diff --git a/.ocamlformat b/.ocamlformat
index 43b12fc0..309668a5 100644
--- a/.ocamlformat
+++ b/.ocamlformat
@@ -1,4 +1,4 @@
-version=0.28.1
+version=0.29.0
 exp-grouping=preserve
 type-decl=sparse
 break-infix=fit-or-vertical
diff --git a/GNUmakefile b/GNUmakefile
index 09d3e86f..49a9445f 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -28,7 +28,7 @@ pins:
 	opam pin --no-action --yes add caqti-miou "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
 	opam pin --no-action --yes add caqti-mnet "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
 	opam pin --no-action --yes add caqti-driver-pgx "git+https://github.com/swrup/ocaml-caqti.git#7838c29ffa9095d32b95affee26b22ef2ad302fd"
-	opam pin --no-action --yes "git+https://github.com/swrup/mfat.git#40afdb419df56d4932928a61906e012a3c534549"
+	opam pin --no-action --yes "git+https://github.com/swrup/mfat.git#3a98411c507fb38d9442cbf3fc079bd8be97fee6"
 
 
 .PHONY: vendors
@@ -55,7 +55,7 @@ manifest:
 	dune exec src/mte.exe > src/manifest.json
 
 build:
-	dune build src/mte.exe
+	dune build --workspace dune-workspace.solo5 src/mte.exe
 
 run: build
 	solo5-hvt --block:storage=$(secmod_fat) --net:service=$(tap_device) -- ./_build/solo5/src/mte.exe --solo5:quiet
diff --git a/default/assets/mte.conf b/default/assets/mte.conf
index f9064832..9a5ffcec 100644
--- a/default/assets/mte.conf
+++ b/default/assets/mte.conf
@@ -1,4 +1,4 @@
-[currency-KUDO]
+[currency-KUDOS]
 enabled= YES
 code= KUDOS
 name= Kudos
@@ -40,16 +40,16 @@ default_purse_limit = 9999
 config = "pgx://mte:hunter2@10.0.0.1:5432/taler-exchange"
 
 [taler-exchange-secmod-rsa]
-lookahead_sign = "7 weeks"
+lookahead_sign = "1 year"
 overlap_duration = "1 hour"
-duration = "3 weeks"
+duration = "9 weeks"
 
 [taler-exchange-secmod-eddsa]
 lookahead_sign = "1 year"
 overlap_duration = "1 hour"
 duration = "3 weeks"
 
-[coin_kudo_1]
+[coin_kudos_1]
 value= KUDOS:0.01
 duration_withdraw= "1 year"
 duration_spend= "1 year"
@@ -62,7 +62,7 @@ cipher= RSA
 rsa_keysize= 2048
 age_restricted= NO
 
-[coin_kudo_2]
+[coin_kudos_2]
 value= KUDOS:0.02
 duration_withdraw= "1 year"
 duration_spend= "1 year"
diff --git a/dune-project b/dune-project
index 1fdae6f6..eb3e0b72 100644
--- a/dune-project
+++ b/dune-project
@@ -1,46 +1,2 @@
 (lang dune 3.20)
-
 (name mte)
-
-; (generate_opam_files true)
-;
-; ; (source
-; ; (github username/reponame))
-;
-; (authors "Olivier Pierre <swrup@protonmail.com>")
-;
-; (maintainers "Olivier Pierre <swrup@protonmail.com>")
-;
-; (license AGPL-3.0-only)
-;
-; ; (documentation https://url/to/documentation)
-;
-; (package
-;  (name mte)
-;  (synopsis "MTE - the MirageOS Taler Exchange")
-;  (description "A GNU Taler exchange implementation with the unikernel framework MirageOS")
-;  (tags
-;   ("GNU Taler" MirageOS unikernel OCaml crypto))
-;  (depends
-;    (ocaml (>= 5.3))
-;    base32
-;    caqti
-;    caqti-miou
-;    caqti-driver-pgx
-;    crunch
-;    vif
-;    jsont
-;    cohttp
-;    fmt
-;    bin
-;    angstrom
-;    mirage-crypto
-;    kdf
-;    digestif
-;    duration
-;    jsont
-;    cohttp
-;    ptime
-;    logs
-;   (ocamlformat :with-dev-setup)
-;    ))
diff --git a/dune-workspace b/dune-workspace.solo5
similarity index 100%
rename from dune-workspace
rename to dune-workspace.solo5
diff --git a/eddsa_sed.sh b/eddsa_sed.sh
index 1ef8a9a6..4fab4e85 100644
--- a/eddsa_sed.sh
+++ b/eddsa_sed.sh
@@ -1,27 +1,29 @@
 #!/bin/bash
 set -e
 
