2025-04-20 16:06:36 +02:00
162 changed files with 4938 additions and 8378 deletions
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@ -128,13 +128,8 @@ jobs:
        cache: true
        update: true

-    - name: Clone MinGW packages repository and revert boost to 1.85.0
-      run: |
-        git clone https://github.com/msys2/MINGW-packages
-        cd MINGW-packages
-        git checkout 4cbb366edf2f268ac3146174b40ce38604646fc5 mingw-w64-boost
-        cd mingw-w64-boost
-        sed -i 's/boostorg.jfrog.io\/artifactory\/main/archives.boost.io/' PKGBUILD
+    - name: Clone MinGW packages repository
+      run: git clone https://github.com/msys2/MINGW-packages

    # headers
    - name: Get headers package version
@ -210,30 +205,26 @@ jobs:
      run: |
        cd MINGW-packages/mingw-w64-openssl
        gpg --recv-keys D894E2CE8B3D79F5
-        gpg --recv-keys 216094DFD0CB81EF
        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
    - name: Install openssl package
      run: pacman --noconfirm -U MINGW-packages/mingw-w64-openssl/mingw-w64-i686-*-any.pkg.tar.zst

    # Boost
-    #- name: Get boost package version
-    #  id:  version-boost
-    #  run: |
-    #    echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+    - name: Get boost package version
+      id:  version-boost
+      run: |
+        echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
    - name: Cache boost package
      uses: actions/cache@v4
      id: cache-boost
      with:
        path: MINGW-packages/mingw-w64-boost/*.zst
-        key: winxp-boost-1.85.0+crt-${{ steps.version-headers.outputs.version }}+ossl-${{ steps.version-openssl.outputs.version }}
-    # Rebuild package if packages above has changed
+        key: winxp-winpthreads-${{ steps.version-boost.outputs.version }}
    - name: Build WinXP-capable boost package
      if: steps.cache-boost.outputs.cache-hit != 'true'
      run: |
        cd MINGW-packages/mingw-w64-boost
        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Remove boost packages
-      run: pacman --noconfirm -R mingw-w64-i686-boost mingw-w64-i686-boost-libs
    - name: Install boost package
      run: pacman --noconfirm -U MINGW-packages/mingw-w64-boost/mingw-w64-i686-*-any.pkg.tar.zst

--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -108,7 +108,7 @@ jobs:
      uses: Noelware/docker-manifest-action@master
      with:
        inputs: purplei2p/i2pd:latest
-        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
+        images: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
        push: true

    - name: Create and push latest manifest image to GHCR
@ -116,7 +116,7 @@ jobs:
      uses: Noelware/docker-manifest-action@master
      with:
        inputs: ghcr.io/purplei2p/i2pd:latest
-        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
+        images: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
        push: true

    - name: Store release version to env
@ -128,7 +128,7 @@ jobs:
      uses: Noelware/docker-manifest-action@master
      with:
        inputs: purplei2p/i2pd:latest,purplei2p/i2pd:latest-release,purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        tags: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
+        images: purplei2p/i2pd:latest-amd64,purplei2p/i2pd:latest-i386,purplei2p/i2pd:latest-arm64,purplei2p/i2pd:latest-armv7
        push: true

    - name: Create and push release manifest to GHCR
@ -136,5 +136,5 @@ jobs:
      uses: Noelware/docker-manifest-action@master
      with:
        inputs: ghcr.io/purplei2p/i2pd:latest,ghcr.io/purplei2p/i2pd:latest-release,ghcr.io/purplei2p/i2pd:release-${{ env.RELEASE_VERSION }}
-        tags: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
+        images: ghcr.io/purplei2p/i2pd:latest-amd64,ghcr.io/purplei2p/i2pd:latest-i386,ghcr.io/purplei2p/i2pd:latest-arm64,ghcr.io/purplei2p/i2pd:latest-armv7
        push: true
--- a/102
+++ b/102
@ -1,108 +1,6 @@
 # for this file format description,
 # see https://github.com/olivierlacan/keep-a-changelog

-## [2.56.0] - 2025-02-11
-### Added
- Config params for shared local destination
- AddressBook full addresses cache
- Decline transit tunnel to duplicated router
- Recreate tunnels in random order
-### Changed
- Exclude disk operations from SSU2 and NTCP2 threads
- Set minimal version for peer test to 0.9.62
- Send ack requested flag after second SSU2 resend attempt
- Shorter ECIESx25519 ack request interval for datagram and I2CP sessions
- Don't change datagram routing path too often if unidirectional data stream
- Reduce LeaseSet and local RouterInfo publishing confirmation intervals
- Don't delete buffer of connected routers or if an update received
- Smaller RouterInfo request timeout if sent directly
- Persist local RouterInfo in separate thread
- Don't recalculate and process ranges for every SSU2 Ack block
- Reseeds list
-### Fixed
- Termination deadlock if SAM session is active
- Race condition at tunnel endpoint
- Inbound tunnel build encryption
-
-## [2.55.0] - 2024-12-30
-### Added
- Support boost 1.87
- "i2p.streaming.maxConcurrentStreams" tunnel's param to limit number of simultaneous streams
- Separate thread for tunnel build requests
- Show next peer and connectivity on "Transit tunnels" page
- Tunnel name for local destination thread
- Throttle incoming ECIESx25519 sessions
- Send tunnel data to transport session directly if possible
- Publish 'R' cap for yggdrasil-only routers, and 'U' cap for routers through proxy
- Random tunnel rejection when medium congestion
- Save unreachable router's endpoint to use it next time without introducers
- Recognize symmetric NAT from peer test message 7
- Resend HolePunch and RelayResponse messages
-### Changed
- Removed own implementation of AESNI and always use one from openssl
- Renamed main thread to i2pd-daemon
- Set i2p.streaming.profile=2 for shared local destination
- Reduced LeaseSet and RouterInfo lookup timeouts
- Cleanup ECIES sessions and tags more often
- Check LeaseSet expiration time
- Handle NTCP2 session handshakes in separate thread
- Limit last decline time by 1.5 hours in router's profile
- Don't handle RelayRequest and RelayIntro with same nonce twice
- Increased hole punch expiration interval
- Send peer test message 6 with delay if message 4 was received before message 5
- Pre-calculate more x25519 keys for transports in runtime
- Don't request LeaseSet for incoming stream
- Terminate incoming stream right away if no remote LeaseSet
- Handle choked, new RTO and window size calculation and resetting algorithm for streams
-### Fixed
- Empty string in addressbook subscriptions
- ECIESx25519 sessions without destination
- Missing RouterInfo buffer in NetDb
- Invalid I2PControl certificate
- Routers disappear from NetDb when offline
- Peer test message 6 sent to unknown endpoint
- Race condition with LeaseSet update
- Excessive CPU usage by streams
- Crash on shutdown
-
-## [2.54.0] - 2024-10-06
-### Added
- Maintain recently connected routers list to avoid false-positive peer test
- Limited connectivity mode(through proxy)
- "i2p.streaming.profile" tunnel's param to let tunnel select also low-bandwidth routers
- Limit stream's inbound speed
- Periodic ack requests in ratchets session
- Set congestion cap G immediately if through proxy
- Show tunnel's routers bandwidth caps in web console
- Handle immediate ack requested flag in SSU2 data packets
- Resend and ack peer test and relay messages
- "senduseragent" HTTP proxy's param to pass through user's User-Agent
-### Changed
- Exclude 'N' routers from high-bandwidth routers for client tunnels
- C++11 support has been dropped, the minimal requirement is C++17 now, C++20 for some compilers
- Removed dependency from boost::date_time and boost::filesystem
- Set default i2cp.leaseSetEncType to 0,4 and to 4 for server tunnels
- Handle i2cp.inboundlimit and i2cp.outboundlimit params in I2CP
- Publish LeaseSet with new timestamp update if tunnel was replaced in the same second
- Increase max number of generated tags to 800 per tagset
- Routing path expiration by time instead num attempts
- Save timestamp from epoch instead local time to profiles
- Update introducer's iTag if session to introducer was replaced to new one
- RTT, window size and number of NACKs calculation for streaming
- Don't select same peer for tunnel too often
- Use WinApi for data path UTF-8 conversion for Windows
-### Fixed
- Jump link crash if address book is disabled
- Race condition if connect through an introducer
- "Date" header in I2PControl response
- Incomplete response from web console
- AEAD verification with LibreSSL
- Number of generated tags and new keys for follow-on tagsets
- Expired leases in LeaseSet
- Attempts to send HolePunch to 0.0.0.0
- Incorrect options size in quick ack streaming packet
- Low bandwidth router appeared as first peer in high-bandwidth client tunnel
-
 ## [2.53.1] - 2024-07-29
 ### Changed
 - I2CP performance improvement
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-Copyright (c) 2013-2025, The PurpleI2P Project
+Copyright (c) 2013-2023, The PurpleI2P Project

 All rights reserved.

--- a/4
+++ b/4
@ -29,6 +29,7 @@ DAEMON_SRC_DIR := daemon
 # import source files lists
 include filelist.mk

+USE_AESNI       := $(or $(USE_AESNI),yes)
 USE_STATIC      := $(or $(USE_STATIC),no)
 USE_UPNP        := $(or $(USE_UPNP),no)
 DEBUG           := $(or $(DEBUG),yes)
@ -69,9 +70,6 @@ else ifneq (, $(findstring freebsd, $(SYS))$(findstring openbsd, $(SYS)))
 else ifneq (, $(findstring haiku, $(SYS)))
 	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
 	include Makefile.haiku
-else ifneq (, $(findstring solaris, $(SYS)))
-	DAEMON_SRC += $(DAEMON_SRC_DIR)/UnixDaemon.cpp
-	include Makefile.solaris
 else # not supported
 	$(error Not supported platform)
 endif
--- a/Makefile.bsd
+++ b/Makefile.bsd
@ -1,22 +1,18 @@
 CXX = clang++
 CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wextra -Wno-unused-parameter -pedantic -Wno-misleading-indentation
-DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
-LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
-LDLIBS = -lssl -lcrypto -lz -lpthread -lboost_system -lboost_program_options
-
 ## NOTE: NEEDED_CXXFLAGS is here so that custom CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
 ## For example, when adding 'hardening flags' to the build
 ## (e.g. -fstack-protector-strong -Wformat -Werror=format-security), we do not want to remove
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FLAGS to work at build-time.
-CXXVER := $(shell $(CXX) -dumpversion|cut -c 1-2)
-ifeq (${CXXVER}, "4.") # older clang always returned 4.2.1
-	$(error Compiler too old)
-else ifeq (${CXXVER}, ${filter ${CXXVER},16 17 18 19})  # clang 16 - 19
-	NEEDED_CXXFLAGS = -std=c++20
-else
+CXXVER := $(shell $(CXX) -dumpversion)
+ifeq (${CXXVER}, "4.2.1") # older clang always returned 4.2.1
+	NEEDED_CXXFLAGS = -std=c++11
+else # newer versions support C++17
 	NEEDED_CXXFLAGS = -std=c++17
 endif
-
+DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
+INCFLAGS = -I/usr/include/ -I/usr/local/include/
+LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
+LDLIBS = -lcrypto -lssl -lz -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
--- a/Makefile.haiku
+++ b/Makefile.haiku
@ -1,12 +1,8 @@
-ifeq ($(shell $(CXX) -dumpmachine | cut -c 1-4), i586)
-CXX = g++-x86
-else
 CXX = g++
-endif
-CXXFLAGS := -Wall -std=c++20
+CXXFLAGS := -Wall -std=c++11
 INCFLAGS = -I/system/develop/headers
 DEFINES = -D_DEFAULT_SOURCE -D_GNU_SOURCE
-LDLIBS = -lbe -lbsd -lnetwork -lz -lssl -lcrypto -lboost_program_options -lpthread
+LDLIBS = -lbe -lbsd -lnetwork -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread

 ifeq ($(USE_UPNP),yes)
 	DEFINES += -DUSE_UPNP
--- a/Makefile.homebrew
+++ b/Makefile.homebrew
@ -5,20 +5,20 @@ SSLROOT = ${BREWROOT}/opt/openssl@1.1
 UPNPROOT = ${BREWROOT}/opt/miniupnpc

 CXXFLAGS ?= ${CXX_DEBUG} -Wall -Wno-overloaded-virtual
-NEEDED_CXXFLAGS ?= -std=c++17
+NEEDED_CXXFLAGS ?= -std=c++11
 INCFLAGS ?= -I${SSLROOT}/include -I${BOOSTROOT}/include
 LDFLAGS ?= ${LD_DEBUG}
 DEFINES += -DMAC_OSX

 ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz ${SSLROOT}/lib/libcrypto.a ${SSLROOT}/lib/libssl.a ${BOOSTROOT}/lib/libboost_system.a ${BOOSTROOT}/lib/libboost_filesystem.a ${BOOSTROOT}/lib/libboost_program_options.a
+	LDLIBS = -lz ${SSLROOT}/lib/libcrypto.a ${SSLROOT}/lib/libssl.a ${BOOSTROOT}/lib/libboost_system.a ${BOOSTROOT}/lib/libboost_date_time.a ${BOOSTROOT}/lib/libboost_filesystem.a ${BOOSTROOT}/lib/libboost_program_options.a
 ifeq ($(USE_UPNP),yes)
 	LDLIBS += ${UPNPROOT}/lib/libminiupnpc.a
 endif
 	LDLIBS +=  -lpthread -ldl
 else
 	LDFLAGS += -L${SSLROOT}/lib -L${BOOSTROOT}/lib
-	LDLIBS = -lz -lssl -lcrypto -lboost_system -lboost_filesystem -lboost_program_options -lpthread
+	LDLIBS = -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
 ifeq ($(USE_UPNP),yes)
 	LDFLAGS += -L${UPNPROOT}/lib
 	LDLIBS += -lminiupnpc
@ -30,6 +30,13 @@ ifeq ($(USE_UPNP),yes)
 	INCFLAGS += -I${UPNPROOT}/include
 endif

+ifeq ($(USE_AESNI),yes)
+ifneq (, $(findstring i386, $(SYS))$(findstring i686, $(SYS))$(findstring x86_64, $(SYS))) # only x86-based CPU supports that
+	NEEDED_CXXFLAGS += -maes
+	DEFINES += -D__AES__
+endif
+endif
+
 install: all
 	install -d ${PREFIX}/bin
 	install -m 755 ${I2PD} ${PREFIX}/bin
--- a/Makefile.linux
+++ b/Makefile.linux
@ -9,17 +9,24 @@ LDFLAGS ?= ${LD_DEBUG}
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FDLAGS to work at build-time.

-# detect proper flag for c++17 support by compilers
+# detect proper flag for c++11 support by compilers
 CXXVER := $(shell $(CXX) -dumpversion)
 ifeq ($(shell expr match $(CXX) 'clang'),5)
+	NEEDED_CXXFLAGS += -std=c++11
+else ifeq ($(shell expr match ${CXXVER} "4\.[0-9][0-9]"),4) # gcc >= 4.10
+	NEEDED_CXXFLAGS += -std=c++11
+else ifeq ($(shell expr match ${CXXVER} "4\.[8-9]"),3) # gcc 4.8 - 4.9
+	NEEDED_CXXFLAGS += -std=c++11 -D_GLIBCXX_USE_NANOSLEEP=1
+else ifeq ($(shell expr match ${CXXVER} "[5-6]"),1) # gcc 5 - 6
+	NEEDED_CXXFLAGS += -std=c++11
+	LDLIBS = -latomic
+else ifeq ($(shell expr match ${CXXVER} "[7-9]"),1) # gcc 7 - 9
 	NEEDED_CXXFLAGS += -std=c++17
-else ifeq ($(shell expr match ${CXXVER} "[8-9]"),1) # gcc 8 - 9
+	LDLIBS = -latomic
+else ifeq ($(shell expr match ${CXXVER} "1[0-9]"),2) # gcc 10+
+#	NEEDED_CXXFLAGS += -std=c++20
 	NEEDED_CXXFLAGS += -std=c++17
-	LDLIBS = -lboost_system -lstdc++fs
-else ifeq ($(shell expr match ${CXXVER} "1[0-2]"),2) # gcc 10 - 12
-	NEEDED_CXXFLAGS += -std=c++17
-else ifeq ($(shell expr match ${CXXVER} "1[3-9]"),2) # gcc 13+
-	NEEDED_CXXFLAGS += -std=c++20
+	LDLIBS = -latomic
 else # not supported
 $(error Compiler too old)
 endif
@ -31,6 +38,9 @@ ifeq ($(USE_STATIC),yes)
 #   Using 'getaddrinfo' in statically linked applications requires at runtime
 #   the shared libraries from the glibc version used for linking
 	LIBDIR := /usr/lib/$(SYS)
+	LDLIBS += $(LIBDIR)/libboost_system.a
+	LDLIBS += $(LIBDIR)/libboost_date_time.a
+	LDLIBS += $(LIBDIR)/libboost_filesystem.a
 	LDLIBS += $(LIBDIR)/libboost_program_options.a
 	LDLIBS += $(LIBDIR)/libssl.a
 	LDLIBS += $(LIBDIR)/libcrypto.a
@ -40,7 +50,7 @@ ifeq ($(USE_UPNP),yes)
 endif
 	LDLIBS += -lpthread -ldl
 else
-	LDLIBS += -lssl -lcrypto -lz -lboost_program_options -lpthread -latomic
+	LDLIBS += -lcrypto -lssl -lz -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
 ifeq ($(USE_UPNP),yes)
 	LDLIBS += -lminiupnpc
 endif
@ -51,6 +61,13 @@ ifeq ($(USE_UPNP),yes)
 	DEFINES += -DUSE_UPNP
 endif

+ifeq ($(USE_AESNI),yes)
+ifneq (, $(findstring i386, $(SYS))$(findstring i686, $(SYS))$(findstring x86_64, $(SYS))) # only x86-based CPU supports that
+	NEEDED_CXXFLAGS += -maes
+	DEFINES += -D__AES__
+endif
+endif
+
 install: all
 	install -d ${PREFIX}/bin
 	install -m 755 ${I2PD} ${PREFIX}/bin
--- a/Makefile.mingw
+++ b/Makefile.mingw
@ -7,7 +7,7 @@ CXXFLAGS := $(CXX_DEBUG) -fPIC -msse
 INCFLAGS := -I$(DAEMON_SRC_DIR) -IWin32
 LDFLAGS := ${LD_DEBUG} -static -fPIC -msse

-NEEDED_CXXFLAGS += -std=c++20
+NEEDED_CXXFLAGS += -std=c++17
 DEFINES += -DWIN32_LEAN_AND_MEAN

 # UPNP Support
@ -16,11 +16,9 @@ ifeq ($(USE_UPNP),yes)
 	LDLIBS = -lminiupnpc
 endif

-ifeq ($(USE_WINXP_FLAGS), yes)
-	DEFINES += -DWINVER=0x0501 -D_WIN32_WINNT=0x0501
-endif
-
 LDLIBS += \
+	$(MINGW_PREFIX)/lib/libboost_system-mt.a \
+	$(MINGW_PREFIX)/lib/libboost_date_time-mt.a \
 	$(MINGW_PREFIX)/lib/libboost_filesystem-mt.a \
 	$(MINGW_PREFIX)/lib/libboost_program_options-mt.a \
 	$(MINGW_PREFIX)/lib/libssl.a \
@ -42,6 +40,16 @@ ifeq ($(USE_WIN32_APP), yes)
 	DAEMON_OBJS += $(patsubst %.rc,obj/%.o,$(DAEMON_RC))
 endif

+ifeq ($(USE_WINXP_FLAGS), yes)
+	DEFINES += -DWINVER=0x0501 -D_WIN32_WINNT=0x0501
+endif
+
+ifeq ($(USE_AESNI),yes)
+	NEEDED_CXXFLAGS += -maes
+	LDFLAGS += -maes
+	DEFINES += -D__AES__
+endif
+
 ifeq ($(USE_ASLR),yes)
 	LDFLAGS += -Wl,--nxcompat -Wl,--high-entropy-va -Wl,--dynamicbase,--export-all-symbols
 endif
--- a/Makefile.osx
+++ b/Makefile.osx
@ -1,5 +1,5 @@
 CXX = clang++
-CXXFLAGS := ${CXX_DEBUG} -Wall -std=c++17
+CXXFLAGS := ${CXX_DEBUG} -Wall -std=c++11
 INCFLAGS = -I/usr/local/include
 DEFINES := -DMAC_OSX
 LDFLAGS := -Wl,-rpath,/usr/local/lib -L/usr/local/lib
@ -7,9 +7,9 @@ LDFLAGS += -Wl,-dead_strip
 LDFLAGS += -Wl,-dead_strip_dylibs

 ifeq ($(USE_STATIC),yes)
-	LDLIBS = -lz /usr/local/lib/libssl.a /usr/local/lib/libcrypto.a /usr/local/lib/libboost_system.a /usr/local/lib/libboost_filesystem.a /usr/local/lib/libboost_program_options.a -lpthread
+	LDLIBS = -lz /usr/local/lib/libcrypto.a /usr/local/lib/libssl.a /usr/local/lib/libboost_system.a /usr/local/lib/libboost_date_time.a /usr/local/lib/libboost_filesystem.a /usr/local/lib/libboost_program_options.a -lpthread
 else
-	LDLIBS = -lz -lssl -lcrypto -lboost_system -lboost_filesystem -lboost_program_options -lpthread
+	LDLIBS = -lz -lcrypto -lssl -lboost_system -lboost_date_time -lboost_filesystem -lboost_program_options -lpthread
 endif

 ifeq ($(USE_UPNP),yes)
@ -25,5 +25,9 @@ endif
 OSARCH = $(shell uname -p)

 ifneq ($(OSARCH),powerpc)
+	ifeq ($(USE_AESNI),yes)
+		CXXFLAGS += -D__AES__ -maes
+	else
 		CXXFLAGS += -msse
+	endif
 endif
--- a/Makefile.solaris
+++ b/Makefile.solaris
@ -1,9 +0,0 @@
-CXX = g++
-INCFLAGS = -I/usr/openssl/3/include
-CXXFLAGS := -Wall -std=c++20
-LDLIBS = -L/usr/openssl/3/lib/64 -lssl -lcrypto -lboost_program_options -lz -lpthread -lsocket
-
-ifeq ($(USE_UPNP),yes)
-	DEFINES += -DUSE_UPNP
-	LDLIBS += -lminiupnpc
-endif
--- a/Win32/Win32App.cpp
+++ b/Win32/Win32App.cpp
@ -313,7 +313,7 @@ namespace win32
 					}
 					case ID_DATADIR:
 					{
-						std::string datadir(i2p::fs::GetDataDir());
+						std::string datadir(i2p::fs::GetUTF8DataDir());
 						ShellExecute(NULL, "explore", datadir.c_str(), NULL, NULL, SW_SHOWNORMAL);
 						return 0;
 					}
@ -355,7 +355,9 @@ namespace win32
 						}
 					}
 				}
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
+#endif
 			}
 			case WM_TRAYICON:
 			{
--- a/Win32/Win32NetState.cpp
+++ b/Win32/Win32NetState.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
--- a/Win32/Win32NetState.h
+++ b/Win32/Win32NetState.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
--- a/build/CMakeLists.txt
+++ b/build/CMakeLists.txt
@ -29,6 +29,7 @@ project(
 )

 # configurable options
+option(WITH_AESNI           "Use AES-NI instructions set"             ON)
 option(WITH_HARDENING       "Use hardening compiler flags"            OFF)
 option(WITH_LIBRARY         "Build library"                           ON)
 option(WITH_BINARY          "Build binary"                            ON)
@ -155,6 +156,20 @@ else()
  endif()
  set(CMAKE_CXX_FLAGS_MINSIZEREL "${CMAKE_CXX_FLAGS_MINSIZEREL} -ffunction-sections -fdata-sections")
  set(CMAKE_EXE_LINKER_FLAGS_MINSIZEREL "-Wl,--gc-sections") # -flto is added from above
+
+  # check for c++17 & c++11 support
+  include(CheckCXXCompilerFlag)
+
+  CHECK_CXX_COMPILER_FLAG("-std=c++17" CXX17_SUPPORTED)
+  CHECK_CXX_COMPILER_FLAG("-std=c++11" CXX11_SUPPORTED)
+
+  if(CXX17_SUPPORTED)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
+  elseif(CXX11_SUPPORTED)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
+  else()
+    message(SEND_ERROR "C++17 nor C++11 standard not seems to be supported by compiler. Too old version?")
+  endif()
 endif()

 if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
@ -184,6 +199,16 @@ if(UNIX)
  endif()
 endif()

+# Note: AES-NI and AVX is available on x86-based CPU's.
+# Here also ARM64 implementation, but currently we don't support it.
+# MSVC is not supported due to different ASM processing, so we hope OpenSSL has its own checks to run optimized code.
+if(WITH_AESNI AND (ARCHITECTURE MATCHES "x86_64" OR ARCHITECTURE MATCHES "i386"))
+  if(NOT MSVC)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -maes")
+  endif()
+  add_definitions(-D__AES__)
+endif()
+
 if(WITH_ADDRSANITIZER)
  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address -fno-omit-frame-pointer")
  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fsanitize=address")
@ -198,10 +223,6 @@ if(WITH_THREADSANITIZER)
  endif()
 endif()

-if (CMAKE_COMPILER_IS_GNUCC AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 10.0 AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 8.0) # gcc 8-9
-    list(APPEND CMAKE_REQUIRED_LIBRARIES "stdc++fs")
-endif()
-
 # Use std::atomic instead of GCC builtins on macOS PowerPC:
 # For more information refer to: https://github.com/PurpleI2P/i2pd/issues/1726#issuecomment-1306335111
 # This has been fixed in Boost 1.81, nevertheless we retain the setting for the sake of compatibility.
@ -256,14 +277,14 @@ else()
  if(NOT MSVC)
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC")
  endif()
-  add_definitions(-DBOOST_ATOMIC_DYN_LINK -DBOOST_SYSTEM_DYN_LINK -DBOOST_FILESYSTEM_DYN_LINK -DBOOST_PROGRAM_OPTIONS_DYN_LINK)
+  add_definitions(-DBOOST_ATOMIC_DYN_LINK -DBOOST_SYSTEM_DYN_LINK -DBOOST_FILESYSTEM_DYN_LINK -DBOOST_PROGRAM_OPTIONS_DYN_LINK -DBOOST_DATE_TIME_DYN_LINK -DBOOST_REGEX_DYN_LINK)
  if(WIN32)
    set(Boost_USE_STATIC_LIBS OFF)
    set(Boost_USE_STATIC_RUNTIME OFF)
  endif()
 endif()

-find_package(Boost REQUIRED COMPONENTS system filesystem program_options)
+find_package(Boost REQUIRED COMPONENTS system filesystem program_options date_time OPTIONAL_COMPONENTS atomic)
 if(NOT DEFINED Boost_FOUND)
  message(SEND_ERROR "Boost is not found, or your boost version was below 1.46. Please download Boost!")
 endif()
@ -291,26 +312,6 @@ if(ZLIB_FOUND)
  link_directories(${ZLIB_ROOT}/lib)
 endif()

-# C++ standard to use, based on compiler and version of boost
-if(NOT MSVC)
-# check for c++20 & c++17 support
-  include(CheckCXXCompilerFlag)
-
-  if(Boost_VERSION VERSION_GREATER_EQUAL "1.83") # min boost version for c++20
-    CHECK_CXX_COMPILER_FLAG("-std=c++20" CXX20_SUPPORTED)
-  endif()
-  CHECK_CXX_COMPILER_FLAG("-std=c++17" CXX17_SUPPORTED)
- 
-
-  if(CXX20_SUPPORTED)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++20")
-  elseif(CXX17_SUPPORTED)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
-  else()
-    message(SEND_ERROR "C++20 nor C++17 standard not seems to be supported by compiler. Too old version?")
-  endif()
-endif()
-
 # load includes
 include_directories(SYSTEM ${Boost_INCLUDE_DIRS} ${OPENSSL_INCLUDE_DIR} ${ZLIB_INCLUDE_DIR})

@ -321,9 +322,9 @@ message(STATUS "Compiler vendor    : ${CMAKE_CXX_COMPILER_ID}")
 message(STATUS "Compiler version   : ${CMAKE_CXX_COMPILER_VERSION}")
 message(STATUS "Compiler path      : ${CMAKE_CXX_COMPILER}")
 message(STATUS "Architecture       : ${ARCHITECTURE}")
-message(STATUS "Compiler flags     : ${CMAKE_CXX_FLAGS}")
 message(STATUS "Install prefix:    : ${CMAKE_INSTALL_PREFIX}")
 message(STATUS "Options:")
+message(STATUS "  AESNI            : ${WITH_AESNI}")
 message(STATUS "  HARDENING        : ${WITH_HARDENING}")
 message(STATUS "  LIBRARY          : ${WITH_LIBRARY}")
 message(STATUS "  BINARY           : ${WITH_BINARY}")
--- a/build/cmake_modules/CheckAtomic.cmake
+++ b/build/cmake_modules/CheckAtomic.cmake
@ -8,7 +8,7 @@ INCLUDE(CheckLibraryExists)

 function(check_working_cxx_atomics varname)
  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -std=c++17")
+  set(CMAKE_REQUIRED_FLAGS "${CMAKE_REQUIRED_FLAGS} -std=c++11")
  CHECK_CXX_SOURCE_COMPILES("
 #include <atomic>
 std::atomic<int> x;
@ -25,7 +25,7 @@ endfunction(check_working_cxx_atomics)

 function(check_working_cxx_atomics64 varname)
  set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS "-std=c++17 ${CMAKE_REQUIRED_FLAGS}")
+  set(CMAKE_REQUIRED_FLAGS "-std=c++11 ${CMAKE_REQUIRED_FLAGS}")
  CHECK_CXX_SOURCE_COMPILES("
 #include <atomic>
 #include <cstdint>
--- a/build/cmake_modules/GetGitRevisionDescription.cmake
+++ b/build/cmake_modules/GetGitRevisionDescription.cmake
@ -59,7 +59,7 @@ get_filename_component(_gitdescmoddir ${CMAKE_CURRENT_LIST_FILE} PATH)
 # function returns an empty string via _git_dir_var.
 #
 # Example: Given a path C:/bla/foo/bar and assuming C:/bla/.git exists and
-# neither foo nor bar contain a file/directory .git. This will return
+# neither foo nor bar contain a file/directory .git. This wil return
 # C:/bla/.git
 #
 function(_git_find_closest_git_dir _start_dir _git_dir_var)
--- a/contrib/certificates/reseed/hiduser0_at_mail.i2p.crt
+++ b/contrib/certificates/reseed/hiduser0_at_mail.i2p.crt
@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFgTCCA2mgAwIBAgIETWAY1DANBgkqhkiG9w0BAQ0FADBxMQswCQYDVQQGEwJY
+WDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMR4wHAYDVQQKDBVJMlAgQW5vbnlt
+b3VzIE5ldHdvcmsxDDAKBgNVBAsMA0kyUDEaMBgGA1UEAwwRaGlkdXNlcjBAbWFp
+bC5pMnAwHhcNMjExMjEzMTU0MDI3WhcNMzExMjExMTU0MDI3WjBxMQswCQYDVQQG
+EwJYWDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMR4wHAYDVQQKDBVJMlAgQW5v
+bnltb3VzIE5ldHdvcmsxDDAKBgNVBAsMA0kyUDEaMBgGA1UEAwwRaGlkdXNlcjBA
+bWFpbC5pMnAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXnjJ8UQ0f
+lHHpfPMiHofBPSuL4sbOJY6fOXwPhSg/h6THh9DS/ZWmJXQ3qRD0glDVtv4/Dr/9
+ldGQ5eltF9iCFXCQlMEy2HjQrBKq0nsl7RpYK12cyMaod0kkzCUk9ITLi9CmHM3Z
+gQZcmG8TWjFEpDR+idx/QkQt2pcO4vzWlDit3Vh4ivnbX5jGQHbsVjQEMQWxr+pX
+dsS+YQpjZ6RBmrooGTPO8QDOOeYLAn0lCjmffc/kzIH9E/p4/O0rOpyhVYbdxUD1
+5wkqN9l4yrtxmORG/PudnRQQ0r4TUq8vsxfGY0Euo9IbhgXF2Parel1ZhDxB1WZV
+VwWtgLIh9jGA1UMa8SYKnEfp8LWNZ3b3mUUnZb3kMrLk6jGYRWNsHmamhd4mC7AZ
+qf/8lOkEIw3bPd3YguCDRVcLui5BwIEZmqXg8uoESxfO/sW3pBrN/8M7MkTex9kN
+vjitGDDXvenK27qmNgZxbBlX72yTSfys7XTYTLnxZC8AwdAo2Wz9Z6HhGiPonf2h
+vZkc9ZxuE0jFIrsbJra4X7iyjXgi4vV4ARNg/9Ft6F4/OIbECgeDcBQqq4TlT2bZ
+EfWVrBbqXoj5vNsLigIkd+AyUNwPYEcB5IFSiiOh98pC7BH3pg0m8U5YBjxe1i+9
+EQOOG0Qtx+JigXZHu6bGE0Twy9zy+UzoKQIDAQABoyEwHzAdBgNVHQ4EFgQUGK1b
+0DkL6aLalcfBc/Uj/SF08C0wDQYJKoZIhvcNAQENBQADggIBAMpXM82bJDpH1TlH
+TvhU3Z7nfZdvEhOQfujaFUYiuNripuEKcFGn948+DvAG0FUN+uNlJoqOVs8D7InD
+gWlA9zpqw5Cl5Hij/Wns9QbXuAHJeA23fVUoaM2A6v9ifcIQ1A+rDuRQAo6/64KW
+ChTg2e99RBpfGOyqgeh7tLLe0lPPekVpKHFuXabokaKRDuBcVHcUL4tWXe3dcyqa
+Ej/PJrrS+nWL0EGZ4q80CEd2LPuDzPxNGCJt/R7ZfadENWajcgcXGceh1QBzozrB
+SL/Ya6wF9SrsB7V/r5wX0LM4ZdDaLWbtmUe5Op0h/ZMH25Sa8xAXVz+O9L6sWSoO
+FaiYTOvAiyyPz+nsxKa3xYryDHno7eKSt+hGOcaurhxbdZaEFY/CegEc73tCt9xK
+e9qF8O/WkDLmixuErw3f5en4IfzGR7p3lJAwW/8WD8C6HS39h/eE7dVZNaWgtQnZ
+SgGjgZMTJqTcQ3aZmfuCZefxGFok8w6AIkdbnd1pdMBRjYu8aXgl2hQSB9ZADDE9
+R5d3rXi0PkSFLIvsNjVa5KXrZk/tB0Hpfmepq7CufBqjP/LG9TieRoXzLYUKFF74
+QRwjP+y7AJ+VDUTpY1NV1P+k+2raubU2bOnLF3zL5DtyoyieGPhyeMMvp0fRIxdg
+bSl5VHgPXHNM8mcnndMAuzvl7jEK
+-----END CERTIFICATE-----
--- a/contrib/debian/trusty/patches/01-upnp.patch
+++ b/contrib/debian/trusty/patches/01-upnp.patch
@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>

 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2024-12-30
+Last-Update: 2022-03-23

 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ # import source files lists
- include filelist.mk
+@@ -31,7 +31,7 @@ include filelist.mk
 
+ USE_AESNI       := $(or $(USE_AESNI),yes)
 USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)
--- a/contrib/debian/xenial/patches/01-upnp.patch
+++ b/contrib/debian/xenial/patches/01-upnp.patch
@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>

 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2024-12-30
+Last-Update: 2022-03-23

 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ # import source files lists
- include filelist.mk
+@@ -31,7 +31,7 @@ include filelist.mk
 
+ USE_AESNI       := $(or $(USE_AESNI),yes)
 USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)
--- a/contrib/i2pd.conf
+++ b/contrib/i2pd.conf
@ -243,7 +243,7 @@ verify = true
 ## Default: reg.i2p at "mainline" I2P Network
 # defaulturl = http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt
 ## Optional subscriptions URLs, separated by comma
-# subscriptions = http://reg.i2p/hosts.txt,http://identiguy.i2p/hosts.txt,http://stats.i2p/cgi-bin/newhosts.txt
+# subscriptions = http://reg.i2p/hosts.txt,http://identiguy.i2p/hosts.txt,http://stats.i2p/cgi-bin/newhosts.txt,http://rus.i2p/hosts.txt

 [limits]
 ## Maximum active transit sessions (default: 5000)
@ -277,3 +277,9 @@ verify = true
 ## Save full addresses on disk (default: true)
 # addressbook = true

+[cpuext]
+## Use CPU AES-NI instructions set when work with cryptography when available (default: true)
+# aesni = true
+## Force usage of CPU instructions set, even if they not found (default: false)
+## DO NOT TOUCH that option if you really don't know what are you doing!
+# force = false
--- a/contrib/i2pd.service
+++ b/contrib/i2pd.service
@ -1,8 +1,7 @@
 [Unit]
 Description=I2P Router written in C++
 Documentation=man:i2pd(1) https://i2pd.readthedocs.io/en/latest/
-Wants=network.target
-After=network.target network-online.target
+After=network.target

 [Service]
 User=i2pd
--- a/contrib/rpm/i2pd-git.spec
+++ b/contrib/rpm/i2pd-git.spec
@ -1,7 +1,7 @@
 %define git_hash %(git rev-parse HEAD | cut -c -7)

 Name:          i2pd-git
-Version:       2.56.0
+Version:       2.53.1
 Release:       git%{git_hash}%{?dist}
 Summary:       I2P router written in C++
 Conflicts:     i2pd
@ -24,7 +24,7 @@ BuildRequires: openssl-devel
 BuildRequires: miniupnpc-devel
 BuildRequires: systemd-units

-%if 0%{?fedora} == 41
+%if 0%{?fedora} > 40 || 0%{?eln}
 BuildRequires: openssl-devel-engine
 %endif

@ -148,15 +148,6 @@ getent passwd i2pd >/dev/null || \


 %changelog
-* Tue Feb 11 2025 orignal <orignal@i2pmail.org> - 2.56.0
- update to 2.56.0
-
-* Mon Dec 30 2024 orignal <orignal@i2pmail.org> - 2.55.0
- update to 2.55.0
-
-* Sun Oct 6 2024 orignal <orignal@i2pmail.org> - 2.54.0
- update to 2.54.0
-
 * Tue Jul 30 2024 orignal <orignal@i2pmail.org> - 2.53.1
 - update to 2.53.1

--- a/contrib/rpm/i2pd.spec
+++ b/contrib/rpm/i2pd.spec
@ -1,5 +1,5 @@
 Name:          i2pd
-Version:       2.56.0
+Version:       2.53.1
 Release:       1%{?dist}
 Summary:       I2P router written in C++
 Conflicts:     i2pd-git
@ -22,7 +22,7 @@ BuildRequires: openssl-devel
 BuildRequires: miniupnpc-devel
 BuildRequires: systemd-units

-%if 0%{?fedora} == 41
+%if 0%{?fedora} > 40 || 0%{?eln}
 BuildRequires: openssl-devel-engine
 %endif

@ -146,15 +146,6 @@ getent passwd i2pd >/dev/null || \


 %changelog
-* Tue Feb 11 2025 orignal <orignal@i2pmail.org> - 2.56.0
- update to 2.56.0
-
-* Mon Dec 30 2024 orignal <orignal@i2pmail.org> - 2.55.0
- update to 2.55.0
-
-* Sun Oct 6 2024 orignal <orignal@i2pmail.org> - 2.54.0
- update to 2.54.0
-
 * Tue Jul 30 2024 orignal <orignal@i2pmail.org> - 2.53.1
 - update to 2.53.1

--- a/contrib/tunnels.conf
+++ b/contrib/tunnels.conf
@ -5,7 +5,6 @@ port = 6668
 destination = irc.ilita.i2p
 destinationport = 6667
 keys = irc-keys.dat
-i2p.streaming.profile=2

 #[IRC-IRC2P]
 #type = client
--- a/daemon/Daemon.cpp
+++ b/daemon/Daemon.cpp
@ -149,10 +149,12 @@ namespace util
 		LogPrint(eLogDebug, "FS: Certificates directory: ", certsdir);

 		bool precomputation; i2p::config::GetOption("precomputation.elgamal", precomputation);
+		bool aesni; i2p::config::GetOption("cpuext.aesni", aesni);
+		bool forceCpuExt; i2p::config::GetOption("cpuext.force", forceCpuExt);
 		bool ssu; i2p::config::GetOption("ssu", ssu);
 		if (!ssu && i2p::config::IsDefault ("precomputation.elgamal"))
 			precomputation = false; // we don't elgamal table if no ssu, unless it's specified explicitly
-		i2p::crypto::InitCrypto (precomputation);
+		i2p::crypto::InitCrypto (precomputation, aesni, forceCpuExt);

 		i2p::transport::InitAddressFromIface (); // get address4/6 from interfaces

--- a/daemon/HTTPServer.cpp
+++ b/daemon/HTTPServer.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -132,8 +132,7 @@ namespace http {

 	static void ShowTunnelDetails (std::stringstream& s, enum i2p::tunnel::TunnelState eState, bool explr, int bytes)
 	{
-		std::string state;
-		std::string_view stateText;
+		std::string state, stateText;
 		switch (eState) 
 		{
 			case i2p::tunnel::eTunnelStateBuildReplyReceived :
@ -147,7 +146,7 @@ namespace http {
 		}
 		if (stateText.empty ()) stateText = tr(state);
 		
-		s << "<span class=\"tunnel " << state << "\"> " << stateText << ((explr) ? " (" + std::string(tr("exploratory")) + ")" : "") << "</span>, "; // TODO:
+		s << "<span class=\"tunnel " << state << "\"> " << stateText << ((explr) ? " (" + tr("exploratory") + ")" : "") << "</span>, ";
 		ShowTraffic(s, bytes);
 		s << "\r\n";
 	}
@ -214,7 +213,7 @@ namespace http {
 			"</html>\r\n";
 	}

-	static void ShowError(std::stringstream& s, std::string_view string)
+	static void ShowError(std::stringstream& s, const std::string& string)
 	{
 		s << "<b>" << tr("ERROR") << ":</b>&nbsp;" << string << "<br>\r\n";
 	}
@ -702,7 +701,6 @@ namespace http {
 	{
 		s << "<b>" << tr("Tunnels") << ":</b><br>\r\n";
 		s << "<b>" << tr("Queue size") << ":</b> " << i2p::tunnel::tunnels.GetQueueSize () << "<br>\r\n<br>\r\n";
-		s << "<b>" << tr("TBM Queue size") << ":</b> " << i2p::tunnel::tunnels.GetTBMQueueSize () << "<br>\r\n<br>\r\n";

 		auto ExplPool = i2p::tunnel::tunnels.GetExploratoryPool ();

@ -827,7 +825,7 @@ namespace http {
 		if (i2p::tunnel::tunnels.CountTransitTunnels())
 		{
 			s << "<b>" << tr("Transit Tunnels") << ":</b><br>\r\n";
-			s << "<table><thead><th>&#8658;</th><th>ID</th><th>&#8658;</th><th>" << tr("Amount") << "</th><th>" << tr("Next") << "</th></thead><tbody class=\"tableitem\">";
+			s << "<table><thead><th>&#8658;</th><th>ID</th><th>&#8658;</th><th>" << tr("Amount") << "</th></thead><tbody class=\"tableitem\">";
 			for (const auto& it: i2p::tunnel::tunnels.GetTransitTunnels ())
 			{
 				if (std::dynamic_pointer_cast<i2p::tunnel::TransitTunnelGateway>(it))
@ -837,7 +835,7 @@ namespace http {
 				else
 					s << "<tr><td>&#8658;</td><td>" << it->GetTunnelID () << "</td><td>&#8658;</td><td>";
 				ShowTraffic(s, it->GetNumTransmittedBytes ());
-				s << "</td><td>" << it->GetNextPeerName () << "</td></tr>\r\n";
+				s << "</td></tr>\r\n";
 			}
 			s << "</tbody></table>\r\n";
 		}
@ -1263,7 +1261,7 @@ namespace http {
 			ShowLeasesSets(s);
 		else {
 			res.code = 400;
-			ShowError(s, std::string (tr("Unknown page")) + ": " + page); // TODO
+			ShowError(s, tr("Unknown page") + ": " + page);
 			return;
 		}
 	}
@ -1419,11 +1417,13 @@ namespace http {
 					{
 						auto signatureLen = dest->GetIdentity ()->GetSignatureLen ();
 						uint8_t * signature = new uint8_t[signatureLen];
+						char * sig = new char[signatureLen*2];
 						std::stringstream out;

 						out << name << "=" << dest->GetIdentity ()->ToBase64 ();
 						dest->Sign ((uint8_t *)out.str ().c_str (), out.str ().length (), signature);
-						auto sig = i2p::data::ByteStreamToBase64 (signature, signatureLen);
+						auto len = i2p::data::ByteStreamToBase64 (signature, signatureLen, sig, signatureLen*2);
+						sig[len] = 0;
 						out << "#!sig=" << sig;
 						s << "<b>" << tr("SUCCESS") << "</b>:<br>\r\n<form action=\"http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/add\" method=\"post\" rel=\"noreferrer\" target=\"_blank\">\r\n"
 						     "<textarea readonly name=\"record\" cols=\"80\" rows=\"10\">" << out.str () << "</textarea>\r\n<br>\r\n<br>\r\n"
@ -1432,6 +1432,7 @@ namespace http {
 						     "<input type=\"submit\" value=\"" << tr("Submit") << "\">\r\n"
 						     "</form>\r\n<br>\r\n";
 						delete[] signature;
+						delete[] sig;
 					}
 					else
 						s << "<b>" << tr("ERROR") << "</b>:&nbsp;" << tr("Domain can't end with .b32.i2p") << "\r\n<br>\r\n<br>\r\n";
@ -1460,7 +1461,7 @@ namespace http {
 		else
 		{
 			res.code = 400;
-			ShowError(s, std::string (tr("Unknown command")) + ": " + cmd); // TODO
+			ShowError(s, tr("Unknown command") + ": " + cmd);
 			return;
 		}

@ -1479,13 +1480,13 @@ namespace http {
 		reply.body = content;

 		m_SendBuffer = reply.to_string();
-		boost::asio::async_write (*m_Socket, boost::asio::buffer(m_SendBuffer), boost::asio::transfer_all (), 
+		boost::asio::async_write (*m_Socket, boost::asio::buffer(m_SendBuffer),
 			std::bind (&HTTPConnection::Terminate, shared_from_this (), std::placeholders::_1));
 	}

 	HTTPServer::HTTPServer (const std::string& address, int port):
-		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service.get_executor ()),
-		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::make_address(address), port)),
+		m_IsRunning (false), m_Thread (nullptr), m_Work (m_Service),
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint (boost::asio::ip::address::from_string(address), port)),
 		m_Hostname(address)
 	{
 	}
--- a/daemon/HTTPServer.h
+++ b/daemon/HTTPServer.h
@ -83,8 +83,8 @@ namespace http

 			bool m_IsRunning;
 			std::unique_ptr<std::thread> m_Thread;
-			boost::asio::io_context m_Service;
-			boost::asio::executor_work_guard<boost::asio::io_context::executor_type> m_Work;
+			boost::asio::io_service m_Service;
+			boost::asio::io_service::work m_Work;
 			boost::asio::ip::tcp::acceptor m_Acceptor;
 			std::string m_Hostname;
 	};
--- a/daemon/I2PControl.cpp
+++ b/daemon/I2PControl.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -8,13 +8,16 @@

 #include <stdio.h>
 #include <sstream>
-#include <iomanip>
 #include <openssl/x509.h>
 #include <openssl/pem.h>

 // Use global placeholders from boost introduced when local_time.hpp is loaded
 #define BOOST_BIND_GLOBAL_PLACEHOLDERS
+
+#include <boost/date_time/local_time/local_time.hpp>
+#include <boost/date_time/posix_time/posix_time.hpp>
 #include <boost/property_tree/json_parser.hpp>
+#include <boost/lexical_cast.hpp>

 #include "FS.h"
 #include "Log.h"
@ -29,24 +32,11 @@ namespace i2p
 namespace client
 {
 	I2PControlService::I2PControlService (const std::string& address, int port):
-		m_IsRunning (false),	
+		m_IsRunning (false), m_Thread (nullptr),
+		m_Acceptor (m_Service, boost::asio::ip::tcp::endpoint(boost::asio::ip::address::from_string(address), port)),
 		m_SSLContext (boost::asio::ssl::context::sslv23),
 		m_ShutdownTimer (m_Service)
 	{
-		if (port)		
-			m_Acceptor = std::make_unique<boost::asio::ip::tcp::acceptor>(m_Service,
-				boost::asio::ip::tcp::endpoint(boost::asio::ip::make_address(address), port));
-		else
-#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
-		{		
-			std::remove (address.c_str ());	// just in case
-			m_LocalAcceptor = std::make_unique<boost::asio::local::stream_protocol::acceptor>(m_Service,
-				boost::asio::local::stream_protocol::endpoint(address));	
-		}	
-#else
-			LogPrint(eLogError, "I2PControl: Local sockets are not supported");
-#endif				
-				
 		i2p::config::GetOption("i2pcontrol.password", m_Password);

 		// certificate / keys
@ -57,29 +47,15 @@ namespace client
 			i2pcp_crt = i2p::fs::DataDirPath(i2pcp_crt);
 		if (i2pcp_key.at(0) != '/')
 			i2pcp_key = i2p::fs::DataDirPath(i2pcp_key);
-		if (!i2p::fs::Exists (i2pcp_crt) || !i2p::fs::Exists (i2pcp_key)) 
-		{
+		if (!i2p::fs::Exists (i2pcp_crt) || !i2p::fs::Exists (i2pcp_key)) {
 			LogPrint (eLogInfo, "I2PControl: Creating new certificate for control connection");
 			CreateCertificate (i2pcp_crt.c_str(), i2pcp_key.c_str());
-		} 
-		else 
+		} else {
 			LogPrint(eLogDebug, "I2PControl: Using cert from ", i2pcp_crt);
-		m_SSLContext.set_options (boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::no_sslv2 | boost::asio::ssl::context::single_dh_use);
-		boost::system::error_code ec;
-		m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem, ec);
-		if (!ec)		
-			m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem, ec);
-		if (ec)
-		{
-			LogPrint (eLogInfo, "I2PControl: Failed to load ceritifcate: ", ec.message (), ". Recreating");
-			CreateCertificate (i2pcp_crt.c_str(), i2pcp_key.c_str());
-			m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem, ec);
-			if (!ec)		
-				m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem, ec);
-			if (ec) 
-				// give up
-				LogPrint (eLogError, "I2PControl: Can't load certificates");
 		}
+		m_SSLContext.set_options (boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::no_sslv2 | boost::asio::ssl::context::single_dh_use);
+		m_SSLContext.use_certificate_file (i2pcp_crt, boost::asio::ssl::context::pem);
+		m_SSLContext.use_private_key_file (i2pcp_key, boost::asio::ssl::context::pem);

 		// handlers
 		m_MethodHandlers["Authenticate"]       = &I2PControlService::AuthenticateHandler;
@ -110,7 +86,7 @@ namespace client
 		{
 			Accept ();
 			m_IsRunning = true;
-			m_Thread = std::make_unique<std::thread>(std::bind (&I2PControlService::Run, this));
+			m_Thread = new std::thread (std::bind (&I2PControlService::Run, this));
 		}
 	}

@ -119,19 +95,12 @@ namespace client
 		if (m_IsRunning)
 		{
 			m_IsRunning = false;
-			if (m_Acceptor) m_Acceptor->cancel ();
-#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
-			if (m_LocalAcceptor) 
-			{
-				auto path = m_LocalAcceptor->local_endpoint().path();
-				m_LocalAcceptor->cancel ();
-				std::remove (path.c_str ());
-			}	
-#endif			
+			m_Acceptor.cancel ();
 			m_Service.stop ();
 			if (m_Thread)
 			{
 				m_Thread->join ();
+				delete m_Thread;
 				m_Thread = nullptr;
 			}
 		}
@ -153,60 +122,40 @@ namespace client

 	void I2PControlService::Accept ()
 	{
-		if (m_Acceptor)
-		{	
-			auto newSocket = std::make_shared<boost::asio::ssl::stream<boost::asio::ip::tcp::socket> > (m_Service, m_SSLContext);
-			m_Acceptor->async_accept (newSocket->lowest_layer(),
-				[this, newSocket](const boost::system::error_code& ecode)
-				{
-					HandleAccepted (ecode, newSocket);
-				});		
-		}	
-#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
-		else if (m_LocalAcceptor)
-		{
-			auto newSocket = std::make_shared<boost::asio::ssl::stream<boost::asio::local::stream_protocol::socket> > (m_Service, m_SSLContext);
-			m_LocalAcceptor->async_accept (newSocket->lowest_layer(),
-				[this, newSocket](const boost::system::error_code& ecode)
-				{
-					HandleAccepted (ecode, newSocket);
-				});		
-		}	
-#endif		
+		auto newSocket = std::make_shared<ssl_socket> (m_Service, m_SSLContext);
+		m_Acceptor.async_accept (newSocket->lowest_layer(), std::bind (&I2PControlService::HandleAccept, this,
+			std::placeholders::_1, newSocket));
 	}

-	template<typename ssl_socket> 
-	void I2PControlService::HandleAccepted (const boost::system::error_code& ecode,
-		std::shared_ptr<ssl_socket> newSocket)
+	void I2PControlService::HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket)
 	{
 		if (ecode != boost::asio::error::operation_aborted)
 			Accept ();

-		if (ecode) 
-		{
+		if (ecode) {
 			LogPrint (eLogError, "I2PControl: Accept error: ", ecode.message ());
 			return;
 		}
-		LogPrint (eLogDebug, "I2PControl: New request from ", newSocket->lowest_layer ().remote_endpoint ());
-		Handshake (newSocket);
+		LogPrint (eLogDebug, "I2PControl: New request from ", socket->lowest_layer ().remote_endpoint ());
+		Handshake (socket);
 	}

-	template<typename ssl_socket>
 	void I2PControlService::Handshake (std::shared_ptr<ssl_socket> socket)
 	{
 		socket->async_handshake(boost::asio::ssl::stream_base::server,
-			[this, socket](const boost::system::error_code& ecode)
-		    {
-				if (ecode) 
+		std::bind( &I2PControlService::HandleHandshake, this, std::placeholders::_1, socket));
+	}
+
+	void I2PControlService::HandleHandshake (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket)
 	{
+		if (ecode) {
 			LogPrint (eLogError, "I2PControl: Handshake error: ", ecode.message ());
 			return;
 		}
+		//std::this_thread::sleep_for (std::chrono::milliseconds(5));
 		ReadRequest (socket);
-			});			                        
 	}

-	template<typename ssl_socket>
 	void I2PControlService::ReadRequest (std::shared_ptr<ssl_socket> socket)
 	{
 		auto request = std::make_shared<I2PControlBuffer>();
@ -216,13 +165,10 @@ namespace client
 #else
 			boost::asio::buffer (request->data (), request->size ()),
 #endif
-		    [this, socket, request](const boost::system::error_code& ecode, size_t bytes_transferred)
-		    {
-				HandleRequestReceived (ecode, bytes_transferred, socket, request);
-			});
+			std::bind(&I2PControlService::HandleRequestReceived, this,
+			std::placeholders::_1, std::placeholders::_2, socket, request));
 	}

-	template<typename ssl_socket>
 	void I2PControlService::HandleRequestReceived (const boost::system::error_code& ecode,
 		size_t bytes_transferred, std::shared_ptr<ssl_socket> socket,
 		std::shared_ptr<I2PControlBuffer> buf)
@ -300,7 +246,6 @@ namespace client
 		}
 	}

-	template<typename ssl_socket>
 	void I2PControlService::SendResponse (std::shared_ptr<ssl_socket> socket,
 		std::shared_ptr<I2PControlBuffer> buf, std::ostringstream& response, bool isHtml)
 	{
@ -310,12 +255,12 @@ namespace client
 			std::ostringstream header;
 			header << "HTTP/1.1 200 OK\r\n";
 			header << "Connection: close\r\n";
-			header << "Content-Length: " << std::to_string(len) << "\r\n";
+			header << "Content-Length: " << boost::lexical_cast<std::string>(len) << "\r\n";
 			header << "Content-Type: application/json\r\n";
 			header << "Date: ";
-			std::time_t t = std::time (nullptr);
-    		std::tm tm = *std::gmtime (&t);
-			header << std::put_time(&tm, "%a, %d %b %Y %T GMT") << "\r\n";
+			auto facet = new boost::local_time::local_time_facet ("%a, %d %b %Y %H:%M:%S GMT");
+			header.imbue(std::locale (header.getloc(), facet));
+			header << boost::posix_time::second_clock::local_time() << "\r\n";
 			header << "\r\n";
 			offset = header.str ().size ();
 			memcpy (buf->data (), header.str ().c_str (), offset);
@ -323,11 +268,16 @@ namespace client
 		memcpy (buf->data () + offset, response.str ().c_str (), len);
 		boost::asio::async_write (*socket, boost::asio::buffer (buf->data (), offset + len),
 			boost::asio::transfer_all (),
-		    [socket, buf](const boost::system::error_code& ecode, std::size_t bytes_transferred)
+			std::bind(&I2PControlService::HandleResponseSent, this,
+				std::placeholders::_1, std::placeholders::_2, socket, buf));
+	}
+
+	void I2PControlService::HandleResponseSent (const boost::system::error_code& ecode, std::size_t bytes_transferred,
+		std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf)
 	{
-				if (ecode)
+		if (ecode) {
 			LogPrint (eLogError, "I2PControl: Write error: ", ecode.message ());
-			});	
+		}
 	}

 // handlers
@ -455,7 +405,7 @@ namespace client
 			X509_NAME_add_entry_by_txt (name, "O",  MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_ORGANIZATION, -1, -1, 0); // organization
 			X509_NAME_add_entry_by_txt (name, "CN", MBSTRING_ASC, (unsigned char *)I2P_CONTROL_CERTIFICATE_COMMON_NAME, -1, -1, 0); // common name
 			X509_set_issuer_name (x509, name); // set issuer to ourselves
-			X509_sign (x509, pkey, EVP_sha1 ()); // sign, last param must be NULL for EdDSA
+			X509_sign (x509, pkey, EVP_sha1 ()); // sign

