diff --git a/.gitignore b/.gitignore
index 1adbe1ef..40d8fe07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,15 @@ netDb
 tunnels.cfg
 tests/tests
 
+# Build files
+build/CMakeCache.txt
+build/CMakeFiles/*
+build/cmake_install.cmake
+build/i2pd
+build/libcommon.a
+build/libi2pd.a
+
+
 # Autotools
 autom4te.cache
 .deps
diff --git a/AESNIMacros.h b/AESNIMacros.h
new file mode 100644
index 00000000..5fb16a73
--- /dev/null
+++ b/AESNIMacros.h
@@ -0,0 +1,66 @@
+#ifndef AESNIMACROS_H__
+#define AESNIMACROS_H__
+
+#define KeyExpansion256(round0,round1) \
+    "pshufd $0xff, %%xmm2, %%xmm2 \n" \
+    "movaps %%xmm1, %%xmm4 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm1 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm1 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm1 \n" \
+    "pxor %%xmm2, %%xmm1 \n" \
+    "movaps %%xmm1, "#round0"(%[sched]) \n" \
+    "aeskeygenassist $0, %%xmm1, %%xmm4 \n" \
+    "pshufd $0xaa, %%xmm4, %%xmm2 \n" \
+    "movaps %%xmm3, %%xmm4 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm3 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm3 \n" \
+    "pslldq $4, %%xmm4 \n" \
+    "pxor %%xmm4, %%xmm3 \n" \
+    "pxor %%xmm2, %%xmm3 \n" \
+    "movaps %%xmm3, "#round1"(%[sched]) \n" 
+
+#define EncryptAES256(sched) \
+    "pxor (%["#sched"]), %%xmm0 \n" \
+    "aesenc 16(%["#sched"]), %%xmm0 \n" \
+    "aesenc 32(%["#sched"]), %%xmm0 \n" \
+    "aesenc 48(%["#sched"]), %%xmm0 \n" \
+    "aesenc 64(%["#sched"]), %%xmm0 \n" \
+    "aesenc 80(%["#sched"]), %%xmm0 \n" \
+    "aesenc 96(%["#sched"]), %%xmm0 \n" \
+    "aesenc 112(%["#sched"]), %%xmm0 \n" \
+    "aesenc 128(%["#sched"]), %%xmm0 \n" \
+    "aesenc 144(%["#sched"]), %%xmm0 \n" \
+    "aesenc 160(%["#sched"]), %%xmm0 \n" \
+    "aesenc 176(%["#sched"]), %%xmm0 \n" \
+    "aesenc 192(%["#sched"]), %%xmm0 \n" \
+    "aesenc 208(%["#sched"]), %%xmm0 \n" \
+    "aesenclast 224(%["#sched"]), %%xmm0 \n"
+
+#define DecryptAES256(sched) \
+    "pxor 224(%["#sched"]), %%xmm0 \n" \
+    "aesdec 208(%["#sched"]), %%xmm0 \n" \
+    "aesdec 192(%["#sched"]), %%xmm0 \n" \
+    "aesdec 176(%["#sched"]), %%xmm0 \n" \
+    "aesdec 160(%["#sched"]), %%xmm0 \n" \
+    "aesdec 144(%["#sched"]), %%xmm0 \n" \
+    "aesdec 128(%["#sched"]), %%xmm0 \n" \
+    "aesdec 112(%["#sched"]), %%xmm0 \n" \
+    "aesdec 96(%["#sched"]), %%xmm0 \n" \
+    "aesdec 80(%["#sched"]), %%xmm0 \n" \
+    "aesdec 64(%["#sched"]), %%xmm0 \n" \
+    "aesdec 48(%["#sched"]), %%xmm0 \n" \
+    "aesdec 32(%["#sched"]), %%xmm0 \n" \
+    "aesdec 16(%["#sched"]), %%xmm0 \n" \
+    "aesdeclast (%["#sched"]), %%xmm0 \n"
+
+#define CallAESIMC(offset) \
+    "movaps "#offset"(%[shed]), %%xmm0 \n"  \
+    "aesimc %%xmm0, %%xmm0 \n" \
+    "movaps %%xmm0, "#offset"(%[shed]) \n" 
+
+#endif
diff --git a/AddressBook.cpp b/AddressBook.cpp
index 6d2893d4..af10cdea 100644
--- a/AddressBook.cpp
+++ b/AddressBook.cpp
@@ -8,10 +8,10 @@
 #include <boost/filesystem.hpp>
 #include <boost/lexical_cast.hpp>
 #include <cryptopp/osrng.h>
-#include "base64.h"
-#include "util.h"
+#include "util/base64.h"
+#include "util/util.h"
 #include "Identity.h"
-#include "Log.h"
+#include "util/Log.h"
 #include "NetDb.h"
 #include "ClientContext.h"
 #include "AddressBook.h"
@@ -215,7 +215,7 @@ namespace client
         auto pos = address.find(".b32.i2p");
         if (pos != std::string::npos)
         {
-            Base32ToByteStream (address.c_str(), pos, ident, 32);
+            i2p::util::Base32ToByteStream (address.c_str(), pos, ident, 32);
             return true;
         }
         else
diff --git a/AddressBook.h b/AddressBook.h
index 0de1bbfd..e00283a2 100644
--- a/AddressBook.h
+++ b/AddressBook.h
@@ -8,10 +8,10 @@
 #include <iostream>
 #include <mutex>
 #include <boost/asio.hpp>
-#include "base64.h"
-#include "util.h"
+#include "util/base64.h"
+#include "util/util.h"
 #include "Identity.h"
-#include "Log.h"
+#include "util/Log.h"
 
 namespace i2p
 {
diff --git a/BOB.cpp b/BOB.cpp
index cbe8f142..9247edbd 100644
--- a/BOB.cpp
+++ b/BOB.cpp
@@ -1,6 +1,6 @@
 #include <string.h>
 #include <boost/lexical_cast.hpp>
-#include "Log.h"
+#include "util/Log.h"
 #include "ClientContext.h"
 #include "BOB.h"
 
diff --git a/ClientContext.cpp b/ClientContext.cpp
index 34e195e0..9ffd2303 100644
--- a/ClientContext.cpp
+++ b/ClientContext.cpp
@@ -2,8 +2,8 @@
 #include <iostream>
 #include <boost/property_tree/ptree.hpp>
 #include <boost/property_tree/ini_parser.hpp>
-#include "util.h"
-#include "Log.h"
+#include "util/util.h"
+#include "util/Log.h"
 #include "Identity.h"
 #include "ClientContext.h"
 
diff --git a/Daemon.cpp b/Daemon.cpp
index 7ba7ccb3..46ab2eb2 100644
--- a/Daemon.cpp
+++ b/Daemon.cpp
@@ -2,17 +2,16 @@
 
 #include "Daemon.h"
 
-#include "Log.h"
-#include "base64.h"
+#include "util/Log.h"
 #include "version.h"
-#include "Transports.h"
-#include "NTCPSession.h"
+#include "transport/Transports.h"
+#include "transport/NTCPSession.h"
 #include "RouterInfo.h"
 #include "RouterContext.h"
-#include "Tunnel.h"
+#include "tunnel/Tunnel.h"
 #include "NetDb.h"
 #include "Garlic.h"
-#include "util.h"
+#include "util/util.h"
 #include "Streaming.h"
 #include "Destination.h"
 #include "HTTPServer.h"
diff --git a/DaemonLinux.cpp b/DaemonLinux.cpp
index 15e30e2f..bbd5962e 100644
--- a/DaemonLinux.cpp
+++ b/DaemonLinux.cpp
@@ -8,8 +8,8 @@
 #include <fcntl.h>
 #include <sys/stat.h>
 
-#include "Log.h"
-#include "util.h"
+#include "util/Log.h"
+#include "util/util.h"
 
 
 void handle_signal(int sig)
diff --git a/DaemonWin32.cpp b/DaemonWin32.cpp
index 6d8139de..3f5d5b00 100644
--- a/DaemonWin32.cpp
+++ b/DaemonWin32.cpp
@@ -1,6 +1,6 @@
 #include "Daemon.h"
-#include "util.h"
-#include "Log.h"
+#include "util/util.h"
+#include "util/Log.h"
 
 #ifdef _WIN32
 
@@ -80,4 +80,4 @@ namespace i2p
     }
 }
 
-#endif
\ No newline at end of file
+#endif
diff --git a/Datagram.cpp b/Datagram.cpp
index 4b08e25c..c5d4311b 100644
--- a/Datagram.cpp
+++ b/Datagram.cpp
@@ -2,8 +2,8 @@
 #include <vector>
 #include <cryptopp/sha.h>
 #include <cryptopp/gzip.h>
-#include "Log.h"
-#include "TunnelBase.h"
+#include "util/Log.h"
+#include "tunnel/TunnelBase.h"
 #include "RouterContext.h"
 #include "Destination.h"
 #include "Datagram.h"
diff --git a/Destination.cpp b/Destination.cpp
index 5f214ab6..c680313c 100644
--- a/Destination.cpp
+++ b/Destination.cpp
@@ -1,10 +1,10 @@
 #include <algorithm>
 #include <cassert>
 #include <boost/lexical_cast.hpp>
-#include "Log.h"
-#include "util.h"
-#include "ElGamal.h"
-#include "Timestamp.h"
+#include "util/Log.h"
+#include "util/util.h"
+#include "crypto/ElGamal.h"
+#include "util/Timestamp.h"
 #include "NetDb.h"
 #include "AddressBook.h"
 #include "Destination.h"
diff --git a/Destination.h b/Destination.h
index 7e73af95..789474e2 100644
--- a/Destination.h
+++ b/Destination.h
@@ -10,8 +10,8 @@
 #include <functional>
 #include <boost/asio.hpp>
 #include "Identity.h"
-#include "TunnelPool.h"
-#include "CryptoConst.h"
+#include "tunnel/TunnelPool.h"
+#include "crypto/CryptoConst.h"
 #include "LeaseSet.h"
 #include "Garlic.h"
 #include "NetDb.h"
diff --git a/Garlic.cpp b/Garlic.cpp
index 0fdc6473..3b9e4b43 100644
--- a/Garlic.cpp
+++ b/Garlic.cpp
@@ -1,12 +1,12 @@
 #include <inttypes.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <map>
 #include <string>
 #include "RouterContext.h"
 #include "I2NPProtocol.h"
-#include "Tunnel.h"
-#include "TunnelPool.h"
-#include "Timestamp.h"
+#include "tunnel/Tunnel.h"
+#include "tunnel/TunnelPool.h"
+#include "util/Timestamp.h"
 #include "Destination.h"
 #include "Garlic.h"
 
diff --git a/Garlic.h b/Garlic.h
index 7d02c21a..457b64e0 100644
--- a/Garlic.h
+++ b/Garlic.h
@@ -9,10 +9,10 @@
 #include <mutex>
 #include <memory>
 #include <cryptopp/osrng.h>
-#include "aes.h"
+#include "crypto/aes.h"
 #include "I2NPProtocol.h"
 #include "LeaseSet.h"
-#include "Queue.h"
+#include "util/Queue.h"
 #include "Identity.h"
 
