Manual merge of #810

Unused import
Using default rocket build (that uses Rocket.toml)
2021-10-11 10:55:03 +01:00 · 2021-10-11 10:46:28 +01:00 · 2021-10-04 10:54:09 +01:00 · 2021-09-30 15:13:08 +01:00 · 2021-09-30 15:00:45 +01:00 · 2021-09-28 10:55:14 +01:00
475 changed files with 84830 additions and 10596 deletions
@@ -3,7 +3,7 @@ name: Continuous integration
 on: [push, pull_request]

 jobs:
-  ci:
+  build:
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.rust == 'nightly' || matrix.rust == 'beta' }}
    strategy:
@@ -12,6 +12,10 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        if: matrix.os == 'ubuntu-latest'
+
      - uses: actions/checkout@v2

      - uses: actions-rs/toolchain@v1
@@ -21,52 +25,24 @@ jobs:
          override: true
          components: rustfmt, clippy

-      # main repo
      - uses: actions-rs/cargo@v1
        with:
          command: build
          args: --all

-      # validator API
-      - uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path validator-api/Cargo.toml

-      # main repo
      - uses: actions-rs/cargo@v1
        with:
          command: test
          args: --all

-      # validator API
-      - uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path validator-api/Cargo.toml
-
-      # main repo
      - uses: actions-rs/cargo@v1
        with:
          command: fmt
          args: --all -- --check

-      # validator API
-      - uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path validator-api/Cargo.toml  -- --check
-
-      # main repo
      - uses: actions-rs/cargo@v1
        if: ${{ matrix.rust != 'nightly' }}
        with:
          command: clippy
          args: -- -D warnings
-
-      # validator API
-      - uses: actions-rs/cargo@v1
-        if: ${{ matrix.rust != 'nightly' }}
-        with:
-          command: clippy
-          args: --manifest-path validator-api/Cargo.toml -- -D warnings
@@ -3,7 +3,7 @@ name: Mixnet Contract
 on: [push, pull_request]

 jobs:
-  ci:
+  mixnet-contract:
    # since it's going to be compiled into wasm, there's absolutely
    # no point in running CI on different OS-es
    runs-on: ubuntu-latest
@@ -0,0 +1,22 @@
+name: Generate TS types
+
+on: push
+
+jobs:
+  tauri-wallet-types:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Prepare
+        run: sudo apt-get update && sudo apt-get install -y libpango1.0-dev libatk1.0-dev libgdk-pixbuf2.0-dev libsoup2.4-dev librust-gdk-dev libwebkit2gtk-4.0-dev
+      - uses: actions/checkout@v2
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+      - name: Generate TS
+        run: cd tauri-wallet/src-tauri && cargo test
+      - uses: EndBug/add-and-commit@v7.2.1 # https://github.com/marketplace/actions/add-commit
+        with:
+          add: '["tauri-wallet"]'
+          message: '[ci skip] Generate TS types'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -3,7 +3,7 @@ name: Wasm Client
 on: [push, pull_request]

 jobs:
-  ci:
+  wasm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
@@ -29,3 +29,4 @@ v6-topology.json
 validator-api/v4.json
 validator-api/v6.json
 **/node_modules
+validator-api/keypair
@@ -11,18 +11,22 @@ panic = "abort"
 [workspace]

 members = [
+    "clients/client-core",
    "clients/native",
    "clients/native/websocket-requests",
    "clients/socks5",
+    "clients/tauri-client/src-tauri",
    "clients/webassembly",
-    "clients/client-core",
    "common/client-libs/gateway-client",
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
+    "common/coconut-interface",
    "common/config",
+    "common/credentials",
    "common/crypto",
    "common/mixnet-contract",
    "common/mixnode-common",
+    "common/network-defaults",
    "common/nonexhaustive-delayqueue",
    "common/nymsphinx",
    "common/nymsphinx/acknowledgements",
@@ -35,15 +39,16 @@ members = [
    "common/nymsphinx/params",
    "common/nymsphinx/types",
    "common/pemstore",
-    "common/socks5/requests",
    "common/socks5/proxy-helpers",
+    "common/socks5/requests",
    "common/topology",
    "common/wasm-utils",
+    "explorer-api",
    "gateway",
    "gateway/gateway-requests",
    "mixnode",
-#    "validator-api",
    "service-providers/network-requester",
+    "validator-api",
 ]

 default-members = [
@@ -53,7 +58,7 @@ default-members = [
    "gateway",
    "service-providers/network-requester",
    "mixnode",
-#    "validator-api",
+    "validator-api",
 ]

-exclude = ["explorer", "contracts", "validator-api"]
+exclude = ["explorer", "contracts"]
@@ -15,6 +15,7 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * nym-gateway - acts sort of like a mailbox for mixnet messages, removing the need for directly delivery to potentially offline or firewalled devices.
 * nym-network-monitor - sends packets through the full system to check that they are working as expected, and stores node uptime histories as the basis of a rewards system ("mixmining" or "proof-of-mixing").
 * nym-explorer - a (projected) block explorer and (existing) mixnet viewer.
+* nym-wallet (currently in development)- a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework. 

 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
 [![Build Status](https://img.shields.io/github/workflow/status/nymtech/nym/Continuous%20integration/develop?style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
@@ -15,6 +15,7 @@ rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 serde = { version = "1.0", features = ["derive"] }
 sled = "0.34"
 tokio = { version = "1.4", features = ["macros"] }
+url = { version ="2.2", features = ["serde"] }

 # internal
 config = { path = "../../common/config" }
@@ -61,8 +61,8 @@ impl KeyManager {
    // I have absolutely no idea why the compiler insists it's unused. The call happens during client::init::execute
    #[allow(dead_code)]
    /// After shared key with the gateway is derived, puts its ownership to this instance of a [`KeyManager`].
-    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: SharedKeys) {
-        self.gateway_shared_key = Some(Arc::new(gateway_shared_key))
+    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: Arc<SharedKeys>) {
+        self.gateway_shared_key = Some(gateway_shared_key)
    }

    /// Loads previously stored keys from the disk.
@@ -13,7 +13,6 @@ use crate::client::{inbound_messages::InputMessageReceiver, topology_control::To
 use futures::channel::mpsc;
 use gateway_client::AcknowledgementReceiver;
 use log::*;
-use nymsphinx::params::PacketMode;
 use nymsphinx::{
    acknowledgements::AckKey,
    addressing::clients::Recipient,
@@ -120,14 +119,6 @@ pub(super) struct Config {

    /// Average delay a data packet is going to get delayed at a single mixnode.
    average_packet_delay: Duration,
-
-    /// Mode of all mix packets created - VPN or Mix. They indicate whether packets should get delayed
-    /// and keys reused.
-    packet_mode: PacketMode,
-
-    /// If the mode of the client is set to VPN it specifies number of packets created with the
-    /// same initial secret until it gets rotated.
-    vpn_key_reuse_limit: Option<usize>,
 }

 impl Config {
@@ -136,16 +127,12 @@ impl Config {
        ack_wait_multiplier: f64,
        average_ack_delay: Duration,
        average_packet_delay: Duration,
-        packet_mode: PacketMode,
-        vpn_key_reuse_limit: Option<usize>,
    ) -> Self {
        Config {
            ack_wait_addition,
            ack_wait_multiplier,
            average_ack_delay,
            average_packet_delay,
-            packet_mode,
-            vpn_key_reuse_limit,
        }
    }
 }
@@ -186,8 +173,6 @@ where
            ack_recipient,
            config.average_packet_delay,
            config.average_ack_delay,
-            config.packet_mode,
-            config.vpn_key_reuse_limit,
        );

        // will listen for any acks coming from the network
@@ -19,7 +19,6 @@ use gateway_client::AcknowledgementReceiver;
 use log::*;
 use nymsphinx::acknowledgements::AckKey;
 use nymsphinx::addressing::clients::Recipient;
-use nymsphinx::params::PacketMode;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::sync::Arc;
 use std::time::Duration;
@@ -51,20 +50,9 @@ pub struct Config {

    /// Average delay an acknowledgement packet is going to get delayed at a single mixnode.
    average_ack_delay_duration: Duration,
-
-    /// Mode of all mix packets created - VPN or Mix. They indicate whether packets should get delayed
-    /// and keys reused.
-    packet_mode: PacketMode,
-
-    /// If the mode of the client is set to VPN it specifies number of packets created with the
-    /// same initial secret until it gets rotated.
-    vpn_key_reuse_limit: Option<usize>,
 }

 impl Config {
-    // at this point I'm not entirely sure how to deal with this warning without
-    // some considerable refactoring
-    #[allow(clippy::too_many_arguments)]
    pub fn new(
        ack_key: Arc<AckKey>,
        ack_wait_multiplier: f64,
@@ -73,8 +61,6 @@ impl Config {
        average_message_sending_delay: Duration,
        average_packet_delay_duration: Duration,
        self_recipient: Recipient,
-        packet_mode: PacketMode,
-        vpn_key_reuse_limit: Option<usize>,
    ) -> Self {
        Config {
            ack_key,
@@ -84,8 +70,6 @@ impl Config {
            average_message_sending_delay,
            average_packet_delay_duration,
            average_ack_delay_duration,
-            packet_mode,
-            vpn_key_reuse_limit,
        }
    }
 }
@@ -126,8 +110,6 @@ impl RealMessagesController<OsRng> {
            config.ack_wait_multiplier,
            config.average_ack_delay_duration,
            config.average_packet_delay_duration,
-            config.packet_mode,
-            config.vpn_key_reuse_limit,
        );

        let ack_control = AcknowledgementController::new(
@@ -163,7 +145,7 @@ impl RealMessagesController<OsRng> {
        }
    }

-    pub(super) async fn run(&mut self, vpn_mode: bool) {
+    pub(super) async fn run(&mut self) {
        let mut out_queue_control = self.out_queue_control.take().unwrap();
        let mut ack_control = self.ack_control.take().unwrap();

@@ -171,7 +153,7 @@ impl RealMessagesController<OsRng> {
        // the task to ever finish. This will of course change once we introduce
        // graceful shutdowns.
        let out_queue_control_fut = tokio::spawn(async move {
-            out_queue_control.run_out_queue_control(vpn_mode).await;
+            out_queue_control.run_out_queue_control().await;
            error!("The out queue controller has finished execution!");
            out_queue_control
        });
@@ -190,9 +172,9 @@ impl RealMessagesController<OsRng> {

    // &Handle is only passed for consistency sake with other client modules, but I think
    // when we get to refactoring, we should apply gateway approach and make it implicit
-    pub fn start(mut self, handle: &Handle, vpn_mode: bool) -> JoinHandle<Self> {
+    pub fn start(mut self, handle: &Handle) -> JoinHandle<Self> {
        handle.spawn(async move {
-            self.run(vpn_mode).await;
+            self.run().await;
            self
        })
    }
@@ -249,15 +249,6 @@ where
        tokio::task::yield_now().await;
    }

-    async fn on_batch_received(&mut self, real_messages: Vec<RealMessage>) {
-        let mut mix_packets = Vec::with_capacity(real_messages.len());
-        for real_message in real_messages.into_iter() {
-            self.sent_notify(real_message.fragment_id);
-            mix_packets.push(real_message.mix_packet);
-        }
-        self.mix_tx.unbounded_send(mix_packets).unwrap();
-    }
-
    // Send messages at certain rate and if no real traffic is available, send cover message.
    async fn run_normal_out_queue(&mut self) {
        // we should set initial delay only when we actually start the stream
@@ -271,20 +262,8 @@ where
        }
    }

-    // Send real message as soon as it's available and don't inject ANY cover traffic.
-    async fn run_vpn_out_queue(&mut self) {
-        while let Some(next_messages) = self.real_receiver.next().await {
-            self.on_batch_received(next_messages).await
-        }
-    }
-
-    pub(crate) async fn run_out_queue_control(&mut self, vpn_mode: bool) {
-        if vpn_mode {
-            debug!("Starting out queue controller in vpn mode...");
-            self.run_vpn_out_queue().await
-        } else {
-            debug!("Starting out queue controller...");
-            self.run_normal_out_queue().await
-        }
+    pub(crate) async fn run_out_queue_control(&mut self) {
+        debug!("Starting out queue controller...");
+        self.run_normal_out_queue().await
    }
 }
@@ -18,7 +18,7 @@ pub enum ReplyKeyStorageError {
 /// Permanent storage for keys in all sent [`ReplySURB`]
 ///
 /// Each sent out [`ReplySURB`] has a new key associated with it that is going to be used for
-/// payload encryption. In order to decrypt whatever reply we receive, we need to know which
+/// payload encryption. In order to -decrypt whatever reply we receive, we need to know which
 /// key to use for that purpose. We do it based on received `H(t)` which has to be included
 /// with each reply.
 /// Moreover, there is no restriction when the [`ReplySURB`] might get used so we need to
@@ -4,6 +4,8 @@
 use log::*;
 use nymsphinx::addressing::clients::Recipient;
 use nymsphinx::params::DEFAULT_NUM_MIX_HOPS;
+use rand::seq::SliceRandom;
+use rand::thread_rng;
 use std::ops::Deref;
 use std::sync::Arc;
 use std::time;
@@ -12,6 +14,7 @@ use tokio::runtime::Handle;
 use tokio::sync::{RwLock, RwLockReadGuard};
 use tokio::task::JoinHandle;
 use topology::{nym_topology_from_bonds, NymTopology};
+use url::Url;