 			// save cert
 			if ((f = fopen (crt_path, "wb")) != NULL) {
--- a/daemon/I2PControl.h
+++ b/daemon/I2PControl.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -35,6 +35,8 @@ namespace client

 	class I2PControlService: public I2PControlHandlers
 	{
+		typedef boost::asio::ssl::stream<boost::asio::ip::tcp::socket> ssl_socket;
+
 		public:

 			I2PControlService (const std::string& address, int port);
@ -47,18 +49,16 @@ namespace client

 			void Run ();
 			void Accept ();
-			template<typename ssl_socket> 
-			void HandleAccepted (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> newSocket);
-			template<typename ssl_socket>
+			void HandleAccept(const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket);
 			void Handshake (std::shared_ptr<ssl_socket> socket);
-			template<typename ssl_socket>
+			void HandleHandshake (const boost::system::error_code& ecode, std::shared_ptr<ssl_socket> socket);
 			void ReadRequest (std::shared_ptr<ssl_socket> socket);
-			template<typename ssl_socket>
 			void HandleRequestReceived (const boost::system::error_code& ecode, size_t bytes_transferred,
 				std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf);
-			template<typename ssl_socket>
 			void SendResponse (std::shared_ptr<ssl_socket> socket,
 				std::shared_ptr<I2PControlBuffer> buf, std::ostringstream& response, bool isHtml);
+			void HandleResponseSent (const boost::system::error_code& ecode, std::size_t bytes_transferred,
+				std::shared_ptr<ssl_socket> socket, std::shared_ptr<I2PControlBuffer> buf);

 			void CreateCertificate (const char *crt_path, const char *key_path);

@ -86,13 +86,10 @@ namespace client

 			std::string m_Password;
 			bool m_IsRunning;
-			std::unique_ptr<std::thread> m_Thread;
+			std::thread * m_Thread;

-			boost::asio::io_context m_Service;
-			std::unique_ptr<boost::asio::ip::tcp::acceptor> m_Acceptor;
-#if defined(BOOST_ASIO_HAS_LOCAL_SOCKETS)
-			std::unique_ptr<boost::asio::local::stream_protocol::acceptor> m_LocalAcceptor;
-#endif		
+			boost::asio::io_service m_Service;
+			boost::asio::ip::tcp::acceptor m_Acceptor;
 			boost::asio::ssl::context m_SSLContext;
 			boost::asio::deadline_timer m_ShutdownTimer;
 			std::set<std::string> m_Tokens;
--- a/daemon/UPnP.cpp
+++ b/daemon/UPnP.cpp
@ -52,7 +52,7 @@ namespace transport
 	{
 		m_IsRunning = true;
 		LogPrint(eLogInfo, "UPnP: Starting");
-		boost::asio::post (m_Service, std::bind (&UPnP::Discover, this));
+		m_Service.post (std::bind (&UPnP::Discover, this));
 		std::unique_lock<std::mutex> l(m_StartedMutex);
 		m_Thread.reset (new std::thread (std::bind (&UPnP::Run, this)));
 		m_Started.wait_for (l, std::chrono::seconds (5)); // 5 seconds maximum
@ -150,7 +150,7 @@ namespace transport

 		// UPnP discovered
 		LogPrint (eLogDebug, "UPnP: ExternalIPAddress is ", m_externalIPAddress);
-		i2p::context.UpdateAddress (boost::asio::ip::make_address (m_externalIPAddress));
+		i2p::context.UpdateAddress (boost::asio::ip::address::from_string (m_externalIPAddress));
 		// port mapping
 		PortMapping ();
 	}
--- a/daemon/UPnP.h
+++ b/daemon/UPnP.h
@ -67,7 +67,7 @@ namespace transport
 			std::unique_ptr<std::thread> m_Thread;
 			std::condition_variable m_Started;
 			std::mutex m_StartedMutex;
-			boost::asio::io_context m_Service;
+			boost::asio::io_service m_Service;
 			boost::asio::deadline_timer m_Timer;
 			bool m_upnpUrlsInitialized = false;
 			struct UPNPUrls m_upnpUrls;
--- a/daemon/UnixDaemon.cpp
+++ b/daemon/UnixDaemon.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -25,7 +25,6 @@
 #include "RouterContext.h"
 #include "ClientContext.h"
 #include "Transports.h"
-#include "util.h"

 void handle_signal(int sig)
 {
@ -221,7 +220,6 @@ namespace i2p

 		void DaemonLinux::run ()
 		{
-			i2p::util::SetThreadName ("i2pd-daemon");
 			while (running)
 			{
 				std::this_thread::sleep_for (std::chrono::seconds(1));
--- a/debian/changelog
+++ b/debian/changelog
@ -1,21 +1,3 @@
-i2pd (2.56.0-1) unstable; urgency=medium
-
-  * updated to version 2.56.0/0.9.65
-
- -- orignal <orignal@i2pmail.org>  Tue, 11 Feb 2025 16:00:00 +0000
-
-i2pd (2.55.0-1) unstable; urgency=medium
-
-  * updated to version 2.55.0
-
- -- orignal <orignal@i2pmail.org>  Mon, 30 Dec 2024 16:00:00 +0000
-
-i2pd (2.54.0-1) unstable; urgency=medium
-
-  * updated to version 2.54.0/0.9.64
-
- -- orignal <orignal@i2pmail.org>  Sun, 6 Oct 2024 16:00:00 +0000
-
 i2pd (2.53.1-1) unstable; urgency=medium

  * updated to version 2.53.1
--- a/debian/patches/01-upnp.patch
+++ b/debian/patches/01-upnp.patch
@ -2,13 +2,13 @@ Description: Enable UPnP usage in package
 Author: r4sas <r4sas@i2pmail.org>

 Reviewed-By: r4sas <r4sas@i2pmail.org>
-Last-Update: 2024-12-30
+Last-Update: 2022-03-23

 --- i2pd.orig/Makefile
 +++ i2pd/Makefile
-@@ -31,7 +31,7 @@ # import source files lists
- include filelist.mk
+@@ -31,7 +31,7 @@ include filelist.mk
 
+ USE_AESNI       := $(or $(USE_AESNI),yes)
 USE_STATIC      := $(or $(USE_STATIC),no)
 -USE_UPNP        := $(or $(USE_UPNP),no)
 +USE_UPNP        := $(or $(USE_UPNP),yes)
--- a/i18n/Afrikaans.cpp
+++ b/i18n/Afrikaans.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace afrikaans // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"failed", "Het misluk"},
 		{"unknown", "onbekend"},
--- a/i18n/Armenian.cpp
+++ b/i18n/Armenian.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace armenian // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f ԿիԲ"},
 		{"%.2f MiB", "%.2f ՄիԲ"},
--- a/i18n/Chinese.cpp
+++ b/i18n/Chinese.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace chinese // language namespace
 		return 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
@ -64,7 +64,7 @@ namespace chinese // language namespace
 		{"Full cone NAT", "全锥型NAT"},
 		{"No Descriptors", "无描述符"},
 		{"Uptime", "运行时间"},
-		{"Network status", "网络状态"},
+		{"Network status", "IPv4 网络状态"},
 		{"Network status v6", "IPv6 网络状态"},
 		{"Stopping in", "距停止还有："},
 		{"Family", "家族"},
--- a/i18n/Czech.cpp
+++ b/i18n/Czech.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace czech // language namespace
 		return (n == 1) ? 0 : (n >= 2 && n <= 4) ? 1 : 2;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/English.cpp
+++ b/i18n/English.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -30,7 +30,7 @@ namespace english // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"", ""},
 	};
--- a/i18n/French.cpp
+++ b/i18n/French.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace french // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f Kio"},
 		{"%.2f MiB", "%.2f Mio"},
--- a/i18n/German.cpp
+++ b/i18n/German.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace german // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/I18N.cpp
+++ b/i18n/I18N.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -30,12 +30,12 @@ namespace i18n
 		}
 	}

-	std::string_view translate (std::string_view arg)
+	std::string translate (const std::string& arg)
 	{
 		return i2p::client::context.GetLanguage ()->GetString (arg);
 	}

-	std::string translate (const std::string& arg, const std::string& arg2, const int n)
+	std::string translate (const std::string& arg, const std::string& arg2, const int& n)
 	{
 		return i2p::client::context.GetLanguage ()->GetPlural (arg, arg2, n);
 	}
--- a/i18n/I18N.h
+++ b/i18n/I18N.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -10,7 +10,6 @@
 #define __I18N_H__

 #include <string>
-#include <string_view>
 #include <map>
 #include <utility>
 #include <functional>
@ -19,13 +18,12 @@ namespace i2p
 {
 namespace i18n
 {
-	typedef std::map<std::string_view, std::string_view> LocaleStrings; 
 	class Locale
 	{
 		public:
 			Locale (
 				const std::string& language,
-				const LocaleStrings& strings,
+				const std::map<std::string, std::string>& strings,
 				const std::map<std::string, std::vector<std::string>>& plurals,
 				std::function<int(int)> formula
 			): m_Language (language), m_Strings (strings), m_Plurals (plurals), m_Formula (formula) { };
@ -36,7 +34,7 @@ namespace i18n
 				return m_Language;
 			}

-			std::string_view GetString (std::string_view arg) const
+			std::string GetString (const std::string& arg) const
 			{
 				const auto it = m_Strings.find(arg);
 				if (it == m_Strings.end())
@ -49,7 +47,7 @@ namespace i18n
 				}
 			}

-			std::string GetPlural (const std::string& arg, const std::string& arg2, int n) const
+			std::string GetPlural (const std::string& arg, const std::string& arg2, const int& n) const
 			{
 				const auto it = m_Plurals.find(arg2);
 				if (it == m_Plurals.end()) // not found, fallback to english
@ -65,14 +63,14 @@ namespace i18n

 		private:
 			const std::string m_Language;
-			const LocaleStrings m_Strings;
+			const std::map<std::string, std::string> m_Strings;
 			const std::map<std::string, std::vector<std::string>> m_Plurals;
 			std::function<int(int)> m_Formula;
 	};

 	void SetLanguage(const std::string &lang);
-	std::string_view translate (std::string_view arg);
-	std::string translate (const std::string& arg, const std::string& arg2, int n);
+	std::string translate (const std::string& arg);
+	std::string translate (const std::string& arg, const std::string& arg2, const int& n);
 } // i18n
 } // i2p

@ -81,7 +79,7 @@ namespace i18n
 * @param arg String with message
 */
 template<typename TValue>
-std::string_view tr (TValue&& arg)
+std::string tr (TValue&& arg)
 {
 	return i2p::i18n::translate(std::forward<TValue>(arg));
 }
@ -94,7 +92,7 @@ std::string_view tr (TValue&& arg)
 template<typename TValue, typename... TArgs>
 std::string tr (TValue&& arg, TArgs&&... args)
 {
-	std::string tr_str = std::string (i2p::i18n::translate(std::forward<TValue>(arg))); // TODO:
+	std::string tr_str = i2p::i18n::translate(std::forward<TValue>(arg));

 	size_t size = std::snprintf(NULL, 0, tr_str.c_str(), std::forward<TArgs>(args)...);
 	std::string str(size, 0);
@ -110,7 +108,7 @@ std::string tr (TValue&& arg, TArgs&&... args)
 * @param n Integer, used for selection of form
 */
 template<typename TValue, typename TValue2>
-std::string ntr (TValue&& arg, TValue2&& arg2, int n)
+std::string ntr (TValue&& arg, TValue2&& arg2, int& n)
 {
 	return i2p::i18n::translate(std::forward<TValue>(arg), std::forward<TValue2>(arg2), std::forward<int>(n));
 }
@ -123,7 +121,7 @@ std::string ntr (TValue&& arg, TValue2&& arg2, int n)
 * @param args Array of arguments for string formatting
 */
 template<typename TValue, typename TValue2, typename... TArgs>
-std::string ntr (TValue&& arg, TValue2&& arg2, int n, TArgs&&... args)
+std::string ntr (TValue&& arg, TValue2&& arg2, int& n, TArgs&&... args)
 {
 	std::string tr_str = i2p::i18n::translate(std::forward<TValue>(arg), std::forward<TValue2>(arg2), std::forward<int>(n));

--- a/i18n/Italian.cpp
+++ b/i18n/Italian.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace italian // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Polish.cpp
+++ b/i18n/Polish.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2025, The PurpleI2P Project
+* Copyright (c) 2023-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace polish // language namespace
 		return (n == 1 ? 0 : n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2);
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Portuguese.cpp
+++ b/i18n/Portuguese.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2025, The PurpleI2P Project
+* Copyright (c) 2023-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace portuguese // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Russian.cpp
+++ b/i18n/Russian.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace russian // language namespace
 		return n % 10 == 1 && n % 100 != 11 ? 0 : n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f КиБ"},
 		{"%.2f MiB", "%.2f МиБ"},
--- a/i18n/Spanish.cpp
+++ b/i18n/Spanish.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2022-2025, The PurpleI2P Project
+* Copyright (c) 2022-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace spanish // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Swedish.cpp
+++ b/i18n/Swedish.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2025, The PurpleI2P Project
+* Copyright (c) 2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace swedish // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Turkish.cpp
+++ b/i18n/Turkish.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2023-2025, The PurpleI2P Project
+* Copyright (c) 2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace turkish // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Turkmen.cpp
+++ b/i18n/Turkmen.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace turkmen // language namespace
 		return n != 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/i18n/Ukrainian.cpp
+++ b/i18n/Ukrainian.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace ukrainian // language namespace
 		return n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f КіБ"},
 		{"%.2f MiB", "%.2f МіБ"},
--- a/i18n/Uzbek.cpp
+++ b/i18n/Uzbek.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2021-2025, The PurpleI2P Project
+* Copyright (c) 2021-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -29,7 +29,7 @@ namespace uzbek // language namespace
 		return n > 1 ? 1 : 0;
 	}

-	static const LocaleStrings strings
+	static std::map<std::string, std::string> strings
 	{
 		{"%.2f KiB", "%.2f KiB"},
 		{"%.2f MiB", "%.2f MiB"},
--- a/libi2pd/Base.cpp
+++ b/libi2pd/Base.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -15,7 +15,7 @@ namespace i2p
 {
 namespace data
 {
-	static constexpr char T32[32] =
+	static const char T32[32] =
 	{
 		'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h',
 		'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p',
@ -28,6 +28,11 @@ namespace data
 		return T32;
 	}

+	bool IsBase32 (char ch)
+	{
+		return (ch >= 'a' && ch <= 'z') || (ch >= '2' && ch <= '7');
+	}	
+	
 	static void iT64Build(void);

 	/*
@ -38,7 +43,7 @@ namespace data
 	* Direct Substitution Table
 	*/

-	static constexpr char T64[64] =
+	static const char T64[64] =
 	{
 		'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
 		'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
@ -55,16 +60,23 @@ namespace data
 		return T64;
 	}

+	bool IsBase64 (char ch)
+	{
+		return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '~';
+	}	
+	
 	/*
 	* Reverse Substitution Table (built in run time)
 	*/
+
 	static char iT64[256];
 	static int isFirstTime = 1;

 	/*
 	* Padding
 	*/
-	static constexpr char P64 = '=';
+
+	static char P64 = '=';

 	/*
 	*
@ -74,69 +86,78 @@ namespace data
 	* Converts binary encoded data to BASE64 format.
 	*
 	*/
-	std::string ByteStreamToBase64 (// base64 encoded string 
-		const uint8_t * InBuffer, 	// Input buffer, binary data 
-	    size_t InCount 				// Number of bytes in the input buffer 
+
+	size_t ByteStreamToBase64 (   /* Number of bytes in the encoded buffer */
+		const uint8_t * InBuffer, /* Input buffer, binary data */
+		size_t InCount,           /* Number of bytes in the input buffer */
+		char * OutBuffer,         /* output buffer */
+		size_t len                /* length of output buffer */
 	)
 	{
 		unsigned char * ps;
+		unsigned char * pd;
 		unsigned char   acc_1;
 		unsigned char   acc_2;
 		int             i;
 		int             n;
 		int             m;
+		size_t          outCount;

 		ps = (unsigned char *)InBuffer;
 		n = InCount / 3;
 		m = InCount % 3;
-		size_t outCount = m ? (4 * (n + 1)) : (4 * n);
+		if (!m)
+			outCount = 4 * n;
+		else
+			outCount = 4 * (n + 1);

-		std::string out;
-		out.reserve (outCount);
+		if (outCount > len) return 0;
+
+		pd = (unsigned char *)OutBuffer;
 		for ( i = 0; i < n; i++ )
 		{
 			acc_1 = *ps++;
 			acc_2 = (acc_1 << 4) & 0x30;
-			acc_1 >>= 2;                 // base64 digit #1 
-			out.push_back (T64[acc_1]);
+			acc_1 >>= 2;                 /* base64 digit #1 */
+			*pd++ = T64[acc_1];
 			acc_1 = *ps++;
-			acc_2 |= acc_1 >> 4;         // base64 digit #2
-			out.push_back (T64[acc_2]);
+			acc_2 |= acc_1 >> 4;         /* base64 digit #2 */
+			*pd++ = T64[acc_2];
 			acc_1 &= 0x0f;
 			acc_1 <<= 2;
 			acc_2 = *ps++;
-			acc_1 |= acc_2 >> 6;         // base64 digit #3
-			out.push_back (T64[acc_1]);
-			acc_2 &= 0x3f;               // base64 digit #4
-			out.push_back (T64[acc_2]);
+			acc_1 |= acc_2 >> 6;         /* base64 digit #3 */
+			*pd++ = T64[acc_1];
+			acc_2 &= 0x3f;               /* base64 digit #4 */
+			*pd++ = T64[acc_2];
 		}
 		if ( m == 1 )
 		{
 			acc_1 = *ps++;
-			acc_2 = (acc_1 << 4) & 0x3f; // base64 digit #2
-			acc_1 >>= 2;                 // base64 digit #1
-			out.push_back (T64[acc_1]);
-			out.push_back (T64[acc_2]);
-			out.push_back (P64);
-			out.push_back (P64);
+			acc_2 = (acc_1 << 4) & 0x3f; /* base64 digit #2 */
+			acc_1 >>= 2;                 /* base64 digit #1 */
+			*pd++ = T64[acc_1];
+			*pd++ = T64[acc_2];
+			*pd++ = P64;
+			*pd++ = P64;

 		}
 		else if ( m == 2 )
 		{
 			acc_1 = *ps++;
 			acc_2 = (acc_1 << 4) & 0x3f;
-			acc_1 >>= 2;                 // base64 digit #1
-			out.push_back (T64[acc_1]);
+			acc_1 >>= 2;                 /* base64 digit #1 */
+			*pd++ = T64[acc_1];
 			acc_1 = *ps++;
-			acc_2 |= acc_1 >> 4;         // base64 digit #2
-			out.push_back (T64[acc_2]);
+			acc_2 |= acc_1 >> 4;         /* base64 digit #2 */
+			*pd++ = T64[acc_2];
 			acc_1 &= 0x0f;
-			acc_1 <<= 2;                 // base64 digit #3
-			out.push_back (T64[acc_1]);
-			out.push_back (P64);
+			acc_1 <<= 2;                 /* base64 digit #3 */
+			*pd++ = T64[acc_1];
+			*pd++ = P64;
 		}

-		return out;
+		return outCount;
 	}

 	/*
@ -144,42 +165,55 @@ namespace data
 	* Base64ToByteStream
 	* ------------------
 	*
-	* Converts BASE64 encoded string to binary format. If input buffer is
+	* Converts BASE64 encoded data to binary format. If input buffer is
 	* not properly padded, buffer of negative length is returned
 	*
 	*/
-	size_t Base64ToByteStream (		// Number of output bytes 
-		std::string_view base64Str,	// BASE64 encoded string  
-	    uint8_t * OutBuffer, 		// output buffer length 
-	    size_t len					// length of output buffer 
+
+	size_t Base64ToByteStream ( /* Number of output bytes */
+		const char * InBuffer,  /* BASE64 encoded buffer */
+		size_t InCount,         /* Number of input bytes */
+		uint8_t * OutBuffer,    /* output buffer length */
+		size_t len              /* length of output buffer */
 	)
 	{
+		unsigned char * ps;
 		unsigned char * pd;
 		unsigned char   acc_1;
 		unsigned char   acc_2;
+		int             i;
+		int             n;
+		int             m;
 		size_t          outCount;

-		if (base64Str.empty () || base64Str[0] == P64) return 0;
-		auto d = std::div (base64Str.length (), 4);
-		if (!d.rem)
-			outCount = 3 * d.quot;
+		if (isFirstTime)
+			iT64Build();
+
+		n = InCount / 4;
+		m = InCount % 4;
+
+		if (InCount && !m)
+			outCount = 3 * n;
 		else
 			return 0;

-		if (isFirstTime) iT64Build();
+		if(*InBuffer == P64)
+			return 0;

-		auto pos = base64Str.find_last_not_of (P64);
-		if (pos == base64Str.npos) return 0;
-		outCount -= (base64Str.length () - pos - 1);
-		if (outCount > len) return 0;
+		ps = (unsigned char *)(InBuffer + InCount - 1);
+		while ( *ps-- == P64 )
+			outCount--;
+		ps = (unsigned char *)InBuffer;
+
+		if (outCount > len)
+			return 0;

-		auto ps = base64Str.begin ();
 		pd = OutBuffer;
 		auto endOfOutBuffer = OutBuffer + outCount;
-		for (int i = 0; i < d.quot; i++)
+		for ( i = 0; i < n; i++ )
 		{
-			acc_1 = iT64[int(*ps++)];
-			acc_2 = iT64[int(*ps++)];
+			acc_1 = iT64[*ps++];
+			acc_2 = iT64[*ps++];
 			acc_1 <<= 2;
 			acc_1 |= acc_2 >> 4;
 			*pd++ = acc_1;
@ -187,13 +221,13 @@ namespace data
 				break;

 			acc_2 <<= 4;
-			acc_1 = iT64[int(*ps++)];
+			acc_1 = iT64[*ps++];
 			acc_2 |= acc_1 >> 2;
 			*pd++ = acc_2;
 			if (pd >= endOfOutBuffer)
 				break;

-			acc_2 = iT64[int(*ps++)];
+			acc_2 = iT64[*ps++];
 			acc_2 |= acc_1 << 6;
 			*pd++ = acc_2;
 		}
@ -201,16 +235,31 @@ namespace data
 		return outCount;
 	}

-	std::string ToBase64Standard (std::string_view in)
+	size_t Base64EncodingBufferSize (const size_t input_size)
 	{
-		auto str = ByteStreamToBase64 ((const uint8_t *)in.data (), in.length ());
+		auto d = div (input_size, 3);
+		if (d.rem)
+			d.quot++;
+
+		return 4 * d.quot;
+	}
+
+	std::string ToBase64Standard (const std::string& in)
+	{
+		auto len = Base64EncodingBufferSize (in.length ());
+		char * str = new char[len + 1];
+		auto l = ByteStreamToBase64 ((const uint8_t *)in.c_str (), in.length (), str, len);
+		str[l] = 0;
 		// replace '-' by '+' and '~' by '/'
-		for (auto& ch: str)
-			if (ch == '-')
-				ch = '+';
-			else if (ch == '~')
-				ch = '/';
-		return str;
+		for (size_t i = 0; i < l; i++)
+			if (str[i] == '-')
+				str[i] = '+';
+			else if (str[i] == '~')
+				str[i] = '/';
+
+		std::string s(str);
+		delete[] str;
+		return s;
 	}

 	/*
@ -231,12 +280,13 @@ namespace data
 		iT64[(int)P64] = 0;
 	}

-	size_t Base32ToByteStream (std::string_view base32Str, uint8_t * outBuf, size_t outLen)
+	size_t Base32ToByteStream (const char * inBuf, size_t len, uint8_t * outBuf, size_t outLen)
 	{
 		unsigned int tmp = 0, bits = 0;
 		size_t ret = 0;
-		for (auto ch: base32Str)
+		for (size_t i = 0; i < len; i++)
 		{
+			char ch = inBuf[i];
 			if (ch >= '2' && ch <= '7') // digit
 				ch = (ch - '2') + 26; // 26 means a-z
 			else if (ch >= 'a' && ch <= 'z')
@ -258,13 +308,11 @@ namespace data
 		return ret;
 	}

-	std::string ByteStreamToBase32 (const uint8_t * inBuf, size_t len)
+	size_t ByteStreamToBase32 (const uint8_t * inBuf, size_t len, char * outBuf, size_t outLen)
 	{
-		std::string out;
-		out.reserve ((len * 8 + 4) / 5);
-		size_t pos = 1;
+		size_t ret = 0, pos = 1;
 		unsigned int bits = 8, tmp = inBuf[0];
-		while (bits > 0 || pos < len)
+		while (ret < outLen && (bits > 0 || pos < len))
 		{
 			if (bits < 5)
 			{
@ -284,9 +332,10 @@ namespace data

 			bits -= 5;
 			int ind = (tmp >> bits) & 0x1F;
-			out.push_back ((ind < 26) ? (ind + 'a') : ((ind - 26) + '2'));
+			outBuf[ret] = (ind < 26) ? (ind + 'a') : ((ind - 26) + '2');
+			ret++;
 		}
-		return out;
+		return ret;
 	}
 }
 }
--- a/libi2pd/Base.h
+++ b/libi2pd/Base.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,41 +11,26 @@

 #include <inttypes.h>
 #include <string>
-#include <string_view>
-#include <cstdlib>
-
-namespace i2p 
-{
-namespace data 
-{
-	std::string ByteStreamToBase64 (const uint8_t * InBuffer, size_t InCount);
-	size_t Base64ToByteStream (std::string_view base64Str, uint8_t * OutBuffer, size_t len);
+#include <iostream>

+namespace i2p {
+namespace data {
+	size_t ByteStreamToBase64 (const uint8_t * InBuffer, size_t InCount, char * OutBuffer, size_t len);
+	size_t Base64ToByteStream (const char * InBuffer, size_t InCount, uint8_t * OutBuffer, size_t len );
 	const char * GetBase32SubstitutionTable ();
 	const char * GetBase64SubstitutionTable ();
-	constexpr bool IsBase64 (char ch)
-	{
-		return (ch >= 'A' && ch <= 'Z') || (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '~';
-	}	
+	bool IsBase64 (char ch);

-	size_t Base32ToByteStream (std::string_view base32Str, uint8_t * outBuf, size_t outLen);
-	std::string ByteStreamToBase32 (const uint8_t * inBuf, size_t len);	
-	constexpr bool IsBase32 (char ch)
-	{
-		return (ch >= 'a' && ch <= 'z') || (ch >= '2' && ch <= '7');
-	}	
+	size_t Base32ToByteStream (const char * inBuf, size_t len, uint8_t * outBuf, size_t outLen);
+	size_t ByteStreamToBase32 (const uint8_t * InBuf, size_t len, char * outBuf, size_t outLen);
+	bool IsBase32 (char ch);

 	/**
 	 * Compute the size for a buffer to contain encoded base64 given that the size of the input is input_size bytes
 	 */
-	inline size_t Base64EncodingBufferSize(size_t input_size)
-	{
-		auto d = std::div (input_size, 3);
-		if (d.rem) d.quot++;
-		return 4 * d.quot;
-	}	
+	size_t Base64EncodingBufferSize(const size_t input_size);

-	std::string ToBase64Standard (std::string_view in); // using standard table, for Proxy-Authorization
+	std::string ToBase64Standard (const std::string& in); // using standard table, for Proxy-Authorization

 } // data
 } // i2p
--- a/libi2pd/Blinding.cpp
+++ b/libi2pd/Blinding.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -152,11 +152,11 @@ namespace data
 			m_BlindedSigType = m_SigType;
 	}

-	BlindedPublicKey::BlindedPublicKey (std::string_view b33):
+	BlindedPublicKey::BlindedPublicKey (const std::string& b33):
 		m_SigType (0) // 0 means invalid, we can't blind DSA, set it later
 	{
 		uint8_t addr[40]; // TODO: define length from b33
-		size_t l = i2p::data::Base32ToByteStream (b33, addr, 40);
+		size_t l = i2p::data::Base32ToByteStream (b33.c_str (), b33.length (), addr, 40);
 		if (l < 32)
 		{
 			LogPrint (eLogError, "Blinding: Malformed b33 ", b33);
@ -198,7 +198,7 @@ namespace data
 	std::string BlindedPublicKey::ToB33 () const
 	{
 		if (m_PublicKey.size () > 32) return ""; // assume 25519
-		uint8_t addr[35];
+		uint8_t addr[35]; char str[60]; // TODO: define actual length
 		uint8_t flags = 0;
 		if (m_IsClientAuth) flags |= B33_PER_CLIENT_AUTH_FLAG;
 		addr[0] = flags; // flags
@ -208,7 +208,8 @@ namespace data
 		uint32_t checksum = crc32 (0, addr + 3, m_PublicKey.size ());
 		// checksum is Little Endian
 		addr[0] ^= checksum; addr[1] ^= (checksum >> 8); addr[2] ^= (checksum >> 16);
-		return ByteStreamToBase32 (addr, m_PublicKey.size () + 3);
+		auto l = ByteStreamToBase32 (addr, m_PublicKey.size () + 3, str, 60);
+		return std::string (str, str + l);
 	}

 	void BlindedPublicKey::GetCredential (uint8_t * credential) const
--- a/libi2pd/Blinding.h
+++ b/libi2pd/Blinding.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,7 +11,6 @@

 #include <inttypes.h>
 #include <string>
-#include <string_view>
 #include <vector>
 #include "Identity.h"

@ -24,7 +23,7 @@ namespace data
 		public:

 			BlindedPublicKey (std::shared_ptr<const IdentityEx> identity, bool clientAuth = false);
-			BlindedPublicKey (std::string_view b33); // from b33 without .b32.i2p
+			BlindedPublicKey (const std::string& b33); // from b33 without .b32.i2p
 			std::string ToB33 () const;

 			const uint8_t * GetPublicKey () const { return m_PublicKey.data (); };
--- a/libi2pd/CPU.cpp
+++ b/libi2pd/CPU.cpp
@ -0,0 +1,68 @@
+/*
+* Copyright (c) 2013-2023, The PurpleI2P Project
+*
+* This file is part of Purple i2pd project and licensed under BSD3
+*
+* See full license text in LICENSE file at top of project tree
+*/
+
+#include "CPU.h"
+#include "Log.h"
+
+#ifndef bit_AES
+	#define bit_AES (1 << 25)
+#endif
+
+#if defined(__GNUC__) && __GNUC__ < 6 && IS_X86
+	#include <cpuid.h>
+#endif
+
+#ifdef _MSC_VER
+	#include <intrin.h>
+#endif
+
+namespace i2p
+{
+namespace cpu
+{
+	bool aesni = false;
+
+	inline bool cpu_support_aes()
+	{
+#if IS_X86
+#if defined(__clang__)
+#	if (__clang_major__ >= 6)
+		__builtin_cpu_init();
+#	endif
+		return __builtin_cpu_supports("aes");
+#elif (defined(__GNUC__) && __GNUC__ >= 6)
+		__builtin_cpu_init();
+		return __builtin_cpu_supports("aes");
+#elif (defined(__GNUC__) && __GNUC__ < 6)
+		int cpu_info[4];
+		bool flag = false;
+		__cpuid(0, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
+		if (cpu_info[0] >= 0x00000001) {
+			__cpuid(0x00000001, cpu_info[0], cpu_info[1], cpu_info[2], cpu_info[3]);
+			flag = ((cpu_info[2] & bit_AES) != 0);
+		}
+		return flag;
+#elif defined(_MSC_VER)
+		int cpu_info[4];
+		__cpuid(cpu_info, 1);
+		return ((cpu_info[2] & bit_AES) != 0);
+#endif
+#endif
+		return false;
+	}
+
+	void Detect(bool AesSwitch, bool force)
+	{
+		if ((cpu_support_aes() && AesSwitch) || (AesSwitch && force)) {
+			aesni = true;
+		}
+
+		LogPrint(eLogInfo, "AESNI ", (aesni ? "enabled" : "disabled"));
+	}
+}
+}
--- a/libi2pd/CPU.h
+++ b/libi2pd/CPU.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -21,4 +21,20 @@
 #	define IS_X86_64 0
 #endif

+#if defined(__AES__) && !defined(_MSC_VER) && IS_X86
+#	define SUPPORTS_AES 1
+#else
+#	define SUPPORTS_AES 0
+#endif
+
+namespace i2p
+{
+namespace cpu
+{
+	extern bool aesni;
+
+	void Detect(bool AesSwitch, bool force);
+}
+}
+
 #endif
--- a/libi2pd/Config.cpp
+++ b/libi2pd/Config.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -117,14 +117,9 @@ namespace config {
 			("httpproxy.latency.max", value<std::string>()->default_value("0"),       "HTTP proxy max latency for tunnels")
 			("httpproxy.outproxy", value<std::string>()->default_value(""),           "HTTP proxy upstream out proxy url")
 			("httpproxy.addresshelper", value<bool>()->default_value(true),           "Enable or disable addresshelper")
-			("httpproxy.senduseragent", value<bool>()->default_value(false),          "Pass through user's User-Agent if enabled. Disabled by default")
 			("httpproxy.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Local destination's LeaseSet type")
 			("httpproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("0,4"), "Local destination's LeaseSet encryption type")
 			("httpproxy.i2cp.leaseSetPrivKey", value<std::string>()->default_value(""), "LeaseSet private key")
-			("httpproxy.i2p.streaming.maxOutboundSpeed", value<std::string>()->default_value("1730000000"), "Max outbound speed of HTTP proxy stream in bytes/sec")
-			("httpproxy.i2p.streaming.maxInboundSpeed", value<std::string>()->default_value("1730000000"), "Max inbound speed of HTTP proxy stream in bytes/sec")
-			("httpproxy.i2p.streaming.profile", value<std::string>()->default_value("1"), "HTTP Proxy bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
-
 		;

 		options_description socksproxy("SOCKS Proxy options");
@ -149,20 +144,6 @@ namespace config {
 			("socksproxy.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Local destination's LeaseSet type")
 			("socksproxy.i2cp.leaseSetEncType", value<std::string>()->default_value("0,4"), "Local destination's LeaseSet encryption type")
 			("socksproxy.i2cp.leaseSetPrivKey", value<std::string>()->default_value(""), "LeaseSet private key")
-			("socksproxy.i2p.streaming.maxOutboundSpeed", value<std::string>()->default_value("1730000000"), "Max outbound speed of SOCKS proxy stream in bytes/sec")
-			("socksproxy.i2p.streaming.maxInboundSpeed", value<std::string>()->default_value("1730000000"), "Max inbound speed of SOCKS proxy stream in bytes/sec")
-			("socksproxy.i2p.streaming.profile", value<std::string>()->default_value("1"), "SOCKS Proxy bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
-		;
-
-		options_description shareddest("Shared local destination options");
-		shareddest.add_options()
-			("shareddest.inbound.length", value<std::string>()->default_value("3"),    "Shared local destination inbound tunnel length")
-			("shareddest.outbound.length", value<std::string>()->default_value("3"),   "Shared local destination outbound tunnel length")
-			("shareddest.inbound.quantity", value<std::string>()->default_value("3"),  "Shared local destination inbound tunnels quantity")
-			("shareddest.outbound.quantity", value<std::string>()->default_value("3"), "Shared local destination outbound tunnels quantity")
-			("shareddest.i2cp.leaseSetType", value<std::string>()->default_value("3"), "Shared local destination's LeaseSet type")
-			("shareddest.i2cp.leaseSetEncType", value<std::string>()->default_value("0,4"), "Shared local destination's LeaseSet encryption type")
-			("shareddest.i2p.streaming.profile", value<std::string>()->default_value("2"), "Shared local destination bandwidth usage profile. 1 - bulk(high), 2- interactive(low)")
 		;

 		options_description sam("SAM bridge options");
@ -238,7 +219,7 @@ namespace config {
 				"https://reseed.onion.im/,"
 				"https://i2pseed.creativecowpat.net:8443/,"
 				"https://reseed.i2pgit.org/,"
-				"https://coconut.incognet.io/,"
+				"https://banana.incognet.io/,"
 				"https://reseed-pl.i2pd.xyz/,"
 				"https://www2.mk16.de/,"
 			    "https://i2p.ghativega.in/,"
@ -249,6 +230,7 @@ namespace config {
 				"http://[324:71e:281a:9ed3::ace]:7070/,"
 				"http://[301:65b9:c7cd:9a36::1]:18801/,"
 				"http://[320:8936:ec1a:31f1::216]/,"
+				"http://[306:3834:97b9:a00a::1]/,"
 				"http://[316:f9e0:f22e:a74f::216]/"
 			),                                                            "Reseed URLs through the Yggdrasil, separated by comma")
 		;
@ -326,11 +308,11 @@ namespace config {
 			("persist.addressbook", value<bool>()->default_value(true),    "Persist full addresses (default: true)")
 		;

-		options_description cpuext("CPU encryption extensions options. Deprecated");
+		options_description cpuext("CPU encryption extensions options");
 		cpuext.add_options()
-			("cpuext.aesni", bool_switch()->default_value(true),                     "Deprecated option")
+			("cpuext.aesni", bool_switch()->default_value(true),                     "Use auto detection for AESNI CPU extensions. If false, AESNI will be not used")
 			("cpuext.avx", bool_switch()->default_value(false),                      "Deprecated option")
-			("cpuext.force", bool_switch()->default_value(false),                    "Deprecated option")
+			("cpuext.force", bool_switch()->default_value(false),                    "Force usage of CPU extensions. Useful when cpuinfo is not available on virtual machines")
 		;

 		options_description meshnets("Meshnet transports options");
@ -352,7 +334,6 @@ namespace config {
 			.add(httpserver)
 			.add(httpproxy)
 			.add(socksproxy)
-			.add(shareddest)
 			.add(sam)
 			.add(bob)
 			.add(i2cp)
--- a/libi2pd/Crypto.cpp
+++ b/libi2pd/Crypto.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -19,11 +19,6 @@
 #if OPENSSL_HKDF
 #include <openssl/kdf.h>
 #endif
-#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
-#include <openssl/param_build.h>
-#include <openssl/core_names.h>
-#endif
-#include "CPU.h"
 #include "Crypto.h"
 #include "Ed25519.h"
 #include "I2PEndian.h"
@ -33,7 +28,7 @@ namespace i2p
 {
 namespace crypto
 {
-	constexpr uint8_t elgp_[256]=
+	const uint8_t elgp_[256]=
 	{
 		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
 		0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
@ -53,9 +48,9 @@ namespace crypto
 		0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
 	};

-	constexpr int elgg_ = 2;
+	const int elgg_ = 2;

-	constexpr uint8_t dsap_[128]=
+	const uint8_t dsap_[128]=
 	{
 		0x9c, 0x05, 0xb2, 0xaa, 0x96, 0x0d, 0x9b, 0x97, 0xb8, 0x93, 0x19, 0x63, 0xc9, 0xcc, 0x9e, 0x8c,
 		0x30, 0x26, 0xe9, 0xb8, 0xed, 0x92, 0xfa, 0xd0, 0xa6, 0x9c, 0xc8, 0x86, 0xd5, 0xbf, 0x80, 0x15,
@ -67,13 +62,13 @@ namespace crypto
 		0x28, 0x5d, 0x4c, 0xf2, 0x95, 0x38, 0xd9, 0xe3, 0xb6, 0x05, 0x1f, 0x5b, 0x22, 0xcc, 0x1c, 0x93
 	};

-	constexpr uint8_t dsaq_[20]=
+	const uint8_t dsaq_[20]=
 	{
 		0xa5, 0xdf, 0xc2, 0x8f, 0xef, 0x4c, 0xa1, 0xe2, 0x86, 0x74, 0x4c, 0xd8, 0xee, 0xd9, 0xd2, 0x9d,
 		0x68, 0x40, 0x46, 0xb7
 	};

-	constexpr uint8_t dsag_[128]=
+	const uint8_t dsag_[128]=
 	{
 		0x0c, 0x1f, 0x4d, 0x27, 0xd4, 0x00, 0x93, 0xb4, 0x29, 0xe9, 0x62, 0xd7, 0x22, 0x38, 0x24, 0xe0,
 		0xbb, 0xc4, 0x7e, 0x7c, 0x83, 0x2a, 0x39, 0x23, 0x6f, 0xc6, 0x83, 0xaf, 0x84, 0x88, 0x95, 0x81,
@ -85,7 +80,7 @@ namespace crypto
 		0xb3, 0xdb, 0xb1, 0x4a, 0x90, 0x5e, 0x7b, 0x2b, 0x3e, 0x93, 0xbe, 0x47, 0x08, 0xcb, 0xcc, 0x82
 	};

-	constexpr int rsae_ = 65537;
+	const int rsae_ = 65537;

 	struct CryptoConstants
 	{
@ -150,37 +145,6 @@ namespace crypto
 	#define dsap GetCryptoConstants ().dsap
 	#define dsaq GetCryptoConstants ().dsaq
 	#define dsag GetCryptoConstants ().dsag
-#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
-	EVP_PKEY * CreateDSA (BIGNUM * pubKey, BIGNUM * privKey)
-	{
-		EVP_PKEY * pkey = nullptr;
-		int selection = EVP_PKEY_KEY_PARAMETERS;
-		auto bld = OSSL_PARAM_BLD_new();
-		OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, dsap);
-		OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, dsaq);
-		OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, dsag);
-		if (pubKey)
-		{	
-			OSSL_PARAM_BLD_push_BN (bld, OSSL_PKEY_PARAM_PUB_KEY, pubKey);
-			selection = EVP_PKEY_PUBLIC_KEY;
-		}	
-		if (privKey)
-		{	
-			OSSL_PARAM_BLD_push_BN (bld, OSSL_PKEY_PARAM_PRIV_KEY, privKey);
-			selection = EVP_PKEY_KEYPAIR;
-		}	
-		auto params = OSSL_PARAM_BLD_to_param(bld);
-		
-		EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name (NULL, "DSA", NULL);
-		EVP_PKEY_fromdata_init(ctx);
-        EVP_PKEY_fromdata(ctx, &pkey, selection, params);
-		
-		EVP_PKEY_CTX_free(ctx);
-		OSSL_PARAM_free(params);
-		OSSL_PARAM_BLD_free(bld);
-		return pkey;
-	}	
-#else	
 	DSA * CreateDSA ()
 	{
 		DSA * dsa = DSA_new ();
@ -188,7 +152,6 @@ namespace crypto
 		DSA_set0_key (dsa, NULL, NULL);
 		return dsa;
 	}
-#endif

 // DH/ElGamal

@ -277,12 +240,17 @@ namespace crypto
 // x25519
 	X25519Keys::X25519Keys ()
 	{
+#if OPENSSL_X25519
 		m_Ctx = EVP_PKEY_CTX_new_id (NID_X25519, NULL);
 		m_Pkey = nullptr;
+#else
+		m_Ctx = BN_CTX_new ();
+#endif
 	}

 	X25519Keys::X25519Keys (const uint8_t * priv, const uint8_t * pub)
 	{
+#if OPENSSL_X25519
 		m_Pkey = EVP_PKEY_new_raw_private_key (EVP_PKEY_X25519, NULL, priv, 32);
 		m_Ctx = EVP_PKEY_CTX_new (m_Pkey, NULL);
 		if (pub)
@ -292,16 +260,29 @@ namespace crypto
 			size_t len = 32;
 			EVP_PKEY_get_raw_public_key (m_Pkey, m_PublicKey, &len);
 		}
+#else
+		m_Ctx = BN_CTX_new ();
+		memcpy (m_PrivateKey, priv, 32);
+		if (pub)
+			memcpy (m_PublicKey, pub, 32);
+		else
+			GetEd25519 ()->ScalarMulB (m_PrivateKey, m_PublicKey, m_Ctx);
+#endif
 	}

 	X25519Keys::~X25519Keys ()
 	{
+#if OPENSSL_X25519
 		EVP_PKEY_CTX_free (m_Ctx);
 		if (m_Pkey) EVP_PKEY_free (m_Pkey);
+#else
+		BN_CTX_free (m_Ctx);
+#endif
 	}

 	void X25519Keys::GenerateKeys ()
 	{
+#if OPENSSL_X25519
 		if (m_Pkey)
 		{
 			EVP_PKEY_free (m_Pkey);
@ -313,11 +294,16 @@ namespace crypto
 		m_Ctx = EVP_PKEY_CTX_new (m_Pkey, NULL); // TODO: do we really need to re-create m_Ctx?
 		size_t len = 32;
 		EVP_PKEY_get_raw_public_key (m_Pkey, m_PublicKey, &len);
+#else
+		RAND_bytes (m_PrivateKey, 32);
+		GetEd25519 ()->ScalarMulB (m_PrivateKey, m_PublicKey, m_Ctx);
+#endif
 	}

 	bool X25519Keys::Agree (const uint8_t * pub, uint8_t * shared)
 	{
 		if (!pub || (pub[31] & 0x80)) return false; // not x25519 key
+#if OPENSSL_X25519
 		EVP_PKEY_derive_init (m_Ctx);
 		auto pkey = EVP_PKEY_new_raw_public_key (EVP_PKEY_X25519, NULL, pub, 32);
 		if (!pkey) return false;
@ -325,17 +311,25 @@ namespace crypto
 		size_t len = 32;
 		EVP_PKEY_derive (m_Ctx, shared, &len);
 		EVP_PKEY_free (pkey);
+#else
+		GetEd25519 ()->ScalarMul (pub, m_PrivateKey, shared, m_Ctx);
+#endif
 		return true;
 	}

 	void X25519Keys::GetPrivateKey (uint8_t * priv) const
 	{
+#if OPENSSL_X25519
 		size_t len = 32;
 		EVP_PKEY_get_raw_private_key (m_Pkey, priv, &len);
+#else
+		memcpy (priv, m_PrivateKey, 32);
+#endif
 	}

 	void X25519Keys::SetPrivateKey (const uint8_t * priv, bool calculatePublic)
 	{
+#if OPENSSL_X25519
 		if (m_Ctx) EVP_PKEY_CTX_free (m_Ctx);
 		if (m_Pkey) EVP_PKEY_free (m_Pkey);
 		m_Pkey = EVP_PKEY_new_raw_private_key (EVP_PKEY_X25519, NULL, priv, 32);
@ -345,6 +339,11 @@ namespace crypto
 			size_t len = 32;
 			EVP_PKEY_get_raw_public_key (m_Pkey, m_PublicKey, &len);
 		}
+#else
+		memcpy (m_PrivateKey, priv, 32);
+		if (calculatePublic)
+			GetEd25519 ()->ScalarMulB (m_PrivateKey, m_PublicKey, m_Ctx);
+#endif
 	}

 // ElGamal
@ -478,8 +477,9 @@ namespace crypto
 		// encrypt
 		CBCEncryption encryption;
 		encryption.SetKey (shared);
+		encryption.SetIV (iv);
 		encrypted[257] = 0;
-		encryption.Encrypt (m, 256, iv, encrypted + 258);
+		encryption.Encrypt (m, 256, encrypted + 258);
 		EC_POINT_free (p);
 		BN_CTX_end (ctx);
 		BN_CTX_free (ctx);
@ -512,7 +512,8 @@ namespace crypto
 			uint8_t m[256];
 			CBCDecryption decryption;
 			decryption.SetKey (shared);
-			decryption.Decrypt (encrypted + 258, 256, iv, m);
+			decryption.SetIV (iv);
+			decryption.Decrypt (encrypted + 258, 256, m);
 			// verify and copy
 			uint8_t hash[32];
 			SHA256 (m + 33, 222, hash);
@ -550,114 +551,440 @@ namespace crypto
 	}

 // AES
-	ECBEncryption::ECBEncryption ()
+#if SUPPORTS_AES
+	#define KeyExpansion256(round0,round1) \
+		"pshufd $0xff, %%xmm2, %%xmm2 \n" \
+		"movaps %%xmm1, %%xmm4 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm1 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm1 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm1 \n" \
+		"pxor %%xmm2, %%xmm1 \n" \
+		"movaps %%xmm1, "#round0"(%[sched]) \n" \
+		"aeskeygenassist $0, %%xmm1, %%xmm4 \n" \
+		"pshufd $0xaa, %%xmm4, %%xmm2 \n" \
+		"movaps %%xmm3, %%xmm4 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm3 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm3 \n" \
+		"pslldq $4, %%xmm4 \n" \
+		"pxor %%xmm4, %%xmm3 \n" \
+		"pxor %%xmm2, %%xmm3 \n" \
+		"movaps %%xmm3, "#round1"(%[sched]) \n"
+#endif
+
+#if SUPPORTS_AES
+	void ECBCryptoAESNI::ExpandKey (const AESKey& key)
 	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
+		__asm__
+		(
+			"movups (%[key]), %%xmm1 \n"
+			"movups 16(%[key]), %%xmm3 \n"
+			"movaps %%xmm1, (%[sched]) \n"
+			"movaps %%xmm3, 16(%[sched]) \n"
+			"aeskeygenassist $1, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(32,48)
+			"aeskeygenassist $2, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(64,80)
+			"aeskeygenassist $4, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(96,112)
+			"aeskeygenassist $8, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(128,144)
+			"aeskeygenassist $16, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(160,176)
+			"aeskeygenassist $32, %%xmm3, %%xmm2 \n"
+			KeyExpansion256(192,208)
+			"aeskeygenassist $64, %%xmm3, %%xmm2 \n"
+			// key expansion final
+			"pshufd $0xff, %%xmm2, %%xmm2 \n"
+			"movaps %%xmm1, %%xmm4 \n"
+			"pslldq $4, %%xmm4 \n"
+			"pxor %%xmm4, %%xmm1 \n"
+			"pslldq $4, %%xmm4 \n"
+			"pxor %%xmm4, %%xmm1 \n"
+			"pslldq $4, %%xmm4 \n"
+			"pxor %%xmm4, %%xmm1 \n"
+			"pxor %%xmm2, %%xmm1 \n"
+			"movups %%xmm1, 224(%[sched]) \n"
+			: // output
+			: [key]"r"((const uint8_t *)key), [sched]"r"(GetKeySchedule ()) // input
+			: "%xmm1", "%xmm2", "%xmm3", "%xmm4", "memory" // clogged
+		);
+	}
+#endif
+
+
+#if SUPPORTS_AES
+	#define EncryptAES256(sched) \
+		"pxor (%["#sched"]), %%xmm0 \n" \
+		"aesenc	16(%["#sched"]), %%xmm0 \n" \
+		"aesenc	32(%["#sched"]), %%xmm0 \n" \
+		"aesenc	48(%["#sched"]), %%xmm0 \n" \
+		"aesenc	64(%["#sched"]), %%xmm0 \n" \
+		"aesenc	80(%["#sched"]), %%xmm0 \n" \
+		"aesenc	96(%["#sched"]), %%xmm0 \n" \
+		"aesenc	112(%["#sched"]), %%xmm0 \n" \
+		"aesenc	128(%["#sched"]), %%xmm0 \n" \
+		"aesenc	144(%["#sched"]), %%xmm0 \n" \
+		"aesenc	160(%["#sched"]), %%xmm0 \n" \
+		"aesenc	176(%["#sched"]), %%xmm0 \n" \
+		"aesenc	192(%["#sched"]), %%xmm0 \n" \
+		"aesenc	208(%["#sched"]), %%xmm0 \n" \
+		"aesenclast	224(%["#sched"]), %%xmm0 \n"
+#endif
+
+	void ECBEncryption::Encrypt (const ChipherBlock * in, ChipherBlock * out)
+	{
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[in]), %%xmm0 \n"
+				EncryptAES256(sched)
+				"movups %%xmm0, (%[out]) \n"
+				:
+				: [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out)
+				: "%xmm0", "memory"
+			);
+		}
+		else
+#endif
+		{
+			AES_encrypt (in->buf, out->buf, &m_Key);
+		}
 	}

-	ECBEncryption::~ECBEncryption ()
+#if SUPPORTS_AES
+	#define DecryptAES256(sched) \
+		"pxor 224(%["#sched"]), %%xmm0 \n" \
+		"aesdec	208(%["#sched"]), %%xmm0 \n" \
+		"aesdec	192(%["#sched"]), %%xmm0 \n" \
+		"aesdec	176(%["#sched"]), %%xmm0 \n" \
+		"aesdec	160(%["#sched"]), %%xmm0 \n" \
+		"aesdec	144(%["#sched"]), %%xmm0 \n" \
+		"aesdec	128(%["#sched"]), %%xmm0 \n" \
+		"aesdec	112(%["#sched"]), %%xmm0 \n" \
+		"aesdec	96(%["#sched"]), %%xmm0 \n" \
+		"aesdec	80(%["#sched"]), %%xmm0 \n" \
+		"aesdec	64(%["#sched"]), %%xmm0 \n" \
+		"aesdec	48(%["#sched"]), %%xmm0 \n" \
+		"aesdec	32(%["#sched"]), %%xmm0 \n" \
+		"aesdec	16(%["#sched"]), %%xmm0 \n" \
+		"aesdeclast (%["#sched"]), %%xmm0 \n"
+#endif
+
+	void ECBDecryption::Decrypt (const ChipherBlock * in, ChipherBlock * out)
 	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[in]), %%xmm0 \n"
+				DecryptAES256(sched)
+				"movups %%xmm0, (%[out]) \n"
+				:
+				: [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out)
+				: "%xmm0", "memory"
+			);
+		}
+		else
+#endif
+		{
+			AES_decrypt (in->buf, out->buf, &m_Key);
+		}
 	}

-	void ECBEncryption::Encrypt (const uint8_t * in, uint8_t * out)
+#if SUPPORTS_AES
+	#define CallAESIMC(offset) \
+		"movaps "#offset"(%[shed]), %%xmm0 \n" \
+		"aesimc %%xmm0, %%xmm0 \n" \
+		"movaps %%xmm0, "#offset"(%[shed]) \n"
+#endif
+
+	void ECBEncryption::SetKey (const AESKey& key)
 	{
-		EVP_EncryptInit_ex (m_Ctx, EVP_aes_256_ecb(), NULL, m_Key, NULL);
-		EVP_CIPHER_CTX_set_padding (m_Ctx, 0);
-		int len;
-		EVP_EncryptUpdate (m_Ctx, out, &len, in, 16);
-		EVP_EncryptFinal_ex (m_Ctx, out + len, &len);
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			ExpandKey (key);
+		}
+		else
+#endif
+		{
+			AES_set_encrypt_key (key, 256, &m_Key);
+		}
 	}

-	ECBDecryption::ECBDecryption ()
+	void ECBDecryption::SetKey (const AESKey& key)
 	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			ExpandKey (key); // expand encryption key first
+			// then invert it using aesimc
+			__asm__
+			(
+				CallAESIMC(16)
+				CallAESIMC(32)
+				CallAESIMC(48)
+				CallAESIMC(64)
+				CallAESIMC(80)
+				CallAESIMC(96)
+				CallAESIMC(112)
+				CallAESIMC(128)
+				CallAESIMC(144)
+				CallAESIMC(160)
+				CallAESIMC(176)
+				CallAESIMC(192)
+				CallAESIMC(208)
+				:
+				: [shed]"r"(GetKeySchedule ())
+				: "%xmm0", "memory"
+			);
+		}
+		else
+#endif
+		{
+			AES_set_decrypt_key (key, 256, &m_Key);
+		}
 	}

-	ECBDecryption::~ECBDecryption ()
+	void CBCEncryption::Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
 	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[iv]), %%xmm1 \n"
+				"1: \n"
+				"movups (%[in]), %%xmm0 \n"
+				"pxor %%xmm1, %%xmm0 \n"
+				EncryptAES256(sched)
+				"movaps %%xmm0, %%xmm1 \n"
+				"movups %%xmm0, (%[out]) \n"
+				"add $16, %[in] \n"
+				"add $16, %[out] \n"
+				"dec %[num] \n"
+				"jnz 1b \n"
+				"movups %%xmm1, (%[iv]) \n"
+				:
+				: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+				: "%xmm0", "%xmm1", "cc", "memory"
+			);
+		}
+		else
+#endif
+		{
+			for (int i = 0; i < numBlocks; i++)
+			{
+				*m_LastBlock.GetChipherBlock () ^= in[i];
+				m_ECBEncryption.Encrypt (m_LastBlock.GetChipherBlock (), m_LastBlock.GetChipherBlock ());
+				out[i] = *m_LastBlock.GetChipherBlock ();
+			}
+		}
 	}

-	void ECBDecryption::Decrypt (const uint8_t * in, uint8_t * out)
-	{
-		EVP_DecryptInit_ex (m_Ctx, EVP_aes_256_ecb(), NULL, m_Key, NULL);
-		EVP_CIPHER_CTX_set_padding (m_Ctx, 0);
-		int len;
-		EVP_DecryptUpdate (m_Ctx, out, &len, in, 16);
-		EVP_DecryptFinal_ex (m_Ctx, out + len, &len);
-	}
-
-
-	CBCEncryption::CBCEncryption () 
-	{ 
-		m_Ctx = EVP_CIPHER_CTX_new ();
-	}
-	
-	CBCEncryption::~CBCEncryption ()
-	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
-	}	
-	
-	void CBCEncryption::Encrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out)
+	void CBCEncryption::Encrypt (const uint8_t * in, std::size_t len, uint8_t * out)
 	{
 		// len/16
-		EVP_EncryptInit_ex (m_Ctx, EVP_aes_256_cbc(), NULL, m_Key, iv);
-		EVP_CIPHER_CTX_set_padding (m_Ctx, 0);
-		int l;
-		EVP_EncryptUpdate (m_Ctx, out, &l, in, len);
-		EVP_EncryptFinal_ex (m_Ctx, out + l, &l);
+		int numBlocks = len >> 4;
+		if (numBlocks > 0)
+			Encrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out);
 	}

-	CBCDecryption::CBCDecryption () 
+	void CBCEncryption::Encrypt (const uint8_t * in, uint8_t * out)
 	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[iv]), %%xmm1 \n"
+				"movups (%[in]), %%xmm0 \n"
+				"pxor %%xmm1, %%xmm0 \n"
+				EncryptAES256(sched)
+				"movups %%xmm0, (%[out]) \n"
+				"movups %%xmm0, (%[iv]) \n"
+				:
+				: [iv]"r"((uint8_t *)m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out)
+				: "%xmm0", "%xmm1", "memory"
+			);
+		}
+		else
+#endif
+			Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 	}

