diff --git a/pclsync/pcrypto.c b/pclsync/pcrypto.c
index ace18f7..ac6448c 100644
--- a/pclsync/pcrypto.c
+++ b/pclsync/pcrypto.c
@@ -68,7 +68,7 @@ static void psync_hmac_sha512_init(psync_hmac_sha512_ctx *ctx,
   }
   psync_sha512_init(&ctx->sha1ctx);
   psync_sha512_update(&ctx->sha1ctx, keyxor, PSYNC_SHA512_BLOCK_LEN);
-  pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
+  pssl_cleanup(keyxor, PSYNC_SHA512_BLOCK_LEN);
 }
 
 static void psync_hmac_sha512_update(psync_hmac_sha512_ctx *ctx,
@@ -81,7 +81,7 @@ static void psync_hmac_sha512_final(unsigned char *result,
   psync_sha512_final(ctx->final + PSYNC_SHA512_BLOCK_LEN, &ctx->sha1ctx);
   psync_sha512(ctx->final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN,
                result);
-  pssl_memclean(ctx->final,
+  pssl_cleanup(ctx->final,
                      PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
 }
 
@@ -107,8 +107,8 @@ static void psync_hmac_sha512(const unsigned char *msg, size_t msglen,
   psync_sha512_update(&sha1ctx, msg, msglen);
   psync_sha512_final(final + PSYNC_SHA512_BLOCK_LEN, &sha1ctx);
   psync_sha512(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN, result);
-  pssl_memclean(keyxor, PSYNC_SHA512_BLOCK_LEN);
-  pssl_memclean(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
+  pssl_cleanup(keyxor, PSYNC_SHA512_BLOCK_LEN);
+  pssl_cleanup(final, PSYNC_SHA512_BLOCK_LEN + PSYNC_SHA512_DIGEST_LEN);
 }
 
 #define ALIGN_A256_BS(n)                                                       \
@@ -165,7 +165,7 @@ psync_symmetric_key_t pcrypto_key_len(size_t len) {
   key = (psync_symmetric_key_t)pmemlock_malloc(
       offsetof(psync_symmetric_key_struct_t, key) + len);
   key->keylen = len;
-  pssl_rand_strong(key->key, len);
+  pssl_random(key->key, len);
   return key;
 }
 
@@ -181,7 +181,7 @@ pcrypto_ctr_encdec_create(psync_symmetric_key_t key) {
   if (unlikely_log(key->keylen <
                    PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE))
     return PSYNC_CRYPTO_INVALID_ENCODER;
-  enc = pssl_enc_create(key);
+  enc = paes_encoder_create(key);
   if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
     return PSYNC_CRYPTO_INVALID_ENCODER;
   ret = psync_new(pcrypto_key_t);
@@ -192,8 +192,8 @@ pcrypto_ctr_encdec_create(psync_symmetric_key_t key) {
 
 void pcrypto_ctr_encdec_free(
     pcrypto_ctr_encdec_t enc) {
-  pssl_enc_free(enc->encoder);
-  pssl_memclean(enc->iv, PSYNC_AES256_BLOCK_SIZE);
+  paes_encoder_free(enc->encoder);
+  pssl_cleanup(enc->iv, PSYNC_AES256_BLOCK_SIZE);
   psync_free(enc);
 }
 
