_clear(sizeof *pkt->pkt.onepass_sig );
+	pkt->pkt.onepass_sig = xcalloc (1,sizeof *pkt->pkt.onepass_sig );
 	rc = parse_onepass_sig(inp, pkttype, pktlen, pkt->pkt.onepass_sig );
 	break;
       case PKT_USER_ID:
@@ -483,7 +482,7 @@ parse( IOBUF inp, PACKET *pkt, int onlykeypkts, off_t *retpos,
 
   leave:
     if( !rc && iobuf_error(inp) )
-	rc = G10ERR_INV_KEYRING;
+	rc = GPG_ERR_INV_KEYRING;
     return rc;
 }
 
@@ -505,31 +504,31 @@ dump_hex_line( int c, int *i )
 
 
 static int
-copy_packet( IOBUF inp, IOBUF out, int pkttype, unsigned long pktlen )
+copy_packet( iobuf_t inp, iobuf_t out, int pkttype, unsigned long pktlen )
 {
-    int n;
+    int rc, n;
     char buf[100];
 
     if( iobuf_in_block_mode(inp) ) {
 	while( (n = iobuf_read( inp, buf, 100 )) != -1 )
-	    if( iobuf_write(out, buf, n ) )
-		return G10ERR_WRITE_FILE; /* write error */
+	    if( (rc = iobuf_write(out, buf, n )) )
+		return rc; /* write error */
     }
     else if( !pktlen && pkttype == PKT_COMPRESSED ) {
 	log_debug("copy_packet: compressed!\n");
 	/* compressed packet, copy till EOF */
 	while( (n = iobuf_read( inp, buf, 100 )) != -1 )
-	    if( iobuf_write(out, buf, n ) )
-		return G10ERR_WRITE_FILE; /* write error */
+	    if( (rc = iobuf_write(out, buf, n )) )
+		return rc; /* write error */
     }
     else {
 	for( ; pktlen; pktlen -= n ) {
 	    n = pktlen > 100 ? 100 : pktlen;
 	    n = iobuf_read( inp, buf, n );
 	    if( n == -1 )
-		return G10ERR_READ_FILE;
-	    if( iobuf_write(out, buf, n ) )
-		return G10ERR_WRITE_FILE; /* write error */
+              return GPG_ERR_GENERAL; /* FIXME(gcrypt): read error*/;
+	    if( (rc = iobuf_write(out, buf, n )) )
+		return rc; /* write error */
 	}
     }
     return 0;
@@ -537,7 +536,7 @@ copy_packet( IOBUF inp, IOBUF out, int pkttype, unsigned long pktlen )
 
 
 static void
-skip_packet( IOBUF inp, int pkttype, unsigned long pktlen )
+skip_packet( iobuf_t inp, int pkttype, unsigned long pktlen )
 {
     if( list_mode ) {
 	if( pkttype == PKT_MARKER )
@@ -564,7 +563,7 @@ skip_packet( IOBUF inp, int pkttype, unsigned long pktlen )
 }
 
 static void
-skip_rest( IOBUF inp, unsigned long pktlen )
+skip_rest( iobuf_t inp, unsigned long pktlen )
 {
     if( iobuf_in_block_mode(inp) ) {
 	while( iobuf_get(inp) != -1 )
@@ -579,7 +578,7 @@ skip_rest( IOBUF inp, unsigned long pktlen )
 
 
 static void *
-read_rest( IOBUF inp, size_t pktlen )
+read_rest( iobuf_t inp, size_t pktlen )
 {
     byte *p;
     int i;
@@ -589,7 +588,7 @@ read_rest( IOBUF inp, size_t pktlen )
 	p = NULL;
     }
     else {
-	p = m_alloc( pktlen );
+	p = xmalloc ( pktlen );
 	for(i=0; pktlen; pktlen--, i++ )
 	    p[i] = iobuf_get(inp);
     }
@@ -599,7 +598,7 @@ read_rest( IOBUF inp, size_t pktlen )
 
 
 static int
-parse_symkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
+parse_symkeyenc( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *packet )
 {
     PKT_symkey_enc *k;
     int rc = 0;
@@ -607,18 +606,18 @@ parse_symkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
 
     if( pktlen < 4 ) {
 	log_error("packet(%d) too short\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     version = iobuf_get_noeof(inp); pktlen--;
     if( version != 4 ) {
 	log_error("packet(%d) with unknown version %d\n", pkttype, version);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     if( pktlen > 200 ) { /* (we encode the seskeylen in a byte) */
 	log_error("packet(%d) too large\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     cipher_algo = iobuf_get_noeof(inp); pktlen--;
@@ -640,11 +639,11 @@ parse_symkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
     }
     if( minlen > pktlen ) {
 	log_error("packet with S2K %d too short\n", s2kmode );
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     seskeylen = pktlen - minlen;
-    k = packet->pkt.symkey_enc = m_alloc_clear( sizeof *packet->pkt.symkey_enc
+    k = packet->pkt.symkey_enc = xcalloc (1, sizeof *packet->pkt.symkey_enc
 						+ seskeylen - 1 );
     k->version = version;
     k->cipher_algo = cipher_algo;
@@ -681,23 +680,23 @@ parse_symkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
 }
 
 static int
-parse_pubkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
+parse_pubkeyenc( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *packet )
 {
     unsigned int n;
     int rc = 0;
     int i, ndata;
     PKT_pubkey_enc *k;
 
-    k = packet->pkt.pubkey_enc = m_alloc_clear(sizeof *packet->pkt.pubkey_enc);
+    k = packet->pkt.pubkey_enc = xcalloc (1,sizeof *packet->pkt.pubkey_enc);
     if( pktlen < 12 ) {
 	log_error("packet(%d) too short\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     k->version = iobuf_get_noeof(inp); pktlen--;
     if( k->version != 2 && k->version != 3 ) {
 	log_error("packet(%d) with unknown version %d\n", pkttype, k->version);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     k->keyid[0] = read_32(inp); pktlen -= 4;
@@ -725,7 +724,7 @@ parse_pubkeyenc( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
 		putchar('\n');
 	    }
             if (!k->data[i])
-                rc = G10ERR_INVALID_PACKET;
+                rc = GPG_ERR_INV_PACKET;
 	}
     }
 
@@ -1151,7 +1150,7 @@ void parse_revkeys(PKT_signature *sig)
       if(len==sizeof(struct revocation_key) &&
 	 (revkey->class&0x80)) /* 0x80 bit must be set */
 	{
-	  sig->revkey=m_realloc(sig->revkey,
+	  sig->revkey=xrealloc(sig->revkey,
 			  sizeof(struct revocation_key *)*(sig->numrevkeys+1));
 	  sig->revkey[sig->numrevkeys]=revkey;
 	  sig->numrevkeys++;
@@ -1160,7 +1159,7 @@ void parse_revkeys(PKT_signature *sig)
 }
 
 static int
-parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_signature( iobuf_t inp, int pkttype, unsigned long pktlen,
 					  PKT_signature *sig )
 {
     int md5_len=0;
@@ -1178,7 +1177,7 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 	is_v4=1;
     else if( sig->version != 2 && sig->version != 3 ) {
 	log_error("packet(%d) with unknown version %d\n", pkttype, sig->version);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
 
@@ -1199,11 +1198,11 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 	n = read_16(inp); pktlen -= 2; /* length of hashed data */
 	if( n > 10000 ) {
 	    log_error("signature packet: hashed data too long\n");
-	    rc = G10ERR_INVALID_PACKET;
+	    rc = GPG_ERR_INV_PACKET;
 	    goto leave;
 	}
 	if( n ) {
-	    sig->hashed = m_alloc (sizeof (*sig->hashed) + n - 1 );
+	    sig->hashed = xmalloc (sizeof (*sig->hashed) + n - 1 );
             sig->hashed->size = n;
 	    sig->hashed->len = n;
 	    if( iobuf_read (inp, sig->hashed->data, n ) != n ) {
@@ -1217,14 +1216,14 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 	n = read_16(inp); pktlen -= 2; /* length of unhashed data */
 	if( n > 10000 ) {
 	    log_error("signature packet: unhashed data too long\n");
-	    rc = G10ERR_INVALID_PACKET;
+	    rc = GPG_ERR_INV_PACKET;
 	    goto leave;
 	}
 	if( n ) {
             /* we add 8 extra bytes so that we have space for the signature
              * status cache.  Well we are wasting this if there is a cache
              * packet already, but in the other case it avoids an realloc */
-	    sig->unhashed = m_alloc (sizeof(*sig->unhashed) + n + 8 - 1 );
+	    sig->unhashed = xmalloc (sizeof(*sig->unhashed) + n + 8 - 1 );
             sig->unhashed->size = n + 8;
 	    sig->unhashed->len = n;
 	    if( iobuf_read(inp, sig->unhashed->data, n ) != n ) {
@@ -1239,7 +1238,7 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 
     if( pktlen < 5 ) { /* sanity check */
 	log_error("packet(%d) too short\n", pkttype);
-	rc = G10ERR_INVALID_PACKET;
+	rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
 
@@ -1357,7 +1356,7 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 		putchar('\n');
 	    }
             if (!sig->data[i])
-                rc = G10ERR_INVALID_PACKET;
+                rc = GPG_ERR_INV_PACKET;
 	}
     }
 
@@ -1368,7 +1367,7 @@ parse_signature( IOBUF inp, int pkttype, unsigned long pktlen,
 
 
 static int
-parse_onepass_sig( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_onepass_sig( iobuf_t inp, int pkttype, unsigned long pktlen,
 					     PKT_onepass_sig *ops )
 {
     int version;
@@ -1376,13 +1375,13 @@ parse_onepass_sig( IOBUF inp, int pkttype, unsigned long pktlen,
 
     if( pktlen < 13 ) {
 	log_error("packet(%d) too short\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     version = iobuf_get_noeof(inp); pktlen--;
     if( version != 3 ) {
 	log_error("onepass_sig with unknown version %d\n", version);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     ops->sig_class = iobuf_get_noeof(inp); pktlen--;
@@ -1405,13 +1404,13 @@ parse_onepass_sig( IOBUF inp, int pkttype, unsigned long pktlen,
 }
 
 
-static MPI
-read_protected_v3_mpi (IOBUF inp, unsigned long *length)
+static gcry_mpi_t
+read_protected_v3_mpi (iobuf_t inp, unsigned long *length)
 {
   int c;
   unsigned int nbits, nbytes;
   unsigned char *buf, *p;
-  MPI val;
+  gcry_mpi_t val;
 
   if (*length < 2)
     {
@@ -1434,7 +1433,7 @@ read_protected_v3_mpi (IOBUF inp, unsigned long *length)
       return NULL;
     }
   nbytes = (nbits+7) / 8;
-  buf = p = m_alloc (2 + nbytes);
+  buf = p = xmalloc (2 + nbytes);
   *p++ = nbits >> 8;
   *p++ = nbits;
   for (; nbytes && length; nbytes--, --*length)
@@ -1442,18 +1441,18 @@ read_protected_v3_mpi (IOBUF inp, unsigned long *length)
   if (nbytes)
     {
       log_error ("packet shorter tham mpi\n");
-      m_free (buf);
+      xfree (buf);
       return NULL;
     }
 
-  /* convert buffer into an opaque MPI */
+  /* convert buffer into an opaque gcry_mpi_t */
   val = mpi_set_opaque (NULL, buf, p-buf); 
   return val;
 }
 
 
 static int
-parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_key( iobuf_t inp, int pkttype, unsigned long pktlen,
 			      byte *hdr, int hdrlen, PACKET *pkt )
 {
     int i, version, algorithm;
@@ -1486,13 +1485,13 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 	is_v4=1;
     else if( version != 2 && version != 3 ) {
 	log_error("packet(%d) with unknown version %d\n", pkttype, version);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
 
     if( pktlen < 11 ) {
 	log_error("packet(%d) too short\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
 
@@ -1579,7 +1578,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 		putchar('\n');
 	    }
             if (!sk->skey[i])
-                rc = G10ERR_INVALID_PACKET;
+                rc = GPG_ERR_INV_PACKET;
 	}
         if (rc) /* one of the MPIs were bad */
             goto leave;
@@ -1590,7 +1589,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 	    sk->protect.s2k.count = 0;
 	    if( sk->protect.algo == 254 || sk->protect.algo == 255 ) {
 		if( pktlen < 3 ) {
-		    rc = G10ERR_INVALID_PACKET;
+		    rc = GPG_ERR_INV_PACKET;
 		    goto leave;
 		}
                 sk->protect.sha1chk = (sk->protect.algo == 254);
@@ -1608,7 +1607,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 			if( list_mode )
 			    printf(  "\tunknown S2K %d\n",
 						sk->protect.s2k.mode );
-			rc = G10ERR_INVALID_PACKET;
+			rc = GPG_ERR_INV_PACKET;
 			goto leave;
 		    }
 		    /* here we know that it is a gnu extension
@@ -1640,7 +1639,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 			printf(  "\tunknown %sS2K %d\n",
 				 sk->protect.s2k.mode < 1000? "":"GNU ",
 						   sk->protect.s2k.mode );
-		    rc = G10ERR_INVALID_PACKET;
+		    rc = GPG_ERR_INV_PACKET;
 		    goto leave;
 		}
 
@@ -1661,7 +1660,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 
 		if( sk->protect.s2k.mode == 3 ) {
 		    if( pktlen < 1 ) {
-			rc = G10ERR_INVALID_PACKET;
+			rc = GPG_ERR_INV_PACKET;
 			goto leave;
 		    }
 		    sk->protect.s2k.count = iobuf_get(inp);
@@ -1701,7 +1700,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 		sk->protect.ivlen = 0;
 
 	    if( pktlen < sk->protect.ivlen ) {
-		rc = G10ERR_INVALID_PACKET;
+		rc = GPG_ERR_INV_PACKET;
 		goto leave;
 	    }
 	    for(i=0; i < sk->protect.ivlen && pktlen; i++, pktlen-- )
@@ -1722,7 +1721,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 	 * So we put the key into secure memory when we unprotect it. */
 	if( sk->protect.s2k.mode == 1001 ) {
 	    /* better set some dummy stuff here */
-	    sk->skey[npkey] = mpi_set_opaque(NULL, m_strdup("dummydata"), 10);
+	    sk->skey[npkey] = mpi_set_opaque(NULL, xstrdup ("dummydata"), 10);
 	    pktlen = 0;
 	}
 	else if( is_v4 && sk->is_protected ) {
@@ -1755,7 +1754,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
                 }
 
                 if (!sk->skey[i])
-                    rc = G10ERR_INVALID_PACKET;
+                    rc = GPG_ERR_INV_PACKET;
 	    }
             if (rc)
                 goto leave;
@@ -1784,7 +1783,7 @@ parse_key( IOBUF inp, int pkttype, unsigned long pktlen,
 		putchar('\n');
 	    }
             if (!pk->pkey[i])
-                rc = G10ERR_INVALID_PACKET;
+                rc = GPG_ERR_INV_PACKET;
 	}
         if (rc)
             goto leave;
@@ -1808,7 +1807,7 @@ parse_attribute_subpkts(PKT_user_id *uid)
   int buflen=uid->attrib_len;
   byte type;
 
-  m_free(uid->attribs);
+  xfree (uid->attribs);
 
   while(buflen)
     {
@@ -1831,7 +1830,7 @@ parse_attribute_subpkts(PKT_user_id *uid)
       if( buflen < n )
 	goto too_short;
 
-      attribs=m_realloc(attribs,(count+1)*sizeof(struct user_attribute));
+      attribs=xrealloc(attribs,(count+1)*sizeof(struct user_attribute));
       memset(&attribs[count],0,sizeof(struct user_attribute));
 
       type=*buffer;
@@ -1876,11 +1875,11 @@ static void setup_user_id(PACKET *packet)
 }
 
 static int
-parse_user_id( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
+parse_user_id( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *packet )
 {
     byte *p;
 
-    packet->pkt.user_id = m_alloc(sizeof *packet->pkt.user_id  + pktlen);
+    packet->pkt.user_id = xmalloc (sizeof *packet->pkt.user_id  + pktlen);
     packet->pkt.user_id->len = pktlen;
 
     setup_user_id(packet);
@@ -1939,17 +1938,17 @@ make_attribute_uidname(PKT_user_id *uid, size_t max_namelen)
 }
 
 static int
-parse_attribute( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
+parse_attribute( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *packet )
 {
     byte *p;
 
 #define EXTRA_UID_NAME_SPACE 71
-    packet->pkt.user_id = m_alloc(sizeof *packet->pkt.user_id
+    packet->pkt.user_id = xmalloc (sizeof *packet->pkt.user_id
                                   + EXTRA_UID_NAME_SPACE);
 
     setup_user_id(packet);
 
-    packet->pkt.user_id->attrib_data = m_alloc(pktlen);
+    packet->pkt.user_id->attrib_data = xmalloc (pktlen);
     packet->pkt.user_id->attrib_len = pktlen;
     p = packet->pkt.user_id->attrib_data;
     for( ; pktlen; pktlen--, p++ )
@@ -1970,11 +1969,11 @@ parse_attribute( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
 
 
 static int
-parse_comment( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
+parse_comment( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *packet )
 {
     byte *p;
 
-    packet->pkt.comment = m_alloc(sizeof *packet->pkt.comment + pktlen - 1);
+    packet->pkt.comment = xmalloc (sizeof *packet->pkt.comment + pktlen - 1);
     packet->pkt.comment->len = pktlen;
     p = packet->pkt.comment->data;
     for( ; pktlen; pktlen--, p++ )
@@ -1997,7 +1996,7 @@ parse_comment( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *packet )
 
 
 static void
-parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
+parse_trust( iobuf_t inp, int pkttype, unsigned long pktlen, PACKET *pkt )
 {
   int c;
 
@@ -2005,7 +2004,7 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
     {
       c = iobuf_get_noeof(inp);
       pktlen--;
-      pkt->pkt.ring_trust = m_alloc( sizeof *pkt->pkt.ring_trust );
+      pkt->pkt.ring_trust = xmalloc ( sizeof *pkt->pkt.ring_trust );
       pkt->pkt.ring_trust->trustval = c;
       pkt->pkt.ring_trust->sigcache = 0;
       if (!c && pktlen==1)
@@ -2031,7 +2030,7 @@ parse_trust( IOBUF inp, int pkttype, unsigned long pktlen, PACKET *pkt )
 
 
 static int
-parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_plaintext( iobuf_t inp, int pkttype, unsigned long pktlen,
 					PACKET *pkt, int new_ctb )
 {
     int rc = 0;
@@ -2042,7 +2041,7 @@ parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen,
 
     if( pktlen && pktlen < 6 ) {
 	log_error("packet(%d) too short (%lu)\n", pkttype, (ulong)pktlen);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     /* A packet length of zero indicates partial body length.  A zero
@@ -2052,7 +2051,7 @@ parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen,
       partial=1;
     mode = iobuf_get_noeof(inp); if( pktlen ) pktlen--;
     namelen = iobuf_get_noeof(inp); if( pktlen ) pktlen--;
-    pt = pkt->pkt.plaintext = m_alloc(sizeof *pkt->pkt.plaintext + namelen -1);
+    pt = pkt->pkt.plaintext = xmalloc (sizeof *pkt->pkt.plaintext + namelen -1);
     pt->new_ctb = new_ctb;
     pt->mode = mode;
     pt->namelen = namelen;
@@ -2093,7 +2092,7 @@ parse_plaintext( IOBUF inp, int pkttype, unsigned long pktlen,
 
 
 static int
-parse_compressed( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_compressed( iobuf_t inp, int pkttype, unsigned long pktlen,
 		  PACKET *pkt, int new_ctb )
 {
     PKT_compressed *zd;
@@ -2102,7 +2101,7 @@ parse_compressed( IOBUF inp, int pkttype, unsigned long pktlen,
      * (this should be the last object in a file or
      *	the compress algorithm should know the length)
      */
-    zd = pkt->pkt.compressed =	m_alloc(sizeof *pkt->pkt.compressed );
+    zd = pkt->pkt.compressed =	xmalloc (sizeof *pkt->pkt.compressed );
     zd->algorithm = iobuf_get_noeof(inp);
     zd->len = 0; /* not used */ 
     zd->new_ctb = new_ctb;
@@ -2114,14 +2113,14 @@ parse_compressed( IOBUF inp, int pkttype, unsigned long pktlen,
 
 
 static int
-parse_encrypted( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_encrypted( iobuf_t inp, int pkttype, unsigned long pktlen,
 				       PACKET *pkt, int new_ctb )
 {
     int rc = 0;
     PKT_encrypted *ed;
     unsigned long orig_pktlen = pktlen;
 
-    ed = pkt->pkt.encrypted =  m_alloc(sizeof *pkt->pkt.encrypted );
+    ed = pkt->pkt.encrypted =  xmalloc (sizeof *pkt->pkt.encrypted );
     ed->len = pktlen;
     /* we don't know the extralen which is (cipher_blocksize+2)
        because the algorithm ist not specified in this packet.
@@ -2143,14 +2142,14 @@ parse_encrypted( IOBUF inp, int pkttype, unsigned long pktlen,
 	    log_error("encrypted_mdc packet with unknown version %d\n",
 								version);
             /*skip_rest(inp, pktlen); should we really do this? */
-            rc = G10ERR_INVALID_PACKET;
+            rc = GPG_ERR_INV_PACKET;
 	    goto leave;
 	}
 	ed->mdc_method = DIGEST_ALGO_SHA1;
     }
     if( orig_pktlen && pktlen < 10 ) { /* actually this is blocksize+2 */
 	log_error("packet(%d) too short\n", pkttype);
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	skip_rest(inp, pktlen);
 	goto leave;
     }
@@ -2172,19 +2171,19 @@ parse_encrypted( IOBUF inp, int pkttype, unsigned long pktlen,
 
 
 static int
-parse_mdc( IOBUF inp, int pkttype, unsigned long pktlen,
+parse_mdc( iobuf_t inp, int pkttype, unsigned long pktlen,
 				   PACKET *pkt, int new_ctb )
 {
     int rc = 0;
     PKT_mdc *mdc;
     byte *p;
 
-    mdc = pkt->pkt.mdc=  m_alloc(sizeof *pkt->pkt.mdc );
+    mdc = pkt->pkt.mdc=  xmalloc (sizeof *pkt->pkt.mdc );
     if( list_mode )
 	printf(":mdc packet: length=%lu\n", pktlen);
     if( !new_ctb || pktlen != 20 ) {
 	log_error("mdc_packet with invalid encoding\n");
-        rc = G10ERR_INVALID_PACKET;
+        rc = GPG_ERR_INV_PACKET;
 	goto leave;
     }
     p = mdc->hash;
@@ -2208,7 +2207,7 @@ parse_mdc( IOBUF inp, int pkttype, unsigned long pktlen,
  */
 
 static int
-parse_gpg_control( IOBUF inp,
+parse_gpg_control( iobuf_t inp,
                    int pkttype, unsigned long pktlen, PACKET *packet )
 {
     byte *p;
@@ -2229,7 +2228,7 @@ parse_gpg_control( IOBUF inp,
     if ( list_mode )
         puts ("- gpg control packet");
 
-    packet->pkt.gpg_control = m_alloc(sizeof *packet->pkt.gpg_control
+    packet->pkt.gpg_control = xmalloc (sizeof *packet->pkt.gpg_control
                                       + pktlen - 1);
     packet->pkt.gpg_control->control = iobuf_get_noeof(inp); pktlen--;
     packet->pkt.gpg_control->datalen = pktlen;
@@ -2256,7 +2255,7 @@ parse_gpg_control( IOBUF inp,
         putchar('\n');
     }
     skip_rest(inp,pktlen);
-    return G10ERR_INVALID_PACKET;
+    return GPG_ERR_INV_PACKET;
 }
 
 /* create a gpg control packet to be used internally as a placeholder */
@@ -2266,10 +2265,10 @@ create_gpg_control( ctrlpkttype_t type, const byte *data, size_t datalen )
     PACKET *packet;
     byte *p;
 
-    packet = m_alloc( sizeof *packet );
+    packet = xmalloc ( sizeof *packet );
     init_packet(packet);
     packet->pkttype = PKT_GPG_CONTROL;
-    packet->pkt.gpg_control = m_alloc(sizeof *packet->pkt.gpg_control
+    packet->pkt.gpg_control = xmalloc (sizeof *packet->pkt.gpg_control
                                       + datalen - 1);
     packet->pkt.gpg_control->control = type;
     packet->pkt.gpg_control->datalen = datalen;
diff --git a/g10/passphrase.c b/g10/passphrase.c
index 769276221..41cd31f91 100644
--- a/g10/passphrase.c
+++ b/g10/passphrase.c
@@ -40,6 +40,7 @@
 #include <langinfo.h>
 #endif
 
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "options.h"
@@ -122,10 +123,10 @@ have_static_passphrase()
 void
 set_next_passphrase( const char *s )
 {
-    m_free(next_pw);
+    xfree (next_pw);
     next_pw = NULL;
     if( s ) {
-	next_pw = m_alloc_secure( strlen(s)+1 );
+	next_pw = gcry_xmalloc_secure ( strlen(s)+1 );
 	strcpy(next_pw, s );
     }
 }
@@ -170,7 +171,7 @@ read_passphrase_from_fd( int fd )
         {
           char *pw2 = pw;
           len += 100;
-          pw = m_alloc_secure( len );
+          pw = gcry_xmalloc_secure ( len );
           if( pw2 )
             memcpy(pw, pw2, i );
           else
@@ -183,7 +184,7 @@ read_passphrase_from_fd( int fd )
   if (!opt.batch)
     tty_printf("\b\b\b   \n" );
 
-  m_free( fd_passwd );
+  xfree ( fd_passwd );
   fd_passwd = pw;
 }
 
@@ -337,11 +338,11 @@ agent_send_option (int fd, const char *name, const char *value)
   char *line;
   int i; 
   
-  line = m_alloc (7 + strlen (name) + 1 + strlen (value) + 2);
+  line = xmalloc (7 + strlen (name) + 1 + strlen (value) + 2);
   strcpy (stpcpy (stpcpy (stpcpy (
                      stpcpy (line, "OPTION "), name), "="), value), "\n");
   i = writen (fd, line, strlen (line));
-  m_free (line);
+  xfree (line);
   if (i)
     return -1;
   
