add 10 recommended nodes

Add recommended nodes
Fix open in new tab click on NodeTable
2025-06-05 12:33:43 +03:00 · 2025-06-04 19:47:53 +03:00 · 2025-06-03 14:28:17 +03:00 · 2025-05-22 14:24:24 +03:00 · 2025-05-21 17:11:52 +03:00 · 2025-05-15 19:20:16 +03:00
495 changed files with 35890 additions and 26618 deletions
@@ -102,6 +102,8 @@ jobs:
      - name: Run all tests
        if: contains(matrix.os, 'ubuntu')
        uses: actions-rs/cargo@v1
+        env:
+          NYM_API: https://sandbox-nym-api1.nymtech.net/api
        with:
          command: test
          args: --workspace
@@ -16,8 +16,12 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update && sudo apt-get install -y libdbus-1-dev libmnl-dev libnftnl-dev \
+            libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev jq \
+            libgtk-3-dev squashfs-tools libayatana-appindicator3-dev make libfuse2 unzip librsvg2-dev file \
+            libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
        continue-on-error: true

      - name: Check out repository code
@@ -0,0 +1,47 @@
+name: Integration Tests
+
+on:
+  pull_request:
+    paths:
+      - "nym-api/**"
+      - "tests/**"
+  workflow_dispatch:
+
+jobs:
+  integration-tests:
+    runs-on: ubuntu-latest
+    env:
+      API_BASE_URL: http://localhost:8000
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
+
+      - name: Build nym-api
+        run: cargo build --package nym-api
+
+      - name: Run nym-api in the background
+        run: |
+          ./target/debug/nym-api &
+
+      - name: Wait for nym-api to come alive
+        run: |
+          for i in {1..20}; do
+            curl -sSf http://localhost:8000/v1/status/config-score-details && break
+            echo "Waiting for nym-api to start..."
+            sleep 2
+          done
+
+      - name: Run integration tests
+        env:
+          NYM_API: https://sandbox-nym-api1.nymtech.net/api
+        run: cargo test --test public-api-tests -- --nocapture
@@ -18,11 +18,7 @@ jobs:
    runs-on: ${{ matrix.platform }}

    outputs:
-      release_id: ${{ steps.create-release.outputs.id }}
-      release_date: ${{ fromJSON(steps.create-release.outputs.assets)[0].created_at }}
-      version: ${{ steps.release-info.outputs.version }}
-      filename: ${{ steps.release-info.outputs.filename }}
-      file_hash: ${{ steps.release-info.outputs.file_hash }}
+      release_tag: ${{ github.ref_name }}

    steps:
      - uses: actions/checkout@v4
@@ -33,10 +29,16 @@ jobs:
          node-version: 21
          
      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          
+      - name: Add Rust target for x86_64-apple-darwin
+        run: rustup target add x86_64-apple-darwin
+
+      - name: Set Cargo build target to x86_64
+        run: echo "CARGO_BUILD_TARGET=x86_64-apple-darwin" >> $GITHUB_ENV
+          
      - name: Install the Apple developer certificate for code signing
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -66,12 +68,6 @@ jobs:
          fileName: '.env'
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

-      - name: Add Rust target for x86_64-apple-darwin
-        run: rustup target add x86_64-apple-darwin
-
-      - name: Set Cargo build target to x86_64
-        run: echo "CARGO_BUILD_TARGET=x86_64-apple-darwin" >> $GITHUB_ENV
-        
      - name: Yarn cache clean
        shell: bash
        run: cd .. && yarn cache clean
@@ -94,10 +90,22 @@ jobs:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_IDENTITY_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
-          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          # Tauri v2 specific environment variables
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          TAURI_NOTARIZATION_USERNAME: ${{ secrets.APPLE_ID }}
+          TAURI_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          TAURI_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
-          yarn build-macx86
+          yarn build-macx86 
+
+      - name: Create app tarball
+        run: |
+          # Navigate to where the app bundle is and create the tarball
+          cd target/x86_64-apple-darwin/release/bundle/macos
+          echo "Creating tarball from app bundle"
+          tar -czf nym-wallet.app.tar.gz NymWallet.app
+          cd -

      - name: Upload Artifact
        uses: actions/upload-artifact@v4
@@ -120,22 +128,10 @@ jobs:
            nym-wallet/target/x86_64-apple-darwin/release/bundle/dmg/*.dmg
            nym-wallet/target/x86_64-apple-darwin/release/bundle/macos/*.app.tar.gz*

-      - name: Deploy artifacts to CI www
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-avzr"
-          SOURCE: "nym-wallet/target/x86_64-apple-darwin/release/bundle/macos/nym-wallet.app.tar.gz"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
-          EXCLUDE: "/dist/, /node_modules/"            
-
  push-release-data:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/release-calculate-hash.yml
    needs: publish-tauri
    with:
-      release_tag: ${{ github.ref_name }}
-    secrets: inherit
+      release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
+    secrets: inherit
@@ -3,71 +3,108 @@ on:
  workflow_dispatch:
  release:
    types: [created]
-
 defaults:
  run:
    working-directory: nym-wallet
-
 jobs:
  publish-tauri:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
-        platform: [custom-ubuntu-22.04]
+        platform: [ubuntu-22.04]
    runs-on: ${{ matrix.platform }}
-
    outputs:
-      release_id: ${{ steps.create-release.outputs.id }}
-      release_date: ${{ fromJSON(steps.create-release.outputs.assets)[0].created_at }}
-      version: ${{ steps.release-info.outputs.version }}
-      filename: ${{ steps.release-info.outputs.filename }}
-      file_hash: ${{ steps.release-info.outputs.file_hash }}
-
+      release_tag: ${{ github.ref_name }}
+      
    steps:
      - uses: actions/checkout@v4
-
-      - name: Tauri dependencies
-        run: >
-          sudo apt-get update &&
-          sudo apt-get install -y webkit2gtk-4.0
-        continue-on-error: true
-
+      
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update && sudo apt-get install -y libdbus-1-dev libmnl-dev libnftnl-dev \
+            libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev jq \
+            libgtk-3-dev squashfs-tools libayatana-appindicator3-dev make libfuse2 unzip librsvg2-dev file \
+            libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+      
      - name: Node
        uses: actions/setup-node@v4
        with:
          node-version: 21
-
+          cache: 'yarn'
+      
      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
-
+      
      - name: Install project dependencies
        shell: bash
        run: cd .. && yarn --network-timeout 100000
-
+      
      - name: Install app dependencies
        run: yarn
+      
      - name: Create env file
        uses: timheuer/base64-to-file@v1.2
        with:
          fileName: '.env'
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
-
+      
      - name: Build app
        run: yarn build
        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+      
+      - name: Check bundle directory
+        run: |
+          echo "Checking bundle directory structure"
+          ls -la target/release/bundle || echo "Bundle directory not found"
+          if [ -d "target/release/bundle/appimage" ]; then
+            echo "AppImage bundle directory exists, checking contents:"
+            ls -la target/release/bundle/appimage
+          else
+            echo "AppImage bundle directory not found, checking alternatives:"
+            find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
+            find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
+          fi
+      
+      - name: Create AppImage tarball if needed
+        run: |
+          # Find the AppImage file
+          APPIMAGE_FILE=$(find target/release/bundle -name "*.AppImage" | head -n 1)
+          if [ -n "$APPIMAGE_FILE" ]; then
+            echo "Found AppImage file: $APPIMAGE_FILE"
+            APPIMAGE_DIR=$(dirname "$APPIMAGE_FILE")
+            APPIMAGE_NAME=$(basename "$APPIMAGE_FILE")
+            
+            # Create tarball if it doesn't exist
+            if [ ! -f "${APPIMAGE_FILE}.tar.gz" ]; then
+              echo "Creating tarball for $APPIMAGE_NAME"
+              cd "$APPIMAGE_DIR"
+              tar -czf "${APPIMAGE_NAME}.tar.gz" "$APPIMAGE_NAME"
+              cd -
+              echo "Created tarball: ${APPIMAGE_FILE}.tar.gz"
+            else
+              echo "Tarball already exists: ${APPIMAGE_FILE}.tar.gz"
+            fi
+          else
+            echo "WARNING: No AppImage file found!"
+          fi
+      
      - name: Upload Artifact
        uses: actions/upload-artifact@v4
        with:
-          name: nym-wallet_1.0.0_amd64.AppImage.tar.gz
-          path: nym-wallet/target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz
+          name: nym-wallet-appimage.tar.gz
+          path: |
+            nym-wallet/target/release/bundle/appimage/*.AppImage.tar.gz
+            nym-wallet/target/release/bundle/*/nym-wallet*.AppImage.tar.gz
          retention-days: 30
-
+      
      - id: create-release
        name: Upload to release based on tag name
        uses: softprops/action-gh-release@v2
@@ -75,24 +112,26 @@ jobs:
        with:
          files: |
            nym-wallet/target/release/bundle/appimage/*.AppImage
-            nym-wallet/target/release/bundle/appimage/*.AppImage.tar.gz*
-
-      - name: Deploy artifacts to CI www
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-avzr"
-          SOURCE: "nym-wallet/target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
-          EXCLUDE: "/dist/, /node_modules/"               
-
+            nym-wallet/target/release/bundle/appimage/*.AppImage.tar.gz
+            nym-wallet/target/release/bundle/*/nym-wallet*.AppImage
+            nym-wallet/target/release/bundle/*/nym-wallet*.AppImage.tar.gz
+      
+      - name: Find AppImage tarball path for deployment
+        id: find-appimage
+        run: |
+          APPIMAGE_TARBALL=$(find target/release/bundle -name "*.AppImage.tar.gz" | head -n 1)
+          if [ -n "$APPIMAGE_TARBALL" ]; then
+            echo "Found AppImage tarball: $APPIMAGE_TARBALL"
+            echo "appimage_path=$APPIMAGE_TARBALL" >> $GITHUB_OUTPUT
+          else
+            echo "WARNING: No AppImage tarball found for deployment!"
+            echo "appimage_path=target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz" >> $GITHUB_OUTPUT
+          fi
+      
  push-release-data:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/release-calculate-hash.yml
    needs: publish-tauri
    with:
-      release_tag: ${{ github.ref_name }}
-    secrets: inherit
+      release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
+    secrets: inherit
@@ -1,6 +1,12 @@
 name: publish-nym-wallet-win11
 on:
  workflow_dispatch:
+    inputs:
+      sign:
+        description: "Sign this build using SSL.com. Signing is billed per signature so be careful"
+        required: false
+        type: boolean
+        default: true
  release:
    types: [created]

@@ -18,53 +24,61 @@ jobs:
    runs-on: ${{ matrix.platform }}

    outputs:
-      release_id: ${{ steps.create-release.outputs.id }}
-      release_date: ${{ fromJSON(steps.create-release.outputs.assets)[0].created_at }}
-      version: ${{ steps.release-info.outputs.version }}
-      filename: ${{ steps.release-info.outputs.filename }}
-      file_hash: ${{ steps.release-info.outputs.file_hash }}
+      release_tag: ${{ github.ref_name }}

    steps:
-      - name: Clean up first
-        continue-on-error: true
-        working-directory: .
-        run: |
-          cd ..
-          del /s /q /A:H nym
-          rmdir /s /q nym
-
      - uses: actions/checkout@v4

-      - name: Import signing certificate
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        run: |
-          New-Item -ItemType directory -Path certificate
-          Set-Content -Path certificate/tempCert.txt -Value $env:WINDOWS_CERTIFICATE
-          certutil -decode certificate/tempCert.txt certificate/certificate.pfx
-          Remove-Item -path certificate -include tempCert.txt
-          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Setup MSBuild.exe
+        uses: microsoft/setup-msbuild@v2

      - name: Node
        uses: actions/setup-node@v4
        with:
          node-version: 21

-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-
-      - name: Create env file
-        uses: timheuer/base64-to-file@v1.2
-        with:
-          fileName: '.env'
-          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
-
-      - name: Install Yarn
-        run: npm install -g yarn
-
+      - name: Download EV CodeSignTool from ssl.com
+        working-directory: nym-wallet/src-tauri
+        if: ${{ inputs.sign }}
+        shell: bash
+        run: |
+          curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
+          unzip codesigntool.zip
+      - name: Get EV certificate credential id
+        working-directory: nym-wallet/src-tauri
+        if: ${{ inputs.sign }}
+        id: get_credential_ids
+        shell: bash
+        run: |
+          echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
+      - name: Add custom sign command to tauri.conf.json
+        working-directory: nym-wallet/src-tauri
+        if: ${{ inputs.sign }}
+        shell: bash
+        run: |
+          yq eval --inplace '.bundle.windows +=
+          {
+            "signCommand": {
+              "cmd": "C:\Program Files\Git\bin\bash.EXE",
+              "args": [
+                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
+                "sign",
+                "-username ${{ secrets.SSL_COM_USERNAME }}",
+                "-password ${{ secrets.SSL_COM_PASSWORD }}",
+                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
+                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
+                "-program_name NymWallet",
+                "-input_file_path",
+                "%1",
+                "-override"
+              ]
+            }
+          }' tauri.conf.json
      - name: Install project dependencies
        shell: bash
        run: cd .. && yarn --network-timeout 100000
@@ -77,18 +91,50 @@ jobs:
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ENABLE_CODE_SIGNING: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
-          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-        run: yarn build
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
+          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
+        run: |
+          echo "Starting build process..."
+          yarn build
+
+      - name: Check bundle directory
+        shell: bash
+        run: |
+          echo "Checking bundle directory structure"
+          
+          # Check standard location
+          if [ -d "target/release/bundle" ]; then
+            echo "Found bundle directory at standard location"
+            ls -la target/release/bundle || echo "Failed to list bundle directory"
+          fi
+          
+          # Check src-tauri location
+          if [ -d "src-tauri/target/release/bundle" ]; then
+            echo "Found bundle directory in src-tauri"
+            ls -la src-tauri/target/release/bundle || echo "Failed to list src-tauri bundle directory"
+            
+            # Use this path for future steps
+            echo "BUNDLE_PATH=src-tauri/target/release/bundle" >> $GITHUB_ENV
+          else
+            echo "Using standard bundle path"
+            echo "BUNDLE_PATH=target/release/bundle" >> $GITHUB_ENV
+          fi
+          
+          # Check for MSI files in any location
+          find . -name "*.msi" -type f

      - name: Upload Artifact
        uses: actions/upload-artifact@v4
        with:
-          name: nym-wallet_1.0.0_x64_en-US.msi
-          path: nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi
+          name: nym-wallet.msi
+          path: |
+            nym-wallet/${{ env.BUNDLE_PATH }}/msi/*.msi
+            nym-wallet/${{ env.BUNDLE_PATH }}/*/nym-wallet*.msi
+            nym-wallet/src-tauri/target/release/bundle/msi/*.msi
          retention-days: 30

      - id: create-release
@@ -97,25 +143,28 @@ jobs:
        if: github.event_name == 'release'
        with:
          files: |
-            nym-wallet/target/release/bundle/msi/*.msi
-            nym-wallet/target/release/bundle/msi/*.msi.zip*
-
-      - name: Deploy artifacts to CI www
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-avzr"
-          SOURCE: "nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/${{ github.ref_name }}/nym-wallet
-          EXCLUDE: "/dist/, /node_modules/"            
+            nym-wallet/${{ env.BUNDLE_PATH }}/msi/*.msi
+            nym-wallet/${{ env.BUNDLE_PATH }}/msi/*.msi.zip*
+            nym-wallet/${{ env.BUNDLE_PATH }}/*/nym-wallet*.msi
+            nym-wallet/src-tauri/target/release/bundle/msi/*.msi
+          
+      - name: Find MSI path for deployment
+        id: find-msi
+        shell: bash
+        run: |
+          MSI_FILE=$(find . -name "*.msi" -type f | head -n 1)
+          if [ -n "$MSI_FILE" ]; then
+            echo "Found MSI file: $MSI_FILE"
+            echo "msi_path=$MSI_FILE" >> $GITHUB_OUTPUT
+          else
+            echo "WARNING: No MSI file found for deployment!"
+            echo "msi_path=${{ env.BUNDLE_PATH }}/msi/nym-wallet*.msi" >> $GITHUB_OUTPUT
+          fi

  push-release-data:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    uses: ./.github/workflows/release-calculate-hash.yml
    needs: publish-tauri
    with:
-      release_tag: ${{ github.ref_name }}
-    secrets: inherit
+      release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
+    secrets: inherit
@@ -908,6 +908,16 @@ dependencies = [
 "generic-array 0.14.7",
 ]

+[[package]]
+name = "bloomfilter"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f6d7f06817e48ea4e17532fa61bc4e8b9a101437f0623f69d2ea54284f3a817"
+dependencies = [
+ "getrandom 0.2.15",
+ "siphasher 1.0.1",
+]
+
 [[package]]
 name = "bls12_381"
 version = "0.8.0"
@@ -1564,6 +1574,7 @@ dependencies = [
 "ciborium",
 "clap",
 "criterion-plot",
+ "futures",
 "is-terminal",
 "itertools 0.10.5",
 "num-traits",
@@ -1576,6 +1587,7 @@ dependencies = [
 "serde_derive",
 "serde_json",
 "tinytemplate",
+ "tokio",
 "walkdir",
 ]

@@ -1591,9 +1603,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-channel"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
 "crossbeam-utils",
 ]
@@ -2173,6 +2185,12 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"

+[[package]]
+name = "dotenv"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
+
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -4685,7 +4703,7 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"

 [[package]]
 name = "nym-api"
-version = "1.1.55"
+version = "1.1.56"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -4696,6 +4714,7 @@ dependencies = [
 "bip39",
 "bs58",
 "cfg-if",
+ "chrono",
 "clap",
 "console-subscriber",
 "cosmwasm-std",
@@ -4705,6 +4724,7 @@ dependencies = [
 "cw4",
 "dashmap",
 "dirs",
+ "dotenv",
 "futures",
 "getset",
 "humantime-serde",
@@ -4937,7 +4957,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.52"
+version = "1.1.53"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5020,7 +5040,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.52"
+version = "1.1.53"
 dependencies = [
 "bs58",
 "clap",
@@ -5062,7 +5082,6 @@ dependencies = [
 "async-trait",
 "base64 0.22.1",
 "bs58",
- "cfg-if",
 "clap",
 "comfy-table",
 "futures",
@@ -5077,12 +5096,10 @@ dependencies = [
 "nym-client-core-gateways-storage",
 "nym-client-core-surb-storage",
 "nym-config",
- "nym-country-group",
 "nym-credential-storage",
 "nym-credentials-interface",
 "nym-crypto",
 "nym-ecash-time",
- "nym-explorer-client",
 "nym-gateway-client",
 "nym-gateway-requests",
 "nym-http-api-client",
@@ -5103,7 +5120,6 @@ dependencies = [
 "serde_json",
 "sha2 0.10.8",
 "si-scale",
- "tap",
 "tempfile",
 "thiserror 2.0.12",
 "time",
@@ -5125,7 +5141,6 @@ version = "0.1.0"
 dependencies = [
 "humantime-serde",
 "nym-config",
- "nym-country-group",
 "nym-pemstore",
 "nym-sphinx-addressing",
 "nym-sphinx-params",
@@ -5267,14 +5282,6 @@ dependencies = [
 "vergen",
 ]

-[[package]]
-name = "nym-country-group"
-version = "0.1.0"
-dependencies = [
- "serde",
- "tracing",
-]
-
 [[package]]
 name = "nym-cpp-ffi"
 version = "0.1.2"
@@ -5551,31 +5558,6 @@ dependencies = [
 "utoipa",
 ]

-[[package]]
-name = "nym-explorer-api-requests"
-version = "0.1.0"
-dependencies = [
- "nym-api-requests",
- "nym-contracts-common",
- "nym-mixnet-contract-common",
- "schemars",
- "serde",
- "ts-rs",
-]
-
-[[package]]
-name = "nym-explorer-client"
-version = "0.1.0"
-dependencies = [
- "nym-explorer-api-requests",
- "reqwest 0.12.15",
- "serde",
- "thiserror 2.0.12",
- "tokio",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "nym-ffi-shared"
 version = "0.2.1"
@@ -6055,7 +6037,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.53"
+version = "1.1.54"
 dependencies = [
 "addr",
 "anyhow",
@@ -6106,7 +6088,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.8.0"
+version = "1.9.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6115,15 +6097,18 @@ dependencies = [
 "axum 0.7.9",
 "bip39",
 "blake2 0.8.1",
+ "bloomfilter",
 "bs58",
 "cargo_metadata 0.18.1",
 "celes",
 "chacha",
 "clap",
 "colored",
+ "criterion",
 "csv",
 "cupid",
 "futures",
+ "hkdf",
 "human-repr",
 "humantime-serde",
 "indicatif",
@@ -6163,6 +6148,7 @@ dependencies = [
 "rand 0.8.5",
 "serde",
 "serde_json",
+ "sha2 0.10.8",
 "sysinfo",
 "thiserror 2.0.12",
 "time",
@@ -6235,7 +6221,7 @@ dependencies = [

 [[package]]
 name = "nym-node-status-api"
-version = "2.0.0"
+version = "2.1.0"
 dependencies = [
 "ammonia",
 "anyhow",
@@ -6251,7 +6237,6 @@ dependencies = [
 "nym-bin-common",
 "nym-contracts-common",
 "nym-crypto",
- "nym-explorer-client",
 "nym-http-api-client",
 "nym-network-defaults",
 "nym-node-metrics",
@@ -6497,7 +6482,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.52"
+version = "1.1.53"
 dependencies = [
 "bs58",
 "clap",
@@ -6660,6 +6645,7 @@ dependencies = [
 "rand_chacha 0.3.1",
 "serde",
 "thiserror 2.0.12",
+ "tracing",
 "wasm-bindgen",
 ]

@@ -6713,8 +6699,6 @@ name = "nym-sphinx-framing"
 version = "0.1.0"
 dependencies = [
 "bytes",
- "log",
- "nym-metrics",
 "nym-sphinx-acknowledgements",
 "nym-sphinx-addressing",
 "nym-sphinx-forwarding",
@@ -6723,6 +6707,7 @@ dependencies = [
 "thiserror 2.0.12",
 "tokio",
 "tokio-util",
+ "tracing",
 ]

 [[package]]
@@ -7101,7 +7086,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.17"
+version = "0.1.18"
 dependencies = [
 "anyhow",
 "bytes",
@@ -9246,9 +9231,9 @@ dependencies = [

 [[package]]
 name = "sphinx-packet"
-version = "0.3.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c23047e0cf36ff6904603f499fd13153425cdf5ba47bfbaedbc999da0bd92f4e"
+checksum = "c26f0c20d909fdda1c5d0ece3973127ca421984d55b000215df365e93722fc6e"
 dependencies = [
 "aes",
 "arrayref",
@@ -9267,6 +9252,7 @@ dependencies = [
 "sha2 0.10.8",
 "subtle 2.6.1",
 "x25519-dalek",
+ "zeroize",
 ]

 [[package]]
@@ -10061,9 +10047,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.44.1"
+version = "1.44.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f382da615b842244d4b8738c82ed1275e6c5dd90c459a30941cd07080b06c91a"
+checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
 dependencies = [
 "backtrace",
 "bytes",
@@ -39,7 +39,6 @@ members = [
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
-    "common/country-group",
    "common/credential-storage",
    "common/credential-utils",
    "common/credential-verification",
@@ -97,9 +96,6 @@ members = [
    "common/wireguard",
    "common/wireguard-types",
    "documentation/autodoc",
-    # "explorer-api",
-    # "explorer-api/explorer-api-requests",
-    # "explorer-api/explorer-client",
    "gateway",
    "integrations/bity",
    "nym-api",
@@ -204,7 +200,7 @@ bip39 = { version = "2.0.0", features = ["zeroize"] }
 bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
 blake3 = "1.7.0"
-bloomfilter = "1.0.14"
+bloomfilter = "3.0.1"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
 bytes = "1.10.1"
@@ -270,7 +266,6 @@ indicatif = "0.17.11"
 inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
-isocountry = "0.3.2"
 itertools = "0.14.0"
 k256 = "0.13"
 lazy_static = "1.5.0"
@@ -303,9 +298,6 @@ rand_seeder = "0.2.3"
 rayon = "1.5.1"
 regex = "1.10.6"
 reqwest = { version = "0.12.15", default-features = false }
-rocket = "0.5.0"
-rocket_cors = "0.6.0"
-rocket_okapi = "0.8.0"
 rs_merkle = "1.5.0"
 safer-ffi = "0.1.13"
 schemars = "0.8.22"
@@ -320,7 +312,7 @@ serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
-sphinx-packet = "=0.3.2"
+sphinx-packet = "=0.6.0"
 sqlx = "0.7.4"
 strum = "0.26"
 strum_macros = "0.26"
@@ -410,6 +402,11 @@ wasm-bindgen-futures = "0.4.49"
 wasmtimer = "0.4.1"
 web-sys = "0.3.76"

+
+# for local development:
+#[patch.crates-io]
+#sphinx-packet = { path = "../sphinx" }
+
 # Profile settings for individual crates

 # Compile-time verified queries do quite a bit of work at compile time. Incremental
@@ -168,8 +168,9 @@ generate-typescript:
 	cd tools/ts-rs-cli && cargo run && cd ../..
 	yarn types:lint:fix

+# Run the integration tests for public nym-api endpoints
 run-api-tests:
-	cd nym-api/tests/functional_test && yarn test:qa
+	dotenv -f envs/sandbox.env -- cargo test --test public-api-tests

 # Build debian package, and update PPA
 deb-cli: build-nym-cli
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.52"
+version = "1.1.53"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.52"
+version = "1.1.53"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -87,7 +87,6 @@ impl From<Init> for OverrideConfig {
            use_anonymous_replies: init_config.use_reply_surbs,
            fastmode: init_config.common_args.fastmode,
            no_cover: init_config.common_args.no_cover,
-            geo_routing: None,
            medium_toggle: false,
            nyxd_urls: init_config.common_args.nyxd_urls,
            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
@@ -16,8 +16,7 @@ use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
-use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
-use nym_client_core::config::{ForgetMe, GroupBy, TopologyStructure};
+use nym_client_core::config::ForgetMe;
 use nym_config::OptionalSet;
 use nym_sphinx::addressing::Recipient;
 use nym_sphinx::params::{PacketSize, PacketType};
@@ -107,7 +106,6 @@ pub(crate) struct OverrideConfig {
    use_anonymous_replies: Option<bool>,
    fastmode: bool,
    no_cover: bool,
-    geo_routing: Option<CountryGroup>,
    medium_toggle: bool,
    nyxd_urls: Option<Vec<url::Url>>,
    enabled_credentials_mode: Option<bool>,
@@ -138,21 +136,6 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
    let secondary_packet_size = args.medium_toggle.then_some(PacketSize::ExtendedPacket16);
    let no_per_hop_delays = args.medium_toggle;

-    let topology_structure = if args.medium_toggle {
-        // Use the location of the network-requester
-        let address = config
-            .core
-            .socks5
-            .provider_mix_address
-            .parse()
-            .expect("failed to parse provider mix address");
-        TopologyStructure::GeoAware(GroupBy::NymAddress(address))
-    } else if let Some(code) = args.geo_routing {
-        TopologyStructure::GeoAware(GroupBy::CountryGroup(code))
-    } else {
-        TopologyStructure::default()
-    };
-
    let packet_type = if args.outfox {
        PacketType::Outfox
    } else {
@@ -176,10 +159,6 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
        // NOTE: see comment above about the order of the other disble cover traffic config
        .with_base(BaseClientConfig::with_disabled_cover_traffic, args.no_cover)
        .with_base(BaseClientConfig::with_packet_type, packet_type)
-        .with_base(
-            BaseClientConfig::with_topology_structure,
-            topology_structure,
-        )
        .with_base(BaseClientConfig::with_forget_me, args.forget_me)
        .with_optional(Config::with_anonymous_replies, args.use_anonymous_replies)
        .with_optional(Config::with_port, args.port)
@@ -6,7 +6,6 @@ use crate::commands::{override_config, OverrideConfig};
 use clap::Args;
 use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use nym_client_core::client::base_client::storage::OnDiskPersistent;
-use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
 use nym_socks5_client_core::NymClient;
 use nym_sphinx::addressing::clients::Recipient;
 use std::net::IpAddr;
@@ -37,10 +36,6 @@ pub(crate) struct Run {
    #[clap(long)]
    host: Option<IpAddr>,

-    /// Set geo-aware mixnode selection when sending mixnet traffic, for experiments only.
-    #[clap(long, hide = true, value_parser = validate_country_group, group="routing")]
-    geo_routing: Option<CountryGroup>,
-
    /// Enable medium mixnet traffic, for experiments only.
    /// This includes things like disabling cover traffic, no per hop delays, etc.
    #[clap(long, hide = true)]
@@ -59,7 +54,6 @@ impl From<Run> for OverrideConfig {
            use_anonymous_replies: run_config.use_anonymous_replies,
            fastmode: run_config.common_args.fastmode,
            no_cover: run_config.common_args.no_cover,
-            geo_routing: run_config.geo_routing,
            medium_toggle: run_config.medium_toggle,
            nyxd_urls: run_config.common_args.nyxd_urls,
            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
@@ -70,13 +64,6 @@ impl From<Run> for OverrideConfig {
    }
 }