@@ -211,7 +211,7 @@ void pcrypto_ctr_encdec_encode(
   dataoffset %= PSYNC_AES256_BLOCK_SIZE;
   if (dataoffset) {
     copy_iv_and_xor_with_counter(aessrc, enc->iv, counter);
-    pssl_enc_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_encode(enc->encoder, aessrc, aesdst);
     blocksrem = PSYNC_AES256_BLOCK_SIZE - dataoffset;
     xor_cnt_inplace(data, aesdst + dataoffset, blocksrem);
     datalen -= blocksrem;
@@ -223,7 +223,7 @@ void pcrypto_ctr_encdec_encode(
   if (IS_WORD_ALIGNED(data)) {
     while (blocksrem) {
       copy_iv_and_xor_with_counter(aessrc, enc->iv, counter);
-      pssl_enc_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_encode(enc->encoder, aessrc, aesdst);
       xor16_aligned_inplace(data, aesdst);
       blocksrem--;
       counter++;
@@ -232,7 +232,7 @@ void pcrypto_ctr_encdec_encode(
   } else {
     while (blocksrem) {
       copy_iv_and_xor_with_counter(aessrc, enc->iv, counter);
-      pssl_enc_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_encode(enc->encoder, aessrc, aesdst);
       xor16_unaligned_inplace(data, aesdst);
       blocksrem--;
       counter++;
@@ -241,7 +241,7 @@ void pcrypto_ctr_encdec_encode(
   }
   if (datalen) {
     copy_iv_and_xor_with_counter(aessrc, enc->iv, counter);
-    pssl_enc_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_encode(enc->encoder, aessrc, aesdst);
     xor_cnt_inplace(data, aesdst, datalen);
   }
 }
@@ -295,7 +295,7 @@ void pcrypto_encode_text(pcrypto_textenc_t enc,
     copy_pad(aessrc, PSYNC_AES256_BLOCK_SIZE, &txt, &txtlen);
     assert(enc->ivlen >= PSYNC_AES256_BLOCK_SIZE);
     xor16_aligned_inplace(aessrc, enc->iv);
-    pssl_enc_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_encode(enc->encoder, aessrc, aesdst);
     copy_aligned(outptr, aesdst);
     return;
   }
@@ -306,13 +306,13 @@ void pcrypto_encode_text(pcrypto_textenc_t enc,
   txt += PSYNC_AES256_BLOCK_SIZE;
   txtlen -= PSYNC_AES256_BLOCK_SIZE;
   xor16_aligned_inplace(aessrc, hmac);
-  pssl_enc_blk(enc->encoder, aessrc, aesdst);
+  paes_blk_encode(enc->encoder, aessrc, aesdst);
   copy_aligned(outptr, aesdst);
   outptr += PSYNC_AES256_BLOCK_SIZE;
   do {
     copy_pad(aessrc, PSYNC_AES256_BLOCK_SIZE, &txt, &txtlen);
     xor16_aligned_inplace(aessrc, aesdst);
-    pssl_enc_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_encode(enc->encoder, aessrc, aesdst);
     copy_aligned(outptr, aesdst);
     outptr += PSYNC_AES256_BLOCK_SIZE;
   } while (txtlen);
@@ -334,7 +334,7 @@ pcrypto_decode_text(pcrypto_textdec_t enc,
   datalen /= PSYNC_AES256_BLOCK_SIZE;
   if (datalen == 1) {
     copy_unaligned(aessrc, data);
-    pssl_dec_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_decode(enc->encoder, aessrc, aesdst);
     assert(enc->ivlen >= PSYNC_AES256_BLOCK_SIZE);
     xor16_aligned_inplace(aesdst, enc->iv);
     copy_aligned(outptr, aesdst);
@@ -353,28 +353,28 @@ pcrypto_decode_text(pcrypto_textdec_t enc,
   }
   if (IS_WORD_ALIGNED(data)) {
     copy_aligned(aessrc, data);
-    pssl_dec_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_decode(enc->encoder, aessrc, aesdst);
     copy_aligned(outptr, aesdst);
     outptr += PSYNC_AES256_BLOCK_SIZE;
     while (--datalen) {
       xorptr = data;
       data += PSYNC_AES256_BLOCK_SIZE;
       copy_aligned(aessrc, data);
-      pssl_dec_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_decode(enc->encoder, aessrc, aesdst);
       xor16_aligned_inplace(aesdst, xorptr);
       copy_aligned(outptr, aesdst);
       outptr += PSYNC_AES256_BLOCK_SIZE;
     }
   } else {
     copy_unaligned(aessrc, data);
-    pssl_dec_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_decode(enc->encoder, aessrc, aesdst);
     copy_aligned(outptr, aesdst);
     outptr += PSYNC_AES256_BLOCK_SIZE;
     while (--datalen) {
       xorptr = data;
       data += PSYNC_AES256_BLOCK_SIZE;
       copy_unaligned(aessrc, data);
-      pssl_dec_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_decode(enc->encoder, aessrc, aesdst);
       xor16_unaligned_inplace(aesdst, xorptr);
       copy_aligned(outptr, aesdst);
       outptr += PSYNC_AES256_BLOCK_SIZE;
@@ -404,7 +404,7 @@ pcrypto_textenc_create(psync_symmetric_key_t key) {
   if (unlikely_log(key->keylen <
                    PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE))
     return PSYNC_CRYPTO_INVALID_ENCODER;
-  enc = pssl_enc_create(key);
+  enc = paes_encoder_create(key);
   if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
     return PSYNC_CRYPTO_INVALID_ENCODER;
   ret = (pcrypto_textenc_t)pmemlock_malloc(
@@ -418,8 +418,8 @@ pcrypto_textenc_create(psync_symmetric_key_t key) {
 
 void pcrypto_textenc_free(
     pcrypto_textenc_t enc) {
-  pssl_enc_free(enc->encoder);
-  pssl_memclean(enc->iv, enc->ivlen);
+  paes_encoder_free(enc->encoder);
+  pssl_cleanup(enc->iv, enc->ivlen);
   pmemlock_free(enc);
 }
 
@@ -430,7 +430,7 @@ pcrypto_textdec_create(psync_symmetric_key_t key) {
   if (unlikely_log(key->keylen <
                    PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE))
     return PSYNC_CRYPTO_INVALID_ENCODER;
-  enc = pssl_dec_create(key);
+  enc = paes_decoder_create(key);
   if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
     return PSYNC_CRYPTO_INVALID_ENCODER;
   ret = (pcrypto_textenc_t)pmemlock_malloc(
@@ -444,8 +444,8 @@ pcrypto_textdec_create(psync_symmetric_key_t key) {
 
 void pcrypto_textdec_free(
     pcrypto_textdec_t enc) {
-  pssl_enc_free(enc->encoder);
-  pssl_memclean(enc->iv, enc->ivlen);
+  paes_encoder_free(enc->encoder);
+  pssl_cleanup(enc->iv, enc->ivlen);
   pmemlock_free(enc);
 }
 
