SKE: Verify initiator's public key always
[silc.git] / lib / silcske / silcske.c
index d49d9ccb040a412e82d7abbdc6b96198bf6ae791..caf2579628bf9a1a426057a5179f2949dfa5d07e 100644 (file)
@@ -4,7 +4,7 @@
 
   Author: Pekka Riikonen <priikone@silcnet.org>
 
-  Copyright (C) 2000 - 2006 Pekka Riikonen
+  Copyright (C) 2000 - 2008 Pekka Riikonen
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -55,6 +55,11 @@ SILC_FSM_STATE(silc_ske_st_responder_error);
 SILC_FSM_STATE(silc_ske_st_rekey_initiator_start);
 SILC_FSM_STATE(silc_ske_st_rekey_initiator_done);
 SILC_FSM_STATE(silc_ske_st_rekey_initiator_end);
+SILC_FSM_STATE(silc_ske_st_rekey_responder_wait);
+SILC_FSM_STATE(silc_ske_st_rekey_responder_start);
+SILC_FSM_STATE(silc_ske_st_rekey_responder_done);
+SILC_FSM_STATE(silc_ske_st_rekey_responder_end);
+SILC_TASK_CALLBACK(silc_ske_packet_send_retry);
 
 SilcSKEKeyMaterial
 silc_ske_process_key_material(SilcSKE ske,
@@ -81,7 +86,8 @@ static SilcBool silc_ske_packet_receive(SilcPacketEngine engine,
   /* Clear retransmission */
   ske->retry_timer = SILC_SKE_RETRY_MIN;
   ske->retry_count = 0;
-  silc_schedule_task_del_by_context(ske->schedule, ske);
+  silc_schedule_task_del_by_callback(ske->schedule,
+                                    silc_ske_packet_send_retry);
 
   /* Signal for new packet */
   ske->packet = packet;
@@ -108,8 +114,10 @@ static SilcBool silc_ske_packet_receive(SilcPacketEngine engine,
       silc_fsm_next(&ske->fsm, silc_ske_st_initiator_failure);
   }
 
-  /* Handle rekey synchronously */
-  if (ske->rekeying)
+  /* Handle rekey and SUCCESS packets synchronously.  After SUCCESS packets
+     they keys are taken into use immediately, hence the synchronous
+     processing to get the keys in use as soon as possible. */
+  if (ske->rekeying || packet->type == SILC_PACKET_SUCCESS)
     silc_fsm_continue_sync(&ske->fsm);
   else
     silc_fsm_continue(&ske->fsm);
@@ -174,36 +182,17 @@ static void silc_ske_skr_callback(SilcSKR repository,
 
 static SilcSKEStatus silc_ske_check_version(SilcSKE ske)
 {
-  SilcUInt32 l_protocol_version = 0, r_protocol_version = 0;
   SilcUInt32 r_software_version = 0;
+  char *r_software_string = NULL;
 
   if (!ske->remote_version || !ske->version)
     return SILC_SKE_STATUS_BAD_VERSION;
 
-  if (!silc_parse_version_string(ske->remote_version, &r_protocol_version,
-                                NULL, &r_software_version, NULL, NULL))
-    return SILC_SKE_STATUS_BAD_VERSION;
-
-  if (!silc_parse_version_string(ske->version, &l_protocol_version,
-                                NULL, NULL, NULL, NULL))
-    return SILC_SKE_STATUS_BAD_VERSION;
-
-  /* If remote is too new, don't connect */
-  if (l_protocol_version < r_protocol_version)
+  if (!silc_parse_version_string(ske->remote_version, NULL, NULL,
+                                &r_software_version,
+                                &r_software_string, NULL))
     return SILC_SKE_STATUS_BAD_VERSION;
 
-  /* Backwards compatibility checks */
-
-  /* Old server versions requires "valid" looking Source ID in the SILC
-     packets during initial key exchange.  All version before 1.1.0. */
-  if (r_software_version < 110) {
-    SilcClientID id;
-    memset(&id, 0, sizeof(id));
-    id.ip.data_len = 4;
-    SILC_LOG_DEBUG(("Remote is old version, add dummy Source ID to packets"));
-    silc_packet_set_ids(ske->stream, SILC_ID_CLIENT, &id, 0, NULL);
-  }
-
   return SILC_SKE_STATUS_OK;
 }
 
@@ -682,19 +671,23 @@ static SilcSKEStatus silc_ske_make_hash(SilcSKE ske,
 {
   SilcSKEStatus status = SILC_SKE_STATUS_OK;
   SilcBuffer buf;
-  unsigned char *e, *f, *KEY;
-  SilcUInt32 e_len, f_len, KEY_len;
+  unsigned char *e, *f, *KEY, *s_data;
+  SilcUInt32 e_len, f_len, KEY_len, s_len;
   int ret;
 
   SILC_LOG_DEBUG(("Start"));
 
   if (initiator == FALSE) {
+    s_data = (ske->start_payload_copy ?
+            silc_buffer_data(ske->start_payload_copy) : NULL);
+    s_len = (ske->start_payload_copy ?
+            silc_buffer_len(ske->start_payload_copy) : 0);
     e = silc_mp_mp2bin(&ske->ke1_payload->x, 0, &e_len);
     f = silc_mp_mp2bin(&ske->ke2_payload->x, 0, &f_len);
     KEY = silc_mp_mp2bin(ske->KEY, 0, &KEY_len);
 
     /* Format the buffer used to compute the hash value */
-    buf = silc_buffer_alloc_size(silc_buffer_len(ske->start_payload_copy) +
+    buf = silc_buffer_alloc_size(s_len +
                                 ske->ke2_payload->pk_len +
                                 ske->ke1_payload->pk_len +
                                 e_len + f_len + KEY_len);
@@ -705,28 +698,24 @@ static SilcSKEStatus silc_ske_make_hash(SilcSKE ske,
     if (!ske->ke1_payload->pk_data) {
       ret =
        silc_buffer_format(buf,
-                          SILC_STR_UI_XNSTRING(
-                                  ske->start_payload_copy->data,
-                                  silc_buffer_len(ske->start_payload_copy)),
-                          SILC_STR_UI_XNSTRING(ske->ke2_payload->pk_data,
-                                               ske->ke2_payload->pk_len),
-                          SILC_STR_UI_XNSTRING(e, e_len),
-                          SILC_STR_UI_XNSTRING(f, f_len),
-                          SILC_STR_UI_XNSTRING(KEY, KEY_len),
+                          SILC_STR_DATA(s_data, s_len),
+                          SILC_STR_DATA(ske->ke2_payload->pk_data,
+                                        ske->ke2_payload->pk_len),
+                          SILC_STR_DATA(e, e_len),
+                          SILC_STR_DATA(f, f_len),
+                          SILC_STR_DATA(KEY, KEY_len),
                           SILC_STR_END);
     } else {
       ret =
        silc_buffer_format(buf,
-                          SILC_STR_UI_XNSTRING(
-                                  ske->start_payload_copy->data,
-                                  silc_buffer_len(ske->start_payload_copy)),
-                          SILC_STR_UI_XNSTRING(ske->ke2_payload->pk_data,
-                                               ske->ke2_payload->pk_len),
-                          SILC_STR_UI_XNSTRING(ske->ke1_payload->pk_data,
-                                               ske->ke1_payload->pk_len),
-                          SILC_STR_UI_XNSTRING(e, e_len),
-                          SILC_STR_UI_XNSTRING(f, f_len),
-                          SILC_STR_UI_XNSTRING(KEY, KEY_len),
+                          SILC_STR_DATA(s_data, s_len),
+                          SILC_STR_DATA(ske->ke2_payload->pk_data,
+                                        ske->ke2_payload->pk_len),
+                          SILC_STR_DATA(ske->ke1_payload->pk_data,
+                                        ske->ke1_payload->pk_len),
+                          SILC_STR_DATA(e, e_len),
+                          SILC_STR_DATA(f, f_len),
+                          SILC_STR_DATA(KEY, KEY_len),
                           SILC_STR_END);
     }
     if (ret == -1) {
@@ -747,21 +736,23 @@ static SilcSKEStatus silc_ske_make_hash(SilcSKE ske,
     silc_free(f);
     silc_free(KEY);
   } else {
+    s_data = (ske->start_payload_copy ?
+            silc_buffer_data(ske->start_payload_copy) : NULL);
+    s_len = (ske->start_payload_copy ?
+            silc_buffer_len(ske->start_payload_copy) : 0);
     e = silc_mp_mp2bin(&ske->ke1_payload->x, 0, &e_len);
 