 // I'm extremely curious why compiler NEVER complained about lack of Debug here before
 #[derive(Debug)]
@@ -125,54 +128,61 @@ impl Default for TopologyAccessor {
 }

 pub struct TopologyRefresherConfig {
-    available_validators: Vec<String>,
-    mixnet_contract_address: String,
+    validator_api_urls: Vec<Url>,
    refresh_rate: time::Duration,
 }

 impl TopologyRefresherConfig {
-    pub fn new(
-        available_validators: Vec<String>,
-        mixnet_contract_address: String,
-        refresh_rate: time::Duration,
-    ) -> Self {
+    pub fn new(validator_api_urls: Vec<Url>, refresh_rate: time::Duration) -> Self {
        TopologyRefresherConfig {
-            available_validators,
-            mixnet_contract_address,
+            validator_api_urls,
            refresh_rate,
        }
    }
 }

 pub struct TopologyRefresher {
-    validator_client: validator_client::Client,
+    validator_client: validator_client::ApiClient,

+    validator_api_urls: Vec<Url>,
    topology_accessor: TopologyAccessor,
    refresh_rate: Duration,

+    currently_used_api: usize,
    was_latest_valid: bool,
 }

 impl TopologyRefresher {
-    pub fn new(cfg: TopologyRefresherConfig, topology_accessor: TopologyAccessor) -> Self {
-        let validator_client_config =
-            validator_client::Config::new(cfg.available_validators, cfg.mixnet_contract_address);
-        let validator_client = validator_client::Client::new(validator_client_config);
+    pub fn new(mut cfg: TopologyRefresherConfig, topology_accessor: TopologyAccessor) -> Self {
+        cfg.validator_api_urls.shuffle(&mut thread_rng());

        TopologyRefresher {
-            validator_client,
+            validator_client: validator_client::ApiClient::new(cfg.validator_api_urls[0].clone()),
+            validator_api_urls: cfg.validator_api_urls,
            topology_accessor,
            refresh_rate: cfg.refresh_rate,
+            currently_used_api: 0,
            was_latest_valid: true,
        }
    }

+    fn use_next_validator_api(&mut self) {
+        if self.validator_api_urls.len() == 1 {
+            warn!("There's only a single validator API available - it won't be possible to use a different one");
+            return;
+        }
+
+        self.currently_used_api = (self.currently_used_api + 1) % self.validator_api_urls.len();
+        self.validator_client
+            .change_validator_api(self.validator_api_urls[self.currently_used_api].clone())
+    }
+
    async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
        // TODO: optimization for the future:
        // only refresh mixnodes on timer and refresh gateways only when
        // we have to send to a new, unknown, gateway

-        let mixnodes = match self.validator_client.get_cached_mix_nodes().await {
+        let mixnodes = match self.validator_client.get_cached_mixnodes().await {
            Err(err) => {
                error!("failed to get network mixnodes - {}", err);
                return None;
@@ -199,6 +209,10 @@ impl TopologyRefresher {
        trace!("Refreshing the topology");
        let new_topology = self.get_current_compatible_topology().await;

+        if new_topology.is_none() {
+            self.use_next_validator_api();
+        }
+
        if new_topology.is_none() && self.was_latest_valid {
            // if we failed to grab this topology, but the one before it was alright, let's assume
            // validator had a tiny hiccup and use the old data
@@ -1,23 +1,18 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use config::{deserialize_duration, deserialize_validators, NymConfig};
+use config::defaults::*;
+use config::NymConfig;
 use serde::{Deserialize, Serialize};
 use std::marker::PhantomData;
 use std::path::PathBuf;
 use std::time::Duration;
+use url::Url;

 pub mod persistence;

 pub const MISSING_VALUE: &str = "MISSING VALUE";

-// 'CLIENT'
-pub const DEFAULT_VALIDATOR_REST_ENDPOINTS: &[&str] = &[
-    "http://testnet-milhon-validator1.nymtech.net:1317",
-    "http://testnet-milhon-validator2.nymtech.net:1317",
-];
-pub const DEFAULT_MIXNET_CONTRACT_ADDRESS: &str = "punk10pyejy66429refv3g35g2t7am0was7yalwrzen";
-
 // 'DEBUG'
 const DEFAULT_ACK_WAIT_MULTIPLIER: f64 = 1.5;

@@ -28,26 +23,11 @@ const DEFAULT_AVERAGE_PACKET_DELAY: Duration = Duration::from_millis(50);
 const DEFAULT_TOPOLOGY_REFRESH_RATE: Duration = Duration::from_secs(5 * 60); // every 5min
 const DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT: Duration = Duration::from_millis(5_000);
 const DEFAULT_GATEWAY_RESPONSE_TIMEOUT: Duration = Duration::from_millis(1_500);
-const DEFAULT_VPN_KEY_REUSE_LIMIT: usize = 1000;
-
-const ZERO_DELAY: Duration = Duration::from_nanos(0);
-
-// helper function to get default validators as a Vec<String>
-pub fn default_validator_rest_endpoints() -> Vec<String> {
-    DEFAULT_VALIDATOR_REST_ENDPOINTS
-        .iter()
-        .map(|&endpoint| endpoint.to_string())
-        .collect()
-}

 pub fn missing_string_value() -> String {
    MISSING_VALUE.to_string()
 }

-pub fn missing_vec_string_value() -> Vec<String> {
-    vec![missing_string_value()]
-}
-
 #[derive(Debug, Deserialize, PartialEq, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct Config<T> {
@@ -131,12 +111,8 @@ impl<T: NymConfig> Config<T> {
        self.client.gateway_listener = gateway_listener.into();
    }

-    pub fn set_custom_validators(&mut self, validators: Vec<String>) {
-        self.client.validator_rest_urls = validators;
-    }
-
-    pub fn set_mixnet_contract<S: Into<String>>(&mut self, contract_address: S) {
-        self.client.mixnet_contract_address = contract_address.into();
+    pub fn set_custom_validator_apis(&mut self, validator_api_urls: Vec<Url>) {
+        self.client.validator_api_urls = validator_api_urls;
    }

    pub fn set_high_default_traffic_volume(&mut self) {
@@ -145,14 +121,6 @@ impl<T: NymConfig> Config<T> {
        self.debug.message_sending_average_delay = Duration::from_millis(4); // 250 "real" messages / s
    }

-    pub fn set_vpn_mode(&mut self, vpn_mode: bool) {
-        self.client.vpn_mode = vpn_mode;
-    }
-
-    pub fn set_vpn_key_reuse_limit(&mut self, reuse_limit: usize) {
-        self.debug.vpn_key_reuse_limit = Some(reuse_limit)
-    }
-
    pub fn set_custom_version(&mut self, version: &str) {
        self.client.version = version.to_string();
    }
@@ -193,12 +161,8 @@ impl<T: NymConfig> Config<T> {
        self.client.ack_key_file.clone()
    }

-    pub fn get_validator_rest_endpoints(&self) -> Vec<String> {
-        self.client.validator_rest_urls.clone()
-    }
-
-    pub fn get_validator_mixnet_contract_address(&self) -> String {
-        self.client.mixnet_contract_address.clone()
+    pub fn get_validator_api_endpoints(&self) -> Vec<Url> {
+        self.client.validator_api_urls.clone()
    }

    pub fn get_gateway_id(&self) -> String {
@@ -211,19 +175,11 @@ impl<T: NymConfig> Config<T> {

    // Debug getters
    pub fn get_average_packet_delay(&self) -> Duration {
-        if self.client.vpn_mode {
-            ZERO_DELAY
-        } else {
-            self.debug.average_packet_delay
-        }
+        self.debug.average_packet_delay
    }

    pub fn get_average_ack_delay(&self) -> Duration {
-        if self.client.vpn_mode {
-            ZERO_DELAY
-        } else {
-            self.debug.average_ack_delay
-        }
+        self.debug.average_ack_delay
    }

    pub fn get_ack_wait_multiplier(&self) -> f64 {
@@ -239,11 +195,7 @@ impl<T: NymConfig> Config<T> {
    }

    pub fn get_message_sending_average_delay(&self) -> Duration {
-        if self.client.vpn_mode {
-            ZERO_DELAY
-        } else {
-            self.debug.message_sending_average_delay
-        }
+        self.debug.message_sending_average_delay
    }

    pub fn get_gateway_response_timeout(&self) -> Duration {
@@ -258,21 +210,6 @@ impl<T: NymConfig> Config<T> {
        self.debug.topology_resolution_timeout
    }

-    pub fn get_vpn_mode(&self) -> bool {
-        self.client.vpn_mode
-    }
-
-    pub fn get_vpn_key_reuse_limit(&self) -> Option<usize> {
-        match self.get_vpn_mode() {
-            false => None,
-            true => Some(
-                self.debug
-                    .vpn_key_reuse_limit
-                    .unwrap_or(DEFAULT_VPN_KEY_REUSE_LIMIT),
-            ),
-        }
-    }
-
    pub fn get_version(&self) -> &str {
        &self.client.version
    }
@@ -297,23 +234,8 @@ pub struct Client<T> {
    /// ID specifies the human readable ID of this particular client.
    id: String,

-    /// URL to the validator server for obtaining network topology.
-    #[serde(
-        deserialize_with = "deserialize_validators",
-        default = "missing_vec_string_value",
-        alias = "validator_rest_url"
-    )]
-    validator_rest_urls: Vec<String>,
-
-    /// Address of the validator contract managing the network.
-    #[serde(default = "missing_string_value")]
-    mixnet_contract_address: String,
-
-    /// Special mode of the system such that all messages are sent as soon as they are received
-    /// and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-    /// 'Debug' values will have no effect.
-    #[serde(default)]
-    vpn_mode: bool,
+    /// Addresses to APIs running on validator from which the client gets the view of the network.
+    validator_api_urls: Vec<Url>,

    /// Path to file containing private identity key.
    private_identity_key_file: PathBuf,
@@ -360,9 +282,7 @@ impl<T: NymConfig> Default for Client<T> {
        Client {
            version: env!("CARGO_PKG_VERSION").to_string(),
            id: "".to_string(),
-            validator_rest_urls: default_validator_rest_endpoints(),
-            mixnet_contract_address: DEFAULT_MIXNET_CONTRACT_ADDRESS.to_string(),
-            vpn_mode: false,
+            validator_api_urls: default_api_endpoints(),
            private_identity_key_file: Default::default(),
            public_identity_key_file: Default::default(),
            private_encryption_key_file: Default::default(),
@@ -425,20 +345,14 @@ pub struct Debug {
    /// sent packet is going to be delayed at any given mix node.
    /// So for a packet going through three mix nodes, on average, it will take three times this value
    /// until the packet reaches its destination.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    average_packet_delay: Duration,

    /// The parameter of Poisson distribution determining how long, on average,
    /// sent acknowledgement is going to be delayed at any given mix node.
    /// So for an ack going through three mix nodes, on average, it will take three times this value
    /// until the packet reaches its destination.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    average_ack_delay: Duration,

    /// Value multiplied with the expected round trip time of an acknowledgement packet before
@@ -449,58 +363,36 @@ pub struct Debug {
    /// Value added to the expected round trip time of an acknowledgement packet before
    /// it is assumed it was lost and retransmission of the data packet happens.
    /// In an ideal network with 0 latency, this value would have been 0.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    ack_wait_addition: Duration,

    /// The parameter of Poisson distribution determining how long, on average,
    /// it is going to take for another loop cover traffic message to be sent.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    loop_cover_traffic_average_delay: Duration,

    /// The parameter of Poisson distribution determining how long, on average,
    /// it is going to take another 'real traffic stream' message to be sent.
    /// If no real packets are available and cover traffic is enabled,
    /// a loop cover message is sent instead in order to preserve the rate.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    message_sending_average_delay: Duration,

    /// How long we're willing to wait for a response to a message sent to the gateway,
    /// before giving up on it.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    gateway_response_timeout: Duration,

    /// The uniform delay every which clients are querying the directory server
    /// to try to obtain a compatible network topology to send sphinx packets through.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    topology_refresh_rate: Duration,

    /// During topology refresh, test packets are sent through every single possible network
    /// path. This timeout determines waiting period until it is decided that the packet
    /// did not reach its destination.
-    #[serde(
-        deserialize_with = "deserialize_duration",
-        serialize_with = "humantime_serde::serialize"
-    )]
+    #[serde(with = "humantime_serde")]
    topology_resolution_timeout: Duration,
-
-    /// If the mode of the client is set to VPN it specifies number of packets created with the
-    /// same initial secret until it gets rotated.
-    vpn_key_reuse_limit: Option<usize>,
 }

 impl Default for Debug {
@@ -515,7 +407,6 @@ impl Default for Debug {
            gateway_response_timeout: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
-            vpn_key_reuse_limit: None,
        }
    }
 }
@@ -16,7 +16,7 @@ futures = "0.3" # bunch of futures stuff, however, now that I think about it, it
 # the AsyncRead, AsyncWrite, Stream, Sink, etc. traits could be used from tokio
 # channels should really be replaced with crossbeam due to that implementation being more efficient
 # and the single instance of abortable we have should really be refactored anyway
-url = "2.1" # I think we should just replace it with String
+url = "2.2"

 clap = "2.33.0" # for the command line arguments
 dirs = "3.0" # for determining default store directories in config
@@ -4,14 +4,13 @@
 use crate::client::config::template::config_template;
 use client_core::config::Config as BaseConfig;
 pub use client_core::config::MISSING_VALUE;
+use config::defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
 use config::NymConfig;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;

 mod template;