@@ -456,12 +456,12 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) {
   pcrypto_sector_encdec_t ret;
   if (unlikely_log(key->keylen < PSYNC_AES256_KEY_SIZE))
     return PSYNC_CRYPTO_INVALID_ENCODER;
-  enc = pssl_enc_create(key);
+  enc = paes_encoder_create(key);
   if (unlikely_log(enc == PSYNC_INVALID_ENCODER))
     return PSYNC_CRYPTO_INVALID_ENCODER;
-  dec = pssl_dec_create(key);
+  dec = paes_decoder_create(key);
   if (unlikely_log(enc == PSYNC_INVALID_ENCODER)) {
-    pssl_enc_free(enc);
+    paes_encoder_free(enc);
     return PSYNC_CRYPTO_INVALID_ENCODER;
   }
   ret = (pcrypto_sector_encdec_t)pmemlock_malloc(
@@ -476,9 +476,9 @@ pcrypto_sec_encdec_create(psync_symmetric_key_t key) {
 
 void pcrypto_sec_encdec_free(
     pcrypto_sector_encdec_t enc) {
-  pssl_enc_free(enc->encoder);
-  pssl_dec_free(enc->decoder);
-  pssl_memclean(enc->iv, enc->ivlen);
+  paes_encoder_free(enc->encoder);
+  paes_decoder_free(enc->decoder);
+  pssl_cleanup(enc->iv, enc->ivlen);
   pmemlock_free(enc);
 }
 