 namespace i2p
diff --git a/HTTPProxy.cpp b/HTTPProxy.cpp
index 3902348e..a5a64431 100644
--- a/HTTPProxy.cpp
+++ b/HTTPProxy.cpp
@@ -5,12 +5,12 @@
 #include <string>
 #include <atomic>
 #include "HTTPProxy.h"
-#include "util.h"
+#include "util/util.h"
 #include "Identity.h"
 #include "Streaming.h"
 #include "Destination.h"
 #include "ClientContext.h"
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "I2PTunnel.h"
 
 namespace i2p
diff --git a/HTTPServer.cpp b/HTTPServer.cpp
index 3d656730..2419b386 100644
--- a/HTTPServer.cpp
+++ b/HTTPServer.cpp
@@ -1,13 +1,13 @@
 #include <boost/bind.hpp>
 #include <boost/lexical_cast.hpp>
 #include <boost/date_time/posix_time/posix_time.hpp>
-#include "base64.h"
-#include "Log.h"
-#include "Tunnel.h"
-#include "TransitTunnel.h"
-#include "Transports.h"
+#include "util/base64.h"
+#include "util/Log.h"
+#include "tunnel/Tunnel.h"
+#include "tunnel/TransitTunnel.h"
+#include "transport/Transports.h"
 #include "NetDb.h"
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "Streaming.h"
 #include "Destination.h"
 #include "RouterContext.h"
diff --git a/I2NPProtocol.cpp b/I2NPProtocol.cpp
index 82e7a0be..82a015d1 100644
--- a/I2NPProtocol.cpp
+++ b/I2NPProtocol.cpp
@@ -1,14 +1,13 @@
 #include <string.h>
 #include <atomic>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <cryptopp/gzip.h>
-#include "ElGamal.h"
-#include "Timestamp.h"
+#include "crypto/ElGamal.h"
+#include "util/Timestamp.h"
 #include "RouterContext.h"
 #include "NetDb.h"
-#include "Tunnel.h"
-#include "base64.h"
-#include "Transports.h"
+#include "tunnel/Tunnel.h"
+#include "transport/Transports.h"
 #include "Garlic.h"
 #include "I2NPProtocol.h"
 
diff --git a/I2NPProtocol.h b/I2NPProtocol.h
index 28a0e111..d8570330 100644
--- a/I2NPProtocol.h
+++ b/I2NPProtocol.h
@@ -6,7 +6,7 @@
 #include <set>
 #include <memory>
 #include <cryptopp/sha.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "Identity.h"
 #include "RouterInfo.h"
 #include "LeaseSet.h"
diff --git a/I2PControl.cpp b/I2PControl.cpp
index 9c36b2ac..4e993aa9 100644
--- a/I2PControl.cpp
+++ b/I2PControl.cpp
@@ -9,13 +9,13 @@
 #if !GCC47_BOOST149
 #include <boost/property_tree/json_parser.hpp>
 #endif
-#include "Log.h"
+#include "util/Log.h"
 #include "NetDb.h"
 #include "RouterContext.h"
 #include "Daemon.h"
-#include "Tunnel.h"
-#include "Timestamp.h"
-#include "Transports.h"
+#include "tunnel/Tunnel.h"
+#include "util/Timestamp.h"
+#include "transport/Transports.h"
 #include "version.h"
 
 namespace i2p
diff --git a/I2PTunnel.cpp b/I2PTunnel.cpp
index 50ecd27c..ef968d11 100644
--- a/I2PTunnel.cpp
+++ b/I2PTunnel.cpp
@@ -1,6 +1,5 @@
 #include <cassert>
-#include "base64.h"
-#include "Log.h"
+#include "util/Log.h"
 #include "Destination.h"
 #include "ClientContext.h"
 #include "I2PTunnel.h"
diff --git a/Identity.cpp b/Identity.cpp
index 6f17eca6..226e41fb 100644
--- a/Identity.cpp
+++ b/Identity.cpp
@@ -3,12 +3,12 @@
 #include <cryptopp/sha.h>
 #include <cryptopp/osrng.h>
 #include <cryptopp/dsa.h>
-#include "base64.h"
-#include "CryptoConst.h"
-#include "ElGamal.h"
+#include "util/base64.h"
+#include "crypto/CryptoConst.h"
+#include "crypto/ElGamal.h"
 #include "RouterContext.h"
 #include "Identity.h"
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 
 namespace i2p
 {
@@ -237,7 +237,7 @@ namespace data
     size_t IdentityEx::FromBase64(const std::string& s)
     {
         uint8_t buf[1024];
-        auto len = Base64ToByteStream (s.c_str(), s.length(), buf, 1024);
+        auto len = i2p::util::Base64ToByteStream (s.c_str(), s.length(), buf, 1024);
         return FromBuffer (buf, len);
     }   
     
@@ -246,7 +246,7 @@ namespace data
         uint8_t buf[1024];
         char str[1536];
         size_t l = ToBuffer (buf, 1024);
-        size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, 1536);
+        size_t l1 = i2p::util::ByteStreamToBase64 (buf, l, str, 1536);
         str[l1] = 0;
         return std::string (str);
     }
@@ -420,7 +420,7 @@ namespace data
     size_t PrivateKeys::FromBase64(const std::string& s)
     {
         uint8_t * buf = new uint8_t[s.length ()];
-        size_t l = i2p::data::Base64ToByteStream (s.c_str (), s.length (), buf, s.length ());
+        size_t l = i2p::util::Base64ToByteStream (s.c_str (), s.length (), buf, s.length ());
         size_t ret = FromBuffer (buf, l);
         delete[] buf;
         return ret;
@@ -431,7 +431,7 @@ namespace data
         uint8_t * buf = new uint8_t[GetFullLen ()];
         char * str = new char[GetFullLen ()*2];
         size_t l = ToBuffer (buf, GetFullLen ());
-        size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, str, GetFullLen ()*2);
+        size_t l1 = i2p::util::ByteStreamToBase64 (buf, l, str, GetFullLen ()*2);
         str[l1] = 0;
         delete[] buf;
         std::string ret(str);
diff --git a/Identity.h b/Identity.h
index 4502448b..3388b150 100644
--- a/Identity.h
+++ b/Identity.h
@@ -5,9 +5,9 @@
 #include <string.h>
 #include <string>
 #include <memory>
-#include "base64.h"
-#include "ElGamal.h"
-#include "Signature.h"
+#include "util/base64.h"
+#include "crypto/ElGamal.h"
+#include "crypto/Signature.h"
 
 namespace i2p
 {
@@ -51,7 +51,7 @@ namespace data
             std::string ToBase64 () const
             {
                 char str[sz*2];
-                int l = i2p::data::ByteStreamToBase64 (m_Buf, sz, str, sz*2);
+                int l = i2p::util::ByteStreamToBase64 (m_Buf, sz, str, sz*2);
                 str[l] = 0;
                 return std::string (str);
             }
@@ -59,19 +59,19 @@ namespace data
             std::string ToBase32 () const
             {
                 char str[sz*2];
-                int l = i2p::data::ByteStreamToBase32 (m_Buf, sz, str, sz*2);
+                int l = i2p::util::ByteStreamToBase32 (m_Buf, sz, str, sz*2);
                 str[l] = 0;
                 return std::string (str);
             }   
 
             void FromBase32 (const std::string& s)
             {
-                i2p::data::Base32ToByteStream (s.c_str (), s.length (), m_Buf, sz);
+                i2p::util::Base32ToByteStream (s.c_str (), s.length (), m_Buf, sz);
             }
 
             void FromBase64 (const std::string& s)
             {
-                i2p::data::Base64ToByteStream (s.c_str (), s.length (), m_Buf, sz);
+                i2p::util::Base64ToByteStream (s.c_str (), s.length (), m_Buf, sz);
             }
 
         private:
diff --git a/LeaseSet.cpp b/LeaseSet.cpp
index f648a44c..15771f65 100644
--- a/LeaseSet.cpp
+++ b/LeaseSet.cpp
@@ -1,12 +1,12 @@
 #include <string.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <cryptopp/dsa.h>
 #include <cryptopp/osrng.h>
-#include "CryptoConst.h"
-#include "Log.h"
-#include "Timestamp.h"
+#include "crypto/CryptoConst.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "NetDb.h"
-#include "TunnelPool.h"
+#include "tunnel/TunnelPool.h"
 #include "LeaseSet.h"
 
 namespace i2p
diff --git a/Makefile b/Makefile
index bc9d60fc..cd4961f4 100644
--- a/Makefile
+++ b/Makefile
@@ -28,6 +28,10 @@ tests: mk_build_test_dir $(TESTS)
 
 mk_build_dir:
 	mkdir -p obj
+	mkdir -p obj/transport
+	mkdir -p obj/util
+	mkdir -p obj/crypto
+	mkdir -p obj/tunnel
 mk_build_test_dir:
 	mkdir -p obj/tests
 
@@ -42,13 +46,21 @@ api: $(SHLIB)
 
 deps:
 	@mkdir -p obj
+	@mkdir -p obj/transport
 	@mkdir -p obj/tests
+	@mkdir -p obj/util
+	@mkdir -p obj/crypto
+	@mkdir -p obj/tunnel
 	$(CXX) $(CXXFLAGS) $(NEEDED_CXXFLAGS) -MM *.cpp > $(DEPS)
 	@sed -i -e '/\.o:/ s/^/obj\//' $(DEPS)
 
 obj/%.o : %.cpp
 	@mkdir -p obj
+	@mkdir -p obj/transport
 	@mkdir -p obj/tests
+	@mkdir -p obj/util
+	@mkdir -p obj/crypto
+	@mkdir -p obj/tunnel
 	$(CXX) $(CXXFLAGS) $(NEEDED_CXXFLAGS) $(INCFLAGS) $(CPU_FLAGS) -c -o $@ $<
 
 # '-' is 'ignore if missing' on first run
diff --git a/Makefile.bsd b/Makefile.bsd
index cd6948f3..26dc0e89 100644
--- a/Makefile.bsd
+++ b/Makefile.bsd
@@ -7,7 +7,7 @@ CXXFLAGS = -O2
 ## -std=c++11. If you want to remove this variable please do so in a way that allows setting
 ## custom FLAGS to work at build-time.
 NEEDED_CXXFLAGS = -std=c++11
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
+INCFLAGS = -I/usr/include/ -I/usr/local/include/ -I.
 LDFLAGS = -Wl,-rpath,/usr/local/lib -L/usr/local/lib
 LDLIBS = -lcryptopp -lboost_system -lboost_date_time -lboost_filesystem -lboost_regex -lboost_program_options -lpthread
 LDTESTLIBS = -lboost_unit_test_framework
diff --git a/Makefile.linux b/Makefile.linux
index a2bfed17..21e1bb8c 100644
--- a/Makefile.linux
+++ b/Makefile.linux
@@ -1,5 +1,5 @@
 CXXFLAGS = -g -Wall
-INCFLAGS =
+INCFLAGS = -I.
 