-const DEFAULT_LISTENING_PORT: u16 = 1977;
-
 #[derive(Debug, Deserialize, PartialEq, Serialize, Clone, Copy)]
 #[serde(deny_unknown_fields)]
 pub enum SocketType {
@@ -117,7 +116,7 @@ impl Default for Socket {
    fn default() -> Self {
        Socket {
            socket_type: SocketType::WebSocket,
-            listening_port: DEFAULT_LISTENING_PORT,
+            listening_port: DEFAULT_WEBSOCKET_LISTENING_PORT,
        }
    }
 }
@@ -19,21 +19,13 @@ version = '{{ client.version }}'
 # Human readable ID of this particular client.
 id = '{{ client.id }}'

-# URL to the validator server for obtaining network topology.
-validator_rest_urls = [
-    {{#each client.validator_rest_urls }}
+# Addresses to APIs running on validator from which the client gets the view of the network.
+validator_api_urls = [
+    {{#each client.validator_api_urls }}
        '{{this}}',
    {{/each}}
 ]

-# Address of the validator contract managing the network.
-mixnet_contract_address = '{{ client.mixnet_contract_address }}'
-
-# Special mode of the system such that all messages are sent as soon as they are received
-# and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-# 'Debug' values will have no effect.
-vpn_mode = {{ client.vpn_mode }}
-
 # Path to file containing private identity key.
 private_identity_key_file = '{{ client.private_identity_key_file }}'

@@ -32,7 +32,6 @@ use log::*;
 use nymsphinx::addressing::clients::Recipient;
 use nymsphinx::addressing::nodes::NodeIdentity;
 use nymsphinx::anonymous_replies::ReplySurb;
-use nymsphinx::params::PacketMode;
 use nymsphinx::receiver::ReconstructedMessage;
 use tokio::runtime::Runtime;

@@ -119,12 +118,6 @@ impl NymClient {
        input_receiver: InputMessageReceiver,
        mix_sender: BatchMixMessageSender,
    ) {
-        let packet_mode = if self.config.get_base().get_vpn_mode() {
-            PacketMode::Vpn
-        } else {
-            PacketMode::Mix
-        };
-
        let controller_config = real_messages_control::Config::new(
            self.key_manager.ack_key(),
            self.config.get_base().get_ack_wait_multiplier(),
@@ -133,8 +126,6 @@ impl NymClient {
            self.config.get_base().get_message_sending_average_delay(),
            self.config.get_base().get_average_packet_delay(),
            self.as_mix_recipient(),
-            packet_mode,
-            self.config.get_base().get_vpn_key_reuse_limit(),
        );

        info!("Starting real traffic stream...");
@@ -151,7 +142,7 @@ impl NymClient {
            topology_accessor,
            reply_key_storage,
        )
-        .start(self.runtime.handle(), self.config.get_base().get_vpn_mode());
+        .start(self.runtime.handle());
    }

    // buffer controlling all messages fetched from provider
@@ -189,34 +180,31 @@ impl NymClient {
        let gateway_identity = identity::PublicKey::from_base58_string(gateway_id)
            .expect("provided gateway id is invalid!");

-        let mut gateway_client = GatewayClient::new(
-            gateway_address,
-            self.key_manager.identity_keypair(),
-            gateway_identity,
-            Some(self.key_manager.gateway_shared_key()),
-            mixnet_message_sender,
-            ack_sender,
-            self.config.get_base().get_gateway_response_timeout(),
-        );
-
        self.runtime.block_on(async {
+            let mut gateway_client = GatewayClient::new(
+                gateway_address,
+                self.key_manager.identity_keypair(),
+                gateway_identity,
+                Some(self.key_manager.gateway_shared_key()),
+                mixnet_message_sender,
+                ack_sender,
+                self.config.get_base().get_gateway_response_timeout(),
+            );
+
            gateway_client
                .authenticate_and_start()
                .await
-                .expect("could not authenticate and start up the gateway connection")
-        });
+                .expect("could not authenticate and start up the gateway connection");

-        gateway_client
+            gateway_client
+        })
    }

    // future responsible for periodically polling directory server and updating
    // the current global view of topology
    fn start_topology_refresher(&mut self, topology_accessor: TopologyAccessor) {
        let topology_refresher_config = TopologyRefresherConfig::new(
-            self.config.get_base().get_validator_rest_endpoints(),
-            self.config
-                .get_base()
-                .get_validator_mixnet_contract_address(),
+            self.config.get_base().get_validator_api_endpoints(),
            self.config.get_base().get_topology_refresh_rate(),
        );
        let mut topology_refresher =
@@ -376,9 +364,7 @@ impl NymClient {
            sphinx_message_sender.clone(),
        );

-        if !self.config.get_base().get_vpn_mode() {
-            self.start_cover_traffic_stream(shared_topology_accessor, sphinx_message_sender);
-        }
+        self.start_cover_traffic_stream(shared_topology_accessor, sphinx_message_sender);

        match self.config.get_socket_type() {
            SocketType::WebSocket => {
@@ -14,10 +14,12 @@ use nymsphinx::addressing::clients::Recipient;
 use nymsphinx::addressing::nodes::NodeIdentity;
 use rand::rngs::OsRng;
 use rand::seq::SliceRandom;
+use rand::thread_rng;
 use std::convert::TryInto;
 use std::sync::Arc;
 use std::time::Duration;
 use topology::{filter::VersionFilterable, gateway};
+use url::Url;

 pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
    App::new("init")
@@ -38,11 +40,6 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
                .help("Comma separated list of rest endpoints of the validators")
                .takes_value(true),
        )
-        .arg(Arg::with_name("mixnet-contract")
-                 .long("mixnet-contract")
-                 .help("Address of the validator contract managing the network")
-                 .takes_value(true),
-        )
        .arg(Arg::with_name("disable-socket")
            .long("disable-socket")
            .help("Whether to not start the websocket")
@@ -53,17 +50,6 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
            .help("Port for the socket (if applicable) to listen on in all subsequent runs")
            .takes_value(true)
        )
-        .arg(Arg::with_name("vpn-mode")
-            .long("vpn-mode")
-            .help("Set the vpn mode of the client")
-            .long_help(
-                r#" 
-                    Special mode of the system such that all messages are sent as soon as they are received
-                    and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-                    'Debug' values will have no effect.
-                "#
-            )
-        )
        .arg(Arg::with_name("fastmode")
            .long("fastmode")
            .hidden(true) // this will prevent this flag from being displayed in `--help`
@@ -74,7 +60,7 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
 async fn register_with_gateway(
    gateway: &gateway::Node,
    our_identity: Arc<identity::KeyPair>,
-) -> SharedKeys {
+) -> Arc<SharedKeys> {
    let timeout = Duration::from_millis(1500);
    let mut gateway_client = GatewayClient::new_init(
        gateway.clients_address(),
@@ -87,18 +73,19 @@ async fn register_with_gateway(
        .await
        .expect("failed to establish connection with the gateway!");
    gateway_client
-        .register()
+        .perform_initial_authentication()
        .await
        .expect("failed to register with the gateway!")
 }

 async fn gateway_details(
-    validator_servers: Vec<String>,
-    mixnet_contract: &str,
+    validator_servers: Vec<Url>,
    chosen_gateway_id: Option<&str>,
 ) -> gateway::Node {
-    let validator_client_config = validator_client::Config::new(validator_servers, mixnet_contract);
-    let validator_client = validator_client::Client::new(validator_client_config);
+    let validator_api = validator_servers
+        .choose(&mut thread_rng())
+        .expect("The list of validator apis is empty");
+    let validator_client = validator_client::ApiClient::new(validator_api.clone());

    let gateways = validator_client.get_cached_gateways().await.unwrap();
    let valid_gateways = gateways
@@ -194,8 +181,7 @@ pub fn execute(matches: &ArgMatches) {

        let registration_fut = async {
            let gate_details = gateway_details(
-                config.get_base().get_validator_rest_endpoints(),
-                &config.get_base().get_validator_mixnet_contract_address(),
+                config.get_base().get_validator_api_endpoints(),
                chosen_gateway_id,
            )
            .await;
@@ -3,14 +3,20 @@

 use crate::client::config::{Config, SocketType};
 use clap::ArgMatches;
+use url::Url;

 pub(crate) mod init;
 pub(crate) mod run;
 pub(crate) mod upgrade;

-fn parse_validators(raw: &str) -> Vec<String> {
+fn parse_validators(raw: &str) -> Vec<Url> {
    raw.split(',')
-        .map(|raw_validator| raw_validator.trim().into())
+        .map(|raw_validator| {
+            raw_validator
+                .trim()
+                .parse()
+                .expect("one of the provided validator api urls is invalid")
+        })
        .collect()
 }

@@ -18,11 +24,7 @@ pub(crate) fn override_config(mut config: Config, matches: &ArgMatches) -> Confi
    if let Some(raw_validators) = matches.value_of("validators") {
        config
            .get_base_mut()
-            .set_custom_validators(parse_validators(raw_validators));
-    }
-
-    if let Some(contract_address) = matches.value_of("mixnet-contract") {
-        config.get_base_mut().set_mixnet_contract(contract_address)
+            .set_custom_validator_apis(parse_validators(raw_validators));
    }

    if let Some(gateway_id) = matches.value_of("gateway") {
@@ -33,10 +35,6 @@ pub(crate) fn override_config(mut config: Config, matches: &ArgMatches) -> Confi
        config = config.with_socket(SocketType::None);
    }

-    if matches.is_present("vpn-mode") {
-        config.get_base_mut().set_vpn_mode(true);
-    }
-
    if let Some(port) = matches.value_of("port").map(|port| port.parse::<u16>()) {
        if let Err(err) = port {
            // if port was overridden, it must be parsable
@@ -24,11 +24,6 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
                .help("Comma separated list rest rest endpoints of the validators")
                .takes_value(true),
        )
-        .arg(Arg::with_name("mixnet-contract")
-                 .long("mixnet-contract")
-                 .help("Address of the validator contract managing the network")
-                 .takes_value(true),
-        )
        .arg(Arg::with_name("gateway")
            .long("gateway")
            .help("Id of the gateway we want to connect to. If overridden, it is user's responsibility to ensure prior registration happened")
@@ -38,17 +33,6 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
            .long("disable-socket")
            .help("Whether to not start the websocket")
        )
-        .arg(Arg::with_name("vpn-mode")
-            .long("vpn-mode")
-            .help("Set the vpn mode of the client")
-            .long_help(
-                r#" 
-                    Special mode of the system such that all messages are sent as soon as they are received
-                    and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-                    'Debug' values will have no effect.
-                "#
-            )
-        )
        .arg(Arg::with_name("port")
            .short("p")
            .long("port")
@@ -3,11 +3,17 @@

 use crate::client::config::{Config, MISSING_VALUE};
 use clap::{App, Arg, ArgMatches};
-use client_core::config::{default_validator_rest_endpoints, DEFAULT_MIXNET_CONTRACT_ADDRESS};
+use config::defaults::default_api_endpoints;
 use config::NymConfig;
 use std::fmt::Display;
 use std::process;
-use version_checker::{parse_version, Version};
+use version_checker::Version;
+
+#[allow(dead_code)]
+fn fail_upgrade<D1: Display, D2: Display>(from_version: D1, to_version: D2) -> ! {
+    print_failed_upgrade(from_version, to_version);
+    process::exit(1)
+}

 fn print_start_upgrade<D1: Display, D2: Display>(from: D1, to: D2) {
    println!(
@@ -30,28 +36,29 @@ fn print_successful_upgrade<D1: Display, D2: Display>(from: D1, to: D2) {
    );
 }

-pub fn command_args<'a, 'b>() -> App<'a, 'b> {
-    App::new("upgrade").about("Try to upgrade the client")
-        .arg(
-            Arg::with_name("id")
-                .long("id")
-                .help("Id of the nym-client we want to upgrade")
-                .takes_value(true)
-                .required(true),
-        )
-        // the rest of arguments depend on the upgrade path
-        .arg(Arg::with_name("current version")
-            .long("current-version")
-            .help("REQUIRED FOR PRE-0.9.0 UPGRADES. Specifies current version of the configuration file to help to determine a valid upgrade path. Valid formats include '0.8.1', 'v0.8.1' or 'V0.8.1'")
-            .takes_value(true)
-        )
+fn outdated_upgrade(config_version: &Version, package_version: &Version) -> ! {
+    eprintln!(
+        "Cannot perform upgrade from {} to {}. Your version is too old to perform the upgrade.!",
+        config_version, package_version
+    );
+    process::exit(1)
 }

-fn unsupported_upgrade(config_version: Version, package_version: Version) -> ! {
-    eprintln!("Cannot perform upgrade from {} to {}. Please let the developers know about this issue if you expected it to work!", config_version, package_version);
+fn unsupported_upgrade(current_version: &Version, config_version: &Version) -> ! {
+    eprintln!("Cannot perform upgrade from {} to {}. Please let the developers know about this issue if you expected it to work!", config_version, current_version);
    process::exit(1)
 }