@@ -504,7 +504,7 @@ void pcrypto_encode_sec(
   aessrc = ALIGN_PTR_A256_BS(buff);
   aesdst = aessrc + PSYNC_AES256_BLOCK_SIZE;
   assert(PSYNC_CRYPTO_AUTH_SIZE == 2 * PSYNC_AES256_BLOCK_SIZE);
-  pssl_rand_weak(rnd, PSYNC_AES256_BLOCK_SIZE);
+  pssl_random(rnd, PSYNC_AES256_BLOCK_SIZE);
   psync_hmac_sha512_init(&ctx, enc->iv, enc->ivlen);
   psync_hmac_sha512_update(&ctx, data, datalen);
   psync_hmac_sha512_update(&ctx, &sectorid, sizeof(sectorid));
@@ -515,7 +515,7 @@ void pcrypto_encode_sec(
     xor_cnt_inplace(aessrc, data, datalen);
     memcpy(out, rnd, datalen);
     memcpy(aesdst, hmacsha1bin, PSYNC_AES256_BLOCK_SIZE);
-    pssl_enc_2blk(enc->encoder, aessrc, aessrc);
+    paes_2blk_encode(enc->encoder, aessrc, aessrc);
     memcpy(authout, aessrc, PSYNC_AES256_BLOCK_SIZE * 2);
     return;
   }
@@ -529,13 +529,13 @@ void pcrypto_encode_sec(
          PSYNC_AES256_BLOCK_SIZE);
   memcpy(aessrc + PSYNC_AES256_BLOCK_SIZE + PSYNC_AES256_BLOCK_SIZE / 2,
          rnd + PSYNC_AES256_BLOCK_SIZE / 2, PSYNC_AES256_BLOCK_SIZE / 2);
-  pssl_enc_2blk(enc->encoder, aessrc, aessrc);
+  paes_2blk_encode(enc->encoder, aessrc, aessrc);
   memcpy(authout, aessrc, PSYNC_AES256_BLOCK_SIZE * 2);
   memcpy(aessrc, hmacsha1bin, PSYNC_AES256_BLOCK_SIZE);
   if (IS_WORD_ALIGNED(data) && IS_WORD_ALIGNED(out))
     while (datalen) {
       xor16_aligned_inplace(aessrc, data);
-      pssl_enc_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_encode(enc->encoder, aessrc, aesdst);
       copy_aligned(out, aesdst);
       datalen -= PSYNC_AES256_BLOCK_SIZE;
       data += PSYNC_AES256_BLOCK_SIZE;
@@ -547,7 +547,7 @@ void pcrypto_encode_sec(
   else
     while (datalen) {
       xor16_unaligned_inplace(aessrc, data);
-      pssl_enc_blk(enc->encoder, aessrc, aesdst);
+      paes_blk_encode(enc->encoder, aessrc, aesdst);
       copy_unaligned(out, aesdst);
       datalen -= PSYNC_AES256_BLOCK_SIZE;
       data += PSYNC_AES256_BLOCK_SIZE;
@@ -559,10 +559,10 @@ void pcrypto_encode_sec(
   if (unlikely(needsteal)) {
     xor16_unaligned_inplace(aessrc, data);
     data += PSYNC_AES256_BLOCK_SIZE;
-    pssl_enc_blk(enc->encoder, aessrc, aesdst);
+    paes_blk_encode(enc->encoder, aessrc, aesdst);
     memcpy(out + PSYNC_AES256_BLOCK_SIZE, aesdst, needsteal);
     xor_cnt_inplace(aesdst, data, needsteal);
-    pssl_enc_blk(enc->encoder, aesdst, aessrc);
+    paes_blk_encode(enc->encoder, aesdst, aessrc);
     copy_unaligned(out, aessrc);
   }
 }
@@ -582,7 +582,7 @@ int pcrypto_decode_sec(
   aesxor = aessrc + PSYNC_AES256_BLOCK_SIZE * 8;
   hmac = aessrc + PSYNC_AES256_BLOCK_SIZE * 12;
   memcpy(aessrc, auth, PSYNC_AES256_BLOCK_SIZE * 2);
-  pssl_dec_2blk(enc->decoder, aessrc, hmac);
+  paes_2blk_decode(enc->decoder, aessrc, hmac);
   oout = out;
   odatalen = datalen;
   if (unlikely(datalen < PSYNC_AES256_BLOCK_SIZE)) {
@@ -605,7 +605,7 @@ int pcrypto_decode_sec(
       memcpy(aessrc, data, PSYNC_AES256_BLOCK_SIZE * 4);
       memcpy(aesxor + PSYNC_AES256_BLOCK_SIZE, aessrc,
              PSYNC_AES256_BLOCK_SIZE * 3);
-      pssl_dec_4blk_xor(enc->decoder, aessrc, aesdst,
+      paes_4blk_xor_decode(enc->decoder, aessrc, aesdst,
                                              aesxor);
       memcpy(out, aesdst, PSYNC_AES256_BLOCK_SIZE * 4);
       memcpy(aesxor, aessrc + PSYNC_AES256_BLOCK_SIZE * 3,
@@ -616,7 +616,7 @@ int pcrypto_decode_sec(
     }
     while (datalen) {
       copy_unaligned(aessrc, data);
-      pssl_dec_blk(enc->decoder, aessrc, aesdst);
+      paes_blk_decode(enc->decoder, aessrc, aesdst);
       xor16_aligned_inplace(aesdst, aesxor);
       copy_unaligned(out, aesdst);
       data += PSYNC_AES256_BLOCK_SIZE;
@@ -628,14 +628,14 @@ int pcrypto_decode_sec(
     }
     if (unlikely(needsteal)) {
       copy_unaligned(aessrc, data);
-      pssl_dec_blk(enc->decoder, aessrc, aesdst);
+      paes_blk_decode(enc->decoder, aessrc, aesdst);
       xor_cnt_inplace(aesdst, data + PSYNC_AES256_BLOCK_SIZE, needsteal);
       // can be done with less memcpy's, but this version supports inline
       // decoding (e.g. data==out)
       memcpy(aessrc, data + PSYNC_AES256_BLOCK_SIZE, needsteal);
       memcpy(out + PSYNC_AES256_BLOCK_SIZE, aesdst, needsteal);
       memcpy(aesdst, aessrc, needsteal);
-      pssl_dec_blk(enc->decoder, aesdst, aessrc);
+      paes_blk_decode(enc->decoder, aesdst, aessrc);
       xor16_aligned_inplace(aessrc, aesxor);
       copy_unaligned(out, aessrc);