 ## NOTE: The NEEDED_CXXFLAGS are here so that custom CXXFLAGS can be specified at build time
 ## **without** overwriting the CXXFLAGS which we need in order to build.
diff --git a/Makefile.osx b/Makefile.osx
index fddf5a6b..502efce9 100644
--- a/Makefile.osx
+++ b/Makefile.osx
@@ -1,7 +1,7 @@
 CXX = clang++
 CXXFLAGS = -g -Wall -std=c++11 -DCRYPTOPP_DISABLE_ASM -DMAC_OSX
 #CXXFLAGS = -g -O2 -Wall -std=c++11 -DCRYPTOPP_DISABLE_ASM
-INCFLAGS = -I/usr/local/include
+INCFLAGS = -I/usr/local/include -I.
 LDFLAGS = -Wl,-rpath,/usr/local/lib -L/usr/local/lib
 LDLIBS = -lcryptopp -lboost_system -lboost_date_time -lboost_filesystem -lboost_regex -lboost_program_options -lpthread
 LDTESTLIBS = -lboost_unit_test_framework
diff --git a/NetDb.cpp b/NetDb.cpp
index 474f9d2d..23d69226 100644
--- a/NetDb.cpp
+++ b/NetDb.cpp
@@ -1,19 +1,19 @@
 #include <string.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <fstream>
 #include <vector>
 #include <boost/asio.hpp>
 #include <cryptopp/gzip.h>
-#include "base64.h"
-#include "Log.h"
-#include "Timestamp.h"
+#include "util/base64.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "I2NPProtocol.h"
-#include "Tunnel.h"
-#include "Transports.h"
+#include "tunnel/Tunnel.h"
+#include "transport/Transports.h"
 #include "RouterContext.h"
 #include "Garlic.h"
 #include "NetDb.h"
-#include "util.h"
+#include "util/util.h"
 
 using namespace i2p::transport;
 
@@ -263,7 +263,7 @@ namespace data
         }
 
         // list of chars might appear in base64 string
-        const char * chars = GetBase64SubstitutionTable (); // 64 bytes
+        const char * chars = i2p::util::GetBase64SubstitutionTable (); // 64 bytes
         boost::filesystem::path suffix;
         for (int i = 0; i < 64; i++)
         {
@@ -544,7 +544,7 @@ namespace data
     {
         const uint8_t * buf = msg->GetPayload ();
         char key[48];
-        int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+        int l = i2p::util::ByteStreamToBase64 (buf, 32, key, 48);
         key[l] = 0;
         int num = buf[32]; // num
         LogPrint ("DatabaseSearchReply for ", key, " num=", num);
@@ -613,7 +613,7 @@ namespace data
         {
             const uint8_t * router = buf + 33 + i*32;
             char peerHash[48];
-            int l1 = i2p::data::ByteStreamToBase64 (router, 32, peerHash, 48);
+            int l1 = i2p::util::ByteStreamToBase64 (router, 32, peerHash, 48);
             peerHash[l1] = 0;
             LogPrint (i,": ", peerHash);
 
@@ -639,7 +639,7 @@ namespace data
             return;
         }   
         char key[48];
-        int l = i2p::data::ByteStreamToBase64 (buf, 32, key, 48);
+        int l = i2p::util::ByteStreamToBase64 (buf, 32, key, 48);
         key[l] = 0;
         uint8_t flag = buf[64];
         LogPrint ("DatabaseLookup for ", key, " recieved flags=", (int)flag);
diff --git a/NetDb.h b/NetDb.h
index d63fdc7c..84280332 100644
--- a/NetDb.h
+++ b/NetDb.h
@@ -9,12 +9,12 @@
 #include <thread>
 #include <mutex>
 #include <boost/filesystem.hpp>
-#include "Queue.h"
+#include "util/Queue.h"
 #include "I2NPProtocol.h"
 #include "RouterInfo.h"
 #include "LeaseSet.h"
-#include "Tunnel.h"
-#include "TunnelPool.h"
+#include "tunnel/Tunnel.h"
+#include "tunnel/TunnelPool.h"
 #include "Reseed.h"
 #include "NetDbRequests.h"
 
diff --git a/NetDbRequests.cpp b/NetDbRequests.cpp
index d3bff8ce..382d0e3b 100644
--- a/NetDbRequests.cpp
+++ b/NetDbRequests.cpp
@@ -1,6 +1,6 @@
-#include "Log.h"
+#include "util/Log.h"
 #include "I2NPProtocol.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "NetDb.h"
 #include "NetDbRequests.h"
 
diff --git a/Profiling.cpp b/Profiling.cpp
index 5d3ad943..f2d1269b 100644
--- a/Profiling.cpp
+++ b/Profiling.cpp
@@ -1,8 +1,8 @@
 #include <boost/filesystem.hpp>
 #include <boost/property_tree/ptree.hpp>
 #include <boost/property_tree/ini_parser.hpp>
-#include "base64.h"
-#include "util.h"
+#include "util/base64.h"
+#include "util/util.h"
 #include "Profiling.h"
 
 namespace i2p
@@ -52,7 +52,7 @@ namespace data
                 LogPrint (eLogError, "Failed to create directory ", path);
                 return;
             }           
-            const char * chars = GetBase64SubstitutionTable (); // 64 bytes
+            const char * chars = i2p::util::GetBase64SubstitutionTable (); // 64 bytes
             for (int i = 0; i < 64; i++)
             {
                 auto path1 = path / (std::string ("p") + chars[i]);
diff --git a/Reseed.cpp b/Reseed.cpp
index 89fbde7c..3e16f48b 100644
--- a/Reseed.cpp
+++ b/Reseed.cpp
@@ -11,13 +11,13 @@
 #include <cryptopp/zinflate.h>
 #define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
 #include <cryptopp/arc4.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "Reseed.h"
-#include "Log.h"
+#include "util/Log.h"
 #include "Identity.h"
-#include "CryptoConst.h"
+#include "crypto/CryptoConst.h"
 #include "NetDb.h"
-#include "util.h"
+#include "util/util.h"
 
 
 namespace i2p
diff --git a/Reseed.h b/Reseed.h
index cdd76858..a18ccd67 100644
--- a/Reseed.h
+++ b/Reseed.h
@@ -9,7 +9,7 @@
 #include <cryptopp/rsa.h>
 #include <boost/asio.hpp>
 #include "Identity.h"
-#include "aes.h"
+#include "crypto/aes.h"
 
 namespace i2p
 {
diff --git a/RouterContext.cpp b/RouterContext.cpp
index 0f6d4954..7032ea66 100644
--- a/RouterContext.cpp
+++ b/RouterContext.cpp
@@ -2,12 +2,12 @@
 #include <cryptopp/dh.h>
 #include <cryptopp/dsa.h>
 #include <boost/lexical_cast.hpp>
-#include "CryptoConst.h"
+#include "crypto/CryptoConst.h"
 #include "RouterContext.h"
-#include "Timestamp.h"
+#include "util/Timestamp.h"
 #include "I2NPProtocol.h"
 #include "NetDb.h"
-#include "util.h"
+#include "util/util.h"
 #include "version.h"
 
 namespace i2p
diff --git a/RouterInfo.cpp b/RouterInfo.cpp
index f4dadeb7..b3b11d73 100644
--- a/RouterInfo.cpp
+++ b/RouterInfo.cpp
@@ -1,14 +1,14 @@
 #include <stdio.h>
 #include <string.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <fstream>
 #include <boost/lexical_cast.hpp>
 #include <cryptopp/sha.h>
 #include <cryptopp/dsa.h>
-#include "CryptoConst.h"
-#include "base64.h"
-#include "Timestamp.h"
-#include "Log.h"
+#include "crypto/CryptoConst.h"
+#include "util/base64.h"
+#include "util/Timestamp.h"
+#include "util/Log.h"
 #include "RouterInfo.h"
 #include "RouterContext.h"
 
@@ -176,7 +176,7 @@ namespace data
                 else if (!strcmp (key, "mtu"))
                     address.mtu = boost::lexical_cast<int>(value);
                 else if (!strcmp (key, "key"))
-                    Base64ToByteStream (value, strlen (value), address.key, 32);
+                    i2p::util::Base64ToByteStream (value, strlen (value), address.key, 32);
                 else if (!strcmp (key, "caps"))
                     ExtractCaps (value);
                 else if (key[0] == 'i')
@@ -199,7 +199,7 @@ namespace data
                     else if (!strcmp (key, "itag"))
                         introducer.iTag = boost::lexical_cast<uint32_t>(value);
                     else if (!strcmp (key, "ikey"))
-                        Base64ToByteStream (value, strlen (value), introducer.iKey, 32);
+                        i2p::util::Base64ToByteStream (value, strlen (value), introducer.iKey, 32);
                 }
             }   
             if (isValidAddress)
@@ -344,7 +344,7 @@ namespace data
                         WriteString ("ikey" + boost::lexical_cast<std::string>(i), properties);
                         properties << '=';
                         char value[64];
-                        size_t l = ByteStreamToBase64 (introducer.iKey, 32, value, 64);
+                        size_t l = i2p::util::ByteStreamToBase64 (introducer.iKey, 32, value, 64);
                         value[l] = 0;
                         WriteString (value, properties);
                         properties << ';';
@@ -373,7 +373,7 @@ namespace data
                 WriteString ("key", properties);
                 properties << '=';
                 char value[64];
-                size_t l = ByteStreamToBase64 (address.key, 32, value, 64);
+                size_t l = i2p::util::ByteStreamToBase64 (address.key, 32, value, 64);
                 value[l] = 0;
                 WriteString (value, properties);
                 properties << ';';
diff --git a/SAM.cpp b/SAM.cpp
index 9014f373..695e8d4a 100644
--- a/SAM.cpp
+++ b/SAM.cpp
@@ -4,9 +4,9 @@
 #include <stdlib.h>
 #endif
 #include <boost/lexical_cast.hpp>
-#include "base64.h"
+#include "util/base64.h"
 #include "Identity.h"
-#include "Log.h"
+#include "util/Log.h"
 #include "Destination.h"
 #include "ClientContext.h"
 #include "SAM.h"
@@ -319,7 +319,7 @@ namespace client
         uint8_t buf[1024];
         char priv[1024];
         size_t l = m_Session->localDestination->GetPrivateKeys ().ToBuffer (buf, 1024);
-        size_t l1 = i2p::data::ByteStreamToBase64 (buf, l, priv, 1024);
+        size_t l1 = i2p::util::ByteStreamToBase64 (buf, l, priv, 1024);
         priv[l1] = 0;
 #ifdef _MSC_VER
         size_t l2 = sprintf_s (m_Buffer, SAM_SOCKET_BUFFER_SIZE, SAM_SESSION_CREATE_REPLY_OK, priv);
@@ -632,7 +632,7 @@ namespace client
                 // send remote peer address
                 uint8_t ident[1024];
                 size_t l = stream->GetRemoteIdentity ().ToBuffer (ident, 1024);
-                size_t l1 = i2p::data::ByteStreamToBase64 (ident, l, (char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE);
+                size_t l1 = i2p::util::ByteStreamToBase64 (ident, l, (char *)m_StreamBuffer, SAM_SOCKET_BUFFER_SIZE);
                 m_StreamBuffer[l1] = '\n';
                 HandleI2PReceive (boost::system::error_code (), l1 +1); // we send identity like it has been received from stream
             }   
diff --git a/SOCKS.cpp b/SOCKS.cpp
index be68d35d..6e092707 100644
--- a/SOCKS.cpp
+++ b/SOCKS.cpp
@@ -7,7 +7,7 @@
 #include "Streaming.h"
 #include "Destination.h"
 #include "ClientContext.h"
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "I2PTunnel.h"
 