-fn validate_country_group(s: &str) -> Result<CountryGroup, String> {
-    match s.parse() {
-        Ok(cg) => Ok(cg),
-        Err(_) => Err(format!("failed to parse country group: {}", s)),
-    }
-}
-
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    eprintln!("Starting client {}...", args.common_args.id);

@@ -13,7 +13,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 #[cfg(feature = "verify")]
 use sha2::Sha256;

@@ -190,15 +190,15 @@ impl<'de> Deserialize<'de> for ClientMac {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nym_crypto::asymmetric::encryption;
+    use nym_crypto::asymmetric::x25519;

    #[test]
    #[cfg(feature = "verify")]
    fn client_request_roundtrip() {
        let mut rng = rand::thread_rng();

-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
+        let client_key_pair = x25519::KeyPair::new(&mut rng);

        let nonce = 1234567890;

@@ -14,7 +14,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 #[cfg(feature = "verify")]
 use sha2::Sha256;

@@ -199,15 +199,15 @@ impl<'de> Deserialize<'de> for ClientMac {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nym_crypto::asymmetric::encryption;
+    use nym_crypto::asymmetric::x25519;

    #[test]
    #[cfg(feature = "verify")]
    fn client_request_roundtrip() {
        let mut rng = rand::thread_rng();

-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
+        let client_key_pair = x25519::KeyPair::new(&mut rng);

        let nonce = 1234567890;

@@ -340,7 +340,7 @@ mod tests {
    use std::{net::IpAddr, str::FromStr};

    use nym_credentials_interface::CredentialSpendingData;
-    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_crypto::asymmetric::x25519::PrivateKey;
    use nym_sphinx::addressing::Recipient;
    use nym_wireguard_types::PeerPublicKey;
    use x25519_dalek::PublicKey;
@@ -14,7 +14,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 #[cfg(feature = "verify")]
 use sha2::Sha256;

@@ -199,15 +199,15 @@ impl<'de> Deserialize<'de> for ClientMac {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nym_crypto::asymmetric::encryption;
+    use nym_crypto::asymmetric::x25519;

    #[test]
    #[cfg(feature = "verify")]
    fn client_request_roundtrip() {
        let mut rng = rand::thread_rng();

-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
+        let client_key_pair = x25519::KeyPair::new(&mut rng);

        let nonce = 1234567890;

@@ -306,7 +306,7 @@ mod tests {
    };

    use nym_credentials_interface::CredentialSpendingData;
-    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_crypto::asymmetric::x25519::PrivateKey;
    use nym_sphinx::addressing::Recipient;
    use nym_wireguard_types::PeerPublicKey;
    use x25519_dalek::PublicKey;
@@ -15,7 +15,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 #[cfg(feature = "verify")]
 use sha2::Sha256;

@@ -251,7 +251,7 @@ impl<'de> Deserialize<'de> for ClientMac {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nym_crypto::asymmetric::encryption;
+    use nym_crypto::asymmetric::x25519;

    #[test]
    fn create_ip_pair() {
@@ -266,8 +266,8 @@ mod tests {
    fn client_request_roundtrip() {
        let mut rng = rand::thread_rng();

-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
+        let client_key_pair = x25519::KeyPair::new(&mut rng);

        let nonce = 1234567890;

@@ -230,7 +230,7 @@ mod tests {
    };

    use nym_credentials_interface::CredentialSpendingData;
-    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_crypto::asymmetric::x25519::PrivateKey;
    use nym_sphinx::addressing::Recipient;
    use nym_wireguard_types::PeerPublicKey;
    use x25519_dalek::PublicKey;
@@ -15,7 +15,7 @@ use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
 use hmac::{Hmac, Mac};
 #[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::{PrivateKey, PublicKey};
+use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 #[cfg(feature = "verify")]
 use sha2::Sha256;

@@ -251,7 +251,7 @@ impl<'de> Deserialize<'de> for ClientMac {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use nym_crypto::asymmetric::encryption;
+    use nym_crypto::asymmetric::x25519;

    #[test]
    fn create_ip_pair() {
@@ -266,8 +266,8 @@ mod tests {
    fn client_request_roundtrip() {
        let mut rng = rand::thread_rng();

-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
+        let client_key_pair = x25519::KeyPair::new(&mut rng);

        let nonce = 1234567890;

@@ -11,7 +11,7 @@ use nym_credentials::ecash::bandwidth::IssuanceTicketBook;
 use nym_credentials::ecash::utils::obtain_aggregate_wallet;
 use nym_credentials::IssuedTicketBook;
 use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_ecash_time::{ecash_default_expiration_date, Date};
 use nym_validator_client::coconut::all_ecash_api_clients;
 use nym_validator_client::nym_api::EpochId;
@@ -31,7 +31,7 @@ where
    C: EcashSigningClient + EcashQueryClient + Sync,
 {
    let mut rng = OsRng;
-    let signing_key = identity::PrivateKey::new(&mut rng);
+    let signing_key = ed25519::PrivateKey::new(&mut rng);
    let expiration = expiration.unwrap_or_else(ecash_default_expiration_date);

    let deposit_amount = client.get_required_deposit_amount().await?;
@@ -4,8 +4,8 @@
 use nym_credential_storage::error::StorageError;
 use nym_credentials::error::Error as CredentialsError;
 use nym_credentials_interface::CompactEcashError;
-use nym_crypto::asymmetric::encryption::KeyRecoveryError;
-use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
+use nym_crypto::asymmetric::ed25519::Ed25519RecoveryError;
+use nym_crypto::asymmetric::x25519::KeyRecoveryError;
 use nym_validator_client::coconut::EcashApiError;
 use nym_validator_client::error::ValidatorClientError;
 use thiserror::Error;
@@ -12,7 +12,6 @@ license.workspace = true
 async-trait = { workspace = true }
 base64 = { workspace = true }
 bs58 = { workspace = true }
-cfg-if = { workspace = true }
 clap = { workspace = true, optional = true }
 comfy-table = { workspace = true, optional = true }
 futures = { workspace = true }
@@ -24,7 +23,6 @@ serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
 si-scale = { workspace = true }
-tap = { workspace = true }
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["macros"] }
@@ -35,9 +33,7 @@ zeroize = { workspace = true }
 nym-id = { path = "../nym-id" }
 nym-bandwidth-controller = { path = "../bandwidth-controller" }
 nym-config = { path = "../config" }
-nym-country-group = { path = "../country-group" }
 nym-crypto = { path = "../crypto" }
-nym-explorer-client = { path = "../../explorer-api/explorer-client" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../gateway-requests" }
 nym-http-api-client = { path = "../http-api-client" }
@@ -14,7 +14,6 @@ url = { workspace = true, features = ["serde"] }

 nym-config = { path = "../../config" }

-nym-country-group = { path = "../../country-group" }
 nym-pemstore = { path = "../../pemstore", optional = true }

 # those are pulling so many deps T.T
@@ -65,11 +65,10 @@ const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60

 // stats reporting related

-/// Time interval between reporting statistics to the given provider if it exist
+/// Time interval between reporting statistics to the given provider if it exists
 const STATS_REPORT_INTERVAL_SECS: Duration = Duration::from_secs(300);

 use crate::error::InvalidTrafficModeFailure;
-pub use nym_country_group::CountryGroup;

 #[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -258,15 +257,6 @@ impl Config {
        self
    }

-    pub fn with_topology_structure(mut self, topology_structure: TopologyStructure) -> Self {
-        self.set_topology_structure(topology_structure);
-        self
-    }
-
-    pub fn set_topology_structure(&mut self, topology_structure: TopologyStructure) {
-        self.debug.topology.topology_structure = topology_structure;
-    }
-
    pub fn with_no_per_hop_delays(mut self, no_per_hop_delays: bool) -> Self {
        if no_per_hop_delays {
            self.set_no_per_hop_delays()
@@ -415,6 +405,14 @@ pub struct Traffic {
    /// Do not set it unless you understand the consequences of that change.
    pub secondary_packet_size: Option<PacketSize>,

+    /// Specify whether any constructed sphinx packets should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    /// this affects any forward packets, acks and reply surbs
+    /// this flag should remain disabled until sufficient number of nodes on the network has upgraded
+    /// and support updated format.
+    /// in the case of reply surbs, the recipient must also understand the new encoding
+    pub use_legacy_sphinx_format: bool,
+
    pub packet_type: PacketType,
 }

@@ -442,6 +440,10 @@ impl Default for Traffic {
            primary_packet_size: PacketSize::RegularPacket,
            secondary_packet_size: None,
            packet_type: PacketType::Mix,
+
+            // we should use the legacy format until sufficient number of nodes understand the
+            // improved encoding
+            use_legacy_sphinx_format: true,
        }
    }
 }
@@ -546,9 +548,6 @@ pub struct Topology {
    #[serde(with = "humantime_serde")]
    pub max_startup_gateway_waiting_period: Duration,

-    /// Specifies the mixnode topology to be used for sending packets.
-    pub topology_structure: TopologyStructure,
-
    /// Specifies a minimum performance of a mixnode that is used on route construction.
    /// This setting is only applicable when `NymApi` topology is used.
    pub minimum_mixnode_performance: u8,
@@ -570,30 +569,6 @@ pub struct Topology {
    pub ignore_ingress_epoch_role: bool,
 }

-#[allow(clippy::large_enum_variant)]
-#[derive(Default, Copy, Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub enum TopologyStructure {
-    #[default]
-    NymApi,
-    GeoAware(GroupBy),
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Copy, Clone, Debug, PartialEq, Serialize, Deserialize)]
-pub enum GroupBy {
-    CountryGroup(CountryGroup),
-    NymAddress(Recipient),
-}
-
-impl std::fmt::Display for GroupBy {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GroupBy::CountryGroup(group) => write!(f, "group: {group}"),
-            GroupBy::NymAddress(address) => write!(f, "address: {address}"),
-        }
-    }
-}
-
 impl Default for Topology {
    fn default() -> Self {
        Topology {
@@ -601,7 +576,6 @@ impl Default for Topology {
            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
            disable_refreshing: false,
            max_startup_gateway_waiting_period: DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD,
-            topology_structure: TopologyStructure::default(),
            minimum_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
            minimum_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
            use_extended_topology: false,
@@ -2,10 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::old::v5::{
-    AcknowledgementsV5, ClientV5, ConfigV5, CoverTrafficV5, DebugConfigV5, GatewayConnectionV5,
-    GroupByV5, ReplySurbsV5, TopologyStructureV5, TopologyV5, TrafficV5,
+    AcknowledgementsV5, ClientV5, ConfigV5, CountryGroupV5, CoverTrafficV5, DebugConfigV5,
+    GatewayConnectionV5, GroupByV5, ReplySurbsV5, TopologyStructureV5, TopologyV5, TrafficV5,
 };
-use crate::CountryGroup;
 use nym_sphinx_addressing::Recipient;
 use nym_sphinx_params::{PacketSize, PacketType};
 use serde::{Deserialize, Serialize};
@@ -369,31 +368,47 @@ impl From<TopologyStructureV4> for TopologyStructureV5 {
    }
 }

+#[derive(Copy, Clone, Hash, PartialEq, Eq, Serialize, Deserialize, Debug)]
+pub enum CountryGroupV4 {
+    Europe,
+    NorthAmerica,
+    SouthAmerica,
+    Oceania,
+    Asia,
+    Africa,
+    Unknown,
+}
+
+impl From<CountryGroupV4> for CountryGroupV5 {
+    fn from(value: CountryGroupV4) -> Self {
+        match value {
+            CountryGroupV4::Europe => CountryGroupV5::Europe,
+            CountryGroupV4::NorthAmerica => CountryGroupV5::NorthAmerica,
+            CountryGroupV4::SouthAmerica => CountryGroupV5::SouthAmerica,
+            CountryGroupV4::Oceania => CountryGroupV5::Oceania,
+            CountryGroupV4::Asia => CountryGroupV5::Asia,
+            CountryGroupV4::Africa => CountryGroupV5::Africa,
+            CountryGroupV4::Unknown => CountryGroupV5::Unknown,
+        }
+    }
+}
+
 #[allow(clippy::large_enum_variant)]
 #[derive(Copy, Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub enum GroupByV4 {
-    CountryGroup(CountryGroup),
+    CountryGroup(CountryGroupV4),
    NymAddress(Recipient),
 }

 impl From<GroupByV4> for GroupByV5 {
    fn from(value: GroupByV4) -> Self {
        match value {
-            GroupByV4::CountryGroup(country) => GroupByV5::CountryGroup(country),
+            GroupByV4::CountryGroup(country) => GroupByV5::CountryGroup(country.into()),
            GroupByV4::NymAddress(addr) => GroupByV5::NymAddress(addr),
        }
    }
 }

-impl std::fmt::Display for GroupByV4 {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GroupByV4::CountryGroup(group) => write!(f, "group: {}", group),
-            GroupByV4::NymAddress(address) => write!(f, "address: {}", address),
-        }
-    }
-}
-
 impl Default for TopologyV4 {
    fn default() -> Self {
        TopologyV4 {
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::{
-    Acknowledgements, Client, Config, CountryGroup, CoverTraffic, DebugConfig, GatewayConnection,
-    GroupBy, ReplySurbs, Topology, TopologyStructure, Traffic,
+    Acknowledgements, Client, Config, CoverTraffic, DebugConfig, GatewayConnection, ReplySurbs,
+    Topology, Traffic,
 };
 use nym_sphinx_addressing::Recipient;
 use nym_sphinx_params::{PacketSize, PacketType};
@@ -146,7 +146,6 @@ impl From<ConfigV5> for Config {
                        .debug
                        .topology
                        .max_startup_gateway_waiting_period,
-                    topology_structure: value.debug.topology.topology_structure.into(),
                    ..Default::default()
                },
                reply_surbs: ReplySurbs {
@@ -372,40 +371,24 @@ pub enum TopologyStructureV5 {
    GeoAware(GroupByV5),
 }

-impl From<TopologyStructureV5> for TopologyStructure {
-    fn from(value: TopologyStructureV5) -> Self {
-        match value {
-            TopologyStructureV5::NymApi => TopologyStructure::NymApi,
-            TopologyStructureV5::GeoAware(group_by) => TopologyStructure::GeoAware(group_by.into()),
-        }
-    }
+#[derive(Copy, Clone, Hash, PartialEq, Eq, Serialize, Deserialize, Debug)]
+pub enum CountryGroupV5 {
+    Europe,
+    NorthAmerica,
+    SouthAmerica,
+    Oceania,
+    Asia,
+    Africa,
+    Unknown,
 }

 #[allow(clippy::large_enum_variant)]
 #[derive(Copy, Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub enum GroupByV5 {
-    CountryGroup(CountryGroup),
+    CountryGroup(CountryGroupV5),
    NymAddress(Recipient),
 }

-impl From<GroupByV5> for GroupBy {
-    fn from(value: GroupByV5) -> Self {
-        match value {
-            GroupByV5::CountryGroup(country) => GroupBy::CountryGroup(country),
-            GroupByV5::NymAddress(addr) => GroupBy::NymAddress(addr),
-        }
-    }
-}
-
-impl std::fmt::Display for GroupByV5 {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            GroupByV5::CountryGroup(group) => write!(f, "group: {}", group),
-            GroupByV5::NymAddress(address) => write!(f, "address: {}", address),
-        }
-    }
-}
-
 impl Default for TopologyV5 {
    fn default() -> Self {
        TopologyV5 {
@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
+use nym_crypto::asymmetric::ed25519::Ed25519RecoveryError;
 use nym_gateway_requests::shared_key::SharedKeyConversionError;
 use thiserror::Error;

@@ -5,7 +5,7 @@
 #![warn(clippy::unwrap_used)]

 use async_trait::async_trait;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;

@@ -36,9 +36,7 @@ pub trait GatewaysDetailsStore {
    async fn all_gateways(&self) -> Result<Vec<GatewayRegistration>, Self::StorageError>;

    /// Return identity keys of all registered gateways.
-    async fn all_gateways_identities(
-        &self,
-    ) -> Result<Vec<identity::PublicKey>, Self::StorageError> {
+    async fn all_gateways_identities(&self) -> Result<Vec<ed25519::PublicKey>, Self::StorageError> {
        Ok(self
            .all_gateways()
            .await?
@@ -64,7 +62,7 @@ pub trait GatewaysDetailsStore {

    async fn upgrade_stored_remote_gateway_key(
        &self,
-        gateway_id: identity::PublicKey,
+        gateway_id: ed25519::PublicKey,
        updated_key: &SharedSymmetricKey,
    ) -> Result<(), Self::StorageError>;

@@ -3,7 +3,7 @@

 use crate::BadGateway;
 use cosmrs::AccountId;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
@@ -29,7 +29,7 @@ pub struct GatewayRegistration {
 }

 impl GatewayRegistration {
-    pub fn gateway_id(&self) -> identity::PublicKey {
+    pub fn gateway_id(&self) -> ed25519::PublicKey {
        self.details.gateway_id()
    }
 }
@@ -64,7 +64,7 @@ impl From<GatewayDetails> for GatewayRegistration {

 impl GatewayDetails {
    pub fn new_remote(
-        gateway_id: identity::PublicKey,
+        gateway_id: ed25519::PublicKey,
        shared_key: Arc<SharedGatewayKey>,
        gateway_owner_address: Option<AccountId>,
        gateway_listener: Url,
@@ -77,11 +77,11 @@ impl GatewayDetails {
        })
    }

-    pub fn new_custom(gateway_id: identity::PublicKey, data: Option<Vec<u8>>) -> Self {
+    pub fn new_custom(gateway_id: ed25519::PublicKey, data: Option<Vec<u8>>) -> Self {
        GatewayDetails::Custom(CustomGatewayDetails { gateway_id, data })
    }

-    pub fn gateway_id(&self) -> identity::PublicKey {
+    pub fn gateway_id(&self) -> ed25519::PublicKey {
        match self {
            GatewayDetails::Remote(details) => details.gateway_id,
            GatewayDetails::Custom(details) => details.gateway_id,
@@ -157,7 +157,7 @@ pub struct RawRegisteredGateway {

 #[derive(Debug, Clone, Copy)]
 pub struct RegisteredGateway {
-    pub gateway_id: identity::PublicKey,
+    pub gateway_id: ed25519::PublicKey,

    pub registration_timestamp: OffsetDateTime,

@@ -179,7 +179,7 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {

    fn try_from(value: RawRemoteGatewayDetails) -> Result<Self, Self::Error> {
        let gateway_id =
-            identity::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
+            ed25519::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
                BadGateway::MalformedGatewayIdentity {
                    gateway_id: value.gateway_id_bs58.clone(),
                    source,
@@ -267,7 +267,7 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {

 #[derive(Debug, Clone)]
 pub struct RemoteGatewayDetails {
-    pub gateway_id: identity::PublicKey,
+    pub gateway_id: ed25519::PublicKey,

    pub shared_key: Arc<SharedGatewayKey>,

@@ -288,7 +288,7 @@ impl TryFrom<RawCustomGatewayDetails> for CustomGatewayDetails {

    fn try_from(value: RawCustomGatewayDetails) -> Result<Self, Self::Error> {
        let gateway_id =
-            identity::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
+            ed25519::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
                BadGateway::MalformedGatewayIdentity {
                    gateway_id: value.gateway_id_bs58.clone(),
                    source,
@@ -314,12 +314,12 @@ impl<'a> From<&'a CustomGatewayDetails> for RawCustomGatewayDetails {

 #[derive(Debug, Clone)]
 pub struct CustomGatewayDetails {
-    pub gateway_id: identity::PublicKey,
+    pub gateway_id: ed25519::PublicKey,
    pub data: Option<Vec<u8>>,
 }

 impl CustomGatewayDetails {
-    pub fn new(gateway_id: identity::PublicKey) -> CustomGatewayDetails {
+    pub fn new(gateway_id: ed25519::PublicKey) -> CustomGatewayDetails {
        Self {
            gateway_id,
            data: None,
@@ -14,7 +14,7 @@ use crate::{
 };
 use log::info;
 use nym_client_core_gateways_storage::GatewayDetails;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
 use std::path::PathBuf;
@@ -29,7 +29,7 @@ pub struct CommonClientAddGatewayArgs {
    /// Explicitly specify id of the gateway to register with.
    /// If unspecified, a random gateway will be chosen instead.
    #[cfg_attr(feature = "cli", clap(long, alias = "gateway"))]
-    pub gateway_id: Option<identity::PublicKey>,
+    pub gateway_id: Option<ed25519::PublicKey>,

    /// Specifies whether the client will attempt to enforce tls connection to the desired gateway.
    #[cfg_attr(feature = "cli", clap(long))]
@@ -14,7 +14,7 @@ use crate::{
 };
 use log::info;
 use nym_client_core_gateways_storage::GatewayDetails;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_sphinx::addressing::Recipient;
 use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
@@ -42,7 +42,7 @@ pub struct CommonClientInitArgs {

    /// Id of the gateway we are going to connect to.
    #[cfg_attr(feature = "cli", clap(long))]
-    pub gateway: Option<identity::PublicKey>,
+    pub gateway: Option<ed25519::PublicKey>,

    /// Specifies whether the client will attempt to enforce tls connection to the desired gateway.
    #[cfg_attr(feature = "cli", clap(long))]
@@ -1,7 +1,7 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_sphinx::addressing::Recipient;
 use std::path::PathBuf;

@@ -15,7 +15,7 @@ pub struct CommonClientRunArgs {
    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
    /// ensure prior registration happened
    #[cfg_attr(feature = "cli", clap(long))]
-    pub gateway: Option<identity::PublicKey>,
+    pub gateway: Option<ed25519::PublicKey>,

    /// Comma separated list of rest endpoints of the nyxd validators
    #[cfg_attr(
@@ -4,7 +4,7 @@
 use crate::cli_helpers::{CliClient, CliClientConfig};
 use crate::client::base_client::non_wasm_helpers::setup_fs_gateways_storage;
 use crate::client::base_client::storage::helpers::set_active_gateway;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;

 #[cfg_attr(feature = "cli", derive(clap::Args))]
 #[derive(Debug, Clone)]
@@ -15,7 +15,7 @@ pub struct CommonClientSwitchGatewaysArgs {

    /// Id of the gateway we want to switch to.
    #[cfg_attr(feature = "cli", clap(long))]
-    pub gateway_id: identity::PublicKey,
+    pub gateway_id: ed25519::PublicKey,
 }

 pub async fn switch_gateway<C, A>(args: A) -> Result<(), C::Error>
@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
 use time::OffsetDateTime;
@@ -10,7 +10,7 @@ use url::Url;
 #[derive(Serialize, Deserialize)]
 pub struct GatewayInfo {
    pub registration: OffsetDateTime,
-    pub identity: identity::PublicKey,
+    pub identity: ed25519::PublicKey,
    pub active: bool,

    pub typ: String,
@@ -39,7 +39,7 @@ use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_config_types::ForgetMe;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_crypto::asymmetric::{encryption, identity};
+use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_crypto::hkdf::DerivationMaterial;
 use nym_gateway_client::client::config::GatewayClientConfig;
 use nym_gateway_client::{
@@ -367,7 +367,7 @@ where
    // buffer controlling all messages fetched from provider
    // required so that other components would be able to use them (say the websocket)
    fn start_received_messages_buffer_controller(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        query_receiver: ReceivedBufferRequestReceiver,
        mixnet_receiver: MixnetMessageReceiver,
        reply_key_storage: SentReplyKeys,
@@ -552,18 +552,12 @@ where
        user_agent: Option<UserAgent>,
    ) -> Box<dyn TopologyProvider + Send + Sync> {
        // if no custom provider was ... provided ..., create one using nym-api
-        custom_provider.unwrap_or_else(|| match config_topology.topology_structure {
-            config::TopologyStructure::NymApi => Box::new(NymApiTopologyProvider::new(
+        custom_provider.unwrap_or_else(|| {
+            Box::new(NymApiTopologyProvider::new(
                config_topology,
                nym_api_urls,
                user_agent,
-            )),
-            config::TopologyStructure::GeoAware(group_by) => {
-                warn!("using deprecated 'GeoAware' topology provider - this option will be removed very soon");
-
-                #[allow(deprecated)]
-                Box::new(crate::client::topology_control::GeoAwareTopologyProvider::new(nym_api_urls, group_by))
-            }
+            ))
        })
    }

@@ -942,7 +936,7 @@ where

 pub struct BaseClient {
    pub address: Recipient,
-    pub identity_keys: Arc<identity::KeyPair>,
+    pub identity_keys: Arc<ed25519::KeyPair>,
    pub client_input: ClientInputStatus,
    pub client_output: ClientOutputStatus,
    pub client_state: ClientState,
@@ -5,7 +5,7 @@ use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::error::ClientCoreError;
 use nym_client_core_gateways_storage::{ActiveGateway, GatewayRegistration, GatewaysDetailsStore};
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;

 // helpers for error wrapping
 pub async fn set_active_gateway<D>(
@@ -26,7 +26,7 @@ where

 pub async fn get_active_gateway_identity<D>(
    details_store: &D,
-) -> Result<Option<identity::PublicKey>, ClientCoreError>
+) -> Result<Option<ed25519::PublicKey>, ClientCoreError>
 where
    D: GatewaysDetailsStore,
    D::StorageError: Send + Sync + 'static,
@@ -42,7 +42,7 @@ where

 pub async fn get_all_registered_identities<D>(
    details_store: &D,
-) -> Result<Vec<identity::PublicKey>, ClientCoreError>
+) -> Result<Vec<ed25519::PublicKey>, ClientCoreError>
 where
    D: GatewaysDetailsStore + Sync,
    D::StorageError: Send + Sync + 'static,
@@ -62,6 +62,10 @@ where
    /// Optional secondary predefined packet size used for the loop cover messages.
    secondary_packet_size: Option<PacketSize>,

+    /// Specify whether any constructed packets should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    use_legacy_sphinx_format: bool,
+
    packet_type: PacketType,

    stats_tx: ClientStatsSender,
@@ -130,6 +134,7 @@ impl LoopCoverTrafficStream<OsRng> {
            topology_access,
            primary_packet_size: traffic_config.primary_packet_size,
            secondary_packet_size: traffic_config.secondary_packet_size,
+            use_legacy_sphinx_format: traffic_config.use_legacy_sphinx_format,
            packet_type: traffic_config.packet_type,
            stats_tx,
            task_client,
@@ -182,6 +187,7 @@ impl LoopCoverTrafficStream<OsRng> {

        let cover_message = match generate_loop_cover_packet(
            &mut self.rng,
+            self.use_legacy_sphinx_format,
            topology_ref,
            &self.ack_key,
            &self.our_full_destination,
@@ -3,7 +3,7 @@

 use crate::client::key_manager::persistence::KeyStore;
 use nym_crypto::{
-    asymmetric::{encryption, identity},
+    asymmetric::{ed25519, x25519},
    hkdf::{DerivationMaterial, InvalidLength},
 };
 use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
@@ -25,10 +25,10 @@ mod test;
 #[derive(Clone)]
 pub struct ClientKeys {
    /// identity key associated with the client instance.
-    identity_keypair: Arc<identity::KeyPair>,
+    identity_keypair: Arc<ed25519::KeyPair>,

    /// encryption key associated with the client instance.
-    encryption_keypair: Arc<encryption::KeyPair>,
+    encryption_keypair: Arc<x25519::KeyPair>,

    /// key used for producing and processing acknowledgement packets.
    ack_key: Arc<AckKey>,
@@ -41,8 +41,8 @@ impl ClientKeys {
        R: RngCore + CryptoRng,
    {
        ClientKeys {
-            identity_keypair: Arc::new(identity::KeyPair::new(rng)),
-            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
+            identity_keypair: Arc::new(ed25519::KeyPair::new(rng)),
+            encryption_keypair: Arc::new(x25519::KeyPair::new(rng)),
            ack_key: Arc::new(AckKey::new(rng)),
        }
    }
@@ -56,18 +56,18 @@ impl ClientKeys {
    {
        let secret = derivation_material.derive_secret()?;
        Ok(ClientKeys {
-            identity_keypair: Arc::new(identity::KeyPair::from_secret(
+            identity_keypair: Arc::new(ed25519::KeyPair::from_secret(
                secret,
                derivation_material.index(),
            )),
-            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
+            encryption_keypair: Arc::new(x25519::KeyPair::new(rng)),
            ack_key: Arc::new(AckKey::new(rng)),
        })
    }

    pub fn from_keys(
-        id_keypair: identity::KeyPair,
-        enc_keypair: encryption::KeyPair,
+        id_keypair: ed25519::KeyPair,
+        enc_keypair: x25519::KeyPair,
        ack_key: AckKey,
    ) -> Self {
        Self {
@@ -85,13 +85,13 @@ impl ClientKeys {
        store.store_keys(self).await
    }

-    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
-    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+    /// Gets an atomically reference counted pointer to [`ed25519::KeyPair`].
+    pub fn identity_keypair(&self) -> Arc<ed25519::KeyPair> {
        Arc::clone(&self.identity_keypair)
    }