-sed "s/EddsaPrivateKey\.t /Eddsa\.priv /g" -i src/*
-sed "s/EddsaPrivateKey\.t;/Eddsa\.priv;/g" -i src/*
-sed "s/EddsaPublicKey\.t /Eddsa\.pub /g" -i src/*
-sed "s/EddsaPublicKey\.t;/Eddsa\.pub;/g" -i src/*
-sed "s/EddsaSignature\.t /Eddsa\.sig_ /g" -i src/*
-sed "s/EddsaSignature\.t;/Eddsa\.sig_;/g" -i src/*
-sed "s/EddsaPublicKey\.t)/Eddsa\.pub)/g" -i src/*
+file="tools/*"
 
-sed "s/EddsaPrivateKey\.of_octets /Eddsa\.priv_of_octets /g" -i src/*
-sed "s/EddsaPrivateKey\.to_octets /Eddsa\.priv_to_octets /g" -i src/*
-sed "s/EddsaPrivateKey\.pub_of_priv /Eddsa\.pub_of_priv /g" -i src/*
-sed "s/EddsaPrivateKey\.generate /Eddsa\.generate /g" -i src/*
-sed "s/EddsaPrivateKey\.bin /Eddsa\.priv_bin /g" -i src/*
+sed "s/EddsaPrivateKey\.t /Eddsa\.priv /g" -i $file
+sed "s/EddsaPrivateKey\.t;/Eddsa\.priv;/g" -i $file
+sed "s/EddsaPublicKey\.t /Eddsa\.pub /g" -i $file
+sed "s/EddsaPublicKey\.t;/Eddsa\.pub;/g" -i $file
+sed "s/EddsaSignature\.t /Eddsa\.sig_ /g" -i $file
+sed "s/EddsaSignature\.t;/Eddsa\.sig_;/g" -i $file
+sed "s/EddsaPublicKey\.t)/Eddsa\.pub)/g" -i $file
 
-sed "s/EddsaPublicKey\.to_b32 /Eddsa\.pub_to_b32 /g" -i src/*
-sed "s/EddsaPublicKey\.of_b32 /Eddsa\.pub_of_b32 /g" -i src/*
-sed "s/EddsaSignature\.sign /Eddsa\.sign /g" -i src/*
+sed "s/EddsaPrivateKey\.of_octets /Eddsa\.priv_of_octets /g" -i $file
+sed "s/EddsaPrivateKey\.to_octets /Eddsa\.priv_to_octets /g" -i $file
+sed "s/EddsaPrivateKey\.pub_of_priv /Eddsa\.pub_of_priv /g" -i $file
+sed "s/EddsaPrivateKey\.generate /Eddsa\.generate /g" -i $file
+sed "s/EddsaPrivateKey\.bin /Eddsa\.priv_bin /g" -i $file
 
-sed "s/EddsaPrivateKey\.jsont/Eddsa\.priv_jsont/g" -i src/*
-sed "s/EddsaPublicKey\.jsont/Eddsa\.pub_jsont/g" -i src/*
-sed "s/EddsaSignature\.jsont/Eddsa\.sig_jsont/g" -i src/*
-sed "s/EddsaPrivateKey\.caqti/Eddsa\.priv_caqti/g" -i src/*
-sed "s/EddsaPublicKey\.caqti/Eddsa\.pub_caqti/g" -i src/*
-sed "s/EddsaSignature\.caqti/Eddsa\.sig_caqti/g" -i src/*
+sed "s/EddsaPublicKey\.to_b32 /Eddsa\.pub_to_b32 /g" -i $file
+sed "s/EddsaPublicKey\.of_b32 /Eddsa\.pub_of_b32 /g" -i $file
+sed "s/EddsaSignature\.sign /Eddsa\.sign /g" -i $file
+
+sed "s/EddsaPrivateKey\.jsont/Eddsa\.priv_jsont/g" -i $file
+sed "s/EddsaPublicKey\.jsont/Eddsa\.pub_jsont/g" -i $file
+sed "s/EddsaSignature\.jsont/Eddsa\.sig_jsont/g" -i $file
+sed "s/EddsaPrivateKey\.caqti/Eddsa\.priv_caqti/g" -i $file
+sed "s/EddsaPublicKey\.caqti/Eddsa\.pub_caqti/g" -i $file
+sed "s/EddsaSignature\.caqti/Eddsa\.sig_caqti/g" -i $file
diff --git a/test/management.sh b/test/management.sh
index 1a13d8bf..7f78333d 100755
--- a/test/management.sh
+++ b/test/management.sh
@@ -5,7 +5,7 @@ set -e
 a="/tmp/a.json"
 b="/tmp/b.json"
 
