anchor.diff:       iv = IVLen,
        tag_len = TagLen,
        rekey_interval = RekeyInterval} = Params,
  -  Secret,
  -  #public_key_pair{
  -     type = PublicKeyType,
  -     params = PublicKeyParams,
  -     private = PrivKey},
  -  R2A, R3A, Msg) ->
  +  Secret, KeyPair, R2A, R3A, Msg) ->
       %%
       RLen = KeyLen + IVLen,
       case Msg of
  
positive.code: 
  encrypt_and_send_chunk(
    #params{
       socket = Socket, rekey_interval = Seq,
       shared_secret = SharedSecret,
       key = Key, iv = {IVSalt, _}, hmac_algorithm = HmacAlgo} = Params,
    Seq, Cleartext) ->
      %%
      KeyLen = byte_size(Key),
      IVSaltLen = byte_size(IVSalt),
      R = crypto:strong_rand_bytes(KeyLen + IVSaltLen + 6),
      case
          gen_tcp:send(
            Socket, encrypt_chunk(Params, Seq, [?REKEY_CHUNK, R]))
      of
          ok ->
              {Key_1, <<IVSalt_1:IVSaltLen/binary, IVNo_1:48>>} =
                  hmac_key_iv(
                    HmacAlgo, SharedSecret, R, KeyLen, IVSaltLen + 6),
              Params_1 = Params#params{key = Key_1, iv = {IVSalt_1, IVNo_1}},
              Result =
                  gen_tcp:send(Socket, encrypt_chunk(Params_1, 0, Cleartext)),
  
negative.code:          public,
           private}).
  
  -define(KEY_PAIR_LIFE_TIME, 3600000). % 1 hour
  -define(KEY_PAIR_LIFE_COUNT, 256). % Number of connection setups
  
  
  %% -------------------------------------------------------------------------
  %% Keep the node's public/private key pair in the process state
  %% of a key pair server linked to the acceptor process.
  %% Create the key pair the first time it is needed
  %% so crypto gets time to start first.
  %%
  
  start_key_pair_server() ->
      monitor_dist_proc(
        spawn_link(
          fun () ->
                  register(?MODULE, self()),
                  key_pair_server()
          end)).
  
  key_pair_server() ->
      key_pair_server(undefined, undefined, undefined).
  %%
  key_pair_server(KeyPair) ->
      key_pair_server(
        KeyPair,
        erlang:start_timer(?KEY_PAIR_LIFE_TIME, self(), discard),
        ?KEY_PAIR_LIFE_COUNT).
  %%    
  key_pair_server(_KeyPair, Timer, 0) ->
      cancel_timer(Timer),
      key_pair_server();
  key_pair_server(KeyPair, Timer, Count) ->
      receive
          {Pid, Tag, get_key_pair} ->
              case KeyPair of
                  undefined ->
                      KeyPair_1 = generate_key_pair(),
                      Pid ! {Tag, KeyPair_1},
                      key_pair_server(KeyPair_1);
                  #key_pair{} ->
                      Pid ! {Tag, KeyPair},
                      key_pair_server(KeyPair, Timer, Count - 1)
              end;
          {Pid, Tag, get_new_key_pair} ->
              cancel_timer(Timer),
              KeyPair_1 = generate_key_pair(),
              Pid ! {Tag, KeyPair_1},
              key_pair_server(KeyPair_1);
          {timeout, Timer, discard} when is_reference(Timer) ->
              key_pair_server()
      end.
  
  generate_key_pair() ->
      #key_pair{type = Type, params = Params} = #key_pair{},
      {Public, Private} =
          crypto:generate_key(Type, Params),
      #key_pair{public = Public, private = Private}.
  
  cancel_timer(undefined) ->
      ok;
  cancel_timer(Timer) ->
      case erlang:cancel_timer(Timer) of
          false ->
              receive
  