-    buf = silc_buffer_alloc_size(silc_buffer_len(ske->start_payload_copy) +
-                                ske->ke1_payload->pk_len + e_len);
+    buf = silc_buffer_alloc_size(s_len + ske->ke1_payload->pk_len + e_len);
     if (!buf)
       return SILC_SKE_STATUS_OUT_OF_MEMORY;
 
     /* Format the buffer used to compute the hash value */
     ret =
       silc_buffer_format(buf,
-                        SILC_STR_UI_XNSTRING(ske->start_payload_copy->data,
-                                    silc_buffer_len(ske->start_payload_copy)),
-                        SILC_STR_UI_XNSTRING(ske->ke1_payload->pk_data,
-                                             ske->ke1_payload->pk_len),
-                        SILC_STR_UI_XNSTRING(e, e_len),
+                        SILC_STR_DATA(s_data, s_len),
+                        SILC_STR_DATA(ske->ke1_payload->pk_data,
+                                      ske->ke1_payload->pk_len),
+                        SILC_STR_DATA(e, e_len),
                         SILC_STR_END);
     if (ret == -1) {
       silc_buffer_free(buf);
@@ -964,15 +955,11 @@ static SilcBool silc_ske_packet_send(SilcSKE ske,
   return ret;
 }
 
-/* SKE FSM destructor.  We call completion callback here.  All SKE
-   machines go here and call the completion.  Completion must not be called
-   from any other place. */
+/* Calls completion callback.  Completion is called always in this function
+   and must not be called anywhere else. */
 
-static void silc_ske_finished(SilcFSM fsm, void *fsm_context,
-                             void *destructor_context)
+static void silc_ske_completion(SilcSKE ske)
 {
-  SilcSKE ske = fsm_context;
-
   /* Call the completion callback */
   if (!ske->freed && !ske->aborted && ske->callbacks->completed) {
     if (ske->status != SILC_SKE_STATUS_OK)
@@ -982,12 +969,37 @@ static void silc_ske_finished(SilcFSM fsm, void *fsm_context,
       ske->callbacks->completed(ske, ske->status, ske->prop, ske->keymat,
                                ske->rekey, ske->callbacks->context);
   }
+}
 
+/* SKE FSM destructor. */
+
+static void silc_ske_finished(SilcFSM fsm, void *fsm_context,
+                             void *destructor_context)
+{
+  SilcSKE ske = fsm_context;
   ske->running = FALSE;
   if (ske->freed)
     silc_ske_free(ske);
 }
 
+/* Key exchange timeout task callback */
+
+SILC_TASK_CALLBACK(silc_ske_timeout)
+{
+  SilcSKE ske = context;
+
+  SILC_LOG_DEBUG(("Timeout"));
+
+  ske->packet = NULL;
+  ske->status = SILC_SKE_STATUS_TIMEOUT;
+  if (ske->responder)
+    silc_fsm_next(&ske->fsm, silc_ske_st_responder_failure);
+  else
+    silc_fsm_next(&ske->fsm, silc_ske_st_initiator_failure);
+
+  silc_fsm_continue_sync(&ske->fsm);
+}
+
 /******************************* Protocol API *******************************/
 
 /* Allocates new SKE object. */
@@ -1019,6 +1031,7 @@ SilcSKE silc_ske_alloc(SilcRng rng, SilcSchedule schedule,
   ske->public_key = public_key;
   ske->private_key = private_key;
   ske->retry_timer = SILC_SKE_RETRY_MIN;
+  ske->refcnt = 1;
 
   return ske;
 }
@@ -1034,9 +1047,24 @@ void silc_ske_free(SilcSKE ske)
 
   if (ske->running) {
     ske->freed = TRUE;
+
+    if (ske->aborted) {
+      /* If already aborted, destroy the session immediately */
+      ske->packet = NULL;
+      ske->status = SILC_SKE_STATUS_ERROR;
+      if (ske->responder)
+       silc_fsm_next(&ske->fsm, silc_ske_st_responder_failure);
+      else
+       silc_fsm_next(&ske->fsm, silc_ske_st_initiator_failure);
+      silc_fsm_continue_sync(&ske->fsm);
+    }
     return;
   }
 
+  ske->refcnt--;
+  if (ske->refcnt > 0)
+    return;
+
   /* Free start payload */
   if (ske->start_payload)
     silc_ske_payload_start_free(ske->start_payload);
@@ -1058,6 +1086,8 @@ void silc_ske_free(SilcSKE ske)
       silc_hash_free(ske->prop->hash);
     if (ske->prop->hmac)
       silc_hmac_free(ske->prop->hmac);
+    if (ske->prop->public_key)
+      silc_pkcs_public_key_free(ske->prop->public_key);
     silc_free(ske->prop);
   }
   if (ske->keymat)
@@ -1120,7 +1150,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_start)
   if (ske->aborted) {
     /** Aborted */
     silc_fsm_next(fsm, silc_ske_st_initiator_aborted);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Encode the payload */
@@ -1130,7 +1160,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_start)
     /** Error encoding Start Payload */
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Save the the payload buffer for future use. It is later used to
@@ -1145,15 +1175,17 @@ SILC_FSM_STATE(silc_ske_st_initiator_start)
     SILC_LOG_DEBUG(("Error sending packet"));
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
-  /* XXX timeout */
+  /* Add key exchange timeout */
+  silc_schedule_task_add_timeout(ske->schedule, silc_ske_timeout,
+                                ske, ske->timeout, 0);
 
   /** Wait for responder proposal */
-  SILC_LOG_DEBUG(("Waiting for reponder proposal"));
+  SILC_LOG_DEBUG(("Waiting for responder proposal"));
   silc_fsm_next(fsm, silc_ske_st_initiator_phase1);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 }
 
 /* Phase-1.  Receives responder's proposal */
@@ -1177,7 +1209,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
     silc_ske_install_retransmission(ske);
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
 
   /* Decode the payload */
@@ -1188,7 +1220,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
     ske->packet = NULL;
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Get remote ID and set it to stream */
@@ -1221,7 +1253,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
     SILC_LOG_ERROR(("Invalid cookie, modified or unsupported feature"));
     ske->status = SILC_SKE_STATUS_INVALID_COOKIE;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Check version string */
@@ -1231,7 +1263,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
     /** Version mismatch */
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Free our KE Start Payload context, we don't need it anymore. */
@@ -1274,7 +1306,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
 