-    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
-    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+    /// Gets an atomically reference counted pointer to [`x25519::KeyPair`].
+    pub fn encryption_keypair(&self) -> Arc<x25519::KeyPair> {
        Arc::clone(&self.encryption_keypair)
    }
    /// Gets an atomically reference counted pointer to [`AckKey`].
@@ -103,8 +103,8 @@ impl ClientKeys {
 fn _assert_keys_zeroize_on_drop() {
    fn _assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}

-    _assert_zeroize_on_drop::<identity::KeyPair>();
-    _assert_zeroize_on_drop::<encryption::KeyPair>();
+    _assert_zeroize_on_drop::<ed25519::KeyPair>();
+    _assert_zeroize_on_drop::<x25519::KeyPair>();
    _assert_zeroize_on_drop::<AckKey>();
    _assert_zeroize_on_drop::<LegacySharedKeys>();
    _assert_zeroize_on_drop::<SharedSymmetricKey>();
@@ -11,7 +11,7 @@ use tokio::sync::Mutex;
 #[cfg(not(target_arch = "wasm32"))]
 use crate::config::disk_persistence::ClientKeysPaths;
 #[cfg(not(target_arch = "wasm32"))]
-use nym_crypto::asymmetric::{encryption, identity};
+use nym_crypto::asymmetric::{ed25519, x25519};
 #[cfg(not(target_arch = "wasm32"))]
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
 #[cfg(not(target_arch = "wasm32"))]
@@ -86,13 +86,13 @@ impl OnDiskKeys {
    }

    #[doc(hidden)]
-    pub fn load_encryption_keypair(&self) -> Result<encryption::KeyPair, OnDiskKeysError> {
+    pub fn load_encryption_keypair(&self) -> Result<x25519::KeyPair, OnDiskKeysError> {
        let encryption_paths = self.paths.encryption_key_pair_path();
        self.load_keypair(encryption_paths, "encryption")
    }

    #[doc(hidden)]
-    pub fn load_identity_keypair(&self) -> Result<identity::KeyPair, OnDiskKeysError> {
+    pub fn load_identity_keypair(&self) -> Result<ed25519::KeyPair, OnDiskKeysError> {
        let identity_paths = self.paths.identity_key_pair_path();
        self.load_keypair(identity_paths, "identity")
    }
@@ -4,7 +4,7 @@
 use async_trait::async_trait;
 use log::{debug, error};
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_client::error::GatewayClientError;
 use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
@@ -30,7 +30,7 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
 /// This combines combines the functionalities of being able to send and receive mix packets.
 #[async_trait]
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
-    fn gateway_identity(&self) -> identity::PublicKey;
+    fn gateway_identity(&self) -> ed25519::PublicKey;
    fn ws_fd(&self) -> Option<RawFd>;
    async fn send_client_request(
        &mut self,
@@ -75,7 +75,7 @@ pub trait GatewayReceiver {
 #[async_trait]
 impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
    #[inline]
-    fn gateway_identity(&self) -> identity::PublicKey {
+    fn gateway_identity(&self) -> ed25519::PublicKey {
        (**self).gateway_identity()
    }
    fn ws_fd(&self) -> Option<RawFd> {
@@ -134,7 +134,7 @@ where
    St: CredentialStorage,
    <St as CredentialStorage>::StorageError: Send + Sync + 'static,
 {
-    fn gateway_identity(&self) -> identity::PublicKey {
+    fn gateway_identity(&self) -> ed25519::PublicKey {
        self.gateway_client.gateway_identity()
    }
    fn ws_fd(&self) -> Option<RawFd> {
@@ -190,7 +190,7 @@ pub enum LocalGatewayError {
 #[cfg(not(target_arch = "wasm32"))]
 pub struct LocalGateway {
    /// Identity of the locally managed gateway
-    local_identity: identity::PublicKey,
+    local_identity: ed25519::PublicKey,

    // 'sender' part
    /// Channel responsible for taking mix packets and forwarding them further into the further mixnet layers.
@@ -203,7 +203,7 @@ pub struct LocalGateway {
 #[cfg(not(target_arch = "wasm32"))]
 impl LocalGateway {
    pub fn new(
-        local_identity: identity::PublicKey,
+        local_identity: ed25519::PublicKey,
        packet_forwarder: nym_mixnet_client::forwarder::MixForwardingSender,
        packet_router_tx: oneshot::Sender<PacketRouter>,
    ) -> Self {
@@ -221,7 +221,7 @@ mod nonwasm_sealed {

    #[async_trait]
    impl GatewayTransceiver for LocalGateway {
-        fn gateway_identity(&self) -> identity::PublicKey {
+        fn gateway_identity(&self) -> ed25519::PublicKey {
            self.local_identity
        }
        fn ws_fd(&self) -> Option<RawFd> {
@@ -263,7 +263,7 @@ mod nonwasm_sealed {

 // if we ever decided to start writing unit tests... : )
 pub struct MockGateway {
-    dummy_identity: identity::PublicKey,
+    dummy_identity: ed25519::PublicKey,
    packet_router: Option<PacketRouter>,
    sent: Vec<MixPacket>,
 }
@@ -303,7 +303,7 @@ impl GatewaySender for MockGateway {

 #[async_trait]
 impl GatewayTransceiver for MockGateway {
-    fn gateway_identity(&self) -> identity::PublicKey {
+    fn gateway_identity(&self) -> ed25519::PublicKey {
        self.dummy_identity
    }
    fn ws_fd(&self) -> Option<RawFd> {
@@ -109,6 +109,10 @@ pub(crate) struct Config {

    /// Optional secondary predefined packet size used for the encapsulated messages.
    secondary_packet_size: Option<PacketSize>,
+
+    /// Specify whether any constructed reply surbs should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    use_legacy_sphinx_format: bool,
 }

 impl Config {
@@ -118,6 +122,7 @@ impl Config {
        average_packet_delay: Duration,
        average_ack_delay: Duration,
        deterministic_route_selection: bool,
+        use_legacy_reply_surb_format: bool,
    ) -> Self {
        Config {
            ack_key,
@@ -127,6 +132,7 @@ impl Config {
            average_ack_delay,
            primary_packet_size: PacketSize::default(),
            secondary_packet_size: None,
+            use_legacy_sphinx_format: use_legacy_reply_surb_format,
        }
    }

@@ -186,6 +192,7 @@ where
            config.sender_address,
            config.average_packet_delay,
            config.average_ack_delay,
+            config.use_legacy_sphinx_format,
        );
        MessageHandler {
            config,
@@ -254,9 +261,11 @@ where
        let topology_permit = self.topology_access.get_read_permit().await;
        let topology = self.get_topology(&topology_permit)?;

-        let reply_surbs = self
-            .message_preparer
-            .generate_reply_surbs(amount, topology)?;
+        let reply_surbs = self.message_preparer.generate_reply_surbs(
+            self.config.use_legacy_sphinx_format,
+            amount,
+            topology,
+        )?;

        let reply_keys = reply_surbs
            .iter()
@@ -522,6 +531,7 @@ where
            self.generate_reply_surbs_with_keys(amount as usize).await?;

        let message = NymMessage::new_repliable(RepliableMessage::new_additional_surbs(
+            self.config.use_legacy_sphinx_format,
            sender_tag,
            reply_surbs,
        ));
@@ -559,8 +569,12 @@ where
            .generate_reply_surbs_with_keys(num_reply_surbs as usize)
            .await?;

-        let message =
-            NymMessage::new_repliable(RepliableMessage::new_data(message, sender_tag, reply_surbs));
+        let message = NymMessage::new_repliable(RepliableMessage::new_data(
+            self.config.use_legacy_sphinx_format,
+            message,
+            sender_tag,
+            reply_surbs,
+        ));

        self.try_split_and_send_non_reply_message(
            message,
@@ -99,6 +99,7 @@ impl<'a> From<&'a Config> for message_handler::Config {
            cfg.traffic.average_packet_delay,
            cfg.acks.average_ack_delay,
            cfg.traffic.deterministic_route_selection,
+            cfg.traffic.use_legacy_sphinx_format,
        )
        .with_custom_primary_packet_size(cfg.traffic.primary_packet_size)
        .with_custom_secondary_packet_size(cfg.traffic.secondary_packet_size)
@@ -252,6 +252,7 @@ where
                (
                    generate_loop_cover_packet(
                        &mut self.rng,
+                        self.config.traffic.use_legacy_sphinx_format,
                        topology_ref,
                        &self.config.ack_key,
                        &self.config.our_full_destination,
@@ -9,7 +9,7 @@ use futures::channel::mpsc;
 use futures::lock::Mutex;
 use futures::StreamExt;
 use log::*;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_crypto::Digest;
 use nym_gateway_client::MixnetMessageReceiver;
 use nym_sphinx::anonymous_replies::requests::{
@@ -39,7 +39,7 @@ pub type ReconstructedMessagesReceiver = mpsc::UnboundedReceiver<Vec<Reconstruct

 struct ReceivedMessagesBufferInner<R: MessageReceiver> {
    messages: Vec<ReconstructedMessage>,
-    local_encryption_keypair: Arc<encryption::KeyPair>,
+    local_encryption_keypair: Arc<x25519::KeyPair>,

    // TODO: looking how it 'looks' here, perhaps `MessageReceiver` should be renamed to something
    // else instead.
@@ -176,7 +176,7 @@ struct ReceivedMessagesBuffer<R: MessageReceiver> {

 impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
    fn new(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        reply_key_storage: SentReplyKeys,
        reply_controller_sender: ReplyControllerSender,
        stats_tx: ClientStatsSender,
@@ -250,10 +250,10 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
        let mut reconstructed = Vec::new();
        for msg in msgs {
            let (reply_surbs, from_surb_request) = match msg.content {
-                RepliableMessageContent::Data {
-                    message,
-                    reply_surbs,
-                } => {
+                RepliableMessageContent::Data(content) => {
+                    let reply_surbs = content.reply_surbs;
+                    let message = content.message;
+
                    trace!(
                        "received message that also contained additional {} reply surbs from {:?}!",
                        reply_surbs.len(),
@@ -264,7 +264,9 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {

                    (reply_surbs, false)
                }
-                RepliableMessageContent::AdditionalSurbs { reply_surbs } => {
+                RepliableMessageContent::AdditionalSurbs(content) => {
+                    let reply_surbs = content.reply_surbs;
+
                    trace!(
                        "received additional {} reply surbs from {:?}!",
                        reply_surbs.len(),
@@ -272,9 +274,37 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                    );
                    (reply_surbs, true)
                }
-                RepliableMessageContent::Heartbeat {
-                    additional_reply_surbs,
-                } => {
+                RepliableMessageContent::Heartbeat(content) => {
+                    let additional_reply_surbs = content.additional_reply_surbs;
+                    error!("received a repliable heartbeat message - we don't know how to handle it yet (and we won't know until future PRs)");
+                    (additional_reply_surbs, false)
+                }
+                RepliableMessageContent::DataV2(content) => {
+                    let reply_surbs = content.reply_surbs;
+                    let message = content.message;
+
+                    trace!(
+                        "received message that also contained additional {} reply surbs from {:?}!",
+                        reply_surbs.len(),
+                        msg.sender_tag
+                    );
+
+                    reconstructed.push(ReconstructedMessage::new(message, msg.sender_tag));
+
+                    (reply_surbs, false)
+                }
+                RepliableMessageContent::AdditionalSurbsV2(content) => {
+                    let reply_surbs = content.reply_surbs;
+
+                    trace!(
+                        "received additional {} reply surbs from {:?}!",
+                        reply_surbs.len(),
+                        msg.sender_tag
+                    );
+                    (reply_surbs, true)
+                }
+                RepliableMessageContent::HeartbeatV2(content) => {
+                    let additional_reply_surbs = content.additional_reply_surbs;
                    error!("received a repliable heartbeat message - we don't know how to handle it yet (and we won't know until future PRs)");
                    (additional_reply_surbs, false)
                }
@@ -536,7 +566,7 @@ pub(crate) struct ReceivedMessagesBufferController<R: MessageReceiver> {

 impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferController<R> {
    pub(crate) fn new(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        query_receiver: ReceivedBufferRequestReceiver,
        mixnet_packet_receiver: MixnetMessageReceiver,
        reply_key_storage: SentReplyKeys,
@@ -1,214 +0,0 @@
-use crate::config::GroupBy;
-use log::{debug, error};
-use nym_explorer_client::{ExplorerClient, PrettyDetailedMixNodeBond};
-use nym_network_defaults::var_names::EXPLORER_API;
-use nym_topology::{
-    provider_trait::{async_trait, TopologyProvider},
-    NymTopology,
-};
-use nym_validator_client::client::NodeId;
-use rand::{prelude::SliceRandom, thread_rng};
-use std::collections::HashMap;
-use tap::TapOptional;
-use url::Url;
-
-pub use nym_country_group::CountryGroup;
-
-fn create_explorer_client() -> Option<ExplorerClient> {
-    let Ok(explorer_api_url) = std::env::var(EXPLORER_API) else {
-        error!("Missing EXPLORER_API");
-        return None;
-    };
-
-    let Ok(explorer_api_url) = explorer_api_url.parse() else {
-        error!("Failed to parse EXPLORER_API");
-        return None;
-    };
-
-    log::debug!("Using explorer-api url: {}", explorer_api_url);
-    let Ok(client) = nym_explorer_client::ExplorerClient::new(explorer_api_url) else {
-        error!("Failed to create explorer-api client");
-        return None;
-    };
-
-    Some(client)
-}
-
-fn group_mixnodes_by_country_code(
-    mixnodes: Vec<PrettyDetailedMixNodeBond>,
-) -> HashMap<CountryGroup, Vec<NodeId>> {
-    mixnodes
-        .into_iter()
-        .fold(HashMap::<CountryGroup, Vec<NodeId>>::new(), |mut acc, m| {
-            if let Some(ref location) = m.location {
-                let country_code = location.two_letter_iso_country_code.clone();
-                let group_code = CountryGroup::new(country_code.as_str());
-                let mixnodes = acc.entry(group_code).or_default();
-                mixnodes.push(m.mix_id);
-            }
-            acc
-        })
-}
-
-fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<NodeId>>) {
-    let mixnode_distribution = mixnodes
-        .iter()
-        .map(|(k, v)| format!("{}: {}", k, v.len()))
-        .collect::<Vec<_>>()
-        .join(", ");
-    debug!("Mixnode distribution - {}", mixnode_distribution);
-}
-
-fn check_layer_integrity(topology: NymTopology) -> Result<(), ()> {
-    if topology.ensure_minimally_routable().is_err() {
-        error!("Layer is missing in topology!");
-        return Err(());
-    }
-    Ok(())
-}
-
-#[deprecated(note = "use NymApiTopologyProvider instead as explorer API will soon be removed")]
-pub struct GeoAwareTopologyProvider {
-    validator_client: nym_validator_client::client::NymApiClient,
-    filter_on: GroupBy,
-}
-
-#[allow(deprecated)]
-impl GeoAwareTopologyProvider {
-    pub fn new(mut nym_api_urls: Vec<Url>, filter_on: GroupBy) -> GeoAwareTopologyProvider {
-        log::info!(
-            "Creating geo-aware topology provider with filter on {}",
-            filter_on
-        );
-        nym_api_urls.shuffle(&mut thread_rng());
-
-        GeoAwareTopologyProvider {
-            validator_client: nym_validator_client::client::NymApiClient::new(
-                nym_api_urls[0].clone(),
-            ),
-            filter_on,
-        }
-    }
-
-    async fn get_topology(&self) -> Option<NymTopology> {
-        let rewarded_set = self
-            .validator_client
-            .get_current_rewarded_set()
-            .await
-            .inspect_err(|err| error!("failed to get current rewarded set: {err}"))
-            .ok()?;
-
-        let mut topology = NymTopology::new_empty(rewarded_set);
-
-        let mixnodes = match self
-            .validator_client
-            .get_all_basic_active_mixing_assigned_nodes()
-            .await
-        {
-            Err(err) => {
-                error!("failed to get network mixnodes - {err}");
-                return None;
-            }
-            Ok(mixes) => mixes,
-        };
-
-        let gateways = match self
-            .validator_client
-            .get_all_basic_entry_assigned_nodes()
-            .await
-        {
-            Err(err) => {
-                error!("failed to get network gateways - {err}");
-                return None;
-            }
-            Ok(gateways) => gateways,
-        };
-
-        // Also fetch mixnodes cached by explorer-api, with the purpose of getting their
-        // geolocation.
-        debug!("Fetching mixnodes from explorer-api...");
-        let explorer_client = create_explorer_client()?;
-        let Ok(mixnodes_from_explorer_api) = explorer_client.get_mixnodes().await else {
-            error!("failed to get mixnodes from explorer-api");
-            return None;
-        };
-
-        debug!("Fetching gateways from explorer-api...");
-        let Ok(gateways_from_explorer_api) = explorer_client.get_gateways().await else {
-            error!("failed to get mixnodes from explorer-api");
-            return None;
-        };
-
-        // Determine what we should filter around
-        let filter_on = match self.filter_on {
-            GroupBy::CountryGroup(group) => group,
-            GroupBy::NymAddress(recipient) => {
-                // Convert recipient into a country group by extracting out the gateway part and
-                // using that as the country code.
-                let gateway = recipient.gateway().to_base58_string();
-
-                // Lookup the location of this gateway by using the location data from the
-                // explorer-api
-                let gateway_location = gateways_from_explorer_api
-                    .iter()
-                    .find(|g| g.gateway.identity_key == gateway)
-                    .and_then(|g| g.location.clone())
-                    .map(|location| location.two_letter_iso_country_code)
-                    .tap_none(|| error!("No location found for the gateway: {}", gateway))?;
-                debug!(
-                    "Filtering on nym-address: {}, with location: {}",
-                    recipient, gateway_location
-                );
-
-                CountryGroup::new(&gateway_location)
-            }
-        };
-        debug!("Filter group: {}", filter_on);
-
-        // Partition mixnodes_from_explorer_api according to the value of
-        // two_letter_iso_country_code.
-        // NOTE: we construct the full distribution here, but only use the one we're interested in.
-        // The reason we this instead of a straight filter is that this opens up the possibility to
-        // complement a small grouping with mixnodes from adjecent countries.
-        let mixnode_distribution = group_mixnodes_by_country_code(mixnodes_from_explorer_api);
-        log_mixnode_distribution(&mixnode_distribution);
-
-        let Some(filtered_mixnode_ids) = mixnode_distribution.get(&filter_on) else {
-            error!("no mixnodes found for: {}", filter_on);
-            return None;
-        };
-
-        let mixnodes = mixnodes
-            .into_iter()
-            .filter(|m| filtered_mixnode_ids.contains(&m.node_id))
-            .collect::<Vec<_>>();
-
-        topology.add_skimmed_nodes(&mixnodes);
-        topology.add_skimmed_nodes(&gateways);
-
-        // TODO: return real error type
-        check_layer_integrity(topology.clone()).ok()?;
-
-        Some(topology)
-    }
-}
-
-#[allow(deprecated)]
-#[cfg(not(target_arch = "wasm32"))]
-#[async_trait]
-impl TopologyProvider for GeoAwareTopologyProvider {
-    // this will be manually refreshed on a timer specified inside mixnet client config
-    async fn get_new_topology(&mut self) -> Option<NymTopology> {
-        self.get_topology().await
-    }
-}
-
-#[allow(deprecated)]
-#[cfg(target_arch = "wasm32")]
-#[async_trait(?Send)]
-impl TopologyProvider for GeoAwareTopologyProvider {
-    // this will be manually refreshed on a timer specified inside mixnet client config
-    async fn get_new_topology(&mut self) -> Option<NymTopology> {
-        self.get_topology().await
-    }
-}
@@ -17,11 +17,8 @@ use tokio::time::sleep;
 use wasmtimer::tokio::sleep;

 mod accessor;
-pub mod geo_aware_provider;
 pub mod nym_api_provider;

-#[allow(deprecated)]
-pub use geo_aware_provider::GeoAwareTopologyProvider;
 pub use nym_api_provider::{Config as NymApiTopologyProviderConfig, NymApiTopologyProvider};
 pub use nym_topology::provider_trait::TopologyProvider;

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::client::mix_traffic::transceiver::ErasedGatewayError;
-use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
+use nym_crypto::asymmetric::ed25519::Ed25519RecoveryError;
 use nym_gateway_client::error::GatewayClientError;
 use nym_topology::node::RoutingNodeError;
 use nym_topology::{NodeId, NymTopologyError};
@@ -5,7 +5,7 @@ use crate::error::ClientCoreError;
 use crate::init::types::RegistrationResult;
 use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_client::GatewayClient;
 use nym_topology::node::RoutingNode;
 use nym_validator_client::client::IdentityKeyRef;
@@ -52,7 +52,7 @@ const PING_TIMEOUT: Duration = Duration::from_millis(1000);
 // The abstraction that some of these helpers use
 pub trait ConnectableGateway {
    fn node_id(&self) -> NodeId;
-    fn identity(&self) -> identity::PublicKey;
+    fn identity(&self) -> ed25519::PublicKey;
    fn clients_address(&self, prefer_ipv6: bool) -> Option<String>;
    fn is_wss(&self) -> bool;
 }
@@ -62,7 +62,7 @@ impl ConnectableGateway for RoutingNode {
        self.node_id
    }

-    fn identity(&self) -> identity::PublicKey {
+    fn identity(&self) -> ed25519::PublicKey {
        self.identity_key
    }

@@ -287,7 +287,7 @@ pub(super) fn get_specified_gateway(
    must_use_tls: bool,
 ) -> Result<RoutingNode, ClientCoreError> {
    log::debug!("Requesting specified gateway: {}", gateway_identity);
-    let user_gateway = identity::PublicKey::from_base58_string(gateway_identity)
+    let user_gateway = ed25519::PublicKey::from_base58_string(gateway_identity)
        .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;

    let gateway = gateways
@@ -312,9 +312,9 @@ pub(super) fn get_specified_gateway(
 }

 pub(super) async fn register_with_gateway(
-    gateway_id: identity::PublicKey,
+    gateway_id: ed25519::PublicKey,
    gateway_listener: Url,
-    our_identity: Arc<identity::KeyPair>,
+    our_identity: Arc<ed25519::KeyPair>,
    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
 ) -> Result<RegistrationResult, ClientCoreError> {
    let mut gateway_client = GatewayClient::new_init(
@@ -9,7 +9,7 @@ use crate::init::{setup_gateway, use_loaded_gateway_details};
 use nym_client_core_gateways_storage::{
    GatewayRegistration, GatewaysDetailsStore, RemoteGatewayDetails,
 };
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_client::client::InitGatewayClient;
 use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_sphinx::addressing::clients::Recipient;
@@ -26,14 +26,14 @@ use url::Url;

 pub enum SelectedGateway {
    Remote {
-        gateway_id: identity::PublicKey,
+        gateway_id: ed25519::PublicKey,

        gateway_owner_address: Option<AccountId>,

        gateway_listener: Url,
    },
    Custom {
-        gateway_id: identity::PublicKey,
+        gateway_id: ed25519::PublicKey,
        additional_data: Option<Vec<u8>>,
    },
 }
@@ -77,7 +77,7 @@ impl SelectedGateway {
        gateway_id: String,
        additional_data: Option<Vec<u8>>,
    ) -> Result<Self, ClientCoreError> {
-        let gateway_id = identity::PublicKey::from_base58_string(&gateway_id)
+        let gateway_id = ed25519::PublicKey::from_base58_string(&gateway_id)
            .map_err(|source| ClientCoreError::MalformedGatewayIdentity { gateway_id, source })?;

        Ok(SelectedGateway::Custom {
@@ -86,7 +86,7 @@ impl SelectedGateway {
        })
    }

-    pub fn gateway_id(&self) -> &identity::PublicKey {
+    pub fn gateway_id(&self) -> &ed25519::PublicKey {
        match self {
            SelectedGateway::Remote { gateway_id, .. } => gateway_id,
            SelectedGateway::Custom { gateway_id, .. } => gateway_id,
@@ -142,7 +142,7 @@ impl InitialisationResult {
        )
    }

-    pub fn gateway_id(&self) -> identity::PublicKey {
+    pub fn gateway_id(&self) -> ed25519::PublicKey {
        self.gateway_registration.details.gateway_id()
    }
 }
@@ -271,7 +271,7 @@ impl GatewaySetup {
    }

    /// new gateway setup performed by each client that's inbuilt in a gateway (like NR or IPR)
-    pub fn new_inbuilt(identity: identity::PublicKey) -> Self {
+    pub fn new_inbuilt(identity: ed25519::PublicKey) -> Self {
        GatewaySetup::New {
            specification: GatewaySelectionSpecification::Custom {
                gateway_identity: identity.to_base58_string(),
@@ -17,7 +17,7 @@ use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCred
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_credentials::CredentialSpendingData;
 use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
    BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersionExt,
@@ -57,7 +57,7 @@ pub(crate) mod websockets;
 use websockets::connect_async;

 pub struct GatewayConfig {
-    pub gateway_identity: identity::PublicKey,
+    pub gateway_identity: ed25519::PublicKey,

    // currently a dead field
    pub gateway_owner: Option<String>,
@@ -67,7 +67,7 @@ pub struct GatewayConfig {

 impl GatewayConfig {
    pub fn new(
-        gateway_identity: identity::PublicKey,
+        gateway_identity: ed25519::PublicKey,
        gateway_owner: Option<String>,
        gateway_listener: String,
    ) -> Self {
@@ -93,8 +93,8 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
    authenticated: bool,
    bandwidth: ClientBandwidth,
    gateway_address: String,
-    gateway_identity: identity::PublicKey,
-    local_identity: Arc<identity::KeyPair>,
+    gateway_identity: ed25519::PublicKey,
+    local_identity: Arc<ed25519::KeyPair>,
    shared_key: Option<Arc<SharedGatewayKey>>,
    connection: SocketState,
    packet_router: PacketRouter,
@@ -117,7 +117,7 @@ impl<C, St> GatewayClient<C, St> {
    pub fn new(
        cfg: GatewayClientConfig,
        gateway_config: GatewayConfig,
-        local_identity: Arc<identity::KeyPair>,
+        local_identity: Arc<ed25519::KeyPair>,
        // TODO: make it mandatory. if you don't want to pass it, use `new_init`
        shared_key: Option<Arc<SharedGatewayKey>>,
        packet_router: PacketRouter,
@@ -145,7 +145,7 @@ impl<C, St> GatewayClient<C, St> {
        }
    }

-    pub fn gateway_identity(&self) -> identity::PublicKey {
+    pub fn gateway_identity(&self) -> ed25519::PublicKey {
        self.gateway_identity
    }

@@ -1063,8 +1063,8 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
    // for initialisation we do not need credential storage. Though it's still a bit weird we have to set the generic...
    pub fn new_init(
        gateway_listener: Url,
-        gateway_identity: identity::PublicKey,
-        local_identity: Arc<identity::KeyPair>,
+        gateway_identity: ed25519::PublicKey,
+        local_identity: Arc<ed25519::KeyPair>,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
    ) -> Self {
        log::trace!("Initialising gateway client");
@@ -15,7 +15,7 @@ use nym_credentials::{
    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures, EpochVerificationKey,
 };
 use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use std::fs;
 use std::path::PathBuf;
 use tempfile::NamedTempFile;
@@ -83,7 +83,7 @@ async fn issue_client_ticketbook(
    );

    let persistent_storage = initialise_persistent_storage(credentials_store).await;
-    let private_id_key: identity::PrivateKey = nym_pemstore::load_key(private_id_key)?;
+    let private_id_key: ed25519::PrivateKey = nym_pemstore::load_key(private_id_key)?;
    utils::issue_credential(
        &client,
        &persistent_storage,
@@ -1,6 +1,6 @@
 use clap::{Args, Parser, Subcommand};
 use nym_bin_common::output_format::OutputFormat;
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_types::helpers::ConsoleSigningOutput;
 use nym_validator_client::nyxd::error::NyxdError;
 use std::path::PathBuf;
@@ -34,14 +34,14 @@ pub struct SignArgs {

 pub async fn sign(args: SignArgs) -> Result<(), NyxdError> {
    eprintln!(">>> loading: {}", args.private_key.display());
-    let private_identity_key: identity::PrivateKey =
+    let private_identity_key: ed25519::PrivateKey =
        nym_pemstore::load_key(args.private_key).expect("failed to load key");

    print_signed_msg(&private_identity_key, &args.base58_msg, args.output);
    Ok(())
 }

-fn print_signed_msg(private_key: &identity::PrivateKey, raw_msg: &str, output: OutputFormat) {
+fn print_signed_msg(private_key: &ed25519::PrivateKey, raw_msg: &str, output: OutputFormat) {
    let trimmed = raw_msg.trim();
    eprintln!(">>> attempting to sign: {trimmed}");