+pub fn command_args<'a, 'b>() -> App<'a, 'b> {
+    App::new("upgrade").about("Try to upgrade the client").arg(
+        Arg::with_name("id")
+            .long("id")
+            .help("Id of the nym-client we want to upgrade")
+            .takes_value(true)
+            .required(true),
+    )
+}
+
 fn parse_config_version(config: &Config) -> Version {
    let version = Version::parse(config.get_base().get_version()).unwrap_or_else(|err| {
        eprintln!("failed to parse client version! - {:?}", err);
@@ -86,190 +93,28 @@ fn parse_package_version() -> Version {
    version
 }

-fn pre_090_upgrade(from: &str, mut config: Config) -> Config {
-    // this is not extracted to separate function as you only have to manually pass version
-    // if upgrading from pre090 version
-    let from = match from.strip_prefix('v') {
-        Some(stripped) => stripped,
-        None => from,
-    };
-
-    let from = match from.strip_prefix('V') {
-        Some(stripped) => stripped,
-        None => from,
-    };
-
-    let from_version = parse_version(from).expect("invalid version provided!");
-    if from_version.major == 0 && from_version.minor < 8 {
-        // technically this could be implemented, but is there any point in that?
-        eprintln!("upgrading client from before v0.8.0 is not supported. Please run `init` with new binary instead");
-        process::exit(1)
-    }
-
-    if (from_version.major == 0 && from_version.minor >= 9) || from_version.major >= 1 {
-        eprintln!("self reported version is higher than 0.9.0. Those releases should have already contained version numbers in config! Make sure you provided correct version");
-        process::exit(1)
-    }
-
-    // note: current is guaranteed to not have any `build` information suffix (nor pre-release
-    // information), as this was asserted at the beginning of this command)
-    //
-    // upgrade to current (if it's a 0.9.X) or try to upgrade to 0.9.0 as an intermediate
-    // step in future upgrades (so, for example, we might go 0.8.0 -> 0.9.0 -> 0.10.0)
-    // this way we don't need to have all the crazy paths on how to upgrade from any version to any
-    // other version. We just upgrade one minor version at a time.
-    let current = Version::parse(env!("CARGO_PKG_VERSION")).unwrap();
-    let to_version = if current.major == 0 && current.minor == 9 {
-        current
-    } else {
-        Version::new(0, 9, 0)
-    };
-
-    if config.get_base().get_validator_rest_endpoints()[0] != MISSING_VALUE {
-        eprintln!("existing config seems to have specified new validator rest endpoint which was only introduced in 0.9.0! Can't perform upgrade.");
-        print_failed_upgrade(&from_version, &to_version);
-        process::exit(1);
-    }
-
-    print_start_upgrade(&from_version, &to_version);
-
-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    println!(
-        "Setting validator REST endpoint to to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&from_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(from_version, to_version);
-
-    config
-}
-
-/*
-changes:
- introduction of mixnet contract address field
- change to default validator rest endpoint
- */
-fn minor_010_upgrade(
+fn minor_0_12_upgrade(
    mut config: Config,
    _matches: &ArgMatches,
    config_version: &Version,
    package_version: &Version,
 ) -> Config {
-    let to_version = if package_version.major == 0 && package_version.minor == 10 {
+    let to_version = if package_version.major == 0 && package_version.minor == 12 {
        package_version.clone()
    } else {
-        Version::new(0, 10, 0)
+        Version::new(0, 12, 0)
    };

    print_start_upgrade(&config_version, &to_version);

-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    if config.get_base().get_validator_mixnet_contract_address() != MISSING_VALUE {
-        eprintln!("existing config seems to have specified mixnet contract address which was only introduced in 0.10.0! Can't perform upgrade.");
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    }
-
    println!(
-        "Setting mixnet contract address to {}",
-        DEFAULT_MIXNET_CONTRACT_ADDRESS
+        "Setting validator API endpoints to {:?}",
+        default_api_endpoints()
    );

    config
        .get_base_mut()
-        .set_mixnet_contract(DEFAULT_MIXNET_CONTRACT_ADDRESS);
-
-    // The default validator endpoint changed
-    println!(
-        "Setting validator REST endpoint to to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(config_version, to_version);
-
-    config
-}
-
-// no changes but version number
-fn patch_010_upgrade(
-    mut config: Config,
-    _matches: &ArgMatches,
-    config_version: &Version,
-    package_version: &Version,
-) -> Config {
-    let to_version = package_version;
-
-    print_start_upgrade(&config_version, &to_version);
-
-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(config_version, to_version);
-
-    config
-}
-
-fn minor_011_upgrade(
-    mut config: Config,
-    _matches: &ArgMatches,
-    config_version: &Version,
-    package_version: &Version,
-) -> Config {
-    let to_version = package_version;
-
-    print_start_upgrade(&config_version, &to_version);
-
-    println!(
-        "Setting mixnet contract address to {}",
-        DEFAULT_MIXNET_CONTRACT_ADDRESS
-    );
-
-    config
-        .get_base_mut()
-        .set_mixnet_contract(DEFAULT_MIXNET_CONTRACT_ADDRESS);
-
-    // The default validator endpoint changed
-    println!(
-        "Setting validator REST endpoint to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
+        .set_custom_validator_apis(default_api_endpoints());

    config
        .get_base_mut()
@@ -297,18 +142,11 @@ fn do_upgrade(mut config: Config, matches: &ArgMatches, package_version: Version

        config = match config_version.major {
            0 => match config_version.minor {
-                9 => minor_010_upgrade(config, matches, &config_version, &Version::new(0, 10, 0)),
-                10 => match config_version.patch {
-                    0 => {
-                        patch_010_upgrade(config, matches, &config_version, &Version::new(0, 10, 1))
-                    }
-                    _ => {
-                        minor_011_upgrade(config, matches, &config_version, &Version::new(0, 11, 0))
-                    }
-                },
-                _ => unsupported_upgrade(config_version, package_version),
+                9 | 10 => outdated_upgrade(&config_version, &package_version),
+                11 => minor_0_12_upgrade(config, matches, &config_version, &package_version),
+                _ => unsupported_upgrade(&config_version, &package_version),
            },
-            _ => unsupported_upgrade(config_version, package_version),
+            _ => unsupported_upgrade(&config_version, &package_version),
        }
    }
 }
@@ -318,22 +156,14 @@ pub fn execute(matches: &ArgMatches) {

    let id = matches.value_of("id").unwrap();

-    let mut existing_config = Config::load_from_file(Some(id)).unwrap_or_else(|err| {
+    let existing_config = Config::load_from_file(Some(id)).unwrap_or_else(|err| {
        eprintln!("failed to load existing config file! - {:?}", err);
        process::exit(1)
    });

-    // versions fields were added in 0.9.0
    if existing_config.get_base().get_version() == MISSING_VALUE {
-        let self_reported_version = matches.value_of("current version").unwrap_or_else(|| {
-            eprintln!(
-                "trying to upgrade from pre v0.9.0 without providing current system version!"
-            );
-            process::exit(1)
-        });
-
-        // upgrades up to 0.9.0
-        existing_config = pre_090_upgrade(self_reported_version, existing_config);
+        eprintln!("the existing configuration file does not seem to contain version number.");
+        process::exit(1);
    }

    // here be upgrade path to 0.9.X and beyond based on version number from config
@@ -20,6 +20,7 @@ rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 serde = { version = "1.0", features = ["derive"] } # for config serialization/deserialization
 snafu = "0.6"
 tokio = { version = "1.4", features = ["rt-multi-thread", "net", "signal"] }
+url = "2.2"

 # internal
 client-core = { path = "../client-core" }
@@ -4,6 +4,7 @@
 use crate::client::config::template::config_template;
 use client_core::config::Config as BaseConfig;
 pub use client_core::config::MISSING_VALUE;
+use config::defaults::DEFAULT_SOCKS5_LISTENING_PORT;
 use config::NymConfig;
 use nymsphinx::addressing::clients::Recipient;
 use serde::{Deserialize, Serialize};
@@ -11,8 +12,6 @@ use std::path::PathBuf;

 mod template;

-const DEFAULT_LISTENING_PORT: u16 = 1080;
-
 #[derive(Debug, Default, Deserialize, PartialEq, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct Config {
@@ -103,7 +102,7 @@ pub struct Socks5 {
 impl Socks5 {
    pub fn new<S: Into<String>>(provider_mix_address: S) -> Self {
        Socks5 {
-            listening_port: DEFAULT_LISTENING_PORT,
+            listening_port: DEFAULT_SOCKS5_LISTENING_PORT,
            provider_mix_address: provider_mix_address.into(),
        }
    }
@@ -112,7 +111,7 @@ impl Socks5 {
 impl Default for Socks5 {
    fn default() -> Self {
        Socks5 {
-            listening_port: DEFAULT_LISTENING_PORT,
+            listening_port: DEFAULT_SOCKS5_LISTENING_PORT,
            provider_mix_address: "".into(),
        }
    }
@@ -19,21 +19,13 @@ version = '{{ client.version }}'
 # Human readable ID of this particular client.
 id = '{{ client.id }}'

-# URL to the validator server for obtaining network topology.
-validator_rest_urls = [
-    {{#each client.validator_rest_urls }}
+# Addresses to APIs running on validator from which the client gets the view of the network.
+validator_api_urls = [
+    {{#each client.validator_api_urls }}
        '{{this}}',
    {{/each}}
 ]

-# Address of the validator contract managing the network.
-mixnet_contract_address = '{{ client.mixnet_contract_address }}'
-
-# Special mode of the system such that all messages are sent as soon as they are received
-# and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-# 'Debug' values will have no effect.
-vpn_mode = {{ client.vpn_mode }}
-
 # Path to file containing private identity key.
 private_identity_key_file = '{{ client.private_identity_key_file }}'

@@ -32,7 +32,6 @@ use gateway_client::{
 use log::*;
 use nymsphinx::addressing::clients::Recipient;
 use nymsphinx::addressing::nodes::NodeIdentity;
-use nymsphinx::params::PacketMode;
 use tokio::runtime::Runtime;

 pub(crate) mod config;
@@ -107,12 +106,6 @@ impl NymClient {
        input_receiver: InputMessageReceiver,
        mix_sender: BatchMixMessageSender,
    ) {
-        let packet_mode = if self.config.get_base().get_vpn_mode() {
-            PacketMode::Vpn
-        } else {
-            PacketMode::Mix
-        };
-
        let controller_config = client_core::client::real_messages_control::Config::new(
            self.key_manager.ack_key(),
            self.config.get_base().get_ack_wait_multiplier(),
@@ -121,8 +114,6 @@ impl NymClient {
            self.config.get_base().get_message_sending_average_delay(),
            self.config.get_base().get_average_packet_delay(),
            self.as_mix_recipient(),
-            packet_mode,
-            self.config.get_base().get_vpn_key_reuse_limit(),
        );

        info!("Starting real traffic stream...");
@@ -139,7 +130,7 @@ impl NymClient {
            topology_accessor,
            reply_key_storage,
        )
-        .start(self.runtime.handle(), self.config.get_base().get_vpn_mode());
+        .start(self.runtime.handle());
    }

    // buffer controlling all messages fetched from provider
@@ -177,44 +168,38 @@ impl NymClient {
        let gateway_identity = identity::PublicKey::from_base58_string(gateway_id)
            .expect("provided gateway id is invalid!");

-        let mut gateway_client = GatewayClient::new(
-            gateway_address,
-            self.key_manager.identity_keypair(),
-            gateway_identity,
-            Some(self.key_manager.gateway_shared_key()),
-            mixnet_message_sender,
-            ack_sender,
-            self.config.get_base().get_gateway_response_timeout(),
-        );
-
        self.runtime.block_on(async {
+            let mut gateway_client = GatewayClient::new(
+                gateway_address,
+                self.key_manager.identity_keypair(),
+                gateway_identity,
+                Some(self.key_manager.gateway_shared_key()),
+                mixnet_message_sender,
+                ack_sender,
+                self.config.get_base().get_gateway_response_timeout(),
+            );
+
            gateway_client
                .authenticate_and_start()
                .await
-                .expect("could not authenticate and start up the gateway connection")
-        });
+                .expect("could not authenticate and start up the gateway connection");

-        gateway_client
+            gateway_client
+        })
    }

    // future responsible for periodically polling directory server and updating
    // the current global view of topology
    fn start_topology_refresher(&mut self, topology_accessor: TopologyAccessor) {
        let topology_refresher_config = TopologyRefresherConfig::new(
-            self.config.get_base().get_validator_rest_endpoints(),
-            self.config
-                .get_base()
-                .get_validator_mixnet_contract_address(),
+            self.config.get_base().get_validator_api_endpoints(),
            self.config.get_base().get_topology_refresh_rate(),
        );
        let mut topology_refresher =
            TopologyRefresher::new(topology_refresher_config, topology_accessor);
        // before returning, block entire runtime to refresh the current network view so that any
        // components depending on topology would see a non-empty view
-        info!(
-            "Obtaining initial network topology from {}",
-            self.config.get_base().get_validator_rest_endpoints()[0]
-        );
+        info!("Obtaining initial network topology");
        self.runtime.block_on(topology_refresher.refresh());