-	CBCDecryption::~CBCDecryption ()
+	void CBCDecryption::Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
 	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[iv]), %%xmm1 \n"
+				"1: \n"
+				"movups (%[in]), %%xmm0 \n"
+				"movaps %%xmm0, %%xmm2 \n"
+				DecryptAES256(sched)
+				"pxor %%xmm1, %%xmm0 \n"
+				"movups %%xmm0, (%[out]) \n"
+				"movaps %%xmm2, %%xmm1 \n"
+				"add $16, %[in] \n"
+				"add $16, %[out] \n"
+				"dec %[num] \n"
+				"jnz 1b \n"
+				"movups %%xmm1, (%[iv]) \n"
+				:
+				: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+				: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+			);
+		}
+		else
+#endif
+		{
+			for (int i = 0; i < numBlocks; i++)
+			{
+				ChipherBlock tmp = in[i];
+				m_ECBDecryption.Decrypt (in + i, out + i);
+				out[i] ^= *m_IV.GetChipherBlock ();
+				*m_IV.GetChipherBlock () = tmp;
+			}
+		}
 	}

-	void CBCDecryption::Decrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out)
+	void CBCDecryption::Decrypt (const uint8_t * in, std::size_t len, uint8_t * out)
 	{
-		// len/16
-		EVP_DecryptInit_ex (m_Ctx, EVP_aes_256_cbc(), NULL, m_Key, iv);
-		EVP_CIPHER_CTX_set_padding (m_Ctx, 0);
-		int l;
-		EVP_DecryptUpdate (m_Ctx, out, &l, in, len);
-		EVP_DecryptFinal_ex (m_Ctx, out + l, &l);
+		int numBlocks = len >> 4;
+		if (numBlocks > 0)
+			Decrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out);
+	}
+
+	void CBCDecryption::Decrypt (const uint8_t * in, uint8_t * out)
+	{
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				"movups (%[iv]), %%xmm1 \n"
+				"movups (%[in]), %%xmm0 \n"
+				"movups %%xmm0, (%[iv]) \n"
+				DecryptAES256(sched)
+				"pxor %%xmm1, %%xmm0 \n"
+				"movups %%xmm0, (%[out]) \n"
+				:
+				: [iv]"r"((uint8_t *)m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out)
+				: "%xmm0", "%xmm1", "memory"
+			);
+		}
+		else
+#endif
+			Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out);
 	}

 	void TunnelEncryption::Encrypt (const uint8_t * in, uint8_t * out)
 	{
-		uint8_t iv[16];
-		m_IVEncryption.Encrypt (in, iv); // iv
-		m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, iv, out + 16); // data
-		m_IVEncryption.Encrypt (iv, out); // double iv
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				// encrypt IV
+				"movups (%[in]), %%xmm0 \n"
+				EncryptAES256(sched_iv)
+				"movaps %%xmm0, %%xmm1 \n"
+				// double IV encryption
+				EncryptAES256(sched_iv)
+				"movups %%xmm0, (%[out]) \n"
+				// encrypt data, IV is xmm1
+				"1: \n"
+				"add $16, %[in] \n"
+				"add $16, %[out] \n"
+				"movups (%[in]), %%xmm0 \n"
+				"pxor %%xmm1, %%xmm0 \n"
+				EncryptAES256(sched_l)
+				"movaps %%xmm0, %%xmm1 \n"
+				"movups %%xmm0, (%[out]) \n"
+				"dec %[num] \n"
+				"jnz 1b \n"
+				:
+				: [sched_iv]"r"(m_IVEncryption.GetKeySchedule ()), [sched_l]"r"(m_LayerEncryption.ECB().GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+				: "%xmm0", "%xmm1", "cc", "memory"
+			);
+		}
+		else
+#endif
+		{
+			m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerEncryption.SetIV (out);
+			m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+		}
 	}

 	void TunnelDecryption::Decrypt (const uint8_t * in, uint8_t * out)
 	{
-		uint8_t iv[16];
-		m_IVDecryption.Decrypt (in, iv); // iv
-		m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, iv, out + 16); // data
-		m_IVDecryption.Decrypt (iv, out); // double iv
+#if SUPPORTS_AES
+		if(i2p::cpu::aesni)
+		{
+			__asm__
+			(
+				// decrypt IV
+				"movups	(%[in]), %%xmm0 \n"
+				DecryptAES256(sched_iv)
+				"movaps %%xmm0, %%xmm1 \n"
+				// double IV encryption
+				DecryptAES256(sched_iv)
+				"movups %%xmm0, (%[out]) \n"
+				// decrypt data, IV is xmm1
+				"1: \n"
+				"add $16, %[in] \n"
+				"add $16, %[out] \n"
+				"movups (%[in]), %%xmm0 \n"
+				"movaps %%xmm0, %%xmm2 \n"
+				DecryptAES256(sched_l)
+				"pxor %%xmm1, %%xmm0 \n"
+				"movups %%xmm0, (%[out]) \n"
+				"movaps %%xmm2, %%xmm1 \n"
+				"dec %[num] \n"
+				"jnz 1b \n"
+				:
+				: [sched_iv]"r"(m_IVDecryption.GetKeySchedule ()), [sched_l]"r"(m_LayerDecryption.ECB().GetKeySchedule ()),
+					[in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+				: "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+			);
+		}
+		else
+#endif
+		{
+			m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+			m_LayerDecryption.SetIV (out);
+			m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+			m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+		}
 	}

 // AEAD/ChaCha20/Poly1305

-	static bool AEADChaCha20Poly1305 (EVP_CIPHER_CTX * ctx, const uint8_t * msg, size_t msgLen, 
-		const uint8_t * ad, size_t adLen, const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt)
+	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen, const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt)
 	{
-		if (!ctx || len < msgLen) return false;
+		if (len < msgLen) return false;
 		if (encrypt && len < msgLen + 16) return false;
 		bool ret = true;
 		int outlen = 0;
+		EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new ();
 		if (encrypt)
 		{
 			EVP_EncryptInit_ex(ctx, EVP_chacha20_poly1305(), 0, 0, 0);
@ -670,15 +997,6 @@ namespace crypto
 		}
 		else
 		{
-#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x4000000fL
-			std::vector<uint8_t> m(msgLen + 16);
-			if (msg == buf)
-			{	
-				// we have to use different buffers otherwise verification fails
-				memcpy (m.data (), msg, msgLen + 16);
-				msg = m.data ();
-			}	
-#endif			
 			EVP_DecryptInit_ex(ctx, EVP_chacha20_poly1305(), 0, 0, 0);
 			EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 12, 0);
 			EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, 16, (uint8_t *)(msg + msgLen));
@ -687,100 +1005,38 @@ namespace crypto
 			EVP_DecryptUpdate(ctx, buf, &outlen, msg, msgLen);
 			ret = EVP_DecryptFinal_ex(ctx, buf + outlen, &outlen) > 0;
 		}
-		return ret;
-	}

-	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen, 
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt)
-	{
-		EVP_CIPHER_CTX * ctx = EVP_CIPHER_CTX_new ();
-		auto ret = AEADChaCha20Poly1305 (ctx, msg, msgLen, ad, adLen, key, nonce, buf, len, encrypt);
 		EVP_CIPHER_CTX_free (ctx);
 		return ret;
 	}

-	AEADChaCha20Poly1305Encryptor::AEADChaCha20Poly1305Encryptor ()
-	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
-	}
-	
-	AEADChaCha20Poly1305Encryptor::~AEADChaCha20Poly1305Encryptor ()
-	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
-	}	
-
-	bool AEADChaCha20Poly1305Encryptor::Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
-	{
-		return AEADChaCha20Poly1305 (m_Ctx, msg, msgLen, ad, adLen, key, nonce, buf, len, true);
-	}	
-
-	void AEADChaCha20Poly1305Encryptor::Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, 
-		const uint8_t * key, const uint8_t * nonce, uint8_t * mac)
+	void AEADChaCha20Poly1305Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, const uint8_t * key, const uint8_t * nonce, uint8_t * mac)
 	{
 		if (bufs.empty ()) return;
 		int outlen = 0;
-		EVP_EncryptInit_ex(m_Ctx, EVP_chacha20_poly1305(), 0, 0, 0);
-		EVP_CIPHER_CTX_ctrl(m_Ctx, EVP_CTRL_AEAD_SET_IVLEN, 12, 0);
-		EVP_EncryptInit_ex(m_Ctx, NULL, NULL, key, nonce);
+		EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new ();
+		EVP_EncryptInit_ex(ctx, EVP_chacha20_poly1305(), 0, 0, 0);
+		EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 12, 0);
+		EVP_EncryptInit_ex(ctx, NULL, NULL, key, nonce);
 		for (const auto& it: bufs)
-			EVP_EncryptUpdate(m_Ctx, it.first, &outlen, it.first, it.second);
-		EVP_EncryptFinal_ex(m_Ctx, NULL, &outlen);
-		EVP_CIPHER_CTX_ctrl(m_Ctx, EVP_CTRL_AEAD_GET_TAG, 16, mac);
+			EVP_EncryptUpdate(ctx, it.first, &outlen, it.first, it.second);
+		EVP_EncryptFinal_ex(ctx, NULL, &outlen);
+		EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, 16, mac);
+		EVP_CIPHER_CTX_free (ctx);
 	}

-	AEADChaCha20Poly1305Decryptor::AEADChaCha20Poly1305Decryptor ()
-	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
-	}
-	
-	AEADChaCha20Poly1305Decryptor::~AEADChaCha20Poly1305Decryptor ()
-	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
-	}	
-
-	bool AEADChaCha20Poly1305Decryptor::Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
-	{
-		return AEADChaCha20Poly1305 (m_Ctx, msg, msgLen, ad, adLen, key, nonce, buf, len, false);
-	}
-
-	static void ChaCha20 (EVP_CIPHER_CTX *ctx, const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out)
+	void ChaCha20 (const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out)
 	{
+		EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new ();
 		uint32_t iv[4];
 		iv[0] = htole32 (1); memcpy (iv + 1, nonce, 12); // counter | nonce
 		EVP_EncryptInit_ex(ctx, EVP_chacha20 (), NULL, key, (const uint8_t *)iv);
 		int outlen = 0;
 		EVP_EncryptUpdate(ctx, out, &outlen, msg, msgLen);
 		EVP_EncryptFinal_ex(ctx, NULL, &outlen);
-	}
-	
-	void ChaCha20 (const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out)
-	{
-		EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new ();
-		ChaCha20 (ctx, msg, msgLen, key, nonce, out);
 		EVP_CIPHER_CTX_free (ctx);
 	}

-	
-	ChaCha20Context::ChaCha20Context ()
-	{
-		m_Ctx = EVP_CIPHER_CTX_new ();
-	}
-	
-	ChaCha20Context::~ChaCha20Context ()
-	{
-		if (m_Ctx)
-			EVP_CIPHER_CTX_free (m_Ctx);
-	}
-	
-	void ChaCha20Context::operator ()(const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out)
-	{
-		ChaCha20 (m_Ctx, msg, msgLen, key, nonce, out);
-	}	
-	
 	void HKDF (const uint8_t * salt, const uint8_t * key, size_t keyLen, const std::string& info,
 		uint8_t * out, size_t outLen)
 	{
@ -821,18 +1077,6 @@ namespace crypto

 // Noise

-	void NoiseSymmetricState::Init (const uint8_t * ck, const uint8_t * hh, const uint8_t * pub)
-	{
-		// pub is Bob's public static key, hh = SHA256(h)
-		memcpy (m_CK, ck, 32);
-		SHA256_CTX ctx;
-		SHA256_Init (&ctx);
-		SHA256_Update (&ctx, hh, 32);
-		SHA256_Update (&ctx, pub, 32);
-		SHA256_Final (m_H, &ctx); // h = MixHash(pub) = SHA256(hh || pub)
-		m_N = 0;
-	}	
-	
 	void NoiseSymmetricState::MixHash (const uint8_t * buf, size_t len)
 	{
 		SHA256_CTX ctx;
@ -856,93 +1100,74 @@ namespace crypto
 	{
 		HKDF (m_CK, sharedSecret, 32, "", m_CK);
 		// new ck is m_CK[0:31], key is m_CK[32:63]
-		m_N = 0;
 	}

-	bool NoiseSymmetricState::Encrypt (const uint8_t * in, uint8_t * out, size_t len)
+	static void InitNoiseState (NoiseSymmetricState& state, const uint8_t * ck,
+		const uint8_t * hh, const uint8_t * pub)
 	{
-		uint8_t nonce[12];
-		if (m_N)
-		{	
-			memset (nonce, 0, 4);
-			htole64buf (nonce + 4, m_N);
-		}	
-		else
-			memset (nonce, 0, 12);
-		auto ret = AEADChaCha20Poly1305 (in, len, m_H, 32, m_CK + 32, nonce, out, len + 16, true);
-		if (ret) m_N++;
-		return ret;
-	}
-
-	bool NoiseSymmetricState::Decrypt (const uint8_t * in, uint8_t * out, size_t len)
-	{
-		uint8_t nonce[12];
-		if (m_N)
-		{	
-			memset (nonce, 0, 4);
-			htole64buf (nonce + 4, m_N);
-		}
-		else
-			memset (nonce, 0, 12);
-		auto ret = AEADChaCha20Poly1305 (in, len, m_H, 32, m_CK + 32, nonce, out, len, false);
-		if (ret) m_N++;
-		return ret;
+		// pub is Bob's public static key, hh = SHA256(h)
+		memcpy (state.m_CK, ck, 32);
+		SHA256_CTX ctx;
+		SHA256_Init (&ctx);
+		SHA256_Update (&ctx, hh, 32);
+		SHA256_Update (&ctx, pub, 32);
+		SHA256_Final (state.m_H, &ctx); // h = MixHash(pub) = SHA256(hh || pub)
 	}

 	void InitNoiseNState (NoiseSymmetricState& state, const uint8_t * pub)
 	{
-		static constexpr char protocolName[] = "Noise_N_25519_ChaChaPoly_SHA256"; // 31 chars
-		static constexpr uint8_t hh[32] =
+		static const char protocolName[] = "Noise_N_25519_ChaChaPoly_SHA256"; // 31 chars
+		static const uint8_t hh[32] =
 		{
 			0x69, 0x4d, 0x52, 0x44, 0x5a, 0x27, 0xd9, 0xad, 0xfa, 0xd2, 0x9c, 0x76, 0x32, 0x39, 0x5d, 0xc1,
 			0xe4, 0x35, 0x4c, 0x69, 0xb4, 0xf9, 0x2e, 0xac, 0x8a, 0x1e, 0xe4, 0x6a, 0x9e, 0xd2, 0x15, 0x54
 		}; // hh = SHA256(protocol_name || 0)
-		state.Init ((const uint8_t *)protocolName, hh, pub); // ck = protocol_name || 0
+		InitNoiseState (state, (const uint8_t *)protocolName, hh, pub); // ck = protocol_name || 0
 	}

 	void InitNoiseXKState (NoiseSymmetricState& state, const uint8_t * pub)
 	{
-		static constexpr uint8_t protocolNameHash[32] =
+		static const uint8_t protocolNameHash[32] =
 		{
 			0x72, 0xe8, 0x42, 0xc5, 0x45, 0xe1, 0x80, 0x80, 0xd3, 0x9c, 0x44, 0x93, 0xbb, 0x91, 0xd7, 0xed,
 			0xf2, 0x28, 0x98, 0x17, 0x71, 0x21, 0x8c, 0x1f, 0x62, 0x4e, 0x20, 0x6f, 0x28, 0xd3, 0x2f, 0x71
 		}; // SHA256 ("Noise_XKaesobfse+hs2+hs3_25519_ChaChaPoly_SHA256")
-		static constexpr uint8_t hh[32] =
+		static const uint8_t hh[32] =
 		{
 			0x49, 0xff, 0x48, 0x3f, 0xc4, 0x04, 0xb9, 0xb2, 0x6b, 0x11, 0x94, 0x36, 0x72, 0xff, 0x05, 0xb5,
 			0x61, 0x27, 0x03, 0x31, 0xba, 0x89, 0xb8, 0xfc, 0x33, 0x15, 0x93, 0x87, 0x57, 0xdd, 0x3d, 0x1e
 		}; // SHA256 (protocolNameHash)
-		state.Init (protocolNameHash, hh, pub);
+		InitNoiseState (state, protocolNameHash, hh, pub);
 	}

 	void InitNoiseXKState1 (NoiseSymmetricState& state, const uint8_t * pub)
 	{
-		static constexpr uint8_t protocolNameHash[32] =
+		static const uint8_t protocolNameHash[32] =
 		{
 			0xb1, 0x37, 0x22, 0x81, 0x74, 0x23, 0xa8, 0xfd, 0xf4, 0x2d, 0xf2, 0xe6, 0x0e, 0xd1, 0xed, 0xf4,
 			0x1b, 0x93, 0x07, 0x1d, 0xb1, 0xec, 0x24, 0xa3, 0x67, 0xf7, 0x84, 0xec, 0x27, 0x0d, 0x81, 0x32
 		}; // SHA256 ("Noise_XKchaobfse+hs1+hs2+hs3_25519_ChaChaPoly_SHA256")
-		static constexpr uint8_t hh[32] =
+		static const uint8_t hh[32] =
 		{
 			0xdc, 0x85, 0xe6, 0xaf, 0x7b, 0x02, 0x65, 0x0c, 0xf1, 0xf9, 0x0d, 0x71, 0xfb, 0xc6, 0xd4, 0x53,
 			0xa7, 0xcf, 0x6d, 0xbf, 0xbd, 0x52, 0x5e, 0xa5, 0xb5, 0x79, 0x1c, 0x47, 0xb3, 0x5e, 0xbc, 0x33
 		}; // SHA256 (protocolNameHash)
-		state.Init (protocolNameHash, hh, pub);
+		InitNoiseState (state, protocolNameHash, hh, pub);
 	}

 	void InitNoiseIKState (NoiseSymmetricState& state, const uint8_t * pub)
 	{
-		static constexpr uint8_t protocolNameHash[32] =
+		static const uint8_t protocolNameHash[32] =
 		{
 			0x4c, 0xaf, 0x11, 0xef, 0x2c, 0x8e, 0x36, 0x56, 0x4c, 0x53, 0xe8, 0x88, 0x85, 0x06, 0x4d, 0xba,
 			0xac, 0xbe, 0x00, 0x54, 0xad, 0x17, 0x8f, 0x80, 0x79, 0xa6, 0x46, 0x82, 0x7e, 0x6e, 0xe4, 0x0c
 		}; // SHA256("Noise_IKelg2+hs2_25519_ChaChaPoly_SHA256"), 40 bytes
-		static constexpr uint8_t hh[32] =
+		static const uint8_t hh[32] =
 		{
 			0x9c, 0xcf, 0x85, 0x2c, 0xc9, 0x3b, 0xb9, 0x50, 0x44, 0x41, 0xe9, 0x50, 0xe0, 0x1d, 0x52, 0x32,
 			0x2e, 0x0d, 0x47, 0xad, 0xd1, 0xe9, 0xa5, 0x55, 0xf7, 0x55, 0xb5, 0x69, 0xae, 0x18, 0x3b, 0x5c
 		}; // SHA256 (protocolNameHash)
-		state.Init (protocolNameHash, hh, pub);
+		InitNoiseState (state, protocolNameHash, hh, pub);
 	}

 // init and terminate
@ -959,8 +1184,9 @@ namespace crypto
 		}
 	}*/

-	void InitCrypto (bool precomputation)
+	void InitCrypto (bool precomputation, bool aesni, bool force)
 	{
+		i2p::cpu::Detect (aesni, force);
 /*		auto numLocks = CRYPTO_num_locks();
 		for (int i = 0; i < numLocks; i++)
 			m_OpenSSLMutexes.emplace_back (new std::mutex);
--- a/libi2pd/Crypto.h
+++ b/libi2pd/Crypto.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -25,17 +25,16 @@

 #include "Base.h"
 #include "Tag.h"
+#include "CPU.h"

 // recognize openssl version and features
 #if (OPENSSL_VERSION_NUMBER >= 0x010101000) // 1.1.1
 #	define OPENSSL_HKDF 1
 #	define OPENSSL_EDDSA 1
+#	define OPENSSL_X25519 1
 #	if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER != 0x030000000)) // 3.0.0, regression in SipHash, not implemented in LibreSSL
 #		define OPENSSL_SIPHASH 1
 #	endif
-#	if (OPENSSL_VERSION_NUMBER >= 0x030500000) // 3.5.0
-#		define OPENSSL_PQ 1
-#	endif
 #endif

 namespace i2p
@ -45,11 +44,7 @@ namespace crypto
 	bool bn2buf (const BIGNUM * bn, uint8_t * buf, size_t len);

 	// DSA
-#if (OPENSSL_VERSION_NUMBER >= 0x030000000) // since 3.0.0
-	EVP_PKEY * CreateDSA (BIGNUM * pubKey = nullptr, BIGNUM * privKey = nullptr);
-#else
 	DSA * CreateDSA ();
-#endif	

 	// RSA
 	const BIGNUM * GetRSAE ();
@ -75,8 +70,13 @@ namespace crypto
 		private:

 			uint8_t m_PublicKey[32];
+#if OPENSSL_X25519
 			EVP_PKEY_CTX * m_Ctx;
 			EVP_PKEY * m_Pkey;
+#else
+			BN_CTX * m_Ctx;
+			uint8_t m_PrivateKey[32];
+#endif
 			bool m_IsElligatorIneligible = false; // true if definitely ineligible
 	};

@ -91,70 +91,142 @@ namespace crypto
 	void GenerateECIESKeyPair (const EC_GROUP * curve, BIGNUM *& priv, EC_POINT *& pub);

 	// AES
-	typedef i2p::data::Tag<32> AESKey;
-	
-	class ECBEncryption
+	struct ChipherBlock
 	{
-		public:
+		uint8_t buf[16];

-			ECBEncryption ();
-			~ECBEncryption ();
-			
-			void SetKey (const uint8_t * key) { m_Key = key; };
-			void Encrypt(const uint8_t * in, uint8_t * out);
-
-		private:
-
-			AESKey m_Key;
-			EVP_CIPHER_CTX * m_Ctx;	
+		void operator^=(const ChipherBlock& other) // XOR
+		{
+			if (!(((size_t)buf | (size_t)other.buf) & 0x03)) // multiple of 4 ?
+			{
+				for (int i = 0; i < 4; i++)
+					reinterpret_cast<uint32_t *>(buf)[i] ^= reinterpret_cast<const uint32_t *>(other.buf)[i];
+			}
+			else
+			{
+				for (int i = 0; i < 16; i++)
+					buf[i] ^= other.buf[i];
+			}
+		}
 	};

-	class ECBDecryption
+	typedef i2p::data::Tag<32> AESKey;
+
+	template<size_t sz>
+	class AESAlignedBuffer // 16 bytes alignment
 	{
 		public:

-			ECBDecryption ();
-			~ECBDecryption ();
+			AESAlignedBuffer ()
+			{
+				m_Buf = m_UnalignedBuffer;
+				uint8_t rem = ((size_t)m_Buf) & 0x0f;
+				if (rem)
+					m_Buf += (16 - rem);
+			}

-			void SetKey (const uint8_t * key) { m_Key = key; };
-			void Decrypt (const uint8_t * in, uint8_t * out);
+			operator uint8_t * () { return m_Buf; };
+			operator const uint8_t * () const { return m_Buf; };
+			ChipherBlock * GetChipherBlock () { return (ChipherBlock *)m_Buf; };
+			const ChipherBlock * GetChipherBlock () const { return (const ChipherBlock *)m_Buf; };

 		private:

-			AESKey m_Key;
-			EVP_CIPHER_CTX * m_Ctx;	
+			uint8_t m_UnalignedBuffer[sz + 15]; // up to 15 bytes alignment
+			uint8_t * m_Buf;
+	};
+
+
+#if SUPPORTS_AES
+	class ECBCryptoAESNI
+	{
+		public:
+
+			uint8_t * GetKeySchedule () { return m_KeySchedule; };
+
+		protected:
+
+			void ExpandKey (const AESKey& key);
+
+		private:
+
+			AESAlignedBuffer<240> m_KeySchedule;	// 14 rounds for AES-256, 240 bytes
+	};
+#endif
+
+#if SUPPORTS_AES
+	class ECBEncryption: public ECBCryptoAESNI
+#else
+	class ECBEncryption
+#endif
+	{
+		public:
+
+		void SetKey (const AESKey& key);
+
+		void Encrypt(const ChipherBlock * in, ChipherBlock * out);
+
+	private:
+		AES_KEY m_Key;
+	};
+
+#if SUPPORTS_AES
+	class ECBDecryption: public ECBCryptoAESNI
+#else
+	class ECBDecryption
+#endif
+	{
+		public:
+
+			void SetKey (const AESKey& key);
+			void Decrypt (const ChipherBlock * in, ChipherBlock * out);
+		private:
+			AES_KEY m_Key;
 	};

 	class CBCEncryption
 	{
 		public:

-			CBCEncryption ();
-			~CBCEncryption ();
+			CBCEncryption () { memset ((uint8_t *)m_LastBlock, 0, 16); };

-			void SetKey (const uint8_t * key) { m_Key = key; }; // 32 bytes		
-			void Encrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out);
+			void SetKey (const AESKey& key) { m_ECBEncryption.SetKey (key); }; // 32 bytes
+			void SetIV (const uint8_t * iv) { memcpy ((uint8_t *)m_LastBlock, iv, 16); }; // 16 bytes
+			void GetIV (uint8_t * iv) const { memcpy (iv, (const uint8_t *)m_LastBlock, 16); };
+
+			void Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out);
+			void Encrypt (const uint8_t * in, std::size_t len, uint8_t * out);
+			void Encrypt (const uint8_t * in, uint8_t * out); // one block
+
+			ECBEncryption & ECB() { return m_ECBEncryption; }

 		private:

-			AESKey m_Key;
-			EVP_CIPHER_CTX * m_Ctx;	
+			AESAlignedBuffer<16> m_LastBlock;
+
+			ECBEncryption m_ECBEncryption;
 	};

 	class CBCDecryption
 	{
 		public:

-			CBCDecryption ();
-			~CBCDecryption ();
+			CBCDecryption () { memset ((uint8_t *)m_IV, 0, 16); };

-			void SetKey (const uint8_t * key) { m_Key = key; }; // 32 bytes
-			void Decrypt (const uint8_t * in, size_t len, const uint8_t * iv, uint8_t * out);
+			void SetKey (const AESKey& key) { m_ECBDecryption.SetKey (key); }; // 32 bytes
+			void SetIV (const uint8_t * iv) { memcpy ((uint8_t *)m_IV, iv, 16); }; // 16 bytes
+			void GetIV (uint8_t * iv) const { memcpy (iv, (const uint8_t *)m_IV, 16); };
+
+			void Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out);
+			void Decrypt (const uint8_t * in, std::size_t len, uint8_t * out);
+			void Decrypt (const uint8_t * in, uint8_t * out); // one block
+
+			ECBDecryption & ECB() { return m_ECBDecryption; }

 		private:

-			AESKey m_Key;
-			EVP_CIPHER_CTX * m_Ctx;	
+			AESAlignedBuffer<16> m_IV;
+			ECBDecryption m_ECBDecryption;
 	};

 	class TunnelEncryption // with double IV encryption
@ -194,58 +266,13 @@ namespace crypto
 	};

 // AEAD/ChaCha20/Poly1305
+	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen, const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt); // msgLen is len without tag

-	class AEADChaCha20Poly1305Encryptor
-	{
-		public:
-
-			AEADChaCha20Poly1305Encryptor ();
-			~AEADChaCha20Poly1305Encryptor ();
-
-			bool Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); // msgLen is len without tag
-
-			void Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, const uint8_t * key, const uint8_t * nonce, uint8_t * mac); // encrypt multiple buffers with zero ad
-			
-		private:
-
-			EVP_CIPHER_CTX * m_Ctx;	
-	};	
-
-	class AEADChaCha20Poly1305Decryptor
-	{
-		public:
-
-			AEADChaCha20Poly1305Decryptor ();
-			~AEADChaCha20Poly1305Decryptor ();
-
-			bool Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); // msgLen is len without tag
-			
-		private:
-
-			EVP_CIPHER_CTX * m_Ctx;	
-	};	
-	
-	bool AEADChaCha20Poly1305 (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len, bool encrypt); // msgLen is len without tag
+	void AEADChaCha20Poly1305Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, const uint8_t * key, const uint8_t * nonce, uint8_t * mac); // encrypt multiple buffers with zero ad

 // ChaCha20
 	void ChaCha20 (const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out);

-	class ChaCha20Context
-	{
-		public:
-
-			ChaCha20Context ();
-			~ChaCha20Context ();
-			void operator ()(const uint8_t * msg, size_t msgLen, const uint8_t * key, const uint8_t * nonce, uint8_t * out);
-			
-		private:
-
-			EVP_CIPHER_CTX * m_Ctx;	
-	};
-	
 // HKDF

 	void HKDF (const uint8_t * salt, const uint8_t * key, size_t keyLen, const std::string& info, uint8_t * out, size_t outLen = 64); // salt - 32, out - 32 or 64, info <= 32
@ -255,16 +282,10 @@ namespace crypto
 	struct NoiseSymmetricState
 	{
 		uint8_t m_H[32] /*h*/, m_CK[64] /*[ck, k]*/;
-		uint64_t m_N;
-
-		void Init (const uint8_t * ck, const uint8_t * hh, const uint8_t * pub);

 		void MixHash (const uint8_t * buf, size_t len);
 		void MixHash (const std::vector<std::pair<uint8_t *, size_t> >& bufs);
 		void MixKey (const uint8_t * sharedSecret);
-
-		bool Encrypt (const uint8_t * in, uint8_t * out, size_t len); // out length = len + 16
-		bool Decrypt (const uint8_t * in, uint8_t * out, size_t len); // len without 16 bytes tag
 	};

 	void InitNoiseNState (NoiseSymmetricState& state, const uint8_t * pub); // Noise_N (tunnels, router)
@ -273,7 +294,7 @@ namespace crypto
 	void InitNoiseIKState (NoiseSymmetricState& state, const uint8_t * pub); // Noise_IK (ratchets)

 // init and terminate
-	void InitCrypto (bool precomputation);
+	void InitCrypto (bool precomputation, bool aesni, bool force);
 	void TerminateCrypto ();
 }
 }
--- a/libi2pd/CryptoKey.cpp
+++ b/libi2pd/CryptoKey.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2021, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -181,21 +181,5 @@ namespace crypto
 		k.GetPrivateKey (priv);
 		memcpy (pub, k.GetPublicKey (), 32);
 	}
-
-	LocalEncryptionKey::LocalEncryptionKey (i2p::data::CryptoKeyType t): keyType(t) 
-	{ 
-		pub.resize (GetCryptoPublicKeyLen (keyType)); 
-		priv.resize (GetCryptoPrivateKeyLen (keyType));
-	}
-	
-	void LocalEncryptionKey::GenerateKeys () 
-	{ 
-		i2p::data::PrivateKeys::GenerateCryptoKeyPair (keyType, priv.data (), pub.data ()); 
-	}
-	
-	void LocalEncryptionKey::CreateDecryptor () 
-	{ 
-		decryptor = i2p::data::PrivateKeys::CreateDecryptor (keyType, priv.data ()); 
-	}
 }
 }
--- a/libi2pd/CryptoKey.h
+++ b/libi2pd/CryptoKey.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2021, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,7 +11,6 @@

 #include <inttypes.h>
 #include "Crypto.h"
-#include "Identity.h"

 namespace i2p
 {
@ -158,50 +157,7 @@ namespace crypto
 			X25519Keys m_StaticKeys;
 	};

-	void CreateECIESX25519AEADRatchetRandomKeys (uint8_t * priv, uint8_t * pub); // including hybrid
-
-	constexpr size_t GetCryptoPrivateKeyLen (i2p::data::CryptoKeyType type)
-	{
-		switch (type)
-		{
-			case i2p::data::CRYPTO_KEY_TYPE_ELGAMAL: return 256;
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC: return 32;
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD: return 32;
-			// ML-KEM hybrid
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
-				return 32;
-		};	
-		return 0;
-	}
-
-	constexpr size_t GetCryptoPublicKeyLen (i2p::data::CryptoKeyType type)
-	{
-		switch (type)
-		{
-			case i2p::data::CRYPTO_KEY_TYPE_ELGAMAL: return 256;
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC: return 32;
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD: return 32;
-			// ML-KEM hybrid
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
-			case i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
-				return 32;
-		};	
-		return 0;
-	}
-
-	struct LocalEncryptionKey
-	{
-		std::vector<uint8_t> pub, priv;
-		i2p::data::CryptoKeyType keyType;
-		std::shared_ptr<CryptoKeyDecryptor> decryptor;
-
-		LocalEncryptionKey (i2p::data::CryptoKeyType t);
-		void GenerateKeys ();
-		void CreateDecryptor (); 
-	};
+	void CreateECIESX25519AEADRatchetRandomKeys (uint8_t * priv, uint8_t * pub);
 }
 }

--- a/libi2pd/Datagram.cpp
+++ b/libi2pd/Datagram.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -104,7 +104,8 @@ namespace datagram

 		if (verified)
 		{
-			auto session = ObtainSession (identity.GetIdentHash());
+			auto h = identity.GetIdentHash();
+			auto session = ObtainSession(h);
 			session->Ack();
 			auto r = FindReceiver(toPort);
 			if(r)
@ -287,8 +288,8 @@ namespace datagram

 	DatagramSession::DatagramSession(std::shared_ptr<i2p::client::ClientDestination> localDestination,
 		const i2p::data::IdentHash & remoteIdent) :
-		m_LocalDestination(localDestination), m_RemoteIdent(remoteIdent),
-		m_LastUse (0), m_LastFlush (0),
+		m_LocalDestination(localDestination),
+		m_RemoteIdent(remoteIdent),
 		m_RequestingLS(false)
 	{
 	}
@ -309,12 +310,8 @@ namespace datagram
 		if (msg || m_SendQueue.empty ())
 			m_SendQueue.push_back(msg);
 		// flush queue right away if full
-		if (!msg || m_SendQueue.size() >= DATAGRAM_SEND_QUEUE_MAX_SIZE || 
-		    m_LastUse > m_LastFlush + DATAGRAM_MAX_FLUSH_INTERVAL)
-		{	
+		if (!msg || m_SendQueue.size() >= DATAGRAM_SEND_QUEUE_MAX_SIZE)
 			FlushSendQueue();
-			m_LastFlush =  m_LastUse;
-		}
 	}

 	DatagramSession::Info DatagramSession::GetSessionInfo() const
@ -347,7 +344,7 @@ namespace datagram
 		if(path)
 			path->updateTime = i2p::util::GetSecondsSinceEpoch ();
 		if (IsRatchets ())
-			SendMsg (nullptr); // send empty message in case if we don't have some data to send
+			SendMsg (nullptr); // send empty message in case if we have some data to send
 	}

 	std::shared_ptr<i2p::garlic::GarlicRoutingPath> DatagramSession::GetSharedRoutingPath ()
@ -380,19 +377,15 @@ namespace datagram
 			if (!found)
 			{
 				m_RoutingSession = m_LocalDestination->GetRoutingSession(m_RemoteLeaseSet, true);
-				if (m_RoutingSession)
-				{	
-					m_RoutingSession->SetAckRequestInterval (DATAGRAM_SESSION_ACK_REQUEST_INTERVAL);
 				if (!m_RoutingSession->GetOwner () || !m_RoutingSession->IsReadyToSend ())
 					m_PendingRoutingSessions.push_back (m_RoutingSession);
 			}
 		}
-		}

 		auto path = m_RoutingSession->GetSharedRoutingPath();
-		if (path && m_RoutingSession->IsRatchets () && m_RoutingSession->CleanupUnconfirmedTags ())
+		if (path && m_RoutingSession->IsRatchets () &&
+			m_LastUse > m_RoutingSession->GetLastActivityTimestamp ()*1000 + DATAGRAM_SESSION_PATH_TIMEOUT)
 		{
-			LogPrint (eLogDebug, "Datagram: path reset");
 			m_RoutingSession->SetSharedRoutingPath (nullptr);
 			path = nullptr;
 		}
@ -420,14 +413,7 @@ namespace datagram
 					auto sz = ls.size();
 					if (sz)
 					{
-						int idx = -1;
-						if (m_LocalDestination)
-						{
-							auto pool = m_LocalDestination->GetTunnelPool ();
-							if (pool)
-								idx = pool->GetRng ()() % sz;
-						}
-						if (idx < 0) idx = rand () % sz;
+						auto idx = rand() % sz;
 						path->remoteLease = ls[idx];
 					}
 					else
@ -453,14 +439,7 @@ namespace datagram
 				auto sz = ls.size();
 				if (sz)
 				{
-					int idx = -1;
-					if (m_LocalDestination)
-					{
-						auto pool = m_LocalDestination->GetTunnelPool ();
-						if (pool)
-							idx = pool->GetRng ()() % sz;
-					}
-					if (idx < 0) idx = rand () % sz;
+					auto idx = rand() % sz;
 					path->remoteLease = ls[idx];
 				}
 				else
--- a/libi2pd/Datagram.h
+++ b/libi2pd/Datagram.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -31,6 +31,8 @@ namespace datagram
 {
 	// milliseconds for max session idle time
 	const uint64_t DATAGRAM_SESSION_MAX_IDLE = 10 * 60 * 1000;
+	// milliseconds for how long we try sticking to a dead routing path before trying to switch
+	const uint64_t DATAGRAM_SESSION_PATH_TIMEOUT = 10 * 1000;
 	// milliseconds interval a routing path is used before switching
 	const uint64_t DATAGRAM_SESSION_PATH_SWITCH_INTERVAL = 20 * 60 * 1000;
 	// milliseconds before lease expire should we try switching leases
@ -41,8 +43,6 @@ namespace datagram
 	const uint64_t DATAGRAM_SESSION_PATH_MIN_LIFETIME = 5 * 1000;
 	// max 64 messages buffered in send queue for each datagram session
 	const size_t DATAGRAM_SEND_QUEUE_MAX_SIZE = 64;
-	const uint64_t DATAGRAM_MAX_FLUSH_INTERVAL = 5; // in milliseconds
-	const int DATAGRAM_SESSION_ACK_REQUEST_INTERVAL = 5500; // in milliseconds

 	class DatagramSession : public std::enable_shared_from_this<DatagramSession>
 	{
@ -98,7 +98,7 @@ namespace datagram
 			std::shared_ptr<i2p::garlic::GarlicRoutingSession> m_RoutingSession;
 			std::vector<std::shared_ptr<i2p::garlic::GarlicRoutingSession> > m_PendingRoutingSessions;
 			std::vector<std::shared_ptr<I2NPMessage> > m_SendQueue;
-			uint64_t m_LastUse, m_LastFlush; // milliseconds
+			uint64_t m_LastUse;
 			bool m_RequestingLS;
 	};

--- a/libi2pd/Destination.cpp
+++ b/libi2pd/Destination.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -13,7 +13,6 @@
 #include <vector>
 #include <boost/algorithm/string.hpp>
 #include "Crypto.h"
-#include "ECIESX25519AEADRatchetSession.h"
 #include "Log.h"
 #include "FS.h"
 #include "Timestamp.h"
@ -24,7 +23,7 @@ namespace i2p
 {
 namespace client
 {
-	LeaseSetDestination::LeaseSetDestination (boost::asio::io_context& service,
+	LeaseSetDestination::LeaseSetDestination (boost::asio::io_service& service,
 		bool isPublic, const std::map<std::string, std::string> * params):
 		m_Service (service), m_IsPublic (isPublic), m_PublishReplyToken (0),
 		m_LastSubmissionTime (0), m_PublishConfirmationTimer (m_Service),
@ -38,7 +37,6 @@ namespace client
 		int inVar   = DEFAULT_INBOUND_TUNNELS_LENGTH_VARIANCE;
 		int outVar  = DEFAULT_OUTBOUND_TUNNELS_LENGTH_VARIANCE;
 		int numTags = DEFAULT_TAGS_TO_SEND;
-		bool isHighBandwidth = true;
 		std::shared_ptr<std::vector<i2p::data::IdentHash> > explicitPeers;
 		try
 		{
@ -94,7 +92,7 @@ namespace client
 				it = params->find (I2CP_PARAM_DONT_PUBLISH_LEASESET);
 				if (it != params->end ())
 				{
-					// override isPublic
+					// oveeride isPublic
 					m_IsPublic = (it->second != "true");
 				}
 				it = params->find (I2CP_PARAM_LEASESET_TYPE);
@ -123,9 +121,6 @@ namespace client
 						m_LeaseSetPrivKey.reset (nullptr);
 					}
 				}
-				it = params->find (I2CP_PARAM_STREAMING_PROFILE);
-				if (it != params->end ())
-					isHighBandwidth = std::stoi (it->second) != STREAMING_PROFILE_INTERACTIVE;
 			}
 		}
 		catch (std::exception & ex)
@ -133,7 +128,7 @@ namespace client
 			LogPrint(eLogError, "Destination: Unable to parse parameters for destination: ", ex.what());
 		}
 		SetNumTags (numTags);
-		m_Pool = i2p::tunnel::tunnels.CreateTunnelPool (inLen, outLen, inQty, outQty, inVar, outVar, isHighBandwidth);
+		m_Pool = i2p::tunnel::tunnels.CreateTunnelPool (inLen, outLen, inQty, outQty, inVar, outVar);
 		if (explicitPeers)
 			m_Pool->SetExplicitPeers (explicitPeers);
 		if(params)
@ -169,7 +164,7 @@ namespace client
 		LoadTags ();
 		m_Pool->SetLocalDestination (shared_from_this ());
 		m_Pool->SetActive (true);
-		m_CleanupTimer.expires_from_now (boost::posix_time::seconds (DESTINATION_CLEANUP_TIMEOUT));
+		m_CleanupTimer.expires_from_now (boost::posix_time::minutes (DESTINATION_CLEANUP_TIMEOUT));
 		m_CleanupTimer.async_wait (std::bind (&LeaseSetDestination::HandleCleanupTimer,
 			shared_from_this (), std::placeholders::_1));
 	}
@ -196,7 +191,7 @@ namespace client
 			m_IsPublic = itr->second != "true";
 		}

-		int inLen = 0, outLen = 0, inQuant = 0, outQuant = 0, numTags = 0, minLatency = 0, maxLatency = 0;
+		int inLen, outLen, inQuant, outQuant, numTags, minLatency, maxLatency;
 		std::map<std::string, int&> intOpts = {
 			{I2CP_PARAM_INBOUND_TUNNEL_LENGTH, inLen},
 			{I2CP_PARAM_OUTBOUND_TUNNEL_LENGTH, outLen},
@ -295,7 +290,7 @@ namespace client
 		if (m_IsPublic)
 		{
 			auto s = shared_from_this ();
-			boost::asio::post (m_Service, [s](void)
+			m_Service.post ([s](void)
 			{
 				s->m_PublishVerificationTimer.cancel ();
 				s->Publish ();
@ -323,7 +318,7 @@ namespace client
 		memcpy (data.k, key, 32);
 		memcpy (data.t, tag, 32);
 		auto s = shared_from_this ();
-		boost::asio::post (m_Service, [s,data](void)
+		m_Service.post ([s,data](void)
 			{
 				s->AddSessionKey (data.k, data.t);
 			});
@ -340,7 +335,7 @@ namespace client
 		memcpy (data.k, key, 32);
 		data.t = tag;
 		auto s = shared_from_this ();
-		boost::asio::post (m_Service, [s,data](void)
+		m_Service.post ([s,data](void)
 			{
 				s->AddECIESx25519Key (data.k, data.t);
 			});
@ -348,42 +343,23 @@ namespace client

 	void LeaseSetDestination::ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg)
 	{
-		if (!msg) return;
-		bool empty = false;
-		{
-			std::lock_guard<std::mutex> l(m_IncomingMsgsQueueMutex);
-			empty = m_IncomingMsgsQueue.empty ();
-			m_IncomingMsgsQueue.push_back (msg);
-		}
-		if (empty)
-			boost::asio::post (m_Service, [s = shared_from_this ()]() 
-			{ 
-				std::list<std::shared_ptr<I2NPMessage> > receivedMsgs;
-				{
-					std::lock_guard<std::mutex> l(s->m_IncomingMsgsQueueMutex);
-					s->m_IncomingMsgsQueue.swap (receivedMsgs);
-				}
-			    for (auto& it: receivedMsgs)
-			    	s->HandleGarlicMessage (it);               
-			});
+		m_Service.post (std::bind (&LeaseSetDestination::HandleGarlicMessage, shared_from_this (), msg));
 	}

 	void LeaseSetDestination::ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg)
 	{
 		uint32_t msgID = bufbe32toh (msg->GetPayload () + DELIVERY_STATUS_MSGID_OFFSET);
-		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::HandleDeliveryStatusMessage, shared_from_this (), msgID));
+		m_Service.post (std::bind (&LeaseSetDestination::HandleDeliveryStatusMessage, shared_from_this (), msgID));
 	}

 	void LeaseSetDestination::HandleI2NPMessage (const uint8_t * buf, size_t len)
 	{
 		I2NPMessageType typeID = (I2NPMessageType)(buf[I2NP_HEADER_TYPEID_OFFSET]);
 		uint32_t msgID = bufbe32toh (buf + I2NP_HEADER_MSGID_OFFSET);
-		LeaseSetDestination::HandleCloveI2NPMessage (typeID, buf + I2NP_HEADER_SIZE, 
-			GetI2NPMessageLength(buf, len) - I2NP_HEADER_SIZE, msgID, nullptr);
+		LeaseSetDestination::HandleCloveI2NPMessage (typeID, buf + I2NP_HEADER_SIZE, GetI2NPMessageLength(buf, len) - I2NP_HEADER_SIZE, msgID);
 	}

-	bool LeaseSetDestination::HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload,
-		size_t len, uint32_t msgID, i2p::garlic::ECIESX25519AEADRatchetSession * from)
+	bool LeaseSetDestination::HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID)
 	{
 		switch (typeID)
 		{
@ -398,7 +374,7 @@ namespace client
 					m_Pool->ProcessTunnelTest (bufbe32toh (payload + TUNNEL_TEST_MSGID_OFFSET), bufbe64toh (payload + TUNNEL_TEST_TIMESTAMP_OFFSET));
 			break;
 			case eI2NPDatabaseStore:
-				HandleDatabaseStoreMessage (payload, len, from);
+				HandleDatabaseStoreMessage (payload, len);
 			break;
 			case eI2NPDatabaseSearchReply:
 				HandleDatabaseSearchReplyMessage (payload, len);
@ -413,8 +389,7 @@ namespace client
 		return true;
 	}

-	void LeaseSetDestination::HandleDatabaseStoreMessage (const uint8_t * buf, size_t len,
-		i2p::garlic::ECIESX25519AEADRatchetSession * from)
+	void LeaseSetDestination::HandleDatabaseStoreMessage (const uint8_t * buf, size_t len)
 	{
 		if (len < DATABASE_STORE_HEADER_SIZE)
 		{
@ -469,8 +444,7 @@ namespace client
 					if (buf[DATABASE_STORE_TYPE_OFFSET] == i2p::data::NETDB_STORE_TYPE_LEASESET)
 						leaseSet = std::make_shared<i2p::data::LeaseSet> (buf + offset, len - offset); // LeaseSet
 					else
-						leaseSet = std::make_shared<i2p::data::LeaseSet2> (buf[DATABASE_STORE_TYPE_OFFSET], 
-							buf + offset, len - offset, true, from ? from->GetRemoteStaticKeyType () : GetPreferredCryptoType () ); // LeaseSet2
+						leaseSet = std::make_shared<i2p::data::LeaseSet2> (buf[DATABASE_STORE_TYPE_OFFSET], buf + offset, len - offset, true, GetPreferredCryptoType () ); // LeaseSet2
 					if (leaseSet->IsValid () && leaseSet->GetIdentHash () == key && !leaseSet->IsExpired ())
 					{
 						if (leaseSet->GetIdentHash () != GetIdentHash ())
@ -499,8 +473,7 @@ namespace client
 					if (request->requestedBlindedKey)
 					{
 						auto ls2 = std::make_shared<i2p::data::LeaseSet2> (buf + offset, len - offset,
-							request->requestedBlindedKey, m_LeaseSetPrivKey ? ((const uint8_t *)*m_LeaseSetPrivKey) : nullptr, 
-						    from ? from->GetRemoteStaticKeyType () : GetPreferredCryptoType ());
+							request->requestedBlindedKey, m_LeaseSetPrivKey ? ((const uint8_t *)*m_LeaseSetPrivKey) : nullptr , GetPreferredCryptoType ());
 						if (ls2->IsValid () && !ls2->IsExpired ())
 						{
 							leaseSet = ls2;
@ -603,8 +576,7 @@ namespace client
 			m_ExcludedFloodfills.clear ();
 			m_PublishReplyToken = 0;
 			// schedule verification
-			m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT +
-				(m_Pool ? m_Pool->GetRng ()() % PUBLISH_VERIFICATION_TIMEOUT_VARIANCE : 0)));
+			m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT));
 			m_PublishVerificationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishVerificationTimer,
 			shared_from_this (), std::placeholders::_1));
 		}
@ -612,11 +584,8 @@ namespace client
 			i2p::garlic::GarlicDestination::HandleDeliveryStatusMessage (msgID);
 	}

-	void LeaseSetDestination::SetLeaseSetUpdated (bool post)
+	void LeaseSetDestination::SetLeaseSetUpdated ()
 	{
-		if (post)
-			boost::asio::post (m_Service, [s = shared_from_this ()]() { s->UpdateLeaseSet (); });
-		else
 		UpdateLeaseSet ();
 	}

@ -683,8 +652,8 @@ namespace client
 				m_ExcludedFloodfills.clear ();
 				m_PublishReplyToken = 1; // dummy non-zero value
 				// try again after a while
-				LogPrint (eLogInfo, "Destination: Can't publish LeasetSet because destination is not ready. Try publishing again after ", PUBLISH_CONFIRMATION_TIMEOUT, " milliseconds");
-				m_PublishConfirmationTimer.expires_from_now (boost::posix_time::milliseconds(PUBLISH_CONFIRMATION_TIMEOUT));
+				LogPrint (eLogInfo, "Destination: Can't publish LeasetSet because destination is not ready. Try publishing again after ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds");
+				m_PublishConfirmationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_CONFIRMATION_TIMEOUT));
 				m_PublishConfirmationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishConfirmationTimer,
 					shared_from_this (), std::placeholders::_1));
 				return;
@ -697,13 +666,13 @@ namespace client
 		auto s = shared_from_this ();
 		msg->onDrop = [s]()
 			{
-				boost::asio::post (s->GetService (), [s]()
+				s->GetService ().post([s]()
 					{
 						s->m_PublishConfirmationTimer.cancel ();
 						s->HandlePublishConfirmationTimer (boost::system::error_code());
 					});
 			};
-		m_PublishConfirmationTimer.expires_from_now (boost::posix_time::milliseconds(PUBLISH_CONFIRMATION_TIMEOUT));
+		m_PublishConfirmationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_CONFIRMATION_TIMEOUT));
 		m_PublishConfirmationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishConfirmationTimer,
 			shared_from_this (), std::placeholders::_1));
 		outbound->SendTunnelDataMsgTo (floodfill->GetIdentHash (), 0, msg);
@ -719,15 +688,15 @@ namespace client
 				m_PublishReplyToken = 0;
 				if (GetIdentity ()->GetCryptoKeyType () == i2p::data::CRYPTO_KEY_TYPE_ELGAMAL)
 				{
-					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " milliseconds or failed. will try again");
+					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds or failed. will try again");
 					Publish ();
 				}
 				else
 				{
-					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " milliseconds from Java floodfill for crypto type ", (int)GetIdentity ()->GetCryptoKeyType ());
+					LogPrint (eLogWarning, "Destination: Publish confirmation was not received in ", PUBLISH_CONFIRMATION_TIMEOUT, " seconds from Java floodfill for crypto type ", (int)GetIdentity ()->GetCryptoKeyType ());
 					// Java floodfill never sends confirmation back for unknown crypto type
 					// assume it successive and try to verify
-					m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT + PUBLISH_VERIFICATION_TIMEOUT_VARIANCE)); // always max
+					m_PublishVerificationTimer.expires_from_now (boost::posix_time::seconds(PUBLISH_VERIFICATION_TIMEOUT));
 					m_PublishVerificationTimer.async_wait (std::bind (&LeaseSetDestination::HandlePublishVerificationTimer,
 			shared_from_this (), std::placeholders::_1));

@ -782,10 +751,10 @@ namespace client
 		if (!m_Pool || !IsReady ())
 		{
 			if (requestComplete)
-				boost::asio::post (m_Service, [requestComplete](void){requestComplete (nullptr);});
+				m_Service.post ([requestComplete](void){requestComplete (nullptr);});
 			return false;
 		}
-		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), dest, requestComplete, nullptr));
+		m_Service.post (std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), dest, requestComplete, nullptr));
 		return true;
 	}

@ -794,7 +763,7 @@ namespace client
 		if (!dest || !m_Pool || !IsReady ())
 		{
 			if (requestComplete)
-				boost::asio::post (m_Service, [requestComplete](void){requestComplete (nullptr);});
+				m_Service.post ([requestComplete](void){requestComplete (nullptr);});
 			return false;
 		}
 		auto storeHash = dest->GetStoreHash ();
@ -802,17 +771,17 @@ namespace client
 		if (leaseSet)
 		{
 			if (requestComplete)
-				boost::asio::post (m_Service, [requestComplete, leaseSet](void){requestComplete (leaseSet);});
+				m_Service.post ([requestComplete, leaseSet](void){requestComplete (leaseSet);});
 			return true;
 		}
-		boost::asio::post (m_Service, std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), storeHash, requestComplete, dest));
+		m_Service.post (std::bind (&LeaseSetDestination::RequestLeaseSet, shared_from_this (), storeHash, requestComplete, dest));
 		return true;
 	}

 	void LeaseSetDestination::CancelDestinationRequest (const i2p::data::IdentHash& dest, bool notify)
 	{
 		auto s = shared_from_this ();
-		boost::asio::post (m_Service, [dest, notify, s](void)
+		m_Service.post ([dest, notify, s](void)
 			{
 				auto it = s->m_LeaseSetRequests.find (dest);
 				if (it != s->m_LeaseSetRequests.end ())
@ -840,7 +809,7 @@ namespace client
 			request->requestedBlindedKey = requestedBlindedKey; // for encrypted LeaseSet2
 			if (requestComplete)
 				request->requestComplete.push_back (requestComplete);
-			auto ts = i2p::util::GetMillisecondsSinceEpoch ();
+			auto ts = i2p::util::GetSecondsSinceEpoch ();
 			auto ret = m_LeaseSetRequests.insert (std::pair<i2p::data::IdentHash, std::shared_ptr<LeaseSetRequest> >(dest,request));
 			if (ret.second) // inserted
 			{
@ -910,7 +879,7 @@ namespace client
 			auto s = shared_from_this ();
 			msg->onDrop = [s, dest, request]()
 				{
-					boost::asio::post (s->GetService (), [s, dest, request]()
+					s->GetService ().post([s, dest, request]()
 						{
 							s->SendNextLeaseSetRequest (dest, request);
 						});
@ -923,7 +892,7 @@ namespace client
 						nextFloodfill->GetIdentHash (), 0, msg
 					}
 				});
-			request->requestTimeoutTimer.expires_from_now (boost::posix_time::milliseconds(LEASESET_REQUEST_TIMEOUT));
+			request->requestTimeoutTimer.expires_from_now (boost::posix_time::seconds(LEASESET_REQUEST_TIMEOUT));
 			request->requestTimeoutTimer.async_wait (std::bind (&LeaseSetDestination::HandleRequestTimoutTimer,
 				shared_from_this (), std::placeholders::_1, dest));
 		}
@ -940,7 +909,7 @@ namespace client
 			if (it != m_LeaseSetRequests.end ())
 			{
 				bool done = false;
-				uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
+				uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
 				if (ts < it->second->requestTime + MAX_LEASESET_REQUEST_TIMEOUT)
 				{
 					auto floodfill = i2p::data::netdb.GetClosestFloodfill (dest, it->second->excluded);
@ -977,8 +946,7 @@ namespace client
 			CleanupExpiredTags ();
 			CleanupRemoteLeaseSets ();
 			CleanupDestination ();
-			m_CleanupTimer.expires_from_now (boost::posix_time::seconds (DESTINATION_CLEANUP_TIMEOUT +
-				(m_Pool ? m_Pool->GetRng ()() % DESTINATION_CLEANUP_TIMEOUT_VARIANCE : 0)));
+			m_CleanupTimer.expires_from_now (boost::posix_time::minutes (DESTINATION_CLEANUP_TIMEOUT));
 			m_CleanupTimer.async_wait (std::bind (&LeaseSetDestination::HandleCleanupTimer,
 				shared_from_this (), std::placeholders::_1));
 		}
@ -992,7 +960,7 @@ namespace client
 		{
 			if (it->second->IsEmpty () || ts > it->second->GetExpirationTime ()) // leaseset expired
 			{
-				LogPrint (eLogDebug, "Destination: Remote LeaseSet ", it->second->GetIdentHash ().ToBase64 (), " expired");
+				LogPrint (eLogWarning, "Destination: Remote LeaseSet ", it->second->GetIdentHash ().ToBase64 (), " expired");
 				it = m_RemoteLeaseSets.erase (it);
 			}
 			else
@ -1000,15 +968,20 @@ namespace client
 		}
 	}