@@ -1,15 +0,0 @@
-[package]
-name = "nym-country-group"
-version = "0.1.0"
-authors.workspace = true
-repository.workspace = true
-homepage.workspace = true
-documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-serde = { workspace = true, features = ["derive"] }
-tracing.workspace = true
@@ -1,158 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use serde::{Deserialize, Serialize};
-use std::fmt;
-use tracing::info;
-
-#[derive(Copy, Clone, Hash, PartialEq, Eq, Serialize, Deserialize, Debug)]
-pub enum CountryGroup {
-    Europe,
-    NorthAmerica,
-    SouthAmerica,
-    Oceania,
-    Asia,
-    Africa,
-    Unknown,
-}
-
-impl CountryGroup {
-    // We map country codes into group, which initially are continent codes to a first approximation,
-    // but we do it manually to reserve the right to tweak this distribution for our purposes.
-    // NOTE: I did this quickly, and it's not a complete list of all countries, but only those that
-    // were present in the network at the time. Please add more as needed.
-    pub fn new(country_code: &str) -> Self {
-        let country_code = country_code.to_uppercase();
-        use CountryGroup::*;
-        match country_code.as_ref() {
-            // Europe
-            "AT" => Europe,
-            "BG" => Europe,
-            "CH" => Europe,
-            "CY" => Europe,
-            "CZ" => Europe,
-            "DE" => Europe,
-            "DK" => Europe,
-            "ES" => Europe,
-            "FI" => Europe,
-            "FR" => Europe,
-            "GB" => Europe,
-            "GR" => Europe,
-            "IE" => Europe,
-            "IT" => Europe,
-            "LT" => Europe,
-            "LU" => Europe,
-            "LV" => Europe,
-            "MD" => Europe,
-            "MT" => Europe,
-            "NL" => Europe,
-            "NO" => Europe,
-            "PL" => Europe,
-            "RO" => Europe,
-            "SE" => Europe,
-            "SK" => Europe,
-            "TR" => Europe,
-            "UA" => Europe,
-
-            // North America
-            "CA" => NorthAmerica,
-            "MX" => NorthAmerica,
-            "US" => NorthAmerica,
-
-            // South America
-            "AR" => SouthAmerica,
-            "BR" => SouthAmerica,
-            "CL" => SouthAmerica,
-            "CO" => SouthAmerica,
-            "CR" => SouthAmerica,
-            "GT" => SouthAmerica,
-
-            // Oceania
-            "AU" => Oceania,
-
-            // Asia
-            "AM" => Asia,
-            "BH" => Asia,
-            "CN" => Asia,
-            "GE" => Asia,
-            "HK" => Asia,
-            "ID" => Asia,
-            "IL" => Asia,
-            "IN" => Asia,
-            "JP" => Asia,
-            "KH" => Asia,
-            "KR" => Asia,
-            "KZ" => Asia,
-            "MY" => Asia,
-            "RU" => Asia,
-            "SG" => Asia,
-            "TH" => Asia,
-            "VN" => Asia,
-
-            // Africa
-            "SC" => Africa,
-            "UG" => Africa,
-            "ZA" => Africa,
-
-            // And group level codes work too
-            "EU" => Europe,
-            "NA" => NorthAmerica,
-            "SA" => SouthAmerica,
-            "OC" => Oceania,
-            "AS" => Asia,
-            "AF" => Africa,
-
-            // And some aliases
-            "EUROPE" => Europe,
-            "NORTHAMERICA" => NorthAmerica,
-            "SOUTHAMERICA" => SouthAmerica,
-            "OCEANIA" => Oceania,
-            "ASIA" => Asia,
-            "AFRICA" => Africa,
-
-            _ => {
-                info!("Unknown country code: {country_code}");
-                Unknown
-            }
-        }
-    }
-}
-
-impl fmt::Display for CountryGroup {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        use CountryGroup::*;
-        match self {
-            Europe => write!(f, "EU"),
-            NorthAmerica => write!(f, "NA"),
-            SouthAmerica => write!(f, "SA"),
-            Oceania => write!(f, "OC"),
-            Asia => write!(f, "AS"),
-            Africa => write!(f, "AF"),
-            Unknown => write!(f, "Unknown"),
-        }
-    }
-}
-
-impl std::str::FromStr for CountryGroup {
-    type Err = ();
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let group = CountryGroup::new(s);
-        if group == CountryGroup::Unknown {
-            Err(())
-        } else {
-            Ok(group)
-        }
-    }
-}
-
-impl CountryGroup {
-    #[allow(unused)]
-    fn known(self) -> Option<CountryGroup> {
-        use CountryGroup::*;
-        match self {
-            Europe | NorthAmerica | SouthAmerica | Oceania | Asia | Africa => Some(self),
-            Unknown => None,
-        }
-    }
-}
@@ -172,6 +172,21 @@ impl MemoryEcachTicketbookManager {
        );
    }

+    pub(crate) async fn contains_ticketbook(&self, ticketbook: &IssuedTicketBook) -> bool {
+        let ser = ticketbook.pack();
+        let search_data = Zeroizing::new(ser.data);
+        self.inner
+            .read()
+            .await
+            .ticketbooks
+            .iter()
+            .any(|ticketbook| {
+                let ser = ticketbook.1.ticketbook.pack();
+                let data = Zeroizing::new(ser.data);
+                search_data.eq(&data)
+            })
+    }
+
    pub(crate) async fn get_ticketbooks_info(&self) -> Vec<BasicTicketbookInformation> {
        let guard = self.inner.read().await;

@@ -95,6 +95,24 @@ impl SqliteEcashTicketbookManager {
        Ok(())
    }

+    pub(crate) async fn contains_ticketbook_data(&self, data: &[u8]) -> Result<bool, sqlx::Error> {
+        let exists = sqlx::query(
+            r#"
+                SELECT EXISTS (
+                    SELECT 1
+                    FROM ecash_ticketbook
+                    WHERE ticketbook_data = ?
+                )
+            "#,
+        )
+        .bind(data)
+        .fetch_optional(&self.connection_pool)
+        .await?
+        .is_some();
+
+        Ok(exists)
+    }
+
    pub(crate) async fn get_ticketbooks_info(
        &self,
    ) -> Result<Vec<BasicTicketbookInformation>, sqlx::Error> {
@@ -70,6 +70,13 @@ impl Storage for EphemeralStorage {
        Ok(())
    }

+    async fn contains_issued_ticketbook(
+        &self,
+        ticketbook: &IssuedTicketBook,
+    ) -> Result<bool, StorageError> {
+        Ok(self.storage_manager.contains_ticketbook(ticketbook).await)
+    }
+
    async fn get_ticketbooks_info(
        &self,
    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError> {
@@ -145,6 +145,16 @@ impl Storage for PersistentStorage {
        Ok(())
    }

+    async fn contains_issued_ticketbook(
+        &self,
+        ticketbook: &IssuedTicketBook,
+    ) -> Result<bool, Self::StorageError> {
+        let ser = ticketbook.pack();
+        let data = Zeroizing::new(ser.data);
+
+        Ok(self.storage_manager.contains_ticketbook_data(&data).await?)
+    }
+
    async fn get_ticketbooks_info(
        &self,
    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError> {
@@ -37,6 +37,11 @@ pub trait Storage: Clone + Send + Sync {
        ticketbook: &IssuedTicketBook,
    ) -> Result<(), Self::StorageError>;

+    async fn contains_issued_ticketbook(
+        &self,
+        ticketbook: &IssuedTicketBook,
+    ) -> Result<bool, Self::StorageError>;
+
    async fn get_ticketbooks_info(
        &self,
    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError>;
@@ -12,7 +12,7 @@ use nym_credentials_interface::{
    BlindedSignature, KeyPairUser, PartialWallet, TicketType, VerificationKeyAuth,
    WalletSignatures, WithdrawalRequest,
 };
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_ecash_contract_common::deposit::DepositId;
 use nym_ecash_time::{ecash_default_expiration_date, ecash_today, EcashTime};
 use nym_validator_client::nym_api::EpochId;
@@ -27,7 +27,7 @@ pub struct IssuanceTicketBook {
    deposit_id: DepositId,

    /// base58 encoded private key ensuring the depositer requested these attributes
-    signing_key: identity::PrivateKey,
+    signing_key: ed25519::PrivateKey,

    /// ecash keypair related to the credential
    ecash_keypair: KeyPairUser,
@@ -43,7 +43,7 @@ impl IssuanceTicketBook {
    pub fn new<M: AsRef<[u8]>>(
        deposit_id: DepositId,
        identifier: M,
-        signing_key: identity::PrivateKey,
+        signing_key: ed25519::PrivateKey,
        ticketbook_type: TicketType,
    ) -> Self {
        //this expiration date will get fed to the ecash library, force midnight to be set
@@ -59,7 +59,7 @@ impl IssuanceTicketBook {
    pub fn new_with_expiration<M: AsRef<[u8]>>(
        deposit_id: DepositId,
        identifier: M,
-        signing_key: identity::PrivateKey,
+        signing_key: ed25519::PrivateKey,
        ticketbook_type: TicketType,
        expiration_date: Date,
    ) -> Self {
@@ -93,7 +93,7 @@ impl IssuanceTicketBook {
        message
    }

-    fn request_signature(&self, signing_request: &CredentialSigningData) -> identity::Signature {
+    fn request_signature(&self, signing_request: &CredentialSigningData) -> ed25519::Signature {
        let message = Self::request_plaintext(&signing_request.withdrawal_request, self.deposit_id);
        self.signing_key.sign(message)
    }
@@ -127,7 +127,7 @@ impl IssuanceTicketBook {
        self.deposit_id
    }

-    pub fn identity_key(&self) -> &identity::PrivateKey {
+    pub fn identity_key(&self) -> &ed25519::PrivateKey {
        &self.signing_key
    }

@@ -3,7 +3,7 @@

 use crate::ecash::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
 use nym_credentials_interface::CompactEcashError;
-use nym_crypto::asymmetric::encryption::KeyRecoveryError;
+use nym_crypto::asymmetric::x25519::KeyRecoveryError;
 use nym_validator_client::ValidatorClientError;
 use thiserror::Error;

@@ -18,7 +18,7 @@ pub mod bs58_ed25519_pubkey {
 }

 pub mod bs58_ed25519_signature {
-    use crate::asymmetric::identity::Signature;
+    use crate::asymmetric::ed25519::Signature;
    use serde::{Deserialize, Deserializer, Serializer};

    pub fn serialize<S: Serializer>(
@@ -1,8 +1,13 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-pub mod encryption;
-pub mod identity;
+pub mod ed25519;
+pub mod x25519;

-pub use encryption as x25519;
-pub use identity as ed25519;
+// don't break existing imports
+// but deprecate them
+#[deprecated(note = "use ed25519 instead")]
+pub use ed25519 as identity;
+
+#[deprecated(note = "use x25519 instead")]
+pub use x25519 as encryption;
@@ -1,7 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::asymmetric::encryption;
+use crate::asymmetric::x25519;
 use crate::hkdf;
 use cipher::{Key, KeyIvInit, StreamCipher};
 use digest::crypto_common::BlockSizeUser;
@@ -15,14 +15,14 @@ use rand::{CryptoRng, RngCore};
 #[cfg(feature = "rand")]
 pub fn new_ephemeral_shared_key<C, D, R>(
    rng: &mut R,
-    remote_key: &encryption::PublicKey,
-) -> (encryption::KeyPair, Key<C>)
+    remote_key: &x25519::PublicKey,
+) -> (x25519::KeyPair, Key<C>)
 where
    C: StreamCipher + KeyIvInit,
    D: Digest + BlockSizeUser + Clone,
    R: RngCore + CryptoRng,
 {
-    let ephemeral_keypair = encryption::KeyPair::new(rng);
+    let ephemeral_keypair = x25519::KeyPair::new(rng);

    // after performing diffie-hellman we don't care about the private component anymore
    let dh_result = ephemeral_keypair.private_key().diffie_hellman(remote_key);
@@ -43,8 +43,8 @@ where

 /// Recompute shared key using remote public key and local private key.
 pub fn recompute_shared_key<C, D>(
-    remote_key: &encryption::PublicKey,
-    local_key: &encryption::PrivateKey,
+    remote_key: &x25519::PublicKey,
+    local_key: &x25519::PrivateKey,
 ) -> Key<C>
 where
    C: StreamCipher + KeyIvInit,
@@ -6,7 +6,7 @@ use crate::registration::handshake::state::State;
 use crate::SharedGatewayKey;
 use futures::future::BoxFuture;
 use futures::{Sink, Stream};
-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use rand::{CryptoRng, RngCore};
 use std::future::Future;
 use std::pin::Pin;
@@ -48,8 +48,8 @@ impl Future for GatewayHandshake<'_> {
 pub fn client_handshake<'a, S, R>(
    rng: &'a mut R,
    ws_stream: &'a mut S,
-    identity: &'a identity::KeyPair,
-    gateway_pubkey: identity::PublicKey,
+    identity: &'a ed25519::KeyPair,
+    gateway_pubkey: ed25519::PublicKey,
    expects_credential_usage: bool,
    derive_aes256_gcm_siv_key: bool,
    #[cfg(not(target_arch = "wasm32"))] shutdown: TaskClient,
@@ -78,7 +78,7 @@ where
 pub fn gateway_handshake<'a, S, R>(
    rng: &'a mut R,
    ws_stream: &'a mut S,
-    identity: &'a identity::KeyPair,
+    identity: &'a ed25519::KeyPair,
    received_init_payload: Vec<u8>,
    shutdown: TaskClient,
 ) -> GatewayHandshake<'a>
@@ -14,11 +14,7 @@ use crate::{
 use futures::{Sink, SinkExt, Stream, StreamExt};
 use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_crypto::symmetric::aead::random_nonce;
-use nym_crypto::{
-    asymmetric::{encryption, identity},
-    generic_array::typenum::Unsigned,
-    hkdf,
-};
+use nym_crypto::{generic_array::typenum::Unsigned, hkdf};
 use nym_sphinx::params::{GatewayEncryptionAlgorithm, GatewaySharedKeyHkdfAlgorithm};
 use rand::{thread_rng, CryptoRng, RngCore};
 use std::any::{type_name, Any};
@@ -74,14 +70,14 @@ impl<'a, S, R> State<'a, S, R> {
    pub(crate) fn new(
        rng: &'a mut R,
        ws_stream: &'a mut S,
-        identity: &'a identity::KeyPair,
-        remote_pubkey: Option<identity::PublicKey>,
+        identity: &'a ed25519::KeyPair,
+        remote_pubkey: Option<ed25519::PublicKey>,
        #[cfg(not(target_arch = "wasm32"))] shutdown: TaskClient,
    ) -> Self
    where
        R: CryptoRng + RngCore,
    {
-        let ephemeral_keypair = encryption::KeyPair::new(rng);
+        let ephemeral_keypair = x25519::KeyPair::new(rng);
        State {
            ws_stream,
            rng,
@@ -113,7 +109,7 @@ impl<'a, S, R> State<'a, S, R> {
    }

    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn local_ephemeral_key(&self) -> &encryption::PublicKey {
+    pub(crate) fn local_ephemeral_key(&self) -> &x25519::PublicKey {
        self.ephemeral_keypair.public_key()
    }

@@ -150,7 +146,7 @@ impl<'a, S, R> State<'a, S, R> {

    pub(crate) fn derive_shared_key(
        &mut self,
-        remote_ephemeral_key: &encryption::PublicKey,
+        remote_ephemeral_key: &x25519::PublicKey,
        initiator_salt: Option<&[u8]>,
    ) {
        let dh_result = self
@@ -189,7 +185,7 @@ impl<'a, S, R> State<'a, S, R> {
    // assuming x is local and y is remote
    pub(crate) fn prepare_key_material_sig(
        &self,
-        remote_ephemeral_key: &encryption::PublicKey,
+        remote_ephemeral_key: &x25519::PublicKey,
    ) -> Result<MaterialExchange, HandshakeError> {
        let plaintext: Vec<_> = self
            .ephemeral_keypair
@@ -243,7 +239,7 @@ impl<'a, S, R> State<'a, S, R> {
        )?;

        // now verify signature itself
-        let signature = identity::Signature::from_bytes(&decrypted_signature)
+        let signature = ed25519::Signature::from_bytes(&decrypted_signature)
            .map_err(|_| HandshakeError::InvalidSignature)?;

        // g^y || g^x, if y is remote and x is local
@@ -261,7 +257,7 @@ impl<'a, S, R> State<'a, S, R> {
    }

    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn update_remote_identity(&mut self, remote_pubkey: identity::PublicKey) {
+    pub(crate) fn update_remote_identity(&mut self, remote_pubkey: ed25519::PublicKey) {
        self.remote_pubkey = Some(remote_pubkey)
    }

@@ -1,6 +1,6 @@
 use std::fmt;

-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_sphinx::addressing::clients::Recipient;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
@@ -200,7 +200,7 @@ impl fmt::Display for IpPacketRequestData {
 }

 impl IpPacketRequestData {
-    pub fn add_signature(&mut self, signature: identity::Signature) -> Option<identity::Signature> {
+    pub fn add_signature(&mut self, signature: ed25519::Signature) -> Option<ed25519::Signature> {
        match self {
            IpPacketRequestData::StaticConnect(request) => {
                request.signature = Some(signature);
@@ -269,11 +269,11 @@ impl StaticConnectRequest {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct SignedStaticConnectRequest {
    pub request: StaticConnectRequest,
-    pub signature: Option<identity::Signature>,
+    pub signature: Option<ed25519::Signature>,
 }

 impl SignedRequest for SignedStaticConnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
+    fn identity(&self) -> Option<&ed25519::PublicKey> {
        Some(self.request.reply_to.identity())
    }

@@ -286,7 +286,7 @@ impl SignedRequest for SignedStaticConnectRequest {
            })
    }

-    fn signature(&self) -> Option<&identity::Signature> {
+    fn signature(&self) -> Option<&ed25519::Signature> {
        self.signature.as_ref()
    }

@@ -333,11 +333,11 @@ impl DynamicConnectRequest {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct SignedDynamicConnectRequest {
    pub request: DynamicConnectRequest,
-    pub signature: Option<identity::Signature>,
+    pub signature: Option<ed25519::Signature>,
 }

 impl SignedRequest for SignedDynamicConnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
+    fn identity(&self) -> Option<&ed25519::PublicKey> {
        Some(self.request.reply_to.identity())
    }

@@ -350,7 +350,7 @@ impl SignedRequest for SignedDynamicConnectRequest {
            })
    }

-    fn signature(&self) -> Option<&identity::Signature> {
+    fn signature(&self) -> Option<&ed25519::Signature> {
        self.signature.as_ref()
    }

@@ -382,11 +382,11 @@ impl DisconnectRequest {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct SignedDisconnectRequest {
    pub request: DisconnectRequest,
-    pub signature: Option<identity::Signature>,
+    pub signature: Option<ed25519::Signature>,
 }

 impl SignedRequest for SignedDisconnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
+    fn identity(&self) -> Option<&ed25519::PublicKey> {
        Some(self.request.reply_to.identity())
    }

@@ -399,7 +399,7 @@ impl SignedRequest for SignedDisconnectRequest {
            })
    }

-    fn signature(&self) -> Option<&identity::Signature> {
+    fn signature(&self) -> Option<&ed25519::Signature> {
        self.signature.as_ref()
    }

@@ -10,9 +10,6 @@ pub enum MixProcessingError {
    #[error("failed to recover the expected SURB-Ack packet: {0}")]
    MalformedSurbAck(#[from] SurbAckRecoveryError),

-    #[error("the received packet was set to use the very old and very much deprecated 'VPN' mode")]
-    ReceivedOldTypeVpnPacket,
-
    #[error("failed to process received Nym packet: {0}")]
    NymPacketProcessingError(#[from] PacketProcessingError),
 }
@@ -37,32 +37,3 @@ impl TicketTypeRepr {
        }
    }
 }
-
-// Constants for bloom filter for double spending detection
-//Chosen for FP of
-//Calculator at https://hur.st/bloomfilter/
-pub const ECASH_DS_BLOOMFILTER_PARAMS: BloomfilterParameters = BloomfilterParameters {
-    num_hashes: 10,
-    bitmap_size: 1_500_000_000,
-    sip_keys: [
-        (12345678910111213141, 1415926535897932384),
-        (7182818284590452353, 3571113171923293137),
-    ],
-};
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
-pub struct BloomfilterParameters {
-    pub num_hashes: u32,
-    pub bitmap_size: u64,
-    pub sip_keys: [(u64, u64); 2],
-}
-
-impl BloomfilterParameters {
-    pub const fn byte_size(&self) -> u64 {
-        self.bitmap_size / 8
-    }
-
-    pub const fn default_ecash() -> Self {
-        ECASH_DS_BLOOMFILTER_PARAMS
-    }
-}
@@ -3,7 +3,7 @@

 use crate::error::NetworkTestingError;
 use crate::TestMessage;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_sphinx::acknowledgements::identifier::recover_identifier;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::chunking::fragment::FragmentIdentifier;
@@ -31,7 +31,7 @@ impl<T> From<FragmentIdentifier> for Received<T> {
 }

 pub struct TestPacketProcessor<T, R: MessageReceiver = SphinxMessageReceiver> {
-    local_encryption_keypair: Arc<encryption::KeyPair>,
+    local_encryption_keypair: Arc<x25519::KeyPair>,
    ack_key: Arc<AckKey>,

    /// Structure responsible for decrypting and recovering plaintext message from received ciphertexts.
@@ -42,7 +42,7 @@ pub struct TestPacketProcessor<T, R: MessageReceiver = SphinxMessageReceiver> {

 impl<T> TestPacketProcessor<T, SphinxMessageReceiver> {
    pub fn new_sphinx_processor(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        ack_key: Arc<AckKey>,
    ) -> Self {
        Self::new(local_encryption_keypair, ack_key)
@@ -53,7 +53,7 @@ impl<T, R> TestPacketProcessor<T, R>
 where
    R: MessageReceiver,
 {
-    pub fn new(local_encryption_keypair: Arc<encryption::KeyPair>, ack_key: Arc<AckKey>) -> Self {
+    pub fn new(local_encryption_keypair: Arc<x25519::KeyPair>, ack_key: Arc<AckKey>) -> Self {
        TestPacketProcessor {
            local_encryption_keypair,
            ack_key,
@@ -6,7 +6,7 @@ use crate::processor::{Received, TestPacketProcessor};
 use crate::{log_err, log_info, log_warn};
 use futures::channel::mpsc;
 use futures::StreamExt;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::receiver::{MessageReceiver, SphinxMessageReceiver};
 use nym_task::TaskClient;
@@ -29,7 +29,7 @@ pub struct SimpleMessageReceiver<T, R: MessageReceiver = SphinxMessageReceiver>

 impl<T> SimpleMessageReceiver<T, SphinxMessageReceiver> {
    pub fn new_sphinx_receiver(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        ack_key: Arc<AckKey>,
        mixnet_message_receiver: mpsc::UnboundedReceiver<Vec<Vec<u8>>>,
        acks_receiver: mpsc::UnboundedReceiver<Vec<Vec<u8>>>,
@@ -49,7 +49,7 @@ impl<T> SimpleMessageReceiver<T, SphinxMessageReceiver> {

 impl<T, R: MessageReceiver> SimpleMessageReceiver<T, R> {
    pub fn new(
-        local_encryption_keypair: Arc<encryption::KeyPair>,
+        local_encryption_keypair: Arc<x25519::KeyPair>,
        ack_key: Arc<AckKey>,
        mixnet_message_receiver: mpsc::UnboundedReceiver<Vec<Vec<u8>>>,
        acks_receiver: mpsc::UnboundedReceiver<Vec<Vec<u8>>>,
@@ -39,6 +39,10 @@ pub struct NodeTester<R> {
    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
    average_ack_delay: Duration,

+    /// Specify whether any constructed packets should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    use_legacy_sphinx_format: bool,
+
    // while acks are going to be ignored they still need to be constructed
    // so that the gateway would be able to correctly process and forward the message
    ack_key: Arc<AckKey>,
@@ -57,6 +61,7 @@ where
        deterministic_route_selection: bool,
        average_packet_delay: Duration,
        average_ack_delay: Duration,
+        use_legacy_sphinx_format: bool,
        ack_key: Arc<AckKey>,
    ) -> Self {
        Self {
@@ -67,6 +72,7 @@ where
            deterministic_route_selection,
            average_packet_delay,
            average_ack_delay,
+            use_legacy_sphinx_format,
            ack_key,
        }
    }
@@ -245,6 +251,10 @@ where
 impl<R: CryptoRng + Rng> FragmentPreparer for NodeTester<R> {
    type Rng = R;

+    fn use_legacy_sphinx_format(&self) -> bool {
+        self.use_legacy_sphinx_format
+    }
+
    fn deterministic_route_selection(&self) -> bool {
        self.deterministic_route_selection
    }
@@ -363,6 +363,7 @@ impl MetricsController {
        buffer
    }

+    #[inline(always)]
    pub fn to_writer(&self, writer: &mut dyn std::io::Write) {
        let metrics = self.gather();
        match writer.write_all(&metrics) {
@@ -371,6 +372,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn register_int_gauge<'a>(&self, name: &str, help: impl Into<Option<&'a str>>) {
        let Some(metric) = Metric::new_int_gauge(name, help.into().unwrap_or(name)) else {
            return;
@@ -378,6 +380,7 @@ impl MetricsController {
        self.register_metric(metric);
    }

+    #[inline(always)]
    pub fn register_float_gauge<'a>(&self, name: &str, help: impl Into<Option<&'a str>>) {
        let Some(metric) = Metric::new_float_gauge(name, help.into().unwrap_or(name)) else {
            return;
@@ -385,6 +388,7 @@ impl MetricsController {
        self.register_metric(metric);
    }

+    #[inline(always)]
    pub fn register_int_counter<'a>(&self, name: &str, help: impl Into<Option<&'a str>>) {
        let Some(metric) = Metric::new_int_counter(name, help.into().unwrap_or(name)) else {
            return;
@@ -392,6 +396,7 @@ impl MetricsController {
        self.register_metric(metric);
    }

+    #[inline(always)]
    pub fn register_histogram<'a>(
        &self,
        name: &str,
@@ -404,6 +409,7 @@ impl MetricsController {
        self.register_metric(metric);
    }

+    #[inline(always)]
    pub fn set(&self, name: &str, value: i64) -> bool {
        if let Some(metric) = self.registry_index.get(name) {
            metric.set(value);
@@ -413,6 +419,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn set_float(&self, name: &str, value: f64) -> bool {
        if let Some(metric) = self.registry_index.get(name) {
            metric.set_float(value);
@@ -422,6 +429,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn add_to_histogram(&self, name: &str, value: f64) -> bool {
        if let Some(metric) = self.registry_index.get(name) {
            metric.add_histogram_observation(value);
@@ -431,12 +439,14 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn start_timer(&self, name: &str) -> Option<HistogramTimer> {
        self.registry_index
            .get(name)
            .and_then(|metric| metric.start_timer())
    }

+    #[inline(always)]
    pub fn inc(&self, name: &str) -> bool {
        if let Some(metric) = self.registry_index.get(name) {
            metric.inc();
@@ -446,6 +456,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn inc_by(&self, name: &str, value: i64) -> bool {
        if let Some(metric) = self.registry_index.get(name) {
            metric.inc_by(value);
@@ -455,6 +466,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn maybe_register_and_set<'a>(
        &self,
        name: &str,
@@ -468,6 +480,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn maybe_register_and_set_float<'a>(
        &self,
        name: &str,
@@ -481,6 +494,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn maybe_register_and_add_to_histogram<'a>(
        &self,
        name: &str,
@@ -495,6 +509,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn maybe_register_and_inc<'a>(&self, name: &str, help: impl Into<Option<&'a str>>) {
        if !self.inc(name) {
            let help = help.into();
@@ -503,6 +518,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn maybe_register_and_inc_by<'a>(
        &self,
        name: &str,
@@ -516,6 +532,7 @@ impl MetricsController {
        }
    }

+    #[inline(always)]
    pub fn register_metric(&self, metric: impl Into<Metric>) {
        let m = metric.into();
        let fq_name = m.fq_name();
@@ -37,8 +37,10 @@ pub enum SurbAckRecoveryError {
 }

 impl SurbAck {
+    #[allow(clippy::too_many_arguments)]
    pub fn construct<R>(
        rng: &mut R,
+        use_legacy_sphinx_format: bool,
        recipient: &Recipient,
        ack_key: &AckKey,
        marshaled_fragment_id: [u8; 5],
@@ -57,8 +59,6 @@ impl SurbAck {
        let packet_size = match packet_type {
            PacketType::Outfox => surb_ack_payload.len().max(MIN_PACKET_SIZE),
            PacketType::Mix => PacketSize::AckPacket.payload_size(),
-            #[allow(deprecated)]
-            PacketType::Vpn => PacketSize::AckPacket.payload_size(),
        };

        let surb_ack_packet = match packet_type {
@@ -69,14 +69,7 @@ impl SurbAck {
                Some(packet_size),
            )?,
            PacketType::Mix => NymPacket::sphinx_build(
-                packet_size,
-                surb_ack_payload,
-                &route,
-                &destination,
-                &delays,
-            )?,
-            #[allow(deprecated)]
-            PacketType::Vpn => NymPacket::sphinx_build(
+                use_legacy_sphinx_format,
                packet_size,
                surb_ack_payload,
                &route,
@@ -106,8 +99,6 @@ impl SurbAck {
                PacketSize::OutfoxAckPacket.size() + MAX_NODE_ADDRESS_UNPADDED_LEN
            }
            PacketType::Mix => PacketSize::AckPacket.size() + MAX_NODE_ADDRESS_UNPADDED_LEN,
-            #[allow(deprecated)]
-            PacketType::Vpn => PacketSize::AckPacket.size() + MAX_NODE_ADDRESS_UNPADDED_LEN,
        }
    }

@@ -139,8 +130,6 @@ impl SurbAck {
        let packet = match packet_type {
            PacketType::Outfox => NymPacket::outfox_from_bytes(&b[address_offset..])?,
            PacketType::Mix => NymPacket::sphinx_from_bytes(&b[address_offset..])?,
-            #[allow(deprecated)]
-            PacketType::Vpn => NymPacket::sphinx_from_bytes(&b[address_offset..])?,
        };

        Ok((address, packet))
@@ -5,7 +5,7 @@
 // it's already destructed).

 use crate::nodes::{NodeIdentity, NODE_IDENTITY_SIZE};
-use nym_crypto::asymmetric::{encryption, identity};
+use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_sphinx_types::Destination;
 use serde::de::{Error as SerdeError, Unexpected, Visitor};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
@@ -15,11 +15,11 @@ use thiserror::Error;

 // Not entirely sure whether this is the correct place for those, but let's see how it's going
 // to work out
-pub type ClientEncryptionKey = encryption::PublicKey;
-const CLIENT_ENCRYPTION_KEY_SIZE: usize = encryption::PUBLIC_KEY_SIZE;
+pub type ClientEncryptionKey = x25519::PublicKey;
+const CLIENT_ENCRYPTION_KEY_SIZE: usize = x25519::PUBLIC_KEY_SIZE;

-pub type ClientIdentity = identity::PublicKey;
-const CLIENT_IDENTITY_SIZE: usize = identity::PUBLIC_KEY_LENGTH;
+pub type ClientIdentity = ed25519::PublicKey;
+const CLIENT_IDENTITY_SIZE: usize = ed25519::PUBLIC_KEY_LENGTH;

 pub type RecipientBytes = [u8; Recipient::LEN];

@@ -29,13 +29,13 @@ pub enum RecipientFormattingError {
    MalformedRecipientError { reason: String },

    #[error("recipient's identity key is malformed: {0}")]
-    MalformedIdentityError(identity::Ed25519RecoveryError),
+    MalformedIdentityError(ed25519::Ed25519RecoveryError),

    #[error("recipient's encryption key is malformed: {0}")]
-    MalformedEncryptionKeyError(#[from] encryption::KeyRecoveryError),
+    MalformedEncryptionKeyError(#[from] x25519::KeyRecoveryError),

    #[error("recipient gateway's identity key is malformed: {0}")]
-    MalformedGatewayError(identity::Ed25519RecoveryError),
+    MalformedGatewayError(ed25519::Ed25519RecoveryError),
 }

 // TODO: this should a different home... somewhere, but where?
@@ -249,9 +249,9 @@ mod tests {
    fn string_conversion_works() {
        let mut rng = rand::thread_rng();

-        let client_id_pair = identity::KeyPair::new(&mut rng);
-        let client_enc_pair = encryption::KeyPair::new(&mut rng);
-        let gateway_id_pair = identity::KeyPair::new(&mut rng);
+        let client_id_pair = ed25519::KeyPair::new(&mut rng);
+        let client_enc_pair = x25519::KeyPair::new(&mut rng);
+        let gateway_id_pair = ed25519::KeyPair::new(&mut rng);

        let recipient = Recipient::new(
            *client_id_pair.public_key(),
@@ -281,9 +281,9 @@ mod tests {
    fn bytes_conversion_works() {
        let mut rng = rand::thread_rng();

-        let client_id_pair = identity::KeyPair::new(&mut rng);
-        let client_enc_pair = encryption::KeyPair::new(&mut rng);
-        let gateway_id_pair = identity::KeyPair::new(&mut rng);
+        let client_id_pair = ed25519::KeyPair::new(&mut rng);
+        let client_enc_pair = x25519::KeyPair::new(&mut rng);
+        let gateway_id_pair = ed25519::KeyPair::new(&mut rng);

        let recipient = Recipient::new(
            *client_id_pair.public_key(),
@@ -8,7 +8,7 @@
 //! Currently, that routing information is an IP address, but in principle it can be anything
 //!  for as long as it's going to fit in the field.