@@ -394,7 +395,7 @@ agent_send_all_options (int fd)
 #if defined(HAVE_SETLOCALE) && defined(LC_CTYPE)
   old_lc = setlocale (LC_CTYPE, NULL);
   if (old_lc)
-    old_lc = m_strdup (old_lc);
+    old_lc = xstrdup (old_lc);
   dft_lc = setlocale (LC_CTYPE, "");
 #endif
   if (opt.lc_ctype || (dft_ttyname && dft_lc))
@@ -406,7 +407,7 @@ agent_send_all_options (int fd)
   if (old_lc)
     {
       setlocale (LC_CTYPE, old_lc);
-      m_free (old_lc);
+      xfree (old_lc);
     }
 #endif
   if (rc)
@@ -415,7 +416,7 @@ agent_send_all_options (int fd)
 #if defined(HAVE_SETLOCALE) && defined(LC_MESSAGES)
   old_lc = setlocale (LC_MESSAGES, NULL);
   if (old_lc)
-    old_lc = m_strdup (old_lc);
+    old_lc = xstrdup (old_lc);
   dft_lc = setlocale (LC_MESSAGES, "");
 #endif
   if (opt.lc_messages || (dft_ttyname && dft_lc))
@@ -427,7 +428,7 @@ agent_send_all_options (int fd)
   if (old_lc)
     {
       setlocale (LC_MESSAGES, old_lc);
-      m_free (old_lc);
+      xfree (old_lc);
     }
 #endif
   return rc;
@@ -495,7 +496,7 @@ agent_open (int *ret_prot)
     int prot;
 
     if (opt.gpg_agent_info)
-      infostr = m_strdup (opt.gpg_agent_info);
+      infostr = xstrdup (opt.gpg_agent_info);
     else
       {
         infostr = getenv ( "GPG_AGENT_INFO" );
@@ -504,13 +505,13 @@ agent_open (int *ret_prot)
           opt.use_agent = 0;
           return -1;
         }
-        infostr = m_strdup ( infostr );
+        infostr = xstrdup ( infostr );
       }
 
     if ( !(p = strchr ( infostr, ':')) || p == infostr
          || (p-infostr)+1 >= sizeof client_addr.sun_path ) {
         log_error( _("malformed GPG_AGENT_INFO environment variable\n"));
-        m_free (infostr );
+        xfree (infostr );
         opt.use_agent = 0;
         return -1;
     }
@@ -523,7 +524,7 @@ agent_open (int *ret_prot)
     prot = *p? atoi (p+1) : 0;
     if ( prot < 0 || prot > 1) {
         log_error (_("gpg-agent protocol version %d is not supported\n"),prot);
-        m_free (infostr );
+        xfree (infostr );
         opt.use_agent = 0;
         return -1;
     }
@@ -531,7 +532,7 @@ agent_open (int *ret_prot)
        
     if( (fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1 ) {
         log_error ("can't create socket: %s\n", strerror(errno) );
-        m_free (infostr );
+        xfree (infostr );
         opt.use_agent = 0;
         return -1;
     }
@@ -545,12 +546,12 @@ agent_open (int *ret_prot)
     if( connect( fd, (struct sockaddr*)&client_addr, len ) == -1 ) {
         log_error ( _("can't connect to `%s': %s\n"), 
                     infostr, strerror (errno) );
-        m_free (infostr );
+        xfree (infostr );
         close (fd );
         opt.use_agent = 0;
         return -1;
     }
-    m_free (infostr);
+    xfree (infostr);
 
     if (!prot) {
         if ( writen ( fd, "GPGA\0\0\0\x01", 8 ) ) {
@@ -623,7 +624,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
   int nread;
   u32 reply;
   char *pw = NULL;
-  PKT_public_key *pk = m_alloc_clear( sizeof *pk );
+  PKT_public_key *pk = xcalloc (1, sizeof *pk );
   byte fpr[MAX_FINGERPRINT_LEN];
   int have_fpr = 0;
   int prot;
@@ -652,7 +653,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
 #endif
   if (orig_codeset)
     { /* We only switch when we are able to restore the codeset later. */
-      orig_codeset = m_strdup (orig_codeset);
+      orig_codeset = xstrdup (orig_codeset);
       if (!bind_textdomain_codeset (PACKAGE, "utf-8"))
         orig_codeset = NULL; 
     }
@@ -665,7 +666,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
     { 
       char *uid;
       size_t uidlen;
-      const char *algo_name = pubkey_algo_to_string ( pk->pubkey_algo );
+      const char *algo_name = gcry_pk_algo_name ( pk->pubkey_algo );
       const char *timestr;
       char *maink;
       const char *fmtstr;
@@ -674,7 +675,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
         algo_name = "?";
       
       fmtstr = _(" (main key ID %08lX)");
-      maink = m_alloc ( strlen (fmtstr) + 20 );
+      maink = xmalloc ( strlen (fmtstr) + 20 );
       if( keyid[2] && keyid[3] && keyid[0] != keyid[2] 
           && keyid[1] != keyid[3] )
         sprintf( maink, fmtstr, (ulong)keyid[3] );
@@ -687,15 +688,15 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
                  " secret key for user:\n"
                  "\"%.*s\"\n"
                  "%u-bit %s key, ID %08lX, created %s%s\n" );
-      atext = m_alloc ( 100 + strlen (fmtstr)  
+      atext = xmalloc ( 100 + strlen (fmtstr)  
                         + uidlen + 15 + strlen(algo_name) + 8
                         + strlen (timestr) + strlen (maink) );
       sprintf (atext, fmtstr,
                uidlen, uid,
                nbits_from_pk (pk), algo_name, (ulong)keyid[1], timestr,
                maink  );
-      m_free (uid);
-      m_free (maink);
+      xfree (uid);
+      xfree (maink);
       
       { 
         size_t dummy;
@@ -705,9 +706,9 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
       
     }
   else if (mode == 2 ) 
-    atext = m_strdup ( _("Repeat passphrase\n") );
+    atext = xstrdup ( _("Repeat passphrase\n") );
   else
-    atext = m_strdup ( _("Enter passphrase\n") );
+    atext = xstrdup ( _("Enter passphrase\n") );
                 
   if (!prot)
     { /* old style protocol */
@@ -717,7 +718,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
       memcpy (buf+8, fpr, 20 );
       if ( writen ( fd, buf, 28 ) || writen ( fd, atext, strlen (atext) ) ) 
         goto failure;
-      m_free (atext); atext = NULL;
+      xfree (atext); atext = NULL;
       
       /* get response */
       if ( readn ( fd, buf, 12, &nread ) ) 
@@ -753,7 +754,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
            * on how long the passhrase actually is - this wastes some bytes
            * but because we already have this padding we should not loosen
            * this by issuing 2 read calls */
-          pw = m_alloc_secure ( n+1 );
+          pw = xmalloc_secure ( n+1 );
           if ( readn ( fd, pw, n, &nn ) )
             goto failure;
           if ( n != nn ) 
@@ -768,7 +769,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
           if (orig_codeset)
             bind_textdomain_codeset (PACKAGE, orig_codeset);
 #endif
-          m_free (orig_codeset);
+          xfree (orig_codeset);
           return pw;
         }
       else if ( reply == GPGA_PROT_CANCELED ) 
@@ -794,7 +795,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
 
       /* We allocate 2 time the needed space for atext so that there
          is nenough space for escaping */
-      line = m_alloc (15 + 46 
+      line = xmalloc (15 + 46 
                       +  3*strlen (tryagain_text) + 3*strlen (atext) + 2);
       strcpy (line, "GET_PASSPHRASE ");
       p = line+15;
@@ -836,13 +837,13 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
         }
       *p++ = '\n';
       i = writen (fd, line, p - line);
-      m_free (line);
+      xfree (line);
       if (i)
         goto failure;
-      m_free (atext); atext = NULL;
+      xfree (atext); atext = NULL;
       
       /* get response */
-      pw = m_alloc_secure (500);
+      pw = xmalloc_secure (500);
       nread = readline (fd, pw, 499);
       if (nread < 3)
         goto failure;
@@ -860,7 +861,7 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
           if (orig_codeset)
             bind_textdomain_codeset (PACKAGE, orig_codeset);
 #endif
-          m_free (orig_codeset);
+          xfree (orig_codeset);
           return pw;
         }
       else if (nread > 7 && !memcmp (pw, "ERR 111", 7)
@@ -883,10 +884,10 @@ agent_get_passphrase ( u32 *keyid, int mode, const char *tryagain_text,
   if (orig_codeset)
     bind_textdomain_codeset (PACKAGE, orig_codeset);
 #endif
-  m_free (atext);
+  xfree (atext);
   if ( fd != -1 )
     agent_close (fd);
-  m_free (pw );
+  xfree (pw );
   free_public_key( pk );
   
   return NULL;
@@ -918,7 +919,7 @@ passphrase_clear_cache ( u32 *keyid, int algo )
   if (!opt.use_agent)
     return;
   
-  pk = m_alloc_clear ( sizeof *pk );
+  pk = xcalloc (1, sizeof *pk );
   memset (fpr, 0, MAX_FINGERPRINT_LEN );
   if( !keyid || get_pubkey( pk, keyid ) )
     {
@@ -964,14 +965,14 @@ passphrase_clear_cache ( u32 *keyid, int algo )
       char *line, *p;
       int i; 
 
-      line = m_alloc (17 + 40 + 2);
+      line = xmalloc (17 + 40 + 2);
       strcpy (line, "CLEAR_PASSPHRASE ");
       p = line+17;
       for (i=0; i < 20; i++, p +=2 )
         sprintf (p, "%02X", fpr[i]);
       *p++ = '\n';
       i = writen (fd, line, p - line);
-      m_free (line);
+      xfree (line);
       if (i)
         goto failure;
       
@@ -1054,7 +1055,7 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
 
             us = get_long_user_id_string( keyid );
             write_status_text( STATUS_USERID_HINT, us );
-            m_free(us);
+            xfree (us);
 
 	    sprintf( buf, "%08lX%08lX %08lX%08lX %d 0",
                      (ulong)keyid[0], (ulong)keyid[1],
@@ -1070,7 +1071,7 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
     }
 
     if( keyid && !opt.batch && !next_pw && mode!=1 ) {
-	PKT_public_key *pk = m_alloc_clear( sizeof *pk );
+	PKT_public_key *pk = xcalloc (1, sizeof *pk );
 	size_t n;
 	char *p;
 
@@ -1078,11 +1079,11 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
 		     "user: \"") );
 	p = get_user_id( keyid, &n );
 	tty_print_utf8_string( p, n );
-	m_free(p);
+	xfree (p);
 	tty_printf("\"\n");
 
 	if( !get_pubkey( pk, keyid ) ) {
-	    const char *s = pubkey_algo_to_string( pk->pubkey_algo );
+	    const char *s = gcry_pk_algo_name ( pk->pubkey_algo );
 	    tty_printf( _("%u-bit %s key, ID %08lX, created %s"),
 		       nbits_from_pk( pk ), s?s:"?", (ulong)keyid[1],
 		       strtimestamp(pk->timestamp) );
@@ -1108,7 +1109,7 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
           {
             if (!opt.use_agent)
               goto agent_died;
-            pw = m_strdup ("");
+            pw = xstrdup ("");
           }
         if( *pw && mode == 2 ) {
 	    char *pw2 = agent_get_passphrase ( keyid, 2, NULL, canceled );
@@ -1116,27 +1117,27 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
               {
                 if (!opt.use_agent)
                   {
-                    m_free (pw);
+                    xfree (pw);
                     pw = NULL;
                     goto agent_died;
                   }
-                pw2 = m_strdup ("");
+                pw2 = xstrdup ("");
               }
 	    if( strcmp(pw, pw2) ) {
-		m_free(pw2);
-		m_free(pw);
+		xfree (pw2);
+		xfree (pw);
 		return NULL;
 	    }
-	    m_free(pw2);
+	    xfree (pw2);
 	}
     }
     else if( fd_passwd ) {
-	pw = m_alloc_secure( strlen(fd_passwd)+1 );
+	pw = xmalloc_secure ( strlen(fd_passwd)+1 );
 	strcpy( pw, fd_passwd );
     }
     else if( opt.batch ) {
 	log_error(_("can't query password in batchmode\n"));
-	pw = m_strdup( "" ); /* return an empty passphrase */
+	pw = xstrdup ( "" ); /* return an empty passphrase */
     }
     else {
 	pw = cpr_get_hidden("passphrase.enter", _("Enter passphrase: ") );
@@ -1146,24 +1147,24 @@ passphrase_to_dek( u32 *keyid, int pubkey_algo,
 				       _("Repeat passphrase: ") );
 	    tty_kill_prompt();
 	    if( strcmp(pw, pw2) ) {
-		m_free(pw2);
-		m_free(pw);
+		xfree (pw2);
+		xfree (pw);
 		return NULL;
 	    }
-	    m_free(pw2);
+	    xfree (pw2);
 	}
     }
 
     if( !pw || !*pw )
 	write_status( STATUS_MISSING_PASSPHRASE );
 
-    dek = m_alloc_secure_clear ( sizeof *dek );
+    dek = xcalloc_secure (1, sizeof *dek );
     dek->algo = cipher_algo;
     if( !*pw && mode == 2 )
 	dek->keylen = 0;
     else
 	hash_passphrase( dek, pw, s2k, mode==2 );
-    m_free(last_pw);
+    xfree (last_pw);
     last_pw = pw;
     return dek;
 }
@@ -1183,16 +1184,16 @@ hash_passphrase( DEK *dek, char *pw, STRING2KEY *s2k, int create )
     int pwlen = strlen(pw);
 
     assert( s2k->hash_algo );
-    dek->keylen = cipher_get_keylen( dek->algo ) / 8;
+    dek->keylen = gcry_cipher_get_algo_keylen (dek->algo);
     if( !(dek->keylen > 0 && dek->keylen <= DIM(dek->key)) )
 	BUG();
 
-    md = md_open( s2k->hash_algo, 1);
+    gcry_md_open (&md, s2k->hash_algo, 1);
     for(pass=0; used < dek->keylen ; pass++ ) {
 	if( pass ) {
-            md_reset(md);
+            gcry_md_reset(md);
 	    for(i=0; i < pass; i++ ) /* preset the hash context */
-		md_putc(md, 0 );
+		gcry_md_putc (md, 0 );
 	}
 
 	if( s2k->mode == 1 || s2k->mode == 3 ) {
@@ -1200,7 +1201,7 @@ hash_passphrase( DEK *dek, char *pw, STRING2KEY *s2k, int create )
 	    ulong count = len2;
 
 	    if( create && !pass ) {
-		randomize_buffer(s2k->salt, 8, 1);
+		gcry_randomize(s2k->salt, 8, GCRY_STRONG_RANDOM );
 		if( s2k->mode == 3 )
 		    s2k->count = 96; /* 65536 iterations */
 	    }
@@ -1212,27 +1213,27 @@ hash_passphrase( DEK *dek, char *pw, STRING2KEY *s2k, int create )
 	    }
 	    /* a little bit complicated because we need a ulong for count */
 	    while( count > len2 ) { /* maybe iterated+salted */
-		md_write( md, s2k->salt, 8 );
-		md_write( md, pw, pwlen );
+		gcry_md_write( md, s2k->salt, 8 );
+		gcry_md_write( md, pw, pwlen );
 		count -= len2;
 	    }
 	    if( count < 8 )
-		md_write( md, s2k->salt, count );
+		gcry_md_write( md, s2k->salt, count );
 	    else {
-		md_write( md, s2k->salt, 8 );
+		gcry_md_write( md, s2k->salt, 8 );
 		count -= 8;
-                md_write( md, pw, count );
+                gcry_md_write( md, pw, count );
 	    }
 	}
 	else
-	    md_write( md, pw, pwlen );
-	md_final( md );
-	i = md_digest_length( s2k->hash_algo );
+	    gcry_md_write( md, pw, pwlen );
+	gcry_md_final ( md );
+	i = gcry_md_get_algo_dlen (s2k->hash_algo);
 	if( i > dek->keylen - used )
 	    i = dek->keylen - used;
-	memcpy( dek->key+used, md_read(md, s2k->hash_algo), i );
+	memcpy( dek->key+used, gcry_md_read (md, s2k->hash_algo), i );
 	used += i;
     }
-    md_close(md);
+    gcry_md_close (md);
 }
 
diff --git a/g10/photoid.c b/g10/photoid.c
index b311bfa09..1dd6edeca 100644
--- a/g10/photoid.c
+++ b/g10/photoid.c
@@ -49,7 +49,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
   char *filename=NULL;
   byte *photo=NULL;
   byte header[16];
-  IOBUF file;
+  iobuf_t file;
 
   header[0]=0x10; /* little side of photo header length */
   header[1]=0;    /* big side of photo header length */
@@ -60,7 +60,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
     header[i]=0;
 
 #define EXTRA_UID_NAME_SPACE 71
-  uid=m_alloc_clear(sizeof(*uid)+71);
+  uid=xcalloc (1,sizeof(*uid)+71);
 
   printf(_("\nPick an image to use for your photo ID.  "
 	   "The image must be a JPEG file.\n"
@@ -73,7 +73,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
     {
       printf("\n");
 
-      m_free(filename);
+      xfree (filename);
 
       filename=cpr_get("photoid.jpeg.add",
 		       _("Enter JPEG filename for photo ID: "));
@@ -101,7 +101,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
 	  }
 	}
 
-      photo=m_alloc(len);
+      photo=xmalloc (len);
       iobuf_read(file,photo,len);
       iobuf_close(file);
 
@@ -110,7 +110,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
 	 photo[6]!='J' || photo[7]!='F' || photo[8]!='I' || photo[9]!='F')
 	{
 	  log_error(_("\"%s\" is not a JPEG file\n"),filename);
-	  m_free(photo);
+	  xfree (photo);
 	  photo=NULL;
 	  continue;
 	}
@@ -132,7 +132,7 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
 	      goto scram;
 	    case 0:
 	      free_attributes(uid);
-	      m_free(photo);
+	      xfree (photo);
 	      photo=NULL;
 	      continue;
 	    }
@@ -143,13 +143,13 @@ PKT_user_id *generate_photo_id(PKT_public_key *pk)
   uid->ref=1;
 
  scram:
-  m_free(filename);
-  m_free(photo);
+  xfree (filename);
+  xfree (photo);
 
   if(error)
     {
       free_attributes(uid);
-      m_free(uid);
+      xfree (uid);
       return NULL;
     }
 
@@ -283,7 +283,7 @@ void show_photos(const struct user_attribute *attrs,
 	if(!command)
 	  goto fail;
 
-	name=m_alloc(16+strlen(EXTSEP_S)+
+	name=xmalloc (16+strlen(EXTSEP_S)+
 		     strlen(image_type_to_string(args.imagetype,0))+1);
 
 	/* Make the filename.  Notice we are not using the image
@@ -302,7 +302,7 @@ void show_photos(const struct user_attribute *attrs,
 
 	if(exec_write(&spawn,NULL,command,name,1,1)!=0)
 	  {
-	    m_free(name);
+	    xfree (name);
 	    goto fail;
 	  }
 
@@ -311,7 +311,7 @@ void show_photos(const struct user_attribute *attrs,
                                         image_type_to_string(args.imagetype,2));
 #endif
 
-	m_free(name);
+	xfree (name);
 
 	fwrite(&attrs[i].data[offset],attrs[i].len-offset,1,spawn->tochild);
 
diff --git a/g10/pipemode.c b/g10/pipemode.c
index f3351277e..9f2ddfdb5 100644
--- a/g10/pipemode.c
+++ b/g10/pipemode.c
@@ -85,7 +85,7 @@ make_control ( byte *buf, int code, int operation )
 
 static int
 pipemode_filter( void *opaque, int control,
-	         IOBUF a, byte *buf, size_t *ret_len)
+	         iobuf_t a, byte *buf, size_t *ret_len)
 { 
     size_t size = *ret_len;
     struct pipemode_context_s *stx = opaque;
@@ -291,7 +291,7 @@ pipemode_filter( void *opaque, int control,
 void
 run_in_pipemode(void)
 {
-    IOBUF fp;
+    iobuf_t fp;
     armor_filter_context_t afx;
     struct pipemode_context_s stx;
     int rc;
diff --git a/g10/pkclist.c b/g10/pkclist.c
index e6c826963..5a4aa250f 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -74,10 +74,10 @@ do_show_revocation_reason( PKT_signature *sig )
 
 	log_info( _("reason for revocation: ") );
 	if( text )
-	    fputs( text, log_stream() );
+	    fputs( text, log_get_stream () );
 	else
-	    fprintf( log_stream(), "code=%02x", *p );
-	putc( '\n', log_stream() );
+	    fprintf( log_get_stream (), "code=%02x", *p );
+	putc( '\n', log_get_stream () );
 	n--; p++;
 	pp = NULL;
 	do {
@@ -90,8 +90,8 @@ do_show_revocation_reason( PKT_signature *sig )
 		pp = memchr( p, '\n', n );
 		nn = pp? pp - p : n;
 		log_info( _("revocation comment: ") );
-		print_string( log_stream(), p, nn, 0 );
-		putc( '\n', log_stream() );
+		print_string( log_get_stream(), p, nn, 0 );
+		putc( '\n', log_get_stream() );
 		p += nn; n -= nn;
 	    }
 	} while( pp );
@@ -186,11 +186,11 @@ show_paths (const PKT_public_key *pk, int only_first )
 	    return;
 	}
 
-	pk = m_alloc_clear( sizeof *pk );
+	pk = xcalloc (1, sizeof *pk );
 	rc = get_pubkey( pk, keyid );
 	if( rc ) {
 	    log_error("key %08lX: public key not found: %s\n",
-				    (ulong)keyid[1], g10_errstr(rc) );
+				    (ulong)keyid[1], gpg_strerror (rc) );
 	    return;
 	}
 
@@ -214,7 +214,7 @@ show_paths (const PKT_public_key *pk, int only_first )
 
 	p = get_user_id( keyid, &n );
 	tty_print_utf8_string( p, n ),
-	m_free(p);
+	xfree (p);
 	tty_printf("\"\n");
 	free_public_key( pk );
     }
@@ -276,7 +276,7 @@ do_edit_ownertrust (PKT_public_key *pk, int mode,
                        (ulong)keyid[1], datestr_from_pk( pk ) );
             p = get_user_id( keyid, &n );
             tty_print_utf8_string( p, n ),
-              m_free(p);
+              xfree (p);
             tty_printf("\"\n");
 
             keyblock = get_pubkeyblock (keyid);
@@ -395,9 +395,9 @@ do_edit_ownertrust (PKT_public_key *pk, int mode,
         quit = 1;
         break ; /* back to the menu */
       }
-    m_free(p); p = NULL;
+    xfree (p); p = NULL;
   }
-  m_free(p);
+  xfree (p);
   return show? -2: quit? -1 : changed;
 }
 
@@ -558,7 +558,7 @@ do_we_trust_pre( PKT_public_key *pk, unsigned int trustlevel )
 	    size_t n;
 	    char *p = get_user_id( keyid, &n );
 	    tty_print_utf8_string( p, n );
-	    m_free(p);
+	    xfree (p);
 	  }
 	tty_printf("\"\n");
         print_fingerprint (pk, NULL, 2);
@@ -594,7 +594,7 @@ do_we_trust_pre( PKT_public_key *pk, unsigned int trustlevel )
 int
 check_signatures_trust( PKT_signature *sig )
 {
-  PKT_public_key *pk = m_alloc_clear( sizeof *pk );
+  PKT_public_key *pk = xcalloc (1, sizeof *pk );
   unsigned int trustlevel;
   int rc=0;
 
@@ -602,7 +602,7 @@ check_signatures_trust( PKT_signature *sig )
   if (rc) 
     { /* this should not happen */
       log_error("Ooops; the key vanished  - can't check the trust\n");
-      rc = G10ERR_NO_PUBKEY;
+      rc = GPG_ERR_NO_PUBKEY;
       goto leave;
     }
 
@@ -662,7 +662,7 @@ check_signatures_trust( PKT_signature *sig )
       log_info(_("         The signature is probably a FORGERY.\n"));
       if (opt.with_fingerprint)
         print_fingerprint (pk, NULL, 1);
-      rc = G10ERR_BAD_SIGN;
+      rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
       break;
 
     case TRUST_MARGINAL:
@@ -701,7 +701,7 @@ release_pk_list( PK_LIST pk_list )
     for( ; pk_list; pk_list = pk_rover ) {
 	pk_rover = pk_list->next;
 	free_public_key( pk_list->pk );
-	m_free( pk_list );
+	xfree ( pk_list );
     }
 }
 
@@ -730,10 +730,10 @@ default_recipient(void)
     int i;
 
     if( opt.def_recipient )
-	return m_strdup( opt.def_recipient );
+	return xstrdup ( opt.def_recipient );
     if( !opt.def_recipient_self )
 	return NULL;
-    sk = m_alloc_clear( sizeof *sk );
+    sk = xcalloc (1, sizeof *sk );
     i = get_seckey_byname( sk, NULL, 0 );
     if( i ) {
 	free_secret_key( sk );
@@ -742,7 +742,7 @@ default_recipient(void)
     n = MAX_FINGERPRINT_LEN;
     fingerprint_from_sk( sk, fpr, &n );
     free_secret_key( sk );
-    p = m_alloc( 2*n+3 );
+    p = xmalloc ( 2*n+3 );
     *p++ = '0';
     *p++ = 'x';
     for(i=0; i < n; i++ )
@@ -829,17 +829,17 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	      }
 	  }
 	else if( (use & PUBKEY_USAGE_ENC) && !opt.no_encrypt_to ) {
-	    pk = m_alloc_clear( sizeof *pk );
+	    pk = xcalloc (1, sizeof *pk );
 	    pk->req_usage = use;
 	    /* We can encrypt-to a disabled key */
 	    if( (rc = get_pubkey_byname( pk, rov->d, NULL, NULL, 1 )) ) {
 		free_public_key( pk ); pk = NULL;
-		log_error(_("%s: skipped: %s\n"), rov->d, g10_errstr(rc) );
+		log_error(_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
                 write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
                                               rov->d, strlen (rov->d), -1);
 		goto fail;
             }
-	    else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) ) {
+	    else if( !(rc=openpgp_pk_test_algo (pk->pubkey_algo, use )) ) {
 		/* Skip the actual key if the key is already present
 		 * in the list */
 		if (key_present_in_pk_list(pk_list, pk) == 0) {
@@ -849,7 +849,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 		}
 		else {
 		    PK_LIST r;
-		    r = m_alloc( sizeof *r );
+		    r = xmalloc ( sizeof *r );
 		    r->pk = pk; pk = NULL;
 		    r->next = pk_list;
 		    r->flags = (rov->flags&2)?1:0;
@@ -867,7 +867,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	    }
 	    else {
 		free_public_key( pk ); pk = NULL;
-		log_error(_("%s: skipped: %s\n"), rov->d, g10_errstr(rc) );
+		log_error(_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
                 write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
                                               rov->d, strlen (rov->d), -1);
 		goto fail;
@@ -887,13 +887,13 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 		"You did not specify a user ID. (you may use \"-r\")\n"));
 	for(;;) {
 	    rc = 0;
-	    m_free(answer);
+	    xfree (answer);
 	    if( have_def_rec ) {
 		answer = def_rec;
 		def_rec = NULL;
 	    }
-	    else if(backlog) {
-	      answer=pop_strlist(&backlog);
+	    else if (backlog) {
+	      answer = strlist_pop (&backlog);
 	    }
 	    else {
 		answer = cpr_get_utf8("pklist.user_id.enter",
@@ -902,19 +902,19 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 		cpr_kill_prompt();
 	    }
 	    if( !answer || !*answer ) {
-	        m_free(answer);
+	        xfree (answer);
 		break;
 	    }
 	    if(expand_id(answer,&backlog,0))
 	      continue;
 	    if( pk )
 		free_public_key( pk );
-	    pk = m_alloc_clear( sizeof *pk );
+	    pk = xcalloc (1, sizeof *pk );
 	    pk->req_usage = use;
 	    rc = get_pubkey_byname( pk, answer, NULL, NULL, 0 );
 	    if( rc )
 		tty_printf(_("No such user ID.\n"));
-	    else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use)) ) {
+	    else if( !(rc=openpgp_pk_test_algo (pk->pubkey_algo, use)) ) {
 		if( have_def_rec ) {
 		    if (key_present_in_pk_list(pk_list, pk) == 0) {
 			free_public_key(pk); pk = NULL;
@@ -922,7 +922,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 				   "already set as default recipient\n") );
 		    }
 		    else {
-			PK_LIST r = m_alloc( sizeof *r );
+			PK_LIST r = xmalloc ( sizeof *r );
 			r->pk = pk; pk = NULL;
 			r->next = pk_list;
 			r->flags = 0; /* no throwing default ids */
@@ -963,11 +963,11 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 				size_t n;
 				char *p = get_user_id( keyid, &n );
 				tty_print_utf8_string( p, n );
-				m_free(p);
+				xfree (p);
 			      }
 			    tty_printf("\"\n");
 
-			    r = m_alloc( sizeof *r );
+			    r = xmalloc ( sizeof *r );
 			    r->pk = pk; pk = NULL;
 			    r->next = pk_list;
 			    r->flags = 0; /* no throwing interactive ids */
@@ -978,7 +978,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 		    }
 		}
 	    }
-	    m_free(def_rec); def_rec = NULL;
+	    xfree (def_rec); def_rec = NULL;
 	    have_def_rec = 0;
 	}
 	if( pk ) {
@@ -987,13 +987,13 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	}
     }
     else if( !any_recipients && (def_rec = default_recipient()) ) {
-	pk = m_alloc_clear( sizeof *pk );
+	pk = xcalloc (1, sizeof *pk );
 	pk->req_usage = use;
 	/* The default recipient may be disabled */
 	rc = get_pubkey_byname( pk, def_rec, NULL, NULL, 1 );
 	if( rc )
 	    log_error(_("unknown default recipient `%s'\n"), def_rec );
-	else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use)) ) {
+	else if( !(rc=openpgp_pk_test_algo (pk->pubkey_algo, use)) ) {
 	  /* Mark any_recipients here since the default recipient
              would have been used if it wasn't already there.  It
              doesn't really matter if we got this key from the default
@@ -1002,7 +1002,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	  if (key_present_in_pk_list(pk_list, pk) == 0)
 	    log_info(_("skipped: public key already set as default recipient\n"));
 	  else {
-	    PK_LIST r = m_alloc( sizeof *r );
+	    PK_LIST r = xmalloc ( sizeof *r );
 	    r->pk = pk; pk = NULL;
 	    r->next = pk_list;
 	    r->flags = 0; /* no throwing default ids */
@@ -1013,7 +1013,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	    free_public_key( pk );
 	    pk = NULL;
 	}
-	m_free(def_rec); def_rec = NULL;
+	xfree (def_rec); def_rec = NULL;
     }
     else {
 	any_recipients = 0;
@@ -1021,17 +1021,17 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 	    if( (remusr->flags & 1) )
 		continue; /* encrypt-to keys are already handled */
 