-url="http://localhost:3434"
+url="http://10.0.0.2:3434"
 auditor_pub="A17JXR3E6J4CXDPYT7S1H25PGJ3ABS26TQ38654QCX0TB59RPMF0"
 master_key="./default/master_offline_private_key"
 zero_kudos="KUDOS:0.0"
diff --git a/tools/dbinit.sh b/tools/dbinit.sh
index 4d74bc9a..726dafad 100755
--- a/tools/dbinit.sh
+++ b/tools/dbinit.sh
@@ -24,7 +24,7 @@ init_sql="${out_dir}/init.sql"
 drop_sql="${out_dir}/drop.sql"
 
 # psql parameter
-host="localhost"
+host="10.0.0.1"
 port=5432
 username="mte"
 dbname="taler-exchange"
diff --git a/tools/dune b/tools/dune
index d761cb4e..8f30fd36 100644
--- a/tools/dune
+++ b/tools/dune
@@ -2,15 +2,15 @@
  (public_name offline)
  (name offline)
  (modules offline offline_impl)
- (libraries cmdliner bos fmt mirage-crypto mtime ptime mte vif))
+ (libraries mte mtime mtime.clock mirage-crypto-rng.unix cmdliner bos fmt))
 
 (executable
  (public_name gen_registry_files)
  (name gen_registry_files)
  (modules gen_registry_files)
- (libraries recfile_parser bos fmt))
+ (libraries recfile_parser cmdliner bos fmt))
 
 (library
  (name recfile_parser)
  (modules recfile_parser)
- (libraries angstrom bos cmdliner fmt))
+ (libraries angstrom fmt))
diff --git a/tools/offline.ml b/tools/offline.ml
index 0a13ea34..4230af46 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -53,17 +53,17 @@ module Arg = struct
       ()
 
   let eddsa_pub =
-    let parser s = Crypto.EddsaPublicKey.of_b32 s in
+    let parser s = Eddsa.pub_of_b32 s in
     let pp fmt key =
-      let s = Crypto.EddsaPublicKey.to_b32 key in
+      let s = Eddsa.pub_to_b32 key in
       Fmt.pf fmt "%s" s
     in
     Arg.Conv.make ~docv:"eddsa public key argument" ~parser ~pp ()
 
   let rsa_pub =
-    let parser s = Crypto.RsaPublicKey.of_b32 s in
+    let parser s = Rsa.pub_of_b32 s in
     let pp fmt key =
-      let s = Crypto.RsaPublicKey.to_b32 key in
+      let s = Rsa.pub_to_b32 key in
       Fmt.pf fmt "%s" s
     in
     Arg.Conv.make ~docv:"rsa public key argument" ~parser ~pp ()
@@ -155,11 +155,11 @@ let revoke_denom_cmd =
     match is_rsa_pub with
     | false -> Ok v
     | true -> (
-        match Crypto.RsaPublicKey.of_b32 v with
+        match Rsa.pub_of_b32 v with
         | Error e -> Error e
         | Ok rsa_pub ->
-            let h = Crypto.DenominationHash.hash_of_rsa rsa_pub in
-            let s = Crypto.DenominationHash.to_b32 h in
+            let h = Hash.DenominationHash.hash_of_rsa rsa_pub in
+            let s = Hash.DenominationHash.to_b32 h in
             Ok s)
   in
   match res with
@@ -173,8 +173,8 @@ let test_denomination_hash_cmd =
   Cmd.make (Cmd.info "denomination-hash" ~doc)
   @@
   let+ rsa_pub = rsa_pub in
-  let h = Crypto.DenominationHash.hash_of_rsa rsa_pub in
-  let s = Crypto.DenominationHash.to_b32 h in
+  let h = Hash.DenominationHash.hash_of_rsa rsa_pub in
+  let s = Hash.DenominationHash.to_b32 h in
   Fmt.pr "%s@." s; Ok ()
 
 let revoke_signkey_cmd =
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index d3ab9e41..c8d02e97 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -1,7 +1,11 @@
 open Syntax
-open Crypto
+open Time
 open Hash
 