-	ClientDestination::ClientDestination (boost::asio::io_context& service, const i2p::data::PrivateKeys& keys,
+	i2p::data::CryptoKeyType LeaseSetDestination::GetPreferredCryptoType () const
+	{
+		if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
+			return i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD;
+		return i2p::data::CRYPTO_KEY_TYPE_ELGAMAL;
+	}
+
+	ClientDestination::ClientDestination (boost::asio::io_service& service, const i2p::data::PrivateKeys& keys,
 		bool isPublic, const std::map<std::string, std::string> * params):
 		LeaseSetDestination (service, isPublic, params),
-		m_Keys (keys), m_PreferredCryptoType (0), m_StreamingAckDelay (DEFAULT_INITIAL_ACK_DELAY),
+		m_Keys (keys), m_StreamingAckDelay (DEFAULT_INITIAL_ACK_DELAY),
 		m_StreamingOutboundSpeed (DEFAULT_MAX_OUTBOUND_SPEED),
-		m_StreamingInboundSpeed (DEFAULT_MAX_INBOUND_SPEED),
-		m_StreamingMaxConcurrentStreams (DEFAULT_MAX_CONCURRENT_STREAMS),
 		m_IsStreamingAnswerPings (DEFAULT_ANSWER_PINGS), m_LastPort (0),
-		m_DatagramDestination (nullptr), m_RefCounter (0), m_LastPublishedTimestamp (0),
+		m_DatagramDestination (nullptr), m_RefCounter (0),
 		m_ReadyChecker(service)
 	{
 		if (keys.IsOfflineSignature () && GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
@ -1028,15 +1001,7 @@ namespace client
 				{
 					try
 					{
-						i2p::data::CryptoKeyType cryptoType = std::stoi(it1);
-#if !OPENSSL_PQ
-						if (cryptoType <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) // skip PQ keys if not supported
-#endif					
-						{
-							if (!m_PreferredCryptoType && cryptoType)
-								m_PreferredCryptoType = cryptoType; // first non-zero in the list
-							encryptionKeyTypes.insert (cryptoType);
-						}	
+						encryptionKeyTypes.insert (std::stoi(it1));
 					}
 					catch (std::exception& ex)
 					{
@ -1047,21 +1012,29 @@ namespace client
 			}
 		}
 		// if no param or valid crypto type use from identity
+		bool isSingleKey = false;
 		if (encryptionKeyTypes.empty ())
-			encryptionKeyTypes.insert ( { GetIdentity ()->GetCryptoKeyType (),
-				i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD }); // usually 0,4
+		{
+			isSingleKey = true;
+			encryptionKeyTypes.insert (GetIdentity ()->GetCryptoKeyType ());
+		}

 		for (auto& it: encryptionKeyTypes)
 		{
-			auto encryptionKey = std::make_shared<i2p::crypto::LocalEncryptionKey> (it);
+			auto encryptionKey = new EncryptionKey (it);
 			if (IsPublic ())
-				PersistTemporaryKeys (encryptionKey);
+				PersistTemporaryKeys (encryptionKey, isSingleKey);
 			else
 				encryptionKey->GenerateKeys ();
 			encryptionKey->CreateDecryptor ();
-			if (it > i2p::data::CRYPTO_KEY_TYPE_ELGAMAL && GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
-				SetLeaseSetType (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2); // Only DSA can use LeaseSet1
-			m_EncryptionKeys.emplace (it, encryptionKey);
+			if (it == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
+			{
+				m_ECIESx25519EncryptionKey.reset (encryptionKey);
+				if (GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
+					SetLeaseSetType (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2); // Rathets must use LeaseSet2
+			}
+			else
+				m_StandardEncryptionKey.reset (encryptionKey);
 		}

 		if (IsPublic ())
@ -1078,11 +1051,6 @@ namespace client
 				it = params->find (I2CP_PARAM_STREAMING_MAX_OUTBOUND_SPEED);
 				if (it != params->end ())
 					m_StreamingOutboundSpeed = std::stoi(it->second);
-				it = params->find (I2CP_PARAM_STREAMING_MAX_INBOUND_SPEED);
-				if (it != params->end ())
-					m_StreamingInboundSpeed = std::stoi(it->second);
-				if (it != params->end ())
-					m_StreamingMaxConcurrentStreams = std::stoi(it->second);
 				it = params->find (I2CP_PARAM_STREAMING_ANSWER_PINGS);
 				if (it != params->end ())
 					m_IsStreamingAnswerPings = std::stoi (it->second); // 1 for true
@ -1133,6 +1101,7 @@ namespace client
 	void ClientDestination::Stop ()
 	{
 		LogPrint(eLogDebug, "Destination: Stopping destination ", GetIdentHash().ToBase32(), ".b32.i2p");
+		LeaseSetDestination::Stop ();
 		m_ReadyChecker.cancel();
 		LogPrint(eLogDebug, "Destination: -> Stopping Streaming Destination");
 		m_StreamingDestination->Stop ();
@ -1154,7 +1123,6 @@ namespace client
 			delete m_DatagramDestination;
 			m_DatagramDestination = nullptr;
 		}
-		LeaseSetDestination::Stop ();
 		LogPrint(eLogDebug, "Destination: -> Stopping done");
 	}

@ -1218,7 +1186,7 @@ namespace client
 		if (leaseSet)
 		{
 			auto stream = CreateStream (leaseSet, port);
-			boost::asio::post (GetService (), [streamRequestComplete, stream]()
+			GetService ().post ([streamRequestComplete, stream]()
 				{
 					streamRequestComplete(stream);
 				});
@ -1411,56 +1379,32 @@ namespace client
 		return ret;
 	}

-	void ClientDestination::PersistTemporaryKeys (std::shared_ptr<i2p::crypto::LocalEncryptionKey> keys)
+	void ClientDestination::PersistTemporaryKeys (EncryptionKey * keys, bool isSingleKey)
 	{
 		if (!keys) return;
 		std::string ident = GetIdentHash().ToBase32();
-		std::string path  = i2p::fs::DataDirPath("destinations", ident + "." + std::to_string (keys->keyType) + ".dat");
+		std::string path  = i2p::fs::DataDirPath("destinations",
+			isSingleKey ? (ident + ".dat") : (ident + "." + std::to_string (keys->keyType) + ".dat"));
 		std::ifstream f(path, std::ifstream::binary);
-		if (f) 
-		{
-			size_t len = 0;
-			if (keys->keyType == i2p::data::CRYPTO_KEY_TYPE_ELGAMAL)
-				len = 512;
-			else if (keys->keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
-			{	
-				f.seekg (0, std::ios::end);
-				len = f.tellg();
-				f.seekg (0, std::ios::beg);
-			}

-			if (len == 512)
-			{    
-				char pub[256], priv[256];
-				f.read (pub, 256);
-				memcpy (keys->pub.data(), pub, keys->pub.size());
-				f.read (priv, 256);
-				memcpy (keys->priv.data (), priv, keys->priv.size ());
-			}
-			else
-			{
-				f.read ((char *)keys->pub.data(), keys->pub.size());
-				f.read ((char *)keys->priv.data(), keys->priv.size());
-			}	
-			if (f) 
+		if (f) {
+			f.read ((char *)keys->pub, 256);
+			f.read ((char *)keys->priv, 256);
 			return;
-			else
-				LogPrint(eLogWarning, "Destination: Can't read keys from ", path);
 		}

-		LogPrint (eLogInfo, "Destination: Creating new temporary keys of type ", keys->keyType, " for address ", ident, ".b32.i2p");
-		memset (keys->priv.data (), 0, keys->priv.size ());
-		memset (keys->pub.data (), 0, keys->pub.size ());
+		LogPrint (eLogInfo, "Destination: Creating new temporary keys of type for address ", ident, ".b32.i2p");
+		memset (keys->priv, 0, 256);
+		memset (keys->pub, 0, 256);
 		keys->GenerateKeys ();
-		
+		// TODO:: persist crypto key type
 		std::ofstream f1 (path, std::ofstream::binary | std::ofstream::out);
-		if (f1) 
-		{
-			f1.write ((char *)keys->pub.data (), keys->pub.size ());
-			f1.write ((char *)keys->priv.data (), keys->priv.size ());
+		if (f1) {
+			f1.write ((char *)keys->pub, 256);
+			f1.write ((char *)keys->priv, 256);
+			return;
 		}
-		if (!f1)
-			LogPrint(eLogError, "Destination: Can't save keys to ", path);
+		LogPrint(eLogCritical, "Destinations: Can't save keys to ", path);
 	}

 	void ClientDestination::CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels)
@ -1468,10 +1412,9 @@ namespace client
 		std::shared_ptr<i2p::data::LocalLeaseSet> leaseSet;
 		if (GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_LEASESET)
 		{
-			auto it = m_EncryptionKeys.find (i2p::data::CRYPTO_KEY_TYPE_ELGAMAL);
-			if (it != m_EncryptionKeys.end ())
+			if (m_StandardEncryptionKey)
 			{
-				leaseSet = std::make_shared<i2p::data::LocalLeaseSet> (GetIdentity (), it->second->pub.data (), tunnels);
+				leaseSet = std::make_shared<i2p::data::LocalLeaseSet> (GetIdentity (), m_StandardEncryptionKey->pub, tunnels);
 				// sign
 				Sign (leaseSet->GetBuffer (), leaseSet->GetBufferLen () - leaseSet->GetSignatureLen (), leaseSet->GetSignature ());
 			}
@ -1481,40 +1424,18 @@ namespace client
 		else
 		{
 			// standard LS2 (type 3) first
-			if (m_EncryptionKeys.empty ())
-			{
-				LogPrint (eLogError, "Destinations: No encryption keys");
-				return;
-			}	
+			i2p::data::LocalLeaseSet2::KeySections keySections;
+			if (m_ECIESx25519EncryptionKey)
+				keySections.push_back ({m_ECIESx25519EncryptionKey->keyType, 32, m_ECIESx25519EncryptionKey->pub} );
+			if (m_StandardEncryptionKey)
+				keySections.push_back ({m_StandardEncryptionKey->keyType, (uint16_t)m_StandardEncryptionKey->decryptor->GetPublicKeyLen (), m_StandardEncryptionKey->pub} );

-			i2p::data::LocalLeaseSet2::EncryptionKeys keySections;
-			std::shared_ptr<const i2p::crypto::LocalEncryptionKey> preferredSection;
-			if (m_EncryptionKeys.size () == 1)
-				preferredSection = m_EncryptionKeys.begin ()->second; // only key
-			else
-			{	
-				for (const auto& it: m_EncryptionKeys)
-					if (it.first == m_PreferredCryptoType)
-						preferredSection = it.second;
-					else
-						keySections.push_back (it.second);
-			}	
-			if (preferredSection) 
-				keySections.push_front (preferredSection); // make preferred first
-			
-			auto publishedTimestamp = i2p::util::GetSecondsSinceEpoch ();
-			if (publishedTimestamp <= m_LastPublishedTimestamp)
-			{
-				LogPrint (eLogDebug, "Destination: LeaseSet update at the same second");
-				publishedTimestamp++; // force newer timestamp
-			}
 			bool isPublishedEncrypted = GetLeaseSetType () == i2p::data::NETDB_STORE_TYPE_ENCRYPTED_LEASESET2;
 			auto ls2 = std::make_shared<i2p::data::LocalLeaseSet2> (i2p::data::NETDB_STORE_TYPE_STANDARD_LEASESET2,
-				m_Keys, keySections, tunnels, IsPublic (), publishedTimestamp, isPublishedEncrypted);
+				m_Keys, keySections, tunnels, IsPublic (), isPublishedEncrypted);
 			if (isPublishedEncrypted) // encrypt if type 5
 				ls2 = std::make_shared<i2p::data::LocalEncryptedLeaseSet2> (ls2, m_Keys, GetAuthType (), m_AuthKeys);
 			leaseSet = ls2;
-			m_LastPublishedTimestamp = publishedTimestamp;
 		}
 		SetLeaseSet (leaseSet);
 	}
@ -1526,22 +1447,11 @@ namespace client

 	bool ClientDestination::Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const
 	{
-		std::shared_ptr<i2p::crypto::LocalEncryptionKey> encryptionKey;
-		if (!m_EncryptionKeys.empty ())
-		{
-			if (m_EncryptionKeys.rbegin ()->first == preferredCrypto)
-				encryptionKey = m_EncryptionKeys.rbegin ()->second;
-			else
-			{
-				auto it = m_EncryptionKeys.find (preferredCrypto);
-				if (it != m_EncryptionKeys.end ())
-					encryptionKey = it->second;
-			}	
-			if (!encryptionKey)
-				encryptionKey = m_EncryptionKeys.rbegin ()->second;
-		}	
-		if (encryptionKey)
-			return encryptionKey->decryptor->Decrypt (encrypted, data);
+		if (preferredCrypto == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
+			if (m_ECIESx25519EncryptionKey && m_ECIESx25519EncryptionKey->decryptor)
+				return m_ECIESx25519EncryptionKey->decryptor->Decrypt (encrypted, data);
+		if (m_StandardEncryptionKey && m_StandardEncryptionKey->decryptor)
+			return m_StandardEncryptionKey->decryptor->Decrypt (encrypted, data);
 		else
 			LogPrint (eLogError, "Destinations: Decryptor is not set");
 		return false;
@ -1549,26 +1459,14 @@ namespace client

 	bool ClientDestination::SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const
 	{
-#if __cplusplus >= 202002L // C++20
-		return m_EncryptionKeys.contains (keyType);
-#else		
-		return m_EncryptionKeys.count (keyType) > 0;
-#endif		
-	}
-
-	i2p::data::CryptoKeyType ClientDestination::GetRatchetsHighestCryptoType () const
-	{
-		if (m_EncryptionKeys.empty ()) return 0;
-		auto cryptoType = m_EncryptionKeys.rbegin ()->first; 
-		return cryptoType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? cryptoType : 0;
+		return keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? (bool)m_ECIESx25519EncryptionKey : (bool)m_StandardEncryptionKey;
 	}

 	const uint8_t * ClientDestination::GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const
 	{
-		auto it = m_EncryptionKeys.find (keyType);
-		if (it != m_EncryptionKeys.end ())
-			return it->second->pub.data ();
-		return nullptr;
+		if (keyType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
+			return m_ECIESx25519EncryptionKey ? m_ECIESx25519EncryptionKey->pub : nullptr;
+		return m_StandardEncryptionKey ? m_StandardEncryptionKey->pub : nullptr;
 	}

 	void ClientDestination::ReadAuthKey (const std::string& group, const std::map<std::string, std::string> * params)
@ -1602,8 +1500,6 @@ namespace client
 		RunnableService ("Destination"),
 		ClientDestination (GetIOService (), keys, isPublic, params)
 	{
-		if (!GetNickname ().empty ())
-			RunnableService::SetName (GetNickname ());
 	}

 	RunnableClientDestination::~RunnableClientDestination ()
--- a/libi2pd/Destination.h
+++ b/libi2pd/Destination.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -22,7 +22,6 @@
 #include "Identity.h"
 #include "TunnelPool.h"
 #include "Crypto.h"
-#include "CryptoKey.h"
 #include "LeaseSet.h"
 #include "Garlic.h"
 #include "NetDb.hpp"
@ -37,15 +36,13 @@ namespace client
 	const uint8_t PROTOCOL_TYPE_STREAMING = 6;
 	const uint8_t PROTOCOL_TYPE_DATAGRAM = 17;
 	const uint8_t PROTOCOL_TYPE_RAW = 18;
-	const int PUBLISH_CONFIRMATION_TIMEOUT = 1800; // in milliseconds
-	const int PUBLISH_VERIFICATION_TIMEOUT = 5; // in seconds after successful publish
-	const int PUBLISH_VERIFICATION_TIMEOUT_VARIANCE = 3; // in seconds
+	const int PUBLISH_CONFIRMATION_TIMEOUT = 5; // in seconds
+	const int PUBLISH_VERIFICATION_TIMEOUT = 10; // in seconds after successful publish
 	const int PUBLISH_MIN_INTERVAL = 20; // in seconds
 	const int PUBLISH_REGULAR_VERIFICATION_INTERNAL = 100; // in seconds periodically
-	const int LEASESET_REQUEST_TIMEOUT = 1600; // in milliseconds
-	const int MAX_LEASESET_REQUEST_TIMEOUT = 12000; // in milliseconds
-	const int DESTINATION_CLEANUP_TIMEOUT = 44; // in seconds
-	const int DESTINATION_CLEANUP_TIMEOUT_VARIANCE = 30; // in seconds
+	const int LEASESET_REQUEST_TIMEOUT = 5; // in seconds
+	const int MAX_LEASESET_REQUEST_TIMEOUT = 40; // in seconds
+	const int DESTINATION_CLEANUP_TIMEOUT = 3; // in minutes
 	const unsigned int MAX_NUM_FLOODFILLS_PER_REQUEST = 7;

 	// I2CP
@ -89,16 +86,8 @@ namespace client
 	const int DEFAULT_INITIAL_ACK_DELAY = 200; // milliseconds
 	const char I2CP_PARAM_STREAMING_MAX_OUTBOUND_SPEED[] = "i2p.streaming.maxOutboundSpeed"; // bytes/sec
 	const int DEFAULT_MAX_OUTBOUND_SPEED = 1730000000; // no more than 1.73 Gbytes/s
-	const char I2CP_PARAM_STREAMING_MAX_INBOUND_SPEED[] = "i2p.streaming.maxInboundSpeed"; // bytes/sec
-	const int DEFAULT_MAX_INBOUND_SPEED = 1730000000; // no more than 1.73 Gbytes/s
 	const char I2CP_PARAM_STREAMING_ANSWER_PINGS[] = "i2p.streaming.answerPings";
 	const int DEFAULT_ANSWER_PINGS = true;
-	const char I2CP_PARAM_STREAMING_PROFILE[] = "i2p.streaming.profile";
-	const int STREAMING_PROFILE_BULK = 1; // high bandwidth
-	const int STREAMING_PROFILE_INTERACTIVE = 2; // low bandwidth
-	const int DEFAULT_STREAMING_PROFILE = STREAMING_PROFILE_BULK;
-	const char I2CP_PARAM_STREAMING_MAX_CONCURRENT_STREAMS[] = "i2p.streaming.maxConcurrentStreams";
-	const int DEFAULT_MAX_CONCURRENT_STREAMS = 2048;

 	typedef std::function<void (std::shared_ptr<i2p::stream::Stream> stream)> StreamRequestComplete;

@ -109,7 +98,7 @@ namespace client
 		// leaseSet = nullptr means not found
 		struct LeaseSetRequest
 		{
-			LeaseSetRequest (boost::asio::io_context& service): requestTime (0), requestTimeoutTimer (service) {};
+			LeaseSetRequest (boost::asio::io_service& service): requestTime (0), requestTimeoutTimer (service) {};
 			std::unordered_set<i2p::data::IdentHash> excluded;
 			uint64_t requestTime;
 			boost::asio::deadline_timer requestTimeoutTimer;
@ -127,10 +116,10 @@ namespace client

 		public:

-			LeaseSetDestination (boost::asio::io_context& service, bool isPublic, const std::map<std::string, std::string> * params = nullptr);
+			LeaseSetDestination (boost::asio::io_service& service, bool isPublic, const std::map<std::string, std::string> * params = nullptr);
 			~LeaseSetDestination ();
 			const std::string& GetNickname () const { return m_Nickname; };
-			auto& GetService () { return m_Service; };
+			boost::asio::io_service& GetService () { return m_Service; };

 			virtual void Start ();
 			virtual void Stop ();
@ -147,15 +136,15 @@ namespace client
 			void CancelDestinationRequestWithEncryptedLeaseSet (std::shared_ptr<const i2p::data::BlindedPublicKey> dest, bool notify = true);

 			// implements GarlicDestination
-			std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet () override;
-			std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const override { return m_Pool; }
+			std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet ();
+			std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const { return m_Pool; }

 			// override GarlicDestination
-			bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag) override;
-			void SubmitECIESx25519Key (const uint8_t * key, uint64_t tag) override;
-			void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg) override;
-			void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg) override;
-			void SetLeaseSetUpdated (bool post) override;
+			bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag);
+			void SubmitECIESx25519Key (const uint8_t * key, uint64_t tag);
+			void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg);
+			void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg);
+			void SetLeaseSetUpdated ();

 			bool IsPublic () const { return m_IsPublic; };
 			void SetPublic (bool pub) { m_IsPublic = pub; };
@ -163,16 +152,14 @@ namespace client
 		protected:

 			// implements GarlicDestination
-			void HandleI2NPMessage (const uint8_t * buf, size_t len) override;
-			bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, 
-				size_t len, uint32_t msgID, i2p::garlic::ECIESX25519AEADRatchetSession * from) override;
+			void HandleI2NPMessage (const uint8_t * buf, size_t len);
+			bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID);

 			void SetLeaseSet (std::shared_ptr<const i2p::data::LocalLeaseSet> newLeaseSet);
 			int GetLeaseSetType () const { return m_LeaseSetType; };
 			void SetLeaseSetType (int leaseSetType) { m_LeaseSetType = leaseSetType; };
 			int GetAuthType () const { return m_AuthType; };
 			virtual void CleanupDestination () {}; // additional clean up in derived classes
-			virtual i2p::data::CryptoKeyType GetPreferredCryptoType () const = 0;
 			// I2CP
 			virtual void HandleDataMessage (const uint8_t * buf, size_t len) = 0;
 			virtual void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels) = 0;
@ -185,7 +172,7 @@ namespace client
 			void HandlePublishConfirmationTimer (const boost::system::error_code& ecode);
 			void HandlePublishVerificationTimer (const boost::system::error_code& ecode);
 			void HandlePublishDelayTimer (const boost::system::error_code& ecode);
-			void HandleDatabaseStoreMessage (const uint8_t * buf, size_t len, i2p::garlic::ECIESX25519AEADRatchetSession * from);
+			void HandleDatabaseStoreMessage (const uint8_t * buf, size_t len);
 			void HandleDatabaseSearchReplyMessage (const uint8_t * buf, size_t len);
 			void HandleDeliveryStatusMessage (uint32_t msgID);

@ -195,17 +182,15 @@ namespace client
 			void HandleRequestTimoutTimer (const boost::system::error_code& ecode, const i2p::data::IdentHash& dest);
 			void HandleCleanupTimer (const boost::system::error_code& ecode);
 			void CleanupRemoteLeaseSets ();
+			i2p::data::CryptoKeyType GetPreferredCryptoType () const;

 		private:

-			boost::asio::io_context& m_Service;
+			boost::asio::io_service& m_Service;
 			mutable std::mutex m_RemoteLeaseSetsMutex;
 			std::unordered_map<i2p::data::IdentHash, std::shared_ptr<i2p::data::LeaseSet> > m_RemoteLeaseSets;
 			std::unordered_map<i2p::data::IdentHash, std::shared_ptr<LeaseSetRequest> > m_LeaseSetRequests;

-			std::list<std::shared_ptr<I2NPMessage> > m_IncomingMsgsQueue;
-			mutable std::mutex m_IncomingMsgsQueueMutex;
-			
 			std::shared_ptr<i2p::tunnel::TunnelPool> m_Pool;
 			std::mutex m_LeaseSetMutex;
 			std::shared_ptr<const i2p::data::LocalLeaseSet> m_LeaseSet;
@ -231,14 +216,25 @@ namespace client

 	class ClientDestination: public LeaseSetDestination
 	{
+		struct EncryptionKey
+		{
+			uint8_t pub[256], priv[256];
+			i2p::data::CryptoKeyType keyType;
+			std::shared_ptr<i2p::crypto::CryptoKeyDecryptor> decryptor;
+
+			EncryptionKey (i2p::data::CryptoKeyType t):keyType(t) { memset (pub, 0, 256); memset (priv, 0, 256);	};
+			void GenerateKeys () { i2p::data::PrivateKeys::GenerateCryptoKeyPair (keyType, priv, pub); };
+			void CreateDecryptor () { decryptor = i2p::data::PrivateKeys::CreateDecryptor (keyType, priv); };
+		};
+
 		public:

-			ClientDestination (boost::asio::io_context& service, const i2p::data::PrivateKeys& keys,
+			ClientDestination (boost::asio::io_service& service, const i2p::data::PrivateKeys& keys,
 				bool isPublic, const std::map<std::string, std::string> * params = nullptr);
 			~ClientDestination ();

-			void Start () override;
-			void Stop () override;
+			void Start ();
+			void Stop ();

 			const i2p::data::PrivateKeys& GetPrivateKeys () const { return m_Keys; };
 			void Sign (const uint8_t * buf, int len, uint8_t * signature) const { m_Keys.Sign (buf, len, signature); };
@ -266,8 +262,6 @@ namespace client
 			void AcceptOnce (const i2p::stream::StreamingDestination::Acceptor& acceptor);
 			int GetStreamingAckDelay () const { return m_StreamingAckDelay; }
 			int GetStreamingOutboundSpeed () const { return m_StreamingOutboundSpeed; }
-			int GetStreamingInboundSpeed () const { return m_StreamingInboundSpeed; }
-			int GetStreamingMaxConcurrentStreams () const { return m_StreamingMaxConcurrentStreams; }
 			bool IsStreamingAnswerPings () const { return m_IsStreamingAnswerPings; }

 			// datagram
@ -275,28 +269,24 @@ namespace client
 			i2p::datagram::DatagramDestination * CreateDatagramDestination (bool gzip = true);

 			// implements LocalDestination
-			bool Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const override;
-			std::shared_ptr<const i2p::data::IdentityEx> GetIdentity () const override { return m_Keys.GetPublic (); };
-			bool SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const override;
-			const uint8_t * GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const override;
+			bool Decrypt (const uint8_t * encrypted, uint8_t * data, i2p::data::CryptoKeyType preferredCrypto) const;
+			std::shared_ptr<const i2p::data::IdentityEx> GetIdentity () const { return m_Keys.GetPublic (); };
+			bool SupportsEncryptionType (i2p::data::CryptoKeyType keyType) const;
+			const uint8_t * GetEncryptionPublicKey (i2p::data::CryptoKeyType keyType) const;

 		protected:

-			// GarlicDestionation
-			i2p::data::CryptoKeyType GetRatchetsHighestCryptoType () const override;
-			// LeaseSetDestination
-			void CleanupDestination () override;
-			i2p::data::CryptoKeyType GetPreferredCryptoType () const override { return m_PreferredCryptoType; }
+			void CleanupDestination ();
 			// I2CP
-			void HandleDataMessage (const uint8_t * buf, size_t len) override;
-			void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels) override;
+			void HandleDataMessage (const uint8_t * buf, size_t len);
+			void CreateNewLeaseSet (const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels);

 		private:

 			std::shared_ptr<ClientDestination> GetSharedFromThis () {
 				return std::static_pointer_cast<ClientDestination>(shared_from_this ());
 			}
-			void PersistTemporaryKeys (std::shared_ptr<i2p::crypto::LocalEncryptionKey> keys);
+			void PersistTemporaryKeys (EncryptionKey * keys, bool isSingleKey);
 			void ReadAuthKey (const std::string& group, const std::map<std::string, std::string> * params);

 			template<typename Dest>
@ -305,17 +295,17 @@ namespace client
 		private:

 			i2p::data::PrivateKeys m_Keys;
-			std::map<i2p::data::CryptoKeyType, std::shared_ptr<i2p::crypto::LocalEncryptionKey> > m_EncryptionKeys; // last is most preferable
-			i2p::data::CryptoKeyType m_PreferredCryptoType;
+			std::unique_ptr<EncryptionKey> m_StandardEncryptionKey;
+			std::unique_ptr<EncryptionKey> m_ECIESx25519EncryptionKey;

-			int m_StreamingAckDelay,m_StreamingOutboundSpeed, m_StreamingInboundSpeed, m_StreamingMaxConcurrentStreams;
+			int m_StreamingAckDelay;
+			int m_StreamingOutboundSpeed;
 			bool m_IsStreamingAnswerPings;
 			std::shared_ptr<i2p::stream::StreamingDestination> m_StreamingDestination; // default
 			std::map<uint16_t, std::shared_ptr<i2p::stream::StreamingDestination> > m_StreamingDestinationsByPorts;
 			std::shared_ptr<i2p::stream::StreamingDestination> m_LastStreamingDestination; uint16_t m_LastPort; // for server tunnels
 			i2p::datagram::DatagramDestination * m_DatagramDestination;
 			int m_RefCounter; // how many clients(tunnels) use this destination
-			uint64_t m_LastPublishedTimestamp;

 			boost::asio::deadline_timer m_ReadyChecker;

--- a/libi2pd/ECIESX25519AEADRatchetSession.cpp
+++ b/libi2pd/ECIESX25519AEADRatchetSession.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,7 +11,6 @@
 #include "Log.h"
 #include "util.h"
 #include "Crypto.h"
-#include "PostQuantum.h"
 #include "Elligator.h"
 #include "Tag.h"
 #include "I2PEndian.h"
@ -95,17 +94,6 @@ namespace garlic
 		m_ItermediateSymmKeys.erase (index);
 	}

-	ReceiveRatchetTagSet::ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS):
-		m_Session (session), m_IsNS (isNS) 
-	{
-	}
-		
-	ReceiveRatchetTagSet::~ReceiveRatchetTagSet ()
-	{
-		if (m_IsNS && m_Session)
-			m_Session->CleanupReceiveNSRKeys ();
-	}	
-	
 	void ReceiveRatchetTagSet::Expire ()
 	{
 		if (!m_ExpirationTimestamp)
@ -174,12 +162,12 @@ namespace garlic
 			return false;
 		}
 		if (m_Destination)
-			m_Destination->HandleECIESx25519GarlicClove (buf + offset, size, nullptr);
+			m_Destination->HandleECIESx25519GarlicClove (buf + offset, size);
 		return true;
 	}

 	ECIESX25519AEADRatchetSession::ECIESX25519AEADRatchetSession (GarlicDestination * owner, bool attachLeaseSetNS):
-		GarlicRoutingSession (owner, true), m_RemoteStaticKeyType (0)
+		GarlicRoutingSession (owner, true)
 	{
 		if (!attachLeaseSetNS) SetLeaseSetUpdateStatus (eLeaseSetUpToDate);
 		RAND_bytes (m_PaddingSizes, 32); m_NextPaddingSize = 0;
@ -241,42 +229,12 @@ namespace garlic
 		tagsetNsr->NextSessionTagRatchet ();
 	}

-	bool ECIESX25519AEADRatchetSession::MessageConfirmed (uint32_t msgID)
-	{
-		auto ret = GarlicRoutingSession::MessageConfirmed (msgID); // LeaseSet
-		if (m_AckRequestMsgID && m_AckRequestMsgID == msgID)
-		{
-			m_AckRequestMsgID = 0;
-			m_AckRequestNumAttempts = 0;
-			ret = true;
-		}	
-		return ret;
-	}	
-
-	bool ECIESX25519AEADRatchetSession::CleanupUnconfirmedTags ()
-	{
-		if (m_AckRequestMsgID && m_AckRequestNumAttempts > ECIESX25519_ACK_REQUEST_MAX_NUM_ATTEMPTS)
-		{
-			m_AckRequestMsgID = 0;
-			m_AckRequestNumAttempts = 0;
-			return true;	
-		}
-		return false;
-	}	
-
-	void ECIESX25519AEADRatchetSession::CleanupReceiveNSRKeys ()
-	{
-		m_EphemeralKeys = nullptr;
-#if OPENSSL_PQ
-		m_PQKeys = nullptr;
-#endif	
-	}	
-		
 	bool ECIESX25519AEADRatchetSession::HandleNewIncomingSession (const uint8_t * buf, size_t len)
 	{
 		if (!GetOwner ()) return false;
 		// we are Bob
 		// KDF1
+		i2p::crypto::InitNoiseIKState (GetNoiseState (), GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)); // bpk

 		if (!i2p::crypto::GetElligator ()->Decode (buf, m_Aepk))
 		{
@ -284,61 +242,20 @@ namespace garlic
 			return false;
 		}
 		buf += 32; len -= 32;
+		MixHash (m_Aepk, 32); // h = SHA256(h || aepk)

 		uint8_t sharedSecret[32];
-		bool decrypted = false;
-		auto cryptoType = GetOwner ()->GetRatchetsHighestCryptoType ();
-#if OPENSSL_PQ
-		if (cryptoType > i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) // we support post quantum
-		{
-			i2p::crypto::InitNoiseIKStateMLKEM (GetNoiseState (), cryptoType, GetOwner ()->GetEncryptionPublicKey (cryptoType)); // bpk
-			MixHash (m_Aepk, 32); // h = SHA256(h || aepk)
-
-			if (GetOwner ()->Decrypt (m_Aepk, sharedSecret, cryptoType)) // x25519(bsk, aepk)
-			{
-				MixKey (sharedSecret);
-
-				auto keyLen = i2p::crypto::GetMLKEMPublicKeyLen (cryptoType);
-				std::vector<uint8_t> encapsKey(keyLen);
-				if (Decrypt (buf, encapsKey.data (), keyLen))
-				{
-					decrypted = true; // encaps section has right hash 
-					MixHash (buf, keyLen + 16);
-					buf += keyLen + 16;
-					len -= keyLen + 16;
-					
-					m_PQKeys = i2p::crypto::CreateMLKEMKeys (cryptoType);
-					m_PQKeys->SetPublicKey (encapsKey.data ());
-				}
-			}	
-		}	
-#endif
-		if (!decrypted)
-		{	
-			if (cryptoType == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
-			    GetOwner ()->SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
-			{
-				cryptoType = i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD;
-				i2p::crypto::InitNoiseIKState (GetNoiseState (), GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)); // bpk
-				MixHash (m_Aepk, 32); // h = SHA256(h || aepk)
-
 		if (!GetOwner ()->Decrypt (m_Aepk, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)) // x25519(bsk, aepk)
 		{
 			LogPrint (eLogWarning, "Garlic: Incorrect Alice ephemeral key");
 			return false;
 		}
 		MixKey (sharedSecret);
-			}	
-			else
-			{
-				LogPrint (eLogWarning, "Garlic: No supported encryption type");
-				return false;
-			}	
-		}	

 		// decrypt flags/static
-		uint8_t fs[32];
-		if (!Decrypt (buf, fs, 32))
+		uint8_t nonce[12], fs[32];
+		CreateNonce (0, nonce);
+		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 32, m_H, 32, m_CK + 32, nonce, fs, 32, false)) // decrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Flags/static section AEAD verification failed ");
 			return false;
@ -351,18 +268,20 @@ namespace garlic
 		if (isStatic)
 		{
 			// static key, fs is apk
-			SetRemoteStaticKey (cryptoType, fs); 
-			if (!GetOwner ()->Decrypt (fs, sharedSecret, m_RemoteStaticKeyType)) // x25519(bsk, apk)
+			memcpy (m_RemoteStaticKey, fs, 32);
+			if (!GetOwner ()->Decrypt (fs, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)) // x25519(bsk, apk)
 			{
 				LogPrint (eLogWarning, "Garlic: Incorrect Alice static key");
 				return false;
 			}
 			MixKey (sharedSecret);
 		}
+		else // all zeros flags
+			CreateNonce (1, nonce);

 		// decrypt payload
 		std::vector<uint8_t> payload (len - 16); // we must save original ciphertext
-		if (!Decrypt (buf, payload.data (), len - 16))
+		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, m_H, 32, m_CK + 32, nonce, payload.data (), len - 16, false)) // decrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD verification failed");
 			return false;
@ -398,7 +317,7 @@ namespace garlic
 			{
 				case eECIESx25519BlkGalicClove:
 					if (GetOwner ())
-						GetOwner ()->HandleECIESx25519GarlicClove (buf + offset, size, this);
+						GetOwner ()->HandleECIESx25519GarlicClove (buf + offset, size);
 				break;
 				case eECIESx25519BlkNextKey:
 					LogPrint (eLogDebug, "Garlic: Next key");
@ -416,7 +335,7 @@ namespace garlic
 					{
 						uint32_t tagsetid = bufbe16toh (buf + offset1); offset1 += 2; // tagsetid
 						uint16_t n = bufbe16toh (buf + offset1); offset1 += 2; // N
-						MessageConfirmed ((tagsetid << 16) + n); // msgid = (tagsetid << 16) + N
+						MessageConfirmed ((tagsetid << 16) + n); // msgid
 					}
 					break;
 				}
@ -479,6 +398,7 @@ namespace garlic
 		{
 			uint16_t keyID = bufbe16toh (buf); buf += 2; // keyID
 			bool newKey = flag & ECIESX25519_NEXT_KEY_REQUEST_REVERSE_KEY_FLAG;
+			m_SendReverseKey = true;
 			if (!m_NextReceiveRatchet)
 				m_NextReceiveRatchet.reset (new DHRatchet ());
 			else
@ -490,14 +410,15 @@ namespace garlic
 				}
 				m_NextReceiveRatchet->keyID = keyID;
 			}
+			int tagsetID = 2*keyID;
 			if (newKey)
 			{
 				m_NextReceiveRatchet->key = i2p::transport::transports.GetNextX25519KeysPair ();
 				m_NextReceiveRatchet->newKey = true;
+				tagsetID++;
 			}
 			else
 				m_NextReceiveRatchet->newKey = false;
-			auto tagsetID = m_NextReceiveRatchet->GetReceiveTagSetID ();
 			if (flag & ECIESX25519_NEXT_KEY_KEY_PRESENT_FLAG)
 				memcpy (m_NextReceiveRatchet->remote, buf, 32);

@ -511,9 +432,7 @@ namespace garlic
 			GenerateMoreReceiveTags (newTagset, (GetOwner () && GetOwner ()->GetNumRatchetInboundTags () > 0) ?
 				GetOwner ()->GetNumRatchetInboundTags () : ECIESX25519_MAX_NUM_GENERATED_TAGS);
 			receiveTagset->Expire ();
-			
 			LogPrint (eLogDebug, "Garlic: Next receive tagset ", tagsetID, " created");
-			m_SendReverseKey = true;
 		}
 	}

@ -550,15 +469,6 @@ namespace garlic
 		offset += 32;

 		// KDF1
-#if OPENSSL_PQ		
-		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-		{
-			i2p::crypto::InitNoiseIKStateMLKEM (GetNoiseState (), m_RemoteStaticKeyType, m_RemoteStaticKey); // bpk
-			m_PQKeys = i2p::crypto::CreateMLKEMKeys (m_RemoteStaticKeyType);
-			m_PQKeys->GenerateKeys ();
-		}	
-		else	
-#endif			
 		i2p::crypto::InitNoiseIKState (GetNoiseState (), m_RemoteStaticKey); // bpk
 		MixHash (m_EphemeralKeys->GetPublicKey (), 32); // h = SHA256(h || aepk)
 		uint8_t sharedSecret[32];
@ -568,32 +478,18 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
-#if OPENSSL_PQ
-		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-		{
-			auto keyLen = i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType);
-			std::vector<uint8_t> encapsKey(keyLen);
-			m_PQKeys->GetPublicKey (encapsKey.data ());
-			// encrypt encapsKey 
-			if (!Encrypt (encapsKey.data (), out + offset, keyLen))
-			{
-				LogPrint (eLogWarning, "Garlic: ML-KEM encap_key section AEAD encryption failed ");
-				return false;
-			}
-			MixHash (out + offset, keyLen + 16); // h = SHA256(h || ciphertext)
-			offset += keyLen + 16;
-		}	
-#endif		
 		// encrypt flags/static key section
+		uint8_t nonce[12];
+		CreateNonce (0, nonce);
 		const uint8_t * fs;
 		if (isStatic)
-			fs = GetOwner ()->GetEncryptionPublicKey (m_RemoteStaticKeyType);
+			fs = GetOwner ()->GetEncryptionPublicKey (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD);
 		else
 		{
 			memset (out + offset, 0, 32); // all zeros flags section
 			fs = out + offset;
 		}
-		if (!Encrypt (fs, out + offset, 32)) 
+		if (!i2p::crypto::AEADChaCha20Poly1305 (fs, 32, m_H, 32, m_CK + 32, nonce, out + offset, 48, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Flags/static section AEAD encryption failed ");
 			return false;
@ -604,11 +500,13 @@ namespace garlic
 		// KDF2
 		if (isStatic)
 		{
-			GetOwner ()->Decrypt (m_RemoteStaticKey, sharedSecret, m_RemoteStaticKeyType); // x25519 (ask, bpk)
+			GetOwner ()->Decrypt (m_RemoteStaticKey, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD); // x25519 (ask, bpk)
 			MixKey (sharedSecret);
 		}
+		else
+			CreateNonce (1, nonce);
 		// encrypt payload
-		if (!Encrypt (payload, out + offset, len))
+		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_CK + 32, nonce, out + offset, len + 16, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD encryption failed");
 			return false;
@ -657,33 +555,16 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
-#if OPENSSL_PQ
-		if (m_PQKeys)
-		{
-			size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
-			std::vector<uint8_t> kemCiphertext(cipherTextLen);
-			m_PQKeys->Encaps (kemCiphertext.data (), sharedSecret);
-			
-			if (!Encrypt (kemCiphertext.data (), out + offset, cipherTextLen))
-			{
-				LogPrint (eLogWarning, "Garlic: NSR ML-KEM ciphertext section AEAD encryption failed");
-				return false;
-			}
-			m_NSREncodedPQKey = std::make_unique<std::vector<uint8_t> > (cipherTextLen + 16);
-			memcpy (m_NSREncodedPQKey->data (), out + offset, cipherTextLen + 16);
-			MixHash (out + offset, cipherTextLen + 16);
-			MixKey (sharedSecret);
-			offset += cipherTextLen + 16;
-		}	
-#endif		
 		if (!m_EphemeralKeys->Agree (m_RemoteStaticKey, sharedSecret)) // sharedSecret = x25519(besk, apk)
 		{
 			LogPrint (eLogWarning, "Garlic: Incorrect Alice static key");
 			return false;
 		}
 		MixKey (sharedSecret);
+		uint8_t nonce[12];
+		CreateNonce (0, nonce);
 		// calculate hash for zero length
-		if (!Encrypt (sharedSecret /* can be anything */, out + offset, 0)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
+		if (!i2p::crypto::AEADChaCha20Poly1305 (nonce /* can be anything */, 0, m_H, 32, m_CK + 32, nonce, out + offset, 16, true)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD encryption failed");
 			return false;
@ -704,7 +585,6 @@ namespace garlic
 			GetOwner ()->GetNumRatchetInboundTags () : ECIESX25519_MIN_NUM_GENERATED_TAGS);
 		i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", m_NSRKey, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32)
 		// encrypt payload
-		uint8_t nonce[12]; memset (nonce, 0, 12); // seqn = 0
 		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + offset, len + 16, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: NSR payload section AEAD encryption failed");
@ -726,34 +606,16 @@ namespace garlic
 		memcpy (m_H, m_NSRH, 32);
 		MixHash ((const uint8_t *)&tag, 8); // h = SHA256(h || tag)
 		MixHash (m_EphemeralKeys->GetPublicKey (), 32); // h = SHA256(h || bepk)
-		m_N = 0;
-		size_t offset = 40;
-#if OPENSSL_PQ		
-		if (m_PQKeys)
-		{	
-			if (m_NSREncodedPQKey)
-			{	
-				size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
-				memcpy (out + offset, m_NSREncodedPQKey->data (), cipherTextLen + 16);
-				MixHash (out + offset, cipherTextLen + 16);
-				offset += cipherTextLen + 16;
-			}
-			else
-			{
-				LogPrint (eLogWarning, "Garlic: No stored ML-KEM keys");
-				return false;
-			}
-		}
-#endif
-		if (!Encrypt (m_NSRH /* can be anything */, out + offset, 0)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
+		uint8_t nonce[12];
+		CreateNonce (0, nonce);
+		if (!i2p::crypto::AEADChaCha20Poly1305 (nonce /* can be anything */, 0, m_H, 32, m_CK + 32, nonce, out + 40, 16, true)) // encrypt, ciphertext = ENCRYPT(k, n, ZEROLEN, ad)
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD encryption failed");
 			return false;
 		}
-		MixHash (out + offset, 16); // h = SHA256(h || ciphertext)
+		MixHash (out + 40, 16); // h = SHA256(h || ciphertext)
 		// encrypt payload
-		uint8_t nonce[12]; memset (nonce, 0, 12);
-		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + offset + 16, len + 16, true)) // encrypt
+		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, m_H, 32, m_NSRKey, nonce, out + 56, len + 16, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Next NSR payload section AEAD encryption failed");
 			return false;
@ -785,30 +647,13 @@ namespace garlic
 			return false;
 		}
 		MixKey (sharedSecret);
-#if OPENSSL_PQ
-		if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-		{
-			// decrypt kem_ciphertext section
-			size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
-			std::vector<uint8_t> kemCiphertext(cipherTextLen);
-			if (!Decrypt (buf, kemCiphertext.data (), cipherTextLen))
-			{
-				LogPrint (eLogWarning, "Garlic: Reply ML-KEM ciphertext section AEAD decryption failed");
-				return false;
-			}
-			MixHash (buf, cipherTextLen + 16);
-			buf += cipherTextLen + 16;
-			len -= cipherTextLen + 16;
-			// decaps
-			m_PQKeys->Decaps (kemCiphertext.data (), sharedSecret);
-			MixKey (sharedSecret);
-		}
-#endif	
-		GetOwner ()->Decrypt (bepk, sharedSecret, m_RemoteStaticKeyType); // x25519 (ask, bepk)
+		GetOwner ()->Decrypt (bepk, sharedSecret, i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD); // x25519 (ask, bepk)
 		MixKey (sharedSecret);

+		uint8_t nonce[12];
+		CreateNonce (0, nonce);
 		// calculate hash for zero length
-		if (!Decrypt (buf, sharedSecret/* can be anything */, 0)) // decrypt, DECRYPT(k, n, ZEROLEN, ad) verification only
+		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, 0, m_H, 32, m_CK + 32, nonce, sharedSecret/* can be anything */, 0, false)) // decrypt, DECRYPT(k, n, ZEROLEN, ad) verification only
 		{
 			LogPrint (eLogWarning, "Garlic: Reply key section AEAD decryption failed");
 			return false;
@ -833,7 +678,6 @@ namespace garlic
 		}
 		i2p::crypto::HKDF (keydata + 32, nullptr, 0, "AttachPayloadKDF", keydata, 32); // k = HKDF(k_ba, ZEROLEN, "AttachPayloadKDF", 32)
 		// decrypt payload
-		uint8_t nonce[12]; memset (nonce, 0, 12); // seqn = 0
 		if (!i2p::crypto::AEADChaCha20Poly1305 (buf, len - 16, m_H, 32, keydata, nonce, buf, len - 16, false)) // decrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD decryption failed");
@ -843,8 +687,7 @@ namespace garlic
 		if (m_State == eSessionStateNewSessionSent)
 		{
 			m_State = eSessionStateEstablished;
-			// don't delete m_EpehemralKey and m_PQKeys because delayd NSR's migth come
-			// done in CleanupReceiveNSRKeys called from NSR tagset destructor		
+			//m_EphemeralKeys = nullptr; // TODO: delete after a while
 			m_SessionCreatedTimestamp = i2p::util::GetSecondsSinceEpoch ();
 			GetOwner ()->AddECIESx25519Session (m_RemoteStaticKey, shared_from_this ());
 		}
@ -859,8 +702,6 @@ namespace garlic

 	bool ECIESX25519AEADRatchetSession::NewExistingSessionMessage (const uint8_t * payload, size_t len, uint8_t * out, size_t outLen)
 	{
-		auto owner = GetOwner ();
-		if (!owner) return false;
 		uint8_t nonce[12];
 		auto index = m_SendTagset->GetNextIndex ();
 		CreateNonce (index, nonce); // tag's index
@ -868,7 +709,8 @@ namespace garlic
 		if (!tag)
 		{
 			LogPrint (eLogError, "Garlic: Can't create new ECIES-X25519-AEAD-Ratchet tag for send tagset");
-			owner->RemoveECIESx25519Session (m_RemoteStaticKey);
+			if (GetOwner ())
+				GetOwner ()->RemoveECIESx25519Session (m_RemoteStaticKey);
 			return false;
 		}
 		memcpy (out, &tag, 8);
@ -876,7 +718,7 @@ namespace garlic
 		// ciphertext = ENCRYPT(k, n, payload, ad)
 		uint8_t key[32];
 		m_SendTagset->GetSymmKey (index, key);
-		if (!owner->AEADChaCha20Poly1305Encrypt (payload, len, out, 8, key, nonce, out + 8, outLen - 8))
+		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len, out, 8, key, nonce, out + 8, outLen - 8, true)) // encrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD encryption failed");
 			return false;
@ -895,27 +737,24 @@ namespace garlic
 		uint8_t * payload = buf + 8;
 		uint8_t key[32];
 		receiveTagset->GetSymmKey (index, key);
-		auto owner = GetOwner ();
-		if (!owner) return true; // drop message
-		
-		if (!owner->AEADChaCha20Poly1305Decrypt (payload, len - 16, buf, 8, key, nonce, payload, len - 16))
+		if (!i2p::crypto::AEADChaCha20Poly1305 (payload, len - 16, buf, 8, key, nonce, payload, len - 16, false)) // decrypt
 		{
 			LogPrint (eLogWarning, "Garlic: Payload section AEAD decryption failed");
 			return false;
 		}
 		HandlePayload (payload, len - 16, receiveTagset, index);
-		
-		int moreTags = 0;
-		if (owner->GetNumRatchetInboundTags () > 0) // override in settings?
+		if (GetOwner ())
 		{
-			if (receiveTagset->GetNextIndex () - index < owner->GetNumRatchetInboundTags ()/2)
-				moreTags = owner->GetNumRatchetInboundTags ();
-			index -= owner->GetNumRatchetInboundTags (); // trim behind
+			int moreTags = 0;
+			if (GetOwner ()->GetNumRatchetInboundTags () > 0) // override in settings?
+			{
+				if (receiveTagset->GetNextIndex () - index < GetOwner ()->GetNumRatchetInboundTags ()/2)
+					moreTags = GetOwner ()->GetNumRatchetInboundTags ();
+				index -= GetOwner ()->GetNumRatchetInboundTags (); // trim behind
 			}
 			else
 			{
-			moreTags = (receiveTagset->GetTagSetID () > 0) ? ECIESX25519_MAX_NUM_GENERATED_TAGS : // for non first tagset
-				(ECIESX25519_MIN_NUM_GENERATED_TAGS + (index >> 1)); // N/2
+				moreTags = ECIESX25519_MIN_NUM_GENERATED_TAGS + (index >> 2); // N/4
 				if (moreTags > ECIESX25519_MAX_NUM_GENERATED_TAGS) moreTags = ECIESX25519_MAX_NUM_GENERATED_TAGS;
 				moreTags -= (receiveTagset->GetNextIndex () - index);
 				index -= ECIESX25519_MAX_NUM_GENERATED_TAGS; // trim behind
@ -924,6 +763,7 @@ namespace garlic
 				GenerateMoreReceiveTags (receiveTagset, moreTags);
 			if (index > 0)
 				receiveTagset->SetTrimBehind (index);
+		}
 		return true;
 	}

@ -937,14 +777,10 @@ namespace garlic
 				m_State = eSessionStateEstablished;
 				m_NSRSendTagset = nullptr;
 				m_EphemeralKeys = nullptr;
-#if OPENSSL_PQ
-				m_PQKeys = nullptr;
-				m_NSREncodedPQKey = nullptr;
-#endif				
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
+#endif
 			case eSessionStateEstablished:
-				if (m_SendReverseKey && receiveTagset->GetTagSetID () == m_NextReceiveRatchet->GetReceiveTagSetID ())
-					m_SendReverseKey = false; // tag received on new tagset	
 				if (receiveTagset->IsNS ())
 				{
 					// our of sequence NSR
@ -971,12 +807,7 @@ namespace garlic
 		if (!payload) return nullptr;
 		size_t len = CreatePayload (msg, m_State != eSessionStateEstablished, payload);
 		if (!len) return nullptr;
-#if OPENSSL_PQ
-		auto m = NewI2NPMessage (len + (m_State == eSessionStateEstablished ? 28 :
-			i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType) + 116));
-#else		
 		auto m = NewI2NPMessage (len + 100); // 96 + 4
-#endif		
 		m->Align (12); // in order to get buf aligned to 16 (12 + 4)
 		uint8_t * buf = m->GetPayload () + 4; // 4 bytes for length

@ -991,28 +822,16 @@ namespace garlic
 				if (!NewOutgoingSessionMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 96;
-#if OPENSSL_PQ
-				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-					len += i2p::crypto::GetMLKEMPublicKeyLen (m_RemoteStaticKeyType) + 16;
-#endif				
 			break;
 			case eSessionStateNewSessionReceived:
 				if (!NewSessionReplyMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 72;
-#if OPENSSL_PQ
-				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-					len += i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType) + 16;
-#endif				
 			break;
 			case eSessionStateNewSessionReplySent:
 				if (!NextNewSessionReplyMessage (payload, len, buf, m->maxLen))
 					return nullptr;
 				len += 72;
-#if OPENSSL_PQ
-				if (m_RemoteStaticKeyType >= i2p::data::CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD)
-					len += i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType) + 16;
-#endif				
 			break;
 			case eSessionStateOneTime:
 				if (!NewOutgoingSessionMessage (payload, len, buf, m->maxLen, false))
@ -1039,7 +858,6 @@ namespace garlic
 	{
 		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
 		size_t payloadLen = 0;
-		bool sendAckRequest = false;
 		if (first) payloadLen += 7;// datatime
 		if (msg)
 		{
@ -1058,28 +876,13 @@ namespace garlic
 			payloadLen += leaseSet->GetBufferLen () + DATABASE_STORE_HEADER_SIZE + 13;
 			if (!first)
 			{
-				// ack request for LeaseSet
-				m_AckRequestMsgID = m_SendTagset->GetMsgID ();
-				sendAckRequest = true;
-				// update LeaseSet status
+				// ack request
 				SetLeaseSetUpdateStatus (eLeaseSetSubmitted);
-				SetLeaseSetUpdateMsgID (m_AckRequestMsgID);
+				SetLeaseSetUpdateMsgID ((m_SendTagset->GetTagSetID () << 16) + m_SendTagset->GetNextIndex ()); // (tagsetid << 16) + N
 				SetLeaseSetSubmissionTime (ts);
+				payloadLen += 4;
 			}
 		}
-		if (!sendAckRequest && !first &&
-		    ((!m_AckRequestMsgID && ts > m_LastAckRequestSendTime + m_AckRequestInterval) || // regular request
-		     (m_AckRequestMsgID && ts > m_LastAckRequestSendTime + LEASESET_CONFIRMATION_TIMEOUT))) // previous request failed. try again
-		{	
-			// not LeaseSet
-			m_AckRequestMsgID = m_SendTagset->GetMsgID ();
-			if (m_AckRequestMsgID)
-			{	
-				m_AckRequestNumAttempts++;
-				sendAckRequest = true;
-			}	
-		}	
-		if (sendAckRequest) payloadLen += 4;
 		if (m_AckRequests.size () > 0)
 			payloadLen += m_AckRequests.size ()*4 + 3;
 		if (m_SendReverseKey)
@ -1131,14 +934,15 @@ namespace garlic
 			}
 			// LeaseSet
 			if (leaseSet)
-				offset += CreateLeaseSetClove (leaseSet, ts, payload + offset, payloadLen - offset);
-			// ack request
-			if (sendAckRequest)
 			{
+				offset += CreateLeaseSetClove (leaseSet, ts, payload + offset, payloadLen - offset);
+				if (!first)
+				{
+					// ack request
 					payload[offset] = eECIESx25519BlkAckRequest; offset++;
 					htobe16buf (payload + offset, 1); offset += 2;
 					payload[offset] = 0; offset++; // flags
-				m_LastAckRequestSendTime = ts;
+				}
 			}
 			// msg
 			if (msg)
@ -1174,6 +978,7 @@ namespace garlic
 					memcpy (payload + offset, m_NextReceiveRatchet->key->GetPublicKey (), 32);
 					offset += 32; // public key
 				}
+				m_SendReverseKey = false;
 			}
 			if (m_SendForwardKey)
 			{
@ -1269,8 +1074,6 @@ namespace garlic
 	bool ECIESX25519AEADRatchetSession::CheckExpired (uint64_t ts)
 	{
 		CleanupUnconfirmedLeaseSet (ts);
-		if (!m_Destination && ts > m_LastActivityTimestamp + ECIESX25519_SESSION_CREATE_TIMEOUT) return true; // m_LastActivityTimestamp is NS receive time 
-		if (m_State != eSessionStateEstablished && m_SessionCreatedTimestamp && ts > m_SessionCreatedTimestamp + ECIESX25519_SESSION_ESTABLISH_TIMEOUT) return true; 
 		return ts > m_LastActivityTimestamp + ECIESX25519_RECEIVE_EXPIRATION_TIMEOUT && // seconds
 			ts*1000 > m_LastSentTimestamp + ECIESX25519_SEND_EXPIRATION_TIMEOUT*1000; // milliseconds
 	}
--- a/libi2pd/ECIESX25519AEADRatchetSession.h
+++ b/libi2pd/ECIESX25519AEADRatchetSession.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -14,12 +14,10 @@
 #include <functional>
 #include <memory>
 #include <vector>
-#include <array>
 #include <list>
 #include <unordered_map>
 #include "Identity.h"
 #include "Crypto.h"
-#include "PostQuantum.h"
 #include "Garlic.h"
 #include "Tag.h"

@ -32,14 +30,10 @@ namespace garlic
 	const int ECIESX25519_SEND_INACTIVITY_TIMEOUT = 5000; // number of milliseconds we can send empty(pyaload only) packet after
 	const int ECIESX25519_SEND_EXPIRATION_TIMEOUT = 480; // in seconds
 	const int ECIESX25519_RECEIVE_EXPIRATION_TIMEOUT = 600; // in seconds
-	const int ECIESX25519_SESSION_CREATE_TIMEOUT = 3; // in seconds, NSR must be send after NS received
-	const int ECIESX25519_SESSION_ESTABLISH_TIMEOUT = 15; // in seconds 
-	const int ECIESX25519_PREVIOUS_TAGSET_EXPIRATION_TIMEOUT = 180; // in seconds
-	const int ECIESX25519_DEFAULT_ACK_REQUEST_INTERVAL = 33000; // in milliseconds
-	const int ECIESX25519_ACK_REQUEST_MAX_NUM_ATTEMPTS = 3;
+	const int ECIESX25519_PREVIOUS_TAGSET_EXPIRATION_TIMEOUT = 180; // 180
 	const int ECIESX25519_TAGSET_MAX_NUM_TAGS = 8192; // number of tags we request new tagset after
 	const int ECIESX25519_MIN_NUM_GENERATED_TAGS = 24;
-	const int ECIESX25519_MAX_NUM_GENERATED_TAGS = 800;
+	const int ECIESX25519_MAX_NUM_GENERATED_TAGS = 320;
 	const int ECIESX25519_NSR_NUM_GENERATED_TAGS = 12;

 	const size_t ECIESX25519_OPTIMAL_PAYLOAD_SIZE = 1912; // 1912 = 1956 /* to fit 2 tunnel messages */
@ -63,8 +57,6 @@ namespace garlic
 			int GetTagSetID () const { return m_TagSetID; };
 			void SetTagSetID (int tagsetID) { m_TagSetID = tagsetID; };