-	    pk = m_alloc_clear( sizeof *pk );
+	    pk = xcalloc (1, sizeof *pk );
 	    pk->req_usage = use;
 	    if( (rc = get_pubkey_byname( pk, remusr->d, NULL, NULL, 0 )) ) {
 		free_public_key( pk ); pk = NULL;
-		log_error(_("%s: skipped: %s\n"), remusr->d, g10_errstr(rc) );
+		log_error(_("%s: skipped: %s\n"), remusr->d, gpg_strerror (rc) );
                 write_status_text_and_buffer (STATUS_INV_RECP, "0 ",
                                               remusr->d, strlen (remusr->d),
                                               -1);
 		goto fail;
 	    }
-	    else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) ) {
+	    else if( !(rc=openpgp_pk_test_algo (pk->pubkey_algo, use )) ) {
 		int trustlevel;
 
 		trustlevel = get_validity (pk, pk->user_id);
@@ -1043,7 +1043,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
                                                   remusr->d,
                                                   strlen (remusr->d),
                                                   -1);
-		    rc=G10ERR_UNU_PUBKEY;
+		    rc = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
 		    goto fail;
 		}
 		else if( do_we_trust_pre( pk, trustlevel ) ) {
@@ -1062,7 +1062,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
 		    }
 		    else {
 			PK_LIST r;
-			r = m_alloc( sizeof *r );
+			r = xmalloc ( sizeof *r );
 			r->pk = pk; pk = NULL;
 			r->next = pk_list;
 			r->flags = (remusr->flags&2)?1:0;
@@ -1075,7 +1075,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
                                                   remusr->d,
                                                   strlen (remusr->d),
                                                   -1);
-		    rc=G10ERR_UNU_PUBKEY;
+		    rc = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
 		    goto fail;
 		}
 	    }
@@ -1085,7 +1085,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
                                               remusr->d,
                                               strlen (remusr->d),
                                               -1);
-		log_error(_("%s: skipped: %s\n"), remusr->d, g10_errstr(rc) );
+		log_error(_("%s: skipped: %s\n"), remusr->d, gpg_strerror (rc) );
 		goto fail;
 	    }
 	}
@@ -1094,7 +1094,7 @@ build_pk_list( STRLIST rcpts, PK_LIST *ret_pk_list, unsigned use )
     if( !rc && !any_recipients ) {
 	log_error(_("no valid addressees\n"));
         write_status_text (STATUS_NO_RECP, "0");
-	rc = G10ERR_NO_USER_ID;
+	rc = GPG_ERR_NO_USER_ID;
     }
 
  fail:
@@ -1145,11 +1145,11 @@ algo_available( preftype_t preftype, int algo, void *hint )
 			    && algo != CIPHER_ALGO_TWOFISH))
 	return 0;
 
-      return algo && !check_cipher_algo( algo );
+      return algo && !gcry_cipher_test_algo (algo);
     }
   else if( preftype == PREFTYPE_HASH )
     {
-      if(hint && ((*(int *)hint) != md_digest_length(algo)))
+      if(hint && ((*(int *)hint) != gcry_md_get_algo_dlen (algo)))
 	return 0;
 
       if((PGP6 || PGP7) && (algo != DIGEST_ALGO_MD5
@@ -1168,7 +1168,7 @@ algo_available( preftype_t preftype, int algo, void *hint )
       if( RFC2440 && algo == DIGEST_ALGO_TIGER )
 	return 0;
 
-      return algo && !check_digest_algo( algo );
+      return algo && !gcry_md_test_algo( algo );
     }
   else if( preftype == PREFTYPE_ZIP )
     {
diff --git a/g10/pkglue.c b/g10/pkglue.c
new file mode 100644
index 000000000..3e378822c
--- /dev/null
+++ b/g10/pkglue.c
@@ -0,0 +1,278 @@
+/* pkglue.c - public key operations glue code
+ *	Copyright (C) 2000, 2003 Free Software Foundation, Inc.
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+#include <config.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+
+#include "gpg.h"
+#include "util.h"
+#include "pkglue.h"
+
+
+
+/****************
+ * Emulate our old PK interface here - sometime in the future we might
+ * change the internal design to directly fit to libgcrypt.
+ */
+int
+pk_sign (int algo, gcry_mpi_t * data, gcry_mpi_t hash, gcry_mpi_t * skey)
+{
+  gcry_sexp_t s_sig, s_hash, s_skey, list;
+  int rc;
+
+  /* make a sexp from skey */
+  if (algo == GCRY_PK_DSA)
+    {
+      rc = gcry_sexp_build (&s_skey, NULL,
+			    "(private-key(dsa(p%m)(q%m)(g%m)(y%m)(x%m)))",
+			    skey[0], skey[1], skey[2], skey[3], skey[4]);
+    }
+  else if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_skey, NULL,
+			    "(private-key(elg(p%m)(g%m)(y%m)(x%m)))",
+			    skey[0], skey[1], skey[2], skey[3]);
+    }
+  else
+    return GPG_ERR_PUBKEY_ALGO;
+
+  if (rc)
+    BUG ();
+
+  /* put hash into a S-Exp s_hash */
+  if (gcry_sexp_build (&s_hash, NULL, "%m", hash))
+    BUG ();
+
+  rc = gcry_pk_sign (&s_sig, s_hash, s_skey);
+  gcry_sexp_release (s_hash);
+  gcry_sexp_release (s_skey);
+
+  if (rc)
+    ;
+  else
+    {
+      list = gcry_sexp_find_token (s_sig, "r", 0);
+      assert (list);
+      data[0] = gcry_sexp_nth_mpi (list, 1, 0);
+      assert (data[0]);
+      gcry_sexp_release (list);
+
+      list = gcry_sexp_find_token (s_sig, "s", 0);
+      assert (list);
+      data[1] = gcry_sexp_nth_mpi (list, 1, 0);
+      assert (data[1]);
+      gcry_sexp_release (list);
+    }
+
+
+  gcry_sexp_release (s_sig);
+  return rc;
+}
+
+/****************
+ * Emulate our old PK interface here - sometime in the future we might
+ * change the internal design to directly fit to libgcrypt.
+ */
+int
+pk_verify (int algo, gcry_mpi_t hash, gcry_mpi_t * data, gcry_mpi_t * pkey)
+{
+  gcry_sexp_t s_sig, s_hash, s_pkey;
+  int rc;
+
+  /* make a sexp from pkey */
+  if (algo == GCRY_PK_DSA)
+    {
+      rc = gcry_sexp_build (&s_pkey, NULL,
+			    "(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
+			    pkey[0], pkey[1], pkey[2], pkey[3]);
+    }
+  else if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_pkey, NULL,
+			    "(public-key(elg(p%m)(g%m)(y%m)))",
+			    pkey[0], pkey[1], pkey[2]);
+    }
+  else if (algo == GCRY_PK_RSA)
+    {
+      rc = gcry_sexp_build (&s_pkey, NULL,
+			    "(public-key(rsa(n%m)(e%m)))", pkey[0], pkey[1]);
+    }
+  else
+    return GPG_ERR_PUBKEY_ALGO;
+
+  if (rc)
+    BUG ();
+
+  /* put hash into a S-Exp s_hash */
+  if (gcry_sexp_build (&s_hash, NULL, "%m", hash))
+    BUG ();
+
+  /* put data into a S-Exp s_sig */
+  if (algo == GCRY_PK_DSA)
+    {
+      rc = gcry_sexp_build (&s_sig, NULL,
+			    "(sig-val(dsa(r%m)(s%m)))", data[0], data[1]);
+    }
+  else if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_sig, NULL,
+			    "(sig-val(elg(r%m)(s%m)))", data[0], data[1]);
+    }
+  else if (algo == GCRY_PK_RSA)
+    {
+      rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", data[0]);
+    }
+  else
+    BUG ();
+
+  if (rc)
+    BUG ();
+
+
+  rc = gcry_pk_verify (s_sig, s_hash, s_pkey);
+  gcry_sexp_release (s_sig);
+  gcry_sexp_release (s_hash);
+  gcry_sexp_release (s_pkey);
+  return rc;
+}
+
+
+
+
+/****************
+ * Emulate our old PK interface here - sometime in the future we might
+ * change the internal design to directly fit to libgcrypt.
+ */
+int
+pk_encrypt (int algo, gcry_mpi_t * resarr, gcry_mpi_t data, gcry_mpi_t * pkey)
+{
+  gcry_sexp_t s_ciph, s_data, s_pkey;
+  int rc;
+
+  /* make a sexp from pkey */
+  if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_pkey, NULL,
+			    "(public-key(elg(p%m)(g%m)(y%m)))",
+			    pkey[0], pkey[1], pkey[2]);
+    }
+  else
+    return GPG_ERR_PUBKEY_ALGO;
+
+  if (rc)
+    BUG ();
+
+  /* put the data into a simple list */
+  if (gcry_sexp_build (&s_data, NULL, "%m", data))
+    BUG ();
+
+  /* pass it to libgcrypt */
+  rc = gcry_pk_encrypt (&s_ciph, s_data, s_pkey);
+  gcry_sexp_release (s_data);
+  gcry_sexp_release (s_pkey);
+
+  if (rc)
+    ;
+  else
+    { /* add better error handling or make gnupg use S-Exp directly */
+      gcry_sexp_t list = gcry_sexp_find_token (s_ciph, "a", 0);
+      assert (list);
+      resarr[0] = gcry_sexp_nth_mpi (list, 1, 0);
+      assert (resarr[0]);
+      gcry_sexp_release (list);
+
+      list = gcry_sexp_find_token (s_ciph, "b", 0);
+      assert (list);
+      resarr[1] = gcry_sexp_nth_mpi (list, 1, 0);
+      assert (resarr[1]);
+      gcry_sexp_release (list);
+    }
+
+  gcry_sexp_release (s_ciph);
+  return rc;
+}
+
+
+
+/****************
+ * Emulate our old PK interface here - sometime in the future we might
+ * change the internal design to directly fit to libgcrypt.
+ */
+int
+pk_decrypt (int algo, gcry_mpi_t * result, gcry_mpi_t * data,
+	    gcry_mpi_t * skey)
+{
+  gcry_sexp_t s_skey, s_data, s_plain;
+  int rc;
+
+  *result = NULL;
+  /* make a sexp from skey */
+  if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_skey, NULL,
+			    "(private-key(elg(p%m)(g%m)(y%m)(x%m)))",
+			    skey[0], skey[1], skey[2], skey[3]);
+    }
+  else if (algo == GCRY_PK_RSA)
+    {
+      rc = gcry_sexp_build (&s_skey, NULL,
+			    "(private-key(rsa(n%m)(e%m)(d%m)(p%m)(q%m)(u%m)))",
+			    skey[0], skey[1], skey[2], skey[3], skey[4],
+			    skey[5]);
+    }
+  else
+    return GPG_ERR_PUBKEY_ALGO;
+
+  if (rc)
+    BUG ();
+
+  /* put data into a S-Exp s_data */
+  if (algo == GCRY_PK_ELG || algo == GCRY_PK_ELG_E)
+    {
+      rc = gcry_sexp_build (&s_data, NULL,
+			    "(enc-val(elg(a%m)(b%m)))", data[0], data[1]);
+    }
+  else if (algo == GCRY_PK_RSA)
+    {
+      rc = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))", data[0]);
+    }
+  else
+    BUG ();
+
+  if (rc)
+    BUG ();
+
+  rc = gcry_pk_decrypt (&s_plain, s_data, s_skey);
+  gcry_sexp_release (s_skey);
+  gcry_sexp_release (s_data);
+  if (rc)
+    return rc;
+
+  *result = gcry_sexp_nth_mpi (s_plain, 0, 0);
+  gcry_sexp_release (s_plain);
+  if (!*result)
+    return -1;			/* oops */
+
+  return 0;
+}
diff --git a/g10/pkglue.h b/g10/pkglue.h
new file mode 100644
index 000000000..3065d66aa
--- /dev/null
+++ b/g10/pkglue.h
@@ -0,0 +1,34 @@
+/* pkglue.h - public key operations definitions
+ *	Copyright (C) 2003 Free Software Foundation, Inc.
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+#ifndef GNUPG_G10_PKGLUE_H
+#define GNUPG_G10_PKGLUE_H
+
+int pk_sign (int algo, gcry_mpi_t *data, gcry_mpi_t hash,
+             gcry_mpi_t *skey);
+int pk_verify (int algo, gcry_mpi_t hash, gcry_mpi_t *data,
+               gcry_mpi_t *pkey);
+int pk_encrypt (int algo, gcry_mpi_t *resarr, gcry_mpi_t data,
+                gcry_mpi_t *pkey);
+int pk_decrypt (int algo, gcry_mpi_t *result, gcry_mpi_t *data,
+                gcry_mpi_t *skey);
+
+
+#endif /*GNUPG_G10_PKGLUE_H*/
diff --git a/g10/plaintext.c b/g10/plaintext.c
index 89043026c..d84a523fe 100644
--- a/g10/plaintext.c
+++ b/g10/plaintext.c
@@ -1,5 +1,6 @@
 /* plaintext.c -  process plaintext packets
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003  Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -28,6 +29,7 @@
 #include <fcntl.h> /* for setmode() */
 #endif
 
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "options.h"
@@ -48,7 +50,7 @@
  */
 int
 handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
-		  int nooutput, int clearsig )
+		  int nooutput, int clearsig, int *create_failed )
 {
     char *fname = NULL;
     FILE *fp = NULL;
@@ -58,12 +60,17 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 #ifdef __riscos__
     int filetype = 0xfff;
 #endif
+    int dummy_create_failed;
+
+    if (!create_failed)
+      create_failed = &dummy_create_failed;
+    *create_failed = 0;
 
     /* create the filename as C string */
     if( nooutput )
 	;
     else if( opt.outfile ) {
-	fname = m_alloc( strlen( opt.outfile ) + 1);
+	fname = xmalloc ( strlen( opt.outfile ) + 1);
 	strcpy(fname, opt.outfile );
     }
     else if( pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8 ) ) {
@@ -75,7 +82,8 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 	if( !fname )
 	    fname = ask_outfile_name( pt->name, pt->namelen );
 	if( !fname ) {
-	    rc = G10ERR_CREATE_FILE;
+            *create_failed = 1;
+            rc = GPG_ERR_GENERAL;
 	    goto leave;
 	}
     }
@@ -96,11 +104,12 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 	while( !overwrite_filep (fname) ) {
             char *tmp = ask_outfile_name (NULL, 0);
             if ( !tmp || !*tmp ) {
-                m_free (tmp);
-                rc = G10ERR_CREATE_FILE;
+                xfree (tmp);
+                *create_failed = 1;
+                rc = GPG_ERR_GENERAL;
                 goto leave;
             }
-            m_free (fname);
+            xfree (fname);
             fname = tmp;
         }
     }
@@ -109,8 +118,9 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
     if( fp || nooutput )
 	;
     else if( !(fp = fopen(fname,"wb")) ) {
+	rc = gpg_error_from_errno (errno);
 	log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
-	rc = G10ERR_CREATE_FILE;
+        *create_failed = 1;
 	goto leave;
     }
 #else /* __riscos__ */
@@ -124,8 +134,9 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
     else {
         fp = fopen(fname,"wb");
         if( !fp ) {
+             rc == gpg_error_from_errno (errno);          
             log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
-            rc = G10ERR_CREATE_FILE;
+            *create_failed = 1;
             if (errno == 106)
                 log_info("Do output file and input file have the same name?\n");
             goto leave;
@@ -150,76 +161,76 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 	if( convert ) { /* text mode */
 	    for( ; pt->len; pt->len-- ) {
 		if( (c = iobuf_get(pt->buf)) == -1 ) {
+                     rc = gpg_error_from_errno (errno);
 		    log_error("Problem reading source (%u bytes remaining)\n",
 			      (unsigned)pt->len);
-		    rc = G10ERR_READ_FILE;
 		    goto leave;
 		}
 		if( mfx->md )
-		    md_putc(mfx->md, c );
+		    gcry_md_putc (mfx->md, c );
 #ifndef HAVE_DOSISH_SYSTEM
 		if( c == '\r' )  /* convert to native line ending */
 		    continue;	 /* fixme: this hack might be too simple */
 #endif
 		if( fp ) {
-		    if( putc( c, fp ) == EOF ) {
+     		    if( putc( c, fp ) == EOF ) {
+                        rc = gpg_error_from_errno (errno);
 			log_error("Error writing to `%s': %s\n",
 				  fname, strerror(errno) );
-			rc = G10ERR_WRITE_FILE;
 			goto leave;
 		    }
 		}
 	    }
 	}
 	else { /* binary mode */
-	    byte *buffer = m_alloc( 32768 );
+	    byte *buffer = xmalloc ( 32768 );
 	    while( pt->len ) {
 		int len = pt->len > 32768 ? 32768 : pt->len;
 		len = iobuf_read( pt->buf, buffer, len );
 		if( len == -1 ) {
+                    rc = gpg_error_from_errno (errno);
 		    log_error("Problem reading source (%u bytes remaining)\n",
 			      (unsigned)pt->len);
-		    rc = G10ERR_READ_FILE;
-		    m_free( buffer );
+		    xfree ( buffer );
 		    goto leave;
 		}
 		if( mfx->md )
-		    md_write( mfx->md, buffer, len );
+		    gcry_md_write( mfx->md, buffer, len );
 		if( fp ) {
-		    if( fwrite( buffer, 1, len, fp ) != len ) {
+  		    if( fwrite( buffer, 1, len, fp ) != len ) {
+                        rc = gpg_error_from_errno (errno);
 			log_error("Error writing to `%s': %s\n",
 				  fname, strerror(errno) );
-			rc = G10ERR_WRITE_FILE;
-			m_free( buffer );
+			xfree ( buffer );
 			goto leave;
 		    }
 		}
 		pt->len -= len;
 	    }
-	    m_free( buffer );
+	    xfree ( buffer );
 	}
     }
     else if( !clearsig ) {
 	if( convert ) { /* text mode */
 	    while( (c = iobuf_get(pt->buf)) != -1 ) {
 		if( mfx->md )
-		    md_putc(mfx->md, c );
+		    gcry_md_putc (mfx->md, c );
 #ifndef HAVE_DOSISH_SYSTEM
 		if( convert && c == '\r' )
 		    continue; /* fixme: this hack might be too simple */
 #endif
 		if( fp ) {
-		    if( putc( c, fp ) == EOF ) {
+   		    if( putc( c, fp ) == EOF ) {
+                        rc = gpg_error_from_errno (errno);
 			log_error("Error writing to `%s': %s\n",
 				  fname, strerror(errno) );
-			rc = G10ERR_WRITE_FILE;
 			goto leave;
 		    }
 		}
 	    }
 	}
 	else { /* binary mode */
-	    byte *buffer = m_alloc( 32768 );
+	    byte *buffer = xmalloc ( 32768 );
 	    int eof;
 	    for( eof=0; !eof; ) {
 		/* Why do we check for len < 32768:
@@ -234,18 +245,18 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 		if( len < 32768 )
 		    eof = 1;
 		if( mfx->md )
-		    md_write( mfx->md, buffer, len );
+		    gcry_md_write( mfx->md, buffer, len );
 		if( fp ) {
 		    if( fwrite( buffer, 1, len, fp ) != len ) {
+                        rc = gpg_error_from_errno (errno);
 			log_error("Error writing to `%s': %s\n",
 				  fname, strerror(errno) );
-			rc = G10ERR_WRITE_FILE;
-			m_free( buffer );
+			xfree ( buffer );
 			goto leave;
 		    }
 		}
 	    }
-	    m_free( buffer );
+	    xfree ( buffer );
 	}
 	pt->buf = NULL;
     }
@@ -255,17 +266,17 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 	while( (c = iobuf_get(pt->buf)) != -1 ) {
 	    if( fp ) {
 		if( putc( c, fp ) == EOF ) {
+                    rc = gpg_error_from_errno (errno);
 		    log_error("Error writing to `%s': %s\n",
 						fname, strerror(errno) );
-		    rc = G10ERR_WRITE_FILE;
 		    goto leave;
 		}
 	    }
 	    if( !mfx->md )
 		continue;
 	    if( state == 2 ) {
-		md_putc(mfx->md, '\r' );
-		md_putc(mfx->md, '\n' );
+		gcry_md_putc (mfx->md, '\r' );
+		gcry_md_putc (mfx->md, '\n' );
 		state = 0;
 	    }
 	    if( !state ) {
@@ -274,18 +285,18 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
 		else if( c == '\n'  )
 		    state = 2;
 		else
-		    md_putc(mfx->md, c );
+		    gcry_md_putc (mfx->md, c );
 	    }
 	    else if( state == 1 ) {
 		if( c == '\n'  )
 		    state = 2;
 		else {
-		    md_putc(mfx->md, '\r' );
+		    gcry_md_putc (mfx->md, '\r' );
 		    if( c == '\r'  )
 			state = 1;
 		    else {
 			state = 0;
-			md_putc(mfx->md, c );
+			gcry_md_putc (mfx->md, c );
 		    }
 		}
 	    }
@@ -294,9 +305,9 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
     }
 
     if( fp && fp != stdout && fclose(fp) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("Error closing `%s': %s\n", fname, strerror(errno) );
 	fp = NULL;
-	rc = G10ERR_WRITE_FILE;
 	goto leave;
     }
     fp = NULL;
@@ -304,12 +315,12 @@ handle_plaintext( PKT_plaintext *pt, md_filter_context_t *mfx,
   leave:
     if( fp && fp != stdout )
 	fclose(fp);
-    m_free(fname);
+    xfree (fname);
     return rc;
 }
 
 static void
-do_hash( MD_HANDLE md, MD_HANDLE md2, IOBUF fp, int textmode )
+do_hash( MD_HANDLE md, MD_HANDLE md2, iobuf_t fp, int textmode )
 {
     text_filter_context_t tfx;
     int c;
@@ -323,27 +334,27 @@ do_hash( MD_HANDLE md, MD_HANDLE md2, IOBUF fp, int textmode )
 	int lc = -1;
 	while( (c = iobuf_get(fp)) != -1 ) {
 	    if( c == '\n' && lc == '\r' )
-		md_putc(md2, c);
+		gcry_md_putc (md2, c);
 	    else if( c == '\n' ) {
-		md_putc(md2, '\r');
-		md_putc(md2, c);
+		gcry_md_putc (md2, '\r');
+		gcry_md_putc (md2, c);
 	    }
 	    else if( c != '\n' && lc == '\r' ) {
-		md_putc(md2, '\n');
-		md_putc(md2, c);
+		gcry_md_putc (md2, '\n');
+		gcry_md_putc (md2, c);
 	    }
 	    else
-		md_putc(md2, c);
+		gcry_md_putc (md2, c);
 
 	    if( md )
-		md_putc(md, c );
+		gcry_md_putc (md, c );
 	    lc = c;
 	}
     }
     else {
 	while( (c = iobuf_get(fp)) != -1 ) {
 	    if( md )
-		md_putc(md, c );
+		gcry_md_putc (md, c );
 	}
     }
 }
@@ -359,7 +370,7 @@ ask_for_detached_datafile( MD_HANDLE md, MD_HANDLE md2,
 {
     progress_filter_context_t pfx;
     char *answer = NULL;
-    IOBUF fp;
+    iobuf_t fp;
     int rc = 0;
 
     fp = open_sigfile( inname, &pfx ); /* open default file */
@@ -368,12 +379,12 @@ ask_for_detached_datafile( MD_HANDLE md, MD_HANDLE md2,
 	int any=0;
 	tty_printf(_("Detached signature.\n"));
 	do {
-	    m_free(answer);
+	    xfree (answer);
 	    answer = cpr_get("detached_signature.filename",
 			   _("Please enter name of data file: "));
 	    cpr_kill_prompt();
 	    if( any && !*answer ) {
-		rc = G10ERR_READ_FILE;
+		rc = GPG_ERR_GENERAL;
 		goto leave;
 	    }
 	    fp = iobuf_open(answer);
@@ -382,8 +393,8 @@ ask_for_detached_datafile( MD_HANDLE md, MD_HANDLE md2,
 		any++;
 	    }
 	    else if( !fp ) {
+                rc = gpg_error_from_errno (errno);
 		log_error("can't open `%s': %s\n", answer, strerror(errno) );
-		rc = G10ERR_READ_FILE;
 		goto leave;
 	    }
 	} while( !fp );
@@ -399,7 +410,7 @@ ask_for_detached_datafile( MD_HANDLE md, MD_HANDLE md2,
     iobuf_close(fp);
 
   leave:
-    m_free(answer);
+    xfree (answer);
     return rc;
 }
 
@@ -414,7 +425,7 @@ hash_datafiles( MD_HANDLE md, MD_HANDLE md2, STRLIST files,
 		const char *sigfilename, int textmode )
 {
     progress_filter_context_t pfx;
-    IOBUF fp;
+    iobuf_t fp;
     STRLIST sl;
 
     if( !files ) {
@@ -426,16 +437,17 @@ hash_datafiles( MD_HANDLE md, MD_HANDLE md2, STRLIST files,
 	    return 0;
 	}
         log_error (_("no signed data\n"));
-        return G10ERR_OPEN_FILE;
+        return GPG_ERR_NO_DATA;
     }
 
 
     for (sl=files; sl; sl = sl->next ) {
 	fp = iobuf_open( sl->d );
 	if( !fp ) {
+            int tmperr = gpg_error_from_errno (errno);
 	    log_error(_("can't open signed data `%s'\n"),
 						print_fname_stdin(sl->d));
-	    return G10ERR_OPEN_FILE;
+	    return tmperr;
 	}
         handle_progress (&pfx, fp, sl->d);
 	do_hash( md, md2, fp, textmode );
diff --git a/g10/progress.c b/g10/progress.c
index bb414faae..9d9805065 100644
--- a/g10/progress.c
+++ b/g10/progress.c
@@ -21,6 +21,7 @@
 #include <config.h>
 #include <stdio.h>
 
+#include "gpg.h"
 #include "iobuf.h"
 #include "filter.h"
 #include "status.h"
@@ -32,7 +33,7 @@
  */
 int
 progress_filter (void *opaque, int control,
-		 IOBUF a, byte *buf, size_t *ret_len)
+		 iobuf_t a, byte *buf, size_t *ret_len)
 {
   int rc = 0;
   progress_filter_context_t *pfx = opaque;
@@ -86,7 +87,7 @@ progress_filter (void *opaque, int control,
       /* Note, that we must always dealloc resources of a filter
          within the filter handler and not anywhere else.  (We set it
          to NULL and check all uses just in case.) */
-      m_free (pfx->what);
+      xfree (pfx->what);
       pfx->what = NULL;
     }
   else if (control == IOBUFCTRL_DESC)
@@ -95,7 +96,7 @@ progress_filter (void *opaque, int control,
 }
 
 void
-handle_progress (progress_filter_context_t *pfx, IOBUF inp, const char *name)
+handle_progress (progress_filter_context_t *pfx, iobuf_t inp, const char *name)
 {
   off_t filesize = 0;
 
@@ -111,7 +112,7 @@ handle_progress (progress_filter_context_t *pfx, IOBUF inp, const char *name)
     filesize = opt.set_filesize;
 
   /* register the progress filter */
-  pfx->what = m_strdup (name ? name : "stdin");
+  pfx->what = xstrdup (name ? name : "stdin");
   pfx->total = filesize;
   iobuf_push_filter (inp, progress_filter, pfx);
 }
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index 1c52ce4de..b5837b24e 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -1,5 +1,6 @@
 /* pubkey-enc.c -  public key encoded packet handling
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "packet.h"
@@ -34,6 +37,7 @@
 #include "options.h"
 #include "main.h"
 #include "i18n.h"
+#include "pkglue.h"
 
 static int get_it( PKT_pubkey_enc *k,
 		   DEK *dek, PKT_secret_key *sk, u32 *keyid );
@@ -72,12 +76,12 @@ get_session_key( PKT_pubkey_enc *k, DEK *dek )
     PKT_secret_key *sk = NULL;
     int rc;
 
-    rc = check_pubkey_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC);
+    rc = openpgp_pk_test_algo (k->pubkey_algo, PUBKEY_USAGE_ENC);
     if( rc )
 	goto leave;
 
     if( (k->keyid[0] || k->keyid[1]) && !opt.try_all_secrets ) {
-	sk = m_alloc_clear( sizeof *sk );
+	sk = xcalloc (1, sizeof *sk );
 	sk->pubkey_algo = k->pubkey_algo; /* we want a pubkey with this algo*/
 	if( !(rc = get_seckey( sk, k->keyid )) )
 	    rc = get_it( k, dek, sk, k->keyid );
@@ -90,10 +94,10 @@ get_session_key( PKT_pubkey_enc *k, DEK *dek )
 	for(;;) {
 	    if( sk )
 		free_secret_key( sk );
-	    sk = m_alloc_clear( sizeof *sk );
+	    sk = xcalloc (1, sizeof *sk );
 	    rc=enum_secret_keys( &enum_context, sk, 1, 0);
 	    if( rc ) {
-		rc = G10ERR_NO_SECKEY;
+		rc = GPG_ERR_NO_SECKEY;
 		break;
 	    }
 	    if( sk->pubkey_algo != k->pubkey_algo )
@@ -106,7 +110,7 @@ get_session_key( PKT_pubkey_enc *k, DEK *dek )
 	      {
 		p=get_last_passphrase();
 		set_next_passphrase(p);
-		m_free(p);
+		xfree (p);
 	      }
 
 	    rc = check_secret_key( sk, opt.try_all_secrets?1:-1 ); /* ask
@@ -133,16 +137,17 @@ static int
 get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
 {
     int rc;
-    MPI plain_dek  = NULL;
+    gcry_mpi_t plain_dek  = NULL;
     byte *frame = NULL;
     unsigned n, nframe;
     u16 csum, csum2;
 