     }
@@ -657,6 +657,6 @@ void pcrypto_sign_sec(
   aesdst = ALIGN_PTR_A256_BS(buff);
   aessrc = aesdst + PSYNC_AES256_BLOCK_SIZE * 2;
   psync_hmac_sha512(data, datalen, enc->iv, enc->ivlen, aessrc);
-  pssl_enc_2blk(enc->encoder, aessrc, aesdst);
+  paes_2blk_encode(enc->encoder, aessrc, aesdst);
   memcpy(authout, aesdst, PSYNC_AES256_BLOCK_SIZE * 2);
 }
diff --git a/pclsync/pcryptofolder.c b/pclsync/pcryptofolder.c
index 6a8fdf2..773eab8 100644
--- a/pclsync/pcryptofolder.c
+++ b/pclsync/pcryptofolder.c
@@ -379,51 +379,51 @@ int pcryptofolder_setup(const char *password, const char *hint) {
   time_t cryptoexpires;
   int ret;
   debug(D_NOTICE, "generating salt");
-  pssl_rand_strong(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
+  pssl_random(salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
   debug(D_NOTICE, "generating AES key from password and setting up encoder");
-  aeskey = pssl_gen_symkey_pass(
+  aeskey = psymkey_generate_passphrase(
       password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt,
       PSYNC_CRYPTO_PBKDF2_SALT_LEN, PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS);
   enc = pcrypto_ctr_encdec_create(aeskey);
-  pssl_symkey_free(aeskey);
+  psymkey_free(aeskey);
   if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER)) {
     debug(D_WARNING, "psync_crypto_aes256_ctr_encoder_decoder_create failed");
     return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
   }
   debug(D_NOTICE, "generating %d bit RSA key", (int)PSYNC_CRYPTO_RSA_SIZE);
-  rsa = pssl_rsa_gen(PSYNC_CRYPTO_RSA_SIZE);
+  rsa = prsa_generate(PSYNC_CRYPTO_RSA_SIZE);
   if (unlikely(rsa == PSYNC_INVALID_RSA)) {
     debug(D_WARNING, "RSA key generation failed");
     pcrypto_ctr_encdec_free(enc);
     return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
   } else
     debug(D_NOTICE, "RSA key generated");
-  rsaprivate = pssl_rsa_get_priv(rsa);
-  rsapublic = pssl_rsa_get_pub(rsa);
-  pssl_rsa_free(rsa);
+  rsaprivate = prsa_get_private(rsa);
+  rsapublic = prsa_get_public(rsa);
+  prsa_free(rsa);
   if (unlikely(rsaprivate == PSYNC_INVALID_RSA ||
                rsapublic == PSYNC_INVALID_RSA)) {
     debug(D_WARNING,
           "psync_ssl_rsa_get_private or psync_ssl_rsa_get_public failed");
     if (rsaprivate != PSYNC_INVALID_RSA)
-      pssl_rsa_free_priv(rsaprivate);
+      prsa_free_private(rsaprivate);
     if (rsapublic != PSYNC_INVALID_RSA)
-      pssl_rsa_free_pub(rsapublic);
+      prsa_free_public(rsapublic);
     pcrypto_ctr_encdec_free(enc);
     return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
   }
-  rsaprivatebin = pssl_rsa_priv_bin(rsaprivate);
-  rsapublicbin = pssl_rsa_bin_pub(rsapublic);
-  pssl_rsa_free_priv(rsaprivate);
-  pssl_rsa_free_pub(rsapublic);
+  rsaprivatebin = prsa_binary_private(rsaprivate);
+  rsapublicbin = prsa_binary_public(rsapublic);
+  prsa_free_private(rsaprivate);
+  prsa_free_public(rsapublic);
   if (unlikely(rsaprivatebin == PSYNC_INVALID_BIN_RSA ||
                rsapublic == PSYNC_INVALID_BIN_RSA)) {
     debug(D_WARNING, "psync_ssl_rsa_private_to_binary or "
                      "psync_ssl_rsa_public_to_binary failed");
     if (rsaprivatebin != PSYNC_INVALID_BIN_RSA)
-      pssl_rsa_bin_free(rsaprivatebin);
+      prsa_binary_free(rsaprivatebin);
     if (rsapublicbin != PSYNC_INVALID_BIN_RSA)
-      pssl_rsa_bin_free(rsapublicbin);
+      prsa_binary_free(rsapublicbin);
     pcrypto_ctr_encdec_free(enc);
     return PSYNC_CRYPTO_SETUP_KEYGEN_FAILED;
   }
@@ -438,8 +438,8 @@ int pcryptofolder_setup(const char *password, const char *hint) {
       privatesha1);
   if (unlikely(ret != PSYNC_CRYPTO_SETUP_SUCCESS)) {
     debug(D_WARNING, "keys upload failed with error %d", ret);
-    pssl_rsa_bin_free(rsaprivatebin);
-    pssl_rsa_bin_free(rsapublicbin);
+    prsa_binary_free(rsaprivatebin);
+    prsa_binary_free(rsapublicbin);
     return ret;
   }
   debug(D_NOTICE, "keys uploaded");
@@ -448,8 +448,8 @@ int pcryptofolder_setup(const char *password, const char *hint) {
       rsapublicbin->datalen, salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN,
       PSYNC_CRYPTO_PASS_TO_KEY_ITERATIONS, cryptoexpires, publicsha1,
       privatesha1, 0);
-  pssl_rsa_bin_free(rsaprivatebin);
-  pssl_rsa_bin_free(rsapublicbin);
+  prsa_binary_free(rsaprivatebin);
+  prsa_binary_free(rsapublicbin);
   return PSYNC_CRYPTO_SETUP_SUCCESS;
 }
 