+let now_s () =
+  let ns = Mtime_clock.now_ns () in
+  Int64.unsigned_div ns 1_000_000_000L
+
 module Future_keys = struct
   open Api
 
@@ -34,7 +38,7 @@ module Future_keys = struct
         match denom_pub with DenominationKey.Rsa denom -> denom.rsa_pub
       in
       let h_denom_pub = DenominationHash.hash_of_rsa rsa_pub in
-      let h_section_name = Hash.Cstring.H64.hash section_name in
+      let h_section_name = H64_cstring.hash section_name in
       let anchor_time = stamp_start in
       let duration_withdraw =
         Timestamp.diff stamp_start stamp_expire_withdraw
@@ -103,9 +107,9 @@ module Future_keys = struct
       let h_denom_pub = DenominationHash.hash_of_rsa rsa_pub in
       let master_sig =
         let open Signatures.DenominationKeyValidity in
-        let master = EddsaPrivateKey.(pub_of_priv master_key) in
+        let master = Eddsa.pub_of_priv master_key in
         signf
-          (EddsaSignature.sign ~key:master_key)
+          (Eddsa.sign ~key:master_key)
           {
             master;
             start= stamp_start;
@@ -128,7 +132,7 @@ module Future_keys = struct
       let master_sig =
         let open Signatures.ExchangeSigningKeyValidity in
         signf
-          (EddsaSignature.sign ~key:master_key)
+          (Eddsa.sign ~key:master_key)
           {
             start= stamp_start;
             expire= stamp_expire;
@@ -152,7 +156,7 @@ let write_file fname content =
 
 let read_master_key_file filename =
   let* master_key = read_file filename in
-  EddsaPrivateKey.of_octets master_key
+  Eddsa.priv_of_octets master_key
 
 let download ~output ~url =
   let open Bos in
@@ -199,7 +203,7 @@ let setup ~output ~output_pubkey =
 let sign ~master_key ~input ~output =
   let* master_key = read_master_key_file master_key in
   let* input = read_file input in
-  let master_pub = EddsaPrivateKey.pub_of_priv master_key in
+  let master_pub = Eddsa.pub_of_priv master_key in
   let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in
   let* () = Future_keys.verify master_pub future_keys_response in
   let master_signatures = Future_keys.make ~master_key future_keys_response in
@@ -213,7 +217,7 @@ let revoke_denom ~output ~master_key ~h_denom =
   let denom_revoke =
     let master_sig =
       let open Signatures.MasterDenominationKeyRevocation in
-      signf (EddsaSignature.sign ~key) { h_denom_pub }
+      signf (Eddsa.sign ~key) { h_denom_pub }
     in
     Api.DenomRevocationSignature.{ master_sig }
   in
@@ -226,7 +230,7 @@ let revoke_signkey ~output ~master_key ~signkey =
   let signkey_revoke =
     let master_sig =
       let open Signatures.MasterSigningKeyRevocation in
-      signf (EddsaSignature.sign ~key) { exchange_pub= signkey }
+      signf (Eddsa.sign ~key) { exchange_pub= signkey }
     in
     Api.SignkeyRevocationSignature.{ master_sig }
   in
@@ -248,7 +252,7 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
   in
   let master_sig =
     let open Signatures.GlobalFees in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
         start_date;
         end_date;
@@ -280,15 +284,14 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
 
 let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub =
   let* key = read_master_key_file master_key in
-  let ns = Mtime_clock.now_ns () in
-  let validity_start = Timestamp.of_s @@ Int64.unsigned_div ns 1_000_000_000L in
+  let validity_start = Timestamp.of_s (now_s ()) in
   let master_sig =
     let open Signatures.MasterAddAuditor in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
         start_date= validity_start;
         auditor_pub;
-        h_auditor_url= Hash.Cstring.H64.hash auditor_url;
+        h_auditor_url= H64_cstring.hash auditor_url;
       }
   in
   let v =
@@ -301,18 +304,14 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub =
 