-    rc = pubkey_decrypt(sk->pubkey_algo, &plain_dek, enc->data, sk->skey );
+    rc = pk_decrypt (sk->pubkey_algo, &plain_dek, enc->data, sk->skey);
     if( rc )
-	goto leave;
-    frame = mpi_get_buffer( plain_dek, &nframe, NULL );
-    mpi_free( plain_dek ); plain_dek = NULL;
+      goto leave;
+    if ( gcry_mpi_aprint (GCRYMPI_FMT_USG, &frame, &nframe, plain_dek))
+      BUG();
+    gcry_mpi_release (plain_dek); plain_dek = NULL;
 
     /* Now get the DEK (data encryption key) from the frame
      *
@@ -162,30 +167,30 @@ get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
      * CSUM
      */
     if( DBG_CIPHER )
-	log_hexdump("DEK frame:", frame, nframe );
+	log_printhex ("DEK frame:", frame, nframe );
     n=0;
     if( n + 7 > nframe )
-	{ rc = G10ERR_WRONG_SECKEY; goto leave; }
+	{ rc = GPG_ERR_WRONG_SECKEY; goto leave; }
     if( frame[n] == 1 && frame[nframe-1] == 2 ) {
 	log_info(_("old encoding of the DEK is not supported\n"));
-	rc = G10ERR_CIPHER_ALGO;
+	rc = GPG_ERR_CIPHER_ALGO;
 	goto leave;
     }
     if( frame[n] != 2 )  /* somethink is wrong */
-	{ rc = G10ERR_WRONG_SECKEY; goto leave; }
+	{ rc = GPG_ERR_WRONG_SECKEY; goto leave; }
     for(n++; n < nframe && frame[n]; n++ ) /* skip the random bytes */
 	;
     n++; /* and the zero byte */
     if( n + 4 > nframe )
-	{ rc = G10ERR_WRONG_SECKEY; goto leave; }
+	{ rc = GPG_ERR_WRONG_SECKEY; goto leave; }
 
     dek->keylen = nframe - (n+1) - 2;
     dek->algo = frame[n++];
     if( dek->algo ==  CIPHER_ALGO_IDEA )
 	write_status(STATUS_RSA_OR_IDEA);
-    rc = check_cipher_algo( dek->algo );
+    rc = openpgp_cipher_test_algo (dek->algo);
     if( rc ) {
-	if( !opt.quiet && rc == G10ERR_CIPHER_ALGO ) {
+	if( !opt.quiet && rc == GPG_ERR_CIPHER_ALGO ) {
 	    log_info(_("cipher algorithm %d%s is unknown or disabled\n"),
                      dek->algo, dek->algo == CIPHER_ALGO_IDEA? " (IDEA)":"");
 	    if(dek->algo==CIPHER_ALGO_IDEA)
@@ -194,8 +199,8 @@ get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
 	dek->algo = 0;
 	goto leave;
     }
-    if( (dek->keylen*8) != cipher_get_keylen( dek->algo ) ) {
-	rc = G10ERR_WRONG_SECKEY;
+    if( dek->keylen != gcry_cipher_get_algo_keylen (dek->algo) ) {
+	rc = GPG_ERR_WRONG_SECKEY;
 	goto leave;
     }
 
@@ -206,11 +211,11 @@ get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
     for( csum2=0, n=0; n < dek->keylen; n++ )
 	csum2 += dek->key[n];
     if( csum != csum2 ) {
-	rc = G10ERR_WRONG_SECKEY;
+	rc = GPG_ERR_WRONG_SECKEY;
 	goto leave;
     }
     if( DBG_CIPHER )
-	log_hexdump("DEK is:", dek->key, dek->keylen );
+	log_printhex ("DEK is:", dek->key, dek->keylen );
     /* check that the algo is in the preferences and whether it has expired */
     {
 	PKT_public_key *pk = NULL;
@@ -258,7 +263,7 @@ get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
 
         if ( pk &&  pk->is_revoked ) {
             log_info( _("NOTE: key has been revoked") );
-            putc( '\n', log_stream() );
+            putc( '\n', log_get_stream() );
             show_revocation_reason( pk, 1 );
         }
 
@@ -268,8 +273,8 @@ get_it( PKT_pubkey_enc *enc, DEK *dek, PKT_secret_key *sk, u32 *keyid )
 
 
   leave:
-    mpi_free(plain_dek);
-    m_free(frame);
+    gcry_mpi_release (plain_dek);
+    xfree (frame);
     return rc;
 }
 
@@ -286,21 +291,21 @@ get_override_session_key( DEK *dek, const char *string )
     int i;
 
     if ( !string )
-	return G10ERR_BAD_KEY;
+	return GPG_ERR_BAD_KEY;
     dek->algo = atoi(string);
     if ( dek->algo < 1 )
-	return G10ERR_BAD_KEY;
+	return GPG_ERR_BAD_KEY;
     if ( !(s = strchr ( string, ':' )) )
-	return G10ERR_BAD_KEY;
+	return GPG_ERR_BAD_KEY;
     s++;
     for(i=0; i < DIM(dek->key) && *s; i++, s +=2 ) {
 	int c = hextobyte ( s );
 	if (c == -1)
-	    return G10ERR_BAD_KEY;
+	    return GPG_ERR_BAD_KEY;
 	dek->key[i] = c;
     }
     if ( *s )
-	return G10ERR_BAD_KEY;
+	return GPG_ERR_BAD_KEY;
     dek->keylen = i;
     return 0;
 }
diff --git a/g10/revoke.c b/g10/revoke.c
index a45d2d623..80e32a32e 100644
--- a/g10/revoke.c
+++ b/g10/revoke.c
@@ -59,15 +59,15 @@ revocation_reason_build_cb( PKT_signature *sig, void *opaque )
 	ud = native_to_utf8( reason->desc );
 	buflen += strlen(ud);
     }
-    buffer = m_alloc( buflen );
+    buffer = xmalloc ( buflen );
     *buffer = reason->code;
     if( ud ) {
 	memcpy(buffer+1, ud, strlen(ud) );
-	m_free( ud );
+	xfree ( ud );
     }
 
     build_sig_subpkt( sig, SIGSUBPKT_REVOC_REASON, buffer, buflen );
-    m_free( buffer );
+    xfree ( buffer );
     return 0;
 }
 
@@ -76,7 +76,7 @@ revocation_reason_build_cb( PKT_signature *sig, void *opaque )
    and pick a user ID that has a uid signature, and include it if
    possible. */
 static int
-export_minimal_pk(IOBUF out,KBNODE keyblock,
+export_minimal_pk(iobuf_t out,KBNODE keyblock,
 		  PKT_signature *revsig,PKT_signature *revkey)
 {
   KBNODE node;
@@ -90,7 +90,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
   if(!node)
     {
       log_error(_("key incomplete\n"));
-      return G10ERR_GENERAL;
+      return GPG_ERR_GENERAL;
     }
 
   keyid_from_pk(node->pkt->pkt.public_key,keyid);
@@ -99,7 +99,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
   rc=build_packet(out,&pkt);
   if(rc)
     {
-      log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+      log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
       return rc;
     }
 
@@ -113,7 +113,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
       rc=build_packet(out,&pkt);
       if(rc)
 	{
-	  log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+	  log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
 	  return rc;
 	}
     }
@@ -125,7 +125,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
       rc=build_packet(out,&pkt);
       if(rc)
 	{
-	  log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+	  log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
 	  return rc;
 	}
     }
@@ -143,7 +143,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
 	  else
 	    {
 	      log_error(_("key %08lX incomplete\n"),(ulong)keyid[1]);
-	      return G10ERR_GENERAL;
+	      return GPG_ERR_GENERAL;
 	    }
 	}
 
@@ -171,7 +171,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
   rc=build_packet(out,&pkt);
   if(rc)
     {
-      log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+      log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
       return rc;
     }
 
@@ -183,7 +183,7 @@ export_minimal_pk(IOBUF out,KBNODE keyblock,
       rc=build_packet(out,&pkt);
       if(rc)
 	{
-	  log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+	  log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
 	  return rc;
 	}
     }
@@ -202,7 +202,7 @@ gen_desig_revoke( const char *uname )
     PKT_public_key *pk = NULL;
     PKT_secret_key *sk = NULL;
     PKT_signature *sig = NULL;
-    IOBUF out = NULL;
+    iobuf_t out = NULL;
     struct revocation_reason_info *reason = NULL;
     KEYDB_HANDLE kdbhd;
     KEYDB_SEARCH_DESC desc;
@@ -212,22 +212,22 @@ gen_desig_revoke( const char *uname )
 
     if( opt.batch ) {
 	log_error(_("sorry, can't do this in batch mode\n"));
-	return G10ERR_GENERAL;
+	return GPG_ERR_GENERAL;
     }
 
     memset( &afx, 0, sizeof afx);
 
     kdbhd = keydb_new (0);
     classify_user_id (uname, &desc);
-    rc = desc.mode? keydb_search (kdbhd, &desc, 1) : G10ERR_INV_USER_ID;
+    rc = desc.mode? keydb_search (kdbhd, &desc, 1) : GPG_ERR_INV_USER_ID;
     if (rc) {
-	log_error (_("key `%s' not found: %s\n"),uname, g10_errstr (rc));
+	log_error (_("key `%s' not found: %s\n"),uname, gpg_strerror (rc));
 	goto leave;
     }
 
     rc = keydb_get_keyblock (kdbhd, &keyblock );
     if( rc ) {
-	log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
+	log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
 	goto leave;
     }
 
@@ -253,7 +253,7 @@ gen_desig_revoke( const char *uname )
 	if(sk)
 	  free_secret_key(sk);
 
-	sk=m_alloc_clear(sizeof(*sk));
+	sk=xcalloc (1,sizeof(*sk));
 
 	rc=get_seckey_byfprint(sk,pk->revkey[i].fpr,MAX_FINGERPRINT_LEN);
 
@@ -302,7 +302,7 @@ gen_desig_revoke( const char *uname )
 				     0, 0, 0,
 				     revocation_reason_build_cb, reason );
 	    if( rc ) {
-	      log_error(_("make_keysig_packet failed: %s\n"), g10_errstr(rc));
+	      log_error(_("make_keysig_packet failed: %s\n"), gpg_strerror (rc));
 	      goto leave;
 	    }
 
@@ -403,7 +403,7 @@ gen_revoke( const char *uname )
     PKT_public_key *pk = NULL;
     PKT_signature *sig = NULL;
     u32 sk_keyid[2];
-    IOBUF out = NULL;
+    iobuf_t out = NULL;
     KBNODE keyblock = NULL, pub_keyblock = NULL;
     KBNODE node;
     KEYDB_HANDLE kdbhd;
@@ -412,7 +412,7 @@ gen_revoke( const char *uname )
 
     if( opt.batch ) {
 	log_error(_("sorry, can't do this in batch mode\n"));
-	return G10ERR_GENERAL;
+	return GPG_ERR_GENERAL;
     }
 
     memset( &afx, 0, sizeof afx);
@@ -423,16 +423,16 @@ gen_revoke( const char *uname )
      */
     kdbhd = keydb_new (1);
     classify_user_id (uname, &desc);
-    rc = desc.mode? keydb_search (kdbhd, &desc, 1) : G10ERR_INV_USER_ID;
+    rc = desc.mode? keydb_search (kdbhd, &desc, 1) : GPG_ERR_INV_USER_ID;
     if (rc) {
 	log_error (_("secret key `%s' not found: %s\n"),
-                   uname, g10_errstr (rc));
+                   uname, gpg_strerror (rc));
 	goto leave;
     }
 
     rc = keydb_get_keyblock (kdbhd, &keyblock );
     if( rc ) {
-	log_error (_("error reading keyblock: %s\n"), g10_errstr(rc) );
+	log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
 	goto leave;
     }
 
@@ -447,14 +447,14 @@ gen_revoke( const char *uname )
     keyid_from_sk( sk, sk_keyid );
     print_seckey_info (sk);
 
-    pk = m_alloc_clear( sizeof *pk );
+    pk = xcalloc (1, sizeof *pk );
 
     /* FIXME: We should get the public key direct from the secret one */
 
     pub_keyblock=get_pubkeyblock(sk_keyid);
     if(!pub_keyblock)
       {
-	log_error(_("no corresponding public key: %s\n"), g10_errstr(rc) );
+	log_error(_("no corresponding public key: %s\n"), gpg_strerror (rc) );
 	goto leave;
       }
 
@@ -466,7 +466,7 @@ gen_revoke( const char *uname )
 
     if( cmp_public_secret_key( pk, sk ) ) {
 	log_error(_("public key does not match secret key!\n") );
-	rc = G10ERR_GENERAL;
+	rc = GPG_ERR_GENERAL;
 	goto leave;
     }
 
@@ -489,7 +489,7 @@ gen_revoke( const char *uname )
     switch( is_secret_key_protected( sk ) ) {
       case -1:
 	log_error(_("unknown protection algorithm\n"));
-	rc = G10ERR_PUBKEY_ALGO;
+	rc = GPG_ERR_PUBKEY_ALGO;
 	break;
       case 0:
 	tty_printf(_("NOTE: This key is not protected!\n"));
@@ -517,7 +517,7 @@ gen_revoke( const char *uname )
 			     opt.force_v4_certs?4:0, 0, 0,
 			     revocation_reason_build_cb, reason );
     if( rc ) {
-	log_error(_("make_keysig_packet failed: %s\n"), g10_errstr(rc));
+	log_error(_("make_keysig_packet failed: %s\n"), gpg_strerror (rc));
 	goto leave;
     }
 
@@ -537,7 +537,7 @@ gen_revoke( const char *uname )
 
 	rc = build_packet( out, &pkt );
 	if( rc ) {
-	  log_error(_("build_packet failed: %s\n"), g10_errstr(rc) );
+	  log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
 	  goto leave;
 	}
       }
@@ -581,7 +581,7 @@ ask_revocation_reason( int key_rev, int cert_rev, int hint )
 
     do {
         code=-1;
-	m_free(description);
+	xfree (description);
 	description = NULL;
 
 	tty_printf(_("Please select the reason for the revocation:\n"));
@@ -612,7 +612,7 @@ ask_revocation_reason( int key_rev, int cert_rev, int hint )
  	        n = -1;
 	    else
 		n = atoi(answer);
-	    m_free(answer);
+	    xfree (answer);
 	    if( n == 0 ) {
 	        code = 0x00; /* no particular reason */
 		code_text = text_0;
@@ -644,25 +644,25 @@ ask_revocation_reason( int key_rev, int cert_rev, int hint )
 	    trim_trailing_ws( answer, strlen(answer) );
 	    cpr_kill_prompt();
 	    if( !*answer ) {
-		m_free(answer);
+		xfree (answer);
 		break;
 	    }
 
 	    {
 		char *p = make_printable_string( answer, strlen(answer), 0 );
-		m_free(answer);
+		xfree (answer);
 		answer = p;
 	    }
 
 	    if( !description )
-		description = m_strdup(answer);
+		description = xstrdup (answer);
 	    else {
-		char *p = m_alloc( strlen(description) + strlen(answer) + 2 );
+		char *p = xmalloc ( strlen(description) + strlen(answer) + 2 );
 		strcpy(stpcpy(stpcpy( p, description),"\n"),answer);
-		m_free(description);
+		xfree (description);
 		description = p;
 	    }
-	    m_free(answer);
+	    xfree (answer);
 	}
 
 	tty_printf(_("Reason for revocation: %s\n"), code_text );
@@ -674,7 +674,7 @@ ask_revocation_reason( int key_rev, int cert_rev, int hint )
     } while( !cpr_get_answer_is_yes("ask_revocation_reason.okay",
 					    _("Is this okay? "))  );
 
-    reason = m_alloc( sizeof *reason );
+    reason = xmalloc ( sizeof *reason );
     reason->code = code;
     reason->desc = description;
     return reason;
@@ -684,7 +684,7 @@ void
 release_revocation_reason_info( struct revocation_reason_info *reason )
 {
     if( reason ) {
-	m_free( reason->desc );
-	m_free( reason );
+	xfree ( reason->desc );
+	xfree ( reason );
     }
 }
diff --git a/g10/seckey-cert.c b/g10/seckey-cert.c
index 76f0ee28d..573c78f7a 100644
--- a/g10/seckey-cert.c
+++ b/g10/seckey-cert.c
@@ -1,5 +1,6 @@
 /* seckey-cert.c -  secret key certificate packet handling
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "memory.h"
 #include "packet.h"
@@ -33,7 +36,7 @@
 #include "options.h"
 #include "i18n.h"
 #include "status.h"
-
+#include "pkglue.h"
 
 static int
 do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
@@ -43,6 +46,7 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
     u16 csum=0;
     int i, res;
     unsigned nbytes;
+    gpg_error_t rc;
 
     if( sk->is_protected ) { /* remove the protection */
 	DEK *dek = NULL;
@@ -52,11 +56,11 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
 
 	if( sk->protect.s2k.mode == 1001 ) {
 	    log_info(_("secret key parts are not available\n"));
-	    return G10ERR_GENERAL;
+	    return GPG_ERR_GENERAL;
 	}
 	if( sk->protect.algo == CIPHER_ALGO_NONE )
 	    BUG();
-	if( check_cipher_algo( sk->protect.algo ) ) {
+	if( openpgp_cipher_test_algo( sk->protect.algo ) ) {
 	    log_info(_("protection algorithm %d%s is not supported\n"),
 			sk->protect.algo,sk->protect.algo==1?" (IDEA)":"" );
 	    if (sk->protect.algo==CIPHER_ALGO_IDEA)
@@ -64,7 +68,7 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
                 write_status (STATUS_RSA_OR_IDEA);
                 idea_cipher_warn (0);
               }
-	    return G10ERR_CIPHER_ALGO;
+	    return GPG_ERR_CIPHER_ALGO;
 	}
 	keyid_from_sk( sk, keyid );
 	keyid[2] = keyid[3] = 0;
@@ -76,28 +80,39 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
 				 &sk->protect.s2k, mode,
                                  tryagain_text, canceled );
         if (!dek && canceled && *canceled)
-	    return G10ERR_GENERAL;
+	    return GPG_ERR_GENERAL;
+
+	rc = gcry_cipher_open (&cipher_hd, sk->protect.algo,
+                               GCRY_CIPHER_MODE_CFB,
+                               GCRY_CIPHER_SECURE
+                               | (sk->protect.algo >= 100 ?
+                                  0 : GCRY_CIPHER_ENABLE_SYNC));
+        if (rc)
+          log_fatal ("cipher open failed: %s\n", gpg_strerror (rc) );
+
+	rc = gcry_cipher_setkey (cipher_hd, dek->key, dek->keylen);
+        if (rc)
+          log_fatal ("set key failed: %s\n", gpg_strerror (rc) );
 
-	cipher_hd = cipher_open( sk->protect.algo,
-				 CIPHER_MODE_AUTO_CFB, 1);
-	cipher_setkey( cipher_hd, dek->key, dek->keylen );
-	m_free(dek);
+	xfree (dek);
 	save_sk = copy_secret_key( NULL, sk );
-	cipher_setiv( cipher_hd, sk->protect.iv, sk->protect.ivlen );
+	gcry_cipher_setiv (cipher_hd, sk->protect.iv, sk->protect.ivlen);
 	csum = 0;
 	if( sk->version >= 4 ) {
 	    int ndata;
+            unsigned int ndatabits;
 	    byte *p, *data;
             u16 csumc = 0;
 
 	    i = pubkey_get_npkey(sk->pubkey_algo);
-	    assert( mpi_is_opaque( sk->skey[i] ) );
-	    p = mpi_get_opaque( sk->skey[i], &ndata );
+            assert( gcry_mpi_get_flag (sk->skey[i], GCRYMPI_FLAG_OPAQUE ));
+            p = gcry_mpi_get_opaque( sk->skey[i], &ndatabits );
+            ndata = (ndatabits+7)/8;
             if ( ndata > 1 )
                 csumc = p[ndata-2] << 8 | p[ndata-1];
-	    data = m_alloc_secure( ndata );
-	    cipher_decrypt( cipher_hd, data, p, ndata );
-	    mpi_free( sk->skey[i] ); sk->skey[i] = NULL ;
+	    data = gcry_xmalloc_secure ( ndata );
+	    gcry_cipher_decrypt( cipher_hd, data, ndata, p, ndata );
+	    gcry_mpi_release ( sk->skey[i] ); sk->skey[i] = NULL ;
 	    p = data;
             if (sk->protect.sha1chk) {
                 /* This is the new SHA1 checksum method to detect
@@ -108,12 +123,13 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
                 if( ndata < 20 ) 
                     log_error("not enough bytes for SHA-1 checksum\n");
                 else {
-                    MD_HANDLE h = md_open (DIGEST_ALGO_SHA1, 1);
-                    if (!h)
+                    gcry_md_hd_t h;
+
+                    if ( gcry_md_open (&h, DIGEST_ALGO_SHA1, 1))
                         BUG(); /* algo not available */
-                    md_write (h, data, ndata - 20);
-                    md_final (h);
-                    if (!memcmp (md_read (h, DIGEST_ALGO_SHA1),
+                    gcry_md_write (h, data, ndata - 20);
+                    gcry_md_final (h);
+                    if (!memcmp (gcry_md_read (h, DIGEST_ALGO_SHA1),
                                  data + ndata - 20, 20) ) {
                         /* digest does match.  We have to keep the old
                            style checksum in sk->csum, so that the
@@ -122,7 +138,7 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
                            keys. */
                         sk->csum = csum = checksum (data, ndata-20);
                     }
-                    md_close (h);
+                    gcry_md_close (h);
                 }
             }
             else {
@@ -146,56 +162,68 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
             if( sk->csum == csum ) {
                 for( ; i < pubkey_get_nskey(sk->pubkey_algo); i++ ) {
                     nbytes = ndata;
-                    sk->skey[i] = mpi_read_from_buffer(p, &nbytes, 1 );
+		    assert( gcry_is_secure( p ) );
+		    res = gcry_mpi_scan( &sk->skey[i], GCRYMPI_FMT_PGP,
+							     p, &nbytes);
+		    if( res )
+			log_bug ("gcry_mpi_scan failed in do_check: %s\n",
+                                 gpg_strerror (res));
                     ndata -= nbytes;
                     p += nbytes;
                 }
                 /* Note: at this point ndata should be 2 for a simple
                    checksum or 20 for the sha1 digest */
             }
-	    m_free(data);
+	    xfree (data);
 	}
 	else {
 	    for(i=pubkey_get_npkey(sk->pubkey_algo);
 		    i < pubkey_get_nskey(sk->pubkey_algo); i++ ) {
                 byte *p;
                 int ndata;
-                unsigned int dummy;
+                unsigned int ndatabits;
 
-                assert (mpi_is_opaque (sk->skey[i]));
-                p = mpi_get_opaque (sk->skey[i], &ndata);
+                assert( gcry_mpi_get_flag (sk->skey[i], GCRYMPI_FLAG_OPAQUE));
+                p = gcry_mpi_get_opaque( sk->skey[i], &ndatabits );
+                ndata = (ndatabits+7)/8;
                 assert (ndata >= 2);
                 assert (ndata == ((p[0] << 8 | p[1]) + 7)/8 + 2);
-                buffer = m_alloc_secure (ndata);
-		cipher_sync (cipher_hd);
+                buffer = gcry_xmalloc_secure (ndata);
+		gcry_cipher_sync (cipher_hd);
                 buffer[0] = p[0];
                 buffer[1] = p[1];
-                cipher_decrypt (cipher_hd, buffer+2, p+2, ndata-2);
+                gcry_cipher_decrypt (cipher_hd, buffer+2, ndata-2,
+                                     p+2, ndata-2);
                 csum += checksum (buffer, ndata);
-                mpi_free (sk->skey[i]);
-                dummy = ndata;
-                sk->skey[i] = mpi_read_from_buffer (buffer, &dummy, 1);
+                gcry_mpi_release (sk->skey[i]);
+		res = gcry_mpi_scan( &sk->skey[i], GCRYMPI_FMT_USG,
+				     buffer, &ndata );
+		if( res )
+		    log_bug ("gcry_mpi_scan failed in do_check: %s\n", 
+                             gpg_strerror (res));
+
                 assert (sk->skey[i]);
-		m_free (buffer);
+		xfree (buffer);
 /*  		csum += checksum_mpi (sk->skey[i]); */
 	    }
 	}
-	cipher_close( cipher_hd );
+	gcry_cipher_close (cipher_hd);
 	/* now let's see whether we have used the right passphrase */
 	if( csum != sk->csum ) {
 	    copy_secret_key( sk, save_sk );
             passphrase_clear_cache ( keyid, sk->pubkey_algo );
 	    free_secret_key( save_sk );
-	    return G10ERR_BAD_PASS;
+	    return gpg_error (GPG_ERR_BAD_PASSPHRASE);
 	}
 	/* the checksum may fail, so we also check the key itself */
-	res = pubkey_check_secret_key( sk->pubkey_algo, sk->skey );
-	if( res ) {
-	    copy_secret_key( sk, save_sk );
-            passphrase_clear_cache ( keyid, sk->pubkey_algo );
-	    free_secret_key( save_sk );
-	    return G10ERR_BAD_PASS;
-	}
+#warning fixme - we need to reenable this
+/*  	res = pubkey_check_secret_key( sk->pubkey_algo, sk->skey ); */
+/*  	if( res ) { */
+/*  	    copy_secret_key( sk, save_sk ); */
+/*              passphrase_clear_cache ( keyid, sk->pubkey_algo ); */
+/*  	    free_secret_key( save_sk ); */
+/*  	    return gpg_error (GPG_ERR_BAD_PASSPHRASE); */
+/*  	} */
 	free_secret_key( save_sk );
 	sk->is_protected = 0;
     }
@@ -206,7 +234,7 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
 	    csum += checksum_mpi( sk->skey[i] );
 	}
 	if( csum != sk->csum )
-	    return G10ERR_CHECKSUM;
+	    return GPG_ERR_CHECKSUM;
     }
 
     return 0;
@@ -222,7 +250,7 @@ do_check( PKT_secret_key *sk, const char *tryagain_text, int mode,
 int
 check_secret_key( PKT_secret_key *sk, int n )
 {
-    int rc = G10ERR_BAD_PASS;
+    int rc = gpg_error (GPG_ERR_BAD_PASSPHRASE);
     int i,mode;
 
     if(n<0)
@@ -236,7 +264,7 @@ check_secret_key( PKT_secret_key *sk, int n )
     if( n < 1 )
 	n = (opt.batch && !opt.use_agent)? 1 : 3; /* use the default value */
 
-    for(i=0; i < n && rc == G10ERR_BAD_PASS; i++ ) {
+    for(i=0; i < n && gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE; i++ ) {
         int canceled = 0;
         const char *tryagain = NULL;
 	if (i) {
@@ -244,7 +272,8 @@ check_secret_key( PKT_secret_key *sk, int n )
             log_info (_("%s ...\n"), _(tryagain));
         }
 	rc = do_check( sk, tryagain, mode, &canceled );
-	if( rc == G10ERR_BAD_PASS && is_status_enabled() ) {
+	if( gpg_err_code (rc) == GPG_ERR_BAD_PASSPHRASE
+            && is_status_enabled() ) {
 	    u32 kid[2];
 	    char buf[50];
 
@@ -291,21 +320,31 @@ protect_secret_key( PKT_secret_key *sk, DEK *dek )
     if( !sk->is_protected ) { /* okay, apply the protection */
 	CIPHER_HANDLE cipher_hd=NULL;
 