@@ -502,14 +502,14 @@ static int crypto_keys_match() {
   key = (psync_symmetric_key_t)psync_malloc(
       offsetof(psync_symmetric_key_struct_t, key) + 64);
   key->keylen = 64;
-  pssl_rand_weak(key->key, key->keylen);
-  enckey = pssl_symkey_encrypt(crypto_pubkey, key);
+  pssl_random(key->key, key->keylen);
+  enckey = psymkey_encrypt(crypto_pubkey, key->key, key->keylen);
   if (enckey == PSYNC_INVALID_ENC_SYM_KEY) {
     psync_free(key);
     return 0;
   }
 
-  deckey = pssl_symkey_decrypt_lock(&crypto_privkey, &enckey);
+  deckey = psymkey_decrypt_lock(&crypto_privkey, &enckey);
 
   psync_free(enckey);
   if (deckey == PSYNC_INVALID_SYM_KEY) {
@@ -518,7 +518,7 @@ static int crypto_keys_match() {
   }
   res = key->keylen == deckey->keylen &&
         !memcmp(key->key, deckey->key, key->keylen);
-  pssl_symkey_free(deckey);
+  psymkey_free(deckey);
   psync_free(key);
   if (res)
     debug(D_NOTICE, "encrypt/decrypt operation succeeded");
@@ -605,7 +605,7 @@ retry:
   }
 
   debug(D_NOTICE, "trying to load public key");
-  crypto_pubkey = pssl_rsa_load_pub(rsapub, rsapublen);
+  crypto_pubkey = prsa_load_public(rsapub, rsapublen);
   if (crypto_pubkey == PSYNC_INVALID_RSA) {
     pthread_rwlock_unlock(&crypto_lock);
     debug(D_WARNING, "could not load public key");
@@ -618,11 +618,11 @@ retry:
 
 
   debug(D_NOTICE, "generating symmetric key");
-  aeskey = pssl_gen_symkey_pass(
+  aeskey = psymkey_generate_passphrase(
       password, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE, salt, saltlen,
       iterations);
   enc = pcrypto_ctr_encdec_create(aeskey);
-  pssl_symkey_free(aeskey);
+  psymkey_free(aeskey);
   rsaprivdec = (unsigned char *)pmemlock_malloc(rsaprivlen);
   memcpy(rsaprivdec, rsapriv, rsaprivlen);
   pcrypto_ctr_encdec_encode(enc, rsaprivdec, rsaprivlen, 0);
@@ -631,12 +631,12 @@ retry:
 
 
   debug(D_NOTICE, "trying to load private key");
-  crypto_privkey = pssl_rsa_load_priv(rsaprivdec, rsaprivlen);
-  pssl_memclean(rsaprivdec, rsaprivlen);
+  crypto_privkey = prsa_load_private(rsaprivdec, rsaprivlen);
+  pssl_cleanup(rsaprivdec, rsaprivlen);
   pmemlock_free(rsaprivdec);
   if (crypto_privkey == PSYNC_INVALID_RSA) {
     debug(D_NOTICE, "failed to load private key");
-    pssl_rsa_free_pub(crypto_pubkey);
+    prsa_free_public(crypto_pubkey);
     crypto_pubkey = PSYNC_INVALID_RSA;
     pthread_rwlock_unlock(&crypto_lock);
     psync_free(rsapriv);
@@ -648,9 +648,9 @@ retry:
 
   debug(D_NOTICE, "verify matching public and private key");
   if (!crypto_keys_match()) {
-    pssl_rsa_free_pub(crypto_pubkey);
+    prsa_free_public(crypto_pubkey);
     crypto_pubkey = PSYNC_INVALID_RSA;
-    pssl_rsa_free_priv(crypto_privkey);
+    prsa_free_private(crypto_privkey);
     crypto_privkey = PSYNC_INVALID_RSA;
     pthread_rwlock_unlock(&crypto_lock);
     debug(D_ERROR, "keys don't match");
@@ -696,9 +696,9 @@ int pcryptofolder_lock() {
     return PRINT_RETURN_CONST(PSYNC_CRYPTO_STOP_NOT_STARTED);
   }
   crypto_started_l = 0;
-  pssl_rsa_free_pub(crypto_pubkey);
+  prsa_free_public(crypto_pubkey);
   crypto_pubkey = PSYNC_INVALID_RSA;
-  pssl_rsa_free_priv(crypto_privkey);
+  prsa_free_private(crypto_privkey);
   crypto_privkey = PSYNC_INVALID_RSA;
   pthread_rwlock_unlock(&crypto_lock);
   debug(D_NOTICE, "stopped crypto");
@@ -792,7 +792,7 @@ static void save_folder_key_to_db(psync_folderid_t folderid,
   // will deadlock
   insert_folder_key_task *t;
   t = psync_new(insert_folder_key_task);
-  t->key = pssl_symkey_copy(enckey);
+  t->key = psymkey_copy(enckey);
   t->id = folderid;
   prun_thread1("save folder key to db task", save_folder_key_task, t);
 }
@@ -821,7 +821,7 @@ static void save_file_key_to_db(psync_fileid_t fileid, uint64_t hash,
                                 psync_encrypted_symmetric_key_t enckey) {
   insert_file_key_task *t;
   t = psync_new(insert_file_key_task);
-  t->key = pssl_symkey_copy(enckey);
+  t->key = psymkey_copy(enckey);
   t->id = fileid;
   t->hash = hash;
   prun_thread1("save file key to db task", save_file_key_task, t);
@@ -875,7 +875,7 @@ psync_crypto_download_folder_enc_key(psync_folderid_t folderid) {
   if (!key)
     return (psync_encrypted_symmetric_key_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
-  ret = pssl_alloc_symkey(keylen);
+  ret = psymkey_alloc(keylen);
   memcpy(ret->data, key, keylen);
   psync_free(key);
   save_folder_key_to_db(folderid, ret);
@@ -929,7 +929,7 @@ psync_crypto_download_file_enc_key(psync_fileid_t fileid) {
   if (!key)
     return (psync_encrypted_symmetric_key_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
-  ret = pssl_alloc_symkey(keylen);
+  ret = psymkey_alloc(keylen);
   memcpy(ret->data, key, keylen);
   psync_free(key);
   save_file_key_to_db(fileid, result, ret);
@@ -948,7 +948,7 @@ psync_crypto_get_folder_enc_key(psync_folderid_t folderid) {
   psync_sql_bind_uint(res, 1, folderid);
   if ((row = psync_sql_fetch_row(res))) {
     ckey = psync_get_lstring(row[0], &ckeylen);
-    enckey = pssl_alloc_symkey(ckeylen);
+    enckey = psymkey_alloc(ckeylen);
     memcpy(enckey->data, ckey, ckeylen);
     psync_sql_free_result(res);
     return enckey;
@@ -971,7 +971,7 @@ psync_crypto_get_file_enc_key(psync_fileid_t fileid, uint64_t hash,
   psync_sql_bind_uint(res, 2, hash);
   if ((row = psync_sql_fetch_row(res))) {
     ckey = psync_get_lstring(row[0], &ckeylen);
-    enckey = pssl_alloc_symkey(ckeylen);
+    enckey = psymkey_alloc(ckeylen);
     memcpy(enckey->data, ckey, ckeylen);
     psync_sql_free_result(res);
     return enckey;
@@ -999,7 +999,7 @@ psync_crypto_get_folder_symkey_locked(psync_folderid_t folderid) {
   if (psync_crypto_is_error(enckey))
     return (psync_symmetric_key_t)enckey;
 
