diff --git a/src/dune b/src/dune
index fc4f47b2..90283be3 100644
--- a/src/dune
+++ b/src/dune
@@ -6,6 +6,7 @@
   headers_lib
   syntax
   ;
+  mirage-crypto
   duration
   vif
   fmt
diff --git a/src/management.ml b/src/management.ml
index 25d6825c..320efa92 100644
--- a/src/management.ml
+++ b/src/management.ml
@@ -2,7 +2,6 @@
 
    https://docs.taler.net/taler-exchange-manual.html#offline-signing-setup-key-maintenance-and-tear-down
 
-
    The exchange HTTP service must be running before you can complete the following offline signing procedure. Note that when an exchange is running without offline keys its not fully operational. To make the exchange HTTP service fully operational, the following steps involving the offline signing machine must be completed:
 
   1) The public keys of various online keys used by the exchange service are exported via a management HTTP API.
@@ -22,3 +21,32 @@
    - implement `POST /management/keys`
    - offline tool do: GET -> sign -> POST
    - now we should have a server with valid keys signed by the master offline key *)
+(* implement secmod / crytpo stuff as a vif device *)
+
+(* https://docs.taler.net/core/api-common.html#cryptographic-primitives
+
+   All elliptic curve operations are on Curve25519.
+   Public and private keys are thus 32 bytes, and signatures 64 bytes.
+   For hashing, including HKDFs, Taler uses 512-bit hash codes (64 bytes). *)
+
+(* TODO big choice
+   do we re-implement crypto
+   or do we re-use secmodules with IPC on a Unix domain socket *)
+
+type key =
+  | Eddsa of Mirage_crypto_ec.Ed25519.(priv * pub)
+  | Rsa of Mirage_crypto_pk.Rsa.(priv * pub)
+
+let eddsa_online_key_device =
+  let finally _key = () in
+  Vif.Device.v ~name:"eddsa_online_key" ~finally [] @@ fun () ->
+  (* [Mirage_crypto_rng_miou_unix.(initialize (module Pfortuna))] is already done by [Vif.run] *)
+  Eddsa (Mirage_crypto_ec.Ed25519.generate ())
+
+let rsa_denomination_key_device =
+  let finally _key = () in
+  Vif.Device.v ~name:"rsa_denomination_key" ~finally [] @@ fun () ->
+  let open Mirage_crypto_pk.Rsa in
+  let rsa_keysize = 2048 in
+  let priv = generate ~bits:rsa_keysize () in
+  Rsa (priv, pub_of_priv priv)
diff --git a/src/mte.ml b/src/mte.ml
index a9a60f15..e0cca800 100644
--- a/src/mte.ml
+++ b/src/mte.ml
@@ -121,5 +121,12 @@ let () =
   in
   Miou_unix.run @@ fun () ->
   let env = () in
+  let devices =
+    Vif.Devices.
+      [
+        Management.eddsa_online_key_device
+      ; Management.rsa_denomination_key_device
+      ]
+  in
   let middlewares = Vif.Middlewares.[] in
-  Vif.run ~cfg ~middlewares routes env
+  Vif.run ~cfg ~devices ~middlewares routes env