-	if( check_cipher_algo( sk->protect.algo ) )
-	    rc = G10ERR_CIPHER_ALGO; /* unsupport protection algorithm */
+	if( openpgp_cipher_test_algo( sk->protect.algo ) )
+          {
+	    rc = gpg_error (GPG_ERR_CIPHER_ALGO); /* unsupport
+                                                     protection
+                                                     algorithm */
+          }
 	else {
 	    print_cipher_algo_note( sk->protect.algo );
-	    cipher_hd = cipher_open( sk->protect.algo,
-				     CIPHER_MODE_AUTO_CFB, 1 );
-	    if( cipher_setkey( cipher_hd, dek->key, dek->keylen ) )
+	    rc = gcry_cipher_open (&cipher_hd, sk->protect.algo,
+                                   GCRY_CIPHER_MODE_CFB,
+                                   GCRY_CIPHER_SECURE
+                                   | (sk->protect.algo >= 100 ?
+                                      0 : GCRY_CIPHER_ENABLE_SYNC) );
+            if (rc)
+              BUG();
+	    if( gcry_cipher_setkey( cipher_hd, dek->key, dek->keylen ) )
 		log_info(_("WARNING: Weak key detected"
 			   " - please change passphrase again.\n"));
-	    sk->protect.ivlen = cipher_get_blocksize( sk->protect.algo );
+	    sk->protect.ivlen = gcry_cipher_get_algo_blklen(sk->protect.algo);
 	    assert( sk->protect.ivlen <= DIM(sk->protect.iv) );
 	    if( sk->protect.ivlen != 8 && sk->protect.ivlen != 16 )
 		BUG(); /* yes, we are very careful */
-	    randomize_buffer(sk->protect.iv, sk->protect.ivlen, 1);
-	    cipher_setiv( cipher_hd, sk->protect.iv, sk->protect.ivlen );
+	    gcry_randomize (sk->protect.iv, sk->protect.ivlen,
+                            GCRY_STRONG_RANDOM);
+	    gcry_cipher_setiv( cipher_hd, sk->protect.iv, sk->protect.ivlen );
 	    if( sk->version >= 4 ) {
                 byte *bufarr[PUBKEY_MAX_NSKEY];
 		unsigned narr[PUBKEY_MAX_NSKEY];
@@ -315,16 +354,21 @@ protect_secret_key( PKT_secret_key *sk, DEK *dek )
 
 		for(j=0, i = pubkey_get_npkey(sk->pubkey_algo);
 			i < pubkey_get_nskey(sk->pubkey_algo); i++, j++ ) {
-		    assert( !mpi_is_opaque( sk->skey[i] ) );
-		    bufarr[j] = mpi_get_buffer( sk->skey[i], &narr[j], NULL );
-		    nbits[j]  = mpi_get_nbits( sk->skey[i] );
+		    assert( !gcry_mpi_get_flag( sk->skey[i],
+                                                GCRYMPI_FLAG_OPAQUE ));
+
+		    if( gcry_mpi_aprint( GCRYMPI_FMT_USG, (void**)bufarr+j,
+                                         narr+j, sk->skey[i]))
+			BUG();
+
+		    nbits[j]  = gcry_mpi_get_nbits( sk->skey[i] );
 		    ndata += narr[j] + 2;
 		}
 		for( ; j < PUBKEY_MAX_NSKEY; j++ )
 		    bufarr[j] = NULL;
 		ndata += opt.simple_sk_checksum? 2 : 20; /* for checksum */
 
-		data = m_alloc_secure( ndata );
+		data = xmalloc_secure ( ndata );
 		p = data;
 		for(j=0; j < PUBKEY_MAX_NSKEY && bufarr[j]; j++ ) {
 		    p[0] = nbits[j] >> 8 ;
@@ -332,7 +376,7 @@ protect_secret_key( PKT_secret_key *sk, DEK *dek )
 		    p += 2;
 		    memcpy(p, bufarr[j], narr[j] );
 		    p += narr[j];
-		    m_free(bufarr[j]);
+		    xfree (bufarr[j]);
 		}
                 
                 if (opt.simple_sk_checksum) {
@@ -345,27 +389,28 @@ protect_secret_key( PKT_secret_key *sk, DEK *dek )
                     sk->protect.sha1chk = 0;
                 }
                 else {
-                    MD_HANDLE h = md_open (DIGEST_ALGO_SHA1, 1);
-                    if (!h)
+                    gcry_md_hd_t h;
+
+                    if (gcry_md_open (&h, GCRY_MD_SHA1, 1))
                         BUG(); /* algo not available */
-                    md_write (h, data, ndata - 20);
-                    md_final (h);
-                    memcpy (p, md_read (h, DIGEST_ALGO_SHA1), 20);
+                    gcry_md_write (h, data, ndata - 20);
+                    gcry_md_final (h);
+                    memcpy (p, gcry_md_read (h, GCRY_MD_SHA1), 20);
                     p += 20;
-                    md_close (h);
+                    gcry_md_close (h);
                     sk->csum = csum = 0;
                     sk->protect.sha1chk = 1;
                 }
                 assert( p == data+ndata );
 
-		cipher_encrypt( cipher_hd, data, data, ndata );
+		gcry_cipher_encrypt( cipher_hd, data, ndata, NULL, 0 );
 		for(i = pubkey_get_npkey(sk->pubkey_algo);
 			i < pubkey_get_nskey(sk->pubkey_algo); i++ ) {
-		    mpi_free( sk->skey[i] );
+		    gcry_mpi_release ( sk->skey[i] );
 		    sk->skey[i] = NULL;
 		}
 		i = pubkey_get_npkey(sk->pubkey_algo);
-		sk->skey[i] = mpi_set_opaque(NULL, data, ndata );
+		sk->skey[i] = gcry_mpi_set_opaque(NULL, data, ndata*8);
 	    }
 	    else {
 		csum = 0;
@@ -375,26 +420,30 @@ protect_secret_key( PKT_secret_key *sk, DEK *dek )
 		    unsigned int nbits;
 
 		    csum += checksum_mpi (sk->skey[i]);
-		    buffer = mpi_get_buffer( sk->skey[i], &nbytes, NULL );
-		    cipher_sync (cipher_hd);
-		    assert ( !mpi_is_opaque (sk->skey[i]) );
-                    data = m_alloc (nbytes+2);
-                    nbits  = mpi_get_nbits (sk->skey[i]);
+		    if( gcry_mpi_aprint( GCRYMPI_FMT_USG, &buffer,
+                                         &nbytes, sk->skey[i] ) )
+			BUG();
+		    gcry_cipher_sync (cipher_hd);
+		    assert (!gcry_mpi_get_flag( sk->skey[i],
+                                                GCRYMPI_FLAG_OPAQUE ));
+                    data = xmalloc (nbytes+2);
+                    nbits  = gcry_mpi_get_nbits (sk->skey[i]);
                     assert (nbytes == (nbits + 7)/8);
                     data[0] = nbits >> 8;
                     data[1] = nbits;
-		    cipher_encrypt (cipher_hd, data+2, buffer, nbytes);
-		    m_free( buffer );
+		    gcry_cipher_encrypt (cipher_hd, data+2, nbytes,
+                                         buffer, nbytes);
+		    xfree ( buffer );
                     
-                    mpi_free (sk->skey[i]);
-                    sk->skey[i] = mpi_set_opaque (NULL, data, nbytes+2);
+                    gcry_mpi_release (sk->skey[i]);
+                    sk->skey[i] = gcry_mpi_set_opaque (NULL, data,
+                                                       (nbytes+2)*8);
 		}
 		sk->csum = csum;
 	    }
 	    sk->is_protected = 1;
-	    cipher_close( cipher_hd );
+	    gcry_cipher_close( cipher_hd );
 	}
     }
     return rc;
 }
-
diff --git a/g10/seskey.c b/g10/seskey.c
index fc912eeb5..9eeed2c74 100644
--- a/g10/seskey.c
+++ b/g10/seskey.c
@@ -1,5 +1,5 @@
 /* seskey.c -  make sesssion keys etc.
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,6 +23,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "cipher.h"
 #include "mpi.h"
@@ -36,26 +38,35 @@
 void
 make_session_key( DEK *dek )
 {
-    CIPHER_HANDLE chd;
-    int i, rc;
-
-    dek->keylen = cipher_get_keylen( dek->algo ) / 8;
-
-    chd = cipher_open( dek->algo, CIPHER_MODE_AUTO_CFB, 1 );
-    randomize_buffer( dek->key, dek->keylen, 1 );
-    for(i=0; i < 16; i++ ) {
-	rc = cipher_setkey( chd, dek->key, dek->keylen );
-	if( !rc ) {
-	    cipher_close( chd );
-	    return;
-	}
-	log_info(_("weak key created - retrying\n") );
-	/* Renew the session key until we get a non-weak key. */
-	randomize_buffer( dek->key, dek->keylen, 1 );
+  gcry_cipher_hd_t chd;
+  int i, rc;
+
+  dek->keylen = gcry_cipher_get_algo_keylen (dek->algo);
+
+  if (gcry_cipher_open (&chd, dek->algo, GCRY_CIPHER_MODE_CFB,
+                          (GCRY_CIPHER_SECURE
+                           | (dek->algo >= 100 ?
+                              0 : GCRY_CIPHER_ENABLE_SYNC))) )
+    BUG();
+
+  gcry_randomize (dek->key, dek->keylen, GCRY_STRONG_RANDOM );
+  for (i=0; i < 16; i++ )
+    {
+      rc = gcry_cipher_setkey (chd, dek->key, dek->keylen);
+      if (!rc)
+        {
+          gcry_cipher_close (chd);
+          return;
+        }
+      if (gpg_err_code (rc) != GPG_ERR_WEAK_KEY)
+        BUG();
+      log_info (_("weak key created - retrying\n") );
+      /* Renew the session key until we get a non-weak key. */
+      gcry_randomize (dek->key, dek->keylen, GCRY_STRONG_RANDOM );
     }
-    log_fatal(_(
-	    "cannot avoid weak key for symmetric cipher; tried %d times!\n"),
-		  i);
+  
+  log_fatal (_("cannot avoid weak key for symmetric cipher; "
+               "tried %d times!\n"), i);
 }
 
 
@@ -64,15 +75,15 @@ make_session_key( DEK *dek )
  * for packing the session key.
  * returns: A mpi with the session key (caller must free)
  */
-MPI
-encode_session_key( DEK *dek, unsigned nbits )
+gcry_mpi_t
+encode_session_key (DEK *dek, unsigned int nbits)
 {
     int nframe = (nbits+7) / 8;
     byte *p;
     byte *frame;
     int i,n;
     u16 csum;
-    MPI a;
+    gcry_mpi_t a;
 
     /* the current limitation is that we can only use a session key
      * whose length is a multiple of BITS_PER_MPI_LIMB
@@ -99,13 +110,13 @@ encode_session_key( DEK *dek, unsigned nbits )
     for( p = dek->key, i=0; i < dek->keylen; i++ )
 	csum += *p++;
 
-    frame = m_alloc_secure( nframe );
+    frame = gcry_xmalloc_secure ( nframe );
     n = 0;
     frame[n++] = 0;
     frame[n++] = 2;
     i = nframe - 6 - dek->keylen;
     assert( i > 0 );
-    p = get_random_bits( i*8, 1, 1 );
+    p = gcry_random_bytes_secure (i, GCRY_STRONG_RANDOM);
     /* replace zero bytes by new values */
     for(;;) {
 	int j, k;
@@ -118,14 +129,14 @@ encode_session_key( DEK *dek, unsigned nbits )
 	if( !k )
 	    break; /* okay: no zero bytes */
 	k += k/128; /* better get some more */
-	pp = get_random_bits( k*8, 1, 1);
+	pp = gcry_random_bytes_secure( k, GCRY_STRONG_RANDOM);
 	for(j=0; j < i && k ; j++ )
 	    if( !p[j] )
 		p[j] = pp[--k];
-	m_free(pp);
+	xfree (pp);
     }
     memcpy( frame+n, p, i );
-    m_free(p);
+    xfree (p);
     n += i;
     frame[n++] = 0;
     frame[n++] = dek->algo;
@@ -133,21 +144,21 @@ encode_session_key( DEK *dek, unsigned nbits )
     frame[n++] = csum >>8;
     frame[n++] = csum;
     assert( n == nframe );
-    a = mpi_alloc_secure( (nframe+BYTES_PER_MPI_LIMB-1) / BYTES_PER_MPI_LIMB );
-    mpi_set_buffer( a, frame, nframe, 0 );
-    m_free(frame);
+    if (gcry_mpi_scan( &a, GCRYMPI_FMT_USG, frame, &nframe))
+      BUG();
+    xfree (frame);
     return a;
 }
 
 
-static MPI
-do_encode_md( MD_HANDLE md, int algo, size_t len, unsigned nbits,
+static gcry_mpi_t
+do_encode_md( gcry_md_hd_t md, int algo, size_t len, unsigned nbits,
 	      const byte *asn, size_t asnlen, int v3compathack )
 {
     int nframe = (nbits+7) / 8;
     byte *frame;
     int i,n;
-    MPI a;
+    gcry_mpi_t a;
 
     if( len + asnlen + 4  > nframe )
 	log_bug("can't encode a %d bit MD into a %d bits frame\n",
@@ -159,7 +170,7 @@ do_encode_md( MD_HANDLE md, int algo, size_t len, unsigned nbits,
      *
      * PAD consists of FF bytes.
      */
-    frame = md_is_secure(md)? m_alloc_secure( nframe ) : m_alloc( nframe );
+    frame = gcry_md_is_secure (md)? xmalloc_secure (nframe): xmalloc (nframe);
     n = 0;
     frame[n++] = 0;
     frame[n++] = v3compathack? algo : 1; /* block type */
@@ -168,13 +179,11 @@ do_encode_md( MD_HANDLE md, int algo, size_t len, unsigned nbits,
     memset( frame+n, 0xff, i ); n += i;
     frame[n++] = 0;
     memcpy( frame+n, asn, asnlen ); n += asnlen;
-    memcpy( frame+n, md_read(md, algo), len ); n += len;
+    memcpy( frame+n, gcry_md_read (md, algo), len ); n += len;
     assert( n == nframe );
-    a = md_is_secure(md)?
-	 mpi_alloc_secure( (nframe+BYTES_PER_MPI_LIMB-1) / BYTES_PER_MPI_LIMB )
-	 : mpi_alloc( (nframe+BYTES_PER_MPI_LIMB-1) / BYTES_PER_MPI_LIMB );
-    mpi_set_buffer( a, frame, nframe, 0 );
-    m_free(frame);
+    if (gcry_mpi_scan( &a, GCRYMPI_FMT_USG, frame, &nframe ))
+	BUG();
+    xfree (frame);
     return a;
 }
 
@@ -185,33 +194,40 @@ do_encode_md( MD_HANDLE md, int algo, size_t len, unsigned nbits,
  * which did put the algo identifier inseatd of the block type 1 into
  * the encoded value.  Setting this flag forces the old behaviour.
  */
-MPI
-encode_md_value( int pubkey_algo, MD_HANDLE md, int hash_algo,
-		 unsigned nbits, int v3compathack )
+gcry_mpi_t
+encode_md_value (int pubkey_algo, gcry_md_hd_t md, int hash_algo,
+		 unsigned int nbits, int v3compathack )
 {
-    int algo = hash_algo? hash_algo : md_get_algo(md);
-    const byte *asn;
-    size_t asnlen, mdlen;
-    MPI frame;
-
-    if( pubkey_algo == PUBKEY_ALGO_DSA ) {
-        mdlen = md_digest_length (hash_algo);
-        if (mdlen != 20) {
-            log_error (_("DSA requires the use of a 160 bit hash algorithm\n"));
-            return NULL;
+  int algo = hash_algo? hash_algo : gcry_md_get_algo (md);
+  gcry_mpi_t frame;
+  
+  if (pubkey_algo == GCRY_PK_DSA) 
+    {
+      size_t n = gcry_md_get_algo_dlen(hash_algo);
+      if (n != 20)
+        {
+          log_error (_("DSA requires the use of a 160 bit hash algorithm\n"));
+          return NULL;
         }
-
-	frame = md_is_secure(md)? mpi_alloc_secure((md_digest_length(hash_algo)
-				 +BYTES_PER_MPI_LIMB-1) / BYTES_PER_MPI_LIMB )
-				: mpi_alloc((md_digest_length(hash_algo)
-				 +BYTES_PER_MPI_LIMB-1) / BYTES_PER_MPI_LIMB );
-	mpi_set_buffer( frame, md_read(md, hash_algo),
-			       md_digest_length(hash_algo), 0 );
+      if (gcry_mpi_scan( &frame, GCRYMPI_FMT_USG,
+                         gcry_md_read (md, hash_algo), &n ) )
+        BUG();
     }
-    else {
-       asn = md_asn_oid( algo, &asnlen, &mdlen );
-       frame = do_encode_md( md, algo, mdlen, nbits, asn, asnlen, v3compathack);
+  else
+    {
+      byte *asn;
+      size_t asnlen;
+      
+      if( gcry_md_algo_info( algo, GCRYCTL_GET_ASNOID, NULL, &asnlen ) )
+        log_fatal("can't get OID of algo %d: %s\n",
+                  algo, gcry_strerror(-1));
+      asn = xmalloc (asnlen);
+      if( gcry_md_algo_info( algo, GCRYCTL_GET_ASNOID, asn, &asnlen ) )
+        BUG();
+      frame = do_encode_md( md, algo, gcry_md_get_algo_dlen( algo ),
+                            nbits, asn, asnlen, v3compathack );
+      xfree (asn);
     }
-    return frame;
+  return frame;
 }
 
diff --git a/g10/sig-check.c b/g10/sig-check.c
index c99187928..ae5c32eaf 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -1,5 +1,6 @@
 /* sig-check.c -  Check a signature
- * Copyright (C) 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002,
+ *               2003  Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -23,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+
+#include "gpg.h"
 #include "util.h"
 #include "packet.h"
 #include "memory.h"
@@ -33,6 +36,7 @@
 #include "status.h"
 #include "i18n.h"
 #include "options.h"
+#include "pkglue.h"
 
 struct cmp_help_context_s {
     PKT_signature *sig;
@@ -59,7 +63,7 @@ int
 signature_check2( PKT_signature *sig, MD_HANDLE digest,
 		  u32 *r_expiredate, int *r_expired )
 {
-    PKT_public_key *pk = m_alloc_clear( sizeof *pk );
+    PKT_public_key *pk = xcalloc (1, sizeof *pk );
     int rc=0;
 
     *r_expiredate = 0;
@@ -69,14 +73,14 @@ signature_check2( PKT_signature *sig, MD_HANDLE digest,
        not match the actual sig, and also if the clearsign "Hash:"
        header is missing or does not match the actual sig. */
 
-    if(!md_algo_present(digest,sig->digest_algo)) {
+    if(!gcry_md_is_enabled (digest,sig->digest_algo)) {
         log_info(_("WARNING: signature digest conflict in message\n"));
-	rc=G10ERR_GENERAL;
+	rc=GPG_ERR_GENERAL;
     }
     else if( get_pubkey( pk, sig->keyid ) )
-	rc = G10ERR_NO_PUBKEY;
+	rc = GPG_ERR_NO_PUBKEY;
     else if(!pk->is_valid && !pk->is_primary)
-        rc=G10ERR_BAD_PUBKEY; /* you cannot have a good sig from an
+        rc=GPG_ERR_BAD_PUBKEY; /* you cannot have a good sig from an
 				 invalid subkey */
     else {
 	*r_expiredate = pk->expiredate;
@@ -93,116 +97,43 @@ signature_check2( PKT_signature *sig, MD_HANDLE digest,
 	 * not possible to sign more than one identical document within
 	 * one second.	Some remote batch processing applications might
 	 * like this feature here */
-	MD_HANDLE md;
+	gcry_md_hd_t md;
 	u32 a = sig->timestamp;
 	int i, nsig = pubkey_get_nsig( sig->pubkey_algo );
 	byte *p, *buffer;
 
-	md = md_open( DIGEST_ALGO_RMD160, 0);
-	md_putc( digest, sig->pubkey_algo );
-	md_putc( digest, sig->digest_algo );
-	md_putc( digest, (a >> 24) & 0xff );
-	md_putc( digest, (a >> 16) & 0xff );
-	md_putc( digest, (a >>	8) & 0xff );
-	md_putc( digest,  a	   & 0xff );
+	gcry_md_open (&md, GCRY_MD_RMD160, 0);
+	gcry_md_putc( digest, sig->pubkey_algo );
+	gcry_md_putc( digest, sig->digest_algo );
+	gcry_md_putc( digest, (a >> 24) & 0xff );
+	gcry_md_putc( digest, (a >> 16) & 0xff );
+	gcry_md_putc( digest, (a >>  8) & 0xff );
+	gcry_md_putc( digest,  a        & 0xff );
 	for(i=0; i < nsig; i++ ) {
-	    unsigned n = mpi_get_nbits( sig->data[i]);
-
-	    md_putc( md, n>>8);
-	    md_putc( md, n );
-	    p = mpi_get_buffer( sig->data[i], &n, NULL );
-	    md_write( md, p, n );
-	    m_free(p);
+	    size_t n;
+            void *tmp;
+
+	    if (gcry_mpi_aprint (GCRYMPI_FMT_USG, &tmp, &n, sig->data[i]))
+		BUG();
+            
+	    gcry_md_write (md, tmp, n);
+	    xfree (tmp);
 	}
-	md_final( md );
-	p = make_radix64_string( md_read( md, 0 ), 20 );
-	buffer = m_alloc( strlen(p) + 60 );
+	gcry_md_final( md );
+	p = make_radix64_string( gcry_md_read( md, 0 ), 20 );
+	buffer = xmalloc ( strlen(p) + 60 );
 	sprintf( buffer, "%s %s %lu",
 		 p, strtimestamp( sig->timestamp ), (ulong)sig->timestamp );
 	write_status_text( STATUS_SIG_ID, buffer );
-	m_free(buffer);
-	m_free(p);
-	md_close(md);
+	xfree (buffer);
+	xfree (p);
+	gcry_md_close(md);
     }
 
     return rc;
 }
 
 
-/****************
- * This function gets called by pubkey_verify() if the algorithm needs it.
- */
-static int
-cmp_help( void *opaque, MPI result )
-{
-#if 0 /* we do not use this anymore */
-    int rc=0, i, j, c, old_enc;
-    byte *dp;
-    const byte *asn;
-    size_t mdlen, asnlen;
-    struct cmp_help_context_s *ctx = opaque;
-    PKT_signature *sig = ctx->sig;
-    MD_HANDLE digest = ctx->md;
-
-    old_enc = 0;
-    for(i=j=0; (c=mpi_getbyte(result, i)) != -1; i++ ) {
-	if( !j ) {
-	    if( !i && c != 1 )
-		break;
-	    else if( i && c == 0xff )
-		; /* skip the padding */
-	    else if( i && !c )
-		j++;
-	    else
-		break;
-	}
-	else if( ++j == 18 && c != 1 )
-	    break;
-	else if( j == 19 && c == 0 ) {
-	    old_enc++;
-	    break;
-	}
-    }
-    if( old_enc ) {
-	log_error("old encoding scheme is not supported\n");
-	return G10ERR_GENERAL;
-    }
-
-    if( (rc=check_digest_algo(sig->digest_algo)) )
-	return rc; /* unsupported algo */
-    asn = md_asn_oid( sig->digest_algo, &asnlen, &mdlen );
-
-    for(i=mdlen,j=asnlen-1; (c=mpi_getbyte(result, i)) != -1 && j >= 0;
-							   i++, j-- )
-	if( asn[j] != c )
-	    break;
-    if( j != -1 || mpi_getbyte(result, i) )
-	return G10ERR_BAD_PUBKEY;  /* ASN is wrong */
-    for(i++; (c=mpi_getbyte(result, i)) != -1; i++ )
-	if( c != 0xff  )
-	    break;
-    i++;
-    if( c != sig->digest_algo || mpi_getbyte(result, i) ) {
-	/* Padding or leading bytes in signature is wrong */
-	return G10ERR_BAD_PUBKEY;
-    }
-    if( mpi_getbyte(result, mdlen-1) != sig->digest_start[0]
-	|| mpi_getbyte(result, mdlen-2) != sig->digest_start[1] ) {
-	/* Wrong key used to check the signature */
-	return G10ERR_BAD_PUBKEY;
-    }
-
-    dp = md_read( digest, sig->digest_algo );
-    for(i=mdlen-1; i >= 0; i--, dp++ ) {
-	if( mpi_getbyte( result, i ) != *dp )
-	    return G10ERR_BAD_SIGN;
-    }
-    return 0;
-#else
-    return -1;
-#endif
-}
-
 static int
 do_check_messages( PKT_public_key *pk, PKT_signature *sig, int *r_expired )
 {
@@ -213,7 +144,7 @@ do_check_messages( PKT_public_key *pk, PKT_signature *sig, int *r_expired )
 	log_info(_("key %08lX: this is a PGP generated "
 		   "ElGamal key which is NOT secure for signatures!\n"),
  		  (ulong)keyid_from_pk(pk,NULL));
-	return G10ERR_PUBKEY_ALGO;
+	return GPG_ERR_PUBKEY_ALGO;
     }
 
     if( pk->timestamp > sig->timestamp ) {
@@ -223,7 +154,7 @@ do_check_messages( PKT_public_key *pk, PKT_signature *sig, int *r_expired )
 	     : _("public key %08lX is %lu seconds newer than the signature\n"),
 	        (ulong)keyid_from_pk(pk,NULL),d );
 	if( !opt.ignore_time_conflict )
-	    return G10ERR_TIME_CONFLICT; /* pubkey newer than signature */
+	    return GPG_ERR_TIME_CONFLICT; /* pubkey newer than signature */
     }
 
     cur_time = make_timestamp();
@@ -235,7 +166,7 @@ do_check_messages( PKT_public_key *pk, PKT_signature *sig, int *r_expired )
 			   "in future (time warp or clock problem)\n"),
 		       (ulong)keyid_from_pk(pk,NULL),d );
 	if( !opt.ignore_time_conflict )
-	    return G10ERR_TIME_CONFLICT;
+	    return GPG_ERR_TIME_CONFLICT;
     }
 
     if( pk->expiredate && pk->expiredate < cur_time ) {
@@ -262,48 +193,49 @@ static int
 do_check( PKT_public_key *pk, PKT_signature *sig, MD_HANDLE digest,
 						    int *r_expired )
 {
-    MPI result = NULL;
+    gcry_mpi_t result = NULL;
     int rc=0;
     struct cmp_help_context_s ctx;
 
     if( (rc=do_check_messages(pk,sig,r_expired)) )
         return rc;
-    if( (rc=check_digest_algo(sig->digest_algo)) )
+    if( (rc=gcry_md_test_algo(sig->digest_algo)) )
 	return rc;
-    if( (rc=check_pubkey_algo(sig->pubkey_algo)) )
+    if( (rc=gcry_pk_test_algo(sig->pubkey_algo)) )
 	return rc;
 
-    /* make sure the digest algo is enabled (in case of a detached signature)*/
-    md_enable( digest, sig->digest_algo );
+    /* make sure the digest algo is enabled (in case of a detached
+       signature)*/
+    gcry_md_enable( digest, sig->digest_algo );
 