   /** Send KE Payload */
   silc_fsm_next(fsm, silc_ske_st_initiator_phase2);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 
  err:
   if (payload)
@@ -1296,7 +1328,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase1)
   /** Error */
   ske->status = status;
   silc_fsm_next(fsm, silc_ske_st_initiator_error);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Phase-2.  Send KE payload */
@@ -1318,7 +1350,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     /** Out of memory */
     ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
   silc_mp_init(x);
   status =
@@ -1331,7 +1363,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     silc_free(x);
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Encode the result to Key Exchange Payload. */
@@ -1343,7 +1375,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     silc_free(x);
     ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
   ske->ke1_payload = payload;
 
@@ -1365,7 +1397,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     ske->ke1_payload = NULL;
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
   payload->pk_len = pk_len;
   payload->pk_type = silc_pkcs_get_type(ske->public_key);
@@ -1386,7 +1418,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
 
     /* Sign the hash value */
     if (!silc_pkcs_sign(ske->private_key, hash, hash_len, sign,
-                       sizeof(sign) - 1, &sign_len, NULL)) {
+                       sizeof(sign) - 1, &sign_len, FALSE, ske->prop->hash)) {
       /** Error computing signature */
       silc_mp_uninit(x);
       silc_free(x);
@@ -1396,7 +1428,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
       ske->ke1_payload = NULL;
       ske->status = SILC_SKE_STATUS_SIGNATURE_ERROR;
       silc_fsm_next(fsm, silc_ske_st_initiator_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
     payload->sign_data = silc_memdup(sign, sign_len);
     if (payload->sign_data)
@@ -1416,7 +1448,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     ske->ke1_payload = NULL;
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   ske->x = x;
@@ -1431,14 +1463,14 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase2)
     SILC_LOG_DEBUG(("Error sending packet"));
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   silc_buffer_free(payload_buf);
 
   /** Waiting responder's KE payload */
   silc_fsm_next(fsm, silc_ske_st_initiator_phase3);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 }
 
 /* Phase-3.  Process responder's KE payload */
@@ -1458,7 +1490,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase3)
     silc_ske_install_retransmission(ske);
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
 
   /* Decode the payload */
@@ -1469,7 +1501,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase3)
     ske->packet = NULL;
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
   silc_packet_free(ske->packet);
   ske->packet = NULL;
@@ -1522,8 +1554,8 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase3)
       silc_skr_find_set_usage(find, SILC_SKR_USAGE_KEY_AGREEMENT);
 
       /* Find key from repository */
-      SILC_FSM_CALL(silc_skr_find(ske->repository, find,
-                                 silc_ske_skr_callback, ske));
+      SILC_FSM_CALL(silc_skr_find(ske->repository, silc_fsm_get_schedule(fsm),
+                                 find, silc_ske_skr_callback, ske));
     } else {
       /* Verify from application */
       SILC_FSM_CALL(ske->callbacks->verify_key(ske, ske->prop->public_key,
@@ -1535,7 +1567,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase3)
 
   /** Process key material */
   silc_fsm_next(fsm, silc_ske_st_initiator_phase4);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 
  err:
   silc_ske_payload_ke_free(payload);
@@ -1551,7 +1583,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase3)
   /** Error */
   ske->status = status;
   silc_fsm_next(fsm, silc_ske_st_initiator_error);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Process key material */
@@ -1568,7 +1600,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
   if (ske->aborted) {
     /** Aborted */
     silc_fsm_next(fsm, silc_ske_st_initiator_aborted);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Check result of public key verification */
@@ -1576,19 +1608,21 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
     /** Public key not verified */
     SILC_LOG_DEBUG(("Public key verification failed"));
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   payload = ske->ke2_payload;
 
+  /* Compute the HASH value */
+  SILC_LOG_DEBUG(("Computing HASH value"));
+  status = silc_ske_make_hash(ske, hash, &hash_len, FALSE);
+  if (status != SILC_SKE_STATUS_OK)
+    goto err;
+  ske->hash = silc_memdup(hash, hash_len);
+  ske->hash_len = hash_len;
+
   if (ske->prop->public_key) {
     SILC_LOG_DEBUG(("Public key is authentic"));
-
-    /* Compute the hash value */
-    status = silc_ske_make_hash(ske, hash, &hash_len, FALSE);
-    if (status != SILC_SKE_STATUS_OK)
-      goto err;
-
     SILC_LOG_DEBUG(("Verifying signature (HASH)"));
 
     /* Verify signature */
@@ -1600,9 +1634,6 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
     }
 
     SILC_LOG_DEBUG(("Signature is Ok"));
-
-    ske->hash = silc_memdup(hash, hash_len);
-    ske->hash_len = hash_len;
     memset(hash, 'F', hash_len);
   }
 
@@ -1612,7 +1643,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
   if (ske->rekey) {
     /** Finish rekey */
     silc_fsm_next(fsm, silc_ske_st_rekey_initiator_done);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Process key material */
@@ -1635,12 +1666,12 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
     SILC_LOG_DEBUG(("Error sending packet"));
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /** Waiting completion */
   silc_fsm_next(fsm, silc_ske_st_initiator_end);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 
  err:
   memset(hash, 'F', sizeof(hash));
@@ -1663,7 +1694,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_phase4)
   /** Error */
   ske->status = status;
   silc_fsm_next(fsm, silc_ske_st_initiator_error);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Protocol completed */
@@ -1679,7 +1710,7 @@ SILC_FSM_STATE(silc_ske_st_initiator_end)
     silc_ske_install_retransmission(ske);
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
 
   SILC_LOG_DEBUG(("Key exchange completed successfully"));
@@ -1689,7 +1720,10 @@ SILC_FSM_STATE(silc_ske_st_initiator_end)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Aborted by application */
@@ -1708,7 +1742,10 @@ SILC_FSM_STATE(silc_ske_st_initiator_aborted)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Error occurred.  Send error to remote host */
@@ -1733,7 +1770,10 @@ SILC_FSM_STATE(silc_ske_st_initiator_error)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Failure received from remote */
@@ -1743,9 +1783,6 @@ SILC_FSM_STATE(silc_ske_st_initiator_failure)
   SilcSKE ske = fsm_context;
   SilcUInt32 error = SILC_SKE_STATUS_ERROR;
 
-  SILC_LOG_DEBUG(("Error %s (%d) received during key exchange",
-                 silc_ske_map_status(ske->status), ske->status));
-
   if (ske->packet && silc_buffer_len(&ske->packet->buffer) == 4) {
     SILC_GET32_MSB(error, ske->packet->buffer.data);
     ske->status = error;
@@ -1753,19 +1790,24 @@ SILC_FSM_STATE(silc_ske_st_initiator_failure)
     ske->packet = NULL;
   }
 
+  SILC_LOG_DEBUG(("Error %s (%d) received during key exchange",
+                 silc_ske_map_status(ske->status), ske->status));
+
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Starts the protocol as initiator */
 
-SilcAsyncOperation
-silc_ske_initiator(SilcSKE ske,
-                  SilcPacketStream stream,
-                  SilcSKEParams params,
-                  SilcSKEStartPayload start_payload)
+SilcAsyncOperation silc_ske_initiator(SilcSKE ske,
+                                     SilcPacketStream stream,
+                                     SilcSKEParams params,
+                                     SilcSKEStartPayload start_payload)
 {
   SILC_LOG_DEBUG(("Start SKE as initiator"));
 