-use nym_crypto::asymmetric::identity;
+use nym_crypto::asymmetric::ed25519;
 use nym_sphinx_types::{NodeAddressBytes, NODE_ADDRESS_LENGTH};

 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
@@ -16,8 +16,8 @@ use thiserror::Error;

 // Not entirely sure whether this is the correct place for those, but let's see how it's going
 // to work out
-pub type NodeIdentity = identity::PublicKey;
-pub const NODE_IDENTITY_SIZE: usize = identity::PUBLIC_KEY_LENGTH;
+pub type NodeIdentity = ed25519::PublicKey;
+pub const NODE_IDENTITY_SIZE: usize = ed25519::PUBLIC_KEY_LENGTH;

 /// MAX_UNPADDED_LEN represents maximum length an unpadded address could have.
 /// In this case it's an ipv6 socket address (with version prefix)
@@ -199,7 +199,7 @@ impl TryFrom<NodeAddressBytes> for NymNodeRoutingAddress {
    type Error = NymNodeRoutingAddressError;

    fn try_from(value: NodeAddressBytes) -> Result<Self, Self::Error> {
-        Self::try_from_bytes(value.as_bytes_ref())
+        Self::try_from_bytes(value.as_bytes())
    }
 }

@@ -12,6 +12,7 @@ rand = { workspace = true }
 bs58 = { workspace = true }
 serde = { workspace = true }
 thiserror = { workspace = true }
+tracing = { workspace = true }

 nym-crypto = { path = "../../crypto", features = ["stream_cipher", "rand"] }
 nym-sphinx-addressing = { path = "../addressing" }
@@ -1,20 +1,25 @@
-// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::encryption_key::{SurbEncryptionKey, SurbEncryptionKeyError, SurbEncryptionKeySize};
 use nym_crypto::{generic_array::typenum::Unsigned, Digest};
 use nym_sphinx_addressing::clients::Recipient;
-use nym_sphinx_addressing::nodes::{NymNodeRoutingAddress, MAX_NODE_ADDRESS_UNPADDED_LEN};
+use nym_sphinx_addressing::nodes::{
+    NymNodeRoutingAddress, NymNodeRoutingAddressError, MAX_NODE_ADDRESS_UNPADDED_LEN,
+};
 use nym_sphinx_params::packet_sizes::PacketSize;
 use nym_sphinx_params::{PacketType, ReplySurbKeyDigestAlgorithm};
-use nym_sphinx_types::{NymPacket, SURBMaterial, SphinxError, SURB};
+use nym_sphinx_types::constants::PAYLOAD_KEY_SEED_SIZE;
+use nym_sphinx_types::{
+    NymPacket, SURBMaterial, SphinxError, HEADER_SIZE, NODE_ADDRESS_LENGTH, SURB,
+    X25519_WITH_EXPLICIT_PAYLOAD_KEYS_VERSION,
+};
 use nym_topology::{NymRouteProvider, NymTopologyError};
 use rand::{CryptoRng, RngCore};
 use serde::de::{Error as SerdeError, Visitor};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
-
 use std::fmt::{self, Formatter};
-use std::time;
+use std::time::Duration;
 use thiserror::Error;

 #[derive(Debug, Error)]
@@ -31,6 +36,9 @@ pub enum ReplySurbError {
    #[error("failed to recover reply SURB from bytes: {0}")]
    RecoveryError(#[from] SphinxError),

+    #[error("failed to validate the first hop address of the recovered reply SURB: {0}")]
+    MalformedSurbFirstHop(#[from] NymNodeRoutingAddressError),
+
    #[error("failed to recover reply SURB encryption key from bytes: {0}")]
    InvalidEncryptionKeyData(#[from] SurbEncryptionKeyError),
 }
@@ -80,6 +88,10 @@ impl<'de> Deserialize<'de> for ReplySurb {
 }

 impl ReplySurb {
+    /// base overhead of a reply surb that exists regardless of type or number of key materials.
+    pub(crate) const BASE_OVERHEAD: usize =
+        SurbEncryptionKeySize::USIZE + HEADER_SIZE + NODE_ADDRESS_LENGTH;
+
    pub fn max_msg_len(packet_size: PacketSize) -> usize {
        // For detailed explanation (of ack overhead) refer to common\nymsphinx\src\preparer.rs::available_plaintext_per_packet()
        let ack_overhead = MAX_NODE_ADDRESS_UNPADDED_LEN + PacketSize::AckPacket.size();
@@ -91,7 +103,8 @@ impl ReplySurb {
    pub fn construct<R>(
        rng: &mut R,
        recipient: &Recipient,
-        average_delay: time::Duration,
+        average_delay: Duration,
+        use_legacy_surb_format: bool,
        topology: &NymRouteProvider,
    ) -> Result<Self, NymTopologyError>
    where
@@ -101,7 +114,10 @@ impl ReplySurb {
        let delays = nym_sphinx_routing::generate_hop_delays(average_delay, route.len());
        let destination = recipient.as_sphinx_destination();

-        let surb_material = SURBMaterial::new(route, delays, destination);
+        let mut surb_material = SURBMaterial::new(route, delays, destination);
+        if use_legacy_surb_format {
+            surb_material = surb_material.with_version(X25519_WITH_EXPLICIT_PAYLOAD_KEYS_VERSION)
+        }

        // this can't fail as we know we have a valid route to gateway and have correct number of delays
        Ok(ReplySurb {
@@ -110,14 +126,10 @@ impl ReplySurb {
        })
    }

-    /// Returns the expected number of bytes the [`ReplySURB`] will take after serialization.
+    /// Returns the expected number of bytes the [`ReplySURB`] will take after serialization using the new encoding format.
    /// Useful for deserialization from a bytes stream.
-    pub fn serialized_len() -> usize {
-        use nym_sphinx_types::{HEADER_SIZE, NODE_ADDRESS_LENGTH, PAYLOAD_KEY_SIZE};
-
-        // the SURB itself consists of SURB_header, first hop address and set of payload keys
-        // for each hop (3x mix + egress)
-        SurbEncryptionKeySize::USIZE + HEADER_SIZE + NODE_ADDRESS_LENGTH + 4 * PAYLOAD_KEY_SIZE
+    pub fn v2_serialised_len(num_hops: u8) -> usize {
+        Self::BASE_OVERHEAD + num_hops as usize * PAYLOAD_KEY_SEED_SIZE
    }

    pub fn encryption_key(&self) -> &SurbEncryptionKey {
@@ -143,7 +155,12 @@ impl ReplySurb {

        let surb = match SURB::from_bytes(&bytes[SurbEncryptionKeySize::USIZE..]) {
            Err(err) => return Err(ReplySurbError::RecoveryError(err)),
-            Ok(surb) => surb,
+            Ok(surb) => {
+                // we can't really check fully validity of the header, but at the very least we could make a sanity check
+                // to make sure the first hop address is a valid socket address
+                let _ = NymNodeRoutingAddress::try_from(surb.first_hop())?;
+                surb
+            }
        };

        Ok(ReplySurb {
@@ -8,9 +8,15 @@ use std::fmt::{Display, Formatter};
 use std::mem;
 use thiserror::Error;

+use crate::requests::v1::{AdditionalSurbsV1, DataV1, HeartbeatV1};
+use crate::requests::v2::{AdditionalSurbsV2, DataV2, HeartbeatV2};
+
 #[cfg(target_arch = "wasm32")]
 use wasm_bindgen::prelude::*;

+pub(crate) mod v1;
+pub(crate) mod v2;
+
 pub const SENDER_TAG_SIZE: usize = 16;

 #[derive(Debug, Error)]
@@ -103,31 +109,23 @@ pub struct RepliableMessage {
 impl Display for RepliableMessage {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match &self.content {
-            RepliableMessageContent::Data {
-                message,
-                reply_surbs,
-            } => write!(
-                f,
-                "repliable {:.2} kiB data message with {} reply surbs attached from {}",
-                message.len() as f64 / 1024.0,
-                reply_surbs.len(),
-                self.sender_tag,
-            ),
-            RepliableMessageContent::AdditionalSurbs { reply_surbs } => write!(
-                f,
-                "repliable additional surbs message ({} reply surbs attached) from {}",
-                reply_surbs.len(),
-                self.sender_tag,
-            ),
-            RepliableMessageContent::Heartbeat {
-                additional_reply_surbs,
-            } => {
-                write!(
-                    f,
-                    "repliable heartbeat message ({} reply surbs attached) from {}",
-                    additional_reply_surbs.len(),
-                    self.sender_tag,
-                )
+            RepliableMessageContent::Data(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
+            }
+            RepliableMessageContent::AdditionalSurbs(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
+            }
+            RepliableMessageContent::Heartbeat(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
+            }
+            RepliableMessageContent::DataV2(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
+            }
+            RepliableMessageContent::AdditionalSurbsV2(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
+            }
+            RepliableMessageContent::HeartbeatV2(content) => {
+                write!(f, "{content} from {}", self.sender_tag)
            }
        }
    }
@@ -135,26 +133,43 @@ impl Display for RepliableMessage {

 impl RepliableMessage {
    pub fn new_data(
+        use_legacy_surb_format: bool,
        data: Vec<u8>,
        sender_tag: AnonymousSenderTag,
        reply_surbs: Vec<ReplySurb>,
    ) -> Self {
-        RepliableMessage {
-            sender_tag,
-            content: RepliableMessageContent::Data {
+        let content = if use_legacy_surb_format {
+            RepliableMessageContent::Data(DataV1 {
                message: data,
                reply_surbs,
-            },
+            })
+        } else {
+            RepliableMessageContent::DataV2(DataV2 {
+                message: data,
+                reply_surbs,
+            })
+        };
+
+        RepliableMessage {
+            sender_tag,
+            content,
        }
    }

    pub fn new_additional_surbs(
+        use_legacy_surb_format: bool,
        sender_tag: AnonymousSenderTag,
        reply_surbs: Vec<ReplySurb>,
    ) -> Self {
+        let content = if use_legacy_surb_format {
+            RepliableMessageContent::AdditionalSurbs(AdditionalSurbsV1 { reply_surbs })
+        } else {
+            RepliableMessageContent::AdditionalSurbsV2(AdditionalSurbsV2 { reply_surbs })
+        };
+
        RepliableMessage {
            sender_tag,
-            content: RepliableMessageContent::AdditionalSurbs { reply_surbs },
+            content,
        }
    }

@@ -192,35 +207,18 @@ impl RepliableMessage {
    }
 }

-// this recovery code is shared between all variants containing reply surbs
-fn recover_reply_surbs(bytes: &[u8]) -> Result<(Vec<ReplySurb>, usize), InvalidReplyRequestError> {
-    let mut consumed = mem::size_of::<u32>();
-    if bytes.len() < consumed {
-        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
-    }
-    let num_surbs = u32::from_be_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]);
-    let surb_size = ReplySurb::serialized_len();
-    if bytes[consumed..].len() < num_surbs as usize * surb_size {
-        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
-    }
-
-    let mut reply_surbs = Vec::with_capacity(num_surbs as usize);
-    for _ in 0..num_surbs as usize {
-        let surb_bytes = &bytes[consumed..consumed + surb_size];
-        let reply_surb = ReplySurb::from_bytes(surb_bytes)?;
-        reply_surbs.push(reply_surb);
-
-        consumed += surb_size;
-    }
-
-    Ok((reply_surbs, consumed))
-}
-
+#[derive(Debug)]
 #[repr(u8)]
 enum RepliableMessageContentTag {
    Data = 0,
    AdditionalSurbs = 1,
    Heartbeat = 2,
+
+    // updated variants that slightly change SURB encoding
+    // to allow for variable number of hops as well as using payload key seeds
+    DataV2 = 3,
+    AdditionalSurbsV2 = 4,
+    HeartbeatV2 = 5,
 }

 impl TryFrom<u8> for RepliableMessageContentTag {
@@ -233,6 +231,11 @@ impl TryFrom<u8> for RepliableMessageContentTag {
                Ok(Self::AdditionalSurbs)
            }
            _ if value == (RepliableMessageContentTag::Heartbeat as u8) => Ok(Self::Heartbeat),
+            _ if value == (RepliableMessageContentTag::DataV2 as u8) => Ok(Self::DataV2),
+            _ if value == (RepliableMessageContentTag::AdditionalSurbsV2 as u8) => {
+                Ok(Self::AdditionalSurbsV2)
+            }
+            _ if value == (RepliableMessageContentTag::HeartbeatV2 as u8) => Ok(Self::HeartbeatV2),
            val => Err(InvalidReplyRequestError::InvalidRepliableContentTag { received: val }),
        }
    }
@@ -241,58 +244,24 @@ impl TryFrom<u8> for RepliableMessageContentTag {
 // sent by original sender that initialised the communication that knows address of the remote
 #[derive(Debug)]
 pub enum RepliableMessageContent {
-    Data {
-        message: Vec<u8>,
-        reply_surbs: Vec<ReplySurb>,
-    },
-    AdditionalSurbs {
-        reply_surbs: Vec<ReplySurb>,
-    },
-    Heartbeat {
-        additional_reply_surbs: Vec<ReplySurb>,
-    },
+    Data(DataV1),
+    AdditionalSurbs(AdditionalSurbsV1),
+    Heartbeat(HeartbeatV1),
+
+    DataV2(DataV2),
+    AdditionalSurbsV2(AdditionalSurbsV2),
+    HeartbeatV2(HeartbeatV2),
 }

 impl RepliableMessageContent {
    pub fn into_bytes(self) -> Vec<u8> {
        match self {
-            RepliableMessageContent::Data {
-                message,
-                reply_surbs,
-            } => {
-                let num_surbs = reply_surbs.len() as u32;
-
-                num_surbs
-                    .to_be_bytes()
-                    .into_iter()
-                    .chain(reply_surbs.into_iter().flat_map(|s| s.to_bytes()))
-                    .chain(message)
-                    .collect()
-            }
-            RepliableMessageContent::AdditionalSurbs { reply_surbs } => {
-                let num_surbs = reply_surbs.len() as u32;
-
-                num_surbs
-                    .to_be_bytes()
-                    .into_iter()
-                    .chain(reply_surbs.into_iter().flat_map(|s| s.to_bytes()))
-                    .collect()
-            }
-            RepliableMessageContent::Heartbeat {
-                additional_reply_surbs,
-            } => {
-                let num_surbs = additional_reply_surbs.len() as u32;
-
-                num_surbs
-                    .to_be_bytes()
-                    .into_iter()
-                    .chain(
-                        additional_reply_surbs
-                            .into_iter()
-                            .flat_map(|s| s.to_bytes()),
-                    )
-                    .collect()
-            }
+            RepliableMessageContent::Data(content) => content.into_bytes(),
+            RepliableMessageContent::AdditionalSurbs(content) => content.into_bytes(),
+            RepliableMessageContent::Heartbeat(content) => content.into_bytes(),
+            RepliableMessageContent::DataV2(content) => content.into_bytes(),
+            RepliableMessageContent::AdditionalSurbsV2(content) => content.into_bytes(),
+            RepliableMessageContent::HeartbeatV2(content) => content.into_bytes(),
        }
    }

@@ -304,19 +273,25 @@ impl RepliableMessageContent {
            return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
        }

-        let (reply_surbs, n) = recover_reply_surbs(bytes)?;
-
        match tag {
-            RepliableMessageContentTag::Data => Ok(RepliableMessageContent::Data {
-                message: bytes[n..].to_vec(),
-                reply_surbs,
-            }),
-            RepliableMessageContentTag::AdditionalSurbs => {
-                Ok(RepliableMessageContent::AdditionalSurbs { reply_surbs })
+            RepliableMessageContentTag::Data => {
+                Ok(RepliableMessageContent::Data(DataV1::from_bytes(bytes)?))
            }
-            RepliableMessageContentTag::Heartbeat => Ok(RepliableMessageContent::Heartbeat {
-                additional_reply_surbs: reply_surbs,
-            }),
+            RepliableMessageContentTag::AdditionalSurbs => Ok(
+                RepliableMessageContent::AdditionalSurbs(AdditionalSurbsV1::from_bytes(bytes)?),
+            ),
+            RepliableMessageContentTag::Heartbeat => Ok(RepliableMessageContent::Heartbeat(
+                HeartbeatV1::from_bytes(bytes)?,
+            )),
+            RepliableMessageContentTag::DataV2 => {
+                Ok(RepliableMessageContent::DataV2(DataV2::from_bytes(bytes)?))
+            }
+            RepliableMessageContentTag::AdditionalSurbsV2 => Ok(
+                RepliableMessageContent::AdditionalSurbsV2(AdditionalSurbsV2::from_bytes(bytes)?),
+            ),
+            RepliableMessageContentTag::HeartbeatV2 => Ok(RepliableMessageContent::HeartbeatV2(
+                HeartbeatV2::from_bytes(bytes)?,
+            )),
        }
    }

@@ -327,30 +302,22 @@ impl RepliableMessageContent {
                RepliableMessageContentTag::AdditionalSurbs
            }
            RepliableMessageContent::Heartbeat { .. } => RepliableMessageContentTag::Heartbeat,
+            RepliableMessageContent::DataV2(_) => RepliableMessageContentTag::DataV2,
+            RepliableMessageContent::AdditionalSurbsV2(_) => {
+                RepliableMessageContentTag::AdditionalSurbsV2
+            }
+            RepliableMessageContent::HeartbeatV2(_) => RepliableMessageContentTag::HeartbeatV2,
        }
    }

    fn serialized_size(&self) -> usize {
        match self {
-            RepliableMessageContent::Data {
-                message,
-                reply_surbs,
-            } => {
-                let num_reply_surbs_tag = mem::size_of::<u32>();
-                num_reply_surbs_tag
-                    + reply_surbs.len() * ReplySurb::serialized_len()
-                    + message.len()
-            }
-            RepliableMessageContent::AdditionalSurbs { reply_surbs } => {
-                let num_reply_surbs_tag = mem::size_of::<u32>();
-                num_reply_surbs_tag + reply_surbs.len() * ReplySurb::serialized_len()
-            }
-            RepliableMessageContent::Heartbeat {
-                additional_reply_surbs,
-            } => {
-                let num_reply_surbs_tag = mem::size_of::<u32>();
-                num_reply_surbs_tag + additional_reply_surbs.len() * ReplySurb::serialized_len()
-            }
+            RepliableMessageContent::Data(content) => content.serialized_len(),
+            RepliableMessageContent::AdditionalSurbs(content) => content.serialized_len(),
+            RepliableMessageContent::Heartbeat(content) => content.serialized_len(),
+            RepliableMessageContent::DataV2(content) => content.serialized_len(),
+            RepliableMessageContent::AdditionalSurbsV2(content) => content.serialized_len(),
+            RepliableMessageContent::HeartbeatV2(content) => content.serialized_len(),
        }
    }
 }
@@ -514,18 +481,22 @@ mod tests {
    use super::*;

    mod fixtures {
+        use crate::requests::v1::{AdditionalSurbsV1, DataV1, HeartbeatV1};
+        use crate::requests::v2::{AdditionalSurbsV2, DataV2, HeartbeatV2};
        use crate::requests::{AnonymousSenderTag, RepliableMessageContent, ReplyMessageContent};
        use crate::{ReplySurb, SurbEncryptionKey};
-        use nym_crypto::asymmetric::{encryption, identity};
+        use nym_crypto::asymmetric::{ed25519, x25519};
        use nym_sphinx_addressing::clients::Recipient;
        use nym_sphinx_types::{
            Delay, Destination, DestinationAddressBytes, Node, NodeAddressBytes, PrivateKey,
-            SURBMaterial, NODE_ADDRESS_LENGTH,
+            SURBMaterial, NODE_ADDRESS_LENGTH, X25519_WITH_EXPLICIT_PAYLOAD_KEYS_VERSION,
        };
        use rand::{Rng, RngCore};
        use rand_chacha::rand_core::SeedableRng;
        use rand_chacha::ChaCha20Rng;

+        pub(crate) const LEGACY_HOPS: u8 = 4;
+
        pub(super) fn test_rng() -> ChaCha20Rng {
            let dummy_seed = [42u8; 32];
            ChaCha20Rng::from_seed(dummy_seed)
@@ -544,9 +515,9 @@ mod tests {
        }

        pub(super) fn recipient(rng: &mut ChaCha20Rng) -> Recipient {
-            let client_id = identity::KeyPair::new(rng);
-            let client_enc = encryption::KeyPair::new(rng);
-            let gateway_id = identity::KeyPair::new(rng);
+            let client_id = ed25519::KeyPair::new(rng);
+            let client_enc = x25519::KeyPair::new(rng);
+            let gateway_id = ed25519::KeyPair::new(rng);

            Recipient::new(
                *client_id.public_key(),
@@ -567,11 +538,9 @@ mod tests {
            }
        }

-        pub(super) fn reply_surb(rng: &mut ChaCha20Rng) -> ReplySurb {
-            // due to gateway
-            const HOPS: u8 = 4;
-            let route = (0..HOPS).map(|_| node(rng)).collect();
-            let delays = (0..HOPS)
+        pub(super) fn reply_surb(rng: &mut ChaCha20Rng, legacy: bool, hops: u8) -> ReplySurb {
+            let route = (0..hops).map(|_| node(rng)).collect();
+            let delays = (0..hops)
                .map(|_| Delay::new_from_nanos(rng.next_u64()))
                .collect();
            let mut destination_bytes = [0u8; 32];
@@ -585,50 +554,58 @@ mod tests {
                identifier_bytes,
            );

-            let surb = SURBMaterial::new(route, delays, destination)
-                .construct_SURB()
-                .unwrap();
+            let mut surb_material = SURBMaterial::new(route, delays, destination);
+            if legacy {
+                surb_material =
+                    surb_material.with_version(X25519_WITH_EXPLICIT_PAYLOAD_KEYS_VERSION);
+            }
+
            ReplySurb {
-                surb,
+                surb: surb_material.construct_SURB().unwrap(),
                encryption_key: SurbEncryptionKey::new(rng),
            }
        }

-        pub(super) fn reply_surbs(rng: &mut ChaCha20Rng, n: usize) -> Vec<ReplySurb> {
+        pub(super) fn reply_surbs(
+            rng: &mut ChaCha20Rng,
+            n: usize,
+            legacy: bool,
+            hops: u8,
+        ) -> Vec<ReplySurb> {
            let mut surbs = Vec::with_capacity(n);
            for _ in 0..n {
-                surbs.push(reply_surb(rng))
+                surbs.push(reply_surb(rng, legacy, hops))
            }
            surbs
        }

-        pub(super) fn repliable_content_data(
+        pub(super) fn repliable_content_data_v1(
            rng: &mut ChaCha20Rng,
            msg_len: usize,
            surbs: usize,
        ) -> RepliableMessageContent {
-            RepliableMessageContent::Data {
+            RepliableMessageContent::Data(DataV1 {
                message: random_vec_u8(rng, msg_len),
-                reply_surbs: reply_surbs(rng, surbs),
-            }
+                reply_surbs: reply_surbs(rng, surbs, true, LEGACY_HOPS),
+            })
        }

-        pub(super) fn repliable_content_surbs(
+        pub(super) fn repliable_content_surbs_v1(
            rng: &mut ChaCha20Rng,
            surbs: usize,
        ) -> RepliableMessageContent {
-            RepliableMessageContent::AdditionalSurbs {
-                reply_surbs: reply_surbs(rng, surbs),
-            }
+            RepliableMessageContent::AdditionalSurbs(AdditionalSurbsV1 {
+                reply_surbs: reply_surbs(rng, surbs, true, LEGACY_HOPS),
+            })
        }

-        pub(super) fn repliable_content_heartbeat(
+        pub(super) fn repliable_content_heartbeat_v1(
            rng: &mut ChaCha20Rng,
            surbs: usize,
        ) -> RepliableMessageContent {
-            RepliableMessageContent::Heartbeat {
-                additional_reply_surbs: reply_surbs(rng, surbs),
-            }
+            RepliableMessageContent::Heartbeat(HeartbeatV1 {
+                additional_reply_surbs: reply_surbs(rng, surbs, true, LEGACY_HOPS),
+            })
        }

        pub(super) fn reply_content_data(
@@ -649,37 +626,70 @@ mod tests {
                amount: surbs,
            }
        }
+
+        pub(super) fn repliable_content_data_v2(
+            rng: &mut ChaCha20Rng,
+            msg_len: usize,
+            surbs: usize,
+            surb_hops: u8,
+        ) -> RepliableMessageContent {
+            RepliableMessageContent::DataV2(DataV2 {
+                message: random_vec_u8(rng, msg_len),
+                reply_surbs: reply_surbs(rng, surbs, false, surb_hops),
+            })
+        }
+
+        pub(super) fn repliable_content_surbs_v2(
+            rng: &mut ChaCha20Rng,
+            surbs: usize,
+            surb_hops: u8,
+        ) -> RepliableMessageContent {
+            RepliableMessageContent::AdditionalSurbsV2(AdditionalSurbsV2 {
+                reply_surbs: reply_surbs(rng, surbs, false, surb_hops),
+            })
+        }
+
+        pub(super) fn repliable_content_heartbeat_v2(
+            rng: &mut ChaCha20Rng,
+            surbs: usize,
+            surb_hops: u8,
+        ) -> RepliableMessageContent {
+            RepliableMessageContent::HeartbeatV2(HeartbeatV2 {
+                additional_reply_surbs: reply_surbs(rng, surbs, false, surb_hops),
+            })
+        }
    }

