diff --git a/I2NPProtocol.h b/I2NPProtocol.h
index 4c299f5e..be8e4fbf 100644
--- a/I2NPProtocol.h
+++ b/I2NPProtocol.h
@@ -138,6 +138,7 @@ namespace tunnel
 		
 		// payload
 		uint8_t * GetPayload () { return GetBuffer () + I2NP_HEADER_SIZE; };
+		const uint8_t * GetPayload () const { return GetBuffer () + I2NP_HEADER_SIZE; };
 		uint8_t * GetBuffer () { return buf + offset; };
 		const uint8_t * GetBuffer () const { return buf + offset; };
 		size_t GetLength () const { return len - offset; };	
diff --git a/TransitTunnel.cpp b/TransitTunnel.cpp
index 6fc6c5c0..6cc3491a 100644
--- a/TransitTunnel.cpp
+++ b/TransitTunnel.cpp
@@ -20,9 +20,9 @@ namespace tunnel
 		m_Encryption.SetKeys (layerKey, ivKey);
 	}	
 
-	void TransitTunnel::EncryptTunnelMsg (std::shared_ptr<I2NPMessage> tunnelMsg)
+	void TransitTunnel::EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out)
 	{		
-		m_Encryption.Encrypt (tunnelMsg->GetPayload () + 4, tunnelMsg->GetPayload () + 4); 
+		m_Encryption.Encrypt (in->GetPayload () + 4, out->GetPayload () + 4); 
 	}	
 
 	TransitTunnelParticipant::~TransitTunnelParticipant ()
@@ -31,7 +31,7 @@ namespace tunnel
 		
 	void TransitTunnelParticipant::HandleTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> tunnelMsg)
 	{
-		EncryptTunnelMsg (tunnelMsg);
+		EncryptTunnelMsg (tunnelMsg, tunnelMsg);
 		
 		m_NumTransmittedBytes += tunnelMsg->GetLength ();
 		htobe32buf (tunnelMsg->GetPayload (), GetNextTunnelID ());
@@ -78,7 +78,7 @@ namespace tunnel
 		
 	void TransitTunnelEndpoint::HandleTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> tunnelMsg)
 	{
-		EncryptTunnelMsg (tunnelMsg);
+		EncryptTunnelMsg (tunnelMsg, tunnelMsg);
 		
 		LogPrint (eLogDebug, "TransitTunnel endpoint for ", GetTunnelID ());
 		m_Endpoint.HandleDecryptedTunnelDataMsg (tunnelMsg); 
diff --git a/TransitTunnel.h b/TransitTunnel.h
index e6e0601d..e63ce9dc 100644
--- a/TransitTunnel.h
+++ b/TransitTunnel.h
@@ -30,7 +30,7 @@ namespace tunnel
 			// implements TunnelBase
 			void SendTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> msg);
 			void HandleTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> tunnelMsg);
-			void EncryptTunnelMsg (std::shared_ptr<I2NPMessage> tunnelMsg); 
+			void EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out); 
 			uint32_t GetNextTunnelID () const { return m_NextTunnelID; };
 			const i2p::data::IdentHash& GetNextIdentHash () const { return m_NextIdent; };
 			
diff --git a/Tunnel.cpp b/Tunnel.cpp
index 8b0d6cfd..cd3f69b8 100644
--- a/Tunnel.cpp
+++ b/Tunnel.cpp
@@ -140,14 +140,16 @@ namespace tunnel
 		return established;
 	}	
 
-	void Tunnel::EncryptTunnelMsg (std::shared_ptr<I2NPMessage> tunnelMsg)
+	void Tunnel::EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out)
 	{
-		uint8_t * payload = tunnelMsg->GetPayload () + 4;
+		const uint8_t * inPayload = in->GetPayload () + 4;
+		uint8_t * outPayload = out->GetPayload () + 4;
 		TunnelHopConfig * hop = m_Config->GetLastHop (); 
 		while (hop)
 		{	
-			hop->decryption.Decrypt (payload, payload);
+			hop->decryption.Decrypt (inPayload, outPayload);
 			hop = hop->prev;
+			inPayload = outPayload;	
 		}
 	}	
 
@@ -160,7 +162,7 @@ namespace tunnel
 	{
 		if (IsFailed ()) SetState (eTunnelStateEstablished); // incoming messages means a tunnel is alive			
 		msg->from = shared_from_this ();
-		EncryptTunnelMsg (msg);
+		EncryptTunnelMsg (msg, msg);
 		m_Endpoint.HandleDecryptedTunnelDataMsg (msg);	
 	}	
 
diff --git a/Tunnel.h b/Tunnel.h
index 4ce44240..b5cde16a 100644
--- a/Tunnel.h
+++ b/Tunnel.h
@@ -65,7 +65,7 @@ namespace tunnel
 			
 			// implements TunnelBase
 			void SendTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> msg);
-			void EncryptTunnelMsg (std::shared_ptr<I2NPMessage> tunnelMsg); 
+			void EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out); 
 			uint32_t GetNextTunnelID () const { return m_Config->GetFirstHop ()->tunnelID; };
 			const i2p::data::IdentHash& GetNextIdentHash () const { return m_Config->GetFirstHop ()->router->GetIdentHash (); };
 			
diff --git a/TunnelBase.h b/TunnelBase.h
index 5470f139..876d6d93 100644
--- a/TunnelBase.h
+++ b/TunnelBase.h
@@ -40,7 +40,7 @@ namespace tunnel
 			virtual void HandleTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> tunnelMsg) = 0;
 			virtual void SendTunnelDataMsg (std::shared_ptr<i2p::I2NPMessage> msg) = 0;
 			virtual void FlushTunnelDataMsgs () {};
-			virtual void EncryptTunnelMsg (std::shared_ptr<I2NPMessage> tunnelMsg) = 0;
+			virtual void EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out) = 0;
 			virtual uint32_t GetNextTunnelID () const = 0;
 			virtual const i2p::data::IdentHash& GetNextIdentHash () const = 0;
 			virtual uint32_t GetTunnelID () const = 0; // as known at our side
diff --git a/TunnelGateway.cpp b/TunnelGateway.cpp
index 2763ae17..cedbff10 100644
--- a/TunnelGateway.cpp
+++ b/TunnelGateway.cpp
@@ -188,7 +188,7 @@ namespace tunnel
 		auto tunnelMsgs = m_Buffer.GetTunnelDataMsgs ();
 		for (auto tunnelMsg : tunnelMsgs)
 		{	
-			m_Tunnel->EncryptTunnelMsg (tunnelMsg); 
+			m_Tunnel->EncryptTunnelMsg (tunnelMsg, tunnelMsg); 
 			FillI2NPMessageHeader (tunnelMsg.get (), eI2NPTunnelData); // TODO:
 			m_NumSentBytes += TUNNEL_DATA_MSG_SIZE;
 		}