@@ -1790,6 +1832,7 @@ silc_ske_initiator(SilcSKE ske,
       return NULL;
   }
 
+  ske->timeout = params->timeout_secs ? params->timeout_secs : 30;
   ske->start_payload = start_payload;
   ske->version = params->version;
   ske->running = TRUE;
@@ -1821,15 +1864,16 @@ SILC_FSM_STATE(silc_ske_st_responder_start)
   if (ske->aborted) {
     /** Aborted */
     silc_fsm_next(fsm, silc_ske_st_responder_aborted);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
-  /* Start timeout */
-  /* XXX */
+  /* Add key exchange timeout */
+  silc_schedule_task_add_timeout(ske->schedule, silc_ske_timeout,
+                                ske, ske->timeout, 0);
 
   /** Wait for initiator */
   silc_fsm_next(fsm, silc_ske_st_responder_phase1);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 }
 
 /* Decode initiator's start payload.  Select the security properties from
@@ -1841,6 +1885,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase1)
   SilcSKEStatus status;
   SilcSKEStartPayload remote_payload = NULL;
   SilcBuffer packet_buf = &ske->packet->buffer;
+  SilcID id;
 
   SILC_LOG_DEBUG(("Start"));
 
@@ -1852,7 +1897,20 @@ SILC_FSM_STATE(silc_ske_st_responder_phase1)
     ske->packet = NULL;
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
+  }
+
+  /* Get remote ID and set it to stream */
+  if (ske->packet->src_id_len) {
+    silc_id_str2id(ske->packet->src_id, ske->packet->src_id_len,
+                  ske->packet->src_id_type,
+                  (ske->packet->src_id_type == SILC_ID_SERVER ?
+                   (void *)&id.u.server_id : (void *)&id.u.client_id),
+                  (ske->packet->src_id_type == SILC_ID_SERVER ?
+                   sizeof(id.u.server_id) : sizeof(id.u.client_id)));
+    silc_packet_set_ids(ske->stream, 0, NULL, ske->packet->src_id_type,
+                       (ske->packet->src_id_type == SILC_ID_SERVER ?
+                        (void *)&id.u.server_id : (void *)&id.u.client_id));
   }
 
   /* Take a copy of the payload buffer for future use. It is used to
@@ -1889,7 +1947,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase1)
     silc_ske_payload_start_free(remote_payload);
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   silc_ske_payload_start_free(remote_payload);
@@ -1910,7 +1968,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase1)
 
   /** Waiting initiator's KE payload */
   silc_fsm_next(fsm, silc_ske_st_responder_phase2);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 
  err:
   if (ske->prop->group)
@@ -1930,7 +1988,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase1)
   /** Error */
   ske->status = status;
   silc_fsm_next(fsm, silc_ske_st_responder_error);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Phase-2.  Decode initiator's KE payload */
@@ -1949,7 +2007,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase2)
     silc_ske_install_retransmission(ske);
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
 
   /* Decode Key Exchange Payload */
@@ -1960,7 +2018,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase2)
     ske->packet = NULL;
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   ske->ke1_payload = recv_payload;
@@ -1968,26 +2026,19 @@ SILC_FSM_STATE(silc_ske_st_responder_phase2)
   silc_packet_free(ske->packet);
   ske->packet = NULL;
 
-  /* Verify the received public key and verify the signature if we are
-     doing mutual authentication. */
-  if (ske->start_payload &&
-      ske->start_payload->flags & SILC_SKE_SP_FLAG_MUTUAL) {
-
-    SILC_LOG_DEBUG(("We are doing mutual authentication"));
-
-    if (!recv_payload->pk_data && (ske->callbacks->verify_key ||
-                                  ske->repository)) {
+  /* Verify public key, except in rekey, when it is not sent */
+  if (!ske->rekey) {
+    if (!recv_payload->pk_data) {
       /** Public key not provided */
       SILC_LOG_ERROR(("Remote end did not send its public key (or "
                      "certificate), even though we require it"));
       ske->status = SILC_SKE_STATUS_PUBLIC_KEY_NOT_PROVIDED;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
 
     /* Decode the remote's public key */
-    if (recv_payload->pk_data &&
-       !silc_pkcs_public_key_alloc(recv_payload->pk_type,
+    if (!silc_pkcs_public_key_alloc(recv_payload->pk_type,
                                    recv_payload->pk_data,
                                    recv_payload->pk_len,
                                    &ske->prop->public_key)) {
@@ -1995,47 +2046,45 @@ SILC_FSM_STATE(silc_ske_st_responder_phase2)
       SILC_LOG_ERROR(("Unsupported/malformed public key received"));
       ske->status = SILC_SKE_STATUS_UNSUPPORTED_PUBLIC_KEY;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
 
-    if (ske->prop->public_key && (ske->callbacks->verify_key ||
-                                 ske->repository)) {
-      SILC_LOG_DEBUG(("Verifying public key"));
+    SILC_LOG_DEBUG(("Verifying public key"));
 
-      /** Waiting public key verification */
-      silc_fsm_next(fsm, silc_ske_st_responder_phase4);
+    /** Waiting public key verification */
+    silc_fsm_next(fsm, silc_ske_st_responder_phase4);
 
-      /* If repository is provided, verify the key from there. */
-      if (ske->repository) {
-       SilcSKRFind find;
+    /* If repository is provided, verify the key from there. */
+    if (ske->repository) {
+      SilcSKRFind find;
 
-       find = silc_skr_find_alloc();
-       if (!find) {
-         ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
-         silc_fsm_next(fsm, silc_ske_st_responder_error);
-         SILC_FSM_CONTINUE;
-       }
-       silc_skr_find_set_pkcs_type(find,
-                                   silc_pkcs_get_type(ske->prop->public_key));
-       silc_skr_find_set_public_key(find, ske->prop->public_key);
-       silc_skr_find_set_usage(find, SILC_SKR_USAGE_KEY_AGREEMENT);
-
-       /* Find key from repository */
-       SILC_FSM_CALL(silc_skr_find(ske->repository, find,
-                                   silc_ske_skr_callback, ske));
-      } else {
-       /* Verify from application */
+      find = silc_skr_find_alloc();
+      if (!find) {
+       ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+       silc_fsm_next(fsm, silc_ske_st_responder_error);
+       return SILC_FSM_CONTINUE;
+      }
+      silc_skr_find_set_pkcs_type(find,
+                                 silc_pkcs_get_type(ske->prop->public_key));
+      silc_skr_find_set_public_key(find, ske->prop->public_key);
+      silc_skr_find_set_usage(find, SILC_SKR_USAGE_KEY_AGREEMENT);
+
+      /* Find key from repository */
+      SILC_FSM_CALL(silc_skr_find(ske->repository,
+                                 silc_fsm_get_schedule(fsm), find,
+                                 silc_ske_skr_callback, ske));
+    } else {
+      /* Verify from application */
+      if (ske->callbacks->verify_key)
        SILC_FSM_CALL(ske->callbacks->verify_key(ske, ske->prop->public_key,
                                                 ske->callbacks->context,
                                                 silc_ske_pk_verified, NULL));
-      }
-      /* NOT REACHED */
     }
   }
 
   /** Generate KE2 payload */
   silc_fsm_next(fsm, silc_ske_st_responder_phase4);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Phase-4. Generate KE2 payload */
@@ -2050,7 +2099,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
   if (ske->aborted) {
     /** Aborted */
     silc_fsm_next(fsm, silc_ske_st_responder_aborted);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Check result of public key verification */
@@ -2058,7 +2107,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
     /** Public key not verified */
     SILC_LOG_DEBUG(("Public key verification failed"));
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   recv_payload = ske->ke1_payload;
@@ -2070,7 +2119,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
     unsigned char hash[SILC_HASH_MAXLEN];
     SilcUInt32 hash_len;
 