    #[cfg(test)]
    mod repliable_message {
        use super::*;
+        use crate::requests::tests::fixtures::LEGACY_HOPS;

        #[test]
-        fn serialized_size_matches_actual_serialization() {
+        fn serialized_size_matches_actual_serialization_for_v1_messages() {
            let mut rng = fixtures::test_rng();

            let data1 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_data(&mut rng, 10000, 0),
+                content: fixtures::repliable_content_data_v1(&mut rng, 10000, 0),
            };
            assert_eq!(data1.serialized_size(), data1.into_bytes().len());

            let data2 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_data(&mut rng, 10, 100),
+                content: fixtures::repliable_content_data_v1(&mut rng, 10, 100),
            };
            assert_eq!(data2.serialized_size(), data2.into_bytes().len());

            let data3 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_data(&mut rng, 100000, 1000),
+                content: fixtures::repliable_content_data_v1(&mut rng, 100000, 1000),
            };
            assert_eq!(data3.serialized_size(), data3.into_bytes().len());

            let additional_surbs1 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_surbs(&mut rng, 1),
+                content: fixtures::repliable_content_surbs_v1(&mut rng, 1),
            };
            assert_eq!(
                additional_surbs1.serialized_size(),
@@ -688,7 +698,7 @@ mod tests {

            let additional_surbs2 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_surbs(&mut rng, 1000),
+                content: fixtures::repliable_content_surbs_v1(&mut rng, 1000),
            };
            assert_eq!(
                additional_surbs2.serialized_size(),
@@ -697,53 +707,173 @@ mod tests {

            let heartbeat1 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_heartbeat(&mut rng, 1),
+                content: fixtures::repliable_content_heartbeat_v1(&mut rng, 1),
            };
            assert_eq!(heartbeat1.serialized_size(), heartbeat1.into_bytes().len());

            let heartbeat2 = RepliableMessage {
                sender_tag: fixtures::sender_tag(&mut rng),
-                content: fixtures::repliable_content_heartbeat(&mut rng, 1000),
+                content: fixtures::repliable_content_heartbeat_v1(&mut rng, 1000),
            };
            assert_eq!(heartbeat2.serialized_size(), heartbeat2.into_bytes().len());
        }
+
+        #[test]
+        fn serialized_size_matches_actual_serialization_for_v2_messages() {
+            let mut rng = fixtures::test_rng();
+
+            let data1 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_data_v2(&mut rng, 10000, 0, LEGACY_HOPS),
+            };
+            assert_eq!(data1.serialized_size(), data1.into_bytes().len());
+
+            let data2 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_data_v2(&mut rng, 10, 100, LEGACY_HOPS),
+            };
+            assert_eq!(data2.serialized_size(), data2.into_bytes().len());
+
+            let data3 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_data_v2(&mut rng, 100000, 1000, LEGACY_HOPS),
+            };
+            assert_eq!(data3.serialized_size(), data3.into_bytes().len());
+
+            let data4 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_data_v2(&mut rng, 100000, 1000, 1),
+            };
+            assert_eq!(data4.serialized_size(), data4.into_bytes().len());
+
+            let additional_surbs1 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_surbs_v2(&mut rng, 1, LEGACY_HOPS),
+            };
+            assert_eq!(
+                additional_surbs1.serialized_size(),
+                additional_surbs1.into_bytes().len()
+            );
+
+            let additional_surbs2 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_surbs_v2(&mut rng, 1000, LEGACY_HOPS),
+            };
+            assert_eq!(
+                additional_surbs2.serialized_size(),
+                additional_surbs2.into_bytes().len()
+            );
+
+            let additional_surbs3 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_surbs_v2(&mut rng, 1000, 1),
+            };
+            assert_eq!(
+                additional_surbs3.serialized_size(),
+                additional_surbs3.into_bytes().len()
+            );
+
+            let heartbeat1 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_heartbeat_v2(&mut rng, 1, LEGACY_HOPS),
+            };
+            assert_eq!(heartbeat1.serialized_size(), heartbeat1.into_bytes().len());
+
+            let heartbeat2 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_heartbeat_v2(&mut rng, 1000, LEGACY_HOPS),
+            };
+            assert_eq!(heartbeat2.serialized_size(), heartbeat2.into_bytes().len());
+
+            let heartbeat3 = RepliableMessage {
+                sender_tag: fixtures::sender_tag(&mut rng),
+                content: fixtures::repliable_content_heartbeat_v2(&mut rng, 1000, 1),
+            };
+            assert_eq!(heartbeat3.serialized_size(), heartbeat3.into_bytes().len());
+        }
    }

    #[cfg(test)]
    mod repliable_message_content {
        use super::*;
+        use crate::requests::tests::fixtures::LEGACY_HOPS;

        #[test]
-        fn serialized_size_matches_actual_serialization() {
+        fn serialized_size_matches_actual_serialization_for_v1_messages() {
            let mut rng = fixtures::test_rng();

-            let data1 = fixtures::repliable_content_data(&mut rng, 10000, 0);
+            let data1 = fixtures::repliable_content_data_v1(&mut rng, 10000, 0);
            assert_eq!(data1.serialized_size(), data1.into_bytes().len());

-            let data2 = fixtures::repliable_content_data(&mut rng, 10, 100);
+            let data2 = fixtures::repliable_content_data_v1(&mut rng, 10, 100);
            assert_eq!(data2.serialized_size(), data2.into_bytes().len());

-            let data3 = fixtures::repliable_content_data(&mut rng, 100000, 1000);
+            let data3 = fixtures::repliable_content_data_v1(&mut rng, 100000, 1000);
            assert_eq!(data3.serialized_size(), data3.into_bytes().len());

-            let additional_surbs1 = fixtures::repliable_content_surbs(&mut rng, 1);
+            let additional_surbs1 = fixtures::repliable_content_surbs_v1(&mut rng, 1);
            assert_eq!(
                additional_surbs1.serialized_size(),
                additional_surbs1.into_bytes().len()
            );

-            let additional_surbs2 = fixtures::repliable_content_surbs(&mut rng, 1000);
+            let additional_surbs2 = fixtures::repliable_content_surbs_v1(&mut rng, 1000);
            assert_eq!(
                additional_surbs2.serialized_size(),
                additional_surbs2.into_bytes().len()
            );

-            let heartbeat1 = fixtures::repliable_content_heartbeat(&mut rng, 1);
+            let heartbeat1 = fixtures::repliable_content_heartbeat_v1(&mut rng, 1);
            assert_eq!(heartbeat1.serialized_size(), heartbeat1.into_bytes().len());

-            let heartbeat2 = fixtures::repliable_content_heartbeat(&mut rng, 1000);
+            let heartbeat2 = fixtures::repliable_content_heartbeat_v1(&mut rng, 1000);
            assert_eq!(heartbeat2.serialized_size(), heartbeat2.into_bytes().len());
        }
+
+        #[test]
+        fn serialized_size_matches_actual_serialization_for_v2_messages() {
+            let mut rng = fixtures::test_rng();
+
+            let data1 = fixtures::repliable_content_data_v2(&mut rng, 10000, 0, LEGACY_HOPS);
+            assert_eq!(data1.serialized_size(), data1.into_bytes().len());
+
+            let data2 = fixtures::repliable_content_data_v2(&mut rng, 10, 100, LEGACY_HOPS);
+            assert_eq!(data2.serialized_size(), data2.into_bytes().len());
+
+            let data3 = fixtures::repliable_content_data_v2(&mut rng, 100000, 1000, LEGACY_HOPS);
+            assert_eq!(data3.serialized_size(), data3.into_bytes().len());
+
+            let data4 = fixtures::repliable_content_data_v2(&mut rng, 100000, 1000, 1);
+            assert_eq!(data4.serialized_size(), data4.into_bytes().len());
+
+            let additional_surbs1 = fixtures::repliable_content_surbs_v2(&mut rng, 1, LEGACY_HOPS);
+            assert_eq!(
+                additional_surbs1.serialized_size(),
+                additional_surbs1.into_bytes().len()
+            );
+
+            let additional_surbs2 =
+                fixtures::repliable_content_surbs_v2(&mut rng, 1000, LEGACY_HOPS);
+            assert_eq!(
+                additional_surbs2.serialized_size(),
+                additional_surbs2.into_bytes().len()
+            );
+
+            let additional_surbs3 = fixtures::repliable_content_surbs_v2(&mut rng, 1000, 1);
+            assert_eq!(
+                additional_surbs3.serialized_size(),
+                additional_surbs3.into_bytes().len()
+            );
+
+            let heartbeat1 = fixtures::repliable_content_heartbeat_v2(&mut rng, 1, LEGACY_HOPS);
+            assert_eq!(heartbeat1.serialized_size(), heartbeat1.into_bytes().len());
+
+            let heartbeat2 = fixtures::repliable_content_heartbeat_v2(&mut rng, 1000, LEGACY_HOPS);
+            assert_eq!(heartbeat2.serialized_size(), heartbeat2.into_bytes().len());
+
+            let heartbeat3 = fixtures::repliable_content_heartbeat_v2(&mut rng, 1000, 1);
+            assert_eq!(heartbeat3.serialized_size(), heartbeat3.into_bytes().len());
+        }
    }

    #[cfg(test)]
@@ -0,0 +1,176 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::requests::InvalidReplyRequestError;
+use crate::ReplySurb;
+use nym_sphinx_types::PAYLOAD_KEY_SIZE;
+use std::fmt::Display;
+use std::mem;
+use tracing::{error, warn};
+
+const fn v1_reply_surb_serialised_len() -> usize {
+    // the SURB itself consists of SURB_header, first hop address and set of payload keys
+    // for each hop (3x mix + egress)
+    ReplySurb::BASE_OVERHEAD + 4 * PAYLOAD_KEY_SIZE
+}
+
+fn v1_reply_surbs_serialised_len(surbs: &[ReplySurb]) -> usize {
+    // sanity checks; this should probably be removed later on
+    if let Some(reply_surb) = surbs.first() {
+        if reply_surb.surb.uses_key_seeds() {
+            error!("using v1 surbs encoding with updated structure - the surbs will be unusable")
+        }
+    }
+
+    // when serialising surbs are always prepended with u32-encoded count
+    4 + surbs.len() * v1_reply_surb_serialised_len()
+}
+
+// this recovery code is shared between all legacy variants containing reply surbs
+// NUM_SURBS (u32) || SURB_DATA
+fn recover_reply_surbs_v1(
+    bytes: &[u8],
+) -> Result<(Vec<ReplySurb>, usize), InvalidReplyRequestError> {
+    let mut consumed = mem::size_of::<u32>();
+    if bytes.len() < consumed {
+        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
+    }
+    let num_surbs = u32::from_be_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]);
+
+    let surb_size = v1_reply_surb_serialised_len();
+    if bytes[consumed..].len() < num_surbs as usize * surb_size {
+        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
+    }
+
+    let mut reply_surbs = Vec::with_capacity(num_surbs as usize);
+    for _ in 0..num_surbs as usize {
+        let surb_bytes = &bytes[consumed..consumed + surb_size];
+        let reply_surb = ReplySurb::from_bytes(surb_bytes)?;
+        reply_surbs.push(reply_surb);
+
+        consumed += surb_size;
+    }
+
+    Ok((reply_surbs, consumed))
+}
+
+// length (u32) prefixed reply surbs with legacy serialisation of 4 hops and full payload keys attached
+fn reply_surbs_bytes_v1(reply_surbs: &[ReplySurb]) -> impl Iterator<Item = u8> + use<'_> {
+    let num_surbs = reply_surbs.len() as u32;
+
+    num_surbs
+        .to_be_bytes()
+        .into_iter()
+        .chain(reply_surbs.iter().flat_map(|s| s.to_bytes()))
+}
+
+#[derive(Debug)]
+pub struct DataV1 {
+    pub message: Vec<u8>,
+    pub reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for DataV1 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V1 repliable {:.2} kiB data message with {} reply surbs attached",
+            self.message.len() as f64 / 1024.0,
+            self.reply_surbs.len(),
+        )
+    }
+}
+
+#[derive(Debug)]
+pub struct AdditionalSurbsV1 {
+    pub reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for AdditionalSurbsV1 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V1 repliable additional surbs message ({} reply surbs attached)",
+            self.reply_surbs.len(),
+        )
+    }
+}
+
+#[derive(Debug)]
+pub struct HeartbeatV1 {
+    pub additional_reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for HeartbeatV1 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V1 repliable heartbeat message ({} reply surbs attached)",
+            self.additional_reply_surbs.len(),
+        )
+    }
+}
+
+impl DataV1 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v1(&self.reply_surbs)
+            .chain(self.message)
+            .collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (reply_surbs, n) = recover_reply_surbs_v1(bytes)?;
+        Ok(DataV1 {
+            message: bytes[n..].to_vec(),
+            reply_surbs,
+        })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v1_reply_surbs_serialised_len(&self.reply_surbs) + self.message.len()
+    }
+}
+
+impl AdditionalSurbsV1 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v1(&self.reply_surbs).collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (reply_surbs, n) = recover_reply_surbs_v1(bytes)?;
+        if n != bytes.len() {
+            let trailing = bytes.len() - n;
+
+            warn!("trailing {trailing} bytes after v1 additional surbs message");
+        }
+
+        Ok(AdditionalSurbsV1 { reply_surbs })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v1_reply_surbs_serialised_len(&self.reply_surbs)
+    }
+}
+
+impl HeartbeatV1 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v1(&self.additional_reply_surbs).collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (additional_reply_surbs, n) = recover_reply_surbs_v1(bytes)?;
+        if n != bytes.len() {
+            let trailing = bytes.len() - n;
+
+            warn!("trailing {trailing} bytes after v1 heartbeat message");
+        }
+
+        Ok(HeartbeatV1 {
+            additional_reply_surbs,
+        })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v1_reply_surbs_serialised_len(&self.additional_reply_surbs)
+    }
+}
@@ -0,0 +1,187 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::requests::InvalidReplyRequestError;
+use crate::ReplySurb;
+use nym_sphinx_types::constants::PAYLOAD_KEY_SEED_SIZE;
+use std::fmt::Display;
+use std::iter::once;
+use tracing::{error, warn};
+
+const fn v2_reply_surb_serialised_len(num_hops: u8) -> usize {
+    ReplySurb::BASE_OVERHEAD + num_hops as usize * PAYLOAD_KEY_SEED_SIZE
+}
+
+// sphinx doesn't support more than 5 hops (so cast to u8 is safe)
+// ASSUMPTION: all surbs are generated with the same parameters (if they're not, then the client is hurting itself)
+fn reply_surbs_hops(reply_surbs: &[ReplySurb]) -> u8 {
+    reply_surbs
+        .first()
+        .map(|reply_surb| reply_surb.surb.materials_count() as u8)
+        .unwrap_or_default()
+}
+
+fn v2_reply_surbs_serialised_len(surbs: &[ReplySurb]) -> usize {
+    let num_surbs = surbs.len();
+    let num_hops = reply_surbs_hops(surbs);
+
+    // sanity checks; this should probably be removed later on
+    if let Some(reply_surb) = surbs.first() {
+        if !reply_surb.surb.uses_key_seeds() {
+            error!("using v2 surbs encoding with legacy structure - the surbs will be unusable")
+        }
+    }
+
+    // when serialising surbs are always prepended with u16-encoded count an u8-encoded number of hops
+    3 + num_surbs * v2_reply_surb_serialised_len(num_hops)
+}
+
+// NUM_SURBS (u16) || HOPS (u8) || SURB_DATA
+fn recover_reply_surbs_v2(
+    bytes: &[u8],
+) -> Result<(Vec<ReplySurb>, usize), InvalidReplyRequestError> {
+    if bytes.len() < 2 {
+        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
+    }
+
+    // we're not attaching more than 65k surbs...
+    let num_surbs = u16::from_be_bytes([bytes[0], bytes[1]]);
+    let num_hops = bytes[2];
+    let mut consumed = 3;
+
+    let surb_size = ReplySurb::v2_serialised_len(num_hops);
+    if bytes[consumed..].len() < num_surbs as usize * surb_size {
+        return Err(InvalidReplyRequestError::RequestTooShortToDeserialize);
+    }
+
+    let mut reply_surbs = Vec::with_capacity(num_surbs as usize);
+    for _ in 0..num_surbs as usize {
+        let surb_bytes = &bytes[consumed..consumed + surb_size];
+        let reply_surb = ReplySurb::from_bytes(surb_bytes)?;
+        reply_surbs.push(reply_surb);
+
+        consumed += surb_size;
+    }
+
+    Ok((reply_surbs, consumed))
+}
+
+fn reply_surbs_bytes_v2(reply_surbs: &[ReplySurb]) -> impl Iterator<Item = u8> + use<'_> {
+    let num_surbs = reply_surbs.len() as u16;
+    let num_hops = reply_surbs_hops(reply_surbs);
+
+    num_surbs
+        .to_be_bytes()
+        .into_iter()
+        .chain(once(num_hops))
+        .chain(reply_surbs.iter().flat_map(|surb| surb.to_bytes()))
+}
+
+#[derive(Debug)]
+pub struct DataV2 {
+    pub message: Vec<u8>,
+    pub reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for DataV2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V2 repliable {:.2} kiB data message with {} reply surbs attached",
+            self.message.len() as f64 / 1024.0,
+            self.reply_surbs.len(),
+        )
+    }
+}
+
+#[derive(Debug)]
+pub struct AdditionalSurbsV2 {
+    pub reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for AdditionalSurbsV2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V2 repliable additional surbs message ({} reply surbs attached)",
+            self.reply_surbs.len(),
+        )
+    }
+}
+
+#[derive(Debug)]
+pub struct HeartbeatV2 {
+    pub additional_reply_surbs: Vec<ReplySurb>,
+}
+
+impl Display for HeartbeatV2 {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(
+            f,
+            "V2 repliable heartbeat message ({} reply surbs attached)",
+            self.additional_reply_surbs.len(),
+        )
+    }
+}
+
+impl DataV2 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v2(&self.reply_surbs)
+            .chain(self.message)
+            .collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (reply_surbs, n) = recover_reply_surbs_v2(bytes)?;
+        Ok(DataV2 {
+            message: bytes[n..].to_vec(),
+            reply_surbs,
+        })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v2_reply_surbs_serialised_len(&self.reply_surbs) + self.message.len()
+    }
+}
+
+impl AdditionalSurbsV2 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v2(&self.reply_surbs).collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (reply_surbs, n) = recover_reply_surbs_v2(bytes)?;
+        if n != bytes.len() {
+            let trailing = bytes.len() - n;
+            warn!("trailing {trailing} bytes after v2 additional surbs message");
+        }
+
+        Ok(AdditionalSurbsV2 { reply_surbs })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v2_reply_surbs_serialised_len(&self.reply_surbs)
+    }
+}
+
+impl HeartbeatV2 {
+    pub fn into_bytes(self) -> Vec<u8> {
+        reply_surbs_bytes_v2(&self.additional_reply_surbs).collect()
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, InvalidReplyRequestError> {
+        let (additional_reply_surbs, n) = recover_reply_surbs_v2(bytes)?;
+        if n != bytes.len() {
+            let trailing = bytes.len() - n;
+            warn!("trailing {trailing} bytes after v2 heartbeat message");
+        }
+
+        Ok(HeartbeatV2 {
+            additional_reply_surbs,
+        })
+    }
+
+    pub fn serialized_len(&self) -> usize {
+        v2_reply_surbs_serialised_len(&self.additional_reply_surbs)
+    }
+}
@@ -34,6 +34,7 @@ pub enum CoverMessageError {

 pub fn generate_loop_cover_surb_ack<R>(
    rng: &mut R,
+    use_legacy_sphinx_format: bool,
    topology: &NymRouteProvider,
    ack_key: &AckKey,
    full_address: &Recipient,
@@ -45,6 +46,7 @@ where
 {
    Ok(SurbAck::construct(
        rng,
+        use_legacy_sphinx_format,
        full_address,
        ack_key,
        COVER_FRAG_ID.to_bytes(),
@@ -57,6 +59,7 @@ where
 #[allow(clippy::too_many_arguments)]
 pub fn generate_loop_cover_packet<R>(
    rng: &mut R,
+    use_legacy_sphinx_format: bool,
    topology: &NymRouteProvider,
    ack_key: &AckKey,
    full_address: &Recipient,
@@ -71,6 +74,7 @@ where
    // we don't care about total ack delay - we will not be retransmitting it anyway
    let (_, ack_bytes) = generate_loop_cover_surb_ack(
        rng,
+        use_legacy_sphinx_format,
        topology,
        ack_key,
        full_address,
@@ -126,14 +130,7 @@ where
    // once merged, that's an easy rng injection point for sphinx packets : )
    let packet = match packet_type {
        PacketType::Mix => NymPacket::sphinx_build(
-            packet_size.payload_size(),
-            packet_payload,
-            &route,
-            &destination,
-            &delays,
-        )?,
-        #[allow(deprecated)]
-        PacketType::Vpn => NymPacket::sphinx_build(
+            use_legacy_sphinx_format,
            packet_size.payload_size(),
            packet_payload,
            &route,
@@ -11,12 +11,11 @@ repository = { workspace = true }
 bytes = { workspace = true }
 tokio-util = { workspace = true, features = ["codec"] }
 thiserror = { workspace = true }
-log = { workspace = true }
+tracing = { workspace = true }

 nym-sphinx-types = { path = "../types", features = ["sphinx", "outfox"] }
 nym-sphinx-params = { path = "../params", features = ["sphinx", "outfox"] }
 nym-sphinx-forwarding = { path = "../forwarding" }
-nym-metrics = { path = "../../nym-metrics" }
 nym-sphinx-addressing = { path = "../addressing" }
 nym-sphinx-acknowledgements = { path = "../acknowledgements" }

@@ -5,6 +5,7 @@ use crate::packet::{FramedNymPacket, Header};
 use bytes::{Buf, BufMut, BytesMut};
 use nym_sphinx_params::packet_sizes::{InvalidPacketSize, PacketSize};
 use nym_sphinx_params::packet_types::InvalidPacketType;
+use nym_sphinx_params::packet_version::{InvalidPacketVersion, PacketVersion};
 use nym_sphinx_params::PacketType;
 use nym_sphinx_types::{NymPacket, NymPacketError};
 use std::io;
@@ -13,16 +14,25 @@ use tokio_util::codec::{Decoder, Encoder};

 #[derive(Error, Debug)]
 pub enum NymCodecError {
-    #[error("the packet size information was malformed - {0}")]
+    #[error("the packet size information was malformed: {0}")]
    InvalidPacketSize(#[from] InvalidPacketSize),

-    #[error("the packet mode information was malformed - {0}")]
+    #[error("the packet mode information was malformed: {0}")]
    InvalidPacketType(#[from] InvalidPacketType),

-    #[error("encountered an IO error - {0}")]
+    #[error("the packet version information was malformed: {0}")]
+    InvalidPacketVersion(#[from] InvalidPacketVersion),
+
+    #[error("received unsupported packet version {received}. max supported is {max_supported}")]
+    UnsupportedPacketVersion {
+        received: PacketVersion,
+        max_supported: PacketVersion,
+    },
+
+    #[error("encountered an IO error: {0}")]
    IoError(#[from] io::Error),

-    #[error("encountered a packet error - {0}")]
+    #[error("encountered a packet error: {0}")]
    NymPacket(#[from] NymPacketError),

    #[error("could not convert to bytes")]
@@ -56,7 +66,7 @@ impl Decoder for NymCodec {
        if src.is_empty() {
            // can't do anything if we have no bytes, but let's reserve enough for the most
            // conservative case, i.e. receiving an ack packet
-            src.reserve(Header::LEGACY_SIZE + PacketSize::AckPacket.size());
+            src.reserve(Header::SIZE + PacketSize::AckPacket.size());
            return Ok(None);
        }

@@ -68,7 +78,7 @@ impl Decoder for NymCodec {
        };

        let packet_size = header.packet_size.size();
-        let frame_len = header.size() + packet_size;
+        let frame_len = Header::SIZE + packet_size;

        if src.len() < frame_len {
            // we don't have enough bytes to read the rest of frame
@@ -77,7 +87,7 @@ impl Decoder for NymCodec {
        }

        // advance buffer past the header - at this point we have enough bytes
-        src.advance(header.size());
+        src.advance(Header::SIZE);
        let packet_bytes = src.split_to(packet_size);
        let packet = if let Some(slice) = packet_bytes.get(..) {
            // here it could be debatable whether stream is corrupt or not,
@@ -85,8 +95,6 @@ impl Decoder for NymCodec {
            match header.packet_type {
                PacketType::Outfox => NymPacket::outfox_from_bytes(slice)?,
                PacketType::Mix => NymPacket::sphinx_from_bytes(slice)?,
-                #[allow(deprecated)]
-                PacketType::Vpn => NymPacket::sphinx_from_bytes(slice)?,
            }
        } else {
            return Ok(None);
@@ -106,11 +114,11 @@ impl Decoder for NymCodec {
        // we also assume the next packet coming from the same client will use exactly the same versioning
        // as the current packet

-        let mut allocate_for_next_packet = header.size() + PacketSize::AckPacket.size();
+        let mut allocate_for_next_packet = Header::SIZE + PacketSize::AckPacket.size();
        if !src.is_empty() {
            match Header::decode(src) {
                Ok(Some(next_header)) => {
-                    allocate_for_next_packet = next_header.size() + next_header.packet_size.size();
+                    allocate_for_next_packet = Header::SIZE + next_header.packet_size.size();
                }
                Ok(None) => {
                    // we don't have enough information to know how much to reserve, fallback to the ack case
@@ -201,8 +209,15 @@ mod packet_encoding {
            SphinxDelay::new_from_nanos(42),
            SphinxDelay::new_from_nanos(42),
        ];
-        NymPacket::sphinx_build(size.payload_size(), b"foomp", &route, &destination, &delays)
-            .unwrap()
+        NymPacket::sphinx_build(
+            false,
+            size.payload_size(),
+            b"foomp",
+            &route,
+            &destination,
+            &delays,
+        )
+        .unwrap()
    }

    #[test]
@@ -254,34 +269,10 @@ mod packet_encoding {
            assert!(NymCodec.decode(&mut empty_bytes).unwrap().is_none());
            assert_eq!(
                empty_bytes.capacity(),
-                Header::LEGACY_SIZE + PacketSize::AckPacket.size()
+                Header::SIZE + PacketSize::AckPacket.size()
            );
        }

-        #[test]
-        fn for_bytes_with_legacy_header() {
-            // if header gets decoded there should be enough bytes for the entire frame
-            let packet_sizes = vec![
-                PacketSize::AckPacket,
-                PacketSize::RegularPacket,
-                PacketSize::ExtendedPacket8,
-                PacketSize::ExtendedPacket16,
-                PacketSize::ExtendedPacket32,
-            ];
-            for packet_size in packet_sizes {
-                let header = Header {
-                    packet_version: PacketVersion::Legacy,
-                    packet_size,
-                    ..Default::default()
-                };
-                let mut bytes = BytesMut::new();
-                header.encode(&mut bytes);
-                assert!(NymCodec.decode(&mut bytes).unwrap().is_none());
-
-                assert_eq!(bytes.capacity(), Header::LEGACY_SIZE + packet_size.size())
-            }
-        }
-
        #[test]
        fn for_bytes_with_versioned_header() {
            // if header gets decoded there should be enough bytes for the entire frame
@@ -294,7 +285,7 @@ mod packet_encoding {
            ];
            for packet_size in packet_sizes {
                let header = Header {
-                    packet_version: PacketVersion::Versioned(123),
+                    packet_version: PacketVersion::new(),
                    packet_size,
                    ..Default::default()
                };
@@ -302,33 +293,10 @@ mod packet_encoding {
                header.encode(&mut bytes);
                assert!(NymCodec.decode(&mut bytes).unwrap().is_none());

-                assert_eq!(
-                    bytes.capacity(),
-                    Header::VERSIONED_SIZE + packet_size.size()
-                )
+                assert_eq!(bytes.capacity(), Header::SIZE + packet_size.size())
            }
        }

-        #[test]
-        fn for_full_frame_with_legacy_header() {
-            // if full frame is used exactly, there should be enough space for header + ack packet
-            let packet = FramedNymPacket {
-                header: Header {
-                    packet_version: PacketVersion::Legacy,
-                    ..Default::default()
-                },
-                packet: make_valid_sphinx_packet(Default::default()),
-            };
-
-            let mut bytes = BytesMut::new();
-            NymCodec.encode(packet, &mut bytes).unwrap();
-            assert!(NymCodec.decode(&mut bytes).unwrap().is_some());
-            assert_eq!(
-                bytes.capacity(),
-                Header::LEGACY_SIZE + PacketSize::AckPacket.size()
-            );
-        }
-
        #[test]
        fn for_full_frame_with_versioned_header() {
            // if full frame is used exactly, there should be enough space for header + ack packet
@@ -342,40 +310,10 @@ mod packet_encoding {
            assert!(NymCodec.decode(&mut bytes).unwrap().is_some());
            assert_eq!(
                bytes.capacity(),
-                Header::VERSIONED_SIZE + PacketSize::AckPacket.size()
+                Header::SIZE + PacketSize::AckPacket.size()
            );
        }