     /* complete the digest */
     if( sig->version >= 4 )
-	md_putc( digest, sig->version );
-    md_putc( digest, sig->sig_class );
+	gcry_md_putc( digest, sig->version );
+    gcry_md_putc( digest, sig->sig_class );
     if( sig->version < 4 ) {
 	u32 a = sig->timestamp;
-	md_putc( digest, (a >> 24) & 0xff );
-	md_putc( digest, (a >> 16) & 0xff );
-	md_putc( digest, (a >>	8) & 0xff );
-	md_putc( digest,  a	   & 0xff );
+	gcry_md_putc( digest, (a >> 24) & 0xff );
+	gcry_md_putc( digest, (a >> 16) & 0xff );
+	gcry_md_putc( digest, (a >>	8) & 0xff );
+	gcry_md_putc( digest,  a	   & 0xff );
     }
     else {
 	byte buf[6];
 	size_t n;
-	md_putc( digest, sig->pubkey_algo );
-	md_putc( digest, sig->digest_algo );
+	gcry_md_putc( digest, sig->pubkey_algo );
+	gcry_md_putc( digest, sig->digest_algo );
 	if( sig->hashed ) {
 	    n = sig->hashed->len;
-            md_putc (digest, (n >> 8) );
-            md_putc (digest,  n       );
-	    md_write (digest, sig->hashed->data, n);
+            gcry_md_putc (digest, (n >> 8) );
+            gcry_md_putc (digest,  n       );
+	    gcry_md_write (digest, sig->hashed->data, n);
 	    n += 6;
 	}
 	else {
 	  /* Two octets for the (empty) length of the hashed
              section. */
-          md_putc (digest, 0);
-	  md_putc (digest, 0);
+          gcry_md_putc (digest, 0);
+	  gcry_md_putc (digest, 0);
 	  n = 6;
 	}
 	/* add some magic */
@@ -313,38 +245,39 @@ do_check( PKT_public_key *pk, PKT_signature *sig, MD_HANDLE digest,
 	buf[3] = n >> 16;
 	buf[4] = n >>  8;
 	buf[5] = n;
-	md_write( digest, buf, 6 );
+	gcry_md_write( digest, buf, 6 );
     }
-    md_final( digest );
+    gcry_md_final (digest);
 
     result = encode_md_value( pk->pubkey_algo, digest, sig->digest_algo,
 			      mpi_get_nbits(pk->pkey[0]), 0 );
     if (!result)
-        return G10ERR_GENERAL;
+        return GPG_ERR_GENERAL;
     ctx.sig = sig;
     ctx.md = digest;
-    rc = pubkey_verify( pk->pubkey_algo, result, sig->data, pk->pkey,
-			cmp_help, &ctx );
-    mpi_free( result );
+    rc = pk_verify ( pk->pubkey_algo, result, sig->data, pk->pkey);
+    gcry_mpi_release ( result );
     if( (opt.emulate_bugs & EMUBUG_MDENCODE)
-	&& rc == G10ERR_BAD_SIGN && is_ELGAMAL(pk->pubkey_algo) ) {
+	&& gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE
+        && is_ELGAMAL(pk->pubkey_algo) ) {
 	/* In this case we try again because old GnuPG versions didn't encode
 	 * the hash right. There is no problem with DSA however  */
 	result = encode_md_value( pk->pubkey_algo, digest, sig->digest_algo,
 			      mpi_get_nbits(pk->pkey[0]), (sig->version < 5) );
         if (!result)
-            rc = G10ERR_GENERAL;
+            rc = GPG_ERR_GENERAL;
         else {
             ctx.sig = sig;
             ctx.md = digest;
-            rc = pubkey_verify( pk->pubkey_algo, result, sig->data, pk->pkey,
-                                cmp_help, &ctx );
+            rc = pk_verify (pk->pubkey_algo, result, sig->data, pk->pkey);
         }
     }
 
     if( !rc && sig->flags.unknown_critical ) {
-      log_info(_("assuming bad signature from key %08lX due to an unknown critical bit\n"),(ulong)keyid_from_pk(pk,NULL));
-	rc = G10ERR_BAD_SIGN;
+      log_info(_("assuming bad signature from key %08lX "
+                 "due to an unknown critical bit\n"),
+               (ulong)keyid_from_pk(pk,NULL));
+	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
     }
 
     return rc;
@@ -365,9 +298,9 @@ hash_uid_node( KBNODE unode, MD_HANDLE md, PKT_signature *sig )
 	    buf[2] = uid->attrib_len >> 16;
 	    buf[3] = uid->attrib_len >>  8;
 	    buf[4] = uid->attrib_len;
-	    md_write( md, buf, 5 );
+	    gcry_md_write( md, buf, 5 );
 	}
-	md_write( md, uid->attrib_data, uid->attrib_len );
+	gcry_md_write( md, uid->attrib_data, uid->attrib_len );
     }
     else {
 	if( sig->version >=4 ) {
@@ -377,9 +310,9 @@ hash_uid_node( KBNODE unode, MD_HANDLE md, PKT_signature *sig )
 	    buf[2] = uid->len >> 16;
 	    buf[3] = uid->len >>  8;
 	    buf[4] = uid->len;
-	    md_write( md, buf, 5 );
+	    gcry_md_write( md, buf, 5 );
 	}
-	md_write( md, uid->name, uid->len );
+	gcry_md_write( md, uid->name, uid->len );
     }
 }
 
@@ -390,7 +323,7 @@ cache_sig_result ( PKT_signature *sig, int result )
         sig->flags.checked = 1;
         sig->flags.valid = 1;
     }
-    else if ( result == G10ERR_BAD_SIGN ) {
+    else if ( gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE ) {
         sig->flags.checked = 1;
         sig->flags.valid = 0;
     }
@@ -418,7 +351,7 @@ int
 check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
 {
   static int busy=0;
-  int i,rc=G10ERR_GENERAL;
+  int i,rc=GPG_ERR_GENERAL;
 
   assert(IS_KEY_REV(sig));
   assert((sig->keyid[0]!=pk->keyid[0]) || (sig->keyid[0]!=pk->keyid[1]));
@@ -450,9 +383,9 @@ check_revocation_keys(PKT_public_key *pk,PKT_signature *sig)
     
           if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
 	    {
-              MD_HANDLE md;
+              gcry_md_hd_t md;
     
-              md=md_open(sig->digest_algo,0);
+              gcry_md_open (&md, sig->digest_algo,0);
               hash_public_key(md,pk);
               rc=signature_check(sig,md);
 	      cache_sig_result(sig,rc);
@@ -513,12 +446,12 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
 	    }
 	    if((rc=do_check_messages(pk,sig,r_expired)))
 	      return rc;
-            return sig->flags.valid? 0 : G10ERR_BAD_SIGN;
+            return sig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);
         }
     }
 
-    if( (rc=check_digest_algo(algo)) )
-	return rc;
+    if( (rc=gcry_md_test_algo(algo)) )
+      return rc;
 
     if( sig->sig_class == 0x20 ) { /* key revocation */
         u32 keyid[2];	
@@ -529,30 +462,30 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
 	  rc=check_revocation_keys(pk,sig);
 	else
 	  {
-	    md = md_open( algo, 0 );
+	    gcry_md_open (&md, algo, 0 );
 	    hash_public_key( md, pk );
 	    rc = do_check( pk, sig, md, r_expired );
 	    cache_sig_result ( sig, rc );
-	    md_close(md);
+	    gcry_md_close(md);
 	  }
     }
     else if( sig->sig_class == 0x28 ) { /* subkey revocation */
 	KBNODE snode = find_prev_kbnode( root, node, PKT_PUBLIC_SUBKEY );
 
 	if( snode ) {
-	    md = md_open( algo, 0 );
+	    gcry_md_open (&md, algo, 0 );
 	    hash_public_key( md, pk );
 	    hash_public_key( md, snode->pkt->pkt.public_key );
 	    rc = do_check( pk, sig, md, r_expired );
             cache_sig_result ( sig, rc );
-	    md_close(md);
+	    gcry_md_close(md);
 	}
 	else {
             if (!opt.quiet)
                 log_info (_("key %08lX: no subkey for subkey "
 			    "revocation signature\n"),
                           (ulong)keyid_from_pk (pk, NULL));
-	    rc = G10ERR_SIG_CLASS;
+	    rc = GPG_ERR_SIG_CLASS;
 	}
     }
     else if( sig->sig_class == 0x18 ) { /* key binding */
@@ -566,27 +499,27 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
 		if( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1] )
 		    *is_selfsig = 1;
 	    }
-	    md = md_open( algo, 0 );
+	    gcry_md_open (&md, algo, 0 );
 	    hash_public_key( md, pk );
 	    hash_public_key( md, snode->pkt->pkt.public_key );
 	    rc = do_check( pk, sig, md, r_expired );
             cache_sig_result ( sig, rc );
-	    md_close(md);
+	    gcry_md_close(md);
 	}
 	else {
             if (opt.verbose)
                 log_info(_("key %08lX: no subkey for subkey "
 			   "binding signature\n"),
 			 (ulong)keyid_from_pk (pk, NULL));
-	    rc = G10ERR_SIG_CLASS;
+	    rc = GPG_ERR_SIG_CLASS;
 	}
     }
     else if( sig->sig_class == 0x1f ) { /* direct key signature */
-	md = md_open( algo, 0 );
+	gcry_md_open (&md, algo, 0 );
 	hash_public_key( md, pk );
 	rc = do_check( pk, sig, md, r_expired );
         cache_sig_result ( sig, rc );
-	md_close(md);
+	gcry_md_close(md);
     }
     else { /* all other classes */
 	KBNODE unode = find_prev_kbnode( root, node, PKT_USER_ID );
@@ -595,7 +528,7 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
 	    u32 keyid[2];
 
 	    keyid_from_pk( pk, keyid );
-	    md = md_open( algo, 0 );
+	    gcry_md_open (&md, algo, 0 );
 	    hash_public_key( md, pk );
 	    hash_uid_node( unode, md, sig );
 	    if( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1] )
@@ -610,14 +543,14 @@ check_key_signature2( KBNODE root, KBNODE node, PKT_public_key *check_pk,
 	      rc = signature_check2( sig, md, r_expiredate, r_expired );
 
             cache_sig_result ( sig, rc );
-	    md_close(md);
+	    gcry_md_close(md);
 	}
 	else {
             if (!opt.quiet)
                 log_info ("key %08lX: no user ID for key signature packet "
                           "of class %02x\n",
                           (ulong)keyid_from_pk (pk, NULL), sig->sig_class );
-	    rc = G10ERR_SIG_CLASS;
+	    rc = GPG_ERR_SIG_CLASS;
 	}
     }
 
diff --git a/g10/sign.c b/g10/sign.c
index 73286fcb3..fa9e9ea3f 100644
--- a/g10/sign.c
+++ b/g10/sign.c
@@ -40,7 +40,7 @@
 #include "trustdb.h"
 #include "status.h"
 #include "i18n.h"
-
+#include "pkglue.h"
 
 #ifdef HAVE_DOSISH_SYSTEM
 #define LF "\r\n"
@@ -103,11 +103,11 @@ mk_notation_and_policy( PKT_signature *sig,
 	  {
 	    log_error(_("WARNING: unable to %%-expand notation "
 			"(too large).  Using unexpanded.\n"));
-	    expanded=m_strdup(s);
+	    expanded=xstrdup (s);
 	  }
 
 	n2 = strlen(expanded);
-	buf = m_alloc( 8 + n1 + n2 );
+	buf = xmalloc ( 8 + n1 + n2 );
 	buf[0] = 0x80; /* human readable */
 	buf[1] = buf[2] = buf[3] = 0;
 	buf[4] = n1 >> 8;
@@ -119,8 +119,8 @@ mk_notation_and_policy( PKT_signature *sig,
 	build_sig_subpkt( sig, SIGSUBPKT_NOTATION
 			  | ((nd->flags & 1)? SIGSUBPKT_FLAG_CRITICAL:0),
 			  buf, 8+n1+n2 );
-	m_free(expanded);
-	m_free(buf);
+	xfree (expanded);
+	xfree (buf);
     }
 
     if(opt.list_options&LIST_SHOW_NOTATION)
@@ -151,14 +151,14 @@ mk_notation_and_policy( PKT_signature *sig,
 	  {
 	    log_error(_("WARNING: unable to %%-expand policy url "
 			"(too large).  Using unexpanded.\n"));
-	    s=m_strdup(string);
+	    s=xstrdup (string);
 	  }
 
 	build_sig_subpkt(sig,SIGSUBPKT_POLICY|
 			 ((pu->flags & 1)?SIGSUBPKT_FLAG_CRITICAL:0),
 			 s,strlen(s));
 
-	m_free(s);
+	xfree (s);
       }
 
     if(opt.list_options&LIST_SHOW_POLICY)
@@ -189,13 +189,13 @@ hash_uid (MD_HANDLE md, int sigversion, const PKT_user_id *uid)
 	  buf[3] = uid->len >>  8;
 	  buf[4] = uid->len;
 	}
-        md_write( md, buf, 5 );
+        gcry_md_write( md, buf, 5 );
     }
 
     if(uid->attrib_data)
-      md_write (md, uid->attrib_data, uid->attrib_len );
+      gcry_md_write (md, uid->attrib_data, uid->attrib_len );
     else
-      md_write (md, uid->name, uid->len );
+      gcry_md_write (md, uid->name, uid->len );
 }
 
 
@@ -206,31 +206,31 @@ static void
 hash_sigversion_to_magic (MD_HANDLE md, const PKT_signature *sig)
 {
     if (sig->version >= 4) 
-        md_putc (md, sig->version);
-    md_putc (md, sig->sig_class);
+        gcry_md_putc (md, sig->version);
+    gcry_md_putc (md, sig->sig_class);
     if (sig->version < 4) {
         u32 a = sig->timestamp;
-        md_putc (md, (a >> 24) & 0xff );
-        md_putc (md, (a >> 16) & 0xff );
-        md_putc (md, (a >>  8) & 0xff );
-        md_putc (md,  a	       & 0xff );
+        gcry_md_putc (md, (a >> 24) & 0xff );
+        gcry_md_putc (md, (a >> 16) & 0xff );
+        gcry_md_putc (md, (a >>  8) & 0xff );
+        gcry_md_putc (md,  a	       & 0xff );
     }
     else {
         byte buf[6];
         size_t n;
         
-        md_putc (md, sig->pubkey_algo);
-        md_putc (md, sig->digest_algo);
+        gcry_md_putc (md, sig->pubkey_algo);
+        gcry_md_putc (md, sig->digest_algo);
         if (sig->hashed) {
             n = sig->hashed->len;
-            md_putc (md, (n >> 8) );
-            md_putc (md,  n       );
-            md_write (md, sig->hashed->data, n );
+            gcry_md_putc (md, (n >> 8) );
+            gcry_md_putc (md,  n       );
+            gcry_md_write (md, sig->hashed->data, n );
             n += 6;
         }
         else {
-            md_putc (md, 0);  /* always hash the length of the subpacket*/
-            md_putc (md, 0);
+            gcry_md_putc (md, 0);  /* always hash the length of the subpacket*/
+            gcry_md_putc (md, 0);
             n = 6;
         }
         /* add some magic */
@@ -240,7 +240,7 @@ hash_sigversion_to_magic (MD_HANDLE md, const PKT_signature *sig)
         buf[3] = n >> 16;
         buf[4] = n >>  8;
         buf[5] = n;
-        md_write (md, buf, 6);
+        gcry_md_write (md, buf, 6);
     }
 }
 
@@ -249,7 +249,7 @@ static int
 do_sign( PKT_secret_key *sk, PKT_signature *sig,
 	 MD_HANDLE md, int digest_algo )
 {
-    MPI frame;
+    gcry_mpi_t frame;
     byte *dp;
     int rc;
 
@@ -260,61 +260,60 @@ do_sign( PKT_secret_key *sk, PKT_signature *sig,
 		       : _("key has been created %lu seconds "
 			   "in future (time warp or clock problem)\n"), d );
 	if( !opt.ignore_time_conflict )
-	    return G10ERR_TIME_CONFLICT;
+	    return GPG_ERR_TIME_CONFLICT;
     }
 
 
     print_pubkey_algo_note(sk->pubkey_algo);
 
     if( !digest_algo )
-	digest_algo = md_get_algo(md);
+	digest_algo = gcry_md_get_algo(md);
 
     print_digest_algo_note( digest_algo );
-    dp = md_read( md, digest_algo );
+    dp = gcry_md_read ( md, digest_algo );
     sig->digest_algo = digest_algo;
     sig->digest_start[0] = dp[0];
     sig->digest_start[1] = dp[1];
     frame = encode_md_value( sk->pubkey_algo, md,
 			     digest_algo, mpi_get_nbits(sk->skey[0]), 0 );
     if (!frame)
-        return G10ERR_GENERAL;
-    rc = pubkey_sign( sk->pubkey_algo, sig->data, frame, sk->skey );
-    mpi_free(frame);
+        return GPG_ERR_GENERAL;
+    rc = pk_sign( sk->pubkey_algo, sig->data, frame, sk->skey );
+    gcry_mpi_release (frame);
     if (!rc && !opt.no_sig_create_check) {
         /* check that the signature verification worked and nothing is
          * fooling us e.g. by a bug in the signature create
          * code or by deliberately introduced faults. */
-        PKT_public_key *pk = m_alloc_clear (sizeof *pk);
+        PKT_public_key *pk = xcalloc (1,sizeof *pk);
 
         if( get_pubkey( pk, sig->keyid ) )
-            rc = G10ERR_NO_PUBKEY;
+            rc = GPG_ERR_NO_PUBKEY;
         else {
             frame = encode_md_value (pk->pubkey_algo, md,
                                      sig->digest_algo,
                                      mpi_get_nbits(pk->pkey[0]), 0);
             if (!frame)
-                rc = G10ERR_GENERAL;
+                rc = GPG_ERR_GENERAL;
             else
-                rc = pubkey_verify (pk->pubkey_algo, frame,
-                                    sig->data, pk->pkey,
-                                    NULL, NULL );
-            mpi_free (frame);
+                rc = pk_verify (pk->pubkey_algo, frame,
+                                sig->data, pk->pkey);
+            gcry_mpi_release (frame);
         }
         if (rc)
             log_error (_("checking created signature failed: %s\n"),
-                         g10_errstr (rc));
+                         gpg_strerror (rc));
         free_public_key (pk);
     }
     if( rc )
-	log_error(_("signing failed: %s\n"), g10_errstr(rc) );
+	log_error(_("signing failed: %s\n"), gpg_strerror (rc) );
     else {
 	if( opt.verbose ) {
 	    char *ustr = get_user_id_string_printable (sig->keyid);
 	    log_info(_("%s/%s signature from: \"%s\"\n"),
-		     pubkey_algo_to_string(sk->pubkey_algo),
-		     digest_algo_to_string(sig->digest_algo),
+		     gcry_pk_algo_name (sk->pubkey_algo),
+		     gcry_md_algo_name (sig->digest_algo),
 		     ustr );
-	    m_free(ustr);
+	    xfree (ustr);
 	}
     }
     return rc;
@@ -354,7 +353,7 @@ hash_for(int pubkey_algo, int packet_version )
 	  prefitem_t *prefs;
 
 	  for(prefs=opt.personal_digest_prefs;prefs->type;prefs++)
-	    if(md_digest_length(prefs->value)==20)
+	    if(gcry_md_get_algo_dlen (prefs->value) == 20)
 	      return prefs->value;
 	}
 
@@ -415,7 +414,7 @@ print_status_sig_created ( PKT_secret_key *sk, PKT_signature *sig, int what )
  * packet here in reverse order 
  */
 static int
-write_onepass_sig_packets (SK_LIST sk_list, IOBUF out, int sigclass )
+write_onepass_sig_packets (SK_LIST sk_list, iobuf_t out, int sigclass )
 {
     int skcount;
     SK_LIST sk_rover;
@@ -435,7 +434,7 @@ write_onepass_sig_packets (SK_LIST sk_list, IOBUF out, int sigclass )
         }
 
         sk = sk_rover->sk;
-        ops = m_alloc_clear (sizeof *ops);
+        ops = xcalloc (1,sizeof *ops);
         ops->sig_class = sigclass;
         ops->digest_algo = hash_for (sk->pubkey_algo, sk->version);
         ops->pubkey_algo = sk->pubkey_algo;
@@ -449,7 +448,7 @@ write_onepass_sig_packets (SK_LIST sk_list, IOBUF out, int sigclass )
         free_packet (&pkt);
         if (rc) {
             log_error ("build onepass_sig packet failed: %s\n",
-                       g10_errstr(rc));
+                       gpg_strerror (rc));
             return rc;
         }
     }
@@ -461,7 +460,7 @@ write_onepass_sig_packets (SK_LIST sk_list, IOBUF out, int sigclass )
  * Helper to write the plaintext (literal data) packet
  */
 static int
-write_plaintext_packet (IOBUF out, IOBUF inp, const char *fname, int ptmode)
+write_plaintext_packet (iobuf_t out, iobuf_t inp, const char *fname, int ptmode)
 {
     PKT_plaintext *pt = NULL;
     u32 filesize;
@@ -470,15 +469,15 @@ write_plaintext_packet (IOBUF out, IOBUF inp, const char *fname, int ptmode)
     if (!opt.no_literal) {
         if (fname || opt.set_filename) {
             char *s = make_basename (opt.set_filename? opt.set_filename
-                                                     : fname,
-                                     iobuf_get_real_fname(inp));
-            pt = m_alloc (sizeof *pt + strlen(s) - 1);
+                                                     : fname
+                                     /*, iobuf_get_real_fname(inp)*/);
+            pt = xmalloc (sizeof *pt + strlen(s) - 1);
             pt->namelen = strlen (s);
             memcpy (pt->name, s, pt->namelen);
-            m_free (s);
+            xfree (s);
         }
         else { /* no filename */
-            pt = m_alloc (sizeof *pt - 1);
+            pt = xmalloc (sizeof *pt - 1);
             pt->namelen = 0;
         }
     }
@@ -519,7 +518,7 @@ write_plaintext_packet (IOBUF out, IOBUF inp, const char *fname, int ptmode)
         /*cfx.datalen = filesize? calc_packet_length( &pkt ) : 0;*/
         if( (rc = build_packet (out, &pkt)) )
             log_error ("build_packet(PLAINTEXT) failed: %s\n",
-                       g10_errstr(rc) );
+                       gpg_strerror (rc) );
         pt->buf = NULL;
     }
     else {
@@ -527,10 +526,9 @@ write_plaintext_packet (IOBUF out, IOBUF inp, const char *fname, int ptmode)
         int  bytes_copied;
 
         while ((bytes_copied = iobuf_read(inp, copy_buffer, 4096)) != -1)
-            if (iobuf_write(out, copy_buffer, bytes_copied) == -1) {
-                rc = G10ERR_WRITE_FILE;
+            if ( (rc=iobuf_write(out, copy_buffer, bytes_copied) )) {
                 log_error ("copying input to output failed: %s\n",
-                           g10_errstr(rc));
+                           gpg_strerror (rc));
                 break;
             }
         wipememory(copy_buffer,4096); /* burn buffer */
@@ -545,7 +543,7 @@ write_plaintext_packet (IOBUF out, IOBUF inp, const char *fname, int ptmode)
  * hash which will not be changes here.
  */
 static int
-write_signature_packets (SK_LIST sk_list, IOBUF out, MD_HANDLE hash,
+write_signature_packets (SK_LIST sk_list, iobuf_t out, MD_HANDLE hash,
                          int sigclass, u32 timestamp, u32 duration,
 			 int status_letter)
 {
@@ -561,7 +559,7 @@ write_signature_packets (SK_LIST sk_list, IOBUF out, MD_HANDLE hash,
 	sk = sk_rover->sk;
 
 	/* build the signature packet */
-	sig = m_alloc_clear (sizeof *sig);
+	sig = xcalloc (1,sizeof *sig);
 	if(opt.force_v3_sigs || RFC1991)
 	  sig->version=3;
 	else if(duration || opt.sig_policy_url || opt.sig_notation_data)
@@ -579,17 +577,17 @@ write_signature_packets (SK_LIST sk_list, IOBUF out, MD_HANDLE hash,
 	  sig->expiredate = sig->timestamp+duration;
 	sig->sig_class = sigclass;
 
-	md = md_copy (hash);
+	gcry_md_copy (&md, hash);
 
 	if (sig->version >= 4)
 	    build_sig_subpkt_from_sig (sig);
 	mk_notation_and_policy (sig, NULL, sk);
 
         hash_sigversion_to_magic (md, sig);
-	md_final (md);
+	gcry_md_final (md);
 
 	rc = do_sign( sk, sig, md, hash_for (sig->pubkey_algo, sk->version) );
-	md_close (md);
+	gcry_md_close (md);
 
 	if( !rc ) { /* and write it */
             PACKET pkt;
@@ -604,7 +602,7 @@ write_signature_packets (SK_LIST sk_list, IOBUF out, MD_HANDLE hash,
 	    free_packet (&pkt);
 	    if (rc)
 		log_error ("build signature packet failed: %s\n",
-                           g10_errstr(rc) );
+                           gpg_strerror (rc) );
 	}
 	if( rc )
 	    return rc;;
@@ -636,7 +634,7 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
     text_filter_context_t tfx;
     progress_filter_context_t pfx;
     encrypt_filter_context_t efx;
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     PACKET pkt;
     int rc = 0;
     PK_LIST pk_list = NULL;
@@ -682,9 +680,9 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 	inp = NULL; /* we do it later */
     else {
         if( !(inp = iobuf_open(fname)) ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error("can't open %s: %s\n", fname? fname: "[stdin]",
 		      strerror(errno) );
-	    rc = G10ERR_OPEN_FILE;
 	    goto leave;
 	}
 
@@ -693,8 +691,8 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 
     if( outfile ) {
 	if( !(out = iobuf_create( outfile )) ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error(_("can't create %s: %s\n"), outfile, strerror(errno) );
-	    rc = G10ERR_CREATE_FILE;
 	    goto leave;
 	}
 	else if( opt.verbose )
@@ -710,7 +708,7 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 	iobuf_push_filter( inp, text_filter, &tfx );
       }
 
-    mfx.md = md_open(0, 0);
+    gcry_md_open (&mfx.md, 0, 0);
 
    /* If we're encrypting and signing, it is reasonable to pick the
        hash algorithm to use out of the recepient key prefs. */
@@ -724,7 +722,7 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 				      NULL)!=opt.def_digest_algo)
 	  log_info(_("forcing digest algorithm %s (%d) "
 		     "violates recipient preferences\n"),
-		   digest_algo_to_string(opt.def_digest_algo),
+		   gcry_md_algo_name (opt.def_digest_algo),
 		   opt.def_digest_algo);
 	  }
 	else
@@ -752,7 +750,7 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 
     for( sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next ) {
 	PKT_secret_key *sk = sk_rover->sk;
-	md_enable(mfx.md, hash_for(sk->pubkey_algo, sk->version ));
+	gcry_md_enable (mfx.md, hash_for(sk->pubkey_algo, sk->version ));
     }
 
     if( !multifile )
@@ -822,9 +820,9 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
 	    for( sl = strlist_last(filenames); sl;
 			sl = strlist_prev( filenames, sl ) ) {
 		if( !(inp = iobuf_open(sl->d)) ) {
+                    rc = gpg_error_from_errno (errno);
 		    log_error(_("can't open %s: %s\n"),
 					    sl->d, strerror(errno) );
-		    rc = G10ERR_OPEN_FILE;
 		    goto leave;
 		}
                 handle_progress (&pfx, inp, sl->d);
@@ -875,7 +873,7 @@ sign_file( STRLIST filenames, int detached, STRLIST locusr,
             write_status( STATUS_END_ENCRYPTION );
     }
     iobuf_close(inp);
-    md_close( mfx.md );
+    gcry_md_close ( mfx.md );
     release_sk_list( sk_list );
     release_pk_list( pk_list );
     recipient_digest_algo=0;
@@ -893,7 +891,7 @@ clearsign_file( const char *fname, STRLIST locusr, const char *outfile )
     armor_filter_context_t afx;
     progress_filter_context_t pfx;
     MD_HANDLE textmd = NULL;
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     PACKET pkt;
     int rc = 0;
     SK_LIST sk_list = NULL;
@@ -923,17 +921,17 @@ clearsign_file( const char *fname, STRLIST locusr, const char *outfile )
 
     /* prepare iobufs */
     if( !(inp = iobuf_open(fname)) ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("can't open %s: %s\n", fname? fname: "[stdin]",
 					strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
     handle_progress (&pfx, inp, fname);
 
     if( outfile ) {
 	if( !(out = iobuf_create( outfile )) ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error(_("can't create %s: %s\n"), outfile, strerror(errno) );
-	    rc = G10ERR_CREATE_FILE;
 	    goto leave;
 	}
 	else if( opt.verbose )
@@ -966,7 +964,7 @@ clearsign_file( const char *fname, STRLIST locusr, const char *outfile )
 	    int i = hash_for(sk->pubkey_algo, sk->version);
 
 	    if( !hashs_seen[ i & 0xff ] ) {
-		s = digest_algo_to_string( i );
+		s = gcry_md_algo_name (i);
 		if( s ) {
 		    hashs_seen[ i & 0xff ] = 1;
 		    if( any )
@@ -985,13 +983,13 @@ clearsign_file( const char *fname, STRLIST locusr, const char *outfile )
 		  "NotDashEscaped: You need GnuPG to verify this message" LF );
     iobuf_writestr(out, LF );
 
-    textmd = md_open(0, 0);
+    gcry_md_open (&textmd, 0, 0);
     for( sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next ) {
 	PKT_secret_key *sk = sk_rover->sk;
-	md_enable(textmd, hash_for(sk->pubkey_algo, sk->version));
+	gcry_md_enable (textmd, hash_for(sk->pubkey_algo, sk->version));
     }
     if ( DBG_HASHING )
-	md_start_debug( textmd, "clearsign" );
+	gcry_md_start_debug ( textmd, "clearsign" );
     copy_clearsig_text( out, inp, textmd, !opt.not_dash_escaped,
 			opt.escape_from, (old_style && only_md5) );
     /* fixme: check for read errors */
@@ -1011,7 +1009,7 @@ clearsign_file( const char *fname, STRLIST locusr, const char *outfile )
     else
 	iobuf_close(out);
     iobuf_close(inp);
-    md_close( textmd );
+    gcry_md_close ( textmd );
     release_sk_list( sk_list );
     return rc;
 }
@@ -1029,7 +1027,7 @@ sign_symencrypt_file (const char *fname, STRLIST locusr)
     md_filter_context_t mfx;
     text_filter_context_t tfx;
     cipher_filter_context_t cfx;
-    IOBUF inp = NULL, out = NULL;
+    iobuf_t inp = NULL, out = NULL;
     PACKET pkt;
     STRING2KEY *s2k = NULL;
     int rc = 0;
@@ -1055,27 +1053,27 @@ sign_symencrypt_file (const char *fname, STRLIST locusr)
     /* prepare iobufs */
     inp = iobuf_open(fname);
     if( !inp ) {
+        rc = gpg_error_from_errno (errno);
 	log_error("can't open %s: %s\n", fname? fname: "[stdin]",
 					strerror(errno) );
-	rc = G10ERR_OPEN_FILE;
 	goto leave;
     }
     handle_progress (&pfx, inp, fname);
 