 namespace i2p
diff --git a/Streaming.cpp b/Streaming.cpp
index 7e2d3bef..8b95139f 100644
--- a/Streaming.cpp
+++ b/Streaming.cpp
@@ -1,9 +1,9 @@
 #include <cryptopp/gzip.h>
-#include "Log.h"
+#include "util/Log.h"
 #include "RouterInfo.h"
 #include "RouterContext.h"
-#include "Tunnel.h"
-#include "Timestamp.h"
+#include "tunnel/Tunnel.h"
+#include "util/Timestamp.h"
 #include "Destination.h"
 #include "Streaming.h"
 
diff --git a/Streaming.h b/Streaming.h
index f100a69f..370d1822 100644
--- a/Streaming.h
+++ b/Streaming.h
@@ -11,12 +11,12 @@
 #include <memory>
 #include <mutex>
 #include <boost/asio.hpp>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include "Identity.h"
 #include "LeaseSet.h"
 #include "I2NPProtocol.h"
 #include "Garlic.h"
-#include "Tunnel.h"
+#include "tunnel/Tunnel.h"
 
 namespace i2p
 {
diff --git a/TODO b/TODO
index f7de0d33..0951dd0e 100644
--- a/TODO
+++ b/TODO
@@ -1,13 +1,16 @@
-Short-term refactoring:
+Refactoring:
     - SSUSession:637, SSUSession:635 get rid of casting to SSUHeader
     - Identity.cpp:156 check for self asignment
-
-Long-term refactoring:
     - Rely on a library for TLS and SSL.
     - Move parsing code out of networking code, to allow better testing. 
+    - Move streaming code to a separate directory.
     - Separate front-end code (SAM, BOB, ...) from the back-end.
 
-
 Additions:
     - Write tests.
     - Add documentation.
+    - Create a specialized IRC tunnel (instead of just a generic ClientTunnel instance).
+    - Ban peers with unexpected / bad behaviour.
+    - EdDSA support.
+    - Return correct error codes in HTTPProxy.
+    - Modify web interface layout and use AJAX to update information.
diff --git a/UPnP.cpp b/UPnP.cpp
index 6773b514..175528b4 100644
--- a/UPnP.cpp
+++ b/UPnP.cpp
@@ -13,12 +13,12 @@
 #include <dlfcn.h>
 #endif
 
-#include "Log.h"
+#include "util/Log.h"
 
 #include "RouterContext.h"
 #include "UPnP.h"
 #include "NetDb.h"
-#include "util.h"
+#include "util/util.h"
 
 #include <miniupnpc/miniupnpc.h>
 #include <miniupnpc/upnpcommands.h>
diff --git a/UPnP.h b/UPnP.h
index e1211a29..468b5c0c 100644
--- a/UPnP.h
+++ b/UPnP.h
@@ -12,7 +12,7 @@
 
 #include <boost/asio.hpp>
 
-#include "util.h"
+#include "util/util.h"
 
 #define I2P_UPNP_TCP 1
 #define I2P_UPNP_UDP 2
diff --git a/aes.cpp b/aes.cpp
deleted file mode 100644
index fe354b9f..00000000
--- a/aes.cpp
+++ /dev/null
@@ -1,357 +0,0 @@
-#include <stdlib.h>
-#include "TunnelBase.h"
-#include "aes.h"
-
-namespace i2p
-{
-namespace crypto
-{
-
-#ifdef AESNI
-    
-    #define KeyExpansion256(round0,round1) \
-        "pshufd $0xff, %%xmm2, %%xmm2 \n" \
-        "movaps %%xmm1, %%xmm4 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm1 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm1 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm1 \n" \
-        "pxor %%xmm2, %%xmm1 \n" \
-        "movaps %%xmm1, "#round0"(%[sched]) \n" \
-        "aeskeygenassist $0, %%xmm1, %%xmm4 \n" \
-        "pshufd $0xaa, %%xmm4, %%xmm2 \n" \
-        "movaps %%xmm3, %%xmm4 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm3 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm3 \n" \
-        "pslldq $4, %%xmm4 \n" \
-        "pxor %%xmm4, %%xmm3 \n" \
-        "pxor %%xmm2, %%xmm3 \n" \
-        "movaps %%xmm3, "#round1"(%[sched]) \n" 
-
-    void ECBCryptoAESNI::ExpandKey (const AESKey& key)
-    {
-        __asm__
-        (
-            "movups (%[key]), %%xmm1 \n"
-            "movups 16(%[key]), %%xmm3 \n"
-            "movaps %%xmm1, (%[sched]) \n"
-            "movaps %%xmm3, 16(%[sched]) \n"
-            "aeskeygenassist $1, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(32,48)
-            "aeskeygenassist $2, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(64,80)
-            "aeskeygenassist $4, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(96,112)
-            "aeskeygenassist $8, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(128,144)
-            "aeskeygenassist $16, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(160,176)
-            "aeskeygenassist $32, %%xmm3, %%xmm2 \n"
-            KeyExpansion256(192,208)
-            "aeskeygenassist $64, %%xmm3, %%xmm2 \n"
-            // key expansion final
-            "pshufd $0xff, %%xmm2, %%xmm2 \n"
-            "movaps %%xmm1, %%xmm4 \n" 
-            "pslldq $4, %%xmm4 \n"
-            "pxor %%xmm4, %%xmm1 \n"
-            "pslldq $4, %%xmm4 \n"
-            "pxor %%xmm4, %%xmm1 \n"
-            "pslldq $4, %%xmm4 \n"
-            "pxor %%xmm4, %%xmm1 \n"
-            "pxor %%xmm2, %%xmm1 \n"
-            "movups %%xmm1, 224(%[sched]) \n"
-            : // output
-            : [key]"r"((const uint8_t *)key), [sched]"r"(GetKeySchedule ()) // input
-            : "%xmm1", "%xmm2", "%xmm3", "%xmm4", "memory" // clogged
-        );
-    }
-
-    #define EncryptAES256(sched) \
-        "pxor (%["#sched"]), %%xmm0 \n" \
-        "aesenc 16(%["#sched"]), %%xmm0 \n" \
-        "aesenc 32(%["#sched"]), %%xmm0 \n" \
-        "aesenc 48(%["#sched"]), %%xmm0 \n" \
-        "aesenc 64(%["#sched"]), %%xmm0 \n" \
-        "aesenc 80(%["#sched"]), %%xmm0 \n" \
-        "aesenc 96(%["#sched"]), %%xmm0 \n" \
-        "aesenc 112(%["#sched"]), %%xmm0 \n" \
-        "aesenc 128(%["#sched"]), %%xmm0 \n" \
-        "aesenc 144(%["#sched"]), %%xmm0 \n" \
-        "aesenc 160(%["#sched"]), %%xmm0 \n" \
-        "aesenc 176(%["#sched"]), %%xmm0 \n" \
-        "aesenc 192(%["#sched"]), %%xmm0 \n" \
-        "aesenc 208(%["#sched"]), %%xmm0 \n" \
-        "aesenclast 224(%["#sched"]), %%xmm0 \n"
-        
-    void ECBEncryptionAESNI::Encrypt (const ChipherBlock * in, ChipherBlock * out)
-    {
-        __asm__
-        (
-            "movups (%[in]), %%xmm0 \n"
-            EncryptAES256(sched)
-            "movups %%xmm0, (%[out]) \n"    
-            : : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
-        );
-    }       
-
-    #define DecryptAES256(sched) \
-        "pxor 224(%["#sched"]), %%xmm0 \n" \
-        "aesdec 208(%["#sched"]), %%xmm0 \n" \
-        "aesdec 192(%["#sched"]), %%xmm0 \n" \
-        "aesdec 176(%["#sched"]), %%xmm0 \n" \
-        "aesdec 160(%["#sched"]), %%xmm0 \n" \
-        "aesdec 144(%["#sched"]), %%xmm0 \n" \
-        "aesdec 128(%["#sched"]), %%xmm0 \n" \
-        "aesdec 112(%["#sched"]), %%xmm0 \n" \
-        "aesdec 96(%["#sched"]), %%xmm0 \n" \
-        "aesdec 80(%["#sched"]), %%xmm0 \n" \
-        "aesdec 64(%["#sched"]), %%xmm0 \n" \
-        "aesdec 48(%["#sched"]), %%xmm0 \n" \
-        "aesdec 32(%["#sched"]), %%xmm0 \n" \
-        "aesdec 16(%["#sched"]), %%xmm0 \n" \
-        "aesdeclast (%["#sched"]), %%xmm0 \n"
-    
-    void ECBDecryptionAESNI::Decrypt (const ChipherBlock * in, ChipherBlock * out)
-    {
-        __asm__
-        (
-            "movups (%[in]), %%xmm0 \n"
-            DecryptAES256(sched)
-            "movups %%xmm0, (%[out]) \n"    
-            : : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
-        );      
-    }
-
-    #define CallAESIMC(offset) \
-        "movaps "#offset"(%[shed]), %%xmm0 \n"  \
-        "aesimc %%xmm0, %%xmm0 \n" \
-        "movaps %%xmm0, "#offset"(%[shed]) \n" 
-
-    void ECBDecryptionAESNI::SetKey (const AESKey& key)
-    {
-        ExpandKey (key); // expand encryption key first
-        // then  invert it using aesimc
-        __asm__
-        (
-            CallAESIMC(16)
-            CallAESIMC(32)
-            CallAESIMC(48)
-            CallAESIMC(64)
-            CallAESIMC(80)
-            CallAESIMC(96)
-            CallAESIMC(112)
-            CallAESIMC(128)
-            CallAESIMC(144)
-            CallAESIMC(160)
-            CallAESIMC(176)
-            CallAESIMC(192)
-            CallAESIMC(208)
-            : : [shed]"r"(GetKeySchedule ()) : "%xmm0", "memory"
-        );
-    }
-
-#endif      
-
-
-    void CBCEncryption::Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            "movups (%[iv]), %%xmm1 \n"
-            "1: \n"
-            "movups (%[in]), %%xmm0 \n"
-            "pxor %%xmm1, %%xmm0 \n"
-            EncryptAES256(sched)
-            "movaps %%xmm0, %%xmm1 \n"  
-            "movups %%xmm0, (%[out]) \n"
-            "add $16, %[in] \n"
-            "add $16, %[out] \n"
-            "dec %[num] \n"
-            "jnz 1b \n"     
-            "movups %%xmm1, (%[iv]) \n"
-            : 
-            : [iv]"r"(&m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
-            : "%xmm0", "%xmm1", "cc", "memory"
-        ); 
-#else       
-        for (int i = 0; i < numBlocks; i++)
-        {
-            m_LastBlock ^= in[i];
-            m_ECBEncryption.Encrypt (&m_LastBlock, &m_LastBlock);
-            out[i] = m_LastBlock;
-        }
-#endif      
-    }
-
-    void CBCEncryption::Encrypt (const uint8_t * in, std::size_t len, uint8_t * out)
-    {
-        // len/16
-        int numBlocks = len >> 4;
-        if (numBlocks > 0)
-            Encrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out); 
-    }
-
-    void CBCEncryption::Encrypt (const uint8_t * in, uint8_t * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            "movups (%[iv]), %%xmm1 \n"
-            "movups (%[in]), %%xmm0 \n"
-            "pxor %%xmm1, %%xmm0 \n"
-            EncryptAES256(sched)
-            "movups %%xmm0, (%[out]) \n"
-            "movups %%xmm0, (%[iv]) \n"
-            : 
-            : [iv]"r"(&m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out)
-            : "%xmm0", "%xmm1", "memory"
-        );      
-#else
-        Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out); 
-#endif
-    }
-
-    void CBCDecryption::Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            "movups (%[iv]), %%xmm1 \n"
-            "1: \n"
-            "movups (%[in]), %%xmm0 \n"
-            "movaps %%xmm0, %%xmm2 \n"
-            DecryptAES256(sched)
-            "pxor %%xmm1, %%xmm0 \n"
-            "movups %%xmm0, (%[out]) \n"
-            "movaps %%xmm2, %%xmm1 \n"
-            "add $16, %[in] \n"
-            "add $16, %[out] \n"
-            "dec %[num] \n"
-            "jnz 1b \n"     
-            "movups %%xmm1, (%[iv]) \n"
-            : 
-            : [iv]"r"(&m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
-            : "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
-        ); 
-#else
-        for (int i = 0; i < numBlocks; i++)
-        {
-            ChipherBlock tmp = in[i];
-            m_ECBDecryption.Decrypt (in + i, out + i);
-            out[i] ^= m_IV;
-            m_IV = tmp;
-        }
-#endif
-    }
-
-    void CBCDecryption::Decrypt (const uint8_t * in, std::size_t len, uint8_t * out)
-    {
-        int numBlocks = len >> 4;
-        if (numBlocks > 0)
-            Decrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out); 
-    }
-
-    void CBCDecryption::Decrypt (const uint8_t * in, uint8_t * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            "movups (%[iv]), %%xmm1 \n"
-            "movups (%[in]), %%xmm0 \n"
-            "movups %%xmm0, (%[iv]) \n"
-            DecryptAES256(sched)
-            "pxor %%xmm1, %%xmm0 \n"
-            "movups %%xmm0, (%[out]) \n"    
-            : 
-            : [iv]"r"(&m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out)
-            : "%xmm0", "%xmm1", "memory"
-        );
-#else
-        Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out); 
-#endif
-    }
-
-    void TunnelEncryption::Encrypt (const uint8_t * in, uint8_t * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            // encrypt IV 
-            "movups (%[in]), %%xmm0 \n"
-            EncryptAES256(sched_iv)
-            "movaps %%xmm0, %%xmm1 \n"
-            // double IV encryption
-            EncryptAES256(sched_iv)
-            "movups %%xmm0, (%[out]) \n"
-            // encrypt data, IV is xmm1
-            "1: \n"
-            "add $16, %[in] \n"
-            "add $16, %[out] \n"
-            "movups (%[in]), %%xmm0 \n"
-            "pxor %%xmm1, %%xmm0 \n"
-            EncryptAES256(sched_l)
-            "movaps %%xmm0, %%xmm1 \n"  
-            "movups %%xmm0, (%[out]) \n"
-            "dec %[num] \n"
-            "jnz 1b \n"     
-            : 
-            : [sched_iv]"r"(m_IVEncryption.GetKeySchedule ()), [sched_l]"r"(m_LayerEncryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
-            : "%xmm0", "%xmm1", "cc", "memory"
-        );
-#else
-        m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
-        m_LayerEncryption.SetIV (out);
-        m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
-        m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
-#endif
-    }
-
-    void TunnelDecryption::Decrypt (const uint8_t * in, uint8_t * out)
-    {
-#ifdef AESNI
-        __asm__
-        (
-            // decrypt IV 
-            "movups (%[in]), %%xmm0 \n"
-            DecryptAES256(sched_iv)
-            "movaps %%xmm0, %%xmm1 \n"
-            // double IV encryption
-            DecryptAES256(sched_iv)
-            "movups %%xmm0, (%[out]) \n"
-            // decrypt data, IV is xmm1
-            "1: \n"
-            "add $16, %[in] \n"
-            "add $16, %[out] \n"
-            "movups (%[in]), %%xmm0 \n"
-            "movaps %%xmm0, %%xmm2 \n"
-            DecryptAES256(sched_l)
-            "pxor %%xmm1, %%xmm0 \n"
-            "movups %%xmm0, (%[out]) \n"
-            "movaps %%xmm2, %%xmm1 \n"
-            "dec %[num] \n"
-            "jnz 1b \n"     
-            : 
-            : [sched_iv]"r"(m_IVDecryption.GetKeySchedule ()), [sched_l]"r"(m_LayerDecryption.GetKeySchedule ()), 
-              [in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
-            : "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
-        );
-#else
-        m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
-        m_LayerDecryption.SetIV (out);  
-        m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
-        m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
-#endif
-    }
-}
-}
-
diff --git a/api.cpp b/api.cpp
index e5258195..cd24d15a 100644
--- a/api.cpp
+++ b/api.cpp
@@ -1,13 +1,13 @@
 #include <string>
 #include <map>
-#include "Log.h"
+#include "util/Log.h"
 #include "NetDb.h"
-#include "Transports.h"
-#include "Tunnel.h"
+#include "transport/Transports.h"
+#include "tunnel/Tunnel.h"
 #include "RouterContext.h"
 #include "Identity.h"
 #include "Destination.h"
-#include "util.h"
+#include "util/util.h"
 #include "api.h"
 