-    SILC_LOG_DEBUG(("Public key is authentic"));
+    SILC_LOG_DEBUG(("We are doing mutual authentication"));
 
     /* Compute the hash value */
     status = silc_ske_make_hash(ske, hash, &hash_len, TRUE);
@@ -2078,7 +2127,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
       /** Error computing hash */
       ske->status = status;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
 
     SILC_LOG_DEBUG(("Verifying signature (HASH_i)"));
@@ -2090,7 +2139,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
       SILC_LOG_ERROR(("Signature verification failed, incorrect signature"));
       ske->status = SILC_SKE_STATUS_INCORRECT_SIGNATURE;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
 
     SILC_LOG_DEBUG(("Signature is Ok"));
@@ -2111,7 +2160,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
     silc_free(x);
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Save the results for later processing */
@@ -2137,7 +2186,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase4)
 
   /** Send KE2 payload */
   silc_fsm_next(fsm, silc_ske_st_responder_phase5);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Phase-5.  Send KE2 payload */
@@ -2161,35 +2210,36 @@ SILC_FSM_STATE(silc_ske_st_responder_phase5)
       /** Error encoding public key */
       status = SILC_SKE_STATUS_OUT_OF_MEMORY;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
     ske->ke2_payload->pk_data = pk;
     ske->ke2_payload->pk_len = pk_len;
+  }
 
-    SILC_LOG_DEBUG(("Computing HASH value"));
+  SILC_LOG_DEBUG(("Computing HASH value"));
 
-    /* Compute the hash value */
-    memset(hash, 0, sizeof(hash));
-    status = silc_ske_make_hash(ske, hash, &hash_len, FALSE);
-    if (status != SILC_SKE_STATUS_OK) {
-      /** Error computing hash */
-      ske->status = status;
-      silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
-    }
-
-    ske->hash = silc_memdup(hash, hash_len);
-    ske->hash_len = hash_len;
+  /* Compute the hash value */
+  memset(hash, 0, sizeof(hash));
+  status = silc_ske_make_hash(ske, hash, &hash_len, FALSE);
+  if (status != SILC_SKE_STATUS_OK) {
+    /** Error computing hash */
+    ske->status = status;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+  ske->hash = silc_memdup(hash, hash_len);
+  ske->hash_len = hash_len;
 
+  if (ske->public_key && ske->private_key) {
     SILC_LOG_DEBUG(("Signing HASH value"));
 
     /* Sign the hash value */
     if (!silc_pkcs_sign(ske->private_key, hash, hash_len, sign,
-                       sizeof(sign) - 1, &sign_len, NULL)) {
+                       sizeof(sign) - 1, &sign_len, FALSE, ske->prop->hash)) {
       /** Error computing signature */
       status = SILC_SKE_STATUS_SIGNATURE_ERROR;
       silc_fsm_next(fsm, silc_ske_st_responder_error);
-      SILC_FSM_CONTINUE;
+      return SILC_FSM_CONTINUE;
     }
     ske->ke2_payload->sign_data = silc_memdup(sign, sign_len);
     ske->ke2_payload->sign_len = sign_len;
@@ -2204,7 +2254,7 @@ SILC_FSM_STATE(silc_ske_st_responder_phase5)
     /** Error encoding KE payload */
     ske->status = status;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Send the packet. */
@@ -2213,14 +2263,21 @@ SILC_FSM_STATE(silc_ske_st_responder_phase5)
     SILC_LOG_DEBUG(("Error sending packet"));
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   silc_buffer_free(payload_buf);
 
+  /* In case we are doing rekey move to finish it. */
+  if (ske->rekey) {
+    /** Finish rekey */
+    silc_fsm_next(fsm, silc_ske_st_rekey_responder_done);
+    return SILC_FSM_CONTINUE;
+  }
+
   /** Waiting completion */
   silc_fsm_next(fsm, silc_ske_st_responder_end);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 }
 
 /* Protocol completed */
@@ -2236,7 +2293,7 @@ SILC_FSM_STATE(silc_ske_st_responder_end)
     silc_ske_install_retransmission(ske);
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
   silc_packet_free(ske->packet);
   ske->packet = NULL;
@@ -2252,7 +2309,7 @@ SILC_FSM_STATE(silc_ske_st_responder_end)
     /** Error processing key material */
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_responder_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Send SUCCESS packet */
@@ -2262,7 +2319,10 @@ SILC_FSM_STATE(silc_ske_st_responder_end)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Aborted by application */
@@ -2281,7 +2341,10 @@ SILC_FSM_STATE(silc_ske_st_responder_aborted)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Failure received from remote */
@@ -2303,7 +2366,10 @@ SILC_FSM_STATE(silc_ske_st_responder_failure)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Error occurred */
@@ -2325,15 +2391,17 @@ SILC_FSM_STATE(silc_ske_st_responder_error)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Starts the protocol as responder. */
 
-SilcAsyncOperation
-silc_ske_responder(SilcSKE ske,
-                  SilcPacketStream stream,
-                  SilcSKEParams params)
+SilcAsyncOperation silc_ske_responder(SilcSKE ske,
+                                     SilcPacketStream stream,
+                                     SilcSKEParams params)
 {
   SILC_LOG_DEBUG(("Start SKE as responder"));
 
@@ -2348,6 +2416,7 @@ silc_ske_responder(SilcSKE ske,
 
   ske->responder = TRUE;
   ske->flags = params->flags;
+  ske->timeout = params->timeout_secs ? params->timeout_secs : 30;
   if (ske->flags & SILC_SKE_SP_FLAG_IV_INCLUDED)
     ske->session_port = params->session_port;
   ske->version = strdup(params->version);
@@ -2383,17 +2452,26 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_start)
   if (ske->aborted) {
     /** Aborted */
     silc_fsm_next(fsm, silc_ske_st_initiator_aborted);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
-  /* XXX timeout */
+  /* Add rekey exchange timeout */
+  silc_schedule_task_add_timeout(ske->schedule, silc_ske_timeout,
+                                ske, 30, 0);
 
   ske->prop = silc_calloc(1, sizeof(*ske->prop));
   if (!ske->prop) {
     /** No memory */
     ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
+  }
+
+  if (!silc_hash_alloc(ske->rekey->hash, &ske->prop->hash)) {
+    /** Cannot allocate hash */
+    ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+    silc_fsm_next(fsm, silc_ske_st_initiator_error);
+    return SILC_FSM_CONTINUE;
   }
 
   /* Send REKEY packet to start rekey protocol */
@@ -2402,14 +2480,14 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_start)
     SILC_LOG_DEBUG(("Error sending packet"));
     ske->status = SILC_SKE_STATUS_ERROR;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* If doing rekey without PFS, move directly to the end of the protocol. */
   if (!ske->rekey->pfs) {
     /** Rekey without PFS */
     silc_fsm_next(fsm, silc_ske_st_rekey_initiator_done);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   status = silc_ske_group_get_by_number(ske->rekey->ske_group,
@@ -2417,12 +2495,12 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_start)
   if (status != SILC_SKE_STATUS_OK) {
     /** Unknown group */
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /** Rekey with PFS */
   silc_fsm_next(fsm, silc_ske_st_initiator_phase2);
-  SILC_FSM_CONTINUE;
+  return SILC_FSM_CONTINUE;
 }
 