-			uint32_t GetMsgID () const { return (m_TagSetID << 16) + m_NextIndex; }; // (tagsetid << 16) + N
-			
 		private:

 			i2p::data::Tag<64> m_SessionTagKeyData;
@ -81,8 +73,8 @@ namespace garlic
 	{
 		public:

-			ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS = false);
-			~ReceiveRatchetTagSet () override;
+			ReceiveRatchetTagSet (std::shared_ptr<ECIESX25519AEADRatchetSession> session, bool isNS = false):
+				m_Session (session), m_IsNS (isNS) {};

 			bool IsNS () const { return m_IsNS; };
 			std::shared_ptr<ECIESX25519AEADRatchetSession> GetSession () { return m_Session; };
@ -157,7 +149,6 @@ namespace garlic
 			std::shared_ptr<i2p::crypto::X25519Keys> key;
 			uint8_t remote[32]; // last remote public key
 			bool newKey = true;
-			int GetReceiveTagSetID () const { return newKey ? (2*keyID + 1) : 2*keyID; }
 		};

 		public:
@ -166,32 +157,26 @@ namespace garlic
 			~ECIESX25519AEADRatchetSession ();

 			bool HandleNextMessage (uint8_t * buf, size_t len, std::shared_ptr<ReceiveRatchetTagSet> receiveTagset, int index = 0);
-			std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg) override;
+			std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg);
 			std::shared_ptr<I2NPMessage> WrapOneTimeMessage (std::shared_ptr<const I2NPMessage> msg);

 			const uint8_t * GetRemoteStaticKey () const { return m_RemoteStaticKey; }
-			i2p::data::CryptoKeyType GetRemoteStaticKeyType () const { return m_RemoteStaticKeyType; }
-			void SetRemoteStaticKey (i2p::data::CryptoKeyType keyType, const uint8_t * key) 
-			{ 
-				m_RemoteStaticKeyType = keyType;
-				memcpy (m_RemoteStaticKey, key, 32); 
-			}
+			void SetRemoteStaticKey (const uint8_t * key) { memcpy (m_RemoteStaticKey, key, 32); }
+
 			void Terminate () { m_IsTerminated = true; }
-			void SetDestination (const i2p::data::IdentHash& dest)
+			void SetDestination (const i2p::data::IdentHash& dest) // TODO:
 			{
 				if (!m_Destination) m_Destination.reset (new i2p::data::IdentHash (dest));
 			}
+
 			bool CheckExpired (uint64_t ts); // true is expired
 			bool CanBeRestarted (uint64_t ts) const { return ts > m_SessionCreatedTimestamp + ECIESX25519_RESTART_TIMEOUT; }
 			bool IsInactive (uint64_t ts) const { return ts > m_LastActivityTimestamp + ECIESX25519_INACTIVITY_TIMEOUT && CanBeRestarted (ts); }
-			void CleanupReceiveNSRKeys (); // called from ReceiveRatchetTagSet at Alice's side

-			bool IsRatchets () const override { return true; };
-			bool IsReadyToSend () const override { return m_State != eSessionStateNewSessionSent; };
-			bool IsTerminated () const override { return m_IsTerminated; }
-			uint64_t GetLastActivityTimestamp () const override { return m_LastActivityTimestamp; };
-			void SetAckRequestInterval (int interval) override { m_AckRequestInterval = interval; };
-			bool CleanupUnconfirmedTags () override; // return true if unaswered Ack requests, called from I2CP
+			bool IsRatchets () const { return true; };
+			bool IsReadyToSend () const { return m_State != eSessionStateNewSessionSent; };
+			bool IsTerminated () const { return m_IsTerminated; }
+			uint64_t GetLastActivityTimestamp () const { return m_LastActivityTimestamp; };

 		protected:

@ -199,7 +184,6 @@ namespace garlic
 			void SetNoiseState (const i2p::crypto::NoiseSymmetricState& state) { GetNoiseState () = state; };
 			void CreateNonce (uint64_t seqn, uint8_t * nonce);
 			void HandlePayload (const uint8_t * buf, size_t len, const std::shared_ptr<ReceiveRatchetTagSet>& receiveTagset, int index);
-			bool MessageConfirmed (uint32_t msgID) override;

 		private:

@ -225,30 +209,20 @@ namespace garlic

 		private:

-			i2p::data::CryptoKeyType m_RemoteStaticKeyType;
 			uint8_t m_RemoteStaticKey[32];
 			uint8_t m_Aepk[32]; // Alice's ephemeral keys, for incoming only
 			uint8_t m_NSREncodedKey[32], m_NSRH[32], m_NSRKey[32]; // new session reply, for incoming only
 			std::shared_ptr<i2p::crypto::X25519Keys> m_EphemeralKeys;
-#if OPENSSL_PQ	
-			std::unique_ptr<i2p::crypto::MLKEMKeys> m_PQKeys;
-			std::unique_ptr<std::vector<uint8_t> > m_NSREncodedPQKey;
-#endif			
 			SessionState m_State = eSessionStateNew;
 			uint64_t m_SessionCreatedTimestamp = 0, m_LastActivityTimestamp = 0, // incoming (in seconds)
 				m_LastSentTimestamp = 0; // in milliseconds
 			std::shared_ptr<RatchetTagSet> m_SendTagset, m_NSRSendTagset;
-			std::unique_ptr<i2p::data::IdentHash> m_Destination;// must be set for NS if outgoing and NSR if incoming
-			std::list<std::pair<uint16_t, int> > m_AckRequests; // incoming (tagsetid, index)
+			std::unique_ptr<i2p::data::IdentHash> m_Destination;// TODO: might not need it
+			std::list<std::pair<uint16_t, int> > m_AckRequests; // (tagsetid, index)
 			bool m_SendReverseKey = false, m_SendForwardKey = false, m_IsTerminated = false;
 			std::unique_ptr<DHRatchet> m_NextReceiveRatchet, m_NextSendRatchet;
 			uint8_t m_PaddingSizes[32], m_NextPaddingSize;

-			uint64_t m_LastAckRequestSendTime = 0; // milliseconds
-			uint32_t m_AckRequestMsgID = 0; 
-			int m_AckRequestNumAttempts = 0;
-			int m_AckRequestInterval = ECIESX25519_DEFAULT_ACK_REQUEST_INTERVAL; // milliseconds
-			
 		public:

 			// for HTTP only
--- a/libi2pd/Ed25519.cpp
+++ b/libi2pd/Ed25519.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -457,6 +457,86 @@ namespace crypto
 		}
 	}

+#if !OPENSSL_X25519
+	BIGNUM * Ed25519::ScalarMul (const BIGNUM * u, const BIGNUM * k, BN_CTX * ctx) const
+	{
+		BN_CTX_start (ctx);
+		auto x1 = BN_CTX_get (ctx); BN_copy (x1, u);
+		auto x2 = BN_CTX_get (ctx); BN_one (x2);
+		auto z2 = BN_CTX_get (ctx); BN_zero (z2);
+		auto x3 = BN_CTX_get (ctx); BN_copy (x3, u);
+		auto z3 = BN_CTX_get (ctx); BN_one (z3);
+		auto c121666 = BN_CTX_get (ctx); BN_set_word (c121666, 121666);
+		auto tmp0 = BN_CTX_get (ctx); auto tmp1 = BN_CTX_get (ctx);
+		unsigned int swap = 0;
+		auto bits = BN_num_bits (k);
+		while(bits)
+		{
+			--bits;
+			auto k_t = BN_is_bit_set(k, bits) ? 1 : 0;
+			swap ^= k_t;
+			if (swap)
+			{
+				std::swap (x2, x3);
+				std::swap (z2, z3);
+			}
+			swap = k_t;
+			BN_mod_sub(tmp0, x3, z3, q, ctx);
+			BN_mod_sub(tmp1, x2, z2, q, ctx);
+			BN_mod_add(x2, x2, z2, q, ctx);
+			BN_mod_add(z2, x3, z3, q, ctx);
+			BN_mod_mul(z3, tmp0, x2, q, ctx);
+			BN_mod_mul(z2, z2, tmp1, q, ctx);
+			BN_mod_sqr(tmp0, tmp1, q, ctx);
+			BN_mod_sqr(tmp1, x2, q, ctx);
+			BN_mod_add(x3, z3, z2, q, ctx);
+			BN_mod_sub(z2, z3, z2, q, ctx);
+			BN_mod_mul(x2, tmp1, tmp0, q, ctx);
+			BN_mod_sub(tmp1, tmp1, tmp0, q, ctx);
+			BN_mod_sqr(z2, z2, q, ctx);
+			BN_mod_mul(z3, tmp1, c121666, q, ctx);
+			BN_mod_sqr(x3, x3, q, ctx);
+			BN_mod_add(tmp0, tmp0, z3, q, ctx);
+			BN_mod_mul(z3, x1, z2, q, ctx);
+			BN_mod_mul(z2, tmp1, tmp0, q, ctx);
+		}
+		if (swap)
+		{
+			std::swap (x2, x3);
+			std::swap (z2, z3);
+		}
+		BN_mod_inverse (z2, z2, q, ctx);
+		BIGNUM * res = BN_new (); // not from ctx
+		BN_mod_mul(res, x2, z2, q, ctx);
+		BN_CTX_end (ctx);
+		return res;
+	}
+
+	void Ed25519::ScalarMul (const uint8_t * p, const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const
+	{
+		BIGNUM * p1 = DecodeBN<32> (p);
+		uint8_t k[32];
+		memcpy (k, e, 32);
+		k[0] &= 248; k[31] &= 127; k[31] |= 64;
+		BIGNUM * n = DecodeBN<32> (k);
+		BIGNUM * q1 = ScalarMul (p1, n, ctx);
+		EncodeBN (q1, buf, 32);
+		BN_free (p1); BN_free (n); BN_free (q1);
+	}
+
+	void Ed25519::ScalarMulB (const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const
+	{
+		BIGNUM *p1 = BN_new (); BN_set_word (p1, 9);
+		uint8_t k[32];
+		memcpy (k, e, 32);
+		k[0] &= 248; k[31] &= 127; k[31] |= 64;
+		BIGNUM * n = DecodeBN<32> (k);
+		BIGNUM * q1 = ScalarMul (p1, n, ctx);
+		EncodeBN (q1, buf, 32);
+		BN_free (p1); BN_free (n); BN_free (q1);
+	}
+#endif
+
 	void Ed25519::BlindPublicKey (const uint8_t * pub, const uint8_t * seed, uint8_t * blinded)
 	{
 		BN_CTX * ctx = BN_CTX_new ();
--- a/libi2pd/Ed25519.h
+++ b/libi2pd/Ed25519.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -84,7 +84,10 @@ namespace crypto
 			EDDSAPoint GeneratePublicKey (const uint8_t * expandedPrivateKey, BN_CTX * ctx) const;
 			EDDSAPoint DecodePublicKey (const uint8_t * buf, BN_CTX * ctx) const;
 			void EncodePublicKey (const EDDSAPoint& publicKey, uint8_t * buf, BN_CTX * ctx) const;
-
+#if !OPENSSL_X25519
+			void ScalarMul (const uint8_t * p, const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const; // p is point, e is number for x25519
+			void ScalarMulB (const uint8_t * e, uint8_t * buf, BN_CTX * ctx) const;
+#endif
 			void BlindPublicKey (const uint8_t * pub, const uint8_t * seed, uint8_t * blinded); // for encrypted LeaseSet2, pub - 32, seed - 64, blinded - 32
 			void BlindPrivateKey (const uint8_t * priv, const uint8_t * seed, uint8_t * blindedPriv, uint8_t * blindedPub); // for encrypted LeaseSet2, pub - 32, seed - 64, blinded - 32

@ -112,6 +115,11 @@ namespace crypto
 			BIGNUM * DecodeBN (const uint8_t * buf) const;
 			void EncodeBN (const BIGNUM * bn, uint8_t * buf, size_t len) const;

+#if !OPENSSL_X25519
+			// for x25519
+			BIGNUM * ScalarMul (const BIGNUM * p, const BIGNUM * e, BN_CTX * ctx) const;
+#endif
+
 		private:

 			BIGNUM * q, * l, * d, * I;
--- a/libi2pd/FS.cpp
+++ b/libi2pd/FS.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -7,18 +7,13 @@
 */

 #include <algorithm>
+#include <boost/filesystem.hpp>

 #if defined(MAC_OSX)
-#if !STD_FILESYSTEM
 #include <boost/system/system_error.hpp>
-#endif
 #include <TargetConditionals.h>
 #endif

-#if defined(__HAIKU__)
-#include <FindDirectory.h>
-#endif
-
 #ifdef _WIN32
 #include <shlobj.h>
 #include <windows.h>
@ -30,14 +25,6 @@
 #include "Log.h"
 #include "Garlic.h"

-#if STD_FILESYSTEM
-#include <filesystem>
-namespace fs_lib = std::filesystem;
-#else
-#include <boost/filesystem.hpp>
-namespace fs_lib = boost::filesystem;
-#endif
-
 namespace i2p {
 namespace fs {
 	std::string appName = "i2pd";
@ -67,17 +54,15 @@ namespace fs {

 	const std::string GetUTF8DataDir () {
 #ifdef _WIN32
-		int size = MultiByteToWideChar(CP_ACP, 0,
-			dataDir.c_str(), dataDir.size(), nullptr, 0);
-		std::wstring utf16Str(size, L'\0');
-		MultiByteToWideChar(CP_ACP, 0,
-			dataDir.c_str(), dataDir.size(), &utf16Str[0], size);
-		int utf8Size = WideCharToMultiByte(CP_UTF8, 0,
-			utf16Str.c_str(), utf16Str.size(), nullptr, 0, nullptr, nullptr);
-		std::string utf8Str(utf8Size, '\0');
-		WideCharToMultiByte(CP_UTF8, 0,
-			utf16Str.c_str(), utf16Str.size(), &utf8Str[0], utf8Size, nullptr, nullptr);
-		return utf8Str;
+#if (BOOST_VERSION >= 108500)
+		boost::filesystem::path path (dataDir);
+#else
+		boost::filesystem::wpath path (dataDir);
+#endif
+		auto loc = boost::filesystem::path::imbue(std::locale( std::locale(), new std::codecvt_utf8_utf16<wchar_t>() ) ); // convert path to UTF-8
+		auto dataDirUTF8 = path.string();
+		boost::filesystem::path::imbue(loc); // Return locale settings back
+		return dataDirUTF8;
 #else
 		return dataDir; // linux, osx, android uses UTF-8 by default
 #endif
@ -106,10 +91,10 @@ namespace fs {
 			}
 			else
 			{
-#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
-				dataDir = fs_lib::path(commonAppData).string() + "\\" + appName;
+#if (BOOST_VERSION >= 108500)
+				dataDir = boost::filesystem::path(commonAppData).string() + "\\" + appName;
 #else
-				dataDir = fs_lib::wpath(commonAppData).string() + "\\" + appName;
+				dataDir = boost::filesystem::wpath(commonAppData).string() + "\\" + appName;
 #endif
 			}
 #else
@ -135,14 +120,14 @@ namespace fs {
 		}
 		else
 		{
-#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
-			auto execPath = fs_lib::path(localAppData).parent_path();
+#if (BOOST_VERSION >= 108500)
+			auto execPath = boost::filesystem::path(localAppData).parent_path();
 #else
-			auto execPath = fs_lib::wpath(localAppData).parent_path();
+			auto execPath = boost::filesystem::wpath(localAppData).parent_path();
 #endif

 			// if config file exists in .exe's folder use it
-			if(fs_lib::exists(execPath/"i2pd.conf")) // TODO: magic string
+			if(boost::filesystem::exists(execPath/"i2pd.conf")) // TODO: magic string
 			{
 				dataDir = execPath.string ();
 			} else // otherwise %appdata%
@ -158,10 +143,10 @@ namespace fs {
 				}
 				else
 				{
-#if ((BOOST_VERSION >= 108500) || STD_FILESYSTEM)
-					dataDir = fs_lib::path(localAppData).string() + "\\" + appName;
+#if (BOOST_VERSION >= 108500)
+					dataDir = boost::filesystem::path(localAppData).string() + "\\" + appName;
 #else
-					dataDir = fs_lib::wpath(localAppData).string() + "\\" + appName;
+					dataDir = boost::filesystem::wpath(localAppData).string() + "\\" + appName;
 #endif
 				}
 			}
@ -173,17 +158,18 @@ namespace fs {
 		dataDir += "/Library/Application Support/" + appName;
 		return;
 #elif defined(__HAIKU__)
-		char home[PATH_MAX]; // /boot/home/config/settings
-		if (find_directory(B_USER_SETTINGS_DIRECTORY, -1, false, home, PATH_MAX) == B_OK)	
-			dataDir = std::string(home) + "/" + appName;
-		else
+		char *home = getenv("HOME");
+		if (home != NULL && strlen(home) > 0) {
+			dataDir = std::string(home) + "/config/settings/" + appName;
+		} else {
 			dataDir = "/tmp/" + appName;
+		}
 		return;
 #else /* other unix */
 #if defined(ANDROID)
 		const char * ext = getenv("EXTERNAL_STORAGE");
 		if (!ext) ext = "/sdcard";
-		if (fs_lib::exists(ext))
+		if (boost::filesystem::exists(ext))
 		{
 			dataDir = std::string (ext) + "/" + appName;
 			return;
@ -216,16 +202,16 @@ namespace fs {
 	}

 	bool Init() {
-		if (!fs_lib::exists(dataDir))
-			fs_lib::create_directory(dataDir);
+		if (!boost::filesystem::exists(dataDir))
+			boost::filesystem::create_directory(dataDir);

 		std::string destinations = DataDirPath("destinations");
-		if (!fs_lib::exists(destinations))
-			fs_lib::create_directory(destinations);
+		if (!boost::filesystem::exists(destinations))
+			boost::filesystem::create_directory(destinations);

 		std::string tags = DataDirPath("tags");
-		if (!fs_lib::exists(tags))
-			fs_lib::create_directory(tags);
+		if (!boost::filesystem::exists(tags))
+			boost::filesystem::create_directory(tags);
 		else
 			i2p::garlic::CleanUpTagsFiles ();

@ -233,13 +219,13 @@ namespace fs {
 	}

 	bool ReadDir(const std::string & path, std::vector<std::string> & files) {
-		if (!fs_lib::exists(path))
+		if (!boost::filesystem::exists(path))
 			return false;
-		fs_lib::directory_iterator it(path);
-		fs_lib::directory_iterator end;
+		boost::filesystem::directory_iterator it(path);
+		boost::filesystem::directory_iterator end;

 		for ( ; it != end; it++) {
-			if (!fs_lib::is_regular_file(it->status()))
+			if (!boost::filesystem::is_regular_file(it->status()))
 				continue;
 			files.push_back(it->path().string());
 		}
@ -248,42 +234,29 @@ namespace fs {
 	}

 	bool Exists(const std::string & path) {
-		return fs_lib::exists(path);
+		return boost::filesystem::exists(path);
 	}

 	uint32_t GetLastUpdateTime (const std::string & path)
 	{
-		if (!fs_lib::exists(path))
+		if (!boost::filesystem::exists(path))
 			return 0;
-#if STD_FILESYSTEM
-		std::error_code ec;
-		auto t = std::filesystem::last_write_time (path, ec);
-		if (ec) return 0;
-/*#if __cplusplus >= 202002L // C++ 20 or higher
-		const auto sctp = std::chrono::clock_cast<std::chrono::system_clock>(t);
-#else	*/	// TODO: wait until implemented
-		const auto sctp = std::chrono::time_point_cast<std::chrono::system_clock::duration>(
-		    t - decltype(t)::clock::now() + std::chrono::system_clock::now());
-/*#endif */
-		return std::chrono::system_clock::to_time_t(sctp);
-#else
 		boost::system::error_code ec;
 		auto t = boost::filesystem::last_write_time (path, ec);
 		return ec ? 0 : t;
-#endif
 	}

 	bool Remove(const std::string & path) {
-		if (!fs_lib::exists(path))
+		if (!boost::filesystem::exists(path))
 			return false;
-		return fs_lib::remove(path);
+		return boost::filesystem::remove(path);
 	}

 	bool CreateDirectory (const std::string& path)
 	{
-		if (fs_lib::exists(path) && fs_lib::is_directory (fs_lib::status (path)))
+		if (boost::filesystem::exists(path) && boost::filesystem::is_directory (boost::filesystem::status (path)))
 			return true;
-		return fs_lib::create_directory(path);
+		return boost::filesystem::create_directory(path);
 	}

 	void HashedStorage::SetPlace(const std::string &path) {
@ -291,18 +264,18 @@ namespace fs {
 	}

 	bool HashedStorage::Init(const char * chars, size_t count) {
-		if (!fs_lib::exists(root)) {
-			fs_lib::create_directories(root);
+		if (!boost::filesystem::exists(root)) {
+			boost::filesystem::create_directories(root);
 		}

 		for (size_t i = 0; i < count; i++) {
 			auto p = root + i2p::fs::dirSep + prefix1 + chars[i];
-			if (fs_lib::exists(p))
+			if (boost::filesystem::exists(p))
 				continue;
 #if TARGET_OS_SIMULATOR
 			// ios simulator fs says it is case sensitive, but it is not
 			boost::system::error_code ec;
-			if (fs_lib::create_directory(p, ec))
+			if (boost::filesystem::create_directory(p, ec))
 				continue;
 			switch (ec.value()) {
 				case boost::system::errc::file_exists:
@ -312,7 +285,7 @@ namespace fs {
 					throw boost::system::system_error( ec, __func__ );
 			}
 #else
-			if (fs_lib::create_directory(p))
+			if (boost::filesystem::create_directory(p))
 				continue; /* ^ throws exception on failure */
 #endif
 			return false;
@ -335,9 +308,9 @@ namespace fs {

 	void HashedStorage::Remove(const std::string & ident) {
 		std::string path = Path(ident);
-		if (!fs_lib::exists(path))
+		if (!boost::filesystem::exists(path))
 			return;
-		fs_lib::remove(path);
+		boost::filesystem::remove(path);
 	}

 	void HashedStorage::Traverse(std::vector<std::string> & files) {
@ -348,12 +321,12 @@ namespace fs {

 	void HashedStorage::Iterate(FilenameVisitor v)
 	{
-		fs_lib::path p(root);
-		fs_lib::recursive_directory_iterator it(p);
-		fs_lib::recursive_directory_iterator end;
+		boost::filesystem::path p(root);
+		boost::filesystem::recursive_directory_iterator it(p);
+		boost::filesystem::recursive_directory_iterator end;

 		for ( ; it != end; it++) {
-			if (!fs_lib::is_regular_file( it->status() ))
+			if (!boost::filesystem::is_regular_file( it->status() ))
 				continue;
 			const std::string & t = it->path().string();
 			v(t);
--- a/libi2pd/FS.h
+++ b/libi2pd/FS.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -15,16 +15,6 @@
 #include <sstream>
 #include <functional>

-#ifndef STD_FILESYSTEM
-#	if (_WIN32 && __GNUG__) // MinGW GCC somehow incorrectly converts paths
-#		define STD_FILESYSTEM 0
-#	elif (!TARGET_OS_SIMULATOR && __has_include(<filesystem>)) // supports std::filesystem
-#		define STD_FILESYSTEM 1
-#	else
-#		define STD_FILESYSTEM 0
-#	endif
-#endif
-
 namespace i2p {
 namespace fs {
 	extern std::string dirSep;
--- a/libi2pd/Family.cpp
+++ b/libi2pd/Family.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -7,6 +7,7 @@
 */

 #include <string.h>
+#include <openssl/evp.h>
 #include <openssl/ssl.h>
 #include "Crypto.h"
 #include "FS.h"
@ -24,8 +25,6 @@ namespace data

 	Families::~Families ()
 	{
-		for (auto it : m_SigningKeys)
-			if (it.second.first) EVP_PKEY_free (it.second.first);
 	}

 	void Families::LoadCertificate (const std::string& filename)
@ -48,16 +47,48 @@ namespace data
 					cn += 3;
 					char * family = strstr (cn, ".family");
 					if (family) family[0] = 0;
+				}
 				auto pkey = X509_get_pubkey (cert);
-					if (pkey)
+				int keyType = EVP_PKEY_base_id (pkey);
+				switch (keyType)
 				{
-						if (!m_SigningKeys.emplace (cn, std::make_pair(pkey, (int)m_SigningKeys.size () + 1)).second)
+					case EVP_PKEY_DSA:
+						// TODO:
+					break;
+					case EVP_PKEY_EC:
 					{
+						EC_KEY * ecKey = EVP_PKEY_get1_EC_KEY (pkey);
+						if (ecKey)
+						{
+							auto group = EC_KEY_get0_group (ecKey);
+							if (group)
+							{
+								int curve = EC_GROUP_get_curve_name (group);
+								if (curve == NID_X9_62_prime256v1)
+								{
+									uint8_t signingKey[64];
+									BIGNUM * x = BN_new(), * y = BN_new();
+									EC_POINT_get_affine_coordinates_GFp (group,
+										EC_KEY_get0_public_key (ecKey), x, y, NULL);
+									i2p::crypto::bn2buf (x, signingKey, 32);
+									i2p::crypto::bn2buf (y, signingKey + 32, 32);
+									BN_free (x); BN_free (y);
+									verifier = std::make_shared<i2p::crypto::ECDSAP256Verifier>();
+									verifier->SetPublicKey (signingKey);
+								}
+								else
+									LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
+							}
+							EC_KEY_free (ecKey);
+						}
+						break;
+					}
+					default:
+						LogPrint (eLogWarning, "Family: Certificate key type ", keyType, " is not supported");
+				}
 				EVP_PKEY_free (pkey);
-							LogPrint (eLogError, "Family: Duplicated family name ", cn);
-						}	
-					}	
-				}
+				if (verifier && cn)
+					m_SigningKeys.emplace (cn, std::make_pair(verifier, (int)m_SigningKeys.size () + 1));
 			}
 			SSL_free (ssl);
 		}
@ -90,31 +121,23 @@ namespace data
 	}

 	bool Families::VerifyFamily (const std::string& family, const IdentHash& ident,
-		std::string_view signature, const char * key) const
+		const char * signature, const char * key) const
 	{
 		uint8_t buf[100], signatureBuf[64];
-		size_t len = family.length ();
+		size_t len = family.length (), signatureLen = strlen (signature);
 		if (len + 32 > 100)
 		{
 			LogPrint (eLogError, "Family: ", family, " is too long");
 			return false;
 		}
-		auto it = m_SigningKeys.find (family);
-		if (it != m_SigningKeys.end () && it->second.first)
-		{	
+
 		memcpy (buf, family.c_str (), len);
 		memcpy (buf + len, (const uint8_t *)ident, 32);
 		len += 32;
-			auto signatureBufLen = Base64ToByteStream (signature, signatureBuf, 64);
-			if (signatureBufLen)
-			{
-				EVP_MD_CTX * ctx = EVP_MD_CTX_create ();
-				EVP_DigestVerifyInit (ctx, NULL, NULL, NULL, it->second.first);
-				auto ret = EVP_DigestVerify (ctx, signatureBuf, signatureBufLen, buf, len);
-				EVP_MD_CTX_destroy (ctx);
-				return ret;
-			}	
-		}	
+		Base64ToByteStream (signature, signatureLen, signatureBuf, 64);
+		auto it = m_SigningKeys.find (family);
+		if (it != m_SigningKeys.end ())
+			return it->second.first->Verify (buf, len, signatureBuf);
 		// TODO: process key
 		return true;
 	}
@ -154,7 +177,12 @@ namespace data
 						memcpy (buf + len, (const uint8_t *)ident, 32);
 						len += 32;
 						signer.Sign (buf, len, signature);
-						sig = ByteStreamToBase64 (signature, 64);
+						len = Base64EncodingBufferSize (64);
+						char * b64 = new char[len+1];
+						len = ByteStreamToBase64 (signature, 64, b64, len);
+						b64[len] = 0;
+						sig = b64;
+						delete[] b64;
 					}
 					else
 						LogPrint (eLogWarning, "Family: elliptic curve ", curve, " is not supported");
--- a/libi2pd/Family.h
+++ b/libi2pd/Family.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,9 +11,8 @@

 #include <map>
 #include <string>
-#include <string_view>
 #include <memory>
-#include <openssl/evp.h>
+#include "Signature.h"
 #include "Identity.h"

 namespace i2p
@ -29,7 +28,7 @@ namespace data
 			~Families ();
 			void LoadCertificates ();
 			bool VerifyFamily (const std::string& family, const IdentHash& ident,
-				std::string_view signature, const char * key = nullptr) const;
+				const char * signature, const char * key = nullptr) const;
 			FamilyID GetFamilyID (const std::string& family) const;

 		private:
@ -38,7 +37,7 @@ namespace data

 		private:

-			std::map<std::string, std::pair<EVP_PKEY *, FamilyID> > m_SigningKeys; // family -> (verification pkey, id)
+			std::map<std::string, std::pair<std::shared_ptr<i2p::crypto::Verifier>, FamilyID> > m_SigningKeys; // family -> (verifier, id)
 	};

 	std::string CreateFamilySignature (const std::string& family, const IdentHash& ident);
--- a/libi2pd/Garlic.cpp
+++ b/libi2pd/Garlic.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -160,7 +160,7 @@ namespace garlic
 			uint8_t iv[32]; // IV is first 16 bytes
 			SHA256(elGamal.preIV, 32, iv);
 			m_Destination->Encrypt ((uint8_t *)&elGamal, buf);
-			m_IV = iv;
+			m_Encryption.SetIV (iv);
 			buf += 514;
 			len += 514;
 		}
@ -170,7 +170,7 @@ namespace garlic
 			memcpy (buf, tag, 32);
 			uint8_t iv[32]; // IV is first 16 bytes
 			SHA256(tag, 32, iv);
-			m_IV = iv;
+			m_Encryption.SetIV (iv);
 			buf += 32;
 			len += 32;
 		}
@ -210,7 +210,7 @@ namespace garlic
 		size_t rem = blockSize % 16;
 		if (rem)
 			blockSize += (16-rem); //padding
-		m_Encryption.Encrypt(buf, blockSize, m_IV, buf);
+		m_Encryption.Encrypt(buf, blockSize, buf);
 		return blockSize;
 	}

@ -426,8 +426,7 @@ namespace garlic
 	}

 	GarlicDestination::GarlicDestination (): m_NumTags (32), // 32 tags by default
-		m_PayloadBuffer (nullptr), m_LastIncomingSessionTimestamp (0), 
-		m_NumRatchetInboundTags (0) // 0 means standard
+		m_PayloadBuffer (nullptr), m_NumRatchetInboundTags (0) // 0 means standard
 	{
 	}

@ -498,8 +497,7 @@ namespace garlic
 		buf += 4; // length

 		bool found = false;
-		bool supportsRatchets = SupportsRatchets ();
-		if (supportsRatchets)
+		if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
 			// try ECIESx25519 tag
 			found = HandleECIESx25519TagMessage (buf, length);
 		if (!found)
@ -515,7 +513,8 @@ namespace garlic
 				{
 					uint8_t iv[32]; // IV is first 16 bytes
 					SHA256(buf, 32, iv);
-					decryption->Decrypt (buf + 32, length - 32, iv, buf + 32);
+					decryption->SetIV (iv);
+					decryption->Decrypt (buf + 32, length - 32, buf + 32);
 					HandleAESBlock (buf + 32, length - 32, decryption, msg->from);
 					found = true;
 				}
@ -533,23 +532,43 @@ namespace garlic
 					auto decryption = std::make_shared<AESDecryption>(elGamal.sessionKey);
 					uint8_t iv[32]; // IV is first 16 bytes
 					SHA256(elGamal.preIV, 32, iv);
-					decryption->Decrypt(buf + 514, length - 514, iv, buf + 514);
+					decryption->SetIV (iv);
+					decryption->Decrypt(buf + 514, length - 514, buf + 514);
 					HandleAESBlock (buf + 514, length - 514, decryption, msg->from);
 				}
-				else if (supportsRatchets)
+				else if (SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
 				{
 					// otherwise ECIESx25519
-					auto ts = i2p::util::GetMillisecondsSinceEpoch ();
-					if (ts > m_LastIncomingSessionTimestamp + INCOMING_SESSIONS_MINIMAL_INTERVAL) 
-					{	
 					auto session = std::make_shared<ECIESX25519AEADRatchetSession> (this, false); // incoming
-						if (session->HandleNextMessage (buf, length, nullptr, 0))
-							m_LastIncomingSessionTimestamp = ts;
-						else
+					if (!session->HandleNextMessage (buf, length, nullptr, 0))
+					{
+						// try to generate more tags for last tagset
+						if (m_LastTagset && (m_LastTagset->GetNextIndex () - m_LastTagset->GetTrimBehind () < 3*ECIESX25519_MAX_NUM_GENERATED_TAGS))
+						{
+							uint64_t missingTag; memcpy (&missingTag, buf, 8);
+							auto maxTags = std::max (m_NumRatchetInboundTags, ECIESX25519_MAX_NUM_GENERATED_TAGS);
+							LogPrint (eLogWarning, "Garlic: Trying to generate more ECIES-X25519-AEAD-Ratchet tags");
+							for (int i = 0; i < maxTags; i++)
+							{
+								auto nextTag = AddECIESx25519SessionNextTag (m_LastTagset);
+								if (!nextTag)
+								{
+									LogPrint (eLogError, "Garlic: Can't create new ECIES-X25519-AEAD-Ratchet tag for last tagset");
+									break;
+								}
+								if (nextTag == missingTag)
+								{
+									LogPrint (eLogDebug, "Garlic: Missing ECIES-X25519-AEAD-Ratchet tag was generated");
+									if (m_LastTagset->HandleNextMessage (buf, length, m_ECIESx25519Tags[nextTag].index))
+										found = true;
+									break;
+								}
+							}
+							if (!found) m_LastTagset = nullptr;
+						}
+						if (!found)
 							LogPrint (eLogError, "Garlic: Can't handle ECIES-X25519-AEAD-Ratchet message");
 					}
-					else
-						LogPrint (eLogWarning, "Garlic: Incoming sessions come too often");
 				}
 				else
 					LogPrint (eLogError, "Garlic: Failed to decrypt message");
@ -564,7 +583,9 @@ namespace garlic
 		auto it = m_ECIESx25519Tags.find (tag);
 		if (it != m_ECIESx25519Tags.end ())
 		{
-			if (!it->second.tagset || !it->second.tagset->HandleNextMessage (buf, len, it->second.index))
+			if (it->second.tagset && it->second.tagset->HandleNextMessage (buf, len, it->second.index))
+				m_LastTagset = it->second.tagset;
+			else
 				LogPrint (eLogError, "Garlic: Can't handle ECIES-X25519-AEAD-Ratchet message");
 			m_ECIESx25519Tags.erase (it);
 			return true;
@ -745,12 +766,10 @@ namespace garlic
 	}

 	std::shared_ptr<GarlicRoutingSession> GarlicDestination::GetRoutingSession (
-		std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet,
-	    bool requestNewIfNotFound)
+		std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet)
 	{
-		if (destination->GetEncryptionType () >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD)
-		{
-			if (SupportsEncryptionType (destination->GetEncryptionType ()))
+		if (destination->GetEncryptionType () == i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD &&
+			SupportsEncryptionType (i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD))
 		{
 			ECIESX25519AEADRatchetSessionPtr session;
 			uint8_t staticKey[32];
@ -762,22 +781,18 @@ namespace garlic
 				if (session->IsInactive (i2p::util::GetSecondsSinceEpoch ()))
 				{
 					LogPrint (eLogDebug, "Garlic: Session restarted");
-						requestNewIfNotFound = true; // it's not a new session
 					session = nullptr;
 				}
 			}
-				if (!session && requestNewIfNotFound)
+			if (!session)
 			{
 				session = std::make_shared<ECIESX25519AEADRatchetSession> (this, true);
-					session->SetRemoteStaticKey (destination->GetEncryptionType (), staticKey);
+				session->SetRemoteStaticKey (staticKey);
 			}
-				if (session && destination->IsDestination ())
-					session->SetDestination (destination->GetIdentHash ()); // NS or NSR
+			if (destination->IsDestination ())
+				session->SetDestination (destination->GetIdentHash ()); // TODO: remove
 			return session;
 		}
-			else
-				LogPrint (eLogError, "Garlic: Non-supported encryption type ", destination->GetEncryptionType ());
-		}
 		else
 		{
 			ElGamalAESSessionPtr session;
@ -878,6 +893,8 @@ namespace garlic
 		}
 		if (numExpiredTags > 0)
 			LogPrint (eLogDebug, "Garlic: ", numExpiredTags, " ECIESx25519 tags expired for ", GetIdentHash().ToBase64 ());
+		if (m_LastTagset && m_LastTagset->IsExpired (ts))
+			m_LastTagset = nullptr;
 	}

 	void GarlicDestination::RemoveDeliveryStatusSession (uint32_t msgID)
@ -911,7 +928,7 @@ namespace garlic
 		}
 	}

-	void GarlicDestination::SetLeaseSetUpdated (bool post)
+	void GarlicDestination::SetLeaseSetUpdated ()
 	{
 		{
 			std::unique_lock<std::mutex> l(m_SessionsMutex);
@ -1004,8 +1021,7 @@ namespace garlic
 				i2p::fs::Remove (it);
 	}

-	void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len,
-		ECIESX25519AEADRatchetSession * from)
+	void GarlicDestination::HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len)
 	{
 		const uint8_t * buf1 = buf;
 		uint8_t flag = buf[0]; buf++; // flag
@ -1015,7 +1031,9 @@ namespace garlic
 			case eGarlicDeliveryTypeDestination:
 				LogPrint (eLogDebug, "Garlic: Type destination");
 				buf += 32; // TODO: check destination
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
+#endif
 				// no break here
 			case eGarlicDeliveryTypeLocal:
 			{
@ -1025,7 +1043,7 @@ namespace garlic
 				buf += 4; // expiration
 				ptrdiff_t offset = buf - buf1;
 				if (offset <= (int)len)
-					HandleCloveI2NPMessage (typeID, buf, len - offset, msgID, from);
+					HandleCloveI2NPMessage (typeID, buf, len - offset, msgID);
 				else
 					LogPrint (eLogError, "Garlic: Clove is too long");
 				break;
@ -1109,17 +1127,5 @@ namespace garlic
 			m_PayloadBuffer = new uint8_t[I2NP_MAX_MESSAGE_SIZE];
 		return m_PayloadBuffer;
 	}
-
-	bool GarlicDestination::AEADChaCha20Poly1305Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
-	{
-		return m_Encryptor.Encrypt (msg, msgLen, ad, adLen, key, nonce, buf, len);
-	}
-		
-	bool GarlicDestination::AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-		const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
-	{
-		return m_Decryptor.Decrypt (msg, msgLen, ad, adLen, key, nonce, buf, len);
-	}	
 }
 }
--- a/libi2pd/Garlic.h
+++ b/libi2pd/Garlic.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -52,7 +52,6 @@ namespace garlic
 	const int OUTGOING_TAGS_CONFIRMATION_TIMEOUT = 10; // 10 seconds
 	const int LEASESET_CONFIRMATION_TIMEOUT = 4000; // in milliseconds
 	const int ROUTING_PATH_EXPIRATION_TIMEOUT = 120; // in seconds
-	const int INCOMING_SESSIONS_MINIMAL_INTERVAL = 200; // in milliseconds

 	struct SessionTag: public i2p::data::Tag<32>
 	{
@ -110,13 +109,12 @@ namespace garlic
 			GarlicRoutingSession ();
 			virtual ~GarlicRoutingSession ();
 			virtual std::shared_ptr<I2NPMessage> WrapSingleMessage (std::shared_ptr<const I2NPMessage> msg) = 0;
-			virtual bool CleanupUnconfirmedTags () { return false; }; // for I2CP, override in ElGamalAESSession and ECIESX25519AEADRatchetSession
+			virtual bool CleanupUnconfirmedTags () { return false; }; // for I2CP, override in ElGamalAESSession
 			virtual bool MessageConfirmed (uint32_t msgID);
 			virtual bool IsRatchets () const { return false; };
 			virtual bool IsReadyToSend () const { return true; };
 			virtual bool IsTerminated () const { return !GetOwner (); };
 			virtual uint64_t GetLastActivityTimestamp () const { return 0; }; // non-zero for rathets only
-			virtual void SetAckRequestInterval (int interval) {}; // in milliseconds, override in ECIESX25519AEADRatchetSession

 			void SetLeaseSetUpdated ()
 			{
@ -206,7 +204,6 @@ namespace garlic
 			std::map<uint32_t, std::unique_ptr<UnconfirmedTags> > m_UnconfirmedTagsMsgs; // msgID->tags

 			i2p::crypto::CBCEncryption m_Encryption;
-			i2p::data::Tag<16> m_IV;

 		public:

@ -237,18 +234,12 @@ namespace garlic
 			int GetNumTags () const { return m_NumTags; };
 			void SetNumRatchetInboundTags (int numTags) { m_NumRatchetInboundTags = numTags; };
 			int GetNumRatchetInboundTags () const { return m_NumRatchetInboundTags; };
-			std::shared_ptr<GarlicRoutingSession> GetRoutingSession (std::shared_ptr<const i2p::data::RoutingDestination> destination,
-				bool attachLeaseSet, bool requestNewIfNotFound = true);
+			std::shared_ptr<GarlicRoutingSession> GetRoutingSession (std::shared_ptr<const i2p::data::RoutingDestination> destination, bool attachLeaseSet);
 			void CleanupExpiredTags ();
 			void RemoveDeliveryStatusSession (uint32_t msgID);
 			std::shared_ptr<I2NPMessage> WrapMessageForRouter (std::shared_ptr<const i2p::data::RouterInfo> router,
 				std::shared_ptr<I2NPMessage> msg);

-			bool AEADChaCha20Poly1305Encrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); 
-			bool AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); 
-
 			void AddSessionKey (const uint8_t * key, const uint8_t * tag); // one tag
 			void AddECIESx25519Key (const uint8_t * key, uint64_t tag); // one tag
 			virtual bool SubmitSessionKey (const uint8_t * key, const uint8_t * tag); // from different thread
@ -257,27 +248,22 @@ namespace garlic
 			uint64_t AddECIESx25519SessionNextTag (ReceiveRatchetTagSetPtr tagset);
 			void AddECIESx25519Session (const uint8_t * staticKey, ECIESX25519AEADRatchetSessionPtr session);
 			void RemoveECIESx25519Session (const uint8_t * staticKey);
-			void HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len, ECIESX25519AEADRatchetSession * from);
+			void HandleECIESx25519GarlicClove (const uint8_t * buf, size_t len);
 			uint8_t * GetPayloadBuffer ();

 			virtual void ProcessGarlicMessage (std::shared_ptr<I2NPMessage> msg);
 			virtual void ProcessDeliveryStatusMessage (std::shared_ptr<I2NPMessage> msg);
-			virtual void SetLeaseSetUpdated (bool post = false);
+			virtual void SetLeaseSetUpdated ();

 			virtual std::shared_ptr<const i2p::data::LocalLeaseSet> GetLeaseSet () = 0; // TODO
 			virtual std::shared_ptr<i2p::tunnel::TunnelPool> GetTunnelPool () const = 0;
-			virtual i2p::data::CryptoKeyType GetRatchetsHighestCryptoType () const 
-			{
-				return GetIdentity ()->GetCryptoKeyType () >= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ? GetIdentity ()->GetCryptoKeyType () : 0;
-			}	

 		protected:

 			void AddECIESx25519Key (const uint8_t * key, const uint8_t * tag); // one tag
 			bool HandleECIESx25519TagMessage (uint8_t * buf, size_t len); // return true if found
 			virtual void HandleI2NPMessage (const uint8_t * buf, size_t len) = 0; // called from clove only
-			virtual bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, 
-				size_t len, uint32_t msgID, ECIESX25519AEADRatchetSession * from) = 0;
+			virtual bool HandleCloveI2NPMessage (I2NPMessageType typeID, const uint8_t * payload, size_t len, uint32_t msgID) = 0;
 			void HandleGarlicMessage (std::shared_ptr<I2NPMessage> msg);
 			void HandleDeliveryStatusMessage (uint32_t msgID);

@ -286,7 +272,6 @@ namespace garlic

 		private:

-			bool SupportsRatchets () const { return GetRatchetsHighestCryptoType () > 0; }
 			void HandleAESBlock (uint8_t * buf, size_t len, std::shared_ptr<AESDecryption> decryption,
 				std::shared_ptr<i2p::tunnel::InboundTunnel> from);
 			void HandleGarlicPayload (uint8_t * buf, size_t len, std::shared_ptr<i2p::tunnel::InboundTunnel> from);
@ -299,17 +284,14 @@ namespace garlic
 			std::unordered_map<i2p::data::IdentHash, ElGamalAESSessionPtr> m_Sessions;
 			std::unordered_map<i2p::data::Tag<32>, ECIESX25519AEADRatchetSessionPtr> m_ECIESx25519Sessions; // static key -> session
 			uint8_t * m_PayloadBuffer; // for ECIESX25519AEADRatchet
-			uint64_t m_LastIncomingSessionTimestamp; // in milliseconds
 			// incoming
 			int m_NumRatchetInboundTags;
 			std::unordered_map<SessionTag, std::shared_ptr<AESDecryption>, std::hash<i2p::data::Tag<32> > > m_Tags;
 			std::unordered_map<uint64_t, ECIESX25519AEADRatchetIndexTagset> m_ECIESx25519Tags; // session tag -> session
+			ReceiveRatchetTagSetPtr m_LastTagset; // tagset last message came for
 			// DeliveryStatus
 			std::mutex m_DeliveryStatusSessionsMutex;
 			std::unordered_map<uint32_t, GarlicRoutingSessionPtr> m_DeliveryStatusSessions; // msgID -> session
-			// encryption
-			i2p::crypto::AEADChaCha20Poly1305Encryptor m_Encryptor;
-			i2p::crypto::AEADChaCha20Poly1305Decryptor m_Decryptor;

 		public:

--- a/libi2pd/HTTP.cpp
+++ b/libi2pd/HTTP.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -10,7 +10,6 @@
 #include <utility>
 #include <stdio.h>
 #include <ctime>
-#include <charconv>
 #include "util.h"
 #include "Base.h"
 #include "HTTP.h"
@ -19,68 +18,58 @@ namespace i2p
 {
 namespace http
 {
-	// list of valid HTTP methods
-	static constexpr std::array<std::string_view, 16> HTTP_METHODS = 
-	{
+	const std::vector<std::string> HTTP_METHODS = {
 		"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "CONNECT", // HTTP basic methods
 		"COPY", "LOCK", "MKCOL", "MOVE", "PROPFIND", "PROPPATCH", "UNLOCK", "SEARCH" // WebDAV methods, for SEARCH see rfc5323
 	};
-
-	// list of valid HTTP versions
-	static constexpr std::array<std::string_view, 2> HTTP_VERSIONS = 
-	{
+	const std::vector<std::string> HTTP_VERSIONS = {
 		"HTTP/1.0", "HTTP/1.1"
 	};
-	
-	static constexpr std::array<const char *, 7> weekdays = 
-	{
+	const std::vector<const char *> weekdays = {
 		"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
 	};
-	
-	static constexpr std::array<const char *, 12> months = 
-	{
+	const std::vector<const char *> months = {
 		"Jan", "Feb", "Mar", "Apr", "May", "Jun",
 		"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
 	};

-	static inline bool is_http_version(std::string_view str) 
-	{
+	inline bool is_http_version(const std::string & str) {
 		return std::find(HTTP_VERSIONS.begin(), HTTP_VERSIONS.end(), str) != std::end(HTTP_VERSIONS);
 	}

-	static inline bool is_http_method(std::string_view str) 
-	{
+	inline bool is_http_method(const std::string & str) {
 		return std::find(HTTP_METHODS.begin(), HTTP_METHODS.end(), str) != std::end(HTTP_METHODS);
 	}

-	static void strsplit(std::string_view line, std::vector<std::string_view> &tokens, char delim, std::size_t limit = 0) 
-	{	
-		size_t count = 0, pos;
-		while ((pos = line.find (delim)) != line.npos)
-		{
+	void strsplit(const std::string & line, std::vector<std::string> &tokens, char delim, std::size_t limit = 0) {
+		std::size_t count = 0;
+		std::stringstream ss(line);
+		std::string token;
+		while (1) {
 			count++;
-			if (limit > 0 && count >= limit) delim = '\n'; // reset delimiter
-			tokens.push_back (line.substr (0, pos));
-			line = line.substr (pos + 1);	
+			if (limit > 0 && count >= limit)
+				delim = '\n'; /* reset delimiter */
+			if (!std::getline(ss, token, delim))
+				break;
+			tokens.push_back(token);
 		}
-		if (!line.empty ()) tokens.push_back (line);
 	}

-	static std::pair<std::string, std::string> parse_header_line(std::string_view line)
+	static std::pair<std::string, std::string> parse_header_line(const std::string& line)
 	{
 		std::size_t pos = 0;
 		std::size_t len = 1; /*: */
 		std::size_t max = line.length();
 		if ((pos = line.find(':', pos)) == std::string::npos)
-			return std::pair{"", ""}; // no ':' found
+			return std::make_pair("", ""); // no ':' found
 		if (pos + 1 < max) // ':' at the end of header is valid
 		{
 			while ((pos + len) < max && isspace(line.at(pos + len)))
 				len++;
 			if (len == 1)
-				return std::pair{"", ""}; // no following space, but something else
+				return std::make_pair("", ""); // no following space, but something else
 		}
-		return std::pair{std::string (line.substr(0, pos)), std::string (line.substr(pos + len))};
+		return std::make_pair(line.substr(0, pos), line.substr(pos + len));
 	}

 	void gen_rfc7231_date(std::string & out) {
@ -94,18 +83,15 @@ namespace http
 		out = buf;
 	}

-	bool URL::parse(const char *str, std::size_t len) 
-	{
-		return parse({str, len ? len : strlen(str)});
+	bool URL::parse(const char *str, std::size_t len) {
+		std::string url(str, len ? len : strlen(str));
+		return parse(url);
 	}

-	bool URL::parse(std::string_view url) 
-	{
-		if (url.empty ()) return false;
+	bool URL::parse(const std::string& url) {
 		std::size_t pos_p = 0; /* < current parse position */
 		std::size_t pos_c = 0; /* < work position */
-		if(url.at(0) != '/' || pos_p > 0) 
-		{
+		if(url.at(0) != '/' || pos_p > 0) {
 			std::size_t pos_s = 0;

 			/* schema */
@ -155,7 +141,7 @@ namespace http
 				/* port[/path] */
 				pos_p = pos_c + 1;
 				pos_c = url.find('/', pos_p);
-				std::string_view port_str = (pos_c == std::string::npos)
+				std::string port_str = (pos_c == std::string::npos)
 					? url.substr(pos_p, std::string::npos)
 					: url.substr(pos_p, pos_c - pos_p);
 				/* stoi throws exception on failure, we don't need it */
@ -209,9 +195,8 @@ namespace http
 		return true;
 	}

-	bool URL::parse_query(std::map<std::string, std::string> & params) 
-	{
-		std::vector<std::string_view> tokens;
+	bool URL::parse_query(std::map<std::string, std::string> & params) {
+		std::vector<std::string> tokens;
 		strsplit(query, tokens, '&');

 		params.clear();
@ -268,7 +253,7 @@ namespace http
 		return host.rfind(".i2p") == ( host.size() - 4 );
 	}

-	void HTTPMsg::add_header(const char *name, const std::string & value, bool replace) {
+	void HTTPMsg::add_header(const char *name, std::string & value, bool replace) {
 		add_header(name, value.c_str(), replace);
 	}

@ -287,13 +272,12 @@ namespace http
 		headers.erase(name);
 	}

-	int HTTPReq::parse(const char *buf, size_t len) 
-	{
-		return parse({buf, len});
+	int HTTPReq::parse(const char *buf, size_t len) {
+		std::string str(buf, len);
+		return parse(str);
 	}

-	int HTTPReq::parse(std::string_view str) 
-	{
+	int HTTPReq::parse(const std::string& str) {
 		enum { REQ_LINE, HEADER_LINE } expect = REQ_LINE;
 		std::size_t eoh = str.find(HTTP_EOH); /* request head size */
 		std::size_t eol = 0, pos = 0;
@ -302,14 +286,11 @@ namespace http
 		if (eoh == std::string::npos)
 			return 0; /* str not contains complete request */

-		while ((eol = str.find(CRLF, pos)) != std::string::npos) 
-		{
-			if (expect == REQ_LINE) 
-			{
-				std::string_view line = str.substr(pos, eol - pos);
-				std::vector<std::string_view> tokens;
+		while ((eol = str.find(CRLF, pos)) != std::string::npos) {
+			if (expect == REQ_LINE) {
+				std::string line = str.substr(pos, eol - pos);
+				std::vector<std::string> tokens;
 				strsplit(line, tokens, ' ');
-				
 				if (tokens.size() != 3)
 					return -1;
 				if (!is_http_method(tokens[0]))
@ -326,18 +307,18 @@ namespace http
 			}
 			else
 			{
-				std::string_view line = str.substr(pos, eol - pos);
+				std::string line = str.substr(pos, eol - pos);
 				auto p = parse_header_line(line);
 				if (p.first.length () > 0)
 					headers.push_back (p);
 				else
 					return -1;
 			}
-			pos = eol + CRLF.length();
+			pos = eol + strlen(CRLF);
 			if (pos >= eoh)
 				break;
 		}
-		return eoh + HTTP_EOH.length();
+		return eoh + strlen(HTTP_EOH);
 	}

 	void HTTPReq::write(std::ostream & o)
@ -381,7 +362,7 @@ namespace http
 		}
 	}

-	std::string HTTPReq::GetHeader (std::string_view name) const
+	std::string HTTPReq::GetHeader (const std::string& name) const
 	{
 		for (auto& it : headers)
 			if (it.first == name)
@ -389,7 +370,7 @@ namespace http
 		return "";
 	}

-	size_t HTTPReq::GetNumHeaders (std::string_view name) const
+	size_t HTTPReq::GetNumHeaders (const std::string& name) const
 	{
 		size_t num = 0;
 		for (auto& it : headers)
@ -432,13 +413,12 @@ namespace http
 		return length;
 	}

-	int HTTPRes::parse(const char *buf, size_t len) 
-	{
-		return parse({buf,len});
+	int HTTPRes::parse(const char *buf, size_t len) {
+		std::string str(buf, len);
+		return parse(str);
 	}

-	int HTTPRes::parse(std::string_view str) 
-	{
+	int HTTPRes::parse(const std::string& str) {
 		enum { RES_LINE, HEADER_LINE } expect = RES_LINE;
 		std::size_t eoh = str.find(HTTP_EOH); /* request head size */
 		std::size_t eol = 0, pos = 0;
@ -446,41 +426,35 @@ namespace http
 		if (eoh == std::string::npos)
 			return 0; /* str not contains complete request */

-		while ((eol = str.find(CRLF, pos)) != std::string::npos) 
-		{
-			if (expect == RES_LINE) 
-			{
-				std::string_view line = str.substr(pos, eol - pos);
-				std::vector<std::string_view> tokens;
+		while ((eol = str.find(CRLF, pos)) != std::string::npos) {
+			if (expect == RES_LINE) {
+				std::string line = str.substr(pos, eol - pos);
+				std::vector<std::string> tokens;
 				strsplit(line, tokens, ' ', 3);
 				if (tokens.size() != 3)
 					return -1;
 				if (!is_http_version(tokens[0]))
 					return -1;
-				auto res = std::from_chars(tokens[1].data (), tokens[1].data() + tokens[1].size(), code);
-				if (res.ec != std::errc())
-					return -1;
+				code = atoi(tokens[1].c_str());
 				if (code < 100 || code >= 600)
 					return -1;
 				/* all ok */
 				version = tokens[0];
 				status  = tokens[2];
 				expect  = HEADER_LINE;
-			} 
-			else 
-			{
-				std::string_view line = str.substr(pos, eol - pos);
+			} else {
+				std::string line = str.substr(pos, eol - pos);
 				auto p = parse_header_line(line);
 				if (p.first.length () > 0)
 					headers.insert (p);
 				else
 					return -1;
 			}
-			pos = eol + CRLF.length();
+			pos = eol + strlen(CRLF);
 			if (pos >= eoh)
 				break;
 		}
-		return eoh + HTTP_EOH.length();
+		return eoh + strlen(HTTP_EOH);
 	}

 	std::string HTTPRes::to_string() {
@ -505,11 +479,9 @@ namespace http
 		return ss.str();
 	}

-	std::string_view HTTPCodeToStatus(int code) 
-	{
-		std::string_view ptr;
-		switch (code) 
-		{
+	const char * HTTPCodeToStatus(int code) {
+		const char *ptr;
+		switch (code) {
 			case 105: ptr = "Name Not Resolved"; break;
 			/* success */
 			case 200: ptr = "OK"; break;
@ -536,14 +508,14 @@ namespace http
 		return ptr;
 	}

-	std::string UrlDecode(std::string_view data, bool allow_null)
+	std::string UrlDecode(const std::string& data, bool allow_null)
 	{
 		std::string decoded(data);
 		size_t pos = 0;
 		while ((pos = decoded.find('%', pos)) != std::string::npos)
 		{
-			char c = std::stol(decoded.substr(pos + 1, 2), nullptr, 16);
-			if (!c && !allow_null)
+			char c = strtol(decoded.substr(pos + 1, 2).c_str(), NULL, 16);
+			if (c == '\0' && !allow_null)
 			{
 				pos += 3;
 				continue;
--- a/libi2pd/HTTP.h
+++ b/libi2pd/HTTP.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -14,15 +14,16 @@
 #include <list>
 #include <sstream>
 #include <string>
-#include <string_view>
 #include <vector>

 namespace i2p
 {
 namespace http
 {
-	constexpr std::string_view CRLF = "\r\n";         /**< HTTP line terminator */
-	constexpr std::string_view HTTP_EOH = "\r\n\r\n"; /**< HTTP end-of-headers mark */
+	const char CRLF[] = "\r\n";         /**< HTTP line terminator */
+	const char HTTP_EOH[] = "\r\n\r\n"; /**< HTTP end-of-headers mark */
+	extern const std::vector<std::string> HTTP_METHODS;  /**< list of valid HTTP methods */
+	extern const std::vector<std::string> HTTP_VERSIONS; /**< list of valid HTTP versions */

 	struct URL
 	{
@ -44,7 +45,7 @@ namespace http
 		 * @return true on success, false on invalid url
 		 */
 		bool parse (const char *str, std::size_t len = 0);
-		bool parse (std::string_view url);
+		bool parse (const std::string& url);