-        #[test]
-        fn for_full_frame_with_extra_bytes_with_legacy_header() {
-            // if there was at least 2 byte left, there should be enough space for entire next frame
-            let packet_sizes = vec![
-                PacketSize::AckPacket,
-                PacketSize::RegularPacket,
-                PacketSize::ExtendedPacket8,
-                PacketSize::ExtendedPacket16,
-                PacketSize::ExtendedPacket32,
-            ];
-
-            for packet_size in packet_sizes {
-                let first_packet = FramedNymPacket {
-                    header: Header {
-                        packet_version: PacketVersion::Legacy,
-                        ..Default::default()
-                    },
-                    packet: make_valid_sphinx_packet(Default::default()),
-                };
-
-                let mut bytes = BytesMut::new();
-                NymCodec.encode(first_packet, &mut bytes).unwrap();
-                bytes.put_u8(packet_size as u8);
-                bytes.put_u8(PacketType::default() as u8);
-                assert!(NymCodec.decode(&mut bytes).unwrap().is_some());
-
-                assert!(bytes.capacity() >= Header::LEGACY_SIZE + packet_size.size())
-            }
-        }
-
        #[test]
        fn for_full_frame_with_extra_bytes_with_versioned_header() {
            // if there was at least 3 byte left, there should be enough space for entire next frame
@@ -395,7 +333,7 @@ mod packet_encoding {

                let mut bytes = BytesMut::new();
                NymCodec.encode(first_packet, &mut bytes).unwrap();
-                bytes.put_u8(PacketVersion::new_versioned(123).as_u8().unwrap());
+                bytes.put_u8(PacketVersion::new().as_u8());
                bytes.put_u8(packet_size as u8);
                bytes.put_u8(PacketType::default() as u8);
                assert!(NymCodec.decode(&mut bytes).unwrap().is_some());
@@ -4,7 +4,7 @@
 use crate::codec::NymCodecError;
 use bytes::{BufMut, BytesMut};
 use nym_sphinx_params::packet_sizes::PacketSize;
-use nym_sphinx_params::packet_version::PacketVersion;
+use nym_sphinx_params::packet_version::{PacketVersion, CURRENT_PACKET_VERSION};
 use nym_sphinx_params::PacketType;
 use nym_sphinx_types::NymPacket;

@@ -47,6 +47,14 @@ impl FramedNymPacket {
    pub fn into_inner(self) -> NymPacket {
        self.packet
    }
+
+    pub fn packet(&self) -> &NymPacket {
+        &self.packet
+    }
+
+    pub fn is_sphinx(&self) -> bool {
+        self.packet.is_sphinx()
+    }
 }

 // Contains any metadata that might be useful for sending between mix nodes.
@@ -73,8 +81,7 @@ pub struct Header {
 }

 impl Header {
-    pub(crate) const LEGACY_SIZE: usize = 2;
-    pub(crate) const VERSIONED_SIZE: usize = 3;
+    pub(crate) const SIZE: usize = 3;

    pub fn outfox() -> Header {
        Header {
@@ -84,53 +91,39 @@ impl Header {
        }
    }

-    pub(crate) fn size(&self) -> usize {
-        if self.packet_version.is_legacy() {
-            Self::LEGACY_SIZE
-        } else {
-            Self::VERSIONED_SIZE
-        }
-    }
-
    pub(crate) fn encode(&self, dst: &mut BytesMut) {
-        // we reserve one byte for `packet_size` and the other for `mode`
-        dst.reserve(Self::LEGACY_SIZE);
-        if let Some(version) = self.packet_version.as_u8() {
-            dst.reserve(Self::VERSIONED_SIZE);
-            dst.put_u8(version)
-        }
+        dst.reserve(Self::SIZE);

+        dst.put_u8(self.packet_version.as_u8());
        dst.put_u8(self.packet_size as u8);
        dst.put_u8(self.packet_type as u8);
+
        // reserve bytes for the actual packet
        dst.reserve(self.packet_size.size());
    }

    pub(crate) fn decode(src: &mut BytesMut) -> Result<Option<Self>, NymCodecError> {
-        if src.len() < Self::LEGACY_SIZE {
+        if src.len() < Self::SIZE {
            // can't do anything if we don't have enough bytes - but reserve enough for the next call
-            src.reserve(Self::LEGACY_SIZE);
+            src.reserve(Self::SIZE);
            return Ok(None);
        }

-        let packet_version = PacketVersion::from(src[0]);
-        if packet_version.is_legacy() {
-            Ok(Some(Header {
-                packet_version,
-                packet_size: PacketSize::try_from(src[0])?,
-                packet_type: PacketType::try_from(src[1])?,
-            }))
-        } else if src.len() < Self::VERSIONED_SIZE {
-            // we're missing that 1 byte to read the full header...
-            src.reserve(Self::VERSIONED_SIZE);
-            Ok(None)
-        } else {
-            Ok(Some(Header {
-                packet_version,
-                packet_size: PacketSize::try_from(src[1])?,
-                packet_type: PacketType::try_from(src[2])?,
-            }))
+        let packet_version = PacketVersion::try_from(src[0])?;
+        if packet_version > CURRENT_PACKET_VERSION {
+            // received an unsupported packet version - we don't know how it's meant to look like!
+            // (this is in preparation for the dual support of breaking sphinx changes)
+            return Err(NymCodecError::UnsupportedPacketVersion {
+                received: packet_version,
+                max_supported: CURRENT_PACKET_VERSION,
+            });
        }
+
+        Ok(Some(Header {
+            packet_version,
+            packet_size: PacketSize::try_from(src[1])?,
+            packet_type: PacketType::try_from(src[2])?,
+        }))
    }
 }

@@ -157,7 +150,7 @@ mod header_encoding {
        // due to the hack used to get legacy mode compatibility
        let mut bytes = BytesMut::from(
            [
-                PacketVersion::new_versioned(123).as_u8().unwrap(),
+                PacketVersion::new().as_u8(),
                unknown_packet_size,
                PacketType::default() as u8,
            ]
@@ -172,7 +165,14 @@ mod header_encoding {
        // make sure this is still 'unknown' for if we make changes in the future
        assert!(PacketType::try_from(unknown_packet_type).is_err());

-        let mut bytes = BytesMut::from([PacketSize::default() as u8, unknown_packet_type].as_ref());
+        let mut bytes = BytesMut::from(
+            [
+                PacketVersion::new().as_u8(),
+                PacketSize::default() as u8,
+                unknown_packet_type,
+            ]
+            .as_ref(),
+        );
        assert!(Header::decode(&mut bytes).is_err())
    }

@@ -181,16 +181,16 @@ mod header_encoding {
        let mut empty_bytes = BytesMut::new();
        let decode_attempt_1 = Header::decode(&mut empty_bytes).unwrap();
        assert!(decode_attempt_1.is_none());
-        assert!(empty_bytes.capacity() > Header::LEGACY_SIZE);
+        assert!(empty_bytes.capacity() > Header::SIZE);

        let mut empty_bytes = BytesMut::with_capacity(1);
        let decode_attempt_2 = Header::decode(&mut empty_bytes).unwrap();
        assert!(decode_attempt_2.is_none());
-        assert!(empty_bytes.capacity() > Header::LEGACY_SIZE);
+        assert!(empty_bytes.capacity() > Header::SIZE);
    }

    #[test]
-    fn header_encoding_reserves_enough_bytes_for_full_sphinx_packet_in_legacy_mode() {
+    fn header_encoding_reserves_enough_bytes_for_full_sphinx_packet_() {
        let packet_sizes = vec![
            PacketSize::AckPacket,
            PacketSize::RegularPacket,
@@ -200,7 +200,7 @@ mod header_encoding {
        ];
        for packet_size in packet_sizes {
            let header = Header {
-                packet_version: PacketVersion::Legacy,
+                packet_version: PacketVersion::new(),
                packet_size,
                ..Default::default()
            };
@@ -211,23 +211,26 @@ mod header_encoding {
    }

    #[test]
-    fn header_encoding_reserves_enough_bytes_for_full_sphinx_packet_in_versioned_mode() {
-        let packet_sizes = vec![
-            PacketSize::AckPacket,
-            PacketSize::RegularPacket,
-            PacketSize::ExtendedPacket8,
-            PacketSize::ExtendedPacket16,
-            PacketSize::ExtendedPacket32,
-        ];
-        for packet_size in packet_sizes {
-            let header = Header {
-                packet_version: PacketVersion::Versioned(123),
-                packet_size,
-                ..Default::default()
-            };
-            let mut bytes = BytesMut::new();
-            header.encode(&mut bytes);
-            assert_eq!(bytes.capacity(), bytes.len() + packet_size.size())
+    fn header_decoding_will_reject_future_versions() {
+        let future_version = PacketVersion::try_from(123).unwrap();
+
+        let unchecked_header = Header {
+            packet_version: future_version,
+            packet_size: PacketSize::RegularPacket,
+            packet_type: PacketType::Mix,
+        };
+        let mut bytes = BytesMut::new();
+        unchecked_header.encode(&mut bytes);
+
+        match Header::decode(&mut bytes).unwrap_err() {
+            NymCodecError::UnsupportedPacketVersion {
+                received,
+                max_supported,
+            } => {
+                assert_eq!(received, future_version);
+                assert_eq!(max_supported, CURRENT_PACKET_VERSION);
+            }
+            _ => panic!("unexpected error variant"),
        }
    }
 }
@@ -1,18 +1,20 @@
-use log::{debug, error, info, trace};
+// Copyright 2021-2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::packet::FramedNymPacket;
 use nym_sphinx_acknowledgements::surb_ack::{SurbAck, SurbAckRecoveryError};
 use nym_sphinx_addressing::nodes::{NymNodeRoutingAddress, NymNodeRoutingAddressError};
+use nym_sphinx_forwarding::packet::MixPacket;
 use nym_sphinx_params::{PacketSize, PacketType};
+use nym_sphinx_types::header::shared_secret::ExpandedSharedSecret;
 use nym_sphinx_types::{
    Delay as SphinxDelay, DestinationAddressBytes, NodeAddressBytes, NymPacket, NymPacketError,
-    NymProcessedPacket, OutfoxError, PrivateKey, ProcessedPacketData, SphinxError,
-    Version as SphinxPacketVersion,
+    NymProcessedPacket, OutfoxError, OutfoxProcessedPacket, PrivateKey, ProcessedPacketData,
+    SphinxError, Version as SphinxPacketVersion, REPLAY_TAG_SIZE,
 };
 use std::fmt::Display;
 use thiserror::Error;
-
-use crate::packet::FramedNymPacket;
-use nym_metrics::nanos;
-use nym_sphinx_forwarding::packet::MixPacket;
+use tracing::{debug, error, info, trace};

 #[derive(Debug)]
 pub enum MixProcessingResultData {
@@ -49,6 +51,26 @@ pub struct MixProcessingResult {
    pub processing_data: MixProcessingResultData,
 }

+#[allow(clippy::large_enum_variant)]
+#[derive(Debug)]
+pub enum PartialMixProcessingResult {
+    Sphinx {
+        expanded_shared_secret: ExpandedSharedSecret,
+    },
+    Outfox,
+}
+
+impl PartialMixProcessingResult {
+    pub fn replay_tag(&self) -> Option<&[u8; REPLAY_TAG_SIZE]> {
+        match self {
+            PartialMixProcessingResult::Sphinx {
+                expanded_shared_secret,
+            } => Some(expanded_shared_secret.replay_tag()),
+            PartialMixProcessingResult::Outfox => None,
+        }
+    }
+}
+
 type ForwardAck = MixPacket;

 #[derive(Debug)]
@@ -75,59 +97,192 @@ pub enum PacketProcessingError {
    #[error("failed to recover the expected SURB-Ack packet: {0}")]
    MalformedSurbAck(#[from] SurbAckRecoveryError),

-    #[error("the received packet was set to use the very old and very much deprecated 'VPN' mode")]
-    ReceivedOldTypeVpnPacket,
-
    #[error("failed to process received outfox packet: {0}")]
    OutfoxProcessingError(#[from] OutfoxError),
+
+    #[error("attempted to partially process an outfox packet")]
+    PartialOutfoxProcessing,
+
+    #[error("this packet has already been processed before")]
+    PacketReplay,
+}
+
+pub struct PartiallyUnwrappedPacket {
+    received_data: FramedNymPacket,
+    partial_result: PartialMixProcessingResult,
+}
+
+impl PartiallyUnwrappedPacket {
+    /// Attempt to partially unwrap received packet to derive relevant keys
+    /// to allow us to reject it for obvious bad behaviour (like replay or invalid mac)
+    /// without performing full processing
+    pub fn new(
+        received_data: FramedNymPacket,
+        sphinx_key: &PrivateKey,
+    ) -> Result<Self, PacketProcessingError> {
+        let partial_result = match received_data.packet() {
+            NymPacket::Sphinx(packet) => {
+                let expanded_shared_secret =
+                    packet.header.compute_expanded_shared_secret(sphinx_key);
+
+                // don't continue if the header is malformed
+                packet
+                    .header
+                    .ensure_header_integrity(&expanded_shared_secret)?;
+
+                PartialMixProcessingResult::Sphinx {
+                    expanded_shared_secret,
+                }
+            }
+
+            NymPacket::Outfox(_) => PartialMixProcessingResult::Outfox,
+        };
+        Ok(PartiallyUnwrappedPacket {
+            received_data,
+            partial_result,
+        })
+    }
+
+    pub fn finalise_unwrapping(self) -> Result<MixProcessingResult, PacketProcessingError> {
+        let packet_size = self.received_data.packet_size();
+        let packet_type = self.received_data.packet_type();
+
+        let packet = self.received_data.into_inner();
+
+        // currently partial unwrapping is only implemented for sphinx packets.
+        // attempting to call it for anything else should result in a failure
+        let (
+            NymPacket::Sphinx(packet),
+            PartialMixProcessingResult::Sphinx {
+                expanded_shared_secret,
+            },
+        ) = (packet, self.partial_result)
+        else {
+            return Err(PacketProcessingError::PartialOutfoxProcessing);
+        };
+        let processed_packet = packet.process_with_expanded_secret(&expanded_shared_secret)?;
+        wrap_processed_sphinx_packet(processed_packet, packet_size, packet_type)
+    }
+
+    pub fn replay_tag(&self) -> Option<&[u8; REPLAY_TAG_SIZE]> {
+        self.partial_result.replay_tag()
+    }
+}
+
+impl From<(FramedNymPacket, PartialMixProcessingResult)> for PartiallyUnwrappedPacket {
+    fn from(
+        (received_data, partial_result): (FramedNymPacket, PartialMixProcessingResult),
+    ) -> Self {
+        PartiallyUnwrappedPacket {
+            received_data,
+            partial_result,
+        }
+    }
 }

 pub fn process_framed_packet(
    received: FramedNymPacket,
    sphinx_key: &PrivateKey,
 ) -> Result<MixProcessingResult, PacketProcessingError> {
-    nanos!("process_received", {
-        let packet_size = received.packet_size();
-        let packet_type = received.packet_type();
+    let packet_size = received.packet_size();
+    let packet_type = received.packet_type();

-        // unwrap the sphinx packet and if possible and appropriate, cache keys
-        let processed_packet = perform_framed_unwrapping(received, sphinx_key)?;
+    // unwrap the sphinx packet
+    let processed_packet = perform_framed_unwrapping(received, sphinx_key)?;

-        // for forward packets, extract next hop and set delay (but do NOT delay here)
-        // for final packets, extract SURBAck
-        let final_processing_result =
-            perform_final_processing(processed_packet, packet_size, packet_type);
-
-        if final_processing_result.is_err() {
-            error!("{:?}", final_processing_result)
-        }
-
-        final_processing_result
-    })
+    // for forward packets, extract next hop and set delay (but do NOT delay here)
+    // for final packets, extract SURBAck
+    perform_final_processing(processed_packet, packet_size, packet_type)
 }

 fn perform_framed_unwrapping(
    received: FramedNymPacket,
    sphinx_key: &PrivateKey,
 ) -> Result<NymProcessedPacket, PacketProcessingError> {
-    nanos!("perform_initial_unwrapping", {
-        let packet = received.into_inner();
-        perform_framed_packet_processing(packet, sphinx_key)
-    })
+    let packet = received.into_inner();
+    perform_framed_packet_processing(packet, sphinx_key)
 }

 fn perform_framed_packet_processing(
    packet: NymPacket,
    sphinx_key: &PrivateKey,
 ) -> Result<NymProcessedPacket, PacketProcessingError> {
-    nanos!("perform_initial_packet_processing", {
-        packet.process(sphinx_key).map_err(|err| {
-            debug!("Failed to unwrap NymPacket packet: {err}");
-            PacketProcessingError::NymPacketProcessingError(err)
-        })
+    packet.process(sphinx_key).map_err(|err| {
+        debug!("Failed to unwrap NymPacket packet: {err}");
+        PacketProcessingError::NymPacketProcessingError(err)
    })
 }

+fn wrap_processed_sphinx_packet(
+    packet: nym_sphinx_types::ProcessedPacket,
+    packet_size: PacketSize,
+    packet_type: PacketType,
+) -> Result<MixProcessingResult, PacketProcessingError> {
+    let processing_data = match packet.data {
+        ProcessedPacketData::ForwardHop {
+            next_hop_packet,
+            next_hop_address,
+            delay,
+        } => process_forward_hop(
+            NymPacket::Sphinx(next_hop_packet),
+            next_hop_address,
+            delay,
+            packet_type,
+        ),
+        // right now there's no use for the surb_id included in the header - probably it should get removed from the
+        // sphinx all together?
+        ProcessedPacketData::FinalHop {
+            destination,
+            identifier: _,
+            payload,
+        } => process_final_hop(
+            destination,
+            payload.recover_plaintext()?,
+            packet_size,
+            packet_type,
+        ),
+    }?;
+
+    Ok(MixProcessingResult {
+        packet_version: MixPacketVersion::Sphinx(packet.version),
+        processing_data,
+    })
+}
+
+fn wrap_processed_outfox_packet(
+    packet: OutfoxProcessedPacket,
+    packet_size: PacketSize,
+    packet_type: PacketType,
+) -> Result<MixProcessingResult, PacketProcessingError> {
+    let next_address = *packet.next_address();
+    let packet = packet.into_packet();
+    if packet.is_final_hop() {
+        let processing_data = process_final_hop(
+            DestinationAddressBytes::from_bytes(next_address),
+            packet.recover_plaintext()?.to_vec(),
+            packet_size,
+            packet_type,
+        )?;
+        Ok(MixProcessingResult {
+            packet_version: MixPacketVersion::Outfox,
+            processing_data,
+        })
+    } else {
+        let packet = MixPacket::new(
+            NymNodeRoutingAddress::try_from_bytes(&next_address)?,
+            NymPacket::Outfox(packet),
+            PacketType::Outfox,
+        );
+        Ok(MixProcessingResult {
+            packet_version: MixPacketVersion::Outfox,
+            processing_data: MixProcessingResultData::ForwardHop {
+                packet,
+                delay: None,
+            },
+        })
+    }
+}
+
 fn perform_final_processing(
    packet: NymProcessedPacket,
    packet_size: PacketSize,
@@ -135,64 +290,10 @@ fn perform_final_processing(
 ) -> Result<MixProcessingResult, PacketProcessingError> {
    match packet {
        NymProcessedPacket::Sphinx(packet) => {
-            let processing_data = match packet.data {
-                ProcessedPacketData::ForwardHop {
-                    next_hop_packet,
-                    next_hop_address,
-                    delay,
-                } => process_forward_hop(
-                    NymPacket::Sphinx(next_hop_packet),
-                    next_hop_address,
-                    delay,
-                    packet_type,
-                ),
-                // right now there's no use for the surb_id included in the header - probably it should get removed from the
-                // sphinx all together?
-                ProcessedPacketData::FinalHop {
-                    destination,
-                    identifier: _,
-                    payload,
-                } => process_final_hop(
-                    destination,
-                    payload.recover_plaintext()?,
-                    packet_size,
-                    packet_type,
-                ),
-            }?;
-
-            Ok(MixProcessingResult {
-                packet_version: MixPacketVersion::Sphinx(packet.version),
-                processing_data,
-            })
+            wrap_processed_sphinx_packet(packet, packet_size, packet_type)
        }
        NymProcessedPacket::Outfox(packet) => {
-            let next_address = *packet.next_address();
-            let packet = packet.into_packet();
-            if packet.is_final_hop() {
-                let processing_data = process_final_hop(
-                    DestinationAddressBytes::from_bytes(next_address),
-                    packet.recover_plaintext()?.to_vec(),
-                    packet_size,
-                    packet_type,
-                )?;
-                Ok(MixProcessingResult {
-                    packet_version: MixPacketVersion::Outfox,
-                    processing_data,
-                })
-            } else {
-                let packet = MixPacket::new(
-                    NymNodeRoutingAddress::try_from_bytes(&next_address)?,
-                    NymPacket::Outfox(packet),
-                    PacketType::Outfox,
-                );
-                Ok(MixProcessingResult {
-                    packet_version: MixPacketVersion::Outfox,
-                    processing_data: MixProcessingResultData::ForwardHop {
-                        packet,
-                        delay: None,
-                    },
-                })
-            }
+            wrap_processed_outfox_packet(packet, packet_size, packet_type)
        }
    }
 }
@@ -22,17 +22,6 @@ pub mod packet_version;
 pub const FRAG_ID_LEN: usize = 5;
 pub type SerializedFragmentIdentifier = [u8; FRAG_ID_LEN];

-// wait, wait, but why are we starting with version 7?
-// when packet header gets serialized, the following bytes (in that order) are put onto the wire:
-// - packet_version (starting with v1.1.0)
-// - packet_size indicator
-// - packet_type
-// it also just so happens that the only valid values for packet_size indicator include values 1-6
-// therefore if we receive byte `7` (or larger than that) we'll know we received a versioned packet,
-// otherwise we should treat it as legacy
-/// Increment it whenever we perform any breaking change in the wire format!
-const CURRENT_PACKET_VERSION_NUMBER: u8 = 7;
-
 // TODO: ask @AP about the choice of below algorithms

 /// Hashing algorithm used during hkdf for ephemeral shared key generation per sphinx packet payload.
@@ -272,9 +272,6 @@ impl PacketSize {
        let overhead = match packet_type {
            #[cfg(feature = "sphinx")]
            PacketType::Mix => SPHINX_PACKET_OVERHEAD,
-            #[allow(deprecated)]
-            #[cfg(feature = "sphinx")]
-            PacketType::Vpn => SPHINX_PACKET_OVERHEAD,
            #[cfg(feature = "outfox")]
            PacketType::Outfox => OUTFOX_PACKET_OVERHEAD,
            _ => 0,
@@ -27,11 +27,6 @@ pub enum PacketType {
    #[serde(alias = "sphinx")]
    Mix = 0,

-    /// Represents a packet that should be sent through the network as fast as possible.
-    #[deprecated]
-    #[serde(rename = "unsupported-mix-vpn")]
-    Vpn = 1,
-
    /// Abusing this to add Outfox support
    #[serde(rename = "outfox")]
    Outfox = 2,
@@ -41,8 +36,6 @@ impl fmt::Display for PacketType {
    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
        match self {
            PacketType::Mix => write!(f, "Mix"),
-            #[allow(deprecated)]
-            PacketType::Vpn => write!(f, "Vpn"),
            PacketType::Outfox => write!(f, "Outfox"),
        }
    }
@@ -2,56 +2,70 @@
 // SPDX-License-Identifier: Apache-2.0

 use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+use thiserror::Error;

-use crate::{PacketSize, CURRENT_PACKET_VERSION_NUMBER};
+// wait, wait, but why are we starting with version 7?
+// when packet header gets serialized, the following bytes (in that order) are put onto the wire:
+// - packet_version (starting with v1.1.0)
+// - packet_size indicator
+// - packet_type
+// it also just so happens that the only valid values for packet_size indicator include values 1-6
+// therefore if we receive byte `7` (or larger than that) we'll know we received a versioned packet,
+// otherwise we should treat it as legacy
+/// Increment it whenever we perform any breaking change in the wire format!
+pub const INITIAL_PACKET_VERSION_NUMBER: u8 = 7;

-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
-pub enum PacketVersion {
-    // this will allow updated mixnodes to still understand packets from before the update
-    Legacy,
-    Versioned(u8),
+pub const CURRENT_PACKET_VERSION_NUMBER: u8 = INITIAL_PACKET_VERSION_NUMBER;
+pub const CURRENT_PACKET_VERSION: PacketVersion =
+    PacketVersion::unchecked(CURRENT_PACKET_VERSION_NUMBER);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+pub struct PacketVersion(u8);
+
+impl Display for PacketVersion {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(f)
+    }
 }

+#[derive(Debug, Error)]
+#[error("attempted to use legacy packet version")]
+pub struct InvalidPacketVersion;
+
 impl PacketVersion {
    pub fn new() -> Self {
-        Self::new_versioned(CURRENT_PACKET_VERSION_NUMBER)
+        PacketVersion(CURRENT_PACKET_VERSION_NUMBER)
    }

-    pub fn new_legacy() -> Self {
-        PacketVersion::Legacy
+    const fn unchecked(version: u8) -> PacketVersion {
+        PacketVersion(version)
    }

-    pub fn new_versioned(version: u8) -> Self {
-        PacketVersion::Versioned(version)
-    }
-
-    pub fn is_legacy(&self) -> bool {
-        matches!(self, PacketVersion::Legacy)
-    }
-
-    pub fn as_u8(&self) -> Option<u8> {
-        match self {
-            PacketVersion::Legacy => None,
-            PacketVersion::Versioned(version) => Some(*version),
-        }
+    pub fn as_u8(&self) -> u8 {
+        (*self).into()
    }
 }

-impl From<u8> for PacketVersion {
-    fn from(v: u8) -> Self {
-        match v {
-            n if n == PacketSize::RegularPacket as u8 => PacketVersion::Legacy,
-            n if n == PacketSize::AckPacket as u8 => PacketVersion::Legacy,
-            n if n == PacketSize::ExtendedPacket8 as u8 => PacketVersion::Legacy,
-            n if n == PacketSize::ExtendedPacket16 as u8 => PacketVersion::Legacy,
-            n if n == PacketSize::ExtendedPacket32 as u8 => PacketVersion::Legacy,
-            n => PacketVersion::Versioned(n),
+impl TryFrom<u8> for PacketVersion {
+    type Error = InvalidPacketVersion;
+
+    fn try_from(value: u8) -> Result<Self, Self::Error> {
+        if value < INITIAL_PACKET_VERSION_NUMBER {
+            return Err(InvalidPacketVersion);
        }
+        Ok(PacketVersion(value))
+    }
+}
+
+impl From<PacketVersion> for u8 {
+    fn from(packet_version: PacketVersion) -> Self {
+        packet_version.0
    }
 }

 impl Default for PacketVersion {
    fn default() -> Self {
-        PacketVersion::Versioned(CURRENT_PACKET_VERSION_NUMBER)
+        PacketVersion::new()
    }
 }
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::chunking;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_crypto::Digest;
 use nym_sphinx_addressing::clients::Recipient;
 use nym_sphinx_addressing::nodes::MAX_NODE_ADDRESS_UNPADDED_LEN;
@@ -113,7 +113,8 @@ impl NymMessage {
        match self {
            NymMessage::Plain(data) => data,
            NymMessage::Repliable(repliable) => match repliable.content {
-                RepliableMessageContent::Data { message, .. } => message,
+                RepliableMessageContent::Data(content) => content.message,
+                RepliableMessageContent::DataV2(content) => content.message,
                _ => Vec::new(),
            },
            NymMessage::Reply(reply) => match reply.content {
@@ -183,7 +184,7 @@ impl NymMessage {
            // each plain or repliable packet attaches an ephemeral public key so that the recipient
            // could perform diffie-hellman with its own keys followed by a kdf to re-derive
            // the packet encryption key
-            NymMessage::Plain(_) | NymMessage::Repliable(_) => encryption::PUBLIC_KEY_SIZE,
+            NymMessage::Plain(_) | NymMessage::Repliable(_) => x25519::PUBLIC_KEY_SIZE,
            // each reply attaches the digest of the encryption key so that the recipient could
            // lookup correct key for decryption,
            NymMessage::Reply(_) => ReplySurbKeyDigestAlgorithm::output_size(),
@@ -309,6 +310,7 @@ mod tests {
        // a single variant for each repliable and reply is enough as they are more thoroughly tested
        // internally
        let repliable = NymMessage::new_repliable(RepliableMessage::new_data(
+            true,
            vec![1, 2, 3, 4, 5],
            [42u8; 16].into(),
            vec![],
@@ -4,7 +4,7 @@
 use crate::message::{NymMessage, ACK_OVERHEAD, OUTFOX_ACK_OVERHEAD};
 use crate::NymPayloadBuilder;
 use log::debug;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_crypto::Digest;
 use nym_sphinx_acknowledgements::surb_ack::SurbAck;
 use nym_sphinx_acknowledgements::AckKey;
@@ -51,29 +51,14 @@ impl From<PreparedFragment> for MixPacket {
 pub trait FragmentPreparer {
    type Rng: CryptoRng + Rng;