 /* Sends REKEY_DONE packet to finish the protocol. */
@@ -2441,13 +2519,7 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_done)
   silc_packet_get_keys(ske->stream, &send_key, NULL, &hmac_send, NULL);
   key_len = silc_cipher_get_key_len(send_key);
   block_len = silc_cipher_get_block_len(send_key);
-
-  if (!silc_hash_alloc(ske->rekey->hash, &hash)) {
-    /** Cannot allocate hash */
-    ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
-    silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
-  }
+  hash = ske->prop->hash;
   hash_len = silc_hash_len(hash);
 
   /* Process key material */
@@ -2473,22 +2545,26 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_done)
   if (!ske->keymat) {
     SILC_LOG_ERROR(("Error processing key material"));
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   ske->prop->cipher = send_key;
   ske->prop->hmac = hmac_send;
-  ske->prop->hash = hash;
 
   /* Get sending keys */
   if (!silc_ske_set_keys(ske, ske->keymat, ske->prop, &send_key, NULL,
                         &hmac_send, NULL, NULL)) {
     /** Cannot get keys */
     ske->status = SILC_SKE_STATUS_ERROR;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
+  ske->prop->cipher = NULL;
+  ske->prop->hmac = NULL;
+
   /* Set the new keys into use.  This will also send REKEY_DONE packet.  Any
      packet sent after this call will be protected with the new keys. */
   if (!silc_packet_set_keys(ske->stream, send_key, NULL, hmac_send, NULL,
@@ -2496,13 +2572,15 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_done)
     /** Cannot set keys */
     SILC_LOG_DEBUG(("Cannot set new keys, error sending REKEY_DONE"));
     ske->status = SILC_SKE_STATUS_ERROR;
+    silc_cipher_free(send_key);
+    silc_hmac_free(hmac_send);
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /** Wait for REKEY_DONE */
   silc_fsm_next(fsm, silc_ske_st_rekey_initiator_end);
-  SILC_FSM_WAIT;
+  return SILC_FSM_WAIT;
 }
 
 /* Rekey protocol end */
@@ -2520,7 +2598,7 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_end)
     SILC_LOG_DEBUG(("Remote retransmitted an old packet"));
     silc_packet_free(ske->packet);
     ske->packet = NULL;
-    SILC_FSM_WAIT;
+    return SILC_FSM_WAIT;
   }
 
   silc_packet_get_keys(ske->stream, NULL, &receive_key, NULL, &hmac_receive);
@@ -2532,8 +2610,10 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_end)
                         NULL, &hmac_receive, NULL)) {
     /** Cannot get keys */
     ske->status = SILC_SKE_STATUS_ERROR;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   /* Set new receiving keys into use.  All packets received after this will
@@ -2543,8 +2623,10 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_end)
     /** Cannot set keys */
     SILC_LOG_DEBUG(("Cannot set new keys"));
     ske->status = SILC_SKE_STATUS_ERROR;
+    silc_cipher_free(receive_key);
+    silc_hmac_free(hmac_receive);
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
 
   SILC_LOG_DEBUG(("Rekey completed successfully"));
@@ -2554,8 +2636,10 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_end)
   if (!rekey) {
     /** No memory */
     ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
     silc_fsm_next(fsm, silc_ske_st_initiator_error);
-    SILC_FSM_CONTINUE;
+    return SILC_FSM_CONTINUE;
   }
   rekey->pfs = ske->rekey->pfs;
   ske->rekey = rekey;
@@ -2567,7 +2651,10 @@ SILC_FSM_STATE(silc_ske_st_rekey_initiator_end)
   silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
   silc_schedule_task_del_by_context(ske->schedule, ske);
 
-  SILC_FSM_FINISH;
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Starts rekey protocol as initiator */
@@ -2579,8 +2666,11 @@ silc_ske_rekey_initiator(SilcSKE ske,
 {
   SILC_LOG_DEBUG(("Start SKE rekey as initator"));
 
-  if (!ske || !stream || !rekey)
+  if (!ske || !stream || !rekey) {
+    SILC_LOG_ERROR(("Missing arguments to silc_ske_rekey_initiator"));
+    SILC_ASSERT(rekey);
     return NULL;
+  }
 
   if (!silc_async_init(&ske->op, silc_ske_abort, NULL, ske))
     return NULL;
@@ -2610,11 +2700,240 @@ silc_ske_rekey_initiator(SilcSKE ske,
 
 /***************************** Responder Rekey ******************************/
 
-SILC_FSM_STATE(silc_ske_st_rekey_responder_start);
+/* Wait for initiator's packet */
+
+SILC_FSM_STATE(silc_ske_st_rekey_responder_wait)
+{
+  SilcSKE ske = fsm_context;
+
+  SILC_LOG_DEBUG(("Start rekey (%s)", ske->rekey->pfs ? "PFS" : "No PFS"));
+
+  if (ske->aborted) {
+    /** Aborted */
+    silc_fsm_next(fsm, silc_ske_st_responder_aborted);
+    return SILC_FSM_CONTINUE;
+  }
+
+  /* Add rekey exchange timeout */
+  silc_schedule_task_add_timeout(ske->schedule, silc_ske_timeout,
+                                ske, 30, 0);
+
+  silc_fsm_next(fsm, silc_ske_st_rekey_responder_start);
+
+  /* If REKEY packet already received process it directly */
+  if (ske->packet && ske->packet->type == SILC_PACKET_REKEY)
+    return SILC_FSM_CONTINUE;
+
+  /* Wait for REKEY */
+  return SILC_FSM_WAIT;
+}
+
+/* Process initiator's REKEY packet */
 