 		/**
 		 * @brief Parse query part of url to key/value map
@ -68,7 +69,7 @@ namespace http
 	{
 		std::map<std::string, std::string> headers;

-		void add_header(const char *name, const std::string & value, bool replace = false);
+		void add_header(const char *name, std::string & value, bool replace = false);
 		void add_header(const char *name, const char *value, bool replace = false);
 		void del_header(const char *name);

@ -91,7 +92,7 @@ namespace http
 		 * @note Positive return value is a size of header
 		 */
 		int parse(const char *buf, size_t len);
-		int parse(std::string_view buf);
+		int parse(const std::string& buf);

 		/** @brief Serialize HTTP request to string */
 		std::string to_string();
@ -101,8 +102,8 @@ namespace http
 		void UpdateHeader (const std::string& name, const std::string& value);
 		void RemoveHeader (const std::string& name, const std::string& exempt); // remove all headers starting with name, but exempt
 		void RemoveHeader (const std::string& name) { RemoveHeader (name, ""); };
-		std::string GetHeader (std::string_view name) const;
-		size_t GetNumHeaders (std::string_view name) const;
+		std::string GetHeader (const std::string& name) const;
+		size_t GetNumHeaders (const std::string& name) const;
 		size_t GetNumHeaders () const { return headers.size (); };
 	};

@ -127,7 +128,7 @@ namespace http
 		 * @note Positive return value is a size of header
 		 */
 		int parse(const char *buf, size_t len);
-		int parse(const std::string_view buf);
+		int parse(const std::string& buf);

 		/**
 		 * @brief Serialize HTTP response to string
@ -152,7 +153,7 @@ namespace http
 	 * @param code HTTP code [100, 599]
 	 * @return Immutable string with status
 	 */
-	std::string_view HTTPCodeToStatus(int code);
+	const char * HTTPCodeToStatus(int code);

 	/**
 	 * @brief Replaces %-encoded characters in string with their values
@ -160,7 +161,7 @@ namespace http
 	 * @param null If set to true - decode also %00 sequence, otherwise - skip
 	 * @return Decoded string
 	 */
-	std::string UrlDecode(std::string_view data, bool null = false);
+	std::string UrlDecode(const std::string& data, bool null = false);

 	/**
 	 * @brief Merge HTTP response content with Transfer-Encoding: chunked
--- a/libi2pd/I2NPProtocol.cpp
+++ b/libi2pd/I2NPProtocol.cpp
@ -10,15 +10,20 @@
 #include <atomic>
 #include "Base.h"
 #include "Log.h"
+#include "Crypto.h"
 #include "I2PEndian.h"
 #include "Timestamp.h"
 #include "RouterContext.h"
 #include "NetDb.hpp"
 #include "Tunnel.h"
-#include "TransitTunnel.h"
+#include "Transports.h"
+#include "Garlic.h"
+#include "ECIESX25519AEADRatchetSession.h"
 #include "I2NPProtocol.h"
 #include "version.h"

+using namespace i2p::transport;
+
 namespace i2p
 {
 	std::shared_ptr<I2NPMessage> NewI2NPMessage ()
@ -371,6 +376,337 @@ namespace i2p
 		return !msg->GetPayload ()[DATABASE_STORE_TYPE_OFFSET]; // 0- RouterInfo
 	}

+	static bool HandleBuildRequestRecords (int num, uint8_t * records, uint8_t * clearText)
+	{
+		for (int i = 0; i < num; i++)
+		{
+			uint8_t * record = records + i*TUNNEL_BUILD_RECORD_SIZE;
+			if (!memcmp (record + BUILD_REQUEST_RECORD_TO_PEER_OFFSET, (const uint8_t *)i2p::context.GetRouterInfo ().GetIdentHash (), 16))
+			{
+				LogPrint (eLogDebug, "I2NP: Build request record ", i, " is ours");
+				if (!i2p::context.DecryptTunnelBuildRecord (record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText)) 
+				{
+					LogPrint (eLogWarning, "I2NP: Failed to decrypt tunnel build record");
+					return false;
+				}	
+				if (!memcmp ((const uint8_t *)i2p::context.GetIdentHash (), clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32) && // if next ident is now ours
+				    !(clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG)) // and not endpoint
+				{
+					LogPrint (eLogWarning, "I2NP: Next ident is ours in tunnel build record");
+					return false;
+				}	
+				uint8_t retCode = 0;
+				// replace record to reply
+				if (i2p::context.AcceptsTunnels () && i2p::context.GetCongestionLevel (false) < CONGESTION_LEVEL_FULL)
+				{
+					auto transitTunnel = i2p::tunnel::CreateTransitTunnel (
+							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET),
+							clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
+							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+							clearText + ECIES_BUILD_REQUEST_RECORD_LAYER_KEY_OFFSET,
+							clearText + ECIES_BUILD_REQUEST_RECORD_IV_KEY_OFFSET,
+							clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_GATEWAY_FLAG,
+							clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG);
+					if (!i2p::tunnel::tunnels.AddTransitTunnel (transitTunnel))
+						retCode = 30;
+				}
+				else
+					retCode = 30; // always reject with bandwidth reason (30)
+
+				memset (record + ECIES_BUILD_RESPONSE_RECORD_OPTIONS_OFFSET, 0, 2); // no options
+				record[ECIES_BUILD_RESPONSE_RECORD_RET_OFFSET] = retCode;
+				// encrypt reply
+				i2p::crypto::CBCEncryption encryption;
+				for (int j = 0; j < num; j++)
+				{
+					uint8_t * reply = records + j*TUNNEL_BUILD_RECORD_SIZE;
+					if (j == i)
+					{
+						uint8_t nonce[12];
+						memset (nonce, 0, 12);
+						auto& noiseState = i2p::context.GetCurrentNoiseState ();
+						if (!i2p::crypto::AEADChaCha20Poly1305 (reply, TUNNEL_BUILD_RECORD_SIZE - 16,
+							noiseState.m_H, 32, noiseState.m_CK, nonce, reply, TUNNEL_BUILD_RECORD_SIZE, true)) // encrypt
+						{
+							LogPrint (eLogWarning, "I2NP: Reply AEAD encryption failed");
+							return false;
+						}
+					}
+					else
+					{
+						encryption.SetKey (clearText + ECIES_BUILD_REQUEST_RECORD_REPLY_KEY_OFFSET);
+						encryption.SetIV (clearText + ECIES_BUILD_REQUEST_RECORD_REPLY_IV_OFFSET);
+						encryption.Encrypt(reply, TUNNEL_BUILD_RECORD_SIZE, reply);
+					}
+				}
+				return true;
+			}
+		}
+		return false;
+	}
+
+	static void HandleVariableTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
+	{
+		int num = buf[0];
+		LogPrint (eLogDebug, "I2NP: VariableTunnelBuild ", num, " records");
+		if (num > i2p::tunnel::MAX_NUM_RECORDS)
+		{
+			LogPrint (eLogError, "I2NP: Too many records in VaribleTunnelBuild message ", num);
+			return;
+		}
+		if (len < num*TUNNEL_BUILD_RECORD_SIZE + 1)
+		{
+			LogPrint (eLogError, "I2NP: VaribleTunnelBuild message of ", num, " records is too short ", len);
+			return;
+		}
+
+		auto tunnel = i2p::tunnel::tunnels.GetPendingInboundTunnel (replyMsgID);
+		if (tunnel)
+		{
+			// endpoint of inbound tunnel
+			LogPrint (eLogDebug, "I2NP: VariableTunnelBuild reply for tunnel ", tunnel->GetTunnelID ());
+			if (tunnel->HandleTunnelBuildResponse (buf, len))
+			{
+				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been created");
+				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
+				i2p::tunnel::tunnels.AddInboundTunnel (tunnel);
+			}
+			else
+			{
+				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been declined");
+				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
+			}
+		}
+		else
+		{
+			uint8_t clearText[ECIES_BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE];
+			if (HandleBuildRequestRecords (num, buf + 1, clearText))
+			{
+				if (clearText[ECIES_BUILD_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG) // we are endpoint of outboud tunnel
+				{
+					// so we send it to reply tunnel
+					transports.SendMessage (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
+						CreateTunnelGatewayMsg (bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+							eI2NPVariableTunnelBuildReply, buf, len,
+							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
+				}
+				else
+					transports.SendMessage (clearText + ECIES_BUILD_REQUEST_RECORD_NEXT_IDENT_OFFSET,
+						CreateI2NPMessage (eI2NPVariableTunnelBuild, buf, len,
+							bufbe32toh (clearText + ECIES_BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET)));
+			}
+		}
+	}
+
+	static void HandleTunnelBuildMsg (uint8_t * buf, size_t len)
+	{
+		LogPrint (eLogWarning, "I2NP: TunnelBuild is too old for ECIES router");
+	}
+
+	static void HandleTunnelBuildReplyMsg (uint32_t replyMsgID, uint8_t * buf, size_t len, bool isShort)
+	{
+		int num = buf[0];
+		LogPrint (eLogDebug, "I2NP: TunnelBuildReplyMsg of ", num, " records replyMsgID=", replyMsgID);
+		if (num > i2p::tunnel::MAX_NUM_RECORDS)
+		{
+			LogPrint (eLogError, "I2NP: Too many records in TunnelBuildReply message ", num);
+			return;
+		}
+		size_t recordSize = isShort ? SHORT_TUNNEL_BUILD_RECORD_SIZE : TUNNEL_BUILD_RECORD_SIZE;
+		if (len < num*recordSize + 1)
+		{
+			LogPrint (eLogError, "I2NP: TunnelBuildReply message of ", num, " records is too short ", len);
+			return;
+		}
+
+		auto tunnel = i2p::tunnel::tunnels.GetPendingOutboundTunnel (replyMsgID);
+		if (tunnel)
+		{
+			// reply for outbound tunnel
+			if (tunnel->HandleTunnelBuildResponse (buf, len))
+			{
+				LogPrint (eLogInfo, "I2NP: Outbound tunnel ", tunnel->GetTunnelID (), " has been created");
+				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
+				i2p::tunnel::tunnels.AddOutboundTunnel (tunnel);
+			}
+			else
+			{
+				LogPrint (eLogInfo, "I2NP: Outbound tunnel ", tunnel->GetTunnelID (), " has been declined");
+				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
+			}
+		}
+		else
+			LogPrint (eLogWarning, "I2NP: Pending tunnel for message ", replyMsgID, " not found");
+	}
+
+	static void HandleShortTunnelBuildMsg (uint32_t replyMsgID, uint8_t * buf, size_t len)
+	{
+		int num = buf[0];
+		LogPrint (eLogDebug, "I2NP: ShortTunnelBuild ", num, " records");
+		if (num > i2p::tunnel::MAX_NUM_RECORDS)
+		{
+			LogPrint (eLogError, "I2NP: Too many records in ShortTunnelBuild message ", num);
+			return;
+		}
+		if (len < num*SHORT_TUNNEL_BUILD_RECORD_SIZE + 1)
+		{
+			LogPrint (eLogError, "I2NP: ShortTunnelBuild message of ", num, " records is too short ", len);
+			return;
+		}
+		auto tunnel = i2p::tunnel::tunnels.GetPendingInboundTunnel (replyMsgID);
+		if (tunnel)
+		{
+			// endpoint of inbound tunnel
+			LogPrint (eLogDebug, "I2NP: ShortTunnelBuild reply for tunnel ", tunnel->GetTunnelID ());
+			if (tunnel->HandleTunnelBuildResponse (buf, len))
+			{
+				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been created");
+				tunnel->SetState (i2p::tunnel::eTunnelStateEstablished);
+				i2p::tunnel::tunnels.AddInboundTunnel (tunnel);
+			}
+			else
+			{
+				LogPrint (eLogInfo, "I2NP: Inbound tunnel ", tunnel->GetTunnelID (), " has been declined");
+				tunnel->SetState (i2p::tunnel::eTunnelStateBuildFailed);
+			}
+			return;
+		}
+		const uint8_t * record = buf + 1;
+		for (int i = 0; i < num; i++)
+		{
+			if (!memcmp (record, (const uint8_t *)i2p::context.GetRouterInfo ().GetIdentHash (), 16))
+			{
+				LogPrint (eLogDebug, "I2NP: Short request record ", i, " is ours");
+				uint8_t clearText[SHORT_REQUEST_RECORD_CLEAR_TEXT_SIZE];
+				if (!i2p::context.DecryptTunnelShortRequestRecord (record + SHORT_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText))
+				{
+					LogPrint (eLogWarning, "I2NP: Can't decrypt short request record ", i);
+					return;
+				}
+				if (clearText[SHORT_REQUEST_RECORD_LAYER_ENCRYPTION_TYPE]) // not AES
+				{
+					LogPrint (eLogWarning, "I2NP: Unknown layer encryption type ", clearText[SHORT_REQUEST_RECORD_LAYER_ENCRYPTION_TYPE], " in short request record");
+					return;
+				}
+				auto& noiseState = i2p::context.GetCurrentNoiseState ();
+				uint8_t replyKey[32]; // AEAD/Chacha20/Poly1305
+				i2p::crypto::AESKey layerKey, ivKey; // AES
+				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelReplyKey", noiseState.m_CK);
+				memcpy (replyKey, noiseState.m_CK + 32, 32);
+				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelLayerKey", noiseState.m_CK);
+				memcpy (layerKey, noiseState.m_CK + 32, 32);
+				bool isEndpoint = clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG;
+				if (isEndpoint)
+				{
+					i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "TunnelLayerIVKey", noiseState.m_CK);
+					memcpy (ivKey, noiseState.m_CK + 32, 32);
+				}
+				else
+				{	
+					if (!memcmp ((const uint8_t *)i2p::context.GetIdentHash (), clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32)) // if next ident is now ours
+					{
+						LogPrint (eLogWarning, "I2NP: Next ident is ours in short request record");
+						return;
+					}	
+					memcpy (ivKey, noiseState.m_CK , 32);
+				}	
+
+				// check if we accept this tunnel
+				std::shared_ptr<i2p::tunnel::TransitTunnel> transitTunnel;
+				uint8_t retCode = 0;
+				if (!i2p::context.AcceptsTunnels () || i2p::context.GetCongestionLevel (false) >= CONGESTION_LEVEL_FULL)
+					retCode = 30;
+				if (!retCode)
+				{
+					// create new transit tunnel
+					transitTunnel = i2p::tunnel::CreateTransitTunnel (
+						bufbe32toh (clearText + SHORT_REQUEST_RECORD_RECEIVE_TUNNEL_OFFSET),
+						clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET,
+						bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+						layerKey, ivKey,
+						clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_GATEWAY_FLAG,
+						clearText[SHORT_REQUEST_RECORD_FLAG_OFFSET] & TUNNEL_BUILD_RECORD_ENDPOINT_FLAG);
+					if (!i2p::tunnel::tunnels.AddTransitTunnel (transitTunnel))
+						retCode = 30;
+				}
+
+				// encrypt reply
+				uint8_t nonce[12];
+				memset (nonce, 0, 12);
+				uint8_t * reply = buf + 1;
+				for (int j = 0; j < num; j++)
+				{
+					nonce[4] = j; // nonce is record #
+					if (j == i)
+					{
+						memset (reply + SHORT_RESPONSE_RECORD_OPTIONS_OFFSET, 0, 2); // no options
+						reply[SHORT_RESPONSE_RECORD_RET_OFFSET] = retCode;
+						if (!i2p::crypto::AEADChaCha20Poly1305 (reply, SHORT_TUNNEL_BUILD_RECORD_SIZE - 16,
+							noiseState.m_H, 32, replyKey, nonce, reply, SHORT_TUNNEL_BUILD_RECORD_SIZE, true)) // encrypt
+						{
+							LogPrint (eLogWarning, "I2NP: Short reply AEAD encryption failed");
+							return;
+						}
+					}
+					else
+						i2p::crypto::ChaCha20 (reply, SHORT_TUNNEL_BUILD_RECORD_SIZE, replyKey, nonce, reply);
+					reply += SHORT_TUNNEL_BUILD_RECORD_SIZE;
+				}
+				// send reply
+				auto onDrop = [transitTunnel]()
+					{
+						if (transitTunnel)
+						{
+							auto t = transitTunnel->GetCreationTime ();
+							if (t > i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT)
+								// make transit tunnel expired 
+								transitTunnel->SetCreationTime (t - i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT);
+						}	
+					};
+				if (isEndpoint)
+				{
+					auto replyMsg = NewI2NPShortMessage ();
+					replyMsg->Concat (buf, len);
+					replyMsg->FillI2NPMessageHeader (eI2NPShortTunnelBuildReply, bufbe32toh (clearText + SHORT_REQUEST_RECORD_SEND_MSG_ID_OFFSET));
+					if (transitTunnel) replyMsg->onDrop = onDrop;
+					if (memcmp ((const uint8_t *)i2p::context.GetIdentHash (),
+						clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, 32)) // reply IBGW is not local?
+					{
+						i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "RGarlicKeyAndTag", noiseState.m_CK);
+						uint64_t tag;
+						memcpy (&tag, noiseState.m_CK, 8);
+						// we send it to reply tunnel
+						transports.SendMessage (clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET,
+						CreateTunnelGatewayMsg (bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET),
+							i2p::garlic::WrapECIESX25519Message (replyMsg, noiseState.m_CK + 32, tag)));
+					}
+					else
+					{
+						// IBGW is local
+						uint32_t tunnelID = bufbe32toh (clearText + SHORT_REQUEST_RECORD_NEXT_TUNNEL_OFFSET);
+						auto tunnel = i2p::tunnel::tunnels.GetTunnel (tunnelID);
+						if (tunnel)
+						{	
+							tunnel->SendTunnelDataMsg (replyMsg);
+							tunnel->FlushTunnelDataMsgs ();
+						}	
+						else
+							LogPrint (eLogWarning, "I2NP: Tunnel ", tunnelID, " not found for short tunnel build reply");
+					}
+				}
+				else
+				{
+					auto msg = CreateI2NPMessage (eI2NPShortTunnelBuild, buf, len,
+							bufbe32toh (clearText + SHORT_REQUEST_RECORD_SEND_MSG_ID_OFFSET));
+					if (transitTunnel) msg->onDrop = onDrop;
+					transports.SendMessage (clearText + SHORT_REQUEST_RECORD_NEXT_IDENT_OFFSET, msg);
+				}	
+				return;
+			}
+			record += SHORT_TUNNEL_BUILD_RECORD_SIZE;
+		}
+	}
+
 	std::shared_ptr<I2NPMessage> CreateTunnelDataMsg (const uint8_t * buf)
 	{
 		auto msg = NewI2NPTunnelMessage (false);
@ -466,6 +802,41 @@ namespace i2p
 		return l;
 	}

+	void HandleTunnelBuildI2NPMessage (std::shared_ptr<I2NPMessage> msg)
+	{
+		if (msg)
+		{
+			uint8_t typeID = msg->GetTypeID();
+			uint32_t msgID = msg->GetMsgID();
+			LogPrint (eLogDebug, "I2NP: Handling tunnel build message with len=", msg->GetLength(),", type=", (int)typeID, ", msgID=", (unsigned int)msgID);
+			uint8_t * payload = msg->GetPayload();
+			auto size = msg->GetPayloadLength();
+			switch (typeID)
+			{
+				case eI2NPVariableTunnelBuild:
+					HandleVariableTunnelBuildMsg (msgID, payload, size);
+					break;
+				case eI2NPShortTunnelBuild:
+					HandleShortTunnelBuildMsg (msgID, payload, size);
+					break;
+				case eI2NPVariableTunnelBuildReply:
+					HandleTunnelBuildReplyMsg (msgID, payload, size, false);
+					break;
+				case eI2NPShortTunnelBuildReply:
+					HandleTunnelBuildReplyMsg (msgID, payload, size, true);
+					break;
+				case eI2NPTunnelBuild:
+					HandleTunnelBuildMsg (payload, size);
+					break;
+				case eI2NPTunnelBuildReply:
+					// TODO:
+					break;
+				default:
+					LogPrint (eLogError, "I2NP: Unexpected message with type", (int)typeID, " during handling TBM; skipping");
+			}
+		}
+	}
+
 	void HandleI2NPMessage (std::shared_ptr<I2NPMessage> msg)
 	{
 		if (msg)
@ -561,8 +932,14 @@ namespace i2p
 	void I2NPMessagesHandler::Flush ()
 	{
 		if (!m_TunnelMsgs.empty ())
+		{
 			i2p::tunnel::tunnels.PostTunnelData (m_TunnelMsgs);
+			m_TunnelMsgs.clear ();
+		}
 		if (!m_TunnelGatewayMsgs.empty ())
+		{
 			i2p::tunnel::tunnels.PostTunnelData (m_TunnelGatewayMsgs);
+			m_TunnelGatewayMsgs.clear ();
+		}
 	}
 }
--- a/libi2pd/I2NPProtocol.h
+++ b/libi2pd/I2NPProtocol.h
@ -13,7 +13,6 @@
 #include <string.h>
 #include <unordered_set>
 #include <memory>
-#include <list>
 #include <functional>
 #include "Crypto.h"
 #include "I2PEndian.h"
@ -108,6 +107,7 @@ namespace i2p

 	enum I2NPMessageType
 	{
+		eI2NPDummyMsg = 0,
 		eI2NPDatabaseStore = 1,
 		eI2NPDatabaseLookup = 2,
 		eI2NPDatabaseSearchReply = 3,
@ -316,6 +316,7 @@ namespace tunnel
 	std::shared_ptr<I2NPMessage> CreateTunnelGatewayMsg (uint32_t tunnelID, std::shared_ptr<I2NPMessage> msg);

 	size_t GetI2NPMessageLength (const uint8_t * msg, size_t len);
+	void HandleTunnelBuildI2NPMessage (std::shared_ptr<I2NPMessage> msg);
 	void HandleI2NPMessage (std::shared_ptr<I2NPMessage> msg);

 	class I2NPMessagesHandler
@ -328,7 +329,7 @@ namespace tunnel

 		private:

-			std::list<std::shared_ptr<I2NPMessage> > m_TunnelMsgs, m_TunnelGatewayMsgs;
+			std::vector<std::shared_ptr<I2NPMessage> > m_TunnelMsgs, m_TunnelGatewayMsgs;
 	};
 }

--- a/libi2pd/Identity.cpp
+++ b/libi2pd/Identity.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -10,7 +10,6 @@
 #include "I2PEndian.h"
 #include "Log.h"
 #include "Timestamp.h"
-#include "CryptoKey.h"
 #include "Identity.h"

 namespace i2p
@ -28,15 +27,18 @@ namespace data

 	size_t Identity::FromBuffer (const uint8_t * buf, size_t len)
 	{
-		if (len < DEFAULT_IDENTITY_SIZE) return 0; // buffer too small, don't overflow
-		memcpy (this, buf, DEFAULT_IDENTITY_SIZE);
+		if ( len < DEFAULT_IDENTITY_SIZE ) {
+			// buffer too small, don't overflow
+			return 0;
+		}
+		memcpy (publicKey, buf, DEFAULT_IDENTITY_SIZE);
 		return DEFAULT_IDENTITY_SIZE;
 	}

 	IdentHash Identity::Hash () const
 	{
 		IdentHash hash;
-		SHA256((const uint8_t *)this, DEFAULT_IDENTITY_SIZE, hash);
+		SHA256(publicKey, DEFAULT_IDENTITY_SIZE, hash);
 		return hash;
 	}

@ -120,16 +122,6 @@ namespace data
 					memcpy (m_StandardIdentity.signingKey, signingKey, i2p::crypto::GOSTR3410_512_PUBLIC_KEY_LENGTH);
 					break;
 				}
-#if OPENSSL_PQ
-				case SIGNING_KEY_TYPE_MLDSA44:
-				{
-					memcpy (m_StandardIdentity, signingKey, 384);
-					excessLen = i2p::crypto::MLDSA44_PUBLIC_KEY_LENGTH - 384;
-					excessBuf = new uint8_t[excessLen];
-					memcpy (excessBuf, signingKey + 384, excessLen);
-					break;
-				}	
-#endif					
 				default:
 					LogPrint (eLogError, "Identity: Signing key type ", (int)type, " is not supported");
 			}
@ -270,19 +262,23 @@ namespace data
 		return fullLen;
 	}

-	size_t IdentityEx::FromBase64(std::string_view s)
+	size_t IdentityEx::FromBase64(const std::string& s)
 	{
-		std::vector<uint8_t> buf(s.length ()); // binary data can't exceed base64
-		auto len = Base64ToByteStream (s, buf.data(), buf.size ());
+		const size_t slen = s.length();
+		std::vector<uint8_t> buf(slen); // binary data can't exceed base64
+		const size_t len = Base64ToByteStream (s.c_str(), slen, buf.data(), slen);
 		return FromBuffer (buf.data(), len);
 	}

 	std::string IdentityEx::ToBase64 () const
 	{
 		const size_t bufLen = GetFullLen();
+		const size_t strLen = Base64EncodingBufferSize(bufLen);
 		std::vector<uint8_t> buf(bufLen);
+		std::vector<char> str(strLen);
 		size_t l = ToBuffer (buf.data(), bufLen);
-		return i2p::data::ByteStreamToBase64 (buf.data(), l);
+		size_t l1 = i2p::data::ByteStreamToBase64 (buf.data(), l, str.data(), strLen);
+		return std::string (str.data(), l1);
 	}

 	size_t IdentityEx::GetSigningPublicKeyLen () const
@ -359,10 +355,6 @@ namespace data
 				return new i2p::crypto::GOSTR3410_512_Verifier (i2p::crypto::eGOSTR3410TC26A512);
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				return new i2p::crypto::RedDSA25519Verifier ();
-#if OPENSSL_PQ				
-			case SIGNING_KEY_TYPE_MLDSA44:
-				return new i2p::crypto::MLDSA44Verifier ();
-#endif				
 			case SIGNING_KEY_TYPE_RSA_SHA256_2048:
 			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
 			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
@ -384,18 +376,6 @@ namespace data
 				auto keyLen = verifier->GetPublicKeyLen ();
 				if (keyLen <= 128)
 					verifier->SetPublicKey (m_StandardIdentity.signingKey + 128 - keyLen);
-#if OPENSSL_PQ
-				else if (keyLen > 384)
-				{
-					// for post-quantum
-					uint8_t * signingKey = new uint8_t[keyLen];
-					memcpy (signingKey, m_StandardIdentity.signingKey, 384);
-					size_t excessLen = keyLen - 384;
-					memcpy (signingKey + 384, m_ExtendedBuffer + 4, excessLen); // right after signing and crypto key types
-					verifier->SetPublicKey (signingKey);
-					delete[] signingKey;
-				}	
-#endif				
 				else
 				{
 					// for P521
@ -419,14 +399,15 @@ namespace data
 				return std::make_shared<i2p::crypto::ElGamalEncryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				return std::make_shared<i2p::crypto::ECIESX25519AEADRatchetEncryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
+			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				return std::make_shared<i2p::crypto::ECIESP256Encryptor>(key);
 			break;
+			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
+				return std::make_shared<i2p::crypto::ECIESGOSTR3410Encryptor>(key);
+			break;
 			default:
 				LogPrint (eLogError, "Identity: Unknown crypto key type ", (int)keyType);
 		};
@ -570,18 +551,26 @@ namespace data
 		return ret;
 	}

-	size_t PrivateKeys::FromBase64(std::string_view s)
+	size_t PrivateKeys::FromBase64(const std::string& s)
 	{
-		std::vector<uint8_t> buf(s.length ());
-		size_t l = i2p::data::Base64ToByteStream (s, buf.data (), buf.size ());
-		return FromBuffer (buf.data (), l);
+		uint8_t * buf = new uint8_t[s.length ()];
+		size_t l = i2p::data::Base64ToByteStream (s.c_str (), s.length (), buf, s.length ());
+		size_t ret = FromBuffer (buf, l);
+		delete[] buf;
+		return ret;
 	}

 	std::string PrivateKeys::ToBase64 () const
 	{
-		std::vector<uint8_t> buf(GetFullLen ());
-		size_t l = ToBuffer (buf.data (), buf.size ());
-		return i2p::data::ByteStreamToBase64 (buf.data (), l);
+		uint8_t * buf = new uint8_t[GetFullLen ()];
+		char * str = new char[GetFullLen ()*2];
+		size_t l = ToBuffer (buf, GetFullLen ());
+		size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, GetFullLen ()*2);
+		str[l1] = 0;
+		delete[] buf;
+		std::string ret(str);
+		delete[] str;
+		return ret;
 	}

 	void PrivateKeys::Sign (const uint8_t * buf, int len, uint8_t * signature) const
@ -644,11 +633,6 @@ namespace data
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				return new i2p::crypto::RedDSA25519Signer (priv);
 			break;
-#if OPENSSL_PQ
-			case SIGNING_KEY_TYPE_MLDSA44:
-				return new i2p::crypto::MLDSA44Signer (priv);
-			break;	
-#endif				
 			default:
 				LogPrint (eLogError, "Identity: Signing key type ", (int)keyType, " is not supported");
 		}
@ -662,7 +646,8 @@ namespace data

 	size_t PrivateKeys::GetPrivateKeyLen () const
 	{
-		return i2p::crypto::GetCryptoPrivateKeyLen (m_Public->GetCryptoKeyType ());
+		// private key length always 256, but type 4
+		return (m_Public->GetCryptoKeyType () == CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) ? 32 : 256;
 	}

 	uint8_t * PrivateKeys::GetPadding()
@ -688,14 +673,15 @@ namespace data
 				return std::make_shared<i2p::crypto::ElGamalDecryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				return std::make_shared<i2p::crypto::ECIESX25519AEADRatchetDecryptor>(key);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
+			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				return std::make_shared<i2p::crypto::ECIESP256Decryptor>(key);
 			break;
+			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
+				return std::make_shared<i2p::crypto::ECIESGOSTR3410Decryptor>(key);
+			break;
 			default:
 				LogPrint (eLogError, "Identity: Unknown crypto key type ", (int)cryptoType);
 		};
@ -742,7 +728,9 @@ namespace data
 			case SIGNING_KEY_TYPE_RSA_SHA384_3072:
 			case SIGNING_KEY_TYPE_RSA_SHA512_4096:
 				LogPrint (eLogWarning, "Identity: RSA signature type is not supported. Creating EdDSA");
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 				[[fallthrough]];
+#endif
 				// no break here
 			case SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519:
 				i2p::crypto::CreateEDDSA25519RandomKeys (priv, pub);
@ -756,11 +744,6 @@ namespace data
 			case SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519:
 				i2p::crypto::CreateRedDSA25519RandomKeys (priv, pub);
 			break;
-#if OPENSSL_PQ				
-			case SIGNING_KEY_TYPE_MLDSA44:
-				i2p::crypto::CreateMLDSA44RandomKeys (priv, pub);
-			break;	
-#endif				
 			default:
 				LogPrint (eLogWarning, "Identity: Signing key type ", (int)type, " is not supported. Create DSA-SHA1");
 				i2p::crypto::CreateDSARandomKeys (priv, pub); // DSA-SHA1
@ -775,12 +758,13 @@ namespace data
 				i2p::crypto::GenerateElGamalKeyPair(priv, pub);
 			break;
 			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC:
+			case CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST:
 				i2p::crypto::CreateECIESP256RandomKeys (priv, pub);
 			break;
+			case CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC:
+				i2p::crypto::CreateECIESGOSTR3410RandomKeys (priv, pub);
+			break;
 			case CRYPTO_KEY_TYPE_ECIES_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD:
-			case CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD:	
 				i2p::crypto::CreateECIESX25519AEADRatchetRandomKeys (priv, pub);
 			break;
 			default:
--- a/libi2pd/Identity.h
+++ b/libi2pd/Identity.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -12,19 +12,14 @@
 #include <inttypes.h>
 #include <string.h>
 #include <string>
-#include <string_view>
 #include <memory>
 #include <vector>
 #include "Base.h"
 #include "Signature.h"
+#include "CryptoKey.h"

 namespace i2p
 {
-namespace crypto
-{
-	class CryptoKeyEncryptor;
-	class CryptoKeyDecryptor;
-}	
 namespace data
 {
 	typedef Tag<32> IdentHash;
@ -59,8 +54,6 @@ namespace data
 		Identity& operator=(const Keys& keys);
 		size_t FromBuffer (const uint8_t * buf, size_t len);
 		IdentHash Hash () const;
-		operator uint8_t * () { return reinterpret_cast<uint8_t *>(this); }
-		operator const uint8_t * () const { return reinterpret_cast<const uint8_t *>(this); }
 	};

 	Keys CreateRandomKeys ();
@ -70,9 +63,8 @@ namespace data
 	const uint16_t CRYPTO_KEY_TYPE_ELGAMAL = 0;
 	const uint16_t CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC = 1;
 	const uint16_t CRYPTO_KEY_TYPE_ECIES_X25519_AEAD = 4;
-	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM512_X25519_AEAD = 5;
-	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM768_X25519_AEAD = 6;
-	const uint16_t CRYPTO_KEY_TYPE_ECIES_MLKEM1024_X25519_AEAD = 7;
+	const uint16_t CRYPTO_KEY_TYPE_ECIES_P256_SHA256_AES256CBC_TEST = 65280; // TODO: remove later
+	const uint16_t CRYPTO_KEY_TYPE_ECIES_GOSTR3410_CRYPTO_PRO_A_SHA256_AES256CBC = 65281; // TODO: use GOST R 34.11 instead SHA256 and GOST 28147-89 instead AES

 	const uint16_t SIGNING_KEY_TYPE_DSA_SHA1 = 0;
 	const uint16_t SIGNING_KEY_TYPE_ECDSA_SHA256_P256 = 1;
@ -82,11 +74,10 @@ namespace data
 	const uint16_t SIGNING_KEY_TYPE_RSA_SHA384_3072 = 5;
 	const uint16_t SIGNING_KEY_TYPE_RSA_SHA512_4096 = 6;
 	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519 = 7;
-	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519ph = 8; // since openssl 3.0.0
+	const uint16_t SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519ph = 8; // not implemented
 	const uint16_t SIGNING_KEY_TYPE_GOSTR3410_CRYPTO_PRO_A_GOSTR3411_256 = 9;
 	const uint16_t SIGNING_KEY_TYPE_GOSTR3410_TC26_A_512_GOSTR3411_512 = 10; // approved by FSB
 	const uint16_t SIGNING_KEY_TYPE_REDDSA_SHA512_ED25519 = 11; // for LeaseSet2 only
-	const uint16_t SIGNING_KEY_TYPE_MLDSA44 = 12;

 	typedef uint16_t SigningKeyType;
 	typedef uint16_t CryptoKeyType;
@ -108,7 +99,7 @@ namespace data

 			size_t FromBuffer (const uint8_t * buf, size_t len);
 			size_t ToBuffer (uint8_t * buf, size_t len) const;
-			size_t FromBase64(std::string_view s);
+			size_t FromBase64(const std::string& s);
 			std::string ToBase64 () const;
 			const Identity& GetStandardIdentity () const { return m_StandardIdentity; };

@ -142,7 +133,7 @@ namespace data
 			IdentHash m_IdentHash;
 			std::unique_ptr<i2p::crypto::Verifier> m_Verifier;
 			size_t m_ExtendedLen;
-			uint8_t m_ExtendedBuffer[MAX_EXTENDED_BUFFER_SIZE]; // TODO: support PQ keys
+			uint8_t m_ExtendedBuffer[MAX_EXTENDED_BUFFER_SIZE];
 	};

 	size_t GetIdentityBufferLen (const uint8_t * buf, size_t len); // return actual identity length in buffer
@ -171,7 +162,7 @@ namespace data
 			size_t FromBuffer (const uint8_t * buf, size_t len);
 			size_t ToBuffer (uint8_t * buf, size_t len) const;

-			size_t FromBase64(std::string_view s);
+			size_t FromBase64(const std::string& s);
 			std::string ToBase64 () const;

 			std::shared_ptr<i2p::crypto::CryptoKeyDecryptor> CreateDecryptor (const uint8_t * key) const;
--- a/libi2pd/LeaseSet.cpp
+++ b/libi2pd/LeaseSet.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -14,7 +14,6 @@
 #include "Timestamp.h"
 #include "NetDb.hpp"
 #include "Tunnel.h"
-#include "CryptoKey.h"
 #include "LeaseSet.h"

 namespace i2p
@ -400,7 +399,6 @@ namespace data
 		offset += propertiesLen; // skip for now. TODO: implement properties
 		// key sections
 		CryptoKeyType preferredKeyType = m_EncryptionType;
-		m_EncryptionType = 0;
 		bool preferredKeyFound = false;
 		if (offset + 1 > len) return 0;
 		int numKeySections = buf[offset]; offset++;
@ -412,39 +410,21 @@ namespace data
 			if (offset + encryptionKeyLen > len) return 0;
 			if (IsStoreLeases () && !preferredKeyFound) // create encryptor with leases only
 			{
-				// we pick max key type if preferred not found
-#if !OPENSSL_PQ
-				if (keyType <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD) // skip PQ keys if not supported
-#endif			
-				{	
-					if (keyType == preferredKeyType || !m_Encryptor || keyType > m_EncryptionType)
-					{
+				// we pick first valid key if preferred not found
 				auto encryptor = i2p::data::IdentityEx::CreateEncryptor (keyType, buf + offset);
-						if (encryptor)
+				if (encryptor && (!m_Encryptor || keyType == preferredKeyType))
 				{
 					m_Encryptor = encryptor; // TODO: atomic
 					m_EncryptionType = keyType;
 					if (keyType == preferredKeyType) preferredKeyFound = true;
 				}
 			}
-				}	
-			}
 			offset += encryptionKeyLen;
 		}
 		// leases
 		if (offset + 1 > len) return 0;
 		int numLeases = buf[offset]; offset++;
 		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
-		if (GetExpirationTime () > ts + LEASESET_EXPIRATION_TIME_THRESHOLD)
-		{
-			LogPrint (eLogWarning, "LeaseSet2: Expiration time is from future ", GetExpirationTime ()/1000LL);
-			return 0;
-		}	
-		if (ts > m_PublishedTimestamp*1000LL + LEASESET_EXPIRATION_TIME_THRESHOLD)
-		{
-			LogPrint (eLogWarning, "LeaseSet2: Published time is too old ", m_PublishedTimestamp);
-			return 0;
-		}	
 		if (IsStoreLeases ())
 		{
 			UpdateLeasesBegin ();
@ -455,11 +435,6 @@ namespace data
 				lease.tunnelGateway = buf + offset; offset += 32; // gateway
 				lease.tunnelID = bufbe32toh (buf + offset); offset += 4; // tunnel ID
 				lease.endDate = bufbe32toh (buf + offset)*1000LL; offset += 4; // end date
-				if (lease.endDate > ts + LEASESET_EXPIRATION_TIME_THRESHOLD)
-				{
-					LogPrint (eLogWarning, "LeaseSet2: Lease end date is from future ", lease.endDate);
-					return 0;
-				}	
 				UpdateLease (lease, ts);
 			}
 			UpdateLeasesEnd ();
@ -753,41 +728,25 @@ namespace data
 		memset (m_Buffer + offset, 0, signingKeyLen);
 		offset += signingKeyLen;
 		// num leases
-		auto numLeasesPos = offset;	
 		m_Buffer[offset] = num;
 		offset++;
 		// leases
 		m_Leases = m_Buffer + offset;
 		auto currentTime = i2p::util::GetMillisecondsSinceEpoch ();
-		int skipped = 0;
 		for (int i = 0; i < num; i++)
 		{
-			uint64_t ts = tunnels[i]->GetCreationTime () + i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT - i2p::tunnel::TUNNEL_EXPIRATION_THRESHOLD; // 1 minute before expiration
-			ts *= 1000; // in milliseconds
-			if (ts <= currentTime)
-			{
-				// already expired, skip
-				skipped++;
-				continue;
-			}	
-			if (ts > m_ExpirationTime) m_ExpirationTime = ts;
-			// make sure leaseset is newer than previous, but adding some time to expiration date
-			ts += (currentTime - tunnels[i]->GetCreationTime ()*1000LL)*2/i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT; // up to 2 secs
 			memcpy (m_Buffer + offset, tunnels[i]->GetNextIdentHash (), 32);
 			offset += 32; // gateway id
 			htobe32buf (m_Buffer + offset, tunnels[i]->GetNextTunnelID ());
 			offset += 4; // tunnel id
+			uint64_t ts = tunnels[i]->GetCreationTime () + i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT - i2p::tunnel::TUNNEL_EXPIRATION_THRESHOLD; // 1 minute before expiration
+			ts *= 1000; // in milliseconds
+			if (ts > m_ExpirationTime) m_ExpirationTime = ts;
+			// make sure leaseset is newer than previous, but adding some time to expiration date
+			ts += (currentTime - tunnels[i]->GetCreationTime ()*1000LL)*2/i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT; // up to 2 secs
 			htobe64buf (m_Buffer + offset, ts);
 			offset += 8; // end date
 		}
-		if (skipped > 0)
-		{
-			// adjust num leases
-			if (skipped > num) skipped = num;
-			num -= skipped;
-			m_BufferLen -= skipped*LEASE_SIZE;
-			m_Buffer[numLeasesPos] = num;
-		}	
 		// we don't sign it yet. must be signed later on
 	}

@ -848,8 +807,8 @@ namespace data
 	}

 	LocalLeaseSet2::LocalLeaseSet2 (uint8_t storeType, const i2p::data::PrivateKeys& keys,
-		const EncryptionKeys& encryptionKeys, const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels,
-		bool isPublic, uint64_t publishedTimestamp, bool isPublishedEncrypted):
+		const KeySections& encryptionKeys, const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels,
+		bool isPublic, bool isPublishedEncrypted):
 		LocalLeaseSet (keys.GetPublic (), nullptr, 0)
 	{
 		auto identity = keys.GetPublic ();
@ -858,7 +817,7 @@ namespace data
 		if (num > MAX_NUM_LEASES) num = MAX_NUM_LEASES;
 		size_t keySectionsLen = 0;
 		for (const auto& it: encryptionKeys)
-			keySectionsLen += 2/*key type*/ + 2/*key len*/ + it->pub.size()/*key*/;
+			keySectionsLen += 2/*key type*/ + 2/*key len*/ + it.keyLen/*key*/;
 		m_BufferLen = identity->GetFullLen () + 4/*published*/ + 2/*expires*/ + 2/*flag*/ + 2/*properties len*/ +
 			1/*num keys*/ + keySectionsLen + 1/*num leases*/ + num*LEASE2_SIZE + keys.GetSignatureLen ();
 		uint16_t flags = 0;
@ -878,7 +837,8 @@ namespace data
 		m_Buffer[0] = storeType;
 		// LS2 header
 		auto offset = identity->ToBuffer (m_Buffer + 1, m_BufferLen) + 1;
-		htobe32buf (m_Buffer + offset, publishedTimestamp); offset += 4; // published timestamp (seconds)
+		auto timestamp = i2p::util::GetSecondsSinceEpoch ();
+		htobe32buf (m_Buffer + offset, timestamp); offset += 4; // published timestamp (seconds)
 		uint8_t * expiresBuf = m_Buffer + offset; offset += 2; // expires, fill later
 		htobe16buf (m_Buffer + offset, flags); offset += 2; // flags
 		if (keys.IsOfflineSignature ())
@ -893,50 +853,35 @@ namespace data
 		m_Buffer[offset] = encryptionKeys.size (); offset++; // 1 key
 		for (const auto& it: encryptionKeys)
 		{
-			htobe16buf (m_Buffer + offset, it->keyType); offset += 2; // key type
-			htobe16buf (m_Buffer + offset, it->pub.size()); offset += 2; // key len
-			memcpy (m_Buffer + offset, it->pub.data(), it->pub.size()); offset += it->pub.size(); // key
+			htobe16buf (m_Buffer + offset, it.keyType); offset += 2; // key type
+			htobe16buf (m_Buffer + offset, it.keyLen); offset += 2; // key len
+			memcpy (m_Buffer + offset, it.encryptionPublicKey, it.keyLen); offset += it.keyLen; // key
 		}
 		// leases
 		uint32_t expirationTime = 0; // in seconds
-		int skipped = 0; auto numLeasesPos = offset;
 		m_Buffer[offset] = num; offset++; // num leases
 		for (int i = 0; i < num; i++)
 		{
-			auto ts = tunnels[i]->GetCreationTime () + i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT - i2p::tunnel::TUNNEL_EXPIRATION_THRESHOLD; // in seconds, 1 minute before expiration
-			if (ts <= publishedTimestamp) 
-			{	
-				// already expired, skip
-				skipped++;
-				continue; 
-			}	
-			if (ts > expirationTime) expirationTime = ts;
 			memcpy (m_Buffer + offset, tunnels[i]->GetNextIdentHash (), 32);
 			offset += 32; // gateway id
 			htobe32buf (m_Buffer + offset, tunnels[i]->GetNextTunnelID ());
 			offset += 4; // tunnel id
+			auto ts = tunnels[i]->GetCreationTime () + i2p::tunnel::TUNNEL_EXPIRATION_TIMEOUT - i2p::tunnel::TUNNEL_EXPIRATION_THRESHOLD; // in seconds, 1 minute before expiration
+			if (ts > expirationTime) expirationTime = ts;
 			htobe32buf (m_Buffer + offset, ts);
 			offset += 4; // end date
 		}
-		if (skipped > 0)
-		{
-			// adjust num leases
-			if (skipped > num) skipped = num;
-			num -= skipped;
-			m_BufferLen -= skipped*LEASE2_SIZE;
-			m_Buffer[numLeasesPos] = num;
-		}	
 		// update expiration
 		if (expirationTime)
 		{
 			SetExpirationTime (expirationTime*1000LL);
-			auto expires = (int)expirationTime - publishedTimestamp;
+			auto expires = (int)expirationTime - timestamp;
 			htobe16buf (expiresBuf, expires > 0 ? expires : 0);
 		}
 		else
 		{
 			// no tunnels or withdraw
-			SetExpirationTime (publishedTimestamp*1000LL);
+			SetExpirationTime (timestamp*1000LL);
 			memset (expiresBuf, 0, 2); // expires immeditely
 		}
 		// sign
--- a/libi2pd/LeaseSet.h
+++ b/libi2pd/LeaseSet.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2023, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -12,14 +12,12 @@
 #include <inttypes.h>
 #include <string.h>
 #include <vector>
-#include <list>
 #include <set>
 #include <memory>
 #include "Identity.h"
 #include "Timestamp.h"
 #include "I2PEndian.h"
 #include "Blinding.h"
-#include "CryptoKey.h"

 namespace i2p
 {
@ -64,7 +62,6 @@ namespace data
 	const size_t LEASE_SIZE = 44; // 32 + 4 + 8
 	const size_t LEASE2_SIZE = 40; // 32 + 4 + 4
 	const uint8_t MAX_NUM_LEASES = 16;
-	const uint64_t LEASESET_EXPIRATION_TIME_THRESHOLD = 12*60*1000; // in milliseconds

 	const uint8_t NETDB_STORE_TYPE_LEASESET = 1;
 	class LeaseSet: public RoutingDestination
@ -152,8 +149,8 @@ namespace data
 		public:

 			LeaseSet2 (uint8_t storeType): LeaseSet (true), m_StoreType (storeType) {}; // for update
-			LeaseSet2 (uint8_t storeType, const uint8_t * buf, size_t len, bool storeLeases = true, CryptoKeyType preferredCrypto = CRYPTO_KEY_TYPE_ECIES_X25519_AEAD);
-			LeaseSet2 (const uint8_t * buf, size_t len, std::shared_ptr<const BlindedPublicKey> key, const uint8_t * secret = nullptr, CryptoKeyType preferredCrypto = CRYPTO_KEY_TYPE_ECIES_X25519_AEAD); // store type 5, called from local netdb only
+			LeaseSet2 (uint8_t storeType, const uint8_t * buf, size_t len, bool storeLeases = true, CryptoKeyType preferredCrypto = CRYPTO_KEY_TYPE_ELGAMAL);
+			LeaseSet2 (const uint8_t * buf, size_t len, std::shared_ptr<const BlindedPublicKey> key, const uint8_t * secret = nullptr, CryptoKeyType preferredCrypto = CRYPTO_KEY_TYPE_ELGAMAL); // store type 5, called from local netdb only
 			uint8_t GetStoreType () const { return m_StoreType; };
 			uint32_t GetPublishedTimestamp () const { return m_PublishedTimestamp; };
 			bool IsPublic () const { return m_IsPublic; };
@ -183,7 +180,7 @@ namespace data
 		private:

 			uint8_t m_StoreType;
-			uint32_t m_PublishedTimestamp = 0; // seconds
+			uint32_t m_PublishedTimestamp = 0;
 			bool m_IsPublic = true, m_IsPublishedEncrypted = false;
 			std::shared_ptr<i2p::crypto::Verifier> m_TransientVerifier;
 			CryptoKeyType m_EncryptionType;
@ -249,13 +246,17 @@ namespace data
 	{
 		public:

-			typedef std::list<std::shared_ptr<const i2p::crypto::LocalEncryptionKey> > EncryptionKeys;
+			struct KeySection
+			{
+				uint16_t keyType, keyLen;
+				const uint8_t * encryptionPublicKey;
+			};
+			typedef std::vector<KeySection> KeySections;

 			LocalLeaseSet2 (uint8_t storeType, const i2p::data::PrivateKeys& keys,
-				const EncryptionKeys& encryptionKeys,
+				const KeySections& encryptionKeys,
 				const std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> >& tunnels,
-				bool isPublic, uint64_t publishedTimestamp,
-			    bool isPublishedEncrypted = false);
+				bool isPublic, bool isPublishedEncrypted = false);

 			LocalLeaseSet2 (uint8_t storeType, std::shared_ptr<const IdentityEx> identity, const uint8_t * buf, size_t len); // from I2CP

--- a/libi2pd/Log.h
+++ b/libi2pd/Log.h
@ -172,6 +172,16 @@ void LogPrint (std::stringstream& s, TValue&& arg) noexcept
 	s << std::forward<TValue>(arg);
 }

+#if (__cplusplus < 201703L) // below C++ 17
+/** internal usage only -- folding args array to single string */
+template<typename TValue, typename... TArgs>
+void LogPrint (std::stringstream& s, TValue&& arg, TArgs&&... args) noexcept
+{
+	LogPrint (s, std::forward<TValue>(arg));
+	LogPrint (s, std::forward<TArgs>(args)...);
+}
+#endif
+
 /**
 * @brief Create log message and send it to queue
 * @param level Message level (eLogError, eLogInfo, ...)
@ -184,7 +194,13 @@ void LogPrint (LogLevel level, TArgs&&... args) noexcept

 	// fold message to single string
 	std::stringstream ss;
+
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 	(LogPrint (ss, std::forward<TArgs>(args)), ...);
+#else
+	LogPrint (ss, std::forward<TArgs>(args)...);
+#endif
+
 	auto msg = std::make_shared<i2p::log::LogMsg>(level, std::time(nullptr), std::move(ss).str());
 	msg->tid = std::this_thread::get_id();
 	i2p::log::Logger().Append(msg);
@ -201,7 +217,11 @@ void ThrowFatal (TArgs&&... args) noexcept
 	if (!f) return;
 	// fold message to single string
 	std::stringstream ss("");
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 	(LogPrint (ss, std::forward<TArgs>(args)), ...);
+#else
+	LogPrint (ss, std::forward<TArgs>(args)...);
+#endif
 	f (ss.str ());
 }

--- a/libi2pd/NTCP2.cpp
+++ b/libi2pd/NTCP2.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -42,29 +42,28 @@ namespace transport
 		delete[] m_SessionConfirmedBuffer;
 	}

-	bool NTCP2Establisher::KeyDerivationFunction1 (const uint8_t * pub, i2p::crypto::X25519Keys& priv, const uint8_t * rs, const uint8_t * epub)
+	void NTCP2Establisher::KeyDerivationFunction1 (const uint8_t * pub, i2p::crypto::X25519Keys& priv, const uint8_t * rs, const uint8_t * epub)
 	{
 		i2p::crypto::InitNoiseXKState (*this, rs);
 		// h = SHA256(h || epub)
 		MixHash (epub, 32);
 		// x25519 between pub and priv
 		uint8_t inputKeyMaterial[32];
-		if (!priv.Agree (pub, inputKeyMaterial)) return false;
+		priv.Agree (pub, inputKeyMaterial);
 		MixKey (inputKeyMaterial);
-		return true;
 	}

-	bool NTCP2Establisher::KDF1Alice ()
+	void NTCP2Establisher::KDF1Alice ()
 	{
-		return KeyDerivationFunction1 (m_RemoteStaticKey, *m_EphemeralKeys, m_RemoteStaticKey, GetPub ());
+		KeyDerivationFunction1 (m_RemoteStaticKey, *m_EphemeralKeys, m_RemoteStaticKey, GetPub ());
 	}

-	bool NTCP2Establisher::KDF1Bob ()
+	void NTCP2Establisher::KDF1Bob ()
 	{
-		return KeyDerivationFunction1 (GetRemotePub (), i2p::context.GetNTCP2StaticKeys (), i2p::context.GetNTCP2StaticPublicKey (), GetRemotePub ());
+		KeyDerivationFunction1 (GetRemotePub (), i2p::context.GetNTCP2StaticKeys (), i2p::context.GetNTCP2StaticPublicKey (), GetRemotePub ());
 	}

-	bool NTCP2Establisher::KeyDerivationFunction2 (const uint8_t * sessionRequest, size_t sessionRequestLen, const uint8_t * epub)
+	void NTCP2Establisher::KeyDerivationFunction2 (const uint8_t * sessionRequest, size_t sessionRequestLen, const uint8_t * epub)
 	{
 		MixHash (sessionRequest + 32, 32); // encrypted payload

@ -75,35 +74,33 @@ namespace transport

 		// x25519 between remote pub and ephemaral priv
 		uint8_t inputKeyMaterial[32];
-		if (!m_EphemeralKeys->Agree (GetRemotePub (), inputKeyMaterial)) return false;
+		m_EphemeralKeys->Agree (GetRemotePub (), inputKeyMaterial);
+
 		MixKey (inputKeyMaterial);
-		return true;
 	}

-	bool NTCP2Establisher::KDF2Alice ()
+	void NTCP2Establisher::KDF2Alice ()
 	{
-		return KeyDerivationFunction2 (m_SessionRequestBuffer, m_SessionRequestBufferLen, GetRemotePub ());
+		KeyDerivationFunction2 (m_SessionRequestBuffer, m_SessionRequestBufferLen, GetRemotePub ());
 	}

-	bool NTCP2Establisher::KDF2Bob ()
+	void NTCP2Establisher::KDF2Bob ()
 	{
-		return KeyDerivationFunction2 (m_SessionRequestBuffer, m_SessionRequestBufferLen, GetPub ());
+		KeyDerivationFunction2 (m_SessionRequestBuffer, m_SessionRequestBufferLen, GetPub ());
 	}

-	bool NTCP2Establisher::KDF3Alice ()
+	void NTCP2Establisher::KDF3Alice ()
 	{
 		uint8_t inputKeyMaterial[32];
-		if (!i2p::context.GetNTCP2StaticKeys ().Agree (GetRemotePub (), inputKeyMaterial)) return false;
+		i2p::context.GetNTCP2StaticKeys ().Agree (GetRemotePub (), inputKeyMaterial);
 		MixKey (inputKeyMaterial);
-		return true;
 	}

-	bool NTCP2Establisher::KDF3Bob ()
+	void NTCP2Establisher::KDF3Bob ()
 	{
 		uint8_t inputKeyMaterial[32];
-		if (!m_EphemeralKeys->Agree (m_RemoteStaticKey, inputKeyMaterial)) return false;
+		m_EphemeralKeys->Agree (m_RemoteStaticKey, inputKeyMaterial);
 		MixKey (inputKeyMaterial);
-		return true;
 	}

 	void NTCP2Establisher::CreateEphemeralKey ()
@ -111,19 +108,20 @@ namespace transport
 		m_EphemeralKeys = i2p::transport::transports.GetNextX25519KeysPair ();
 	}

-	bool NTCP2Establisher::CreateSessionRequestMessage (std::mt19937& rng)
+	void NTCP2Establisher::CreateSessionRequestMessage ()
 	{
 		// create buffer and fill padding
-		auto paddingLength = rng () % (NTCP2_SESSION_REQUEST_MAX_SIZE - 64); // message length doesn't exceed 287 bytes
+		auto paddingLength = rand () % (NTCP2_SESSION_REQUEST_MAX_SIZE - 64); // message length doesn't exceed 287 bytes
 		m_SessionRequestBufferLen = paddingLength + 64;
 		RAND_bytes (m_SessionRequestBuffer + 64, paddingLength);
 		// encrypt X
 		i2p::crypto::CBCEncryption encryption;
 		encryption.SetKey (m_RemoteIdentHash);
-		encryption.Encrypt (GetPub (), 32, m_IV, m_SessionRequestBuffer); // X
-		memcpy (m_IV, m_SessionRequestBuffer + 16, 16); // save last block as IV for SessionCreated
+		encryption.SetIV (m_IV);
+		encryption.Encrypt (GetPub (), 32, m_SessionRequestBuffer); // X
+		encryption.GetIV (m_IV); // save IV for SessionCreated
 		// encryption key for next block
-		if (!KDF1Alice ()) return false;
+		KDF1Alice ();
 		// fill options
 		uint8_t options[32]; // actual options size is 16 bytes
 		memset (options, 0, 16);
@ -145,40 +143,36 @@ namespace transport
 		// 2 bytes reserved
 		htobe32buf (options + 8, (i2p::util::GetMillisecondsSinceEpoch () + 500)/1000); // tsA, rounded to seconds
 		// 4 bytes reserved
-		// encrypt options
-		if (!Encrypt (options, m_SessionRequestBuffer + 32, 16))
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionRequest failed to encrypt options");
-			return false;
-		}	
-		return true;
+		// sign and encrypt options, use m_H as AD
+		uint8_t nonce[12];
+		memset (nonce, 0, 12); // set nonce to zero
+		i2p::crypto::AEADChaCha20Poly1305 (options, 16, GetH (), 32, GetK (), nonce, m_SessionRequestBuffer + 32, 32, true); // encrypt
 	}