        // TODO: a slightly more graceful termination here
@@ -329,9 +314,8 @@ impl NymClient {
            input_receiver,
            sphinx_message_sender.clone(),
        );
-        if !self.config.get_base().get_vpn_mode() {
-            self.start_cover_traffic_stream(shared_topology_accessor, sphinx_message_sender);
-        }
+
+        self.start_cover_traffic_stream(shared_topology_accessor, sphinx_message_sender);
        self.start_socks5_listener(received_buffer_request_sender, input_sender);

        info!("Client startup finished!");
@@ -12,11 +12,12 @@ use gateway_client::GatewayClient;
 use gateway_requests::registration::handshake::SharedKeys;
 use nymsphinx::addressing::clients::Recipient;
 use nymsphinx::addressing::nodes::NodeIdentity;
-use rand::{prelude::SliceRandom, rngs::OsRng};
+use rand::{prelude::SliceRandom, rngs::OsRng, thread_rng};
 use std::convert::TryInto;
 use std::sync::Arc;
 use std::time::Duration;
 use topology::{filter::VersionFilterable, gateway};
+use url::Url;

 pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
    App::new("init")
@@ -43,28 +44,12 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
                .help("Comma separated list of rest endpoints of the validators")
                .takes_value(true),
        )
-        .arg(Arg::with_name("mixnet-contract")
-                 .long("mixnet-contract")
-                 .help("Address of the validator contract managing the network")
-                 .takes_value(true),
-        )
        .arg(Arg::with_name("port")
            .short("p")
            .long("port")
            .help("Port for the socket to listen on in all subsequent runs")
            .takes_value(true)
        )
-        .arg(Arg::with_name("vpn-mode")
-            .long("vpn-mode")
-            .help("Set the vpn mode of the client")
-            .long_help(
-                r#" 
-                    Special mode of the system such that all messages are sent as soon as they are received
-                    and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-                    'Debug' values will have no effect.
-                "#
-            )
-        )
        .arg(Arg::with_name("fastmode")
            .long("fastmode")
            .hidden(true) // this will prevent this flag from being displayed in `--help`
@@ -75,7 +60,7 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
 async fn register_with_gateway(
    gateway: &gateway::Node,
    our_identity: Arc<identity::KeyPair>,
-) -> SharedKeys {
+) -> Arc<SharedKeys> {
    let timeout = Duration::from_millis(1500);
    let mut gateway_client = GatewayClient::new_init(
        gateway.clients_address(),
@@ -88,18 +73,19 @@ async fn register_with_gateway(
        .await
        .expect("failed to establish connection with the gateway!");
    gateway_client
-        .register()
+        .perform_initial_authentication()
        .await
        .expect("failed to register with the gateway!")
 }

 async fn gateway_details(
-    validator_servers: Vec<String>,
-    mixnet_contract: &str,
+    validator_servers: Vec<Url>,
    chosen_gateway_id: Option<&str>,
 ) -> gateway::Node {
-    let validator_client_config = validator_client::Config::new(validator_servers, mixnet_contract);
-    let validator_client = validator_client::Client::new(validator_client_config);
+    let validator_api = validator_servers
+        .choose(&mut thread_rng())
+        .expect("The list of validator apis is empty");
+    let validator_client = validator_client::ApiClient::new(validator_api.clone());

    let gateways = validator_client.get_cached_gateways().await.unwrap();
    let valid_gateways = gateways
@@ -196,8 +182,7 @@ pub fn execute(matches: &ArgMatches) {

        let registration_fut = async {
            let gate_details = gateway_details(
-                config.get_base().get_validator_rest_endpoints(),
-                &config.get_base().get_validator_mixnet_contract_address(),
+                config.get_base().get_validator_api_endpoints(),
                chosen_gateway_id,
            )
            .await;
@@ -3,14 +3,20 @@

 use crate::client::config::Config;
 use clap::ArgMatches;
+use url::Url;

 pub(crate) mod init;
 pub(crate) mod run;
 pub(crate) mod upgrade;

-fn parse_validators(raw: &str) -> Vec<String> {
+fn parse_validators(raw: &str) -> Vec<Url> {
    raw.split(',')
-        .map(|raw_validator| raw_validator.trim().into())
+        .map(|raw_validator| {
+            raw_validator
+                .trim()
+                .parse()
+                .expect("one of the provided validator api urls is invalid")
+        })
        .collect()
 }

@@ -18,21 +24,13 @@ pub(crate) fn override_config(mut config: Config, matches: &ArgMatches) -> Confi
    if let Some(raw_validators) = matches.value_of("validators") {
        config
            .get_base_mut()
-            .set_custom_validators(parse_validators(raw_validators));
-    }
-
-    if let Some(contract_address) = matches.value_of("mixnet-contract") {
-        config.get_base_mut().set_mixnet_contract(contract_address)
+            .set_custom_validator_apis(parse_validators(raw_validators));
    }

    if let Some(gateway_id) = matches.value_of("gateway") {
        config.get_base_mut().with_gateway_id(gateway_id);
    }

-    if matches.is_present("vpn-mode") {
-        config.get_base_mut().set_vpn_mode(true);
-    }
-
    if let Some(port) = matches.value_of("port").map(|port| port.parse::<u16>()) {
        if let Err(err) = port {
            // if port was overridden, it must be parsable
@@ -34,27 +34,11 @@ pub fn command_args<'a, 'b>() -> clap::App<'a, 'b> {
                .help("Comma separated list of rest endpoints of the validators")
                .takes_value(true),
        )
-        .arg(Arg::with_name("mixnet-contract")
-                 .long("mixnet-contract")
-                 .help("Address of the validator contract managing the network")
-                 .takes_value(true),
-        )
        .arg(Arg::with_name("gateway")
            .long("gateway")
            .help("Id of the gateway we want to connect to. If overridden, it is user's responsibility to ensure prior registration happened")
            .takes_value(true)
        )
-        .arg(Arg::with_name("vpn-mode")
-            .long("vpn-mode")
-            .help("Set the vpn mode of the client")
-            .long_help(
-                r#" 
-                    Special mode of the system such that all messages are sent as soon as they are received
-                    and no cover traffic is generated. If set all message delays are set to 0 and overwriting
-                    'Debug' values will have no effect.
-                "#
-            )
-        )
        .arg(Arg::with_name("port")
            .short("p")
            .long("port")
@@ -3,11 +3,17 @@

 use crate::client::config::{Config, MISSING_VALUE};
 use clap::{App, Arg, ArgMatches};
-use client_core::config::{default_validator_rest_endpoints, DEFAULT_MIXNET_CONTRACT_ADDRESS};
+use config::defaults::default_api_endpoints;
 use config::NymConfig;
 use std::fmt::Display;
 use std::process;
-use version_checker::{parse_version, Version};
+use version_checker::Version;
+
+#[allow(dead_code)]
+fn fail_upgrade<D1: Display, D2: Display>(from_version: D1, to_version: D2) -> ! {
+    print_failed_upgrade(from_version, to_version);
+    process::exit(1)
+}

 fn print_start_upgrade<D1: Display, D2: Display>(from: D1, to: D2) {
    println!(
@@ -30,28 +36,29 @@ fn print_successful_upgrade<D1: Display, D2: Display>(from: D1, to: D2) {
    );
 }

-pub fn command_args<'a, 'b>() -> App<'a, 'b> {
-    App::new("upgrade").about("Try to upgrade the client")
-        .arg(
-            Arg::with_name("id")
-                .long("id")
-                .help("Id of the nym-socks5-client we want to upgrade")
-                .takes_value(true)
-                .required(true),
-        )
-        // the rest of arguments depend on the upgrade path
-        .arg(Arg::with_name("current version")
-            .long("current-version")
-            .help("REQUIRED FOR PRE-0.9.0 UPGRADES. Specifies current version of the configuration file to help to determine a valid upgrade path. Valid formats include '0.8.1', 'v0.8.1' or 'V0.8.1'")
-            .takes_value(true)
-        )
+fn outdated_upgrade(config_version: &Version, package_version: &Version) -> ! {
+    eprintln!(
+        "Cannot perform upgrade from {} to {}. Your version is too old to perform the upgrade.!",
+        config_version, package_version
+    );
+    process::exit(1)
 }

-fn unsupported_upgrade(config_version: Version, package_version: Version) -> ! {
-    eprintln!("Cannot perform upgrade from {} to {}. Please let the developers know about this issue if you expected it to work!", config_version, package_version);
+fn unsupported_upgrade(current_version: &Version, config_version: &Version) -> ! {
+    eprintln!("Cannot perform upgrade from {} to {}. Please let the developers know about this issue if you expected it to work!", config_version, current_version);
    process::exit(1)
 }

+pub fn command_args<'a, 'b>() -> App<'a, 'b> {
+    App::new("upgrade").about("Try to upgrade the client").arg(
+        Arg::with_name("id")
+            .long("id")
+            .help("Id of the nym-client we want to upgrade")
+            .takes_value(true)
+            .required(true),
+    )
+}
+
 fn parse_config_version(config: &Config) -> Version {
    let version = Version::parse(config.get_base().get_version()).unwrap_or_else(|err| {
        eprintln!("failed to parse client version! - {:?}", err);
@@ -86,190 +93,28 @@ fn parse_package_version() -> Version {
    version
 }

-fn pre_090_upgrade(from: &str, mut config: Config) -> Config {
-    // this is not extracted to separate function as you only have to manually pass version
-    // if upgrading from pre090 version
-    let from = match from.strip_prefix('v') {
-        Some(stripped) => stripped,
-        None => from,
-    };
-
-    let from = match from.strip_prefix('V') {
-        Some(stripped) => stripped,
-        None => from,
-    };
-
-    let from_version = parse_version(from).expect("invalid version provided!");
-    if from_version.major == 0 && from_version.minor < 8 {
-        // technically this could be implemented, but is there any point in that?
-        eprintln!("upgrading client from before v0.8.0 is not supported. Please run `init` with new binary instead");
-        process::exit(1)
-    }
-
-    if (from_version.major == 0 && from_version.minor >= 9) || from_version.major >= 1 {
-        eprintln!("self reported version is higher than 0.9.0. Those releases should have already contained version numbers in config! Make sure you provided correct version");
-        process::exit(1)
-    }
-
-    // note: current is guaranteed to not have any `build` information suffix (nor pre-release
-    // information), as this was asserted at the beginning of this command)
-    //
-    // upgrade to current (if it's a 0.9.X) or try to upgrade to 0.9.0 as an intermediate
-    // step in future upgrades (so, for example, we might go 0.8.0 -> 0.9.0 -> 0.10.0)
-    // this way we don't need to have all the crazy paths on how to upgrade from any version to any
-    // other version. We just upgrade one minor version at a time.
-    let current = Version::parse(env!("CARGO_PKG_VERSION")).unwrap();
-    let to_version = if current.major == 0 && current.minor == 9 {
-        current
-    } else {
-        Version::new(0, 9, 0)
-    };
-
-    if config.get_base().get_validator_rest_endpoints()[0] != MISSING_VALUE {
-        eprintln!("existing config seems to have specified new validator rest endpoint which was only introduced in 0.9.0! Can't perform upgrade.");
-        print_failed_upgrade(&from_version, &to_version);
-        process::exit(1);
-    }
-
-    print_start_upgrade(&from_version, &to_version);
-
-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    println!(
-        "Setting validator REST endpoint to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&from_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(from_version, to_version);
-
-    config
-}
-
-/*
-changes:
- introduction of mixnet contract address field
- change to default validator rest endpoint
- */
-fn minor_010_upgrade(
+fn minor_0_12_upgrade(
    mut config: Config,
    _matches: &ArgMatches,
    config_version: &Version,
    package_version: &Version,
 ) -> Config {
-    let to_version = if package_version.major == 0 && package_version.minor == 10 {
+    let to_version = if package_version.major == 0 && package_version.minor == 12 {
        package_version.clone()
    } else {
-        Version::new(0, 10, 0)
+        Version::new(0, 12, 0)
    };

    print_start_upgrade(&config_version, &to_version);

-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    if config.get_base().get_validator_mixnet_contract_address() != MISSING_VALUE {
-        eprintln!("existing config seems to have specified mixnet contract address which was only introduced in 0.10.0! Can't perform upgrade.");
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    }
-
    println!(
-        "Setting mixnet contract address to {}",
-        DEFAULT_MIXNET_CONTRACT_ADDRESS
+        "Setting validator API endpoints to {:?}",
+        default_api_endpoints()
    );

    config
        .get_base_mut()
-        .set_mixnet_contract(DEFAULT_MIXNET_CONTRACT_ADDRESS);
-
-    // The default validator endpoint changed
-    println!(
-        "Setting validator REST endpoint to to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(config_version, to_version);
-
-    config
-}
-
-// no changes but version number
-fn patch_010_upgrade(
-    mut config: Config,
-    _matches: &ArgMatches,
-    config_version: &Version,
-    package_version: &Version,
-) -> Config {
-    let to_version = package_version;
-
-    print_start_upgrade(&config_version, &to_version);
-
-    config
-        .get_base_mut()
-        .set_custom_version(to_version.to_string().as_ref());
-
-    config.save_to_file(None).unwrap_or_else(|err| {
-        eprintln!("failed to overwrite config file! - {:?}", err);
-        print_failed_upgrade(&config_version, &to_version);
-        process::exit(1);
-    });
-
-    print_successful_upgrade(config_version, to_version);
-
-    config
-}
-
-fn minor_011_upgrade(
-    mut config: Config,
-    _matches: &ArgMatches,
-    config_version: &Version,
-    package_version: &Version,
-) -> Config {
-    let to_version = package_version;
-
-    print_start_upgrade(&config_version, &to_version);
-
-    println!(
-        "Setting mixnet contract address to {}",
-        DEFAULT_MIXNET_CONTRACT_ADDRESS
-    );
-
-    config
-        .get_base_mut()
-        .set_mixnet_contract(DEFAULT_MIXNET_CONTRACT_ADDRESS);
-
-    // The default validator endpoint changed
-    println!(
-        "Setting validator REST endpoint to {:?}",
-        default_validator_rest_endpoints()
-    );
-
-    config
-        .get_base_mut()
-        .set_custom_validators(default_validator_rest_endpoints());
+        .set_custom_validator_apis(default_api_endpoints());

    config
        .get_base_mut()
@@ -297,18 +142,11 @@ fn do_upgrade(mut config: Config, matches: &ArgMatches, package_version: Version

        config = match config_version.major {
            0 => match config_version.minor {
-                9 => minor_010_upgrade(config, matches, &config_version, &Version::new(0, 10, 0)),
-                10 => match config_version.patch {
-                    0 => {
-                        patch_010_upgrade(config, matches, &config_version, &Version::new(0, 10, 1))
-                    }
-                    _ => {
-                        minor_011_upgrade(config, matches, &config_version, &Version::new(0, 11, 0))
-                    }
-                },
-                _ => unsupported_upgrade(config_version, package_version),
+                9 | 10 => outdated_upgrade(&config_version, &package_version),
+                11 => minor_0_12_upgrade(config, matches, &config_version, &package_version),
+                _ => unsupported_upgrade(&config_version, &package_version),
            },
-            _ => unsupported_upgrade(config_version, package_version),
+            _ => unsupported_upgrade(&config_version, &package_version),
        }
    }
 }
@@ -318,22 +156,14 @@ pub fn execute(matches: &ArgMatches) {

    let id = matches.value_of("id").unwrap();