 SILC_FSM_STATE(silc_ske_st_rekey_responder_start)
 {
-  SILC_FSM_FINISH;
+  SilcSKE ske = fsm_context;
+  SilcSKEStatus status;
+
+  SILC_LOG_DEBUG(("Start"));
+
+  if (ske->packet->type != SILC_PACKET_REKEY) {
+    ske->status = SILC_SKE_STATUS_ERROR;
+    silc_packet_free(ske->packet);
+    ske->packet = NULL;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  ske->prop = silc_calloc(1, sizeof(*ske->prop));
+  if (!ske->prop) {
+    /** No memory */
+    ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  if (!silc_hash_alloc(ske->rekey->hash, &ske->prop->hash)) {
+    /** Cannot allocate hash */
+    ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  /* If doing rekey without PFS, move directly to the end of the protocol. */
+  if (!ske->rekey->pfs) {
+    /** Rekey without PFS */
+    silc_fsm_next(fsm, silc_ske_st_rekey_responder_done);
+    return SILC_FSM_CONTINUE;
+  }
+
+  status = silc_ske_group_get_by_number(ske->rekey->ske_group,
+                                       &ske->prop->group);
+  if (status != SILC_SKE_STATUS_OK) {
+    /** Unknown group */
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  /** Rekey with PFS */
+  silc_fsm_next(fsm, silc_ske_st_responder_phase2);
+  return SILC_FSM_WAIT;
+}
+
+/* Sends REKEY_DONE packet to finish the protocol. */
+
+SILC_FSM_STATE(silc_ske_st_rekey_responder_done)
+{
+  SilcSKE ske = fsm_context;
+  SilcCipher send_key;
+  SilcHmac hmac_send;
+  SilcHash hash;
+  SilcUInt32 key_len, block_len, hash_len, x_len;
+  unsigned char *pfsbuf;
+
+  SILC_LOG_DEBUG(("Start"));
+
+  silc_packet_get_keys(ske->stream, &send_key, NULL, &hmac_send, NULL);
+  key_len = silc_cipher_get_key_len(send_key);
+  block_len = silc_cipher_get_block_len(send_key);
+  hash = ske->prop->hash;
+  hash_len = silc_hash_len(hash);
+
+  /* Process key material */
+  if (ske->rekey->pfs) {
+    /* PFS */
+    pfsbuf = silc_mp_mp2bin(ske->KEY, 0, &x_len);
+    if (pfsbuf) {
+      ske->keymat = silc_ske_process_key_material_data(pfsbuf, x_len,
+                                                      block_len, key_len,
+                                                      hash_len, hash);
+      memset(pfsbuf, 0, x_len);
+      silc_free(pfsbuf);
+    }
+  } else {
+    /* No PFS */
+    ske->keymat =
+      silc_ske_process_key_material_data(ske->rekey->send_enc_key,
+                                        ske->rekey->enc_key_len / 8,
+                                        block_len, key_len,
+                                        hash_len, hash);
+  }
+
+  if (!ske->keymat) {
+    SILC_LOG_ERROR(("Error processing key material"));
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  ske->prop->cipher = send_key;
+  ske->prop->hmac = hmac_send;
+
+  /* Get sending keys */
+  if (!silc_ske_set_keys(ske, ske->keymat, ske->prop, &send_key, NULL,
+                        &hmac_send, NULL, NULL)) {
+    /** Cannot get keys */
+    ske->status = SILC_SKE_STATUS_ERROR;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  ske->prop->cipher = NULL;
+  ske->prop->hmac = NULL;
+
+  /* Set the new keys into use.  This will also send REKEY_DONE packet.  Any
+     packet sent after this call will be protected with the new keys. */
+  if (!silc_packet_set_keys(ske->stream, send_key, NULL, hmac_send, NULL,
+                           TRUE)) {
+    /** Cannot set keys */
+    SILC_LOG_DEBUG(("Cannot set new keys, error sending REKEY_DONE"));
+    ske->status = SILC_SKE_STATUS_ERROR;
+    silc_cipher_free(send_key);
+    silc_hmac_free(hmac_send);
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  /** Wait for REKEY_DONE */
+  silc_fsm_next(fsm, silc_ske_st_rekey_responder_end);
+  return SILC_FSM_WAIT;
+}
+
+/* Rekey protocol end */
+
+SILC_FSM_STATE(silc_ske_st_rekey_responder_end)
+{
+  SilcSKE ske = fsm_context;
+  SilcCipher receive_key;
+  SilcHmac hmac_receive;
+  SilcSKERekeyMaterial rekey;
+
+  SILC_LOG_DEBUG(("Start"));
+
+  if (ske->packet->type != SILC_PACKET_REKEY_DONE) {
+    SILC_LOG_DEBUG(("Remote retransmitted an old packet"));
+    silc_packet_free(ske->packet);
+    ske->packet = NULL;
+    return SILC_FSM_WAIT;
+  }
+
+  silc_packet_get_keys(ske->stream, NULL, &receive_key, NULL, &hmac_receive);
+  ske->prop->cipher = receive_key;
+  ske->prop->hmac = hmac_receive;
+
+  /* Get receiving keys */
+  if (!silc_ske_set_keys(ske, ske->keymat, ske->prop, NULL, &receive_key,
+                        NULL, &hmac_receive, NULL)) {
+    /** Cannot get keys */
+    ske->status = SILC_SKE_STATUS_ERROR;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  /* Set new receiving keys into use.  All packets received after this will
+     be decrypted with the new keys. */
+  if (!silc_packet_set_keys(ske->stream, NULL, receive_key, NULL,
+                           hmac_receive, FALSE)) {
+    /** Cannot set keys */
+    SILC_LOG_DEBUG(("Cannot set new keys"));
+    ske->status = SILC_SKE_STATUS_ERROR;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
+    silc_cipher_free(receive_key);
+    silc_hmac_free(hmac_receive);
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+
+  SILC_LOG_DEBUG(("Rekey completed successfully"));
+
+  /* Generate new rekey material */
+  rekey = silc_ske_make_rekey_material(ske, ske->keymat);
+  if (!rekey) {
+    /** No memory */
+    ske->status = SILC_SKE_STATUS_OUT_OF_MEMORY;
+    ske->prop->cipher = NULL;
+    ske->prop->hmac = NULL;
+    silc_fsm_next(fsm, silc_ske_st_responder_error);
+    return SILC_FSM_CONTINUE;
+  }
+  rekey->pfs = ske->rekey->pfs;
+  ske->rekey = rekey;
+
+  ske->prop->cipher = NULL;
+  ske->prop->hmac = NULL;
+  silc_packet_free(ske->packet);
+  ske->packet = NULL;
+  silc_packet_stream_unlink(ske->stream, &silc_ske_stream_cbs, ske);
+  silc_schedule_task_del_by_context(ske->schedule, ske);
+
+  /* Call completion */
+  silc_ske_completion(ske);
+
+  return SILC_FSM_FINISH;
 }
 
 /* Starts rekey protocol as responder */
@@ -2622,7 +2941,8 @@ SILC_FSM_STATE(silc_ske_st_rekey_responder_start)
 SilcAsyncOperation
 silc_ske_rekey_responder(SilcSKE ske,
                         SilcPacketStream stream,
-                        SilcSKERekeyMaterial rekey)
+                        SilcSKERekeyMaterial rekey,
+                        SilcPacket packet)
 {
   SILC_LOG_DEBUG(("Start SKE rekey as responder"));
 
@@ -2639,6 +2959,7 @@ silc_ske_rekey_responder(SilcSKE ske,
   ske->responder = TRUE;
   ske->running = TRUE;
   ske->rekeying = TRUE;
+  ske->packet = packet;
 
   /* Link to packet stream to get key exchange packets */
   ske->stream = stream;
@@ -2650,7 +2971,7 @@ silc_ske_rekey_responder(SilcSKE ske,
                          SILC_PACKET_FAILURE, -1);
 
   /* Start SKE rekey as responder */
-  silc_fsm_start(&ske->fsm, silc_ske_st_rekey_responder_start);
+  silc_fsm_start_sync(&ske->fsm, silc_ske_st_rekey_responder_wait);
 
   return &ske->op;
 }
@@ -2686,7 +3007,7 @@ silc_ske_process_key_material_data(unsigned char *data,
     return NULL;
   silc_buffer_format(buf,
                     SILC_STR_UI_CHAR(0),
-                    SILC_STR_UI_XNSTRING(data, data_len),
+                    SILC_STR_DATA(data, data_len),
                     SILC_STR_END);
 