 namespace i2p
diff --git a/build/CMakeLists.txt b/build/CMakeLists.txt
index ed8a281f..f7f85a16 100644
--- a/build/CMakeLists.txt
+++ b/build/CMakeLists.txt
@@ -15,41 +15,42 @@ set ( CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake_modules" )
 set ( CMAKE_SOURCE_DIR ".." )
 
 set (COMMON_SRC
+  "${CMAKE_SOURCE_DIR}/transport/NTCPSession.cpp"
+  "${CMAKE_SOURCE_DIR}/transport/SSU.cpp"
+  "${CMAKE_SOURCE_DIR}/transport/SSUData.cpp"
+  "${CMAKE_SOURCE_DIR}/transport/SSUSession.cpp"
+  "${CMAKE_SOURCE_DIR}/transport/Transports.cpp"
+  "${CMAKE_SOURCE_DIR}/crypto/CryptoConst.cpp"
+  "${CMAKE_SOURCE_DIR}/crypto/aes.cpp"
+  "${CMAKE_SOURCE_DIR}/crypto/Signature.cpp"
+  "${CMAKE_SOURCE_DIR}/util/base64.cpp"
+  "${CMAKE_SOURCE_DIR}/util/util.cpp"
+  "${CMAKE_SOURCE_DIR}/util/Log.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/TransitTunnel.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/Tunnel.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/TunnelGateway.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/TunnelEndpoint.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/TunnelPool.cpp"
+  "${CMAKE_SOURCE_DIR}/tunnel/TunnelCrypto.cpp"
   "${CMAKE_SOURCE_DIR}/AddressBook.cpp"	
-  "${CMAKE_SOURCE_DIR}/CryptoConst.cpp"
   "${CMAKE_SOURCE_DIR}/Garlic.cpp"
   "${CMAKE_SOURCE_DIR}/I2NPProtocol.cpp"
   "${CMAKE_SOURCE_DIR}/Identity.cpp"
   "${CMAKE_SOURCE_DIR}/LeaseSet.cpp"
-  "${CMAKE_SOURCE_DIR}/Log.cpp"
-  "${CMAKE_SOURCE_DIR}/NTCPSession.cpp"
   "${CMAKE_SOURCE_DIR}/NetDbRequests.cpp"	
   "${CMAKE_SOURCE_DIR}/NetDb.cpp"
   "${CMAKE_SOURCE_DIR}/Profiling.cpp"
   "${CMAKE_SOURCE_DIR}/Reseed.cpp"
   "${CMAKE_SOURCE_DIR}/RouterContext.cpp"
   "${CMAKE_SOURCE_DIR}/RouterInfo.cpp"
-  "${CMAKE_SOURCE_DIR}/SSU.cpp"
-  "${CMAKE_SOURCE_DIR}/SSUData.cpp"
-  "${CMAKE_SOURCE_DIR}/SSUSession.cpp"
   "${CMAKE_SOURCE_DIR}/Streaming.cpp"
   "${CMAKE_SOURCE_DIR}/Destination.cpp"	
-  "${CMAKE_SOURCE_DIR}/TransitTunnel.cpp"
-  "${CMAKE_SOURCE_DIR}/Tunnel.cpp"
-  "${CMAKE_SOURCE_DIR}/TunnelGateway.cpp"
-  "${CMAKE_SOURCE_DIR}/Transports.cpp"
-  "${CMAKE_SOURCE_DIR}/TunnelEndpoint.cpp"
-  "${CMAKE_SOURCE_DIR}/TunnelPool.cpp"
-  "${CMAKE_SOURCE_DIR}/aes.cpp"
-  "${CMAKE_SOURCE_DIR}/base64.cpp"
-  "${CMAKE_SOURCE_DIR}/util.cpp"
   "${CMAKE_SOURCE_DIR}/Datagram.cpp"
-  "${CMAKE_SOURCE_DIR}/Signature.cpp"
   "${CMAKE_SOURCE_DIR}/UPnP.cpp"
 )
 
 if (CMAKE_SYSTEM_NAME STREQUAL "Windows")
-  list (APPEND COMMON_SRC "${CMAKE_SOURCE_DIR}/I2PEndian.cpp")
+  list (APPEND COMMON_SRC "${CMAKE_SOURCE_DIR}/util/I2PEndian.cpp")
 endif ()
 
 add_library(common ${COMMON_SRC})
@@ -223,7 +224,7 @@ if (NOT ${MINIUPNPC_FOUND})
 endif()
 
 # load includes
-include_directories( ${Boost_INCLUDE_DIRS} ${CRYPTO++_INCLUDE_DIR} )
+include_directories( ${CMAKE_SOURCE_DIR}  ${Boost_INCLUDE_DIRS} ${CRYPTO++_INCLUDE_DIR} )
 