-	bool NTCP2Establisher::CreateSessionCreatedMessage (std::mt19937& rng)
+	void NTCP2Establisher::CreateSessionCreatedMessage ()
 	{
-		auto paddingLen = rng () % (NTCP2_SESSION_CREATED_MAX_SIZE - 64);
+		auto paddingLen = rand () % (NTCP2_SESSION_CREATED_MAX_SIZE - 64);
 		m_SessionCreatedBufferLen = paddingLen + 64;
 		RAND_bytes (m_SessionCreatedBuffer + 64, paddingLen);
 		// encrypt Y
 		i2p::crypto::CBCEncryption encryption;
 		encryption.SetKey (i2p::context.GetIdentHash ());
-		encryption.Encrypt (GetPub (), 32, m_IV, m_SessionCreatedBuffer); // Y
+		encryption.SetIV (m_IV);
+		encryption.Encrypt (GetPub (), 32, m_SessionCreatedBuffer); // Y
 		// encryption key for next block (m_K)
-		if (!KDF2Bob ()) return false;
+		KDF2Bob ();
 		uint8_t options[16];
 		memset (options, 0, 16);
 		htobe16buf (options + 2, paddingLen); // padLen
 		htobe32buf (options + 8, (i2p::util::GetMillisecondsSinceEpoch () + 500)/1000); // tsB, rounded to seconds
-		// encrypt options
-		if (!Encrypt (options, m_SessionCreatedBuffer + 32, 16))
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionCreated failed to encrypt options");
-			return false;
-		}	
-		return true;
+		// sign and encrypt options, use m_H as AD
+		uint8_t nonce[12];
+		memset (nonce, 0, 12); // set nonce to zero
+		i2p::crypto::AEADChaCha20Poly1305 (options, 16, GetH (), 32, GetK (), nonce, m_SessionCreatedBuffer + 32, 32, true); // encrypt
+
 	}

-	bool NTCP2Establisher::CreateSessionConfirmedMessagePart1 ()
+	void NTCP2Establisher::CreateSessionConfirmedMessagePart1 (const uint8_t * nonce)
 	{
 		// update AD
 		MixHash (m_SessionCreatedBuffer + 32, 32);	// encrypted payload
@ -186,31 +180,21 @@ namespace transport
 		if (paddingLength > 0)
 			MixHash (m_SessionCreatedBuffer + 64, paddingLength);

-		// part1 48 bytes, n = 1
-		if (!Encrypt (i2p::context.GetNTCP2StaticPublicKey (), m_SessionConfirmedBuffer, 32))
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionConfirmed failed to encrypt part1");
-			return false;
-		}	
-		return true;		
+		// part1 48 bytes
+		i2p::crypto::AEADChaCha20Poly1305 (i2p::context.GetNTCP2StaticPublicKey (), 32, GetH (), 32, GetK (), nonce, m_SessionConfirmedBuffer, 48, true); // encrypt
 	}

-	bool NTCP2Establisher::CreateSessionConfirmedMessagePart2 ()
+	void NTCP2Establisher::CreateSessionConfirmedMessagePart2 (const uint8_t * nonce)
 	{
 		// part 2
 		// update AD again
 		MixHash (m_SessionConfirmedBuffer, 48);
 		// encrypt m3p2, it must be filled in SessionRequest
-		if (!KDF3Alice ()) return false; // MixKey, n = 0
+		KDF3Alice ();
 		uint8_t * m3p2 = m_SessionConfirmedBuffer + 48;
-		if (!Encrypt (m3p2, m3p2, m3p2Len - 16))
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionConfirmed failed to encrypt part2");
-			return false;
-		}	
+		i2p::crypto::AEADChaCha20Poly1305 (m3p2, m3p2Len - 16, GetH (), 32, GetK (), nonce, m3p2, m3p2Len, true); // encrypt
 		// update h again
 		MixHash (m3p2, m3p2Len); //h = SHA256(h || ciphertext)
-		return true;
 	}

 	bool NTCP2Establisher::ProcessSessionRequestMessage (uint16_t& paddingLen, bool& clockSkew)
@ -219,17 +203,15 @@ namespace transport
 		// decrypt X
 		i2p::crypto::CBCDecryption decryption;
 		decryption.SetKey (i2p::context.GetIdentHash ());
-		decryption.Decrypt (m_SessionRequestBuffer, 32, i2p::context.GetNTCP2IV (), GetRemotePub ());
-		memcpy (m_IV, m_SessionRequestBuffer + 16, 16); // save last block as IV for SessionCreated
+		decryption.SetIV (i2p::context.GetNTCP2IV ());
+		decryption.Decrypt (m_SessionRequestBuffer, 32, GetRemotePub ());
+		decryption.GetIV (m_IV); // save IV for SessionCreated
 		// decryption key for next block
-		if (!KDF1Bob ())
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionRequest KDF failed");
-			return false;
-		}	
-		// verify MAC and decrypt options block (32 bytes)
-		uint8_t options[16];
-		if (Decrypt (m_SessionRequestBuffer + 32, options, 16)) 
+		KDF1Bob ();
+		// verify MAC and decrypt options block (32 bytes), use m_H as AD
+		uint8_t nonce[12], options[16];
+		memset (nonce, 0, 12); // set nonce to zero
+		if (i2p::crypto::AEADChaCha20Poly1305 (m_SessionRequestBuffer + 32, 16, GetH (), 32, GetK (), nonce, options, 16, false)) // decrypt
 		{
 			// options
 			if (options[0] && options[0] != i2p::context.GetNetID ())
@ -277,16 +259,15 @@ namespace transport
 		// decrypt Y
 		i2p::crypto::CBCDecryption decryption;
 		decryption.SetKey (m_RemoteIdentHash);
-		decryption.Decrypt (m_SessionCreatedBuffer, 32, m_IV, GetRemotePub ());
+		decryption.SetIV (m_IV);
+		decryption.Decrypt (m_SessionCreatedBuffer, 32, GetRemotePub ());
 		// decryption key for next block (m_K)
-		if (!KDF2Alice ())
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionCreated KDF failed");
-			return false;
-		}	
+		KDF2Alice ();
 		// decrypt and verify MAC
 		uint8_t payload[16];
-		if (Decrypt (m_SessionCreatedBuffer + 32, payload, 16)) 
+		uint8_t nonce[12];
+		memset (nonce, 0, 12); // set nonce to zero
+		if (i2p::crypto::AEADChaCha20Poly1305 (m_SessionCreatedBuffer + 32, 16, GetH (), 32, GetK (), nonce, payload, 16, false)) // decrypt
 		{
 			// options
 			paddingLen = bufbe16toh(payload + 2);
@ -307,7 +288,7 @@ namespace transport
 		return true;
 	}

-	bool NTCP2Establisher::ProcessSessionConfirmedMessagePart1 ()
+	bool NTCP2Establisher::ProcessSessionConfirmedMessagePart1 (const uint8_t * nonce)
 	{
 		// update AD
 		MixHash (m_SessionCreatedBuffer + 32, 32);	// encrypted payload
@ -315,8 +296,7 @@ namespace transport
 		if (paddingLength > 0)
 			MixHash (m_SessionCreatedBuffer + 64, paddingLength);

-		// decrypt S, n = 1
-		if (!Decrypt (m_SessionConfirmedBuffer, m_RemoteStaticKey, 32))
+		if (!i2p::crypto::AEADChaCha20Poly1305 (m_SessionConfirmedBuffer, 32, GetH (), 32, GetK (), nonce, m_RemoteStaticKey, 32, false)) // decrypt S
 		{
 			LogPrint (eLogWarning, "NTCP2: SessionConfirmed Part1 AEAD verification failed ");
 			return false;
@ -324,17 +304,13 @@ namespace transport
 		return true;
 	}

-	bool NTCP2Establisher::ProcessSessionConfirmedMessagePart2 (uint8_t * m3p2Buf)
+	bool NTCP2Establisher::ProcessSessionConfirmedMessagePart2 (const uint8_t * nonce, uint8_t * m3p2Buf)
 	{
 		// update AD again
 		MixHash (m_SessionConfirmedBuffer, 48);

-		if (!KDF3Bob ()) // MixKey, n = 0
-		{
-			LogPrint (eLogWarning, "NTCP2: SessionConfirmed Part2 KDF failed");
-			return false;
-		}	
-		if (Decrypt (m_SessionConfirmedBuffer + 48, m3p2Buf, m3p2Len - 16))
+		KDF3Bob ();
+		if (i2p::crypto::AEADChaCha20Poly1305 (m_SessionConfirmedBuffer + 48, m3p2Len - 16, GetH (), 32, GetK (), nonce, m3p2Buf, m3p2Len - 16, false)) // decrypt
 			// calculate new h again for KDF data
 			MixHash (m_SessionConfirmedBuffer + 48, m3p2Len); // h = SHA256(h || ciphertext)
 		else
@ -351,7 +327,6 @@ namespace transport
 		m_Server (server), m_Socket (m_Server.GetService ()),
 		m_IsEstablished (false), m_IsTerminated (false),
 		m_Establisher (new NTCP2Establisher),
-		m_SendKey (nullptr), m_ReceiveKey (nullptr),
 #if OPENSSL_SIPHASH
 		m_SendMDCtx(nullptr), m_ReceiveMDCtx (nullptr),
 #else
@ -374,7 +349,7 @@ namespace transport
 				LogPrint (eLogWarning, "NTCP2: Missing NTCP2 address");
 		}
 		m_NextRouterInfoResendTime = i2p::util::GetSecondsSinceEpoch () + NTCP2_ROUTERINFO_RESEND_INTERVAL +
-			m_Server.GetRng ()() % NTCP2_ROUTERINFO_RESEND_INTERVAL_THRESHOLD;
+			rand ()%NTCP2_ROUTERINFO_RESEND_INTERVAL_THRESHOLD;
 	}

 	NTCP2Session::~NTCP2Session ()
@ -400,8 +375,6 @@ namespace transport
 			m_Socket.close ();
 			transports.PeerDisconnected (shared_from_this ());
 			m_Server.RemoveNTCP2Session (shared_from_this ());
-			if (!m_IntermediateQueue.empty ())
-				m_SendQueue.splice (m_SendQueue.end (), m_IntermediateQueue);
 			for (auto& it: m_SendQueue)
 				it->Drop ();
 			m_SendQueue.clear ();
@ -431,14 +404,14 @@ namespace transport

 	void NTCP2Session::Done ()
 	{
-		boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+		m_Server.GetService ().post (std::bind (&NTCP2Session::Terminate, shared_from_this ()));
 	}

 	void NTCP2Session::Established ()
 	{
 		m_IsEstablished = true;
 		m_Establisher.reset (nullptr);
-		SetTerminationTimeout (NTCP2_TERMINATION_TIMEOUT + m_Server.GetRng ()() % NTCP2_TERMINATION_TIMEOUT_VARIANCE);
+		SetTerminationTimeout (NTCP2_TERMINATION_TIMEOUT);
 		SendQueue ();
 		transports.PeerConnected (shared_from_this ());
 	}
@ -491,12 +464,7 @@ namespace transport

 	void NTCP2Session::SendSessionRequest ()
 	{
-		if (!m_Establisher->CreateSessionRequestMessage (m_Server.GetRng ()))
-		{
-			LogPrint (eLogWarning, "NTCP2: Send SessionRequest KDF failed");
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-			return;
-		}	
+		m_Establisher->CreateSessionRequestMessage ();
 		// send message
 		m_HandshakeInterval = i2p::util::GetMillisecondsSinceEpoch ();
 		boost::asio::async_write (m_Socket, boost::asio::buffer (m_Establisher->m_SessionRequestBuffer, m_Establisher->m_SessionRequestBufferLen), boost::asio::transfer_all (),
@ -521,6 +489,7 @@ namespace transport

 	void NTCP2Session::HandleSessionRequestReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
 	{
+		(void) bytes_transferred;
 		if (ecode)
 		{
 			LogPrint (eLogWarning, "NTCP2: SessionRequest read error: ", ecode.message ());
@ -528,17 +497,7 @@ namespace transport
 		}
 		else
 		{
-			boost::asio::post (m_Server.GetEstablisherService (), 
-				[s = shared_from_this (), bytes_transferred] ()
-				{
-					s->ProcessSessionRequest (bytes_transferred);;
-				});	
-		}
-	}
-
-	void NTCP2Session::ProcessSessionRequest (size_t len)
-	{
-		LogPrint (eLogDebug, "NTCP2: SessionRequest received ", len);
+			LogPrint (eLogDebug, "NTCP2: SessionRequest received ", bytes_transferred);
 			uint16_t paddingLen = 0;
 			bool clockSkew = false;
 			if (m_Establisher->ProcessSessionRequestMessage (paddingLen, clockSkew))
@ -547,7 +506,7 @@ namespace transport
 				{
 					// we don't care about padding, send SessionCreated and close session
 					SendSessionCreated ();
-				boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+					m_Server.GetService ().post (std::bind (&NTCP2Session::Terminate, shared_from_this ()));
 				}
 				else if (paddingLen > 0)
 				{
@ -559,14 +518,15 @@ namespace transport
 					else
 					{
 						LogPrint (eLogWarning, "NTCP2: SessionRequest padding length ", (int)paddingLen, " is too long");
-					boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+						Terminate ();
 					}
 				}
 				else
 					SendSessionCreated ();
 			}
 			else
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+				Terminate ();
+		}
 	}

 	void NTCP2Session::HandleSessionRequestPaddingReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
@ -577,23 +537,12 @@ namespace transport
 			Terminate ();
 		}
 		else
-		{
-			boost::asio::post (m_Server.GetEstablisherService (), 
-				[s = shared_from_this ()] ()
-				{
-					s->SendSessionCreated ();
-				});	
-		}	
+			SendSessionCreated ();
 	}

 	void NTCP2Session::SendSessionCreated ()
 	{
-		if (!m_Establisher->CreateSessionCreatedMessage (m_Server.GetRng ()))
-		{
-			LogPrint (eLogWarning, "NTCP2: Send SessionCreated KDF failed");
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-			return;
-		}	
+		m_Establisher->CreateSessionCreatedMessage ();
 		// send message
 		m_HandshakeInterval = i2p::util::GetMillisecondsSinceEpoch ();
 		boost::asio::async_write (m_Socket, boost::asio::buffer (m_Establisher->m_SessionCreatedBuffer, m_Establisher->m_SessionCreatedBufferLen), boost::asio::transfer_all (),
@ -610,17 +559,7 @@ namespace transport
 		else
 		{
 			m_HandshakeInterval = i2p::util::GetMillisecondsSinceEpoch () - m_HandshakeInterval;
-			boost::asio::post (m_Server.GetEstablisherService (), 
-				[s = shared_from_this (), bytes_transferred] ()
-				{
-					s->ProcessSessionCreated (bytes_transferred);
-				});	
-		}
-	}
-
-	void NTCP2Session::ProcessSessionCreated (size_t len)
-	{
-		LogPrint (eLogDebug, "NTCP2: SessionCreated received ", len);
+			LogPrint (eLogDebug, "NTCP2: SessionCreated received ", bytes_transferred);
 			uint16_t paddingLen = 0;
 			if (m_Establisher->ProcessSessionCreatedMessage (paddingLen))
 			{
@ -634,7 +573,7 @@ namespace transport
 					else
 					{
 						LogPrint (eLogWarning, "NTCP2: SessionCreated padding length ", (int)paddingLen, " is too long");
-					boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+						Terminate ();
 					}
 				}
 				else
@ -644,7 +583,8 @@ namespace transport
 			{
 				if (GetRemoteIdentity ())
 					i2p::data::netdb.SetUnreachable (GetRemoteIdentity ()->GetIdentHash (), true);  // assume wrong s key
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
+				Terminate ();
+			}	
 		}
 	}

@ -658,27 +598,17 @@ namespace transport
 		else
 		{
 			m_Establisher->m_SessionCreatedBufferLen += bytes_transferred;
-			boost::asio::post (m_Server.GetEstablisherService (), 
-				[s = shared_from_this ()] ()
-				{
-					s->SendSessionConfirmed ();
-				});	
+			SendSessionConfirmed ();
 		}
 	}

 	void NTCP2Session::SendSessionConfirmed ()
 	{
-		if (!m_Establisher->CreateSessionConfirmedMessagePart1 ()) 
-		{
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-			return;
-		}	
-		if (!m_Establisher->CreateSessionConfirmedMessagePart2 ())
-		{
-			LogPrint (eLogWarning, "NTCP2: Send SessionConfirmed Part2 KDF failed");
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-			return;
-		}	
+		uint8_t nonce[12];
+		CreateNonce (1, nonce); // set nonce to 1
+		m_Establisher->CreateSessionConfirmedMessagePart1 (nonce);
+		memset (nonce, 0, 12); // set nonce back to 0
+		m_Establisher->CreateSessionConfirmedMessagePart2 (nonce);
 		// send message
 		boost::asio::async_write (m_Socket, boost::asio::buffer (m_Establisher->m_SessionConfirmedBuffer, m_Establisher->m3p2Len + 48), boost::asio::transfer_all (),
 			std::bind(&NTCP2Session::HandleSessionConfirmedSent, shared_from_this (), std::placeholders::_1, std::placeholders::_2));
@ -730,7 +660,6 @@ namespace transport

 	void NTCP2Session::HandleSessionConfirmedReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred)
 	{
-		(void) bytes_transferred;
 		if (ecode)
 		{
 			LogPrint (eLogWarning, "NTCP2: SessionConfirmed read error: ", ecode.message ());
@ -739,56 +668,17 @@ namespace transport
 		else
 		{
 			m_HandshakeInterval = i2p::util::GetMillisecondsSinceEpoch () - m_HandshakeInterval;
-			boost::asio::post (m_Server.GetEstablisherService (), 
-				[s = shared_from_this ()] ()
-				{
-					s->ProcessSessionConfirmed ();;
-				});	
-		}
-	}
-
-	void NTCP2Session::ProcessSessionConfirmed ()
-	{
-		// run on establisher thread
 			LogPrint (eLogDebug, "NTCP2: SessionConfirmed received");
 			// part 1
-		if (m_Establisher->ProcessSessionConfirmedMessagePart1 ())
+			uint8_t nonce[12];
+			CreateNonce (1, nonce);
+			if (m_Establisher->ProcessSessionConfirmedMessagePart1 (nonce))
 			{
 				// part 2
-			auto buf = std::make_shared<std::vector<uint8_t> > (m_Establisher->m3p2Len - 16); // -MAC
-			if (m_Establisher->ProcessSessionConfirmedMessagePart2 (buf->data ())) // TODO:handle in establisher thread
+				std::vector<uint8_t> buf(m_Establisher->m3p2Len - 16); // -MAC
+				memset (nonce, 0, 12); // set nonce to 0 again
+				if (m_Establisher->ProcessSessionConfirmedMessagePart2 (nonce, buf.data ()))
 				{
-				// payload 
-				// RI block must be first 
-				if ((*buf)[0] != eNTCP2BlkRouterInfo)
-				{
-					LogPrint (eLogWarning, "NTCP2: Unexpected block ", (int)(*buf)[0], " in SessionConfirmed");
-					boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-					return;
-				}
-				auto size = bufbe16toh (buf->data () + 1);
-				if (size > buf->size () - 3 || size > i2p::data::MAX_RI_BUFFER_SIZE + 1)
-				{
-					LogPrint (eLogError, "NTCP2: Unexpected RouterInfo size ", size, " in SessionConfirmed");
-					boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-					return;
-				}
-				boost::asio::post (m_Server.GetService (), 
-					[s = shared_from_this (), buf, size] ()
-					{
-						s->EstablishSessionAfterSessionConfirmed (buf, size);
-					});
-			}
-			else
-				boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));
-		}
-		else
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ()));	
-	}	
-
-	void NTCP2Session::EstablishSessionAfterSessionConfirmed (std::shared_ptr<std::vector<uint8_t> > buf, size_t size)
-	{
-		// run on main NTCP2 thread
 					KeyDerivationFunctionDataPhase ();
 					// Bob data phase keys
 					m_SendKey = m_Kba;
@ -796,9 +686,23 @@ namespace transport
 					SetSipKeys (m_Sipkeysba, m_Sipkeysab);
 					memcpy (m_ReceiveIV.buf, m_Sipkeysab + 16, 8);
 					memcpy (m_SendIV.buf, m_Sipkeysba + 16, 8);
-		// we need to set keys for SendTerminationAndTerminate
+					// payload
+					// process RI
+					if (buf[0] != eNTCP2BlkRouterInfo)
+					{
+						LogPrint (eLogWarning, "NTCP2: Unexpected block ", (int)buf[0], " in SessionConfirmed");
+						Terminate ();
+						return;
+					}
+					auto size = bufbe16toh (buf.data () + 1);
+					if (size > buf.size () - 3)
+					{
+						LogPrint (eLogError, "NTCP2: Unexpected RouterInfo size ", size, " in SessionConfirmed");
+						Terminate ();
+						return;
+					}
 					// TODO: check flag
-		i2p::data::RouterInfo ri (buf->data () + 4, size - 1); // 1 byte block type + 2 bytes size + 1 byte flag
+					i2p::data::RouterInfo ri (buf.data () + 4, size - 1); // 1 byte block type + 2 bytes size + 1 byte flag
 					if (ri.IsUnreachable ())
 					{
 						LogPrint (eLogError, "NTCP2: RouterInfo verification failed in SessionConfirmed from ", GetRemoteEndpoint ());
@ -820,33 +724,8 @@ namespace transport
 						SendTerminationAndTerminate (eNTCP2Message3Error);
 						return;
 					}	
-		// update RouterInfo in netdb
-		auto ri1 = i2p::data::netdb.AddRouterInfo (ri.GetBuffer (), ri.GetBufferLen ()); // ri1 points to one from netdb now
-		if (!ri1)
-		{
-			LogPrint (eLogError, "NTCP2: Couldn't update RouterInfo from SessionConfirmed in netdb");
-			Terminate ();
-			return;
-		}
-		
-		bool isOlder = false;
-		if (ri.GetTimestamp () + i2p::data::NETDB_EXPIRATION_TIMEOUT_THRESHOLD*1000LL < ri1->GetTimestamp ())
-		{	
-			// received RouterInfo is older than one in netdb
-			isOlder = true;
-			if (ri1->HasProfile ())
-			{	
-				auto profile = i2p::data::GetRouterProfile (ri1->GetIdentHash ()); // retrieve profile	
-				if (profile && profile->IsDuplicated ())
-				{	
-					SendTerminationAndTerminate (eNTCP2Banned);
-					return;
-				}	
-			}	
-		}
-		
-		auto addr = m_RemoteEndpoint.address ().is_v4 () ? ri1->GetNTCP2V4Address () :
-			(i2p::util::net::IsYggdrasilAddress (m_RemoteEndpoint.address ()) ? ri1->GetYggdrasilAddress () : ri1->GetNTCP2V6Address ());
+					auto addr = m_RemoteEndpoint.address ().is_v4 () ? ri.GetNTCP2V4Address () :
+						(i2p::util::net::IsYggdrasilAddress (m_RemoteEndpoint.address ()) ? ri.GetYggdrasilAddress () : ri.GetNTCP2V6Address ());
 					if (!addr || memcmp (m_Establisher->m_RemoteStaticKey, addr->s, 32))
 					{
 						LogPrint (eLogError, "NTCP2: Wrong static key in SessionConfirmed");
@ -858,21 +737,16 @@ namespace transport
 					     memcmp (m_RemoteEndpoint.address ().to_v6 ().to_bytes ().data () + 1, addr->host.to_v6 ().to_bytes ().data () + 1, 7) : // from the same yggdrasil subnet
 					     memcmp (m_RemoteEndpoint.address ().to_v6 ().to_bytes ().data (), addr->host.to_v6 ().to_bytes ().data (), 8)))) // temporary address
 					{
-			if (isOlder) // older router?
-				i2p::data::UpdateRouterProfile (ri1->GetIdentHash (),
-					[](std::shared_ptr<i2p::data::RouterProfile> profile)
-					{
-						if (profile) profile->Duplicated (); // mark router as duplicated in profile
-					});
-			else
-				LogPrint (eLogInfo, "NTCP2: Host mismatch between published address ", addr->host, " and actual endpoint ", m_RemoteEndpoint.address ());
-			SendTerminationAndTerminate (eNTCP2Banned);
+						LogPrint (eLogError, "NTCP2: Host mismatch between published address ", addr->host, " and actual endpoint ", m_RemoteEndpoint.address ());
+						Terminate ();
 						return;
 					}
-		// TODO: process options block
+					i2p::data::netdb.PostI2NPMsg (CreateI2NPMessage (eI2NPDummyMsg, buf.data () + 3, size)); // TODO: should insert ri and not parse it twice
+					// TODO: process options

 					// ready to communicate
-		SetRemoteIdentity (ri1->GetRouterIdentity ());
+					auto existing = i2p::data::netdb.FindRouter (ri.GetRouterIdentity ()->GetIdentHash ()); // check if exists already
+					SetRemoteIdentity (existing ? existing->GetRouterIdentity () : ri.GetRouterIdentity ());
 					if (m_Server.AddNTCP2Session (shared_from_this (), true))
 					{
 						Established ();
@ -881,6 +755,13 @@ namespace transport
 					else
 						Terminate ();
 				}
+				else
+					Terminate ();
+			}
+			else
+				Terminate ();
+		}
+	}

 	void NTCP2Session::SetSipKeys (const uint8_t * sendSipKey, const uint8_t * receiveSipKey)
 	{
@ -907,11 +788,7 @@ namespace transport
 	void NTCP2Session::ClientLogin ()
 	{
 		m_Establisher->CreateEphemeralKey ();
-		boost::asio::post (m_Server.GetEstablisherService (), 
-		    [s = shared_from_this ()] ()
-			{
-				s->SendSessionRequest ();
-			});	
+		SendSessionRequest ();
 	}

 	void NTCP2Session::ServerLogin ()
@ -1009,7 +886,7 @@ namespace transport
 			i2p::transport::transports.UpdateReceivedBytes (bytes_transferred + 2);
 			uint8_t nonce[12];
 			CreateNonce (m_ReceiveSequenceNumber, nonce); m_ReceiveSequenceNumber++;
-			if (m_Server.AEADChaCha20Poly1305Decrypt (m_NextReceivedBuffer, m_NextReceivedLen-16, nullptr, 0, m_ReceiveKey, nonce, m_NextReceivedBuffer, m_NextReceivedLen))
+			if (i2p::crypto::AEADChaCha20Poly1305 (m_NextReceivedBuffer, m_NextReceivedLen-16, nullptr, 0, m_ReceiveKey, nonce, m_NextReceivedBuffer, m_NextReceivedLen, false))
 			{
 				LogPrint (eLogDebug, "NTCP2: Received message decrypted");
 				ProcessNextFrame (m_NextReceivedBuffer, m_NextReceivedLen-16);
@ -1062,19 +939,7 @@ namespace transport
 				case eNTCP2BlkRouterInfo:
 				{
 					LogPrint (eLogDebug, "NTCP2: RouterInfo flag=", (int)frame[offset]);
-					if (size <= i2p::data::MAX_RI_BUFFER_SIZE + 1)
-					{		
-						auto newRi = i2p::data::netdb.AddRouterInfo (frame + offset + 1, size - 1);
-						if (newRi)
-						{
-							auto remoteIdentity = GetRemoteIdentity ();
-							if (remoteIdentity && remoteIdentity->GetIdentHash () == newRi->GetIdentHash ())
-								// peer's RouterInfo update
-								SetRemoteIdentity (newRi->GetIdentity ());
-						}	
-					}	
-					else
-						LogPrint (eLogInfo, "NTCP2: RouterInfo block is too long ", size);
+					i2p::data::netdb.PostI2NPMsg (CreateI2NPMessage (eI2NPDummyMsg, frame + offset, size));
 					break;
 				}
 				case eNTCP2BlkI2NPMessage:
@ -1198,7 +1063,7 @@ namespace transport
 		}	
 		uint8_t nonce[12];
 		CreateNonce (m_SendSequenceNumber, nonce); m_SendSequenceNumber++;
-		m_Server.AEADChaCha20Poly1305Encrypt (encryptBufs, m_SendKey, nonce, macBuf); // encrypt buffers
+		i2p::crypto::AEADChaCha20Poly1305Encrypt (encryptBufs, m_SendKey, nonce, macBuf); // encrypt buffers
 		SetNextSentFrameLength (totalLen + 16, first->GetNTCP2Header () - 5); // frame length right before first block

 		// send buffers
@ -1229,7 +1094,7 @@ namespace transport
 		// encrypt
 		uint8_t nonce[12];
 		CreateNonce (m_SendSequenceNumber, nonce); m_SendSequenceNumber++;
-		m_Server.AEADChaCha20Poly1305Encrypt ({ {m_NextSendBuffer + 2, payloadLen} }, m_SendKey, nonce, m_NextSendBuffer + payloadLen + 2);
+		i2p::crypto::AEADChaCha20Poly1305Encrypt ({ {m_NextSendBuffer + 2, payloadLen} }, m_SendKey, nonce, m_NextSendBuffer + payloadLen + 2);
 		SetNextSentFrameLength (payloadLen + 16, m_NextSendBuffer);
 		// send
 		m_IsSending = true;
@ -1256,7 +1121,7 @@ namespace transport
 			if (GetLastActivityTimestamp () > m_NextRouterInfoResendTime)
 			{
 				m_NextRouterInfoResendTime += NTCP2_ROUTERINFO_RESEND_INTERVAL +
-					m_Server.GetRng ()() % NTCP2_ROUTERINFO_RESEND_INTERVAL_THRESHOLD;
+					rand ()%NTCP2_ROUTERINFO_RESEND_INTERVAL_THRESHOLD;
 				SendRouterInfo ();
 			}
 			else
@ -1309,7 +1174,7 @@ namespace transport
 	void NTCP2Session::MoveSendQueue (std::shared_ptr<NTCP2Session> other)
 	{
 		if (!other || m_SendQueue.empty ()) return;
-		std::list<std::shared_ptr<I2NPMessage> > msgs;
+		std::vector<std::shared_ptr<I2NPMessage> > msgs;
 		auto ts = i2p::util::GetMillisecondsSinceEpoch ();
 		for (auto it: m_SendQueue)
 			if (!it->IsExpired (ts))
@ -1318,7 +1183,7 @@ namespace transport
 				it->Drop ();
 		m_SendQueue.clear ();
 		if (!msgs.empty ())
-			other->SendI2NPMessages (msgs);
+			other->PostI2NPMessages (msgs);
 	}	
 		
 	size_t NTCP2Session::CreatePaddingBlock (size_t msgLen, uint8_t * buf, size_t len)
@ -1396,45 +1261,23 @@ namespace transport
 	void NTCP2Session::SendTerminationAndTerminate (NTCP2TerminationReason reason)
 	{
 		SendTermination (reason);
-		boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::Terminate, shared_from_this ())); // let termination message go
+		m_Server.GetService ().post (std::bind (&NTCP2Session::Terminate, shared_from_this ())); // let termination message go
 	}

-	void NTCP2Session::SendI2NPMessages (std::list<std::shared_ptr<I2NPMessage> >& msgs)
+	void NTCP2Session::SendI2NPMessages (const std::vector<std::shared_ptr<I2NPMessage> >& msgs)
 	{
-		if (m_IsTerminated || msgs.empty ()) 
-		{
-			msgs.clear ();
-			return;
-		}	
-		bool empty = false;
-		{
-			std::lock_guard<std::mutex> l(m_IntermediateQueueMutex);
-			empty = m_IntermediateQueue.empty ();
-			m_IntermediateQueue.splice (m_IntermediateQueue.end (), msgs);
-		}
-		if (empty)
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::PostI2NPMessages, shared_from_this ()));
+		m_Server.GetService ().post (std::bind (&NTCP2Session::PostI2NPMessages, shared_from_this (), msgs));
 	}

-	void NTCP2Session::PostI2NPMessages ()
+	void NTCP2Session::PostI2NPMessages (std::vector<std::shared_ptr<I2NPMessage> > msgs)
 	{
 		if (m_IsTerminated) return;
-		std::list<std::shared_ptr<I2NPMessage> > msgs;
-		{
-			std::lock_guard<std::mutex> l(m_IntermediateQueueMutex);
-			m_IntermediateQueue.swap (msgs);		
-		}	
 		bool isSemiFull = m_SendQueue.size () > NTCP2_MAX_OUTGOING_QUEUE_SIZE/2;
-		if (isSemiFull)
-		{	
 		for (auto it: msgs)
-				if (it->onDrop)
+			if (isSemiFull && it->onDrop)
 				it->Drop (); // drop earlier because we can handle it
 			else
 				m_SendQueue.push_back (std::move (it));
-		}	
-		else
-			m_SendQueue.splice (m_SendQueue.end (), msgs);
 		
 		if (!m_IsSending && m_IsEstablished)
 			SendQueue ();
@ -1450,19 +1293,12 @@ namespace transport
 	void NTCP2Session::SendLocalRouterInfo (bool update)
 	{
 		if (update || !IsOutgoing ()) // we send it in SessionConfirmed for outgoing session
-			boost::asio::post (m_Server.GetService (), std::bind (&NTCP2Session::SendRouterInfo, shared_from_this ()));
-	}
-
-	i2p::data::RouterInfo::SupportedTransports NTCP2Session::GetTransportType () const
-	{
-		if (m_RemoteEndpoint.address ().is_v4 ()) return i2p::data::RouterInfo::eNTCP2V4;
-		return i2p::util::net::IsYggdrasilAddress (m_RemoteEndpoint.address ()) ? i2p::data::RouterInfo::eNTCP2V6Mesh : i2p::data::RouterInfo::eNTCP2V6;
+			m_Server.GetService ().post (std::bind (&NTCP2Session::SendRouterInfo, shared_from_this ()));
 	}

 	NTCP2Server::NTCP2Server ():
 		RunnableServiceWithWork ("NTCP2"), m_TerminationTimer (GetService ()),
-		m_ProxyType(eNoProxy), m_Resolver(GetService ()),
-		m_Rng(i2p::util::GetMonotonicMicroseconds ()%1000000LL)
+			m_ProxyType(eNoProxy), m_Resolver(GetService ())
 	{
 	}

@ -1473,7 +1309,6 @@ namespace transport

 	void NTCP2Server::Start ()
 	{
-		m_EstablisherService.Start ();
 		if (!IsRunning ())
 		{
 			StartIOService ();
@ -1481,13 +1316,14 @@ namespace transport
 			{
 				LogPrint(eLogInfo, "NTCP2: Using proxy to connect to peers");
 				// TODO: resolve proxy until it is resolved
+				boost::asio::ip::tcp::resolver::query q(m_ProxyAddress, std::to_string(m_ProxyPort));
 				boost::system::error_code e;
-				auto itr = m_Resolver.resolve(m_ProxyAddress, std::to_string(m_ProxyPort), e);
+				auto itr = m_Resolver.resolve(q, e);
 				if(e)
 					LogPrint(eLogCritical, "NTCP2: Failed to resolve proxy ", e.message());
 				else
 				{
-					m_ProxyEndpoint.reset (new boost::asio::ip::tcp::endpoint(*itr.begin ()));
+					m_ProxyEndpoint.reset (new boost::asio::ip::tcp::endpoint(*itr));
 					if (m_ProxyEndpoint)
 						LogPrint(eLogDebug, "NTCP2: m_ProxyEndpoint ", *m_ProxyEndpoint);
 				}
@ -1568,7 +1404,6 @@ namespace transport

 	void NTCP2Server::Stop ()
 	{
-		m_EstablisherService.Stop ();
 		{
 			// we have to copy it because Terminate changes m_NTCP2Sessions
 			auto ntcpSessions = m_NTCP2Sessions;
@ -1648,7 +1483,7 @@ namespace transport
 		}
 		LogPrint (eLogDebug, "NTCP2: Connecting to ", conn->GetRemoteEndpoint (),
 			" (", i2p::data::GetIdentHashAbbreviation (conn->GetRemoteIdentity ()->GetIdentHash ()), ")");
-		boost::asio::post (GetService (), [this, conn]()
+		GetService ().post([this, conn]()
 			{
 				if (this->AddNTCP2Session (conn))
 				{
@ -1806,8 +1641,7 @@ namespace transport

 	void NTCP2Server::ScheduleTermination ()
 	{
-		m_TerminationTimer.expires_from_now (boost::posix_time::seconds(
-			NTCP2_TERMINATION_CHECK_TIMEOUT + m_Rng () % NTCP2_TERMINATION_CHECK_TIMEOUT_VARIANCE));
+		m_TerminationTimer.expires_from_now (boost::posix_time::seconds(NTCP2_TERMINATION_CHECK_TIMEOUT));
 		m_TerminationTimer.async_wait (std::bind (&NTCP2Server::HandleTerminationTimer,
 			this, std::placeholders::_1));
 	}
@ -1869,7 +1703,7 @@ namespace transport
 			LogPrint (eLogError, "NTCP2: Can't connect to unspecified address");
 			return;
 		}
-		boost::asio::post (GetService(), [this, conn]()
+		GetService().post([this, conn]()
 		{
 			if (this->AddNTCP2Session (conn))
 			{
@ -1953,7 +1787,7 @@ namespace transport
 							LogPrint(eLogError, "NTCP2: HTTP proxy write error ", ec.message());
 					});

-				auto readbuff = std::make_shared<boost::asio::streambuf>();
+				boost::asio::streambuf * readbuff = new boost::asio::streambuf;
 				boost::asio::async_read_until(conn->GetSocket(), *readbuff, "\r\n\r\n",
 					[readbuff, timer, conn] (const boost::system::error_code & ec, std::size_t transferred)
 					{
@ -1967,12 +1801,13 @@ namespace transport
 						{
 							readbuff->commit(transferred);
 							i2p::http::HTTPRes res;
-							if(res.parse(std::string {boost::asio::buffers_begin(readbuff->data ()), boost::asio::buffers_begin(readbuff->data ()) + readbuff->size ()}) > 0)
+							if(res.parse(boost::asio::buffer_cast<const char*>(readbuff->data()), readbuff->size()) > 0)
 							{
 								if(res.code == 200)
 								{
 									timer->cancel();
 									conn->ClientLogin();
+									delete readbuff;
 									return;
 								}
 								else
@ -1982,6 +1817,7 @@ namespace transport
 								LogPrint(eLogError, "NTCP2: HTTP proxy gave malformed response");
 							timer->cancel();
 							conn->Terminate();
+							delete readbuff;
 						}
 					});
 				break;
@ -2004,17 +1840,5 @@ namespace transport
 		else
 			m_Address4 = addr;
 	}
-
-	void NTCP2Server::AEADChaCha20Poly1305Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, 
-		const uint8_t * key, const uint8_t * nonce, uint8_t * mac)
-	{
-		return m_Encryptor.Encrypt (bufs, key, nonce, mac);
-	}	
-		
-	bool NTCP2Server::AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen,
-		const uint8_t * ad, size_t adLen, const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len)
-	{
-		return m_Decryptor.Decrypt (msg, msgLen, ad, adLen, key, nonce, buf, len);
-	}	
 }
 }
--- a/libi2pd/NTCP2.h
+++ b/libi2pd/NTCP2.h
@ -14,7 +14,6 @@
 #include <list>
 #include <map>
 #include <array>
-#include <random>
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <boost/asio.hpp>
@ -36,10 +35,8 @@ namespace transport

 	const int NTCP2_CONNECT_TIMEOUT = 5; // 5 seconds
 	const int NTCP2_ESTABLISH_TIMEOUT = 10; // 10 seconds
-	const int NTCP2_TERMINATION_TIMEOUT = 115; // 2 minutes - 5 seconds
-	const int NTCP2_TERMINATION_TIMEOUT_VARIANCE = 10; // 10 seconds
-	const int NTCP2_TERMINATION_CHECK_TIMEOUT = 28; // 28 seconds
-	const int NTCP2_TERMINATION_CHECK_TIMEOUT_VARIANCE = 5; // 5 seconds
+	const int NTCP2_TERMINATION_TIMEOUT = 120; // 2 minutes
+	const int NTCP2_TERMINATION_CHECK_TIMEOUT = 30; // 30 seconds
 	const int NTCP2_RECEIVE_BUFFER_DELETION_TIMEOUT = 3; // 3 seconds
 	const int NTCP2_ROUTERINFO_RESEND_INTERVAL = 25*60; // 25 minuntes in seconds
 	const int NTCP2_ROUTERINFO_RESEND_INTERVAL_THRESHOLD = 25*60; // 25 minuntes
@ -91,29 +88,30 @@ namespace transport
 		const uint8_t * GetRemotePub () const { return m_RemoteEphemeralPublicKey; }; // Y for Alice and X for Bob
 		uint8_t * GetRemotePub () { return m_RemoteEphemeralPublicKey; }; // to set

+		const uint8_t * GetK () const { return m_CK + 32; };
 		const uint8_t * GetCK () const { return m_CK; };
 		const uint8_t * GetH () const { return m_H; };

-		bool KDF1Alice ();
-		bool KDF1Bob ();
-		bool KDF2Alice ();
-		bool KDF2Bob ();
-		bool KDF3Alice (); // for SessionConfirmed part 2
-		bool KDF3Bob ();
+		void KDF1Alice ();
+		void KDF1Bob ();
+		void KDF2Alice ();
+		void KDF2Bob ();
+		void KDF3Alice (); // for SessionConfirmed part 2
+		void KDF3Bob ();

-		bool KeyDerivationFunction1 (const uint8_t * pub, i2p::crypto::X25519Keys& priv, const uint8_t * rs, const uint8_t * epub); // for SessionRequest, (pub, priv) for DH
-		bool KeyDerivationFunction2 (const uint8_t * sessionRequest, size_t sessionRequestLen, const uint8_t * epub); // for SessionCreate
+		void KeyDerivationFunction1 (const uint8_t * pub, i2p::crypto::X25519Keys& priv, const uint8_t * rs, const uint8_t * epub); // for SessionRequest, (pub, priv) for DH
+		void KeyDerivationFunction2 (const uint8_t * sessionRequest, size_t sessionRequestLen, const uint8_t * epub); // for SessionCreate
 		void CreateEphemeralKey ();

-		bool CreateSessionRequestMessage (std::mt19937& rng);
-		bool CreateSessionCreatedMessage (std::mt19937& rng);
-		bool CreateSessionConfirmedMessagePart1 ();
-		bool CreateSessionConfirmedMessagePart2 ();
+		void CreateSessionRequestMessage ();
+		void CreateSessionCreatedMessage ();
+		void CreateSessionConfirmedMessagePart1 (const uint8_t * nonce);
+		void CreateSessionConfirmedMessagePart2 (const uint8_t * nonce);

 		bool ProcessSessionRequestMessage (uint16_t& paddingLen, bool& clockSkew);
 		bool ProcessSessionCreatedMessage (uint16_t& paddingLen);
-		bool ProcessSessionConfirmedMessagePart1 ();
-		bool ProcessSessionConfirmedMessagePart2 (uint8_t * m3p2Buf);
+		bool ProcessSessionConfirmedMessagePart1 (const uint8_t * nonce);
+		bool ProcessSessionConfirmedMessagePart2 (const uint8_t * nonce, uint8_t * m3p2Buf);

 		std::shared_ptr<i2p::crypto::X25519Keys> m_EphemeralKeys;
 		uint8_t m_RemoteEphemeralPublicKey[32]; // x25519
@ -146,14 +144,13 @@ namespace transport
 			void SetRemoteEndpoint (const boost::asio::ip::tcp::endpoint& ep) { m_RemoteEndpoint = ep; };

 			bool IsEstablished () const override { return m_IsEstablished; };
-			i2p::data::RouterInfo::SupportedTransports GetTransportType () const override;
 			bool IsTerminated () const { return m_IsTerminated; };

 			void ClientLogin (); // Alice
 			void ServerLogin (); // Bob

 			void SendLocalRouterInfo (bool update) override; // after handshake or by update
-			void SendI2NPMessages (std::list<std::shared_ptr<I2NPMessage> >& msgs) override;
+			void SendI2NPMessages (const std::vector<std::shared_ptr<I2NPMessage> >& msgs) override;
 			void MoveSendQueue (std::shared_ptr<NTCP2Session> other);
 			
 		private:
@ -172,16 +169,12 @@ namespace transport

 			void HandleSessionRequestSent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleSessionRequestReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
-			void ProcessSessionRequest (size_t len);
 			void HandleSessionRequestPaddingReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleSessionCreatedSent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleSessionCreatedReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
-			void ProcessSessionCreated (size_t len);
 			void HandleSessionCreatedPaddingReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleSessionConfirmedSent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
 			void HandleSessionConfirmedReceived (const boost::system::error_code& ecode, std::size_t bytes_transferred);
-			void ProcessSessionConfirmed ();
-			void EstablishSessionAfterSessionConfirmed (std::shared_ptr<std::vector<uint8_t> > buf, size_t size);

 			// data
 			void ReceiveLength ();
@ -200,7 +193,7 @@ namespace transport
 			void SendRouterInfo ();
 			void SendTermination (NTCP2TerminationReason reason);
 			void SendTerminationAndTerminate (NTCP2TerminationReason reason);
-			void PostI2NPMessages ();
+			void PostI2NPMessages (std::vector<std::shared_ptr<I2NPMessage> > msgs);

 		private:

@ -234,27 +227,12 @@ namespace transport
 			std::list<std::shared_ptr<I2NPMessage> > m_SendQueue;
 			uint64_t m_NextRouterInfoResendTime; // seconds since epoch

-			std::list<std::shared_ptr<I2NPMessage> > m_IntermediateQueue; // from transports
-			mutable std::mutex m_IntermediateQueueMutex;
-			
 			uint16_t m_PaddingSizes[16];
 			int m_NextPaddingSize;
 	};

 	class NTCP2Server: private i2p::util::RunnableServiceWithWork
 	{
-		private:
-
-			class EstablisherService: public i2p::util::RunnableServiceWithWork
-			{
-				public:
-
-					EstablisherService (): RunnableServiceWithWork ("NTCP2e") {};
-					auto& GetService () { return GetIOService (); };
-					void Start () { StartIOService (); };
-					void Stop () { StopIOService (); };
-			};
-			
 		public:

 			enum ProxyType
@ -269,14 +247,7 @@ namespace transport

 			void Start ();
 			void Stop ();
-			auto& GetService () { return GetIOService (); };
-			auto& GetEstablisherService () { return m_EstablisherService.GetService (); };
-			std::mt19937& GetRng () { return m_Rng; };
-			void AEADChaCha20Poly1305Encrypt (const std::vector<std::pair<uint8_t *, size_t> >& bufs, 
-				const uint8_t * key, const uint8_t * nonce, uint8_t * mac);
-			bool AEADChaCha20Poly1305Decrypt (const uint8_t * msg, size_t msgLen, const uint8_t * ad, size_t adLen,
-				const uint8_t * key, const uint8_t * nonce, uint8_t * buf, size_t len); 
-			
+			boost::asio::io_service& GetService () { return GetIOService (); };

 			bool AddNTCP2Session (std::shared_ptr<NTCP2Session> session, bool incoming = false);
 			void RemoveNTCP2Session (std::shared_ptr<NTCP2Session> session);
@ -314,12 +285,7 @@ namespace transport
 			uint16_t m_ProxyPort;
 			boost::asio::ip::tcp::resolver m_Resolver;
 			std::unique_ptr<boost::asio::ip::tcp::endpoint> m_ProxyEndpoint;
-			
 			std::shared_ptr<boost::asio::ip::tcp::endpoint> m_Address4, m_Address6, m_YggdrasilAddress;
-			std::mt19937 m_Rng;
-			EstablisherService m_EstablisherService;
-			i2p::crypto::AEADChaCha20Poly1305Encryptor m_Encryptor;
-			i2p::crypto::AEADChaCha20Poly1305Decryptor m_Decryptor;

 		public:

--- a/libi2pd/NetDb.cpp
+++ b/libi2pd/NetDb.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -10,6 +10,7 @@
 #include <fstream>
 #include <vector>
 #include <map>
+#include <random>
 #include <boost/asio.hpp>
 #include <stdexcept>

@ -39,7 +40,7 @@ namespace data

 	NetDb::NetDb (): m_IsRunning (false), m_Thread (nullptr), m_Reseeder (nullptr), 
 		m_Storage("netDb", "r", "routerInfo-", "dat"), m_PersistProfiles (true),
-		m_LastExploratorySelectionUpdateTime (0), m_Rng(i2p::util::GetMonotonicMicroseconds () % 1000000LL)
+		m_LastExploratorySelectionUpdateTime (0)
 	{
 	}

@ -68,7 +69,7 @@ namespace data
 		{
 			Reseed ();
 		}
-		else if (!GetRandomRouter (i2p::context.GetSharedRouterInfo (), false, false, false))
+		else if (!GetRandomRouter (i2p::context.GetSharedRouterInfo (), false, false))
 			Reseed (); // we don't have a router we can connect to. Trying to reseed

 		auto it = m_RouterInfos.find (i2p::context.GetIdentHash ());
@ -118,22 +119,19 @@ namespace data
 		i2p::util::SetThreadName("NetDB");

 		uint64_t lastManage = 0;
-		uint64_t lastProfilesCleanup = i2p::util::GetMonotonicMilliseconds (), 
-			lastObsoleteProfilesCleanup = lastProfilesCleanup, lastApplyingProfileUpdates = lastProfilesCleanup;
-		int16_t profilesCleanupVariance = 0, obsoleteProfilesCleanVariance = 0, applyingProfileUpdatesVariance = 0;
+		uint64_t lastProfilesCleanup = i2p::util::GetMonotonicMilliseconds (), lastObsoleteProfilesCleanup = lastProfilesCleanup;
+		int16_t profilesCleanupVariance = 0, obsoleteProfilesCleanVariance = 0;

-		std::list<std::shared_ptr<const I2NPMessage> > msgs;
 		while (m_IsRunning)
 		{
 			try
 			{
-				if (m_Queue.Wait (1,0)) // 1 sec
+				auto msg = m_Queue.GetNextWithTimeout (1000); // 1 sec
+				if (msg)
 				{
-					m_Queue.GetWholeQueue (msgs);
-					while (!msgs.empty ())
+					int numMsgs = 0;
+					while (msg)
 					{
-						auto msg = msgs.front (); msgs.pop_front ();
-						if (!msg) continue;
 						LogPrint(eLogDebug, "NetDb: Got request with type ", (int) msg->GetTypeID ());
 						switch (msg->GetTypeID ())
 						{
@ -143,10 +141,17 @@ namespace data
 							case eI2NPDatabaseLookup:
 								HandleDatabaseLookupMsg (msg);
 							break;
+							case eI2NPDummyMsg:
+								// plain RouterInfo from NTCP2 with flags for now
+								HandleNTCP2RouterInfoMsg (msg);
+							break;
 							default: // WTF?
 								LogPrint (eLogError, "NetDb: Unexpected message type ", (int) msg->GetTypeID ());
 								//i2p::HandleI2NPMessage (msg);
 						}
+						if (numMsgs > 100) break;
+						msg = m_Queue.Get ();
+						numMsgs++;
 					}
 				}
 				if (!m_IsRunning) break;
@ -181,7 +186,7 @@ namespace data
 							LogPrint (eLogWarning, "NetDb: Can't persist profiles. Profiles are being saved to disk");
 					}	
 					lastProfilesCleanup = mts;
-					profilesCleanupVariance = m_Rng () % i2p::data::PEER_PROFILE_AUTOCLEAN_VARIANCE;
+					profilesCleanupVariance = rand () % i2p::data::PEER_PROFILE_AUTOCLEAN_VARIANCE;
 				}

 				if (mts >= lastObsoleteProfilesCleanup + (uint64_t)(i2p::data::PEER_PROFILE_OBSOLETE_PROFILES_CLEAN_TIMEOUT + obsoleteProfilesCleanVariance)*1000)
@ -197,20 +202,7 @@ namespace data
 					else
 						LogPrint (eLogWarning, "NetDb: Can't delete profiles. Profiles are being deleted from disk");
 					lastObsoleteProfilesCleanup = mts;
-					obsoleteProfilesCleanVariance = m_Rng () % i2p::data::PEER_PROFILE_OBSOLETE_PROFILES_CLEAN_VARIANCE;
-				}	
-				if (mts >= lastApplyingProfileUpdates + i2p::data::PEER_PROFILE_APPLY_POSTPONED_TIMEOUT + applyingProfileUpdatesVariance)
-				{
-					bool isApplying = m_ApplyingProfileUpdates.valid ();
-					if (isApplying && m_ApplyingProfileUpdates.wait_for(std::chrono::seconds(0)) == std::future_status::ready) // still active?
-					{
-						m_ApplyingProfileUpdates.get ();
-						isApplying = false;
-					}	
-					if (!isApplying)
-						m_ApplyingProfileUpdates = i2p::data::FlushPostponedRouterProfileUpdates ();
-					lastApplyingProfileUpdates = mts;
-					applyingProfileUpdatesVariance = m_Rng () % i2p::data::PEER_PROFILE_APPLY_POSTPONED_TIMEOUT_VARIANCE;
+					obsoleteProfilesCleanVariance = rand () % i2p::data::PEER_PROFILE_OBSOLETE_PROFILES_CLEAN_VARIANCE;
 				}	
 			}
 			catch (std::exception& ex)
@ -294,7 +286,6 @@ namespace data
 			}
 			else
 			{
-				r->CancelBufferToDelete (); // since an update received
 				if (CheckLogLevel (eLogDebug))
 					LogPrint (eLogDebug, "NetDb: RouterInfo is older: ", ident.ToBase64());
 				updated = false;
@ -308,8 +299,7 @@ namespace data
 			{
 				auto mts = i2p::util::GetMillisecondsSinceEpoch ();
 			    isValid = mts + NETDB_EXPIRATION_TIMEOUT_THRESHOLD*1000LL > r->GetTimestamp () && // from future
-					(mts < r->GetTimestamp () + NETDB_MAX_EXPIRATION_TIMEOUT*1000LL || // too old
-					 context.GetUptime () < NETDB_CHECK_FOR_EXPIRATION_UPTIME/10); // enough uptime
+					mts < r->GetTimestamp () + NETDB_MAX_EXPIRATION_TIMEOUT*1000LL; // too old
 			}
 			if (isValid)	
 			{
@ -398,7 +388,8 @@ namespace data
 			if (it == m_LeaseSets.end () || it->second->GetStoreType () != storeType ||
 				leaseSet->GetPublishedTimestamp () > it->second->GetPublishedTimestamp ())
 			{
-				if (leaseSet->IsPublic () && !leaseSet->IsExpired ())
+				if (leaseSet->IsPublic () && !leaseSet->IsExpired () &&
+				     i2p::util::GetSecondsSinceEpoch () + NETDB_EXPIRATION_TIMEOUT_THRESHOLD > leaseSet->GetPublishedTimestamp ())
 				{
 					// TODO: implement actual update
 					if (CheckLogLevel (eLogInfo))
@ -493,7 +484,7 @@ namespace data
 	void NetDb::ReseedFromFloodfill(const RouterInfo & ri, int numRouters, int numFloodfills)
 	{
 		LogPrint(eLogInfo, "NetDB: Reseeding from floodfill ", ri.GetIdentHashBase64());
-		std::list<std::shared_ptr<i2p::I2NPMessage> > requests;
+		std::vector<std::shared_ptr<i2p::I2NPMessage> > requests;

 		i2p::data::IdentHash ourIdent = i2p::context.GetIdentHash();
 		i2p::data::IdentHash ih = ri.GetIdentHash();
@ -516,7 +507,7 @@ namespace data
 		}