-  symkey = pssl_symkey_decrypt_lock(&crypto_privkey, &enckey);
+  symkey = psymkey_decrypt_lock(&crypto_privkey, &enckey);
 
   psync_free(enckey);
   if (symkey == PSYNC_INVALID_SYM_KEY)
@@ -1028,7 +1028,7 @@ psync_crypto_get_file_symkey_locked(psync_fileid_t fileid, uint64_t hash,
           (psync_encrypted_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER)
     return (psync_symmetric_key_t)PSYNC_CRYPTO_UNLOADED_SECTOR_ENCODER;
 
-  symkey = pssl_symkey_decrypt_lock(&crypto_privkey, &enckey);
+  symkey = psymkey_decrypt_lock(&crypto_privkey, &enckey);
 
   psync_free(enckey);
   if (unlikely_log(symkey == PSYNC_INVALID_SYM_KEY))
@@ -1038,7 +1038,7 @@ psync_crypto_get_file_symkey_locked(psync_fileid_t fileid, uint64_t hash,
 }
 
 static void psync_crypto_release_symkey_ptr(void *ptr) {
-  pssl_symkey_free((psync_symmetric_key_t)ptr);
+  psymkey_free((psync_symmetric_key_t)ptr);
 }
 
 static void
@@ -1097,12 +1097,12 @@ psync_crypto_get_folder_encoder_locked(psync_folderid_t folderid) {
     realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
     psync_crypto_release_folder_symkey_locked(folderid, symkey);
     enc = pcrypto_textenc_create(realkey);
-    pssl_symkey_free(realkey);
+    psymkey_free(realkey);
     return enc;
   default:
     debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
   def1:
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     return (pcrypto_textenc_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
   }
@@ -1139,12 +1139,12 @@ psync_crypto_get_folder_decoder_locked(psync_folderid_t folderid) {
     realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
     psync_crypto_release_folder_symkey_locked(folderid, symkey);
     dec = pcrypto_textdec_create(realkey);
-    pssl_symkey_free(realkey);
+    psymkey_free(realkey);
     return dec;
   default:
     debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
   def1:
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     return (pcrypto_textdec_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
   }
@@ -1173,7 +1173,7 @@ psync_crypto_get_temp_folder_encoder_locked(psync_fsfolderid_t folderid) {
     enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
     psync_sql_free_result(res);
     if (enckey) {
-      symkey = pssl_rsa_decrypt(crypto_privkey, enckey, enckeylen);
+      symkey = psymkey_decrypt(crypto_privkey, enckey, enckeylen);
       psync_free(enckey);
     } else
       symkey = PSYNC_INVALID_SYM_KEY;
@@ -1194,14 +1194,14 @@ psync_crypto_get_temp_folder_encoder_locked(psync_fsfolderid_t folderid) {
       goto def1;
     }
     realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     enc = pcrypto_textenc_create(realkey);
-    pssl_symkey_free(realkey);
+    psymkey_free(realkey);
     return enc;
   default:
     debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
   def1:
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     return (pcrypto_textenc_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
   }
@@ -1230,7 +1230,7 @@ psync_crypto_get_temp_folder_decoder_locked(psync_fsfolderid_t folderid) {
     enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
     psync_sql_free_result(res);
     if (enckey) {
-      symkey = pssl_rsa_decrypt(crypto_privkey, enckey, enckeylen);
+      symkey = psymkey_decrypt(crypto_privkey, enckey, enckeylen);
 