 # show summary
 message(STATUS "---------------------------------------")
diff --git a/CryptoConst.cpp b/crypto/CryptoConst.cpp
similarity index 100%
rename from CryptoConst.cpp
rename to crypto/CryptoConst.cpp
diff --git a/CryptoConst.h b/crypto/CryptoConst.h
similarity index 100%
rename from CryptoConst.h
rename to crypto/CryptoConst.h
diff --git a/ElGamal.h b/crypto/ElGamal.h
similarity index 99%
rename from ElGamal.h
rename to crypto/ElGamal.h
index 9f90da53..8a0d04df 100644
--- a/ElGamal.h
+++ b/crypto/ElGamal.h
@@ -7,7 +7,7 @@
 #include <cryptopp/dh.h>
 #include <cryptopp/sha.h>
 #include "CryptoConst.h"
-#include "Log.h"
+#include "util/Log.h"
 
 namespace i2p
 {
diff --git a/Signature.cpp b/crypto/Signature.cpp
similarity index 99%
rename from Signature.cpp
rename to crypto/Signature.cpp
index d56efddd..bf2809a0 100644
--- a/Signature.cpp
+++ b/crypto/Signature.cpp
@@ -1,7 +1,7 @@
 #include <memory>
 #include <cryptopp/integer.h>
 #include <cryptopp/eccrypto.h>
-#include "Log.h"
+#include "util/Log.h"
 #include "Signature.h"
 
 namespace i2p
diff --git a/Signature.h b/crypto/Signature.h
similarity index 100%
rename from Signature.h
rename to crypto/Signature.h
diff --git a/crypto/aes.cpp b/crypto/aes.cpp
new file mode 100644
index 00000000..a4fee883
--- /dev/null
+++ b/crypto/aes.cpp
@@ -0,0 +1,222 @@
+#include <stdlib.h>
+#include "aes.h"
+
+namespace i2p {
+namespace crypto {
+
+#ifdef AESNI
+#include "AESNIMacros.h" 
+
+void ECBCryptoAESNI::ExpandKey (const AESKey& key)
+{
+    __asm__
+    (
+        "movups (%[key]), %%xmm1 \n"
+        "movups 16(%[key]), %%xmm3 \n"
+        "movaps %%xmm1, (%[sched]) \n"
+        "movaps %%xmm3, 16(%[sched]) \n"
+        "aeskeygenassist $1, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(32,48)
+        "aeskeygenassist $2, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(64,80)
+        "aeskeygenassist $4, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(96,112)
+        "aeskeygenassist $8, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(128,144)
+        "aeskeygenassist $16, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(160,176)
+        "aeskeygenassist $32, %%xmm3, %%xmm2 \n"
+        KeyExpansion256(192,208)
+        "aeskeygenassist $64, %%xmm3, %%xmm2 \n"
+        // key expansion final
+        "pshufd $0xff, %%xmm2, %%xmm2 \n"
+        "movaps %%xmm1, %%xmm4 \n" 
+        "pslldq $4, %%xmm4 \n"
+        "pxor %%xmm4, %%xmm1 \n"
+        "pslldq $4, %%xmm4 \n"
+        "pxor %%xmm4, %%xmm1 \n"
+        "pslldq $4, %%xmm4 \n"
+        "pxor %%xmm4, %%xmm1 \n"
+        "pxor %%xmm2, %%xmm1 \n"
+        "movups %%xmm1, 224(%[sched]) \n"
+        : // output
+        : [key]"r"((const uint8_t *)key), [sched]"r"(GetKeySchedule ()) // input
+        : "%xmm1", "%xmm2", "%xmm3", "%xmm4", "memory" // clogged
+    );
+}
+
+void ECBEncryptionAESNI::Encrypt (const ChipherBlock * in, ChipherBlock * out)
+{
+    __asm__
+    (
+        "movups (%[in]), %%xmm0 \n"
+        EncryptAES256(sched)
+        "movups %%xmm0, (%[out]) \n"    
+        : : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
+    );
+}       
+
+
+void ECBDecryptionAESNI::Decrypt (const ChipherBlock * in, ChipherBlock * out)
+{
+    __asm__
+    (
+        "movups (%[in]), %%xmm0 \n"
+        DecryptAES256(sched)
+        "movups %%xmm0, (%[out]) \n"    
+        : : [sched]"r"(GetKeySchedule ()), [in]"r"(in), [out]"r"(out) : "%xmm0", "memory"
+    );      
+}
+
+void ECBDecryptionAESNI::SetKey (const AESKey& key)
+{
+    ExpandKey (key); // expand encryption key first
+    // then  invert it using aesimc
+    __asm__
+    (
+        CallAESIMC(16)
+        CallAESIMC(32)
+        CallAESIMC(48)
+        CallAESIMC(64)
+        CallAESIMC(80)
+        CallAESIMC(96)
+        CallAESIMC(112)
+        CallAESIMC(128)
+        CallAESIMC(144)
+        CallAESIMC(160)
+        CallAESIMC(176)
+        CallAESIMC(192)
+        CallAESIMC(208)
+        : : [shed]"r"(GetKeySchedule ()) : "%xmm0", "memory"
+    );
+}
+
+#endif      
+
+
+void CBCEncryption::Encrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        "movups (%[iv]), %%xmm1 \n"
+        "1: \n"
+        "movups (%[in]), %%xmm0 \n"
+        "pxor %%xmm1, %%xmm0 \n"
+        EncryptAES256(sched)
+        "movaps %%xmm0, %%xmm1 \n"  
+        "movups %%xmm0, (%[out]) \n"
+        "add $16, %[in] \n"
+        "add $16, %[out] \n"
+        "dec %[num] \n"
+        "jnz 1b \n"     
+        "movups %%xmm1, (%[iv]) \n"
+        : 
+        : [iv]"r"(&m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+        : "%xmm0", "%xmm1", "cc", "memory"
+    ); 
+#else       
+    for (int i = 0; i < numBlocks; i++)
+    {
+        m_LastBlock ^= in[i];
+        m_ECBEncryption.Encrypt (&m_LastBlock, &m_LastBlock);
+        out[i] = m_LastBlock;
+    }
+#endif      
+}
+
+void CBCEncryption::Encrypt (const uint8_t * in, std::size_t len, uint8_t * out)
+{
+    // len/16
+    int numBlocks = len >> 4;
+    if (numBlocks > 0)
+        Encrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out); 
+}
+
+void CBCEncryption::Encrypt (const uint8_t * in, uint8_t * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        "movups (%[iv]), %%xmm1 \n"
+        "movups (%[in]), %%xmm0 \n"
+        "pxor %%xmm1, %%xmm0 \n"
+        EncryptAES256(sched)
+        "movups %%xmm0, (%[out]) \n"
+        "movups %%xmm0, (%[iv]) \n"
+        : 
+        : [iv]"r"(&m_LastBlock), [sched]"r"(m_ECBEncryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out)
+        : "%xmm0", "%xmm1", "memory"
+    );      
+#else
+    Encrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out); 
+#endif
+}
+
+void CBCDecryption::Decrypt (int numBlocks, const ChipherBlock * in, ChipherBlock * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        "movups (%[iv]), %%xmm1 \n"
+        "1: \n"
+        "movups (%[in]), %%xmm0 \n"
+        "movaps %%xmm0, %%xmm2 \n"
+        DecryptAES256(sched)
+        "pxor %%xmm1, %%xmm0 \n"
+        "movups %%xmm0, (%[out]) \n"
+        "movaps %%xmm2, %%xmm1 \n"
+        "add $16, %[in] \n"
+        "add $16, %[out] \n"
+        "dec %[num] \n"
+        "jnz 1b \n"     
+        "movups %%xmm1, (%[iv]) \n"
+        : 
+        : [iv]"r"(&m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out), [num]"r"(numBlocks)
+        : "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+    ); 
+#else
+    for (int i = 0; i < numBlocks; i++)
+    {
+        ChipherBlock tmp = in[i];
+        m_ECBDecryption.Decrypt (in + i, out + i);
+        out[i] ^= m_IV;
+        m_IV = tmp;
+    }
+#endif
+}
+
+void CBCDecryption::Decrypt (const uint8_t * in, std::size_t len, uint8_t * out)
+{
+    int numBlocks = len >> 4;
+    if (numBlocks > 0)
+        Decrypt (numBlocks, (const ChipherBlock *)in, (ChipherBlock *)out); 
+}
+
+void CBCDecryption::Decrypt (const uint8_t * in, uint8_t * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        "movups (%[iv]), %%xmm1 \n"
+        "movups (%[in]), %%xmm0 \n"
+        "movups %%xmm0, (%[iv]) \n"
+        DecryptAES256(sched)
+        "pxor %%xmm1, %%xmm0 \n"
+        "movups %%xmm0, (%[out]) \n"    
+        : 
+        : [iv]"r"(&m_IV), [sched]"r"(m_ECBDecryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out)
+        : "%xmm0", "%xmm1", "memory"
+    );
+#else
+    Decrypt (1, (const ChipherBlock *)in, (ChipherBlock *)out); 
+#endif
+}
+
+} // crypto
+} // i2p
+
diff --git a/aes.h b/crypto/aes.h
similarity index 80%
rename from aes.h
rename to crypto/aes.h
index 1751246f..6e763125 100644
--- a/aes.h
+++ b/crypto/aes.h
@@ -181,51 +181,7 @@ namespace crypto
             ECBDecryption m_ECBDecryption;
     };  
 
-    class TunnelEncryption // with double IV encryption
-    {
-        public:
-
-            void SetKeys (const AESKey& layerKey, const AESKey& ivKey)
-            {
-                m_LayerEncryption.SetKey (layerKey);
-                m_IVEncryption.SetKey (ivKey);
-            }   
-
-            void Encrypt (const uint8_t * in, uint8_t * out); // 1024 bytes (16 IV + 1008 data)     
-
-        private:
-
-            ECBEncryption m_IVEncryption;
-#ifdef AESNI
-            ECBEncryption m_LayerEncryption;
-#else
-            CBCEncryption m_LayerEncryption;
-#endif
-    };
-
-    class TunnelDecryption // with double IV encryption
-    {
-        public:
-
-            void SetKeys (const AESKey& layerKey, const AESKey& ivKey)
-            {
-                m_LayerDecryption.SetKey (layerKey);
-                m_IVDecryption.SetKey (ivKey);
-            }           
-
-            void Decrypt (const uint8_t * in, uint8_t * out); // 1024 bytes (16 IV + 1008 data) 
-
-        private:
-
-            ECBDecryption m_IVDecryption;
-#ifdef AESNI
-            ECBDecryption m_LayerDecryption;
-#else
-            CBCDecryption m_LayerDecryption;
-#endif
-    };
 }
 }
 