 		// send them off
-		i2p::transport::transports.SendMessages(ih, std::move (requests));
+		i2p::transport::transports.SendMessages(ih, requests);
 	}

 	bool NetDb::LoadRouterInfo (const std::string& path, uint64_t ts)
@ -571,7 +562,7 @@ namespace data
 		while(n > 0)
 		{
 			std::lock_guard<std::mutex> lock(m_RouterInfosMutex);
-			uint32_t idx = m_Rng () % m_RouterInfos.size ();
+			uint32_t idx = rand () % m_RouterInfos.size ();
 			uint32_t i = 0;
 			for (const auto & it : m_RouterInfos) {
 				if(i >= idx) // are we at the random start point?
@ -651,80 +642,70 @@ namespace data
 		if (checkForExpiration && uptime > i2p::transport::SSU2_TO_INTRODUCER_SESSION_DURATION) // 1 hour
 			expirationTimeout = i2p::context.IsFloodfill () ? NETDB_FLOODFILL_EXPIRATION_TIMEOUT*1000LL :
 				NETDB_MIN_EXPIRATION_TIMEOUT*1000LL + (NETDB_MAX_EXPIRATION_TIMEOUT - NETDB_MIN_EXPIRATION_TIMEOUT)*1000LL*NETDB_MIN_ROUTERS/total;
-		bool isOffline = checkForExpiration && i2p::transport::transports.GetNumPeers () < NETDB_MIN_TRANSPORTS; // enough routers and uptime, but no transports

 		std::list<std::pair<std::string, std::shared_ptr<RouterInfo::Buffer> > > saveToDisk;
 		std::list<std::string> removeFromDisk;	
 			
 		auto own = i2p::context.GetSharedRouterInfo ();
-		for (auto [ident, r]: m_RouterInfos)
+		for (auto& it: m_RouterInfos)
 		{
-			if (!r || r == own) continue; // skip own
-			if (r->IsBufferScheduledToDelete ()) // from previous SaveUpdated, we assume m_PersistingRouters complete
+			if (!it.second || it.second == own) continue; // skip own
+			std::string ident = it.second->GetIdentHashBase64();
+			if (it.second->IsUpdated ())
 			{
-				std::lock_guard<std::mutex> l(m_RouterInfosMutex); // possible collision between DeleteBuffer and Update
-				r->DeleteBuffer ();
-			}	
-			if (r->IsUpdated ())
-			{
-				if (r->GetBuffer () && !r->IsUnreachable ())
+				if (it.second->GetBuffer ())
 				{
 					// we have something to save
 					std::shared_ptr<RouterInfo::Buffer> buffer;
 					{
 						std::lock_guard<std::mutex> l(m_RouterInfosMutex); // possible collision between DeleteBuffer and Update
-						buffer = r->CopyBuffer ();
+						buffer = it.second->GetSharedBuffer ();
+						it.second->DeleteBuffer ();
 					}
-					if (!i2p::transport::transports.IsConnected (ident))
-						r->ScheduleBufferToDelete ();
-					if (buffer)
-						saveToDisk.emplace_back(ident.ToBase64 (), buffer);
+					if (buffer && !it.second->IsUnreachable ()) // don't save bad router
+						saveToDisk.push_back(std::make_pair(ident, buffer));
+					it.second->SetUnreachable (false);
 				}
-				r->SetUpdated (false);
+				it.second->SetUpdated (false);
 				updatedCount++;
 				continue;
 			}
-			else if (r->GetBuffer () && ts > r->GetTimestamp () + NETDB_MIN_EXPIRATION_TIMEOUT*1000LL)
-				// since update was long time ago we assume that router is not connected anymore
-				r->ScheduleBufferToDelete ();
-			
-			if (r->HasProfile () && r->GetProfile ()->IsUnreachable ())
-				r->SetUnreachable (true);
+			if (it.second->GetProfile ()->IsUnreachable ())
+				it.second->SetUnreachable (true);
 			// make router reachable back if too few routers or floodfills
-			if (r->IsUnreachable () && (total - deletedCount < NETDB_MIN_ROUTERS || isLowRate || isOffline ||
-				(r->IsFloodfill () && totalFloodfills - deletedFloodfillsCount < NETDB_MIN_FLOODFILLS)))
-				r->SetUnreachable (false);
-			if (!r->IsUnreachable ())
+			if (it.second->IsUnreachable () && (total - deletedCount < NETDB_MIN_ROUTERS || isLowRate ||
+				(it.second->IsFloodfill () && totalFloodfills - deletedFloodfillsCount < NETDB_MIN_FLOODFILLS)))
+				it.second->SetUnreachable (false);
+			if (!it.second->IsUnreachable ())
 			{
 				// find & mark expired routers
-				if (!r->GetCompatibleTransports (true)) // non reachable by any transport
-					r->SetUnreachable (true);
-				else if (ts + NETDB_EXPIRATION_TIMEOUT_THRESHOLD*1000LL < r->GetTimestamp ())
+				if (!it.second->GetCompatibleTransports (true)) // non reachable by any transport
+					it.second->SetUnreachable (true);
+				else if (ts + NETDB_EXPIRATION_TIMEOUT_THRESHOLD*1000LL < it.second->GetTimestamp ())
 				{
-					LogPrint (eLogWarning, "NetDb: RouterInfo is from future for ", (r->GetTimestamp () - ts)/1000LL, " seconds");
-					r->SetUnreachable (true);
+					LogPrint (eLogWarning, "NetDb: RouterInfo is from future for ", (it.second->GetTimestamp () - ts)/1000LL, " seconds");
+					it.second->SetUnreachable (true);
 				}
 				else if (checkForExpiration) 
 				{	
-					if (ts > r->GetTimestamp () + expirationTimeout)
-						r->SetUnreachable (true);
-					else if ((ts > r->GetTimestamp () + expirationTimeout/2) && // more than half of expiration
-						total > NETDB_NUM_ROUTERS_THRESHOLD && !r->IsHighBandwidth() &&  // low bandwidth
-						!r->IsFloodfill() && (!i2p::context.IsFloodfill () || // non floodfill 
-					    (CreateRoutingKey (ident) ^ i2p::context.GetIdentHash ()).metric[0] >= 0x02)) // different first 7 bits 
-							r->SetUnreachable (true);
+					if (ts > it.second->GetTimestamp () + expirationTimeout)
+						it.second->SetUnreachable (true);
+					else if ((ts > it.second->GetTimestamp () + expirationTimeout/2) && // more than half of expiration
+						total > NETDB_NUM_ROUTERS_THRESHOLD && !it.second->IsHighBandwidth() &&  // low bandwidth
+						!it.second->IsFloodfill() && (!i2p::context.IsFloodfill () || // non floodfill 
+					    (CreateRoutingKey (it.second->GetIdentHash ()) ^ i2p::context.GetIdentHash ()).metric[0] >= 0x02)) // different first 7 bits 
+							it.second->SetUnreachable (true);
 				}	
 			}
-			// make router reachable back if connected now or trusted router
-			if (r->IsUnreachable () && (i2p::transport::transports.IsConnected (ident) ||
-				i2p::transport::transports.IsTrustedRouter (ident)))
-				r->SetUnreachable (false);
+			// make router reachable back if connected now
+			if (it.second->IsUnreachable () && i2p::transport::transports.IsConnected (it.second->GetIdentHash ()))
+				it.second->SetUnreachable (false);
 			
-			if (r->IsUnreachable ())
+			if (it.second->IsUnreachable ())
 			{
-				if (r->IsFloodfill ()) deletedFloodfillsCount++;
+				if (it.second->IsFloodfill ()) deletedFloodfillsCount++;
 				// delete RI file
-				removeFromDisk.emplace_back (ident.ToBase64());
+				removeFromDisk.push_back (ident);
 				deletedCount++;
 				if (total - deletedCount < NETDB_MIN_ROUTERS) checkForExpiration = false;
 			}
@ -782,8 +763,7 @@ namespace data
 	
 	void NetDb::RequestDestination (const IdentHash& destination, RequestedDestination::RequestComplete requestComplete, bool direct)
 	{
-		if (direct && (i2p::transport::transports.RoutesRestricted () || i2p::context.IsLimitedConnectivity ())) 
-		    direct = false; // always use tunnels for restricted routes or limited connectivity
+		if (direct && i2p::transport::transports.RoutesRestricted ()) direct = false; // always use tunnels for restricted routes
 		if (m_Requests)
 			m_Requests->PostRequestDestination (destination, requestComplete, direct);
 		else
@ -951,13 +931,14 @@ namespace data
 			LogPrint (eLogError, "NetDb: DatabaseLookup for zero ident. Ignored");
 			return;
 		}
-		std::string key;
-		if (CheckLogLevel (eLogInfo))
-			key = i2p::data::ByteStreamToBase64 (buf, 32);
+		char key[48];
+		int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+		key[l] = 0;

 		IdentHash replyIdent(buf + 32);
 		uint8_t flag = buf[64];

+
 		LogPrint (eLogDebug, "NetDb: DatabaseLookup for ", key, " received flags=", (int)flag);
 		uint8_t lookupType = flag & DATABASE_LOOKUP_TYPE_FLAGS_MASK;
 		const uint8_t * excluded = buf + 65;
@ -1152,18 +1133,15 @@ namespace data
 	}

 	std::shared_ptr<const RouterInfo> NetDb::GetRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith,
-		bool reverse, bool endpoint, bool clientTunnel) const
+		bool reverse, bool endpoint) const
 	{
-		bool checkIsReal = clientTunnel && i2p::tunnel::tunnels.GetPreciseTunnelCreationSuccessRate () < NETDB_TUNNEL_CREATION_RATE_THRESHOLD && // too low rate
-			context.GetUptime () > NETDB_CHECK_FOR_EXPIRATION_UPTIME; // after 10 minutes uptime
 		return GetRandomRouter (
-			[compatibleWith, reverse, endpoint, clientTunnel, checkIsReal](std::shared_ptr<const RouterInfo> router)->bool
+			[compatibleWith, reverse, endpoint](std::shared_ptr<const RouterInfo> router)->bool
 			{
 				return !router->IsHidden () && router != compatibleWith &&
 					(reverse ? (compatibleWith->IsReachableFrom (*router) && router->GetCompatibleTransports (true)):
 						router->IsReachableFrom (*compatibleWith)) && !router->IsNAT2NATOnly (*compatibleWith) &&
-					router->IsECIES () && !router->IsHighCongestion (clientTunnel) &&
-					(!checkIsReal || router->GetProfile ()->IsReal ()) &&
+					router->IsECIES () && !router->IsHighCongestion (false) &&
 					(!endpoint || (router->IsV4 () && (!reverse || router->IsPublished (true)))); // endpoint must be ipv4 and published if inbound(reverse)
 			});
 	}
@ -1336,8 +1314,12 @@ namespace data
 		{
 			// update selection
 			m_ExploratorySelection.clear ();
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 			std::vector<std::shared_ptr<const RouterInfo> > eligible;
 			eligible.reserve (m_RouterInfos.size ());
+#else		
+			auto& eligible = m_ExploratorySelection;
+#endif			
 			{
 				// collect eligible from current netdb
 				bool checkIsReal = i2p::tunnel::tunnels.GetPreciseTunnelCreationSuccessRate () < NETDB_TUNNEL_CREATION_RATE_THRESHOLD; // too low rate
@ -1347,13 +1329,22 @@ namespace data
 					 	(!checkIsReal || (it.second->HasProfile () && it.second->GetProfile ()->IsReal ())))
 							eligible.push_back (it.second);
 			}
+#if (__cplusplus >= 201703L) // C++ 17 or higher
 			if (eligible.size () > NETDB_MAX_EXPLORATORY_SELECTION_SIZE)
 			{
 				 std::sample (eligible.begin(), eligible.end(), std::back_inserter(m_ExploratorySelection),
-				 	NETDB_MAX_EXPLORATORY_SELECTION_SIZE, m_Rng);
+				 	NETDB_MAX_EXPLORATORY_SELECTION_SIZE, std::mt19937(ts));
 			}	
 			else
 				std::swap (m_ExploratorySelection, eligible);
+#else			
+			if (m_ExploratorySelection.size () > NETDB_MAX_EXPLORATORY_SELECTION_SIZE)
+			{
+				// reduce number of eligible to max selection size
+				std::shuffle (m_ExploratorySelection.begin(), m_ExploratorySelection.end(), std::mt19937(ts));
+				m_ExploratorySelection.resize (NETDB_MAX_EXPLORATORY_SELECTION_SIZE);
+			}	
+#endif			
 			m_LastExploratorySelectionUpdateTime = ts;
 		}	
 		
--- a/libi2pd/NetDb.hpp
+++ b/libi2pd/NetDb.hpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -16,7 +16,6 @@
 #include <thread>
 #include <mutex>
 #include <future>
-#include <random>

 #include "Base.h"
 #include "Gzip.h"
@ -40,7 +39,6 @@ namespace data
 {
 	const int NETDB_MIN_ROUTERS = 90;
 	const int NETDB_MIN_FLOODFILLS = 5;
-	const int NETDB_MIN_TRANSPORTS = 10 ; // otherwise assume offline
 	const int NETDB_NUM_FLOODFILLS_THRESHOLD = 1200;
 	const int NETDB_NUM_ROUTERS_THRESHOLD = 4*NETDB_NUM_FLOODFILLS_THRESHOLD;
 	const int NETDB_TUNNEL_CREATION_RATE_THRESHOLD = 10; // in %
@ -53,7 +51,6 @@ namespace data
 	const int NETDB_MIN_HIGHBANDWIDTH_VERSION = MAKE_VERSION_NUMBER(0, 9, 58); // 0.9.58
 	const int NETDB_MIN_FLOODFILL_VERSION = MAKE_VERSION_NUMBER(0, 9, 59); // 0.9.59
 	const int NETDB_MIN_SHORT_TUNNEL_BUILD_VERSION = MAKE_VERSION_NUMBER(0, 9, 51); // 0.9.51
-	const int NETDB_MIN_PEER_TEST_VERSION = MAKE_VERSION_NUMBER(0, 9, 62); // 0.9.62
 	const size_t NETDB_MAX_NUM_SEARCH_REPLY_PEER_HASHES = 16;
 	const size_t NETDB_MAX_EXPLORATORY_SELECTION_SIZE = 500;
 	const int NETDB_EXPLORATORY_SELECTION_UPDATE_INTERVAL = 82; // in seconds. for floodfill
@ -90,7 +87,7 @@ namespace data
 			void RequestDestination (const IdentHash& destination, RequestedDestination::RequestComplete requestComplete = nullptr, bool direct = true);
 			
 			std::shared_ptr<const RouterInfo> GetRandomRouter () const;
-			std::shared_ptr<const RouterInfo> GetRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith, bool reverse, bool endpoint, bool clientTunnel) const;
+			std::shared_ptr<const RouterInfo> GetRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith, bool reverse, bool endpoint) const;
 			std::shared_ptr<const RouterInfo> GetHighBandwidthRandomRouter (std::shared_ptr<const RouterInfo> compatibleWith, bool reverse, bool endpoint) const;
 			std::shared_ptr<const RouterInfo> GetRandomSSU2PeerTestRouter (bool v4, const std::unordered_set<IdentHash>& excluded) const;
 			std::shared_ptr<const RouterInfo> GetRandomSSU2Introducer (bool v4, const std::unordered_set<IdentHash>& excluded) const;
@ -130,12 +127,12 @@ namespace data
 			}
 			bool PopulateRouterInfoBuffer (std::shared_ptr<RouterInfo> r);
 			std::shared_ptr<RouterInfo::Address> NewRouterInfoAddress () { return m_RouterInfoAddressesPool.AcquireSharedMt (); };
-			RouterInfo::AddressesPtr NewRouterInfoAddresses ()
+			boost::shared_ptr<RouterInfo::Addresses> NewRouterInfoAddresses ()
 			{
-				return RouterInfo::AddressesPtr{m_RouterInfoAddressVectorsPool.AcquireMt (),
+				return boost::shared_ptr<RouterInfo::Addresses>(m_RouterInfoAddressVectorsPool.AcquireMt (),
 					std::bind <void (i2p::util::MemoryPoolMt<RouterInfo::Addresses>::*)(RouterInfo::Addresses *)>
 						(&i2p::util::MemoryPoolMt<RouterInfo::Addresses>::ReleaseMt,
-						&m_RouterInfoAddressVectorsPool, std::placeholders::_1)};
+						&m_RouterInfoAddressVectorsPool, std::placeholders::_1));
 			};
 			std::shared_ptr<Lease> NewLease (const Lease& lease) { return m_LeasesPool.AcquireSharedMt (lease); };
 			std::shared_ptr<IdentityEx> NewIdentity (const uint8_t * buf, size_t len) { return m_IdentitiesPool.AcquireSharedMt (buf, len); };
@ -187,11 +184,10 @@ namespace data
 			std::shared_ptr<NetDbRequests> m_Requests;

 			bool m_PersistProfiles;
-			std::future<void> m_SavingProfiles, m_DeletingProfiles, m_ApplyingProfileUpdates, m_PersistingRouters;
+			std::future<void> m_SavingProfiles, m_DeletingProfiles, m_PersistingRouters;

 			std::vector<std::shared_ptr<const RouterInfo> > m_ExploratorySelection;
 			uint64_t m_LastExploratorySelectionUpdateTime; // in monotonic seconds
-			std::mt19937 m_Rng;

 			i2p::util::MemoryPoolMt<RouterInfo::Buffer> m_RouterInfoBuffersPool;
 			i2p::util::MemoryPoolMt<RouterInfo::Address> m_RouterInfoAddressesPool;
--- a/libi2pd/NetDbRequests.cpp
+++ b/libi2pd/NetDbRequests.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -20,10 +20,8 @@ namespace i2p
 namespace data
 {
 	RequestedDestination::RequestedDestination (const IdentHash& destination, bool isExploratory, bool direct):
-		m_Destination (destination), m_IsExploratory (isExploratory), m_IsDirect (direct), 
-		m_IsActive (true), m_IsSentDirectly (false),
-		m_CreationTime (i2p::util::GetMillisecondsSinceEpoch ()), 
-		m_LastRequestTime (0), m_NumAttempts (0)
+		m_Destination (destination), m_IsExploratory (isExploratory), m_IsDirect (direct), m_IsActive (true),
+		m_CreationTime (i2p::util::GetSecondsSinceEpoch ()), m_LastRequestTime (0), m_NumAttempts (0)
 	{
 		if (i2p::context.IsFloodfill ())
 			m_ExcludedPeers.insert (i2p::context.GetIdentHash ()); // exclude self if floodfill
@ -46,9 +44,8 @@ namespace data
 			msg = i2p::CreateRouterInfoDatabaseLookupMsg(m_Destination, i2p::context.GetIdentHash(), 0, m_IsExploratory, &m_ExcludedPeers);
 		if(router)
 			m_ExcludedPeers.insert (router->GetIdentHash ());
-		m_LastRequestTime = i2p::util::GetMillisecondsSinceEpoch ();
+		m_LastRequestTime = i2p::util::GetSecondsSinceEpoch ();
 		m_NumAttempts++;
-		m_IsSentDirectly = false;
 		return msg;
 	}

@ -58,8 +55,7 @@ namespace data
 			i2p::context.GetRouterInfo ().GetIdentHash () , 0, false, &m_ExcludedPeers);
 		m_ExcludedPeers.insert (floodfill);
 		m_NumAttempts++;
-		m_LastRequestTime = i2p::util::GetMillisecondsSinceEpoch ();
-		m_IsSentDirectly = true;
+		m_LastRequestTime = i2p::util::GetSecondsSinceEpoch ();
 		return msg;
 	}

@ -183,7 +179,7 @@ namespace data

 	void NetDbRequests::RequestComplete (const IdentHash& ident, std::shared_ptr<RouterInfo> r)
 	{
-		boost::asio::post (GetIOService (), [this, ident, r]()
+		GetIOService ().post ([this, ident, r]()
 			{                      
 				std::shared_ptr<RequestedDestination> request;
 				auto it = m_RequestedDestinations.find (ident);
@ -214,7 +210,7 @@ namespace data

 	void NetDbRequests::ManageRequests ()
 	{
-		uint64_t ts = i2p::util::GetMillisecondsSinceEpoch ();
+		uint64_t ts = i2p::util::GetSecondsSinceEpoch ();
 		for (auto it = m_RequestedDestinations.begin (); it != m_RequestedDestinations.end ();)
 		{
 			auto& dest = it->second;
@ -226,8 +222,7 @@ namespace data
 					bool done = false;
 					if (ts < dest->GetCreationTime () + MAX_REQUEST_TIME)
 					{
-						if (ts > dest->GetLastRequestTime () + (dest->IsSentDirectly () ? MIN_DIRECT_REQUEST_TIME : MIN_REQUEST_TIME)) 
-						// try next floodfill if no response after min interval
+						if (ts > dest->GetLastRequestTime () + MIN_REQUEST_TIME) // try next floodfill if no response after min interval
 							done = !SendNextRequest (dest);
 					}
 					else // request is expired
@ -272,7 +267,7 @@ namespace data
 					{
 						if (dest->IsActive ())
 						{
-							boost::asio::post (s->GetIOService (), [s, dest]()
+							s->GetIOService ().post ([s, dest]()
 								{
 									if (dest->IsActive ()) s->SendNextRequest (dest);
 								});
@ -333,8 +328,7 @@ namespace data

 	void NetDbRequests::ScheduleManageRequests ()
 	{
-		m_ManageRequestsTimer.expires_from_now (boost::posix_time::milliseconds(MANAGE_REQUESTS_INTERVAL +
-			m_Rng () % MANAGE_REQUESTS_INTERVAL_VARIANCE));
+		m_ManageRequestsTimer.expires_from_now (boost::posix_time::seconds(MANAGE_REQUESTS_INTERVAL));
 		m_ManageRequestsTimer.async_wait (std::bind (&NetDbRequests::HandleManageRequestsTimer,
 			this, std::placeholders::_1));
 	}
@ -351,7 +345,7 @@ namespace data

 	void NetDbRequests::PostDatabaseSearchReplyMsg (std::shared_ptr<const I2NPMessage> msg)
 	{
-		boost::asio::post (GetIOService (), [this, msg]()
+		GetIOService ().post ([this, msg]()
 			{
 				HandleDatabaseSearchReplyMsg (msg);
 			});	
@ -360,12 +354,11 @@ namespace data
 	void NetDbRequests::HandleDatabaseSearchReplyMsg (std::shared_ptr<const I2NPMessage> msg)
 	{
 		const uint8_t * buf = msg->GetPayload ();
-		std::string key;
+		char key[48];
+		int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+		key[l] = 0;
 		size_t num = buf[32]; // num
-		if (CheckLogLevel (eLogInfo))
-			key = i2p::data::ByteStreamToBase64 (buf, 32);
 		LogPrint (eLogDebug, "NetDbReq: DatabaseSearchReply for ", key, " num=", num);
-
 		IdentHash ident (buf);
 		bool isExploratory = false;
 		auto dest = FindRequest (ident);
@ -438,7 +431,7 @@ namespace data
 	void NetDbRequests::PostRequestDestination (const IdentHash& destination, 
 		const RequestedDestination::RequestComplete& requestComplete, bool direct)
 	{
-		boost::asio::post (GetIOService (), [this, destination, requestComplete, direct]()
+		GetIOService ().post ([this, destination, requestComplete, direct]()
 			{
 				RequestDestination (destination, requestComplete, direct);
 			});	
--- a/libi2pd/NetDbRequests.h
+++ b/libi2pd/NetDbRequests.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -24,17 +24,15 @@ namespace i2p
 namespace data
 {
 	const int MAX_NUM_REQUEST_ATTEMPTS = 5;
-	const uint64_t MANAGE_REQUESTS_INTERVAL = 400; // in milliseconds
-	const uint64_t MANAGE_REQUESTS_INTERVAL_VARIANCE = 300; // in milliseconds
-	const uint64_t MIN_REQUEST_TIME = 1200; // in milliseconds
-	const uint64_t MAX_REQUEST_TIME = MAX_NUM_REQUEST_ATTEMPTS * (MIN_REQUEST_TIME + MANAGE_REQUESTS_INTERVAL + MANAGE_REQUESTS_INTERVAL_VARIANCE);
-	const uint64_t MIN_DIRECT_REQUEST_TIME = 600; // in milliseconds
+	const uint64_t MANAGE_REQUESTS_INTERVAL = 1; // in seconds
+	const uint64_t MIN_REQUEST_TIME = 5; // in seconds
+	const uint64_t MAX_REQUEST_TIME = MAX_NUM_REQUEST_ATTEMPTS * (MIN_REQUEST_TIME + MANAGE_REQUESTS_INTERVAL);
 	const uint64_t EXPLORATORY_REQUEST_INTERVAL = 55; // in seconds
 	const uint64_t EXPLORATORY_REQUEST_INTERVAL_VARIANCE = 170; // in seconds 
 	const uint64_t DISCOVERED_REQUEST_INTERVAL = 360; // in milliseconds
 	const uint64_t DISCOVERED_REQUEST_INTERVAL_VARIANCE = 540; // in milliseconds
-	const uint64_t MAX_EXPLORATORY_REQUEST_TIME = 30000; // in milliseconds
-	const uint64_t REQUEST_CACHE_TIME = MAX_REQUEST_TIME + 40000; // in milliseconds
+	const uint64_t MAX_EXPLORATORY_REQUEST_TIME = 30; // in seconds
+	const uint64_t REQUEST_CACHE_TIME = MAX_REQUEST_TIME + 40; // in seconds
 	const uint64_t REQUESTED_DESTINATIONS_POOL_CLEANUP_INTERVAL = 191; // in seconds
 	
 	class RequestedDestination
@ -53,7 +51,6 @@ namespace data
 			bool IsExploratory () const { return m_IsExploratory; };
 			bool IsDirect () const { return m_IsDirect; };
 			bool IsActive () const { return m_IsActive; };
-			bool IsSentDirectly () const { return m_IsSentDirectly; };
 			bool IsExcluded (const IdentHash& ident) const;
 			uint64_t GetCreationTime () const { return m_CreationTime; };
 			uint64_t GetLastRequestTime () const { return m_LastRequestTime; };
@ -72,9 +69,9 @@ namespace data
 		private:

 			IdentHash m_Destination;
-			bool m_IsExploratory, m_IsDirect, m_IsActive, m_IsSentDirectly;
+			bool m_IsExploratory, m_IsDirect, m_IsActive;
 			std::unordered_set<IdentHash> m_ExcludedPeers;
-			uint64_t m_CreationTime, m_LastRequestTime; // in milliseconds
+			uint64_t m_CreationTime, m_LastRequestTime; // in seconds
 			std::list<RequestComplete> m_RequestComplete;
 			int m_NumAttempts;
 	};
@ -118,9 +115,9 @@ namespace data
 			
 		private:

-			i2p::util::MemoryPoolMt<RequestedDestination> m_RequestedDestinationsPool;
 			std::unordered_map<IdentHash, std::shared_ptr<RequestedDestination> > m_RequestedDestinations;
 			std::list<IdentHash> m_DiscoveredRouterHashes;
+			i2p::util::MemoryPoolMt<RequestedDestination> m_RequestedDestinationsPool;
 			boost::asio::deadline_timer m_ManageRequestsTimer, m_ExploratoryTimer,
 				m_CleanupTimer, m_DiscoveredRoutersTimer;
 			std::mt19937 m_Rng;
--- a/libi2pd/PostQuantum.cpp
+++ b/libi2pd/PostQuantum.cpp
@ -1,160 +0,0 @@
-/*
-* Copyright (c) 2025, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
-#include "Log.h"
-#include "PostQuantum.h"
-
-#if OPENSSL_PQ
-
-#include <openssl/param_build.h>
-#include <openssl/core_names.h>
-
-namespace i2p
-{
-namespace crypto
-{
-	MLKEMKeys::MLKEMKeys (MLKEMTypes type):
-		m_Name (std::get<0>(MLKEMS[type])), m_KeyLen (std::get<1>(MLKEMS[type])), 
-		m_CTLen (std::get<2>(MLKEMS[type])), m_Pkey (nullptr)
-	{
-	}
-	
-	MLKEMKeys::~MLKEMKeys ()
-	{
-		if (m_Pkey) EVP_PKEY_free (m_Pkey);
-	}	
-
-	void MLKEMKeys::GenerateKeys ()
-	{
-		if (m_Pkey) EVP_PKEY_free (m_Pkey);
-		m_Pkey = EVP_PKEY_Q_keygen(NULL, NULL, m_Name.c_str ());
-	}
-
-	void MLKEMKeys::GetPublicKey (uint8_t * pub) const
-	{	
-		if (m_Pkey)
-		{	
-			size_t len = m_KeyLen;
-		    EVP_PKEY_get_octet_string_param (m_Pkey, OSSL_PKEY_PARAM_PUB_KEY, pub, m_KeyLen, &len);
-		}	
-	}
-
-	void MLKEMKeys::SetPublicKey (const uint8_t * pub)
-	{
-		if (m_Pkey)
-		{	
-			EVP_PKEY_free (m_Pkey);
-			m_Pkey = nullptr;
-		}	
-		OSSL_PARAM params[] =
-		{
-			OSSL_PARAM_octet_string (OSSL_PKEY_PARAM_PUB_KEY, (uint8_t *)pub, m_KeyLen),
-			OSSL_PARAM_END
-		};		
-		EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name (NULL, m_Name.c_str (), NULL);
-		if (ctx)
-		{
-			EVP_PKEY_fromdata_init (ctx);
-			EVP_PKEY_fromdata (ctx, &m_Pkey, OSSL_KEYMGMT_SELECT_PUBLIC_KEY, params);
-			EVP_PKEY_CTX_free (ctx);
-		}
-		else
-			LogPrint (eLogError, "MLKEM can't create PKEY context");
-	}
-
-	void MLKEMKeys::Encaps (uint8_t * ciphertext, uint8_t * shared)
-	{
-		if (!m_Pkey) return;
-		auto ctx = EVP_PKEY_CTX_new_from_pkey (NULL, m_Pkey, NULL);
-		if (ctx)
-		{	
-			EVP_PKEY_encapsulate_init (ctx, NULL);
-			size_t len = m_CTLen, sharedLen = 32;
-			EVP_PKEY_encapsulate (ctx, ciphertext, &len, shared, &sharedLen);
-			EVP_PKEY_CTX_free (ctx);
-		}
-		else
-			LogPrint (eLogError, "MLKEM can't create PKEY context");
-	}	
-
-	void MLKEMKeys::Decaps (const uint8_t * ciphertext, uint8_t * shared)
-	{
-		if (!m_Pkey) return;
-		auto ctx = EVP_PKEY_CTX_new_from_pkey (NULL, m_Pkey, NULL);
-		if (ctx)
-		{	
-			EVP_PKEY_decapsulate_init (ctx, NULL);
-			size_t sharedLen = 32;
-			EVP_PKEY_decapsulate (ctx, shared, &sharedLen, ciphertext, m_CTLen);
-			EVP_PKEY_CTX_free (ctx);
-		}
-		else
-			LogPrint (eLogError, "MLKEM can't create PKEY context");
-	}	
-
-	std::unique_ptr<MLKEMKeys> CreateMLKEMKeys (i2p::data::CryptoKeyType type)
-	{
-		if (type <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
-		    type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD > (int)MLKEMS.size ()) return nullptr;
-		return std::make_unique<MLKEMKeys>((MLKEMTypes)(type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD - 1));
-	}	
-
-	static constexpr std::array<std::pair<std::array<uint8_t, 32>, std::array<uint8_t, 32> >, 3> NoiseIKInitMLKEMKeys =
-	{
-		std::make_pair
-		(
-			std::array<uint8_t, 32>
-		 	{
-				0xb0, 0x8f, 0xb1, 0x73, 0x92, 0x66, 0xc9, 0x90, 0x45, 0x7f, 0xdd, 0xc6, 0x4e, 0x55, 0x40, 0xd8, 
-				0x0a, 0x37, 0x99, 0x06, 0x92, 0x2a, 0x78, 0xc4, 0xb1, 0xef, 0x86, 0x06, 0xd0, 0x15, 0x9f, 0x4d
-			}, // SHA256("Noise_IKhfselg2_25519+MLKEM512_ChaChaPoly_SHA256")
-			std::array<uint8_t, 32>
-		 	{
-				0x95, 0x8d, 0xf6, 0x6c, 0x95, 0xce, 0xa9, 0xf7, 0x42, 0xfc, 0xfa, 0x62, 0x71, 0x36, 0x1e, 0xa7,
-				0xdc, 0x7a, 0xc0, 0x75, 0x01, 0xcf, 0xf9, 0xfc, 0x9f, 0xdb, 0x4c, 0x68, 0x3a, 0x53, 0x49, 0xeb
-			} // SHA256 (first)
-		),
-		std::make_pair
-		(
-			std::array<uint8_t, 32>
-		 	{
-				0x36, 0x03, 0x90, 0x2d, 0xf9, 0xa2, 0x2a, 0x5e, 0xc9, 0x3d, 0xdb, 0x8f, 0xa8, 0x1b, 0xdb, 0x4b,
-				0xae, 0x9d, 0x93, 0x9c, 0xdf, 0xaf, 0xde, 0x55, 0x49, 0x13, 0xfe, 0x98, 0xf8, 0x4a, 0xd4, 0xbd
-			}, // SHA256("Noise_IKhfselg2_25519+MLKEM768_ChaChaPoly_SHA256")
-		 	std::array<uint8_t, 32>
-		 	{
-				0x15, 0x44, 0x89, 0xbf, 0x30, 0xf0, 0xc9, 0x77, 0x66, 0x10, 0xcb, 0xb1, 0x57, 0x3f, 0xab, 0x68,
-				0x79, 0x57, 0x39, 0x57, 0x0a, 0xe7, 0xc0, 0x31, 0x8a, 0xa2, 0x96, 0xef, 0xbf, 0xa9, 0x6a, 0xbb
-			} // SHA256 (first)
-		),
-		std::make_pair
-		(
-			std::array<uint8_t, 32>
-		 	{
-				0x86, 0xa5, 0x36, 0x44, 0xc6, 0x12, 0xd5, 0x71, 0xa1, 0x2d, 0xd8, 0xb6, 0x0a, 0x00, 0x9f, 0x2c,
-				0x1a, 0xa8, 0x7d, 0x22, 0xa4, 0xff, 0x2b, 0xcd, 0x61, 0x34, 0x97, 0x6d, 0xa1, 0x49, 0xeb, 0x4a
-			}, // SHA256("Noise_IKhfselg2_25519+MLKEM1024_ChaChaPoly_SHA256")
-		 	std::array<uint8_t, 32>
-		 	{
-				0x42, 0x0d, 0xc2, 0x1c, 0x7b, 0x18, 0x61, 0xb7, 0x4a, 0x04, 0x3d, 0xae, 0x0f, 0xdc, 0xf2, 0x71,
-				0xb9, 0xba, 0x19, 0xbb, 0xbd, 0x5f, 0xd4, 0x9c, 0x3f, 0x4b, 0x01, 0xed, 0x6d, 0x13, 0x1d, 0xa2
-			} // SHA256 (first)
-		)
-	};
-		
-	void InitNoiseIKStateMLKEM (NoiseSymmetricState& state, i2p::data::CryptoKeyType type, const uint8_t * pub)
-	{
-		if (type <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
-		    type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD > (int)NoiseIKInitMLKEMKeys.size ()) return;
-		auto ind = type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD - 1;
-		state.Init (NoiseIKInitMLKEMKeys[ind].first.data(), NoiseIKInitMLKEMKeys[ind].second.data(), pub);
-	}		
-}	
-}	
-
-#endif
--- a/libi2pd/PostQuantum.h
+++ b/libi2pd/PostQuantum.h
@ -1,88 +0,0 @@
-/*
-* Copyright (c) 2025, The PurpleI2P Project
-*
-* This file is part of Purple i2pd project and licensed under BSD3
-*
-* See full license text in LICENSE file at top of project tree
-*/
-
-#ifndef POST_QUANTUM_H__
-#define POST_QUANTUM_H__
-
-#include <memory>
-#include <string_view>
-#include <array>
-#include <tuple>
-#include "Crypto.h"
-#include "Identity.h"
-
-#if OPENSSL_PQ
-
-namespace i2p
-{
-namespace crypto
-{
-	enum MLKEMTypes
-	{
-		eMLKEM512 = 0,
-		eMLKEM768,
-		eMLKEM1024
-	};	
-	
-	constexpr size_t MLKEM512_KEY_LENGTH = 800;
-	constexpr size_t MLKEM512_CIPHER_TEXT_LENGTH = 768;
-	constexpr size_t MLKEM768_KEY_LENGTH = 1184;
-	constexpr size_t MLKEM768_CIPHER_TEXT_LENGTH = 1088;
-	constexpr size_t MLKEM1024_KEY_LENGTH = 1568;
-	constexpr size_t MLKEM1024_CIPHER_TEXT_LENGTH = 1568;
-
-	constexpr std::array<std::tuple<std::string_view, size_t, size_t>, 3> MLKEMS =
-	{
-		std::make_tuple ("ML-KEM-512", MLKEM512_KEY_LENGTH, MLKEM512_CIPHER_TEXT_LENGTH),
-		std::make_tuple ("ML-KEM-768", MLKEM768_KEY_LENGTH, MLKEM768_CIPHER_TEXT_LENGTH),
-		std::make_tuple ("ML-KEM-1024", MLKEM1024_KEY_LENGTH, MLKEM1024_CIPHER_TEXT_LENGTH)
-	};	
-
-	constexpr size_t GetMLKEMPublicKeyLen (i2p::data::CryptoKeyType type)
-	{
-		if (type <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
-		    type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD > (int)MLKEMS.size ()) return 0;
-		return std::get<1>(MLKEMS[type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD - 1]);
-	}	
-
-	constexpr size_t GetMLKEMCipherTextLen (i2p::data::CryptoKeyType type)
-	{
-		if (type <= i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD ||
-		    type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD > (int)MLKEMS.size ()) return 0;
-		return std::get<2>(MLKEMS[type - i2p::data::CRYPTO_KEY_TYPE_ECIES_X25519_AEAD - 1]);
-	}
-	
-	class MLKEMKeys
-	{
-		public:
-
-			MLKEMKeys (MLKEMTypes type);
-			~MLKEMKeys ();
-
-			void GenerateKeys ();
-			void GetPublicKey (uint8_t * pub) const;
-			void SetPublicKey (const uint8_t * pub);
-			void Encaps (uint8_t * ciphertext, uint8_t * shared);
-			void Decaps (const uint8_t * ciphertext, uint8_t * shared);
-			
-		private:
-
-			const std::string m_Name;
-			const size_t m_KeyLen, m_CTLen;
-			EVP_PKEY * m_Pkey;		
-	};
-
-	std::unique_ptr<MLKEMKeys> CreateMLKEMKeys (i2p::data::CryptoKeyType type);
-
-	void InitNoiseIKStateMLKEM (NoiseSymmetricState& state, i2p::data::CryptoKeyType type, const uint8_t * pub); // Noise_IK (ratchets) PQ ML-KEM5
-}	
-}	
-
-#endif
-
-#endif
--- a/libi2pd/Profiling.cpp
+++ b/libi2pd/Profiling.cpp
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -10,7 +10,6 @@
 #include <unordered_map>
 #include <list>
 #include <thread>
-#include <iomanip>
 #include <boost/property_tree/ptree.hpp>
 #include <boost/property_tree/ini_parser.hpp>
 #include "Base.h"
@ -27,21 +26,24 @@ namespace data
 	static i2p::fs::HashedStorage g_ProfilesStorage("peerProfiles", "p", "profile-", "txt");
 	static std::unordered_map<i2p::data::IdentHash, std::shared_ptr<RouterProfile> > g_Profiles;
 	static std::mutex g_ProfilesMutex;
-	static std::list<std::pair<i2p::data::IdentHash, std::function<void (std::shared_ptr<RouterProfile>)> > > g_PostponedUpdates;
-	static std::mutex g_PostponedUpdatesMutex;
+
+	static boost::posix_time::ptime GetTime ()
+	{
+		return boost::posix_time::second_clock::local_time();
+	}

 	RouterProfile::RouterProfile ():
-		m_IsUpdated (false), m_LastDeclineTime (0), m_LastUnreachableTime (0),
-		m_LastUpdateTime (i2p::util::GetSecondsSinceEpoch ()), m_LastAccessTime (0),
-		m_LastPersistTime (0), m_NumTunnelsAgreed (0), m_NumTunnelsDeclined (0),
-		m_NumTunnelsNonReplied (0),m_NumTimesTaken (0), m_NumTimesRejected (0),
-		m_HasConnected (false), m_IsDuplicated (false)
+		m_LastUpdateTime (GetTime ()), m_IsUpdated (false),
+		m_LastDeclineTime (0), m_LastUnreachableTime (0),
+		m_NumTunnelsAgreed (0), m_NumTunnelsDeclined (0), m_NumTunnelsNonReplied (0),
+		m_NumTimesTaken (0), m_NumTimesRejected (0), m_HasConnected (false),
+		m_IsDuplicated (false)
 	{
 	}

 	void RouterProfile::UpdateTime ()
 	{
-		m_LastUpdateTime = i2p::util::GetSecondsSinceEpoch ();
+		m_LastUpdateTime = GetTime ();
 		m_IsUpdated = true;
 	}

@ -60,7 +62,7 @@ namespace data
 			usage.put (PEER_PROFILE_USAGE_DUPLICATED, true);
 		// fill property tree
 		boost::property_tree::ptree pt;
-		pt.put (PEER_PROFILE_LAST_UPDATE_TIMESTAMP, m_LastUpdateTime);
+		pt.put (PEER_PROFILE_LAST_UPDATE_TIME, boost::posix_time::to_simple_string (m_LastUpdateTime));
 		if (m_LastUnreachableTime)
 			pt.put (PEER_PROFILE_LAST_UNREACHABLE_TIME, m_LastUnreachableTime);
 		pt.put_child (PEER_PROFILE_SECTION_PARTICIPATION, participation);
@ -80,7 +82,6 @@ namespace data

 	void RouterProfile::Load (const IdentHash& identHash)
 	{
-		m_IsUpdated = false;
 		std::string ident = identHash.ToBase64 ();
 		std::string path = g_ProfilesStorage.Path(ident);
 		boost::property_tree::ptree pt;
@ -103,22 +104,10 @@ namespace data

 		try
 		{
-			auto ts = pt.get (PEER_PROFILE_LAST_UPDATE_TIMESTAMP, 0);
-			if (ts)
-				m_LastUpdateTime = ts;
-			else	
-			{	
-				// try old lastupdatetime 
-				auto ut = pt.get (PEER_PROFILE_LAST_UPDATE_TIME, "");
-				if (ut.length () > 0)
-				{	
-					std::istringstream ss (ut); std::tm t;
-					ss >> std::get_time(&t, "%Y-%b-%d %H:%M:%S");
-					if (!ss.fail())
-						m_LastUpdateTime = mktime (&t); // t is local time
-				}	
-			}	
-			if (i2p::util::GetSecondsSinceEpoch () - m_LastUpdateTime < PEER_PROFILE_EXPIRATION_TIMEOUT)
+			auto t = pt.get (PEER_PROFILE_LAST_UPDATE_TIME, "");
+			if (t.length () > 0)
+				m_LastUpdateTime = boost::posix_time::time_from_string (t);
+			if ((GetTime () - m_LastUpdateTime).hours () < PEER_PROFILE_EXPIRATION_TIMEOUT)
 			{
 				m_LastUnreachableTime = pt.get (PEER_PROFILE_LAST_UNREACHABLE_TIME, 0);
 				try
@ -209,9 +198,10 @@ namespace data
 		return m_NumTunnelsNonReplied > 10*(total + 1);
 	}

-	bool RouterProfile::IsDeclinedRecently (uint64_t ts)
+	bool RouterProfile::IsDeclinedRecently ()
 	{
 		if (!m_LastDeclineTime) return false;
+		auto ts = i2p::util::GetSecondsSinceEpoch ();
 		if (ts > m_LastDeclineTime + PEER_PROFILE_DECLINED_RECENTLY_INTERVAL ||
 		    ts + PEER_PROFILE_DECLINED_RECENTLY_INTERVAL < m_LastDeclineTime)
 			m_LastDeclineTime = 0;
@ -220,10 +210,7 @@ namespace data

 	bool RouterProfile::IsBad ()
 	{
-		if (IsUnreachable () || m_IsDuplicated) return true;
-		auto ts = i2p::util::GetSecondsSinceEpoch ();
-		if (ts > PEER_PROFILE_MAX_DECLINED_INTERVAL + m_LastDeclineTime) return false;
-		if (IsDeclinedRecently (ts)) return true; 
+		if (IsDeclinedRecently () || IsUnreachable () || m_IsDuplicated) return true;
 		auto isBad = IsAlwaysDeclining () || IsLowPartcipationRate () /*|| IsLowReplyRate ()*/;
 		if (isBad && m_NumTimesRejected > 10*(m_NumTimesTaken + 1))
 		{
@ -258,36 +245,24 @@ namespace data
 			std::unique_lock<std::mutex> l(g_ProfilesMutex);
 			auto it = g_Profiles.find (identHash);
 			if (it != g_Profiles.end ())
-			{
-				it->second->SetLastAccessTime (i2p::util::GetSecondsSinceEpoch ());
 				return it->second;
 		}
-		}
 		auto profile = netdb.NewRouterProfile ();
 		profile->Load (identHash); // if possible
-		std::lock_guard<std::mutex> l(g_ProfilesMutex);
+		std::unique_lock<std::mutex> l(g_ProfilesMutex);
 		g_Profiles.emplace (identHash, profile);
 		return profile;
 	}

 	bool IsRouterBanned (const IdentHash& identHash)
 	{
-		std::lock_guard<std::mutex> l(g_ProfilesMutex);
+		std::unique_lock<std::mutex> l(g_ProfilesMutex);
 		auto it = g_Profiles.find (identHash);
 		if (it != g_Profiles.end ())
 			return it->second->IsUnreachable ();
 		return false;
 	}	
 		
-	bool IsRouterDuplicated (const IdentHash& identHash)
-	{
-		std::lock_guard<std::mutex> l(g_ProfilesMutex);
-		auto it = g_Profiles.find (identHash);
-		if (it != g_Profiles.end ())
-			return it->second->IsDuplicated ();
-		return false;
-	}	
-		
 	void InitProfilesStorage ()
 	{
 		g_ProfilesStorage.SetPlace(i2p::fs::GetDataDir());
@ -302,20 +277,18 @@ namespace data
 		
 	std::future<void> PersistProfiles ()
 	{
-		auto ts = i2p::util::GetSecondsSinceEpoch ();
+		auto ts = GetTime ();
 		std::list<std::pair<i2p::data::IdentHash, std::shared_ptr<RouterProfile> > > tmp;
 		{
-			std::lock_guard<std::mutex> l(g_ProfilesMutex);
+			std::unique_lock<std::mutex> l(g_ProfilesMutex);
 			for (auto it = g_Profiles.begin (); it != g_Profiles.end ();)
 			{
-				if (it->second->IsUpdated () && ts > it->second->GetLastPersistTime () + PEER_PROFILE_PERSIST_INTERVAL)
+				if ((ts - it->second->GetLastUpdateTime ()).total_seconds () > PEER_PROFILE_PERSIST_INTERVAL)
 				{
-					tmp.push_back (*it);
-					it->second->SetLastPersistTime (ts);
-					it->second->SetUpdated (false);
-				}	
-				if (!it->second->IsUpdated () && ts > std::max (it->second->GetLastUpdateTime (), it->second->GetLastAccessTime ()) + PEER_PROFILE_PERSIST_INTERVAL)
+					if (it->second->IsUpdated ())
+						tmp.push_back (std::make_pair (it->first, it->second));
 					it = g_Profiles.erase (it);
+				}
 				else
 					it++;
 			}
@ -329,12 +302,12 @@ namespace data
 	{
 		std::unordered_map<i2p::data::IdentHash, std::shared_ptr<RouterProfile> > tmp;
 		{
-			std::lock_guard<std::mutex> l(g_ProfilesMutex);
+			std::unique_lock<std::mutex> l(g_ProfilesMutex);
 			std::swap (tmp, g_Profiles);
 		}
-		auto ts = i2p::util::GetSecondsSinceEpoch ();
+		auto ts = GetTime ();
 		for (auto& it: tmp)
-			if (it.second->IsUseful() && (it.second->IsUpdated () || ts - it.second->GetLastUpdateTime () < PEER_PROFILE_EXPIRATION_TIMEOUT))
+			if (it.second->IsUseful() && (it.second->IsUpdated () || (ts - it.second->GetLastUpdateTime ()).total_seconds () < PEER_PROFILE_EXPIRATION_TIMEOUT*3600))
 				it.second->Save (it.first);
 	}

@ -352,7 +325,7 @@ namespace data
 				LogPrint(eLogWarning, "Profiling: Can't stat(): ", path);
 				continue;
 			}
-			if (now - st.st_mtime >= PEER_PROFILE_EXPIRATION_TIMEOUT) 
+			if (now - st.st_mtime >= PEER_PROFILE_EXPIRATION_TIMEOUT*3600) 
 			{
 				LogPrint(eLogDebug, "Profiling: Removing expired peer profile: ", path);
 				i2p::fs::Remove(path);
@ -363,11 +336,11 @@ namespace data
 	std::future<void> DeleteObsoleteProfiles ()
 	{
 		{
-			auto ts = i2p::util::GetSecondsSinceEpoch ();
-			std::lock_guard<std::mutex> l(g_ProfilesMutex);
+			auto ts = GetTime ();
+			std::unique_lock<std::mutex> l(g_ProfilesMutex);
 			for (auto it = g_Profiles.begin (); it != g_Profiles.end ();)
 			{
-				if (ts - it->second->GetLastUpdateTime () >= PEER_PROFILE_EXPIRATION_TIMEOUT)
+				if ((ts - it->second->GetLastUpdateTime ()).total_seconds () >= PEER_PROFILE_EXPIRATION_TIMEOUT*3600)
 					it = g_Profiles.erase (it);
 				else
 					it++;
@ -376,47 +349,5 @@ namespace data

 		return std::async (std::launch::async, DeleteFilesFromDisk);
 	}
-
-	bool UpdateRouterProfile (const IdentHash& identHash, std::function<void (std::shared_ptr<RouterProfile>)> update)
-	{
-		if (!update) return true;
-		std::shared_ptr<RouterProfile> profile;
-		{
-			std::lock_guard<std::mutex> l(g_ProfilesMutex);
-			auto it = g_Profiles.find (identHash);
-			if (it != g_Profiles.end ())
-				profile = it->second;
-		}
-		if (profile)
-		{
-			update (profile);
-			return true;
-		}	
-		// postpone
-		std::lock_guard<std::mutex> l(g_PostponedUpdatesMutex);
-		g_PostponedUpdates.emplace_back (identHash, update);
-		return false;
-	}	
-
-	static void ApplyPostponedUpdates (std::list<std::pair<i2p::data::IdentHash, std::function<void (std::shared_ptr<RouterProfile>)> > >&& updates)
-	{
-		for (const auto& [ident, update] : updates)
-		{
-			auto profile = GetRouterProfile (ident);
-			update (profile);
-		}	
-	}	
-		
-	std::future<void> FlushPostponedRouterProfileUpdates ()
-	{
-		if (g_PostponedUpdates.empty ()) return std::future<void>();
-
-		std::list<std::pair<i2p::data::IdentHash, std::function<void (std::shared_ptr<RouterProfile>)> > > updates;
-		{
-			std::lock_guard<std::mutex> l(g_PostponedUpdatesMutex);
-			g_PostponedUpdates.swap (updates);
-		}		
-		return std::async (std::launch::async, ApplyPostponedUpdates, std::move (updates));	
-	}	
 }
 }
--- a/libi2pd/Profiling.h
+++ b/libi2pd/Profiling.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2025, The PurpleI2P Project
+* Copyright (c) 2013-2024, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -11,8 +11,7 @@

 #include <memory>
 #include <future>
-#include <functional>
-#include <boost/asio.hpp>
+#include <boost/date_time/posix_time/posix_time.hpp>
 #include "Identity.h"

 namespace i2p
@ -23,8 +22,7 @@ namespace data
 	const char PEER_PROFILE_SECTION_PARTICIPATION[] = "participation";
 	const char PEER_PROFILE_SECTION_USAGE[] = "usage";
 	// params
-	const char PEER_PROFILE_LAST_UPDATE_TIME[] = "lastupdatetime"; // deprecated
-	const char PEER_PROFILE_LAST_UPDATE_TIMESTAMP[] = "lastupdatetimestamp";
+	const char PEER_PROFILE_LAST_UPDATE_TIME[] = "lastupdatetime";
 	const char PEER_PROFILE_LAST_UNREACHABLE_TIME[] = "lastunreachabletime";
 	const char PEER_PROFILE_PARTICIPATION_AGREED[] = "agreed";
 	const char PEER_PROFILE_PARTICIPATION_DECLINED[] = "declined";
@ -34,19 +32,15 @@ namespace data
 	const char PEER_PROFILE_USAGE_CONNECTED[] = "connected";
 	const char PEER_PROFILE_USAGE_DUPLICATED[] = "duplicated";
 	
-	const int PEER_PROFILE_EXPIRATION_TIMEOUT = 36*60*60; // in seconds (1.5 days)
+	const int PEER_PROFILE_EXPIRATION_TIMEOUT = 36; // in hours (1.5 days)
 	const int PEER_PROFILE_AUTOCLEAN_TIMEOUT = 1500; // in seconds (25 minutes)
 	const int PEER_PROFILE_AUTOCLEAN_VARIANCE = 900; // in seconds (15 minutes)
 	const int PEER_PROFILE_OBSOLETE_PROFILES_CLEAN_TIMEOUT = 5400; // in seconds (1.5 hours)
 	const int PEER_PROFILE_OBSOLETE_PROFILES_CLEAN_VARIANCE = 2400; // in seconds (40 minutes)
-	const int PEER_PROFILE_DECLINED_RECENTLY_INTERVAL = 330; // in seconds (5.5 minutes)
-	const int PEER_PROFILE_MAX_DECLINED_INTERVAL = 4400; // in second (1.5 hours)
-	const int PEER_PROFILE_PERSIST_INTERVAL = 1320; // in seconds (22 minutes)
+	const int PEER_PROFILE_DECLINED_RECENTLY_INTERVAL = 150; // in seconds (2.5 minutes)
+	const int PEER_PROFILE_PERSIST_INTERVAL = 3300; // in seconds (55 minutes)
 	const int PEER_PROFILE_UNREACHABLE_INTERVAL = 480; // in seconds (8 minutes)
 	const int PEER_PROFILE_USEFUL_THRESHOLD = 3;
-	const int PEER_PROFILE_ALWAYS_DECLINING_NUM = 5; // num declines in row to consider always declined
-	const int PEER_PROFILE_APPLY_POSTPONED_TIMEOUT = 2100; // in milliseconds	
-	const int PEER_PROFILE_APPLY_POSTPONED_TIMEOUT_VARIANCE = 500; // in milliseconds	

 	class RouterProfile
 	{
@ -68,22 +62,12 @@ namespace data
 			void Connected ();
 			void Duplicated ();

-			uint64_t GetLastUpdateTime () const { return m_LastUpdateTime; };
+			boost::posix_time::ptime GetLastUpdateTime () const { return m_LastUpdateTime; };
 			bool IsUpdated () const { return m_IsUpdated; };
-			void SetUpdated (bool updated) { m_IsUpdated = updated; }
-			uint64_t GetLastAccessTime () const { return m_LastAccessTime; };
-			void SetLastAccessTime (uint64_t ts) { m_LastAccessTime = ts; };
-			uint64_t GetLastPersistTime () const { return m_LastPersistTime; };
-			void SetLastPersistTime (uint64_t ts) { m_LastPersistTime = ts; };
 			
 			bool IsUseful() const;
 			bool IsDuplicated () const { return m_IsDuplicated; };
 			
-			const boost::asio::ip::udp::endpoint& GetLastEndpoint () const { return m_LastEndpoint; }
-			void SetLastEndpoint (const boost::asio::ip::udp::endpoint& ep) { m_LastEndpoint = ep; }
-			bool HasLastEndpoint (bool v4) const { return !m_LastEndpoint.address ().is_unspecified () && m_LastEndpoint.port () && 
-				((v4 && m_LastEndpoint.address ().is_v4 ()) || (!v4 && m_LastEndpoint.address ().is_v6 ())); }
-			
 		private:

 			void UpdateTime ();
@ -91,13 +75,13 @@ namespace data
 			bool IsAlwaysDeclining () const { return !m_NumTunnelsAgreed && m_NumTunnelsDeclined >= 5; };
 			bool IsLowPartcipationRate () const;
 			bool IsLowReplyRate () const;
-			bool IsDeclinedRecently (uint64_t ts);
+			bool IsDeclinedRecently ();

 		private:

+			boost::posix_time::ptime m_LastUpdateTime; // TODO: use std::chrono
 			bool m_IsUpdated;
-			uint64_t m_LastDeclineTime, m_LastUnreachableTime, m_LastUpdateTime, 
-				m_LastAccessTime, m_LastPersistTime; // in seconds
+			uint64_t m_LastDeclineTime, m_LastUnreachableTime; // in seconds
 			// participation
 			uint32_t m_NumTunnelsAgreed;
 			uint32_t m_NumTunnelsDeclined;
@ -107,19 +91,14 @@ namespace data
 			uint32_t m_NumTimesRejected;
 			bool m_HasConnected; // successful trusted(incoming or NTCP2) connection 
 			bool m_IsDuplicated;
-			// connectivity
-			boost::asio::ip::udp::endpoint m_LastEndpoint; // SSU2 for non-published addresses
 	};

 	std::shared_ptr<RouterProfile> GetRouterProfile (const IdentHash& identHash);
 	bool IsRouterBanned (const IdentHash& identHash); // check only existing profiles
-	bool IsRouterDuplicated (const IdentHash& identHash); // check only existing profiles
 	void InitProfilesStorage ();
 	std::future<void> DeleteObsoleteProfiles ();
 	void SaveProfiles ();
 	std::future<void> PersistProfiles ();
-	bool UpdateRouterProfile (const IdentHash& identHash, std::function<void (std::shared_ptr<RouterProfile>)> update); // return true if updated immediately, and false if postponed
-	std::future<void> FlushPostponedRouterProfileUpdates ();
 }
 }

--- a/libi2pd/Queue.h
+++ b/libi2pd/Queue.h
@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2024, The PurpleI2P Project
+* Copyright (c) 2013-2020, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@ -9,7 +9,8 @@
 #ifndef QUEUE_H__
 #define QUEUE_H__

-#include <list>
+#include <queue>
+#include <vector>
 #include <mutex>
 #include <thread>
 #include <condition_variable>
@ -28,16 +29,18 @@ namespace util
 			void Put (Element e)
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
-				m_Queue.push_back (std::move(e));
+				m_Queue.push (std::move(e));
 				m_NonEmpty.notify_one ();
 			}

-			void Put (std::list<Element>& list)
+			template<template<typename, typename...>class Container, typename... R>
+			void Put (const Container<Element, R...>& vec)
 			{
-				if (!list.empty ())
+				if (!vec.empty ())
 				{
 					std::unique_lock<std::mutex> l(m_QueueMutex);
-					m_Queue.splice (m_Queue.end (), list); 
+					for (const auto& it: vec)
+						m_Queue.push (std::move(it));
 					m_NonEmpty.notify_one ();
 				}
 			}
@ -84,7 +87,7 @@ namespace util
 				return m_Queue.empty ();
 			}

-			int GetSize () const
+			int GetSize ()
 			{
 				std::unique_lock<std::mutex> l(m_QueueMutex);
 				return m_Queue.size ();
@ -104,19 +107,6 @@ namespace util
 				return GetNonThreadSafe (true);
 			}

-			void GetWholeQueue (std::list<Element>& queue)
-			{
-				if (!queue.empty ())
-				{	
-					std::list<Element> newQueue;
-					queue.swap (newQueue);
-				}	
-				{
-					std::unique_lock<std::mutex> l(m_QueueMutex);
-					m_Queue.swap (queue);
-				}
-			}		
-
 		private:

 			Element GetNonThreadSafe (bool peek = false)
@ -125,7 +115,7 @@ namespace util
 				{
 					auto el = m_Queue.front ();
 					if (!peek)
-						m_Queue.pop_front ();
+						m_Queue.pop ();
 					return el;
 				}
 				return nullptr;
@ -133,8 +123,8 @@ namespace util

 		private:

-			std::list<Element> m_Queue;
-			mutable std::mutex m_QueueMutex;
+			std::queue<Element> m_Queue;
+			std::mutex m_QueueMutex;
 			std::condition_variable m_NonEmpty;
 	};
 }
--- a/Show more
+++ b/Show more