   /* Take IVs */
@@ -2725,8 +3046,8 @@ silc_ske_process_key_material_data(unsigned char *data,
     if (!dist)
       return NULL;
     silc_buffer_format(dist,
-                      SILC_STR_UI_XNSTRING(data, data_len),
-                      SILC_STR_UI_XNSTRING(k1, hash_len),
+                      SILC_STR_DATA(data, data_len),
+                      SILC_STR_DATA(k1, hash_len),
                       SILC_STR_END);
     memset(k2, 0, sizeof(k2));
     silc_hash_make(hash, dist->data, silc_buffer_len(dist), k2);
@@ -2736,7 +3057,7 @@ silc_ske_process_key_material_data(unsigned char *data,
     silc_buffer_pull_tail(dist, hash_len);
     silc_buffer_pull(dist, data_len + hash_len);
     silc_buffer_format(dist,
-                      SILC_STR_UI_XNSTRING(k2, hash_len),
+                      SILC_STR_DATA(k2, hash_len),
                       SILC_STR_END);
     silc_buffer_push(dist, data_len + hash_len);
     memset(k3, 0, sizeof(k3));
@@ -2788,8 +3109,8 @@ silc_ske_process_key_material_data(unsigned char *data,
     if (!dist)
       return NULL;
     silc_buffer_format(dist,
-                      SILC_STR_UI_XNSTRING(data, data_len),
-                      SILC_STR_UI_XNSTRING(k1, hash_len),
+                      SILC_STR_DATA(data, data_len),
+                      SILC_STR_DATA(k1, hash_len),
                       SILC_STR_END);
     memset(k2, 0, sizeof(k2));
     silc_hash_make(hash, dist->data, silc_buffer_len(dist), k2);
@@ -2799,7 +3120,7 @@ silc_ske_process_key_material_data(unsigned char *data,
     silc_buffer_pull_tail(dist, hash_len);
     silc_buffer_pull(dist, data_len + hash_len);
     silc_buffer_format(dist,
-                      SILC_STR_UI_XNSTRING(k2, hash_len),
+                      SILC_STR_DATA(k2, hash_len),
                       SILC_STR_END);
     silc_buffer_push(dist, data_len + hash_len);
     memset(k3, 0, sizeof(k3));
@@ -2875,8 +3196,8 @@ silc_ske_process_key_material(SilcSKE ske,
   if (!buf)
     return NULL;
   silc_buffer_format(buf,
-                    SILC_STR_UI_XNSTRING(tmpbuf, klen),
-                    SILC_STR_UI_XNSTRING(ske->hash, ske->hash_len),
+                    SILC_STR_DATA(tmpbuf, klen),
+                    SILC_STR_DATA(ske->hash, ske->hash_len),
                     SILC_STR_END);
 
   /* Process the key material */
@@ -2954,7 +3275,8 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                           SilcHmac *ret_hmac_receive,
                           SilcHash *ret_hash)
 {
-  unsigned char iv[32];
+  unsigned char iv[SILC_HASH_MAXLEN];
+  SilcBool iv_included = (prop->flags & SILC_SKE_SP_FLAG_IV_INCLUDED);
 
   /* Allocate ciphers to be used in the communication */
   if (ret_send_key) {
@@ -2980,6 +3302,12 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
       return FALSE;
   }
 
+  /* Allocate hash */
+  if (ret_hash) {
+    if (!silc_hash_alloc(silc_hash_get_name(prop->hash), ret_hash))
+      return FALSE;
+  }
+
   /* Set key material */
   memset(iv, 0, sizeof(iv));
   if (ske->responder) {
@@ -2988,10 +3316,24 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                          keymat->enc_key_len, TRUE);
 
       if (silc_cipher_get_mode(*ret_send_key) == SILC_CIPHER_MODE_CTR) {
-        memcpy(iv, ske->hash, 4);
-        memcpy(iv + 4, keymat->receive_iv, 4);
+       /* Counter mode */
+       if (!ske->rekeying) {
+         /* Set IV. */
+         memcpy(iv, ske->hash, 4);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->receive_iv, 8);
+       } else {
+         /* Rekey, recompute the truncated hash value. */
+         silc_hash_make(prop->hash, keymat->receive_iv, 8, iv);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->receive_iv, 8);
+         else
+           memset(iv + 4, 0, 12);
+       }
+
         silc_cipher_set_iv(*ret_send_key, iv);
       } else {
+       /* Other modes */
        silc_cipher_set_iv(*ret_send_key, keymat->receive_iv);
       }
     }
@@ -3000,10 +3342,24 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                          keymat->enc_key_len, FALSE);
 
       if (silc_cipher_get_mode(*ret_receive_key) == SILC_CIPHER_MODE_CTR) {
-        memcpy(iv, ske->hash, 4);
-        memcpy(iv + 4, keymat->send_iv, 4);
+       /* Counter mode */
+       if (!ske->rekeying) {
+         /* Set IV. */
+         memcpy(iv, ske->hash, 4);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->send_iv, 8);
+       } else {
+         /* Rekey, recompute the truncated hash value. */
+         silc_hash_make(prop->hash, keymat->send_iv, 8, iv);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->send_iv, 8);
+         else
+           memset(iv + 4, 0, 12);
+       }
+
         silc_cipher_set_iv(*ret_receive_key, iv);
       } else {
+       /* Other modes */
        silc_cipher_set_iv(*ret_receive_key, keymat->send_iv);
       }
     }
@@ -3019,10 +3375,24 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                          keymat->enc_key_len, TRUE);
 
       if (silc_cipher_get_mode(*ret_send_key) == SILC_CIPHER_MODE_CTR) {
-        memcpy(iv, ske->hash, 4);
-        memcpy(iv + 4, keymat->send_iv, 4);
+       /* Counter mode */
+       if (!ske->rekeying) {
+         /* Set IV. */
+         memcpy(iv, ske->hash, 4);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->send_iv, 8);
+       } else {
+         /* Rekey, recompute the truncated hash value. */
+         silc_hash_make(prop->hash, keymat->send_iv, 8, iv);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->send_iv, 8);
+         else
+           memset(iv + 4, 0, 12);
+       }
+
        silc_cipher_set_iv(*ret_send_key, iv);
       } else {
+       /* Other modes */
        silc_cipher_set_iv(*ret_send_key, keymat->send_iv);
       }
     }
@@ -3031,10 +3401,25 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                          keymat->enc_key_len, FALSE);
 
       if (silc_cipher_get_mode(*ret_receive_key) == SILC_CIPHER_MODE_CTR) {
-        memcpy(iv, ske->hash, 4);
-        memcpy(iv + 4, keymat->receive_iv, 4);
+       /* Counter mode */
+       if (!ske->rekeying) {
+         /* Set IV.  If IV Included flag was negotiated we only set the
+            truncated hash value. */
+         memcpy(iv, ske->hash, 4);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->receive_iv, 8);
+       } else {
+         /* Rekey, recompute the truncated hash value. */
+         silc_hash_make(prop->hash, keymat->receive_iv, 8, iv);
+         if (!iv_included)
+           memcpy(iv + 4, keymat->receive_iv, 8);
+         else
+           memset(iv + 4, 0, 12);
+       }
+
        silc_cipher_set_iv(*ret_receive_key, iv);
       } else {
+       /* Other modes */
        silc_cipher_set_iv(*ret_receive_key, keymat->receive_iv);
       }
     }
@@ -3046,12 +3431,6 @@ SilcBool silc_ske_set_keys(SilcSKE ske,
                        keymat->hmac_key_len);
   }
 
-  /* Allocate hash */
-  if (ret_hash) {
-    if (!silc_hash_alloc(silc_hash_get_name(prop->hash), ret_hash))
-      return FALSE;
-  }
-
   return TRUE;
 }
 
@@ -3059,7 +3438,7 @@ const char *silc_ske_status_string[] =
 {
   /* Official */
   "Ok",
-  "Unkown error occurred",
+  "Unexpected error occurred",
   "Bad payload in packet",
   "Unsupported group",
   "Unsupported cipher",
@@ -3077,6 +3456,7 @@ const char *silc_ske_status_string[] =
   "Bad payload length in packet",
   "Error computing signature",
   "System out of memory",
+  "Key exchange timeout",
 
   NULL
 };