+    fn use_legacy_sphinx_format(&self) -> bool;
+
    fn deterministic_route_selection(&self) -> bool;
    fn rng(&mut self) -> &mut Self::Rng;
    fn nonce(&self) -> i32;
    fn average_packet_delay(&self) -> Duration;
    fn average_ack_delay(&self) -> Duration;

-    fn generate_reply_surbs(
-        &mut self,
-        amount: usize,
-        topology: &NymRouteProvider,
-        reply_recipient: &Recipient,
-    ) -> Result<Vec<ReplySurb>, NymTopologyError> {
-        let mut reply_surbs = Vec::with_capacity(amount);
-        let packet_delay = self.average_packet_delay();
-        for _ in 0..amount {
-            let reply_surb =
-                ReplySurb::construct(self.rng(), reply_recipient, packet_delay, topology)?;
-            reply_surbs.push(reply_surb)
-        }
-
-        Ok(reply_surbs)
-    }
-
    fn generate_surb_ack(
        &mut self,
        recipient: &Recipient,
@@ -83,9 +68,11 @@ pub trait FragmentPreparer {
        packet_type: PacketType,
    ) -> Result<SurbAck, NymTopologyError> {
        let ack_delay = self.average_ack_delay();
+        let use_legacy_sphinx_format = self.use_legacy_sphinx_format();

        SurbAck::construct(
            self.rng(),
+            use_legacy_sphinx_format,
            recipient,
            ack_key,
            fragment_id.to_bytes(),
@@ -203,7 +190,7 @@ pub trait FragmentPreparer {
        let destination = packet_recipient.gateway();
        monitoring::fragment_sent(&fragment, self.nonce(), destination);

-        let non_reply_overhead = encryption::PUBLIC_KEY_SIZE;
+        let non_reply_overhead = x25519::PUBLIC_KEY_SIZE;
        let expected_plaintext = match packet_type {
            PacketType::Outfox => {
                fragment.serialized_size() + OUTFOX_ACK_OVERHEAD + non_reply_overhead
@@ -264,14 +251,7 @@ pub trait FragmentPreparer {
                Some(packet_size.plaintext_size()),
            )?,
            PacketType::Mix => NymPacket::sphinx_build(
-                packet_size.payload_size(),
-                packet_payload,
-                &route,
-                &destination,
-                &delays,
-            )?,
-            #[allow(deprecated)]
-            PacketType::Vpn => NymPacket::sphinx_build(
+                self.use_legacy_sphinx_format(),
                packet_size.payload_size(),
                packet_payload,
                &route,
@@ -331,6 +311,10 @@ pub struct MessagePreparer<R> {
    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
    average_ack_delay: Duration,

+    /// Specify whether any constructed packets should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    use_legacy_sphinx_format: bool,
+
    nonce: i32,
 }

@@ -344,6 +328,7 @@ where
        sender_address: Recipient,
        average_packet_delay: Duration,
        average_ack_delay: Duration,
+        use_legacy_sphinx_format: bool,
    ) -> Self {
        let mut rng = rng;
        let nonce = rng.gen();
@@ -353,6 +338,7 @@ where
            sender_address,
            average_packet_delay,
            average_ack_delay,
+            use_legacy_sphinx_format,
            nonce,
        }
    }
@@ -364,6 +350,7 @@ where

    pub fn generate_reply_surbs(
        &mut self,
+        use_legacy_reply_surb_format: bool,
        amount: usize,
        topology: &NymRouteProvider,
    ) -> Result<Vec<ReplySurb>, NymTopologyError> {
@@ -373,6 +360,7 @@ where
                &mut self.rng,
                &self.sender_address,
                self.average_packet_delay,
+                use_legacy_reply_surb_format,
                topology,
            )?;
            reply_surbs.push(reply_surb)
@@ -454,6 +442,10 @@ where
 impl<R: CryptoRng + Rng> FragmentPreparer for MessagePreparer<R> {
    type Rng = R;

+    fn use_legacy_sphinx_format(&self) -> bool {
+        self.use_legacy_sphinx_format
+    }
+
    fn deterministic_route_selection(&self) -> bool {
        self.deterministic_route_selection
    }
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use nym_crypto::aes::cipher::{KeyIvInit, StreamCipher};
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_crypto::shared_key::new_ephemeral_shared_key;
 use nym_crypto::symmetric::stream_cipher;
 use nym_crypto::symmetric::stream_cipher::CipherKey;
@@ -67,7 +67,7 @@ impl NymPayloadBuilder {
    pub fn build_regular<R>(
        self,
        rng: &mut R,
-        recipient_encryption_key: &encryption::PublicKey,
+        recipient_encryption_key: &x25519::PublicKey,
    ) -> Result<NymPayload, SurbAckRecoveryError>
    where
        R: RngCore + CryptoRng,
@@ -3,7 +3,7 @@

 use crate::message::{NymMessage, NymMessageError, PaddedMessage, PlainMessage};
 use nym_crypto::aes::cipher::{KeyIvInit, StreamCipher};
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::x25519;
 use nym_crypto::shared_key::recompute_shared_key;
 use nym_crypto::symmetric::stream_cipher;
 use nym_crypto::symmetric::stream_cipher::CipherKey;
@@ -62,7 +62,7 @@ pub enum MessageRecoveryError {
    NotEnoughBytesForEphemeralKey { provided: usize, required: usize },

    #[error("Recovered remote x25519 public key is invalid - {0}")]
-    InvalidRemoteEphemeralKey(#[from] encryption::KeyRecoveryError),
+    InvalidRemoteEphemeralKey(#[from] x25519::KeyRecoveryError),

    #[error("The reconstructed message was malformed - {source}")]
    MalformedReconstructedMessage {
@@ -100,19 +100,19 @@ pub trait MessageReceiver {

    fn recover_plaintext_from_regular_packet<'a>(
        &self,
-        local_key: &encryption::PrivateKey,
+        local_key: &x25519::PrivateKey,
        raw_enc_frag: &'a mut [u8],
    ) -> Result<&'a mut [u8], MessageRecoveryError> {
-        if raw_enc_frag.len() < encryption::PUBLIC_KEY_SIZE {
+        if raw_enc_frag.len() < x25519::PUBLIC_KEY_SIZE {
            return Err(MessageRecoveryError::NotEnoughBytesForEphemeralKey {
                provided: raw_enc_frag.len(),
-                required: encryption::PUBLIC_KEY_SIZE,
+                required: x25519::PUBLIC_KEY_SIZE,
            });
        }

        // 1. recover remote encryption key
-        let remote_key_bytes = &raw_enc_frag[..encryption::PUBLIC_KEY_SIZE];
-        let remote_ephemeral_key = encryption::PublicKey::from_bytes(remote_key_bytes)?;
+        let remote_key_bytes = &raw_enc_frag[..x25519::PUBLIC_KEY_SIZE];
+        let remote_ephemeral_key = x25519::PublicKey::from_bytes(remote_key_bytes)?;

        // 2. recompute shared encryption key
        let encryption_key = recompute_shared_key::<PacketEncryptionAlgorithm, PacketHkdfAlgorithm>(
@@ -121,7 +121,7 @@ pub trait MessageReceiver {
        );

        // 3. decrypt fragment data
-        let fragment_ciphertext = &mut raw_enc_frag[encryption::PUBLIC_KEY_SIZE..];
+        let fragment_ciphertext = &mut raw_enc_frag[x25519::PUBLIC_KEY_SIZE..];

        self.decrypt_raw_message::<PacketEncryptionAlgorithm>(
            fragment_ciphertext,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Yana	28b4fe7e7e	add 10 recommended nodes	2025-06-05 12:33:43 +03:00
Yana	9479d2a383	Add recommended nodes	2025-06-04 19:47:53 +03:00
Yana	886b4410aa	Fix open in new tab click on NodeTable	2025-06-03 14:28:17 +03:00
Yana	b51358fb12	Style fixes	2025-05-22 14:24:24 +03:00
Yana	53e3acaa37	Add countries and locations to WorldMap	2025-05-21 17:11:52 +03:00
Yana	978817baf7	fix build	2025-05-15 19:20:16 +03:00
Yana	9319a5ec04	fix self-bond, redirect articles to nym/blog	2025-05-15 19:15:29 +03:00
Yana	3186db2915	style fixes	2025-05-14 20:47:26 +03:00
Yana	ff7671f28a	update copy	2025-05-14 20:38:07 +03:00
Yana	cbe8eec2a4	fix dark mode font color	2025-05-14 19:53:07 +03:00
Yana	42f9edd408	Add self-bond and operating costs to NodeTable	2025-05-14 19:40:31 +03:00
Yana	128cf7c070	Add colors on uptime	2025-05-09 15:46:50 +03:00
Yana	79e5004849	revamp NodeTable	2025-05-09 15:27:54 +03:00
Yana	0d6722f9f5	'Change footer version to 2.2	2025-05-08 15:17:28 +03:00
Yana	d458df9c34	fix build	2025-05-08 15:08:48 +03:00
Yana	7a8ac59a36	Add default sorting by country to Node tables	2025-05-08 14:56:04 +03:00
Yana	ad3eb7a84c	fix build	2025-05-07 19:54:09 +03:00
Yana	135f248eba	Replace spectreDao delegations	2025-05-07 18:59:05 +03:00
Yana	7012bf9886	Add node count on every quick filter	2025-05-06 16:25:40 +03:00
Yana	88aa32ddeb	Fix advanced filtering UI	2025-05-06 16:15:23 +03:00
Yana	7c1c9976f0	fix build	2025-05-04 19:27:47 +03:00
Yana	4ee7f7eaf5	Fix saturation filter	2025-05-04 19:23:35 +03:00
Yana	778772d96a	fix build	2025-05-04 19:16:30 +03:00
Yana	5b791b41aa	Add advanced filters	2025-05-04 19:13:34 +03:00
Yana	4b7e51fc3b	Add quick filters on NodeTable	2025-05-04 11:27:29 +03:00
Yana	0a42dd3e0d	fix mobile map	2025-04-22 20:20:44 +03:00
Yana	7cf49f642d	fix images	2025-04-22 19:47:40 +03:00
Yana	089ab65dd7	Fix maps	2025-04-22 18:51:29 +03:00
Yana	c1fabae770	Clean up	2025-04-17 18:25:43 +03:00
Yana	3ed7cfa381	Replace SpectreDao on AccountPageButtonGroup	2025-04-17 18:21:30 +03:00
Yana	4fe83da99d	Replace SpectreDao api in Staking Table	2025-04-17 18:16:13 +03:00
Yana	4f81fc7400	Replace SpectreDao api on Magic Search	2025-04-17 17:55:52 +03:00
Yana	6d601ca654	Replace SpectreDao api on Stakers Card	2025-04-17 17:46:35 +03:00
Yana	cea3ad9908	Add dark mode on error cards	2025-04-17 17:36:27 +03:00
Yana	e4ecd099cc	Add dark mode on error cards	2025-04-17 17:28:08 +03:00
Yana	0723542c39	clean up	2025-04-16 21:20:14 +03:00
Yana	523e559ff8	clean up	2025-04-16 21:17:15 +03:00
Yana	02b27573de	clean up	2025-04-16 21:08:31 +03:00
Yana	8f229737a3	Replace SpectreDao on NodeTable and Node page	2025-04-16 21:06:12 +03:00
Yana	1afd13d6e0	Clean up	2025-04-16 15:27:53 +03:00
Yana	df10b5595a	Add styles	2025-04-16 15:23:05 +03:00
Yana	443031ba66	test data fetching	2025-04-16 13:37:35 +03:00
Yana	8d340a49d3	fix data fetching	2025-04-16 09:57:27 +03:00
Yana	e0925d3c7f	clean up	2025-04-16 08:40:34 +03:00
Yana	89d391da29	fix build	2025-04-16 08:13:21 +03:00
Yana	cc2d7d34d2	reset last changes	2025-04-16 08:05:04 +03:00
Yana	969070f938	fix build, fix map sizes	2025-04-15 21:38:05 +03:00
Yana	3dfcae9369	fix build	2025-04-15 21:04:58 +03:00
Yana	32a4bf1172	fix build	2025-04-15 20:54:37 +03:00
Yana	433cac8c58	Fix map sizing	2025-04-15 18:15:00 +03:00
Yana	4fc64a072c	Add WorldMap	2025-04-15 16:47:37 +03:00
Yana Matrosova	2c7df5766c	Merge pull request #5706 from nymtech/yana/explorer-caching Yana/explorer caching	2025-04-14 10:03:44 -07:00
Yana	7ca2559f99	Add caching on tanstack queries clean up Another try clean up fix build fix build fix build fix build Refactor Node page to accept identity_key in params fix build fix build fix buggy data on landing page graphs Try fix gas fee for redeem all rewards Another try to fix gas fee for redeem rewards Add fees "auto" to the cosmWasm client with offline signer comment out unused option add getOfflineSigner dependency to the callback fn comment out for good clean up, optimise homepage layout Dark theme fix build fix build add fixes Rebase onto develop, fix lint error fix build Fix tooltip Fix switch button on mobile header fix build clean up fix build Fix switch component fix build Add moniker to Magic Search, fix tooltip hover on landing page refactor urls fix build edit placeholder Fix styles fix error message	2025-04-14 17:01:44 +03:00
Jędrzej Stuczyński	84db9f6bcd	chore: rename 'identity' module to 'ed25519' and 'encryption' to 'x25519' (#5707 )	2025-04-13 11:58:25 +01:00
dynco-nym	660463908d	Expand /v3/nym-nodes with geodata (#5686 ) * Expand /v3/nym-nodes - includes node description and geodata - expanded scope of included geodata * Fetch geodata for all nodes * Bump package version	2025-04-10 21:12:33 +02:00
dependabot[bot]	0be844e015	build(deps): bump crossbeam-channel from 0.5.14 to 0.5.15 (#5702 )	2025-04-10 20:06:50 +02:00
Yana Matrosova	efa6e7d7c7	Merge pull request #5669 from nymtech/yana/explorer-caching Yana/explorer caching	2025-04-10 18:41:31 +03:00
dynco-nym	33c783bb7c	Bump package version	2025-04-10 17:22:21 +02:00
Bogdan-Ștefan Neacşu	16059211b9	Add contains ticketbook data db query (#5670 ) * Add contains ticketbook data db query * Fix clippy * Use exists for better performance	2025-04-10 18:21:50 +03:00
Yana	bb6c920767	fix build	2025-04-10 17:24:40 +03:00
Yana	8c4df963c9	Fix switch button on mobile header	2025-04-10 17:23:04 +03:00
Yana	af737596ca	Fix tooltip	2025-04-10 16:50:45 +03:00
Jędrzej Stuczyński	af2c4f50b6	Feature/updated sphinx payload keys (#5698 ) * removed support for legacy packet types from NymCodec I think nodes had plenty of time to upgrade given versioned variant was introduced in 2022 * temp: use local sphinx packet for development * introduce new messages that use more efficient reply surbs encoding * checks for incorrect encoding * generate correct message depending on config value * fixed current packet version * made packet type selection configurable * updated sphinx packet crate to the published version * fixed wasm build * fixes in outfox due to sphinx api changes * additional tests * clippy * fixed log/tracing import	2025-04-10 13:43:29 +01:00
Jędrzej Stuczyński	02ed64557d	chore: removed old explorer-api (#5701 )	2025-04-10 11:26:24 +01:00
Yana	38dabd8d0d	fix build	2025-04-10 11:38:43 +03:00
Yana	d9de5cfa33	Rebase onto develop, fix lint error	2025-04-10 11:29:13 +03:00
Yana	bdfbfde463	add fixes	2025-04-10 11:14:58 +03:00
Yana	5179f38ad2	fix build	2025-04-10 11:14:54 +03:00
Yana	f4e9abcd22	fix build	2025-04-10 11:14:54 +03:00
Yana	46ebd84b02	Dark theme	2025-04-10 11:14:54 +03:00
Yana	d8d2f99a18	clean up, optimise homepage layout	2025-04-10 11:14:49 +03:00
Yana	cd3ec5f3bd	comment out for good	2025-04-10 11:14:49 +03:00
Yana	32a16ef025	add getOfflineSigner dependency to the callback fn	2025-04-10 11:14:48 +03:00
Yana	6af4e44f55	comment out unused option	2025-04-10 11:14:48 +03:00
Yana	3cddc594b4	Add fees "auto" to the cosmWasm client with offline signer	2025-04-10 11:14:48 +03:00
Yana	d11aaed392	Another try to fix gas fee for redeem rewards	2025-04-10 11:14:48 +03:00
Yana	1bead28150	Try fix gas fee for redeem all rewards	2025-04-10 11:14:48 +03:00
Yana	735bed5cd7	fix buggy data on landing page graphs	2025-04-10 11:14:48 +03:00
Yana	12e0d34885	fix build	2025-04-10 11:14:48 +03:00
Yana	43af3b8a3b	fix build	2025-04-10 11:14:48 +03:00
Yana	8ff96b11c9	Refactor Node page to accept identity_key in params	2025-04-10 11:14:48 +03:00
Yana	df453158d6	fix build	2025-04-10 11:14:36 +03:00
Yana	abeeadb661	fix build	2025-04-10 11:14:36 +03:00
Yana	752fe7fa0f	fix build	2025-04-10 11:14:36 +03:00
Yana	c5ec682088	fix build	2025-04-10 11:14:36 +03:00
Yana	58a569cd26	clean up	2025-04-10 11:14:36 +03:00
Yana	2e767a2586	Another try	2025-04-10 11:14:35 +03:00
Yana	dc772d8759	clean up	2025-04-10 11:14:35 +03:00
Yana	9e70c7a32d	Add caching on tanstack queries	2025-04-10 11:14:35 +03:00
Jon Häggblad	ba5e86e842	Bump the nym-vpn deb metapackage to 1.0 (#5697 )	2025-04-09 18:07:55 +02:00
Tommy Verrall	b7313656e9	Merge pull request #5699 from nymtech/fix/sign-in-page-wallet Allow copy and paste on logins fields for the wallet	2025-04-09 15:15:28 +01:00
Tommy Verrall	2eb695088f	linting and yarn - modify log screen	2025-04-09 16:14:11 +02:00
Tommy Verrall	eb612d47c0	Allow copy and paste on logins - allow shell open for linking - some platforms it's not working as expected	2025-04-09 14:55:12 +02:00
benedetta davico	2ba7b26e5d	Merge pull request #5659 from nymtech/benny/revamp-api-tests Adding fresh nym-api tests and workflow	2025-04-09 13:13:24 +02:00
Tommy Verrall	4cd0f7b56f	Merge pull request #5687 from nymtech/feature/test-v2 Tauri V2 - Wallet Migration	2025-04-09 12:09:41 +01:00
Tommy Verrall	600bf42a95	conflicts	2025-04-09 12:51:31 +02:00
Tommy Verrall	748e3e4248	fix remaining lint and cargo clippy errors	2025-04-09 12:46:03 +02:00
dependabot[bot]	8cf1b6427a	build(deps): bump tokio from 1.44.0 to 1.44.2 in /nym-wallet (#5694 )	2025-04-09 12:40:37 +02:00
Tommy Verrall	7a888c6fdf	fix wallet ci	2025-04-09 12:17:02 +02:00
Tommy Verrall	9a9bb89d89	fix lint again	2025-04-09 12:14:49 +02:00
Tommy Verrall	4cc14ddcc4	cargo fmt - hopefully the last	2025-04-09 11:53:47 +02:00
Tommy Verrall	2dbf9d97cb	yarn lint fix	2025-04-09 11:47:10 +02:00
Tommy Verrall	91b6f3cc3e	paste not working from currency form - removed shellhelper too	2025-04-09 11:22:09 +02:00
Tommy Verrall	84cccffcbd	Fix PR comments - removed the shell open in favour of the tauri plugin for opening - cleaned up some code - added a few packages	2025-04-09 10:27:25 +02:00
benedetta davico	7de346cf89	add env	2025-04-09 10:07:55 +02:00
benedetta davico	d6c40aee01	add env	2025-04-09 10:07:49 +02:00
Tommy Verrall	af16b3f059	first code review comments	2025-04-09 09:12:21 +02:00
Tommy Verrall	b1cde0716e	Fix delegation list	2025-04-08 20:10:05 +02:00
Tommy Verrall	45bcdb03d8	fix delegations page - after overflow	2025-04-08 19:29:32 +02:00
benedetta davico	0841b8701d	change path	2025-04-08 19:04:47 +02:00
benedetta davico	7ae228d8f4	change path	2025-04-08 19:03:58 +02:00
benedetta davico	916d33c8c0	Update nym-api-integration-tests.yml	2025-04-08 18:55:57 +02:00
benedetta davico	9b4b2d1a46	Update Makefile	2025-04-08 18:55:25 +02:00
benedettadavico	aef0a52c4b	fix workflow typo	2025-04-08 18:49:40 +02:00
Tommy Verrall	44682b5ef0	removed duplicates and reverted back to 1.2.18 as a version	2025-04-08 18:46:52 +02:00
benedettadavico	f282ffd8a6	remove missed line	2025-04-08 18:42:44 +02:00
benedettadavico	dfbeb8b1f8	reformatting, tidying up	2025-04-08 18:38:18 +02:00
benedettadavico	fc06fe39a2	more clippy fixes	2025-04-08 17:43:36 +02:00
benedettadavico	caa94c142f	fix clippy	2025-04-08 17:15:47 +02:00
benedettadavico	1a5c54084e	fmt	2025-04-08 17:01:46 +02:00
benedettadavico	49d203e18d	better response handling	2025-04-08 16:59:30 +02:00
Tommy Verrall	51c9b012e2	merge conflicts	2025-04-08 16:50:45 +02:00
Tommy Verrall	50b1175622	Merge branch 'develop' into feature/test-v2	2025-04-08 16:40:00 +02:00
Tommy Verrall	29ee5984fb	fix all workflows	2025-04-08 16:21:15 +02:00
Tommy Verrall	e542b25ffc	bump to version 2.0.0 - it's a big release therefore let's semver it correctly	2025-04-08 16:03:36 +02:00
Tommy Verrall	516d3f04cf	No need to publish these to the build server just use the artifacts	2025-04-08 15:57:20 +02:00
benedetta davico	9225e0a630	Merge branch 'develop' into benny/revamp-api-tests	2025-04-08 15:43:31 +02:00
Tommy Verrall	08c09781c7	Fixing all yarn lint errors	2025-04-08 14:36:42 +02:00
benedettadavico	36a4d96f34	cargo fmt	2025-04-08 13:48:42 +02:00
benedettadavico	139c911350	use env var for api url and make asserts uniform	2025-04-08 13:40:17 +02:00
Tommy Verrall	c92de832e4	remove arg	2025-04-08 12:12:13 +02:00
Tommy Verrall	d9d62195cb	try again	2025-04-08 12:05:28 +02:00
Tommy Verrall	da9115d51b	format	2025-04-08 11:58:48 +02:00
benedettadavico	bfddc1e4c1	clean up the test dir	2025-04-08 11:56:45 +02:00
benedettadavico	080d75204e	first commit to cleaning up nym-api tests	2025-04-08 11:56:45 +02:00
Tommy Verrall	1367cad99d	another attempt	2025-04-08 11:54:47 +02:00
Tommy Verrall	4f6d65ab95	revert previous add more logging	2025-04-08 11:50:27 +02:00
Tommy Verrall	4292d8ac03	update windows build	2025-04-08 11:40:50 +02:00
Tommy Verrall	dcb6de2421	tauri path	2025-04-08 11:22:38 +02:00
Tommy Verrall	1f5ed41bb3	correct tauri path	2025-04-08 11:21:53 +02:00
Tommy Verrall	091e98aa74	attempt windows build	2025-04-08 11:14:19 +02:00
Jędrzej Stuczyński	0e38126fc5	Feature/replay protection (#5682 ) * remove old packettype + fix: apply routing filter BEFORE delaying * updated sphinx crate for allow usage of reply tags * full pipeline for placeholder checking of packet replay * replay protection with batched insertion * running background task for clearing/flushing the BF * allow disabling the replay detection + cleanup * allow unwrap in bench code	2025-04-08 09:50:25 +01:00
Tommy Verrall	ecbe192a88	try 22.04	2025-04-08 10:20:50 +02:00
Tommy Verrall	f0ee49788c	test old runner first	2025-04-08 10:18:32 +02:00
Tommy Verrall	d2ff3cb88d	fix app deps	2025-04-08 10:15:27 +02:00
Tommy Verrall	873d15a5e1	update runner platform	2025-04-08 10:13:30 +02:00
Tommy Verrall	53792cc839	Update runner for linux	2025-04-08 10:00:22 +02:00
Tommy Verrall	415ef1bf13	attempt to push to ci	2025-04-08 09:53:35 +02:00
benedettadavico	edfe29b738	bump versions	2025-04-08 09:46:48 +02:00
Tommy Verrall	a4f6426bf9	Update account display	2025-04-08 09:32:46 +02:00
dependabot[bot]	0870911b3c	build(deps): bump tokio from 1.44.1 to 1.44.2 (#5693 )	2025-04-08 08:01:40 +02:00
Tommy Verrall	9f23887cc0	Input fields	2025-04-07 20:07:15 +02:00
Tommy Verrall	8ab269fa05	Jazz up receive modal	2025-04-07 17:16:22 +02:00
Tommy Verrall	7b75f22a8e	Remove legacy	2025-04-07 15:27:54 +02:00
Tommy Verrall	ca0449e03d	Init clipboard manager	2025-04-07 14:22:55 +02:00
Tommy Verrall	224e63d275	Rename and update	2025-04-07 11:37:22 +02:00
Tommy Verrall	3d77283056	Add pruning warning errors	2025-04-07 10:29:03 +02:00
Tommy Verrall	7cc473005b	More permissions errors - fix more perm errors - enabled the version in the wallet	2025-04-07 10:09:47 +02:00
Tommy Verrall	f874284850	- Update beyond tauri v2 - use the latest and greatest - fixed links to use the command shell - app version changes, need to be fixed to allow the auto updater too work	2025-04-04 18:47:35 +02:00
Tommy Verrall	7b6077ba64	update to log in - next up fix hyperlinks	2025-04-04 13:56:20 +02:00
dynco-nym	0d4188785b	Fetch geodata for all nodes	2025-04-04 13:00:25 +02:00
dynco-nym	86c05267c2	Expand /v3/nym-nodes - includes node description and geodata - expanded scope of included geodata	2025-04-03 22:45:28 +02:00
Tommy Verrall	b4865520a4	Revert "add the base points back in" This reverts commit `400aa6ba6d`.	2025-04-02 15:36:49 +02:00
Tommy Verrall	f52ebfb9c3	Merge remote-tracking branch 'origin/feature/test-v2' into feature/test-v2	2025-04-02 15:34:12 +02:00
Tommy Verrall	6ca2a3c539	migrate to v2 - lots to check and do	2025-04-02 15:22:27 +02:00
Tommy Verrall	717c9066d6	Merge remote-tracking branch 'origin/feature/test-v2' into feature/test-v2	2025-04-02 15:18:26 +02:00
Tommy Verrall	2760a17323	add the base points back in - now i've reverted back to the original two here, as the compiler is failing around `tauri::api::path` however, looking into the new design for the path resolver in tower this tasks, requires pratically changing the whole wallet_strorage and config set up - it seems pretty straight forward https://v2.tauri.app/start/migrate/from-tauri-1/#migrate-path-to-tauri-manager - however, I would need a second set of eyes on this	2025-04-02 15:18:11 +02:00
Tommy Verrall	4e9f1bc0ed	migrate to v2 - lots to check and do	2025-04-02 15:17:44 +02:00
Tommy Verrall	d35023d14b	Merge remote-tracking branch 'origin/feature/test-v2' into feature/test-v2	2025-04-02 15:14:02 +02:00
Tommy Verrall	400aa6ba6d	add the base points back in - now i've reverted back to the original two here, as the compiler is failing around `tauri::api::path` however, looking into the new design for the path resolver in tower this tasks, requires pratically changing the whole wallet_strorage and config set up - it seems pretty straight forward https://v2.tauri.app/start/migrate/from-tauri-1/#migrate-path-to-tauri-manager - however, I would need a second set of eyes on this	2025-04-02 15:13:42 +02:00
Tommy Verrall	2ba74ae120	migrate to v2 - lots to check and do	2025-04-02 15:13:42 +02:00
Tommy Verrall	9a4293a5b9	add the base points back in - now i've reverted back to the original two here, as the compiler is failing around `tauri::api::path` however, looking into the new design for the path resolver in tower this tasks, requires pratically changing the whole wallet_strorage and config set up - it seems pretty straight forward https://v2.tauri.app/start/migrate/from-tauri-1/#migrate-path-to-tauri-manager - however, I would need a second set of eyes on this	2025-04-02 08:53:40 +02:00
Tommy Verrall	cdddb44099	migrate to v2 - lots to check and do	2025-04-01 17:06:21 +02:00