 #endif
-
diff --git a/hmac.h b/crypto/hmac.h
similarity index 100%
rename from hmac.h
rename to crypto/hmac.h
diff --git a/filelist.mk b/filelist.mk
index 5602970c..e276c1cc 100644
--- a/filelist.mk
+++ b/filelist.mk
@@ -1,28 +1,33 @@
 COMMON_SRC = \
-  CryptoConst.cpp Datagram.cpp Garlic.cpp I2NPProtocol.cpp LeaseSet.cpp \
-  Log.cpp NTCPSession.cpp NetDb.cpp NetDbRequests.cpp Profiling.cpp \
-  Reseed.cpp RouterContext.cpp RouterInfo.cpp Signature.cpp SSU.cpp \
-  SSUSession.cpp SSUData.cpp Streaming.cpp Identity.cpp TransitTunnel.cpp \
-  Transports.cpp Tunnel.cpp TunnelEndpoint.cpp TunnelPool.cpp TunnelGateway.cpp \
-  Destination.cpp UPnP.cpp util.cpp aes.cpp base64.cpp
+  transport/NTCPSession.cpp transport/SSU.cpp transport/SSUSession.cpp \
+  transport/SSUData.cpp transport/Transports.cpp \
+  util/util.cpp util/base64.cpp util/Log.cpp \
+  crypto/CryptoConst.cpp crypto/aes.cpp crypto/Signature.cpp \
+  tunnel/Tunnel.cpp tunnel/TransitTunnel.cpp tunnel/TunnelEndpoint.cpp \
+  tunnel/TunnelEndpoint.cpp tunnel/TunnelPool.cpp tunnel/TunnelGateway.cpp \
+  tunnel/TunnelCrypto.cpp Datagram.cpp Garlic.cpp I2NPProtocol.cpp LeaseSet.cpp \
+  NetDb.cpp NetDbRequests.cpp Profiling.cpp Reseed.cpp \
+  RouterContext.cpp RouterInfo.cpp Streaming.cpp Identity.cpp \
+  Destination.cpp UPnP.cpp
 
 
 ifeq ($(UNAME),Darwin)
 # This is needed on OS X for some reason I don't understand (yet).
 # Else will get linker error about unknown symbols. - torkel
 	COMMON_SRC += \
-	  AddressBook.cpp BOB.cpp ClientContext.cpp Daemon.cpp I2PTunnel.cpp I2PService.cpp SAM.cpp SOCKS.cpp \
-	  UPnP.cpp HTTPServer.cpp HTTPProxy.cpp i2p.cpp DaemonLinux.cpp I2PControl.cpp
+	  AddressBook.cpp BOB.cpp ClientContext.cpp Daemon.cpp I2PTunnel.cpp I2PService.cpp \
+	  SAM.cpp SOCKS.cpp UPnP.cpp HTTPProxy.cpp i2p.cpp DaemonLinux.cpp I2PControl.cpp \
+	  HTTPServer.cpp
 endif
 
 
 # also: Daemon{Linux,Win32}.cpp will be added later
 DAEMON_SRC = $(COMMON_SRC) \
-	AddressBook.cpp BOB.cpp ClientContext.cpp Daemon.cpp I2PTunnel.cpp I2PService.cpp \
-	SAM.cpp SOCKS.cpp HTTPServer.cpp HTTPProxy.cpp I2PControl.cpp i2p.cpp
+  AddressBook.cpp BOB.cpp ClientContext.cpp Daemon.cpp I2PTunnel.cpp I2PService.cpp \
+  SAM.cpp SOCKS.cpp HTTPServer.cpp HTTPProxy.cpp I2PControl.cpp i2p.cpp
 
 LIB_SRC := $(COMMON_SRC) \
   api.cpp
 
 TESTS_SRC := $(COMMON_SRC)  \
-	tests/Utility.cpp tests/Identity.cpp tests/Data.cpp
+  tests/Utility.cpp tests/Identity.cpp tests/Base64.cpp
diff --git a/tests/Data.cpp b/tests/Base64.cpp
similarity index 97%
rename from tests/Data.cpp
rename to tests/Base64.cpp
index 9e14ebfe..290b83bf 100644
--- a/tests/Data.cpp
+++ b/tests/Base64.cpp
@@ -1,11 +1,11 @@
 #define BOOST_TEST_DYN_LINK
 
 #include <boost/test/unit_test.hpp>
-#include "../Identity.h"
+#include "util/base64.h"
 
-BOOST_AUTO_TEST_SUITE(DataTests)
+BOOST_AUTO_TEST_SUITE(Base64and32Tests)
 
-using namespace i2p::data;
+using namespace i2p::util;
 
 BOOST_AUTO_TEST_CASE(Base64EncodeEmpty)
 {
diff --git a/tests/Utility.cpp b/tests/Utility.cpp
index 7fabfce7..dbbe2bb6 100644
--- a/tests/Utility.cpp
+++ b/tests/Utility.cpp
@@ -1,5 +1,5 @@
 #include <boost/test/unit_test.hpp>
-#include "../util.h"
+#include "util/util.h"
 
 BOOST_AUTO_TEST_SUITE(UtilityTests)
 
diff --git a/NTCPSession.cpp b/transport/NTCPSession.cpp
similarity index 99%
rename from NTCPSession.cpp
rename to transport/NTCPSession.cpp
index c3d64221..d323041b 100644
--- a/NTCPSession.cpp
+++ b/transport/NTCPSession.cpp
@@ -1,12 +1,12 @@
 #include <string.h>
 #include <stdlib.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <cryptopp/dh.h>
 #include <cryptopp/adler32.h>
-#include "base64.h"
-#include "Log.h"
-#include "Timestamp.h"
-#include "CryptoConst.h"
+#include "util/base64.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
+#include "crypto/CryptoConst.h"
 #include "I2NPProtocol.h"
 #include "RouterContext.h"
 #include "Transports.h"
diff --git a/NTCPSession.h b/transport/NTCPSession.h
similarity index 99%
rename from NTCPSession.h
rename to transport/NTCPSession.h
index 7b99483e..2dbfd360 100644
--- a/NTCPSession.h
+++ b/transport/NTCPSession.h
@@ -9,7 +9,7 @@
 #include <boost/asio.hpp>
 #include <cryptopp/modes.h>
 #include <cryptopp/aes.h>
-#include "aes.h"
+#include "crypto/aes.h"
 #include "Identity.h"
 #include "RouterInfo.h"
 #include "I2NPProtocol.h"
diff --git a/SSU.cpp b/transport/SSU.cpp
similarity index 99%
rename from SSU.cpp
rename to transport/SSU.cpp
index f294db17..9c1337ec 100644
--- a/SSU.cpp
+++ b/transport/SSU.cpp
@@ -1,7 +1,7 @@
 #include <string.h>
 #include <boost/bind.hpp>
-#include "Log.h"
-#include "Timestamp.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "RouterContext.h"
 #include "NetDb.h"
 #include "SSU.h"
diff --git a/SSU.h b/transport/SSU.h
similarity index 98%
rename from SSU.h
rename to transport/SSU.h
index 54d9326a..ec0706c2 100644
--- a/SSU.h
+++ b/transport/SSU.h
@@ -9,8 +9,8 @@
 #include <thread>
 #include <mutex>
 #include <boost/asio.hpp>
-#include "aes.h"
-#include "I2PEndian.h"
+#include "crypto/aes.h"
+#include "util/I2PEndian.h"
 #include "Identity.h"
 #include "RouterInfo.h"
 #include "I2NPProtocol.h"
diff --git a/SSUData.cpp b/transport/SSUData.cpp
similarity index 99%
rename from SSUData.cpp
rename to transport/SSUData.cpp
index 02473db4..a1d49ba9 100644
--- a/SSUData.cpp
+++ b/transport/SSUData.cpp
@@ -1,7 +1,7 @@
 #include <stdlib.h>
 #include <boost/bind.hpp>
-#include "Log.h"
-#include "Timestamp.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "NetDb.h"
 #include "SSU.h"
 #include "SSUData.h"
diff --git a/SSUData.h b/transport/SSUData.h
similarity index 100%
rename from SSUData.h
rename to transport/SSUData.h
diff --git a/SSUSession.cpp b/transport/SSUSession.cpp
similarity index 99%
rename from SSUSession.cpp
rename to transport/SSUSession.cpp
index 8f2c2d66..f76592e7 100644
--- a/SSUSession.cpp
+++ b/transport/SSUSession.cpp
@@ -1,9 +1,9 @@
 #include <boost/bind.hpp>
 #include <cryptopp/dh.h>
 #include <cryptopp/sha.h>
-#include "CryptoConst.h"
-#include "Log.h"
-#include "Timestamp.h"
+#include "crypto/CryptoConst.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "RouterContext.h"
 #include "Transports.h"
 #include "SSU.h"
diff --git a/SSUSession.h b/transport/SSUSession.h
similarity index 99%
rename from SSUSession.h
rename to transport/SSUSession.h
index 427b81c8..f7194358 100644
--- a/SSUSession.h
+++ b/transport/SSUSession.h
@@ -4,8 +4,8 @@
 #include <inttypes.h>
 #include <set>
 #include <memory>
-#include "aes.h"
-#include "hmac.h"
+#include "crypto/aes.h"
+#include "crypto/hmac.h"
 #include "I2NPProtocol.h"
 #include "TransportSession.h"
 #include "SSUData.h"
diff --git a/TransportSession.h b/transport/TransportSession.h
similarity index 100%
rename from TransportSession.h
rename to transport/TransportSession.h
diff --git a/Transports.cpp b/transport/Transports.cpp
similarity index 99%
rename from Transports.cpp
rename to transport/Transports.cpp
index 52856c5f..45e2346c 100644
--- a/Transports.cpp
+++ b/transport/Transports.cpp
@@ -1,6 +1,6 @@
 #include <cryptopp/dh.h>
-#include "Log.h"
-#include "CryptoConst.h"
+#include "util/Log.h"
+#include "crypto/CryptoConst.h"
 #include "RouterContext.h"
 #include "I2NPProtocol.h"
 #include "NetDb.h"
diff --git a/Transports.h b/transport/Transports.h
similarity index 100%
rename from Transports.h
rename to transport/Transports.h
diff --git a/TransitTunnel.cpp b/tunnel/TransitTunnel.cpp
similarity index 97%
rename from TransitTunnel.cpp
rename to tunnel/TransitTunnel.cpp
index e042ee8a..79d19564 100644
--- a/TransitTunnel.cpp
+++ b/tunnel/TransitTunnel.cpp
@@ -1,10 +1,10 @@
 #include <string.h>
-#include "I2PEndian.h"
-#include "Log.h"
+#include "util/I2PEndian.h"
+#include "util/Log.h"
 #include "RouterContext.h"
 #include "I2NPProtocol.h"
 #include "Tunnel.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "TransitTunnel.h"
 
 namespace i2p
diff --git a/TransitTunnel.h b/tunnel/TransitTunnel.h
similarity index 99%
rename from TransitTunnel.h
rename to tunnel/TransitTunnel.h
index fea6d4eb..e9458481 100644
--- a/TransitTunnel.h
+++ b/tunnel/TransitTunnel.h
@@ -5,7 +5,7 @@
 #include <vector>
 #include <mutex>
 #include <memory>
-#include "aes.h"
+#include "TunnelCrypto.h"
 #include "I2NPProtocol.h"
 #include "TunnelEndpoint.h"
 #include "TunnelGateway.h"
diff --git a/Tunnel.cpp b/tunnel/Tunnel.cpp
similarity index 99%
rename from Tunnel.cpp
rename to tunnel/Tunnel.cpp
index 9e85b698..a209d3b8 100644
--- a/Tunnel.cpp
+++ b/tunnel/Tunnel.cpp
@@ -1,14 +1,14 @@
 #include <string.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <thread>
 #include <algorithm>
 #include <vector> 
 #include <cryptopp/sha.h>
 #include "RouterContext.h"
-#include "Log.h"
-#include "Timestamp.h"
+#include "util/Log.h"
+#include "util/Timestamp.h"
 #include "I2NPProtocol.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "NetDb.h"
 #include "Tunnel.h"
 
diff --git a/Tunnel.h b/tunnel/Tunnel.h
similarity index 99%
rename from Tunnel.h
rename to tunnel/Tunnel.h
index cc029b76..f724a023 100644
--- a/Tunnel.h
+++ b/tunnel/Tunnel.h
@@ -9,7 +9,7 @@
 #include <thread>
 #include <mutex>
 #include <memory>
-#include "Queue.h"
+#include "util/Queue.h"
 #include "TunnelConfig.h"
 #include "TunnelPool.h"
 #include "TransitTunnel.h"
diff --git a/TunnelBase.h b/tunnel/TunnelBase.h
similarity index 98%
rename from TunnelBase.h
rename to tunnel/TunnelBase.h
index c7d6b536..ea57ea0a 100644
--- a/TunnelBase.h
+++ b/tunnel/TunnelBase.h
@@ -3,7 +3,7 @@
 