     /* prepare key */
-    s2k = m_alloc_clear( sizeof *s2k );
+    s2k = xcalloc (1, sizeof *s2k );
     s2k->mode = RFC1991? 0:opt.s2k_mode;
     s2k->hash_algo = opt.s2k_digest_algo;
 
     algo = default_cipher_algo();
     if (!opt.quiet || !opt.batch)
         log_info (_("%s encryption will be used\n"),
-		    cipher_algo_to_string(algo) );
+		    gcry_cipher_algo_name (algo) );
     cfx.dek = passphrase_to_dek( NULL, 0, algo, s2k, 2, NULL, NULL);
 
     if (!cfx.dek || !cfx.dek->keylen) {
-        rc = G10ERR_PASSPHRASE;
-        log_error(_("error creating passphrase: %s\n"), g10_errstr(rc) );
+        rc = gpg_error (GPG_ERR_INV_PASSPHRASE);
+        log_error(_("error creating passphrase: %s\n"), gpg_strerror (rc) );
         goto leave;
     }
 
@@ -1087,11 +1085,11 @@ sign_symencrypt_file (const char *fname, STRLIST locusr)
     /* prepare to calculate the MD over the input */
     if (opt.textmode)
 	iobuf_push_filter (inp, text_filter, &tfx);
-    mfx.md = md_open(0, 0);
+    gcry_md_open (&mfx.md, 0, 0);
 
     for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next) {
 	PKT_secret_key *sk = sk_rover->sk;
-	md_enable (mfx.md, hash_for (sk->pubkey_algo, sk->version ));
+	gcry_md_enable (mfx.md, hash_for (sk->pubkey_algo, sk->version ));
     }
 
     iobuf_push_filter (inp, md_filter, &mfx);
@@ -1103,15 +1101,15 @@ sign_symencrypt_file (const char *fname, STRLIST locusr)
     /* Write the symmetric key packet */
     /*(current filters: armor)*/
     if (!RFC1991) {
-	PKT_symkey_enc *enc = m_alloc_clear( sizeof *enc );
+	PKT_symkey_enc *enc = xcalloc (1, sizeof *enc );
 	enc->version = 4;
 	enc->cipher_algo = cfx.dek->algo;
 	enc->s2k = *s2k;
 	pkt.pkttype = PKT_SYMKEY_ENC;
 	pkt.pkt.symkey_enc = enc;
 	if( (rc = build_packet( out, &pkt )) )
-	    log_error("build symkey packet failed: %s\n", g10_errstr(rc) );
-	m_free(enc);
+	    log_error("build symkey packet failed: %s\n", gpg_strerror (rc) );
+	xfree (enc);
     }
 
     /* Push the encryption filter */
@@ -1157,9 +1155,9 @@ sign_symencrypt_file (const char *fname, STRLIST locusr)
     }
     iobuf_close(inp);
     release_sk_list( sk_list );
-    md_close( mfx.md );
-    m_free(cfx.dek);
-    m_free(s2k);
+    gcry_md_close ( mfx.md );
+    xfree (cfx.dek);
+    xfree (s2k);
     return rc;
 }
 
@@ -1224,7 +1222,7 @@ make_keysig_packet( PKT_signature **ret_sig, PKT_public_key *pk,
 	  digest_algo = DIGEST_ALGO_SHA1;
       }
 
-    md = md_open( digest_algo, 0 );
+    gcry_md_open (&md, digest_algo, 0 );
 
     /* hash the public key certificate and the user id */
     hash_public_key( md, pk );
@@ -1235,7 +1233,7 @@ make_keysig_packet( PKT_signature **ret_sig, PKT_public_key *pk,
         hash_uid (md, sigversion, uid);
     }
     /* and make the signature packet */
-    sig = m_alloc_clear( sizeof *sig );
+    sig = xcalloc (1, sizeof *sig );
     sig->version = sigversion;
     sig->flags.exportable=1;
     sig->flags.revocable=1;
@@ -1261,12 +1259,12 @@ make_keysig_packet( PKT_signature **ret_sig, PKT_public_key *pk,
 
     if( !rc ) {
         hash_sigversion_to_magic (md, sig);
-	md_final(md);
+	gcry_md_final (md);
 
 	rc = complete_sig( sig, sk, md );
     }
 
-    md_close( md );
+    gcry_md_close ( md );
     if( rc )
 	free_seckey_enc( sig );
     else
@@ -1299,9 +1297,9 @@ update_keysig_packet( PKT_signature **ret_sig,
     if ((!orig_sig || !pk || !sk)
 	|| (orig_sig->sig_class >= 0x10 && orig_sig->sig_class <= 0x13 && !uid)
 	|| (orig_sig->sig_class == 0x18 && !subpk))
-      return G10ERR_GENERAL;
+      return GPG_ERR_GENERAL;
 
-    md = md_open( orig_sig->digest_algo, 0 );
+    gcry_md_open (&md, orig_sig->digest_algo, 0);
 
     /* hash the public key certificate and the user id */
     hash_public_key( md, pk );
@@ -1344,12 +1342,12 @@ update_keysig_packet( PKT_signature **ret_sig,
 
     if (!rc) {
         hash_sigversion_to_magic (md, sig);
-	md_final(md);
+	gcry_md_final (md);
 
 	rc = complete_sig( sig, sk, md );
     }
 
-    md_close (md);
+    gcry_md_close (md);
     if( rc )
 	free_seckey_enc (sig);
     else
diff --git a/g10/signal.c b/g10/signal.c
index 1028ab705..90c0841d8 100644
--- a/g10/signal.c
+++ b/g10/signal.c
@@ -88,17 +88,17 @@ got_fatal_signal( int sig )
 	raise( sig );
     caught_fatal_sig = 1;
 
-    secmem_term();
+    gcry_control (GCRYCTL_TERM_SECMEM );
     /* better don't transtale these messages */
     write(2, "\n", 1 );
-    s = log_get_name(); if( s ) write(2, s, strlen(s) );
+    s = "?" /* FIXME: log_get_name()*/; if( s ) write(2, s, strlen(s) );
     write(2, ": ", 2 );
     s = get_signal_name(sig); write(2, s, strlen(s) );
     write(2, " caught ... exiting\n", 20 );
 
     /* reset action to default action and raise signal again */
     init_one_signal (sig, SIG_DFL, 0);
-    remove_lockfiles ();
+    dotlock_remove_lockfiles ();
 #ifdef __riscos__
     riscos_close_fds ();
 #endif /* __riscos__ */
diff --git a/g10/skclist.c b/g10/skclist.c
index 1f7a3919a..67d9eb2f9 100644
--- a/g10/skclist.c
+++ b/g10/skclist.c
@@ -43,41 +43,11 @@ release_sk_list( SK_LIST sk_list )
     for( ; sk_list; sk_list = sk_rover ) {
 	sk_rover = sk_list->next;
 	free_secret_key( sk_list->sk );
-	m_free( sk_list );
+	xfree ( sk_list );
     }
 }
 
 
-/* Check that we are only using keys which don't have
- * the string "(insecure!)" or "not secure" or "do not use"
- * in one of the user ids
- */
-static int
-is_insecure( PKT_secret_key *sk )
-{
-    u32 keyid[2];
-    KBNODE node = NULL, u;
-    int insecure = 0;
-
-    keyid_from_sk( sk, keyid );
-    node = get_pubkeyblock( keyid );
-    for ( u = node; u; u = u->next ) {
-        if ( u->pkt->pkttype == PKT_USER_ID ) {
-            PKT_user_id *id = u->pkt->pkt.user_id;
-            if ( id->attrib_data )
-                continue; /* skip attribute packets */
-            if ( strstr( id->name, "(insecure!)" )
-                 || strstr( id->name, "not secure" )
-                 || strstr( id->name, "do not use" ) ) {
-                insecure = 1;
-                break;
-            }
-        }
-    }
-    release_kbnode( node );
-    
-    return insecure;
-}
 
 static int
 key_present_in_sk_list(SK_LIST sk_list, PKT_secret_key *sk)
@@ -110,13 +80,13 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
     if( !locusr ) { /* use the default one */
 	PKT_secret_key *sk;
 
-	sk = m_alloc_clear( sizeof *sk );
+	sk = xcalloc (1, sizeof *sk );
 	sk->req_usage = use;
 	if( (rc = get_seckey_byname( sk, NULL, unlock )) ) {
 	    free_secret_key( sk ); sk = NULL;
-	    log_error("no default secret key: %s\n", g10_errstr(rc) );
+	    log_error("no default secret key: %s\n", gpg_strerror (rc) );
 	}
-	else if( !(rc=check_pubkey_algo2(sk->pubkey_algo, use)) ) {
+	else if( !(rc=openpgp_pk_test_algo (sk->pubkey_algo, use)) ) {
 	    SK_LIST r;
 
 	    if( sk->version == 4 && (use & PUBKEY_USAGE_SIG)
@@ -125,13 +95,8 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 		    "ElGamal key which is NOT secure for signatures!\n");
 		free_secret_key( sk ); sk = NULL;
 	    }
-	    else if( random_is_faked() && !is_insecure( sk ) ) {
-		log_info(_("key is not flagged as insecure - "
-			   "can't use it with the faked RNG!\n"));
-		free_secret_key( sk ); sk = NULL;
-	    }
 	    else {
-		r = m_alloc( sizeof *r );
+		r = xmalloc ( sizeof *r );
 		r->sk = sk; sk = NULL;
 		r->next = sk_list;
 		r->mark = 0;
@@ -140,7 +105,7 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 	}
 	else {
 	    free_secret_key( sk ); sk = NULL;
-	    log_error("invalid default secret key: %s\n", g10_errstr(rc) );
+	    log_error("invalid default secret key: %s\n", gpg_strerror (rc) );
 	}
     }
     else {
@@ -157,11 +122,11 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 		log_error(_("skipped `%s': duplicated\n"), locusr->d );
                 continue;
             }
-	    sk = m_alloc_clear( sizeof *sk );
+	    sk = xcalloc (1, sizeof *sk );
 	    sk->req_usage = use;
 	    if( (rc = get_seckey_byname( sk, locusr->d, 0 )) ) {
 		free_secret_key( sk ); sk = NULL;
-		log_error(_("skipped `%s': %s\n"), locusr->d, g10_errstr(rc) );
+		log_error(_("skipped `%s': %s\n"), locusr->d, gpg_strerror (rc) );
 	    }
             else if ( key_present_in_sk_list(sk_list, sk) == 0) {
                 free_secret_key(sk); sk = NULL;
@@ -169,9 +134,9 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
             }
             else if ( unlock && (rc = check_secret_key( sk, 0 )) ) {
 		free_secret_key( sk ); sk = NULL;
-		log_error(_("skipped `%s': %s\n"), locusr->d, g10_errstr(rc) );
+		log_error(_("skipped `%s': %s\n"), locusr->d, gpg_strerror (rc) );
             }
-	    else if( !(rc=check_pubkey_algo2(sk->pubkey_algo, use)) ) {
+	    else if( !(rc=openpgp_pk_test_algo (sk->pubkey_algo, use)) ) {
 		SK_LIST r;
 
 		if( sk->version == 4 && (use & PUBKEY_USAGE_SIG)
@@ -181,13 +146,8 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 			locusr->d );
 		    free_secret_key( sk ); sk = NULL;
 		}
-		else if( random_is_faked() && !is_insecure( sk ) ) {
-		    log_info(_("key is not flagged as insecure - "
-			       "can't use it with the faked RNG!\n"));
-		    free_secret_key( sk ); sk = NULL;
-		}
 		else {
-		    r = m_alloc( sizeof *r );
+		    r = xmalloc ( sizeof *r );
 		    r->sk = sk; sk = NULL;
 		    r->next = sk_list;
 		    r->mark = 0;
@@ -196,7 +156,7 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 	    }
 	    else {
 		free_secret_key( sk ); sk = NULL;
-		log_error("skipped `%s': %s\n", locusr->d, g10_errstr(rc) );
+		log_error("skipped `%s': %s\n", locusr->d, gpg_strerror (rc) );
 	    }
 	}
     }
@@ -204,7 +164,7 @@ build_sk_list( STRLIST locusr, SK_LIST *ret_sk_list,
 
     if( !rc && !sk_list ) {
 	log_error("no valid signators\n");
-	rc = G10ERR_NO_USER_ID;
+	rc = GPG_ERR_NO_USER_ID;
     }
 
     if( rc )
diff --git a/g10/status.c b/g10/status.c
index cc30db79b..32e59eef5 100644
--- a/g10/status.c
+++ b/g10/status.c
@@ -40,6 +40,8 @@
 #include <sys/mman.h>
 #endif
 #endif
+
+#include "gpg.h"
 #include "util.h"
 #include "status.h"
 #include "ttyio.h"
@@ -179,9 +181,12 @@ set_status_fd ( int fd )
                   fd, strerror(errno));
     }
     last_fd = fd;
+#warning fixme: register progress CBs
+#if 0
     register_primegen_progress ( progress_cb, "primegen" );
     register_pk_dsa_progress ( progress_cb, "pk_dsa" );
     register_pk_elg_progress ( progress_cb, "pk_elg" );
+#endif
 }
 
 int
@@ -453,7 +458,7 @@ do_shm_get( const char *keyword, int hidden, int bool )
     if( bool )
 	return p[0]? "" : NULL;
 
-    string = hidden? m_alloc_secure( n+1 ) : m_alloc( n+1 );
+    string = hidden? xmalloc_secure ( n+1 ) : xmalloc ( n+1 );
     memcpy(string, p, n );
     string[n] = 0; /* make sure it is a string */
     if( hidden ) /* invalidate the memory */
@@ -508,7 +513,7 @@ do_get_from_fd( const char *keyword, int hidden, int bool )
 	if( i >= len-1 ) {
 	    char *save = string;
 	    len += 100;
-	    string = hidden? m_alloc_secure ( len ) : m_alloc ( len );
+	    string = hidden? xmalloc_secure ( len ) : xmalloc ( len );
 	    if( save )
 		memcpy(string, save, i );
 	    else
@@ -579,7 +584,7 @@ cpr_get( const char *keyword, const char *prompt )
     for(;;) {
 	p = tty_get( prompt );
 	if( *p=='?' && !p[1] && !(keyword && !*keyword)) {
-	    m_free(p);
+	    xfree (p);
 	    display_online_help( keyword );
 	}
 	else
@@ -595,7 +600,7 @@ cpr_get_utf8( const char *keyword, const char *prompt )
     p = cpr_get( keyword, prompt );
     if( p ) {
 	char *utf8 = native_to_utf8( p );
-	m_free( p );
+	xfree ( p );
 	p = utf8;
     }
     return p;
@@ -615,7 +620,7 @@ cpr_get_hidden( const char *keyword, const char *prompt )
     for(;;) {
 	p = tty_get_hidden( prompt );
 	if( *p == '?' && !p[1] ) {
-	    m_free(p);
+	    xfree (p);
 	    display_online_help( keyword );
 	}
 	else
@@ -652,13 +657,13 @@ cpr_get_answer_is_yes( const char *keyword, const char *prompt )
 	p = tty_get( prompt );
 	trim_spaces(p); /* it is okay to do this here */
 	if( *p == '?' && !p[1] ) {
-	    m_free(p);
+	    xfree (p);
 	    display_online_help( keyword );
 	}
 	else {
 	    tty_kill_prompt();
 	    yes = answer_is_yes(p);
-	    m_free(p);
+	    xfree (p);
 	    return yes;
 	}
     }
@@ -680,13 +685,13 @@ cpr_get_answer_yes_no_quit( const char *keyword, const char *prompt )
 	p = tty_get( prompt );
 	trim_spaces(p); /* it is okay to do this here */
 	if( *p == '?' && !p[1] ) {
-	    m_free(p);
+	    xfree (p);
 	    display_online_help( keyword );
 	}
 	else {
 	    tty_kill_prompt();
 	    yes = answer_is_yes_no_quit(p);
-	    m_free(p);
+	    xfree (p);
 	    return yes;
 	}
     }
diff --git a/g10/tdbdump.c b/g10/tdbdump.c
index cd46f1f5a..3f9e8b388 100644
--- a/g10/tdbdump.c
+++ b/g10/tdbdump.c
@@ -1,5 +1,5 @@
 /* tdbdump.c
- * Copyright (C) 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -30,6 +30,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "keydb.h"
@@ -57,7 +58,7 @@ write_record( TRUSTREC *rec )
     if( !rc )
 	return;
     log_error(_("trust record %lu, type %d: write failed: %s\n"),
-			    rec->recnum, rec->rectype, g10_errstr(rc) );
+			    rec->recnum, rec->rectype, gpg_strerror (rc) );
     tdbio_invalid();
 }
 
@@ -137,7 +138,7 @@ import_ownertrust( const char *fname )
 	is_stdin = 1;
     }
     else if( !(fp = fopen( fname, "r" )) ) {
-	log_error_f(fname, _("can't open file: %s\n"), strerror(errno) );
+	log_error ( _("can't open `%s': %s\n"), fname, strerror(errno) );
 	return;
     }
 
@@ -148,7 +149,7 @@ import_ownertrust( const char *fname )
 	    continue;
 	n = strlen(line);
 	if( line[n-1] != '\n' ) {
-	    log_error_f(fname, _("line too long\n") );
+	    log_error (_("\b%s: line too long\n"), fname );
 	    /* ... or last line does not have a LF */
 	    break; /* can't continue */
 	}
@@ -156,16 +157,16 @@ import_ownertrust( const char *fname )
 	    if( !isxdigit(*p) )
 		break;
 	if( *p != ':' ) {
-	    log_error_f(fname, _("error: missing colon\n") );
+	    log_error (_("\b%s: error: missing colon\n"), fname );
 	    continue;
 	}
 	fprlen = p - line;
 	if( fprlen != 32 && fprlen != 40 ) {
-	    log_error_f(fname, _("error: invalid fingerprint\n") );
+	    log_error (_("\b%s: error: invalid fingerprint\n"), fname );
 	    continue;
 	}
 	if( sscanf(p, ":%u:", &otrust ) != 1 ) {
-	    log_error_f(fname, _("error: no ownertrust value\n") );
+	    log_error (_("\b%s: error: no ownertrust value\n"), fname );
 	    continue;
 	}
 	if( !otrust )
@@ -201,11 +202,11 @@ import_ownertrust( const char *fname )
             any = 1;
 	}
 	else /* error */
-	    log_error_f(fname, _("error finding trust record: %s\n"),
-						    g10_errstr(rc));
+	    log_error (_("\b%s: error finding trust record: %s\n"),
+		       fname, gpg_strerror (rc));
     }
     if( ferror(fp) )
-	log_error_f(fname, _("read error: %s\n"), strerror(errno) );
+	log_error (_("\b%s: read error: %s\n"), fname, strerror(errno) );
     if( !is_stdin )
 	fclose(fp);
     
@@ -214,7 +215,7 @@ import_ownertrust( const char *fname )
         revalidation_mark ();
         rc = tdbio_sync ();
         if (rc)
-          log_error (_("trustdb: sync failed: %s\n"), g10_errstr(rc) );
+          log_error (_("trustdb: sync failed: %s\n"), gpg_strerror (rc) );
       }
     
 }
diff --git a/g10/tdbio.c b/g10/tdbio.c
index bc609adee..d8af2ef8a 100644
--- a/g10/tdbio.c
+++ b/g10/tdbio.c
@@ -29,6 +29,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -123,17 +124,20 @@ static int
 write_cache_item( CACHE_CTRL r )
 {
     int n;
+    gpg_error_t rc;
 
     if( lseek( db_fd, r->recno * TRUST_RECORD_LEN, SEEK_SET ) == -1 ) {
+        rc = gpg_error_from_errno (errno);
 	log_error(_("trustdb rec %lu: lseek failed: %s\n"),
 					    r->recno, strerror(errno) );
-	return G10ERR_WRITE_FILE;
+	return rc;
     }
     n = write( db_fd, r->data, TRUST_RECORD_LEN);
     if( n != TRUST_RECORD_LEN ) {
+        rc = gpg_error_from_errno (errno);
 	log_error(_("trustdb rec %lu: write failed (n=%d): %s\n"),
 					    r->recno, n, strerror(errno) );
-	return G10ERR_WRITE_FILE;
+	return rc;
     }
     r->flags.dirty = 0;
     return 0;
@@ -187,7 +191,7 @@ put_record_into_cache( ulong recno, const char *data )
     }
     /* see whether we reached the limit */
     if( cache_entries < MAX_CACHE_ENTRIES_SOFT ) { /* no */
-	r = m_alloc( sizeof *r );
+	r = xmalloc ( sizeof *r );
 	r->flags.used = 1;
 	r->recno = recno;
 	memcpy( r->data, data, TRUST_RECORD_LEN );
@@ -230,7 +234,7 @@ put_record_into_cache( ulong recno, const char *data )
 	if( cache_entries < MAX_CACHE_ENTRIES_HARD ) { /* no */
 	    if( opt.debug && !(cache_entries % 100) )
 		log_debug("increasing tdbio cache size\n");
-	    r = m_alloc( sizeof *r );
+	    r = xmalloc ( sizeof *r );
 	    r->flags.used = 1;
 	    r->recno = recno;
 	    memcpy( r->data, data, TRUST_RECORD_LEN );
@@ -242,7 +246,7 @@ put_record_into_cache( ulong recno, const char *data )
 	    return 0;
 	}
 	log_info(_("trustdb transaction too large\n"));
-	return G10ERR_RESOURCE_LIMIT;
+	return GPG_ERR_RESOURCE_LIMIT;
     }
     if( dirty_count ) {
 	int n = dirty_count / 5; /* discard some dirty entries */
@@ -488,13 +492,13 @@ tdbio_set_dbname( const char *new_dbname, int create )
 	  fname = make_filename (opt.homedir, new_dbname, NULL);
       }
     else
-      fname = m_strdup (new_dbname);
+      fname = xstrdup (new_dbname);
 
     if( access( fname, R_OK ) ) {
 	if( errno != ENOENT ) {
 	    log_error( _("%s: can't access: %s\n"), fname, strerror(errno) );
-	    m_free(fname);
-	    return G10ERR_TRUSTDB;
+	    xfree (fname);
+	    return GPG_ERR_TRUSTDB;
 	}
 	if( create ) {
 	    FILE *fp;
@@ -511,7 +515,7 @@ tdbio_set_dbname( const char *new_dbname, int create )
 	    }
 	    *p = DIRSEP_C;
 
-	    m_free(db_name);
+	    xfree (db_name);
 	    db_name = fname;
 #ifdef __riscos__
 	    if( !lockhandle )
@@ -541,7 +545,7 @@ tdbio_set_dbname( const char *new_dbname, int create )
             rc = create_version_record ();
 	    if( rc )
 		log_fatal( _("%s: failed to create version record: %s"),
-						   fname, g10_errstr(rc));
+						   fname, gpg_strerror (rc));
 	    /* and read again to check that we are okay */
 	    if( tdbio_read_record( 0, &rec, RECTYPE_VER ) )
 		log_fatal( _("%s: invalid trustdb created\n"), db_name );
@@ -552,7 +556,7 @@ tdbio_set_dbname( const char *new_dbname, int create )
 	    return 0;
 	}
     }
-    m_free(db_name);
+    xfree (db_name);
     db_name = fname;
     return 0;
 }
@@ -636,7 +640,7 @@ create_hashtable( TRUSTREC *vr, int type )
 	 rc = tdbio_write_record( &rec );
 	 if( rc )
 	     log_fatal( _("%s: failed to create hashtable: %s\n"),
-					db_name, g10_errstr(rc));
+					db_name, gpg_strerror (rc));
     }
     /* update the version record */
     rc = tdbio_write_record( vr );
@@ -644,7 +648,7 @@ create_hashtable( TRUSTREC *vr, int type )
 	rc = tdbio_sync();
     if( rc )
 	log_fatal( _("%s: error updating version record: %s\n"),
-						  db_name, g10_errstr(rc));
+						  db_name, gpg_strerror (rc));
 }
 
 
@@ -661,7 +665,7 @@ tdbio_db_matches_options()
       rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
       if( rc )
 	log_fatal( _("%s: error reading version record: %s\n"),
-		   db_name, g10_errstr(rc) );
+		   db_name, gpg_strerror (rc) );
 
       yes_no = vr.r.ver.marginals == opt.marginals_needed
 	&& vr.r.ver.completes == opt.completes_needed
@@ -681,7 +685,7 @@ tdbio_read_model(void)
   rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
   if( rc )
     log_fatal( _("%s: error reading version record: %s\n"),
-	       db_name, g10_errstr(rc) );
+	       db_name, gpg_strerror (rc) );
   return vr.r.ver.trust_model;
 }
 
@@ -697,7 +701,7 @@ tdbio_read_nextcheck ()
     rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
     if( rc )
 	log_fatal( _("%s: error reading version record: %s\n"),
-						    db_name, g10_errstr(rc) );
+						    db_name, gpg_strerror (rc) );
     return vr.r.ver.nextcheck;
 }
 
@@ -711,7 +715,7 @@ tdbio_write_nextcheck (ulong stamp)
     rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
     if( rc )
 	log_fatal( _("%s: error reading version record: %s\n"),
-				       db_name, g10_errstr(rc) );
+				       db_name, gpg_strerror (rc) );
 
     if (vr.r.ver.nextcheck == stamp)
       return 0;
@@ -720,7 +724,7 @@ tdbio_write_nextcheck (ulong stamp)
     rc = tdbio_write_record( &vr );
     if( rc )
 	log_fatal( _("%s: error writing version record: %s\n"),
-				       db_name, g10_errstr(rc) );
+				       db_name, gpg_strerror (rc) );
     return 1;
 }
 
@@ -741,7 +745,7 @@ get_trusthashrec(void)
 	rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
 	if( rc )
 	    log_fatal( _("%s: error reading version record: %s\n"),
-					    db_name, g10_errstr(rc) );
+					    db_name, gpg_strerror (rc) );
 	if( !vr.r.ver.trusthashtbl )
 	    create_hashtable( &vr, 0 );
 
@@ -773,7 +777,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
     rc = tdbio_read_record( hashrec, &rec, RECTYPE_HTBL );
     if( rc ) {
 	log_error( db_name, "upd_hashtable: read failed: %s\n",
-							g10_errstr(rc) );
+							gpg_strerror (rc) );
 	return rc;
     }
 
@@ -783,7 +787,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 	rc = tdbio_write_record( &rec );
 	if( rc ) {
 	    log_error( db_name, "upd_hashtable: write htbl failed: %s\n",
-							    g10_errstr(rc) );
+							    gpg_strerror (rc) );
 	    return rc;
 	}
     }
@@ -792,7 +796,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 	rc = tdbio_read_record( item, &rec, 0 );
 	if( rc ) {
 	    log_error( "upd_hashtable: read item failed: %s\n",
-							    g10_errstr(rc) );
+							    gpg_strerror (rc) );
 	    return rc;
 	}
 