-    let mut existing_config = Config::load_from_file(Some(id)).unwrap_or_else(|err| {
+    let existing_config = Config::load_from_file(Some(id)).unwrap_or_else(|err| {
        eprintln!("failed to load existing config file! - {:?}", err);
        process::exit(1)
    });

-    // versions fields were added in 0.9.0
    if existing_config.get_base().get_version() == MISSING_VALUE {
-        let self_reported_version = matches.value_of("current version").unwrap_or_else(|| {
-            eprintln!(
-                "trying to upgrade from pre v0.9.0 without providing current system version!"
-            );
-            process::exit(1)
-        });
-
-        // upgrades up to 0.9.0
-        existing_config = pre_090_upgrade(self_reported_version, existing_config);
+        eprintln!("the existing configuration file does not seem to contain version number.");
+        process::exit(1);
    }

    // here be upgrade path to 0.9.X and beyond based on version number from config
@@ -0,0 +1,5 @@
+.DS_Store
+/node_modules/
+/src/node_modules/@sapper/
+yarn-error.log
+/__sapper__/
@@ -0,0 +1,33 @@
+## Prerequisites
+
+On Ubuntu-ish systems (not tested on Debian but may work):
+
+```
+sudo apt update && sudo apt install libwebkit2gtk-4.0-dev \
+    build-essential \
+    curl \
+    wget \
+    libssl-dev \
+    libgtk-3-dev \
+    libappindicator3-dev \
+    patchelf \
+    librsvg2-dev```
+
+
+
+## Getting started
+
+1. Start Sapper([docs](https://sapper.svelte.dev/docs/)) -> `yarn run dev`
+2. Start Tauri([docs](https://tauri.studio/en/)) in another terminal -> `yarn tauri dev`
+3. Start validator-api locally, or override `validator-urls` in `index.svelte`
+
+## Getting around
+
+ Frontend -> `tauri-client/`
+  + logic -> `tauri-client/src/routes/index.svelte`
+  + assets -> `tauri-client/static`
+ Backend -> `tauri-client/src/src-tauri`
+
+## Build standalone app
+
+ yarn tauri build [--debug]
@@ -0,0 +1,38 @@
+{
+  "name": "TODO",
+  "description": "TODO",
+  "version": "0.0.1",
+  "scripts": {
+    "dev": "sapper dev",
+    "build": "sapper build --legacy",
+    "export": "sapper export --legacy",
+    "start": "node __sapper__/build"
+  },
+  "dependencies": {
+    "@tauri-apps/api": "^1.0.0-beta.4",
+    "compression": "^1.7.1",
+    "polka": "next",
+    "qrious": "^4.0.2",
+    "sirv": "^1.0.0"
+  },
+  "devDependencies": {
+    "@babel/core": "^7.0.0",
+    "@babel/plugin-syntax-dynamic-import": "^7.0.0",
+    "@babel/plugin-transform-runtime": "^7.0.0",
+    "@babel/preset-env": "^7.0.0",
+    "@babel/runtime": "^7.0.0",
+    "@rollup/plugin-babel": "^5.0.0",
+    "@rollup/plugin-commonjs": "^14.0.0",
+    "@rollup/plugin-node-resolve": "^8.0.0",
+    "@rollup/plugin-replace": "^2.4.0",
+    "@rollup/plugin-url": "^5.0.0",
+    "@tauri-apps/cli": "^1.0.0-beta.5",
+    "rollup": "^2.3.4",
+    "rollup-plugin-svelte": "^7.0.0",
+    "rollup-plugin-terser": "^7.0.0",
+    "sapper": "^0.28.0",
+    "sass": "^1.35.2",
+    "svelte": "^3.17.3",
+    "svelte-preprocess": "^4.7.4"
+  }
+}
@@ -0,0 +1,140 @@
+import path from "path";
+import resolve from "@rollup/plugin-node-resolve";
+import replace from "@rollup/plugin-replace";
+import commonjs from "@rollup/plugin-commonjs";
+import url from "@rollup/plugin-url";
+import svelte from "rollup-plugin-svelte";
+import babel from "@rollup/plugin-babel";
+import { terser } from "rollup-plugin-terser";
+import config from "sapper/config/rollup.js";
+import pkg from "./package.json";
+import sveltePreprocess from "svelte-preprocess";
+
+const mode = process.env.NODE_ENV;
+const dev = mode === "development";
+const legacy = !!process.env.SAPPER_LEGACY_BUILD;
+
+const onwarn = (warning, onwarn) =>
+  (warning.code === "MISSING_EXPORT" && /'preload'/.test(warning.message)) ||
+  (warning.code === "CIRCULAR_DEPENDENCY" &&
+    /[/\\]@sapper[/\\]/.test(warning.message)) ||
+  onwarn(warning);
+
+export default {
+  client: {
+    input: config.client.input(),
+    output: config.client.output(),
+    plugins: [
+      replace({
+        preventAssignment: true,
+        values: {
+          "process.browser": true,
+          "process.env.NODE_ENV": JSON.stringify(mode),
+        },
+      }),
+      svelte({
+        compilerOptions: {
+          dev,
+          hydratable: true,
+        },
+        preprocess: sveltePreprocess(),
+      }),
+      url({
+        sourceDir: path.resolve(__dirname, "src/node_modules/images"),
+        publicPath: "/client/",
+      }),
+      resolve({
+        browser: true,
+        dedupe: ["svelte"],
+      }),
+      commonjs(),
+
+      legacy &&
+        babel({
+          extensions: [".js", ".mjs", ".html", ".svelte"],
+          babelHelpers: "runtime",
+          exclude: ["node_modules/@babel/**"],
+          presets: [
+            [
+              "@babel/preset-env",
+              {
+                targets: "> 0.25%, not dead",
+              },
+            ],
+          ],
+          plugins: [
+            "@babel/plugin-syntax-dynamic-import",
+            [
+              "@babel/plugin-transform-runtime",
+              {
+                useESModules: true,
+              },
+            ],
+          ],
+        }),
+
+      !dev &&
+        terser({
+          module: true,
+        }),
+    ],
+
+    preserveEntrySignatures: false,
+    onwarn,
+  },
+
+  server: {
+    input: config.server.input(),
+    output: config.server.output(),
+    plugins: [
+      replace({
+        preventAssignment: true,
+        values: {
+          "process.browser": false,
+          "process.env.NODE_ENV": JSON.stringify(mode),
+        },
+      }),
+      svelte({
+        compilerOptions: {
+          dev,
+          generate: "ssr",
+          hydratable: true,
+        },
+        emitCss: false,
+      }),
+      url({
+        sourceDir: path.resolve(__dirname, "src/node_modules/images"),
+        publicPath: "/client/",
+        emitFiles: false, // already emitted by client build
+      }),
+      resolve({
+        dedupe: ["svelte"],
+      }),
+      commonjs(),
+    ],
+    external: Object.keys(pkg.dependencies).concat(
+      require("module").builtinModules
+    ),
+    preserveEntrySignatures: "strict",
+    onwarn,
+  },
+
+  serviceworker: {
+    input: config.serviceworker.input(),
+    output: config.serviceworker.output(),
+    plugins: [
+      resolve(),
+      replace({
+        preventAssignment: true,
+        values: {
+          "process.browser": true,
+          "process.env.NODE_ENV": JSON.stringify(mode),
+        },
+      }),
+      commonjs(),
+      !dev && terser(),
+    ],
+    preserveEntrySignatures: false,
+    onwarn,
+  },
+};
@@ -0,0 +1,304 @@
+/**
+ * Run this script to convert the project to TypeScript. This is only guaranteed to work
+ * on the unmodified default template; if you have done code changes you are likely need
+ * to touch up the generated project manually.
+ */
+
+// @ts-check
+const fs = require('fs');
+const path = require('path');
+const { argv } = require('process');
+
+const projectRoot = argv[2] || path.join(__dirname, '..');
+
+const isRollup = fs.existsSync(path.join(projectRoot, "rollup.config.js"));
+
+function warn(message) {
+	console.warn('Warning: ' + message);
+}
+
+function replaceInFile(fileName, replacements) {
+	if (fs.existsSync(fileName)) {
+		let contents = fs.readFileSync(fileName, 'utf8');
+		let hadUpdates = false;
+
+		replacements.forEach(([from, to]) => {
+			const newContents = contents.replace(from, to);
+
+			const isAlreadyApplied = typeof to !== 'string' || contents.includes(to);
+
+			if (newContents !== contents) {
+				contents = newContents;
+				hadUpdates = true;
+			} else if (!isAlreadyApplied) {
+				warn(`Wanted to update "${from}" in ${fileName}, but did not find it.`);
+			}
+		});
+
+		if (hadUpdates) {
+			fs.writeFileSync(fileName, contents);
+		} else {
+			console.log(`${fileName} had already been updated.`);
+		}
+	} else {
+		warn(`Wanted to update ${fileName} but the file did not exist.`);
+	}
+}
+
+function createFile(fileName, contents) {
+	if (fs.existsSync(fileName)) {
+		warn(`Wanted to create ${fileName}, but it already existed. Leaving existing file.`);
+	} else {
+		fs.writeFileSync(fileName, contents);
+	}
+}
+
+function addDepsToPackageJson() {
+	const pkgJSONPath = path.join(projectRoot, 'package.json');
+	const packageJSON = JSON.parse(fs.readFileSync(pkgJSONPath, 'utf8'));
+	packageJSON.devDependencies = Object.assign(packageJSON.devDependencies, {
+		...(isRollup ? { '@rollup/plugin-typescript': '^6.0.0' } : { 'ts-loader': '^8.0.4' }),
+		'@tsconfig/svelte': '^1.0.10',
+		'@types/compression': '^1.7.0',
+		'@types/node': '^14.11.1',
+		'@types/polka': '^0.5.1',
+		'svelte-check': '^1.0.46',
+		'svelte-preprocess': '^4.3.0',
+		tslib: '^2.0.1',
+		typescript: '^4.0.3'
+	});
+
+	// Add script for checking
+	packageJSON.scripts = Object.assign(packageJSON.scripts, {
+		validate: 'svelte-check --ignore src/node_modules/@sapper'
+	});
+
+	// Write the package JSON
+	fs.writeFileSync(pkgJSONPath, JSON.stringify(packageJSON, null, '  '));
+}
+
+function changeJsExtensionToTs(dir) {
+	const elements = fs.readdirSync(dir, { withFileTypes: true });
+
+	for (let i = 0; i < elements.length; i++) {
+		if (elements[i].isDirectory()) {
+			changeJsExtensionToTs(path.join(dir, elements[i].name));
+		} else if (elements[i].name.match(/^[^_]((?!json).)*js$/)) {
+			fs.renameSync(path.join(dir, elements[i].name), path.join(dir, elements[i].name).replace('.js', '.ts'));
+		}
+	}
+}
+
+function updateSingleSvelteFile({ view, vars, contextModule }) {
+	replaceInFile(path.join(projectRoot, 'src', `${view}.svelte`), [
+		[/(?:<script)(( .*?)*?)>/gm, (m, attrs) => `<script${attrs}${!attrs.includes('lang="ts"') ? ' lang="ts"' : ''}>`],
+		...(vars ? vars.map(({ name, type }) => [`export let ${name};`, `export let ${name}: ${type};`]) : []),
+		...(contextModule ? contextModule.map(({ js, ts }) => [js, ts]) : [])
+	]);
+}
+
+// Switch the *.svelte file to use TS
+function updateSvelteFiles() {
+	[
+		{
+			view: 'components/Nav',
+			vars: [{ name: 'segment', type: 'string' }]
+		},
+		{
+			view: 'routes/_layout',
+			vars: [{ name: 'segment', type: 'string' }]
+		},
+		{
+			view: 'routes/_error',
+			vars: [
+				{ name: 'status', type: 'number' },
+				{ name: 'error', type: 'Error' }
+			]
+		},
+		{
+			view: 'routes/blog/index',
+			vars: [{ name: 'posts', type: '{ slug: string; title: string, html: any }[]' }],
+			contextModule: [
+				{
+					js: '.then(r => r.json())',
+					ts: '.then((r: { json: () => any; }) => r.json())'
+				},
+				{
+					js: '.then(posts => {',
+					ts: '.then((posts: { slug: string; title: string, html: any }[]) => {'
+				}
+			]
+		},
+		{
+			view: 'routes/blog/[slug]',
+			vars: [{ name: 'post', type: '{ slug: string; title: string, html: any }' }]
+		}
+	].forEach(updateSingleSvelteFile);
+}
+
+function updateRollupConfig() {
+	// Edit rollup config
+	replaceInFile(path.join(projectRoot, 'rollup.config.js'), [
+		// Edit imports
+		[
+			/'rollup-plugin-terser';\n(?!import sveltePreprocess)/,
+			`'rollup-plugin-terser';
+import sveltePreprocess from 'svelte-preprocess';
+import typescript from '@rollup/plugin-typescript';
+`
+		],
+		// Edit inputs
+		[
+			/(?<!THIS_IS_UNDEFINED[^\n]*\n\s*)onwarn\(warning\);/,
+			`(warning.code === 'THIS_IS_UNDEFINED') ||\n\tonwarn(warning);`
+		],