 #include <inttypes.h>
 #include <memory>
-#include "Timestamp.h"
+#include "util/Timestamp.h"
 #include "I2NPProtocol.h"
 #include "Identity.h"
 
diff --git a/TunnelConfig.h b/tunnel/TunnelConfig.h
similarity index 99%
rename from TunnelConfig.h
rename to tunnel/TunnelConfig.h
index d3ab5ed2..632d1a17 100644
--- a/TunnelConfig.h
+++ b/tunnel/TunnelConfig.h
@@ -5,10 +5,10 @@
 #include <sstream>
 #include <vector>
 #include <memory>
-#include "aes.h"
+#include "TunnelCrypto.h"
 #include "RouterInfo.h"
 #include "RouterContext.h"
-#include "Timestamp.h"
+#include "util/Timestamp.h"
 
 namespace i2p
 {
diff --git a/tunnel/TunnelCrypto.cpp b/tunnel/TunnelCrypto.cpp
new file mode 100644
index 00000000..50241a19
--- /dev/null
+++ b/tunnel/TunnelCrypto.cpp
@@ -0,0 +1,88 @@
+#include "TunnelCrypto.h"
+#include "TunnelBase.h"
+#include "AESNIMacros.h" 
+
+namespace i2p {
+namespace crypto {
+
+void TunnelEncryption::SetKeys (const AESKey& layerKey, const AESKey& ivKey)
+{
+    m_LayerEncryption.SetKey (layerKey);
+    m_IVEncryption.SetKey (ivKey);
+}
+
+void TunnelEncryption::Encrypt (const uint8_t * in, uint8_t * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        // encrypt IV 
+        "movups (%[in]), %%xmm0 \n"
+        EncryptAES256(sched_iv)
+        "movaps %%xmm0, %%xmm1 \n"
+        // double IV encryption
+        EncryptAES256(sched_iv)
+        "movups %%xmm0, (%[out]) \n"
+        // encrypt data, IV is xmm1
+        "1: \n"
+        "add $16, %[in] \n"
+        "add $16, %[out] \n"
+        "movups (%[in]), %%xmm0 \n"
+        "pxor %%xmm1, %%xmm0 \n"
+        EncryptAES256(sched_l)
+        "movaps %%xmm0, %%xmm1 \n"  
+        "movups %%xmm0, (%[out]) \n"
+        "dec %[num] \n"
+        "jnz 1b \n"     
+        : 
+        : [sched_iv]"r"(m_IVEncryption.GetKeySchedule ()), [sched_l]"r"(m_LayerEncryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+        : "%xmm0", "%xmm1", "cc", "memory"
+    );
+#else
+    m_IVEncryption.Encrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+    m_LayerEncryption.SetIV (out);
+    m_LayerEncryption.Encrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+    m_IVEncryption.Encrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+#endif
+    }
+
+void TunnelDecryption::Decrypt (const uint8_t * in, uint8_t * out)
+{
+#ifdef AESNI
+    __asm__
+    (
+        // decrypt IV 
+        "movups (%[in]), %%xmm0 \n"
+        DecryptAES256(sched_iv)
+        "movaps %%xmm0, %%xmm1 \n"
+        // double IV encryption
+        DecryptAES256(sched_iv)
+        "movups %%xmm0, (%[out]) \n"
+        // decrypt data, IV is xmm1
+        "1: \n"
+        "add $16, %[in] \n"
+        "add $16, %[out] \n"
+        "movups (%[in]), %%xmm0 \n"
+        "movaps %%xmm0, %%xmm2 \n"
+        DecryptAES256(sched_l)
+        "pxor %%xmm1, %%xmm0 \n"
+        "movups %%xmm0, (%[out]) \n"
+        "movaps %%xmm2, %%xmm1 \n"
+        "dec %[num] \n"
+        "jnz 1b \n"     
+        : 
+        : [sched_iv]"r"(m_IVDecryption.GetKeySchedule ()), [sched_l]"r"(m_LayerDecryption.GetKeySchedule ()), 
+          [in]"r"(in), [out]"r"(out), [num]"r"(63) // 63 blocks = 1008 bytes
+        : "%xmm0", "%xmm1", "%xmm2", "cc", "memory"
+    );
+#else
+    m_IVDecryption.Decrypt ((const ChipherBlock *)in, (ChipherBlock *)out); // iv
+    m_LayerDecryption.SetIV (out);  
+    m_LayerDecryption.Decrypt (in + 16, i2p::tunnel::TUNNEL_DATA_ENCRYPTED_SIZE, out + 16); // data
+    m_IVDecryption.Decrypt ((ChipherBlock *)out, (ChipherBlock *)out); // double iv
+#endif
+}
+
+} // crypto
+} // i2p
diff --git a/tunnel/TunnelCrypto.h b/tunnel/TunnelCrypto.h
new file mode 100644
index 00000000..ec01acfb
--- /dev/null
+++ b/tunnel/TunnelCrypto.h
@@ -0,0 +1,49 @@
+#ifndef TUNNEL_CRYPTO_H__
+#define TUNNEL_CRYPTO_H__
+
+#include "crypto/aes.h"
+
+namespace i2p {
+namespace crypto {
+
+class TunnelEncryption { // with double IV encryption
+public:
+    void SetKeys (const AESKey& layerKey, const AESKey& ivKey);
+
+    void Encrypt (const uint8_t * in, uint8_t * out); // 1024 bytes (16 IV + 1008 data)     
+
+private:
+
+    ECBEncryption m_IVEncryption;
+#ifdef AESNI
+    ECBEncryption m_LayerEncryption;
+#else
+    CBCEncryption m_LayerEncryption;
+#endif
+};
+
+class TunnelDecryption { // with double IV encryption
+public:
+
+    void SetKeys (const AESKey& layerKey, const AESKey& ivKey)
+    {
+        m_LayerDecryption.SetKey (layerKey);
+        m_IVDecryption.SetKey (ivKey);
+    }           
+
+    void Decrypt (const uint8_t * in, uint8_t * out); // 1024 bytes (16 IV + 1008 data) 
+
+private:
+
+    ECBDecryption m_IVDecryption;
+#ifdef AESNI
+    ECBDecryption m_LayerDecryption;
+#else
+    CBCDecryption m_LayerDecryption;
+#endif
+};
+
+} // crypto
+} // i2p
+
+#endif
diff --git a/TunnelEndpoint.cpp b/tunnel/TunnelEndpoint.cpp
similarity index 99%
rename from TunnelEndpoint.cpp
rename to tunnel/TunnelEndpoint.cpp
index 24dd0bb1..bd982358 100644
--- a/TunnelEndpoint.cpp
+++ b/tunnel/TunnelEndpoint.cpp
@@ -1,9 +1,9 @@
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <string.h>
-#include "Log.h"
+#include "util/Log.h"
 #include "NetDb.h"
 #include "I2NPProtocol.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "RouterContext.h"
 #include "TunnelEndpoint.h"
 
diff --git a/TunnelEndpoint.h b/tunnel/TunnelEndpoint.h
similarity index 100%
rename from TunnelEndpoint.h
rename to tunnel/TunnelEndpoint.h
diff --git a/TunnelGateway.cpp b/tunnel/TunnelGateway.cpp
similarity index 99%
rename from TunnelGateway.cpp
rename to tunnel/TunnelGateway.cpp
index 89f69da1..6b55f543 100644
--- a/TunnelGateway.cpp
+++ b/tunnel/TunnelGateway.cpp
@@ -1,9 +1,9 @@
 #include <string.h>
-#include "I2PEndian.h"
+#include "util/I2PEndian.h"
 #include <cryptopp/sha.h>
-#include "Log.h"
+#include "util/Log.h"
 #include "RouterContext.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "TunnelGateway.h"
 
 namespace i2p
diff --git a/TunnelGateway.h b/tunnel/TunnelGateway.h
similarity index 100%
rename from TunnelGateway.h
rename to tunnel/TunnelGateway.h
diff --git a/TunnelPool.cpp b/tunnel/TunnelPool.cpp
similarity index 99%
rename from TunnelPool.cpp
rename to tunnel/TunnelPool.cpp
index 62d52075..a790ca66 100644
--- a/TunnelPool.cpp
+++ b/tunnel/TunnelPool.cpp
@@ -1,11 +1,11 @@
 #include <algorithm>
-#include "I2PEndian.h"
-#include "CryptoConst.h"
+#include "util/I2PEndian.h"
+#include "crypto/CryptoConst.h"
 #include "Tunnel.h"
 #include "NetDb.h"
-#include "Timestamp.h"
+#include "util/Timestamp.h"
 #include "Garlic.h"
-#include "Transports.h"
+#include "transport/Transports.h"
 #include "TunnelPool.h"
 
 namespace i2p
diff --git a/TunnelPool.h b/tunnel/TunnelPool.h
similarity index 100%
rename from TunnelPool.h
rename to tunnel/TunnelPool.h
diff --git a/I2PEndian.cpp b/util/I2PEndian.cpp
similarity index 100%
rename from I2PEndian.cpp
rename to util/I2PEndian.cpp
diff --git a/I2PEndian.h b/util/I2PEndian.h
similarity index 100%
rename from I2PEndian.h
rename to util/I2PEndian.h
diff --git a/LittleBigEndian.h b/util/LittleBigEndian.h
similarity index 100%
rename from LittleBigEndian.h
rename to util/LittleBigEndian.h
diff --git a/Log.cpp b/util/Log.cpp
similarity index 100%
rename from Log.cpp
rename to util/Log.cpp
diff --git a/Log.h b/util/Log.h
similarity index 100%
rename from Log.h
rename to util/Log.h
diff --git a/Queue.h b/util/Queue.h
similarity index 100%
rename from Queue.h
rename to util/Queue.h
diff --git a/Timestamp.h b/util/Timestamp.h
similarity index 100%
rename from Timestamp.h
rename to util/Timestamp.h
diff --git a/base64.cpp b/util/base64.cpp
similarity index 99%
rename from base64.cpp
rename to util/base64.cpp
index cc0c7c21..8ccae845 100644
--- a/base64.cpp
+++ b/util/base64.cpp
@@ -3,7 +3,7 @@
 
 namespace i2p
 {
-namespace data
+namespace util
 {
 
     static void iT64Build(void);
diff --git a/base64.h b/util/base64.h
similarity index 99%
rename from base64.h
rename to util/base64.h
index 3c1ecb76..689c35ab 100644
--- a/base64.h
+++ b/util/base64.h
@@ -6,7 +6,7 @@
 
 namespace i2p
 {
-namespace data
+namespace util
 {
 
     
diff --git a/util.cpp b/util/util.cpp
similarity index 100%
rename from util.cpp
rename to util/util.cpp
diff --git a/util.h b/util/util.h
similarity index 100%
rename from util.h
rename to util/util.h