@@ -801,7 +805,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 	    level++;
 	    if( level >= keylen ) {
 		log_error( "hashtable has invalid indirections.\n");
-		return G10ERR_TRUSTDB;
+		return GPG_ERR_TRUSTDB;
 	    }
 	    goto next_level;
 	}
@@ -818,7 +822,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 						       &rec, RECTYPE_HLST);
 		    if( rc ) {
 			log_error( "upd_hashtable: read hlst failed: %s\n",
-							     g10_errstr(rc) );
+							     gpg_strerror (rc) );
 			return rc;
 		    }
 		}
@@ -833,7 +837,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 			rc = tdbio_write_record( &rec );
 			if( rc )
 			    log_error( "upd_hashtable: write hlst failed: %s\n",
-							      g10_errstr(rc) );
+							      gpg_strerror (rc) );
 			return rc; /* done */
 		    }
 		}
@@ -842,7 +846,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 						      &rec, RECTYPE_HLST );
 		    if( rc ) {
 			log_error( "upd_hashtable: read hlst failed: %s\n",
-							     g10_errstr(rc) );
+							     gpg_strerror (rc) );
 			return rc;
 		    }
 		}
@@ -851,7 +855,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 		    rc = tdbio_write_record( &rec );
 		    if( rc ) {
 			log_error( "upd_hashtable: write hlst failed: %s\n",
-							  g10_errstr(rc) );
+							  gpg_strerror (rc) );
 			return rc;
 		    }
 		    memset( &rec, 0, sizeof rec );
@@ -861,7 +865,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 		    rc = tdbio_write_record( &rec );
 		    if( rc )
 			log_error( "upd_hashtable: write ext hlst failed: %s\n",
-							  g10_errstr(rc) );
+							  gpg_strerror (rc) );
 		    return rc; /* done */
 		}
 	    } /* end loop over hlst slots */
@@ -879,7 +883,7 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 	    rc = tdbio_write_record( &rec );
 	    if( rc ) {
 		log_error( "upd_hashtable: write new hlst failed: %s\n",
-						  g10_errstr(rc) );
+						  gpg_strerror (rc) );
 		return rc;
 	    }
 	    /* update the hashtable record */
@@ -887,14 +891,14 @@ upd_hashtable( ulong table, byte *key, int keylen, ulong newrecnum )
 	    rc = tdbio_write_record( &lastrec );
 	    if( rc )
 		log_error( "upd_hashtable: update htbl failed: %s\n",
-							     g10_errstr(rc) );
+							     gpg_strerror (rc) );
 	    return rc; /* ready */
 	}
 	else {
 	    log_error( "hashtbl %lu: %lu/%d points to an invalid record %lu\n",
 		       table, hashrec, (msb % ITEMS_PER_HTBL_RECORD), item);
 	    list_trustdb(NULL);
-	    return G10ERR_TRUSTDB;
+	    return GPG_ERR_TRUSTDB;
 	}
     }
 
@@ -922,7 +926,7 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
     rc = tdbio_read_record( hashrec, &rec, RECTYPE_HTBL );
     if( rc ) {
 	log_error( db_name, "drop_from_hashtable: read failed: %s\n",
-							g10_errstr(rc) );
+							gpg_strerror (rc) );
 	return rc;
     }
 
@@ -935,14 +939,14 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
 	rc = tdbio_write_record( &rec );
 	if( rc )
 	    log_error( db_name, "drop_from_hashtable: write htbl failed: %s\n",
-							    g10_errstr(rc) );
+							    gpg_strerror (rc) );
 	return rc;
     }
 
     rc = tdbio_read_record( item, &rec, 0 );
     if( rc ) {
 	log_error( "drop_from_hashtable: read item failed: %s\n",
-							g10_errstr(rc) );
+							gpg_strerror (rc) );
 	return rc;
     }
 
@@ -951,7 +955,7 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
 	level++;
 	if( level >= keylen ) {
 	    log_error( "hashtable has invalid indirections.\n");
-	    return G10ERR_TRUSTDB;
+	    return GPG_ERR_TRUSTDB;
 	}
 	goto next_level;
     }
@@ -964,7 +968,7 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
 		    rc = tdbio_write_record( &rec );
 		    if( rc )
 			log_error( db_name, "drop_from_hashtable: write htbl failed: %s\n",
-									g10_errstr(rc) );
+									gpg_strerror (rc) );
 		    return rc;
 		}
 	    }
@@ -973,7 +977,7 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
 						   &rec, RECTYPE_HLST);
 		if( rc ) {
 		    log_error( "drop_from_hashtable: read hlst failed: %s\n",
-							 g10_errstr(rc) );
+							 gpg_strerror (rc) );
 		    return rc;
 		}
 	    }
@@ -984,7 +988,7 @@ drop_from_hashtable( ulong table, byte *key, int keylen, ulong recnum )
 
     log_error( "hashtbl %lu: %lu/%d points to wrong record %lu\n",
 		    table, hashrec, (msb % ITEMS_PER_HTBL_RECORD), item);
-    return G10ERR_TRUSTDB;
+    return GPG_ERR_TRUSTDB;
 }
 
 
@@ -1010,7 +1014,7 @@ lookup_hashtable( ulong table, const byte *key, size_t keylen,
     hashrec += msb / ITEMS_PER_HTBL_RECORD;
     rc = tdbio_read_record( hashrec, rec, RECTYPE_HTBL );
     if( rc ) {
-	log_error( db_name, "lookup_hashtable failed: %s\n", g10_errstr(rc) );
+	log_error( db_name, "lookup_hashtable failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
 
@@ -1020,7 +1024,7 @@ lookup_hashtable( ulong table, const byte *key, size_t keylen,
 
     rc = tdbio_read_record( item, rec, 0 );
     if( rc ) {
-	log_error( db_name, "hashtable read failed: %s\n", g10_errstr(rc) );
+	log_error( db_name, "hashtable read failed: %s\n", gpg_strerror (rc) );
 	return rc;
     }
     if( rec->rectype == RECTYPE_HTBL ) {
@@ -1028,7 +1032,7 @@ lookup_hashtable( ulong table, const byte *key, size_t keylen,
 	level++;
 	if( level >= keylen ) {
 	    log_error( db_name, "hashtable has invalid indirections\n");
-	    return G10ERR_TRUSTDB;
+	    return GPG_ERR_TRUSTDB;
 	}
 	goto next_level;
     }
@@ -1043,7 +1047,7 @@ lookup_hashtable( ulong table, const byte *key, size_t keylen,
 		    rc = tdbio_read_record( rec->r.hlst.rnum[i], &tmp, 0 );
 		    if( rc ) {
 			log_error( "lookup_hashtable: read item failed: %s\n",
-							      g10_errstr(rc) );
+							      gpg_strerror (rc) );
 			return rc;
 		    }
 		    if( (*cmpfnc)( cmpdata, &tmp ) ) {
@@ -1056,7 +1060,7 @@ lookup_hashtable( ulong table, const byte *key, size_t keylen,
 		rc = tdbio_read_record( rec->r.hlst.next, rec, RECTYPE_HLST );
 		if( rc ) {
 		    log_error( "lookup_hashtable: read hlst failed: %s\n",
-							 g10_errstr(rc) );
+							 gpg_strerror (rc) );
 		    return rc;
 		}
 	    }
@@ -1159,17 +1163,19 @@ tdbio_read_record( ulong recnum, TRUSTREC *rec, int expected )
     buf = get_record_from_cache( recnum );
     if( !buf ) {
 	if( lseek( db_fd, recnum * TRUST_RECORD_LEN, SEEK_SET ) == -1 ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error(_("trustdb: lseek failed: %s\n"), strerror(errno) );
-	    return G10ERR_READ_FILE;
+	    return rc;
 	}
 	n = read( db_fd, readbuf, TRUST_RECORD_LEN);
 	if( !n ) {
 	    return -1; /* eof */
 	}
 	else if( n != TRUST_RECORD_LEN ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error(_("trustdb: read failed (n=%d): %s\n"), n,
 							strerror(errno) );
-	    return G10ERR_READ_FILE;
+	    return rc;
 	}
 	buf = readbuf;
     }
@@ -1180,7 +1186,7 @@ tdbio_read_record( ulong recnum, TRUSTREC *rec, int expected )
     if( expected && rec->rectype != expected ) {
 	log_error("%lu: read expected rec type %d, got %d\n",
 		    recnum, expected, rec->rectype );
-	return G10ERR_TRUSTDB;
+	return GPG_ERR_TRUSTDB;
     }
     p++;    /* skip reserved byte */
     switch( rec->rectype ) {
@@ -1189,7 +1195,7 @@ tdbio_read_record( ulong recnum, TRUSTREC *rec, int expected )
       case RECTYPE_VER: /* version record */
 	if( memcmp(buf+1, "gpg", 3 ) ) {
 	    log_error( _("%s: not a trustdb file\n"), db_name );
-	    rc = G10ERR_TRUSTDB;
+	    rc = GPG_ERR_TRUSTDB;
 	}
 	p += 2; /* skip "gpg" */
 	rec->r.ver.version  = *p++;
@@ -1208,12 +1214,12 @@ tdbio_read_record( ulong recnum, TRUSTREC *rec, int expected )
 	if( recnum ) {
 	    log_error( _("%s: version record with recnum %lu\n"), db_name,
 							     (ulong)recnum );
-	    rc = G10ERR_TRUSTDB;
+	    rc = GPG_ERR_TRUSTDB;
 	}
 	else if( rec->r.ver.version != 3 ) {
 	    log_error( _("%s: invalid file version %d\n"), db_name,
 							rec->r.ver.version );
-	    rc = G10ERR_TRUSTDB;
+	    rc = GPG_ERR_TRUSTDB;
 	}
 	break;
       case RECTYPE_FREE:
@@ -1248,7 +1254,7 @@ tdbio_read_record( ulong recnum, TRUSTREC *rec, int expected )
       default:
 	log_error( "%s: invalid record type %d at recnum %lu\n",
 				   db_name, rec->rectype, (ulong)recnum );
-	rc = G10ERR_TRUSTDB;
+	rc = GPG_ERR_TRUSTDB;
 	break;
     }
 
@@ -1364,7 +1370,7 @@ tdbio_delete_record( ulong recnum )
     rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
     if( rc )
 	log_fatal( _("%s: error reading version record: %s\n"),
-				       db_name, g10_errstr(rc) );
+				       db_name, gpg_strerror (rc) );
 
     rec.recnum = recnum;
     rec.rectype = RECTYPE_FREE;
@@ -1391,13 +1397,13 @@ tdbio_new_recnum()
     rc = tdbio_read_record( 0, &vr, RECTYPE_VER );
     if( rc )
 	log_fatal( _("%s: error reading version record: %s\n"),
-					     db_name, g10_errstr(rc) );
+					     db_name, gpg_strerror (rc) );
     if( vr.r.ver.firstfree ) {
 	recnum = vr.r.ver.firstfree;
 	rc = tdbio_read_record( recnum, &rec, RECTYPE_FREE );
 	if( rc ) {
 	    log_error( _("%s: error reading free record: %s\n"),
-						  db_name,  g10_errstr(rc) );
+						  db_name,  gpg_strerror (rc) );
 	    return rc;
 	}
 	/* update dir record */
@@ -1405,7 +1411,7 @@ tdbio_new_recnum()
 	rc = tdbio_write_record( &vr );
 	if( rc ) {
 	    log_error( _("%s: error writing dir record: %s\n"),
-						     db_name, g10_errstr(rc) );
+						     db_name, gpg_strerror (rc) );
 	    return rc;
 	}
 	/*zero out the new record */
@@ -1415,7 +1421,7 @@ tdbio_new_recnum()
 	rc = tdbio_write_record( &rec );
 	if( rc )
 	    log_fatal(_("%s: failed to zero a record: %s\n"),
-				       db_name, g10_errstr(rc));
+				       db_name, gpg_strerror (rc));
     }
     else { /* not found, append a new record */
 	offset = lseek( db_fd, 0, SEEK_END );
@@ -1430,22 +1436,22 @@ tdbio_new_recnum()
 	rec.recnum = recnum;
 	rc = 0;
 	if( lseek( db_fd, recnum * TRUST_RECORD_LEN, SEEK_SET ) == -1 ) {
+            rc = gpg_error_from_errno (errno);
 	    log_error(_("trustdb rec %lu: lseek failed: %s\n"),
 						recnum, strerror(errno) );
-	    rc = G10ERR_WRITE_FILE;
 	}
 	else {
 	    int n = write( db_fd, &rec, TRUST_RECORD_LEN);
 	    if( n != TRUST_RECORD_LEN ) {
+                rc = gpg_error_from_errno (errno);
 		log_error(_("trustdb rec %lu: write failed (n=%d): %s\n"),
 						 recnum, n, strerror(errno) );
-		rc = G10ERR_WRITE_FILE;
 	    }
 	}
 
 	if( rc )
 	    log_fatal(_("%s: failed to append a record: %s\n"),
-				    db_name,	g10_errstr(rc));
+				    db_name,	gpg_strerror (rc));
     }
     return recnum ;
 }
@@ -1516,7 +1522,7 @@ migrate_from_v2 ()
   int rc, count;
 
   ottable_size = 5;
-  ottable = m_alloc (ottable_size * sizeof *ottable);
+  ottable = xmalloc (ottable_size * sizeof *ottable);
   ottable_used = 0;
 
   /* We have some restrictions here.  We can't use the version record
@@ -1546,7 +1552,7 @@ migrate_from_v2 ()
       if (ottable_used == ottable_size)
         {
           ottable_size += 1000;
-          ottable = m_realloc (ottable, ottable_size * sizeof *ottable);
+          ottable = xrealloc (ottable, ottable_size * sizeof *ottable);
         }
       ottable[ottable_used].keyrecno = buftoulong (oldbuf+6);
       ottable[ottable_used].ot = oldbuf[18];
@@ -1617,8 +1623,5 @@ migrate_from_v2 ()
   if (rc)
     log_fatal ("failed to sync `%s'\n", db_name);
   log_info ("migrated %d version 2 ownertrusts\n", count);
-  m_free (ottable);
+  xfree (ottable);
 }
-
-
-
diff --git a/g10/textfilter.c b/g10/textfilter.c
index 6f3fe1bbf..a3ea4b138 100644
--- a/g10/textfilter.c
+++ b/g10/textfilter.c
@@ -25,6 +25,7 @@
 #include <errno.h>
 #include <assert.h>
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "memory.h"
@@ -71,7 +72,7 @@ len_without_trailing_ws( byte *line, unsigned len )
 
 
 static int
-standard( text_filter_context_t *tfx, IOBUF a,
+standard( text_filter_context_t *tfx, iobuf_t a,
 	  byte *buf, size_t size, size_t *ret_len)
 {
     int rc=0;
@@ -120,7 +121,7 @@ standard( text_filter_context_t *tfx, IOBUF a,
  */
 int
 text_filter( void *opaque, int control,
-	     IOBUF a, byte *buf, size_t *ret_len)
+	     iobuf_t a, byte *buf, size_t *ret_len)
 {
     size_t size = *ret_len;
     text_filter_context_t *tfx = opaque;
@@ -133,7 +134,7 @@ text_filter( void *opaque, int control,
 	if( tfx->truncated )
 	    log_error(_("can't handle text lines longer than %d characters\n"),
 			MAX_LINELEN );
-	m_free( tfx->buffer );
+	xfree ( tfx->buffer );
 	tfx->buffer = NULL;
     }
     else if( control == IOBUFCTRL_DESC )
@@ -147,7 +148,7 @@ text_filter( void *opaque, int control,
  * md is updated as required by rfc2440
  */
 int
-copy_clearsig_text( IOBUF out, IOBUF inp, MD_HANDLE md,
+copy_clearsig_text( iobuf_t out, iobuf_t inp, MD_HANDLE md,
 		    int escape_dash, int escape_from, int pgp2mode )
 {
     unsigned maxlen;
@@ -175,15 +176,15 @@ copy_clearsig_text( IOBUF out, IOBUF inp, MD_HANDLE md,
 	/* update the message digest */
 	if( escape_dash ) {
 	    if( pending_lf ) {
-		md_putc( md, '\r' );
-		md_putc( md, '\n' );
+		gcry_md_putc( md, '\r' );
+		gcry_md_putc( md, '\n' );
 	    }
-	    md_write( md, buffer,
+	    gcry_md_write( md, buffer,
 		     len_without_trailing_chars( buffer, n,
 						 pgp2mode? " \r\n":" \t\r\n"));
 	}
 	else
-	    md_write( md, buffer, n );
+	    gcry_md_write( md, buffer, n );
 	pending_lf = buffer[n-1] == '\n';
 
 	/* write the output */
@@ -224,7 +225,7 @@ copy_clearsig_text( IOBUF out, IOBUF inp, MD_HANDLE md,
     if( !pending_lf ) { /* make sure that the file ends with a LF */
 	iobuf_writestr( out, LF );
 	if( !escape_dash )
-	    md_putc( md, '\n' );
+	    gcry_md_putc( md, '\n' );
     }
 
     if( truncated )
diff --git a/g10/trustdb.c b/g10/trustdb.c
index 457d83b9d..16bd96e49 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -34,6 +34,7 @@
 #endif
 #endif /* !DISABLE_REGEX */
 
+#include "gpg.h"
 #include "errors.h"
 #include "iobuf.h"
 #include "keydb.h"
@@ -98,7 +99,7 @@ new_key_item (void)
 {
   struct key_item *k;
   
-  k = m_alloc_clear (sizeof *k);
+  k = xcalloc (1,sizeof *k);
   return k;
 }
 
@@ -110,8 +111,8 @@ release_key_items (struct key_item *k)
   for (; k; k = k2)
     {
       k2 = k->next;
-      m_free (k->trust_regexp);
-      m_free (k);
+      xfree (k->trust_regexp);
+      xfree (k);
     }
 }
 
@@ -128,7 +129,7 @@ new_key_hash_table (void)
 {
   struct key_item **tbl;
 
-  tbl = m_alloc_clear (1024 * sizeof *tbl);
+  tbl = xcalloc (1,1024 * sizeof *tbl);
   return tbl;
 }
 
@@ -141,7 +142,7 @@ release_key_hash_table (KeyHashTable tbl)
     return;
   for (i=0; i < 1024; i++)
     release_key_items (tbl[i]);
-  m_free (tbl);
+  xfree (tbl);
 }
 
 /* 
@@ -188,7 +189,7 @@ release_key_array ( struct key_array *keys )
     if (keys) {
         for (k=keys; k->keyblock; k++)
             release_kbnode (k->keyblock);
-        m_free (keys);
+        xfree (keys);
     }
 }
 
@@ -335,7 +336,7 @@ read_record (ulong recno, TRUSTREC *rec, int rectype )
   if (rc)
     {
       log_error(_("trust record %lu, req type %d: read failed: %s\n"),
-                recno, rec->rectype, g10_errstr(rc) );
+                recno, rec->rectype, gpg_strerror (rc) );
       tdbio_invalid();
     }
   if (rectype != rec->rectype)
@@ -356,7 +357,7 @@ write_record (TRUSTREC *rec)
   if (rc)
     {
       log_error(_("trust record %lu, type %d: write failed: %s\n"),
-			    rec->recnum, rec->rectype, g10_errstr(rc) );
+			    rec->recnum, rec->rectype, gpg_strerror (rc) );
       tdbio_invalid();
     }
 }
@@ -370,7 +371,7 @@ do_sync(void)
     int rc = tdbio_sync ();
     if(rc)
       {
-        log_error (_("trustdb: sync failed: %s\n"), g10_errstr(rc) );
+        log_error (_("trustdb: sync failed: %s\n"), gpg_strerror (rc) );
         g10_exit(2);
       }
 }
@@ -399,7 +400,7 @@ setup_trustdb( int level, const char *dbname )
     if( trustdb_args.init )
 	return 0;
     trustdb_args.level = level;
-    trustdb_args.dbname = dbname? m_strdup(dbname): NULL;
+    trustdb_args.dbname = dbname? xstrdup (dbname): NULL;
     return 0;
 }
 
@@ -434,7 +435,7 @@ init_trustdb()
   else
     BUG();
   if( rc )
-    log_fatal("can't init trustdb: %s\n", g10_errstr(rc) );
+    log_fatal("can't init trustdb: %s\n", gpg_strerror (rc) );
 
   if(opt.trust_model==TM_AUTO)
     {
@@ -607,7 +608,7 @@ read_trust_record (PKT_public_key *pk, TRUSTREC *rec)
   if (rc) 
     {
       log_error ("trustdb: searching trust record failed: %s\n",
-                 g10_errstr (rc));
+                 gpg_strerror (rc));
       return rc; 
     }
       
@@ -615,7 +616,7 @@ read_trust_record (PKT_public_key *pk, TRUSTREC *rec)
     {
       log_error ("trustdb: record %lu is not a trust record\n",
                  rec->recnum);
-      return G10ERR_TRUSTDB; 
+      return GPG_ERR_TRUSTDB; 
     }      
   
   return 0;
@@ -760,12 +761,12 @@ update_min_ownertrust (u32 *kid, unsigned int new_trust )
   TRUSTREC rec;
   int rc;
 
-  pk = m_alloc_clear (sizeof *pk);
+  pk = xcalloc (1,sizeof *pk);
   rc = get_pubkey (pk, kid);
   if (rc)
     {
       log_error (_("public key %08lX not found: %s\n"),
-                 (ulong)kid[1], g10_errstr(rc) );
+                 (ulong)kid[1], gpg_strerror (rc) );
       return;
     }
 
@@ -1029,12 +1030,12 @@ get_validity (PKT_public_key *pk, PKT_user_id *uid)
   keyid_from_pk (pk, kid);
   if (pk->main_keyid[0] != kid[0] || pk->main_keyid[1] != kid[1])
     { /* this is a subkey - get the mainkey */
-      main_pk = m_alloc_clear (sizeof *main_pk);
+      main_pk = xcalloc (1,sizeof *main_pk);
       rc = get_pubkey (main_pk, pk->main_keyid);
       if (rc)
         {
           log_error ("error getting main key %08lX of subkey %08lX: %s\n",
-                     (ulong)pk->main_keyid[1], (ulong)kid[1], g10_errstr(rc));
+                     (ulong)pk->main_keyid[1], (ulong)kid[1], gpg_strerror (rc));
           validity = TRUST_UNKNOWN; 
           goto leave;
 	}
@@ -1223,12 +1224,12 @@ ask_ownertrust (u32 *kid,int minimum)
   int rc;
   int ot;
 
-  pk = m_alloc_clear (sizeof *pk);
+  pk = xcalloc (1,sizeof *pk);
   rc = get_pubkey (pk, kid);
   if (rc)
     {
       log_error (_("public key %08lX not found: %s\n"),
-                 (ulong)kid[1], g10_errstr(rc) );
+                 (ulong)kid[1], gpg_strerror (rc) );
       return TRUST_UNKNOWN;
     }
  
@@ -1712,14 +1713,14 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
   KEYDB_SEARCH_DESC desc;
   
   maxkeys = 1000;
-  keys = m_alloc ((maxkeys+1) * sizeof *keys);
+  keys = xmalloc ((maxkeys+1) * sizeof *keys);
   nkeys = 0;
   
   rc = keydb_search_reset (hd);
   if (rc)
     {
-      log_error ("keydb_search_reset failed: %s\n", g10_errstr(rc));
-      m_free (keys);
+      log_error ("keydb_search_reset failed: %s\n", gpg_strerror (rc));
+      xfree (keys);
       return NULL;
     }
 
@@ -1735,8 +1736,8 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
     }
   if (rc)
     {
-      log_error ("keydb_search_first failed: %s\n", g10_errstr(rc));
-      m_free (keys);
+      log_error ("keydb_search_first failed: %s\n", gpg_strerror (rc));
+      xfree (keys);
       return NULL;
     }
   
@@ -1748,8 +1749,8 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
       rc = keydb_get_keyblock (hd, &keyblock);
       if (rc) 
         {
-          log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
-          m_free (keys);
+          log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
+          xfree (keys);
           return NULL;
         }
       
@@ -1781,7 +1782,7 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
 
           if (nkeys == maxkeys) {
             maxkeys += 1000;
-            keys = m_realloc (keys, (maxkeys+1) * sizeof *keys);
+            keys = xrealloc (keys, (maxkeys+1) * sizeof *keys);
           }
           keys[nkeys++].keyblock = keyblock;
 
@@ -1804,8 +1805,8 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
   while ( !(rc = keydb_search (hd, &desc, 1)) );
   if (rc && rc != -1) 
     {
-      log_error ("keydb_search_next failed: %s\n", g10_errstr(rc));
-      m_free (keys);
+      log_error ("keydb_search_next failed: %s\n", gpg_strerror (rc));
+      xfree (keys);
       return NULL;
     }
 
@@ -1825,7 +1826,7 @@ reset_trust_records (KEYDB_HANDLE hd, KeyHashTable exclude)
   rc = keydb_search_reset (hd);
   if (rc)
     {
-      log_error ("keydb_search_reset failed: %s\n", g10_errstr(rc));
+      log_error ("keydb_search_reset failed: %s\n", gpg_strerror (rc));
       return;
     }
 
@@ -1838,7 +1839,7 @@ reset_trust_records (KEYDB_HANDLE hd, KeyHashTable exclude)
     }
   rc = keydb_search (hd, &desc, 1);
   if (rc && rc != -1 )
-    log_error ("keydb_search_first failed: %s\n", g10_errstr(rc));
+    log_error ("keydb_search_first failed: %s\n", gpg_strerror (rc));
   else if (!rc)
     {
       desc.mode = KEYDB_SEARCH_MODE_NEXT; /* change mode */
@@ -1847,7 +1848,7 @@ reset_trust_records (KEYDB_HANDLE hd, KeyHashTable exclude)
           rc = keydb_get_keyblock (hd, &keyblock);
           if (rc) 
             {
-              log_error ("keydb_get_keyblock failed: %s\n", g10_errstr(rc));
+              log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
               break;
             }
           count++;
@@ -1860,7 +1861,7 @@ reset_trust_records (KEYDB_HANDLE hd, KeyHashTable exclude)
         }
       while ( !(rc = keydb_search (hd, &desc, 1)) );
       if (rc && rc != -1) 
-        log_error ("keydb_search_next failed: %s\n", g10_errstr(rc));
+        log_error ("keydb_search_next failed: %s\n", gpg_strerror (rc));
     }
   if (opt.verbose)
     log_info (_("%d keys processed (%d validity counts cleared)\n"),
@@ -2027,7 +2028,7 @@ validate_keys (int interactive)
       if (!keys) 
         {
           log_error ("validate_key_list failed\n");
-          rc = G10ERR_GENERAL;
+          rc = GPG_ERR_GENERAL;
           goto leave;
         }
 
@@ -2081,7 +2082,7 @@ validate_keys (int interactive)
 			kar->keyblock->pkt->pkt.public_key->trust_value;
 		      if(kar->keyblock->pkt->pkt.public_key->trust_regexp)
 			k->trust_regexp=
-			  m_strdup(kar->keyblock->pkt->
+			  xstrdup (kar->keyblock->pkt->
 				   pkt.public_key->trust_regexp);
 		      k->next = klist;
 		      klist = k;
@@ -2117,7 +2118,7 @@ validate_keys (int interactive)
       if(tdbio_update_version_record()!=0)
 	{
 	  log_error(_("unable to update trustdb version record: "
-		      "write failed: %s\n"), g10_errstr(rc));
+		      "write failed: %s\n"), gpg_strerror (rc));
 	  tdbio_invalid();
 	}
 
diff --git a/g10/verify.c b/g10/verify.c
index 705a45746..cfa373637 100644
--- a/g10/verify.c
+++ b/g10/verify.c
@@ -54,7 +54,7 @@
 int
 verify_signatures( int nfiles, char **files )
 {
-    IOBUF fp;
+    iobuf_t fp;
     armor_filter_context_t afx;
     progress_filter_context_t pfx;
     const char *sigfile;
@@ -92,8 +92,10 @@ verify_signatures( int nfiles, char **files )
     /* open the signature file */
     fp = iobuf_open(sigfile);
     if( !fp ) {
-	log_error(_("can't open `%s'\n"), print_fname_stdin(sigfile));
-	return G10ERR_OPEN_FILE;
+        rc = gpg_error_from_errno (errno);
+	log_error(_("can't open `%s': %s\n"),
+                  print_fname_stdin(sigfile), strerror (errno));
+        return rc;
     }
     handle_progress (&pfx, fp, sigfile);
 
@@ -120,17 +122,17 @@ verify_signatures( int nfiles, char **files )
 void
 print_file_status( int status, const char *name, int what )
 {
-    char *p = m_alloc(strlen(name)+10);
+    char *p = xmalloc (strlen(name)+10);
     sprintf(p, "%d %s", what, name );
     write_status_text( status, p );
-    m_free(p);
+    xfree (p);
 }
 
 
 static int
 verify_one_file( const char *name )
 {
-    IOBUF fp;
+    iobuf_t fp;
     armor_filter_context_t afx;
     progress_filter_context_t pfx;
     int rc;
@@ -138,9 +140,11 @@ verify_one_file( const char *name )
     print_file_status( STATUS_FILE_START, name, 1 );
     fp = iobuf_open(name);
     if( !fp ) {
+        rc = gpg_error_from_errno (errno);
+	log_error(_("can't open `%s': %s\n"),
+                  print_fname_stdin(name), strerror (errno));
 	print_file_status( STATUS_FILE_ERROR, name, 1 );
-	log_error(_("can't open `%s'\n"), print_fname_stdin(name));
-	return G10ERR_OPEN_FILE;
+	return rc;
     }
     handle_progress (&pfx, fp, name);
 
@@ -175,7 +179,7 @@ verify_files( int nfiles, char **files )
 	    lno++;
 	    if( !*line || line[strlen(line)-1] != '\n' ) {
 		log_error(_("input line %u too long or missing LF\n"), lno );
-		return G10ERR_GENERAL;
+		return GPG_ERR_GENERAL;
 	    }
 	    /* This code does not work on MSDOS but how cares there are
 	     * also no script languages available.  We don't strip any