+		[/input: config.client.input\(\)(?!\.replace)/, `input: config.client.input().replace(/\\.js$/, '.ts')`],
+		[
+			/input: config.server.input\(\)(?!\.replace)/,
+			`input: { server: config.server.input().server.replace(/\\.js$/, ".ts") }`
+		],
+		[
+			/input: config.serviceworker.input\(\)(?!\.replace)/,
+			`input: config.serviceworker.input().replace(/\\.js$/, '.ts')`
+		],
+		// Add preprocess
+		[/compilerOptions/g, 'preprocess: sveltePreprocess({ sourceMap: dev }),\n\t\t\t\tcompilerOptions'],
+		// Add TypeScript
+		[/commonjs\(\)(?!,\n\s*typescript)/g, 'commonjs(),\n\t\t\ttypescript({ sourceMap: dev })']
+	]);
+}
+
+function updateWebpackConfig() {
+	// Edit webpack config
+	replaceInFile(path.join(projectRoot, 'webpack.config.js'), [
+		// Edit imports
+		[
+			/require\('webpack-modules'\);\n(?!const sveltePreprocess)/,
+			`require('webpack-modules');\nconst sveltePreprocess = require('svelte-preprocess');\n`
+		],
+		// Edit extensions
+		[
+			/\['\.mjs', '\.js', '\.json', '\.svelte', '\.html'\]/,
+			`['.mjs', '.js', '.ts', '.json', '.svelte', '.html']`
+		],
+		// Edit entries
+		[
+			/entry: config\.client\.entry\(\)/,
+			`entry: { main: config.client.entry().main.replace(/\\.js$/, '.ts') }`
+		],
+		[
+			/entry: config\.server\.entry\(\)/,
+			`entry: { server: config.server.entry().server.replace(/\\.js$/, '.ts') }`
+		],
+		[
+			/entry: config\.serviceworker\.entry\(\)/,
+			`entry: { 'service-worker': config.serviceworker.entry()['service-worker'].replace(/\\.js$/, '.ts') }`
+		],
+		[
+      /loader: 'svelte-loader',\n\t\t\t\t\t\toptions: {/g,
+      'loader: \'svelte-loader\',\n\t\t\t\t\t\toptions: {\n\t\t\t\t\t\t\tpreprocess: sveltePreprocess({ sourceMap: dev }),'
+    ],
+		// Add TypeScript rules for client and server
+		[
+			/module: {\n\s*rules: \[\n\s*(?!{\n\s*test: \/\\\.ts\$\/)/g,
+			`module: {\n\t\t\trules: [\n\t\t\t\t{\n\t\t\t\t\ttest: /\\.ts$/,\n\t\t\t\t\tloader: 'ts-loader'\n\t\t\t\t},\n\t\t\t\t`
+		],
+		// Add TypeScript rules for serviceworker
+		[
+			/output: config\.serviceworker\.output\(\),\n\s*(?!module)/,
+			`output: config.serviceworker.output(),\n\t\tmodule: {\n\t\t\trules: [\n\t\t\t\t{\n\t\t\t\t\ttest: /\\.ts$/,\n\t\t\t\t\tloader: 'ts-loader'\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\t`
+		],
+		// Edit outputs
+		[
+			/output: config\.serviceworker\.output\(\),\n\s*(?!resolve)/,
+			`output: config.serviceworker.output(),\n\t\tresolve: { extensions: ['.mjs', '.js', '.ts', '.json'] },\n\t\t`
+		]
+	]);
+}
+
+function updateServiceWorker() {
+	replaceInFile(path.join(projectRoot, 'src', 'service-worker.ts'), [
+		[`shell.concat(files);`, `(shell as string[]).concat(files as string[]);`],
+		[`self.skipWaiting();`, `((self as any) as ServiceWorkerGlobalScope).skipWaiting();`],
+		[`self.clients.claim();`, `((self as any) as ServiceWorkerGlobalScope).clients.claim();`],
+		[`fetchAndCache(request)`, `fetchAndCache(request: Request)`],
+		[`self.addEventListener('activate', event =>`, `self.addEventListener('activate', (event: ExtendableEvent) =>`],
+		[`self.addEventListener('install', event =>`, `self.addEventListener('install', (event: ExtendableEvent) =>`],
+		[`addEventListener('fetch', event =>`, `addEventListener('fetch', (event: FetchEvent) =>`],
+	]);
+}
+
+function createTsConfig() {
+	const tsconfig = `{
+		"extends": "@tsconfig/svelte/tsconfig.json",
+		"compilerOptions": {
+			"lib": ["DOM", "ES2017", "WebWorker"]
+		},
+		"include": ["src/**/*", "src/node_modules/**/*"],
+		"exclude": ["node_modules/*", "__sapper__/*", "static/*"]
+	}`;
+
+	createFile(path.join(projectRoot, 'tsconfig.json'), tsconfig);
+}
+
+// Adds the extension recommendation
+function configureVsCode() {
+	const dir = path.join(projectRoot, '.vscode');
+
+	if (!fs.existsSync(dir)) {
+		fs.mkdirSync(dir);
+	}
+
+	createFile(path.join(projectRoot, '.vscode', 'extensions.json'), `{"recommendations": ["svelte.svelte-vscode"]}`);
+}
+
+function deleteThisScript() {
+	fs.unlinkSync(path.join(__filename));
+
+	// Check for Mac's DS_store file, and if it's the only one left remove it
+	const remainingFiles = fs.readdirSync(path.join(__dirname));
+	if (remainingFiles.length === 1 && remainingFiles[0] === '.DS_store') {
+		fs.unlinkSync(path.join(__dirname, '.DS_store'));
+	}
+
+	// Check if the scripts folder is empty
+	if (fs.readdirSync(path.join(__dirname)).length === 0) {
+		// Remove the scripts folder
+		fs.rmdirSync(path.join(__dirname));
+	}
+}
+
+console.log(`Adding TypeScript with ${isRollup ? "Rollup" : "webpack" }...`);
+
+addDepsToPackageJson();
+
+changeJsExtensionToTs(path.join(projectRoot, 'src'));
+
+updateSvelteFiles();
+
+if (isRollup) {
+	updateRollupConfig();
+} else {
+	updateWebpackConfig();
+}
+
+updateServiceWorker();
+
+createTsConfig();
+
+configureVsCode();
+
+// Delete this script, but not during testing
+if (!argv[2]) {
+	deleteThisScript();
+}
+
+console.log('Converted to TypeScript.');
+
+if (fs.existsSync(path.join(projectRoot, 'node_modules'))) {
+	console.log(`
+Next:
+1. run 'npm install' again to install TypeScript dependencies
+2. run 'npm run build' for the @sapper imports in your project to work
+`);
+}
@@ -0,0 +1,4 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+WixTools
@@ -0,0 +1,30 @@
+[package]
+name = "app"
+version = "0.1.0"
+description = "A Tauri App"
+authors = ["you"]
+license = ""
+repository = ""
+default-run = "app"
+edition = "2018"
+build = "src/build.rs"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[build-dependencies]
+tauri-build = { version = "1.0.0-beta.2" }
+
+[dependencies]
+serde_json = "1.0"
+serde = { version = "1.0", features = ["derive"] }
+tauri = { version = "1.0.0-beta.4", features = [] }
+tokio = "1.4"
+url = "2.2"
+
+coconut-interface = { path = "../../../common/coconut-interface" }
+credentials = { path = "../../../common/credentials" }
+validator-client = {path = "../../../common/client-libs/validator-client"}
+
+[features]
+default = ["custom-protocol"]
+custom-protocol = ["tauri/custom-protocol"]
@@ -0,0 +1,13 @@
+max_width = 100
+hard_tabs = false
+tab_spaces = 2
+newline_style = "Auto"
+use_small_heuristics = "Default"
+reorder_imports = true
+reorder_modules = true
+remove_nested_parens = true
+edition = "2018"
+merge_derives = true
+use_try_shorthand = false
+use_field_init_shorthand = false
+force_explicit_abi = true
@@ -0,0 +1,3 @@
+fn main() {
+  tauri_build::build()
+}
@@ -0,0 +1,199 @@
+#![cfg_attr(
+  all(not(debug_assertions), target_os = "windows"),
+  windows_subsystem = "windows"
+)]
+
+use coconut_interface::{
+  self, hash_to_scalar, Attribute, Credential, Parameters, Signature, Theta, VerificationKey,
+};
+use credentials::{obtain_aggregate_signature, obtain_aggregate_verification_key};
+use std::sync::Arc;
+use tokio::sync::RwLock;
+use url::Url;
+
+struct State {
+  signatures: Vec<Signature>,
+  n_attributes: u32,
+  params: Parameters,
+  public_attributes_bytes: Vec<Vec<u8>>,
+  public_attributes: Vec<Attribute>,
+  private_attributes: Vec<Attribute>,
+  aggregated_verification_key: Option<VerificationKey>,
+}
+
+impl State {
+  fn init(public_attributes_bytes: Vec<Vec<u8>>, private_attributes_bytes: Vec<Vec<u8>>) -> State {
+    let n_attributes = (public_attributes_bytes.len() + private_attributes_bytes.len()) as u32;
+    let params = Parameters::new(n_attributes).unwrap();
+    let public_attributes = public_attributes_bytes
+      .iter()
+      .map(hash_to_scalar)
+      .collect::<Vec<Attribute>>();
+    let private_attributes = private_attributes_bytes
+      .iter()
+      .map(hash_to_scalar)
+      .collect::<Vec<Attribute>>();
+    State {
+      signatures: Vec::new(),
+      n_attributes,
+      params,
+      public_attributes_bytes,
+      public_attributes,
+      private_attributes,
+      aggregated_verification_key: None,
+    }
+  }
+}
+
+fn parse_url_validators(raw: &[String]) -> Result<Vec<Url>, String> {
+  let mut parsed_urls = Vec::with_capacity(raw.len());
+  for url in raw {
+    let parsed_url: Url = url
+      .parse()
+      .map_err(|err| format!("one of validator urls is malformed - {}", err))?;
+    parsed_urls.push(parsed_url)
+  }
+  Ok(parsed_urls)
+}
+
+#[tauri::command]
+async fn randomise_credential(
+  idx: usize,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<Vec<Signature>, String> {
+  let mut state = state.write().await;
+  let signature = state.signatures.remove(idx);
+  let new = signature.randomise(&state.params);
+  state.signatures.insert(idx, new);
+  Ok(state.signatures.clone())
+}
+
+#[tauri::command]
+async fn delete_credential(
+  idx: usize,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<Vec<Signature>, String> {
+  let mut state = state.write().await;
+  state.signatures.remove(idx);
+  Ok(state.signatures.clone())
+}
+
+#[tauri::command]
+async fn list_credentials(
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<Vec<Signature>, String> {
+  let state = state.read().await;
+  Ok(state.signatures.clone())
+}
+
+async fn get_aggregated_verification_key(
+  validator_urls: Vec<String>,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<VerificationKey, String> {
+  if let Some(verification_key) = &state.read().await.aggregated_verification_key {
+    return Ok(verification_key.clone());
+  }
+
+  let parsed_urls = parse_url_validators(&validator_urls)?;
+  let key = obtain_aggregate_verification_key(&parsed_urls)
+    .await
+    .map_err(|err| format!("failed to obtain aggregate verification key - {:?}", err))?;
+
+  state
+    .write()
+    .await
+    .aggregated_verification_key
+    .replace(key.clone());
+
+  Ok(key)
+}
+
+async fn prove_credential(
+  idx: usize,
+  validator_urls: Vec<String>,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<Theta, String> {
+  let verification_key = get_aggregated_verification_key(validator_urls, state.clone()).await?;
+  let state = state.read().await;
+
+  if let Some(signature) = state.signatures.get(idx) {
+    match coconut_interface::prove_credential(
+      &state.params,
+      &verification_key,
+      signature,
+      &state.private_attributes,
+    ) {
+      Ok(theta) => Ok(theta),
+      Err(e) => Err(format!("{}", e)),
+    }
+  } else {
+    Err("Got invalid Signature idx".to_string())
+  }
+}
+
+#[tauri::command]
+async fn verify_credential(
+  idx: usize,
+  validator_urls: Vec<String>,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<bool, String> {
+  // the API needs to be improved but at least it should compile (in theory)
+  let verification_key =
+    get_aggregated_verification_key(validator_urls.clone(), state.clone()).await?;
+  let theta = prove_credential(idx, validator_urls, state.clone()).await?;
+
+  let state = state.read().await;
+
+  let credential = Credential::new(
+    state.n_attributes,
+    theta,
+    state.public_attributes_bytes.clone(),
+    state
+      .signatures
+      .get(idx)
+      .ok_or("Got invalid signature idx")?,
+  );
+
+  Ok(credential.verify(&verification_key))
+}
+
+#[tauri::command]
+async fn get_credential(
+  validator_urls: Vec<String>,
+  state: tauri::State<'_, Arc<RwLock<State>>>,
+) -> Result<Vec<Signature>, String> {
+  let guard = state.read().await;
+  let parsed_urls = parse_url_validators(&validator_urls)?;
+
+  let signature = obtain_aggregate_signature(
+    &guard.params,
+    &guard.public_attributes,
+    &guard.private_attributes,
+    &parsed_urls,