 let disable_auditor ~output ~master_key ~auditor_pub =
   let* key = read_master_key_file master_key in
-  let ns = Mtime_clock.now_ns () in
-  let open Time in
-  let validity_end =
-    TimeAbsolute.of_s @@ Int64.unsigned_div ns 1_000_000_000L
-  in
+  let validity_end = TimeAbsolute.of_s (now_s ()) in
   (* hack for tests: +1sec to be sure it overwrite previous timestamp *)
   let validity_end =
     Timestamp.of_absolute (TimeAbsolute.add validity_end TimeRelative.(of_s 1L))
   in
   let master_sig =
     let open Signatures.MasterDelAuditor in
-    signf (EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
+    signf (Eddsa.sign ~key) { end_date= validity_end; auditor_pub }
   in
   let v = Api.AuditorTeardownMessage.{ master_sig; validity_end } in
   let* s = Api.encode Api.AuditorTeardownMessage.jsont v in
@@ -324,9 +323,9 @@ let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
   let* key = read_master_key_file master_key in
   let master_sig_wire =
     let open Signatures.MasterWireFee in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
-        h_wire_method= Hash.Cstring.H64.hash wire_method;
+        h_wire_method= H64_cstring.hash wire_method;
         start_date= fee_start;
         end_date= fee_end;
         closing_fee;
@@ -354,18 +353,17 @@ let enable_wire ~output ~master_key ~payto_uri ~bank_label ~priority =
   let credit_restrictions = [] in
   let debit_restrictions = [] in
   let h_conversion_url =
-    Hash.Cstring.H64.hash ((* ?? *) Option.value ~default:"" conversion_url)
+    H64_cstring.hash ((* ?? *) Option.value ~default:"" conversion_url)
   in
-  let h_credit_restrictions = Hash.Cstring.H64.hash "" in
-  let h_debit_restrictions = Hash.Cstring.H64.hash "" in
+  let h_credit_restrictions = H64_cstring.hash "" in
+  let h_debit_restrictions = H64_cstring.hash "" in
   (* - *)
   let* key = read_master_key_file master_key in
-  let ns = Mtime_clock.now_ns () in
-  let validity_start = Timestamp.of_s @@ Int64.unsigned_div ns 1_000_000_000L in
-  let h_wire_details = Hash.FullPaytoHash.hash payto_uri in
+  let validity_start = Timestamp.of_s (now_s ()) in
+  let h_wire_details = FullPaytoHash.hash payto_uri in
   let master_sig_wire =
     let open Signatures.MasterWireDetails in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
         h_wire_details;
         h_conversion_url;
@@ -375,7 +373,7 @@ let enable_wire ~output ~master_key ~payto_uri ~bank_label ~priority =
   in
   let master_sig_add =
     let open Signatures.MasterAddWire in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
         start_date= validity_start;
         h_wire= h_wire_details;
@@ -404,19 +402,15 @@ let enable_wire ~output ~master_key ~payto_uri ~bank_label ~priority =
 
 let disable_wire ~output ~master_key ~payto_uri =
   let* key = read_master_key_file master_key in
-  let ns = Mtime_clock.now_ns () in
-  let open Time in
-  let validity_end =
-    TimeAbsolute.of_s @@ Int64.unsigned_div ns 1_000_000_000L
-  in
+  let validity_end = TimeAbsolute.of_s (now_s ()) in
   (* hack for tests: +1sec to be sure it overwrite previous timestamp *)
   let validity_end =
     Timestamp.of_absolute (TimeAbsolute.add validity_end TimeRelative.(of_s 1L))
   in
-  let h_wire = Hash.FullPaytoHash.hash payto_uri in
+  let h_wire = FullPaytoHash.hash payto_uri in
   let master_sig_del =
     let open Signatures.MasterDelWire in
-    signf (EddsaSignature.sign ~key) { end_date= validity_end; h_wire }
+    signf (Eddsa.sign ~key) { end_date= validity_end; h_wire }
   in
   let v = Api.WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } in
   let* s = Api.encode Api.WireTeardownMessage.jsont v in
@@ -429,12 +423,12 @@ let drain ~output ~master_key ~debit_account_section ~credit_payto_uri ~wtid
   let* wtid = Api.Bytes32.of_octets wtid in
   let master_sig =
     let open Signatures.MasterDrainProfit in
-    signf (EddsaSignature.sign ~key)
+    signf (Eddsa.sign ~key)
       {
         wtid;
         date;
         amount;
-        h_section= Hash.Cstring.H64.hash debit_account_section;
+        h_section= H64_cstring.hash debit_account_section;
         h_payto= FullPaytoHash.hash credit_payto_uri;
       }
   in