+  )
+  .await
+  .map_err(|err| format!("failed to obtain aggregate signature - {:?}", err))?;
+
+  let mut state = state.write().await;
+  state.signatures.push(signature);
+  Ok(state.signatures.clone())
+}
+
+fn main() {
+  let public_attributes = vec![b"public_key".to_vec()];
+  let private_attributes = vec![b"private_key".to_vec()];
+  tauri::Builder::default()
+    .manage(Arc::new(RwLock::new(State::init(
+      public_attributes,
+      private_attributes,
+    ))))
+    .invoke_handler(tauri::generate_handler![
+      get_credential,
+      randomise_credential,
+      delete_credential,
+      list_credentials,
+      verify_credential
+    ])
+    .run(tauri::generate_context!())
+    .expect("error while running tauri application");
+}
@@ -0,0 +1,65 @@
+{
+  "package": {
+    "productName": "nym-tauri-client",
+    "version": "0.1.0"
+  },
+  "build": {
+    "distDir": "../__sapper__/export",
+    "devPath": "http://localhost:3000",
+    "beforeDevCommand": "",
+    "beforeBuildCommand": "yarn run export"
+  },
+  "tauri": {
+    "bundle": {
+      "active": true,
+      "targets": "all",
+      "identifier": "com.tauri.dev",
+      "icon": [
+        "icons/32x32.png",
+        "icons/128x128.png",
+        "icons/128x128@2x.png",
+        "icons/icon.icns",
+        "icons/icon.ico"
+      ],
+      "resources": [],
+      "externalBin": [],
+      "copyright": "",
+      "category": "DeveloperTool",
+      "shortDescription": "",
+      "longDescription": "",
+      "deb": {
+        "depends": [],
+        "useBootstrapper": false
+      },
+      "macOS": {
+        "frameworks": [],
+        "minimumSystemVersion": "",
+        "useBootstrapper": false,
+        "exceptionDomain": "",
+        "signingIdentity": null,
+        "entitlements": null
+      },
+      "windows": {
+        "certificateThumbprint": null,
+        "digestAlgorithm": "sha256",
+        "timestampUrl": ""
+      }
+    },
+    "updater": {
+      "active": false
+    },
+    "allowlist": {},
+    "windows": [
+      {
+        "title": "Nym Client",
+        "width": 800,
+        "height": 1000,
+        "resizable": true,
+        "fullscreen": false
+      }
+    ],
+    "security": {
+      "csp": "default-src blob: data: filesystem: ws: wss: http: https: tauri: 'unsafe-eval' 'unsafe-inline' 'self' img-src: 'self'"
+    }
+  }
+}
@@ -0,0 +1,39 @@
+/**
+ * These declarations tell TypeScript that we allow import of images, e.g.
+ * ```
+		<script lang='ts'>
+			import successkid from 'images/successkid.jpg';
+		</script>
+
+		<img src="{successkid}">
+	 ```
+ */
+declare module "*.gif" {
+	const value: string;
+	export default value;
+}
+
+declare module "*.jpg" {
+	const value: string;
+	export default value;
+}
+
+declare module "*.jpeg" {
+	const value: string;
+	export default value;
+}
+
+declare module "*.png" {
+	const value: string;
+	export default value;
+}
+
+declare module "*.svg" {
+	const value: string;
+	export default value;
+}
+
+declare module "*.webp" {
+	const value: string;
+	export default value;
+}
@@ -0,0 +1,5 @@
+import * as sapper from '@sapper/app';
+
+sapper.start({
+	target: document.querySelector('#sapper')
+});
@@ -0,0 +1,3 @@
+<nav>
+	<img src="coconut-120.png" style="width: 120px" alt=""/>
+</nav>
@@ -0,0 +1,40 @@
+<script>
+	export let status;
+	export let error;
+
+	const dev = process.env.NODE_ENV === 'development';
+</script>
+
+<style>
+	h1, p {
+		margin: 0 auto;
+	}
+
+	h1 {
+		font-size: 2.8em;
+		font-weight: 700;
+		margin: 0 0 0.5em 0;
+	}
+
+	p {
+		margin: 1em auto;
+	}
+
+	@media (min-width: 480px) {
+		h1 {
+			font-size: 4em;
+		}
+	}
+</style>
+
+<svelte:head>
+	<title>{status}</title>
+</svelte:head>
+
+<h1>{status}</h1>
+
+<p>{error.message}</p>
+
+{#if dev && error.stack}
+	<pre>{error.stack}</pre>
+{/if}
@@ -0,0 +1,22 @@
+<script>
+	import Nav from '../components/Nav.svelte';
+
+	// export let segment;
+</script>
+
+<style>
+	main {
+		position: relative;
+		max-width: 56em;
+		/* background-color: white; */
+		padding: 2em;
+		margin: 0 auto;
+		box-sizing: border-box;
+	}
+</style>
+
+<Nav />
+
+<main>
+	<slot></slot>
+</main>
@@ -0,0 +1,119 @@
+<script>
+  import {invoke} from "@tauri-apps/api/tauri";
+  import {onMount} from "svelte";
+  import QRious from "qrious";
+
+  const validator_urls = ["http://localhost:8080"];
+  let signatures = [];
+  let qrVisible = false;
+
+  async function getCredential() {
+    signatures = await invoke("get_credential", {
+      validatorUrls: validator_urls,
+    });
+  }
+
+  async function randomiseCredential(idx) {
+    signatures = await invoke("randomise_credential", {
+      idx: idx,
+    });
+  }
+
+  async function verifyCredential(idx) {
+    const response = await invoke("verify_credential", {
+      idx: idx,
+      validatorUrls: validator_urls,
+    });
+    alert(response);
+  }
+
+  async function deleteCredential(idx) {
+    signatures = await invoke("delete_credential", {
+      idx: idx,
+    });
+  }
+
+  async function listCredentials() {
+    signatures = await invoke("list_credentials");
+  }
+
+  function signatureQR(idx) {
+    qrVisible = true;
+    const signature = signatures[idx];
+    new QRious({
+      element: document.getElementById("qr"),
+      value: signature,
+      foreground: "white",
+      background: "black",
+      size: 148,
+    });
+  }
+
+  onMount(() => {
+    listCredentials();
+  });
+</script>
+
+<svelte:head>
+  <title>Coconut</title>
+</svelte:head>
+
+<button class="btn btn-success" on:click={getCredential}>Get Credential</button>
+<hr />
+<table class="table table-dark">
+  {#each signatures as signature, idx}
+    <tr>
+      <td><p>{signature.slice(0, 12)}</p></td>
+      <td>
+        <div class="btn-group" role="group" aria-label="Basic example">
+          <button
+            class="btn btn-primary"
+            on:click={() => {
+              randomiseCredential(idx);
+            }}>Randomize</button
+          ><button
+            class="btn btn-danger"
+            on:click={() => {
+              deleteCredential(idx);
+            }}>Delete</button
+          >
+          <button
+            class="btn btn-info"
+            on:click={() => {
+              signatureQR(idx);
+            }}>QR</button
+          >
+          <button
+            class="btn btn-primary"
+            on:click={() => {
+              verifyCredential(idx);
+            }}>Verify</button
+          >
+        </div></td
+      >
+    </tr>
+  {/each}
+</table>
+
+<div
+  class="modal"
+  tabindex="-1"
+  style={qrVisible ? "display: block" : "display: none"}
+>
+  <div class="modal-dialog modal-sm">
+    <div class="modal-content">
+      <div class="modal-body">
+        <canvas id="qr"></canvas>
+        <button
+          type="button"
+          class="close"
+          on:click={() => (qrVisible = false)}
+        >
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- <div><br /></div> -->
@@ -0,0 +1,17 @@
+import sirv from 'sirv';
+import polka from 'polka';
+import compression from 'compression';
+import * as sapper from '@sapper/server';
+
+const { PORT, NODE_ENV } = process.env;
+const dev = NODE_ENV === 'development';
+
+polka() // You can also use Express
+	.use(
+		compression({ threshold: 0 }),
+		sirv('static', { dev }),
+		sapper.middleware()
+	)
+	.listen(PORT, err => {
+		if (err) console.log('error', err);
+	});
@@ -0,0 +1,86 @@
+import { timestamp, files, shell } from '@sapper/service-worker';
+
+const ASSETS = `cache${timestamp}`;
+
+// `shell` is an array of all the files generated by the bundler,
+// `files` is an array of everything in the `static` directory
+const to_cache = shell.concat(files);
+const staticAssets = new Set(to_cache);
+
+self.addEventListener('install', event => {
+	event.waitUntil(
+		caches
+			.open(ASSETS)
+			.then(cache => cache.addAll(to_cache))
+			.then(() => {
+				self.skipWaiting();
+			})
+	);
+});
+
+self.addEventListener('activate', event => {
+	event.waitUntil(
+		caches.keys().then(async keys => {
+			// delete old caches
+			for (const key of keys) {
+				if (key !== ASSETS) await caches.delete(key);
+			}
+
+			self.clients.claim();
+		})
+	);
+});
+
+
+/**
+ * Fetch the asset from the network and store it in the cache. 
+ * Fall back to the cache if the user is offline.
+ */
+async function fetchAndCache(request) {
+	const cache = await caches.open(`offline${timestamp}`)
+
+	try {
+		const response = await fetch(request);
+		cache.put(request, response.clone());
+		return response;
+	} catch (err) {
+		const response = await cache.match(request);
+		if (response) return response;
+
+		throw err;
+	}
+}
+
+self.addEventListener('fetch', event => {
+	if (event.request.method !== 'GET' || event.request.headers.has('range')) return;
+
+	const url = new URL(event.request.url);
+
+	// don't try to handle e.g. data: URIs
+	const isHttp = url.protocol.startsWith('http');
+	const isDevServerRequest = url.hostname === self.location.hostname && url.port !== self.location.port;
+	const isStaticAsset = url.host === self.location.host && staticAssets.has(url.pathname);
+	const skipBecauseUncached = event.request.cache === 'only-if-cached' && !isStaticAsset;
+
+	if (isHttp && !isDevServerRequest && !skipBecauseUncached) {
+		event.respondWith(
+			(async () => {
+				// always serve static files and bundler-generated assets from cache.
+				// if your application has other URLs with data that will never change,
+				// set this variable to true for them and they will only be fetched once.
+				const cachedAsset = isStaticAsset && await caches.match(event.request);
+
+				// for pages, you might want to serve a shell `service-worker-index.html` file,
+				// which Sapper has generated for you. It's not right for every
+				// app, but if it's right for yours then uncomment this section
+				/*
+				if (!cachedAsset && url.origin === self.origin && routes.find(route => route.pattern.test(url.pathname))) {
+					return caches.match('/service-worker-index.html');
+				}
+				*/
+
+				return cachedAsset || fetchAndCache(event.request);
+			})()
+		);
+	}
+});
@@ -0,0 +1,36 @@
+<!doctype html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width,initial-scale=1.0">
+
+	%sapper.base%
+
+	<link rel="stylesheet" href="stylesheets/bootstrap.min.css">
+	<link rel="stylesheet" href="stylesheets/bootstrap-grid.min.css">
+	<link rel="stylesheet" href="stylesheets/bootstrap-reboot.min.css"> 
+	<link rel="stylesheet" href="stylesheets/bundle.min.css">
+	<link rel="manifest" href="manifest.json" crossorigin="use-credentials">
+	<link rel="icon" type="image/png" href="favicon.png">
+	<link rel="apple-touch-icon" href="logo-192.png">
+
+	<!-- Sapper creates a <script> tag containing `src/client.js`
+	     and anything else it needs to hydrate the app and
+	     initialise the router -->
+	%sapper.scripts%
+
+	<!-- Sapper generates a <style> tag containing critical CSS
+	     for the current page. CSS for the rest of the app is
+	     lazily loaded when it precaches secondary pages -->
+	%sapper.styles%
+
+	<!-- This contains the contents of the <svelte:head> component, if
+	     the current page has one -->
+	%sapper.head%
+</head>
+<body>
+	<!-- The application will be rendered inside this element,
+	     because `src/client.js` references it -->
+	<div id="sapper">%sapper.html%</div>
+</body>
+</html>
--- a/Show More
+++ b/Show More