       psync_free(enckey);
       if (symkey == PSYNC_INVALID_SYM_KEY)
@@ -1256,14 +1256,14 @@ psync_crypto_get_temp_folder_decoder_locked(psync_fsfolderid_t folderid) {
       goto def1;
     }
     realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     dec = pcrypto_textdec_create(realkey);
-    pssl_symkey_free(realkey);
+    psymkey_free(realkey);
     return dec;
   default:
     debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
   def1:
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     return (pcrypto_textdec_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
   }
@@ -1428,12 +1428,12 @@ psync_crypto_get_file_encoder_locked(psync_fileid_t fileid, uint64_t hash,
     realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
     psync_crypto_release_file_symkey_locked(fileid, hash, symkey);
     enc = pcrypto_sec_encdec_create(realkey);
-    pssl_symkey_free(realkey);
+    psymkey_free(realkey);
     return enc;
   default:
     debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
   def1:
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     return (pcrypto_sector_encdec_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
   }
@@ -1467,7 +1467,7 @@ psync_crypto_get_temp_file_encoder_locked(psync_fsfileid_t fileid,
     enckey = psync_base64_decode(b64enckey, b64enckeylen, &enckeylen);
     psync_sql_free_result(res);
     if (enckey) {
-      symkey = pssl_rsa_decrypt(crypto_privkey, enckey, enckeylen);
+      symkey = psymkey_decrypt(crypto_privkey, enckey, enckeylen);
 
       psync_free(enckey);
     } else
@@ -1485,14 +1485,14 @@ psync_crypto_get_temp_file_encoder_locked(psync_fsfileid_t fileid,
         goto def1;
       }
       realkey = psync_crypto_sym_key_ver1_to_sym_key(skv1);
-      pssl_symkey_free(symkey);
+      psymkey_free(symkey);
       enc = pcrypto_sec_encdec_create(realkey);
-      pssl_symkey_free(realkey);
+      psymkey_free(realkey);
       return enc;
     default:
       debug(D_WARNING, "unkown key type %u", (unsigned)skv1->type);
     def1:
-      pssl_symkey_free(symkey);
+      psymkey_free(symkey);
       return (pcrypto_sector_encdec_t)err_to_ptr(
           PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
     }
@@ -1554,7 +1554,7 @@ pcryptofolder_filencoder_from_binresult(psync_fileid_t fileid,
   if (!key)
     return (pcrypto_sector_encdec_t)err_to_ptr(
         PRINT_RETURN_CONST(PSYNC_CRYPTO_INVALID_KEY));
-  esym = pssl_alloc_symkey(keylen);
+  esym = psymkey_alloc(keylen);
   memcpy(esym->data, key, keylen);
   psync_free(key);
   hash = papi_find_result2(res, "hash", PARAM_NUM)->num;
@@ -1567,7 +1567,7 @@ pcryptofolder_filencoder_from_binresult(psync_fileid_t fileid,
     // save_file_key_to_db runs thread to save to db, that's why we insert
     // decrypted key to cache, so psync_crypto_get_file_encoder_locked finds
     // it
-    symkey = pssl_symkey_decrypt_lock(&crypto_privkey, &esym);
+    symkey = psymkey_decrypt_lock(&crypto_privkey, &esym);
 
     psync_crypto_release_file_symkey_locked(fileid, hash, symkey);
     enc = psync_crypto_get_file_encoder_locked(fileid, hash, 0);
@@ -1738,21 +1738,21 @@ char *pcryptofolder_filencoder_key_new(uint32_t flags, size_t *keylen) {
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
   sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
   sym.flags = flags;
-  pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
-  pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
+  pssl_random(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
+  pssl_random(sym.aeskey, PSYNC_AES256_KEY_SIZE);
   pthread_rwlock_rdlock(&crypto_lock);
   if (!crypto_started_l) {
     pthread_rwlock_unlock(&crypto_lock);
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
   }
-  encsym = pssl_rsa_encrypt(crypto_pubkey, (unsigned char *)&sym,
+  encsym = psymkey_encrypt(crypto_pubkey, (unsigned char *)&sym,
                                       sizeof(sym));
   pthread_rwlock_unlock(&crypto_lock);
   if (encsym == PSYNC_INVALID_ENC_SYM_KEY) {
     debug(D_ERROR, "RSA encryption failed");
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR));
   }
-  pssl_memclean(&sym, sizeof(sym));
+  pssl_cleanup(&sym, sizeof(sym));
   ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen);
   psync_free(encsym);
   return ret;
@@ -1767,14 +1767,14 @@ char *pcryptofolder_filencoder_key_newplain(
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
   sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
   sym.flags = flags;
-  pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
-  pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
+  pssl_random(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
+  pssl_random(sym.aeskey, PSYNC_AES256_KEY_SIZE);
   pthread_rwlock_rdlock(&crypto_lock);
   if (!crypto_started_l) {
     pthread_rwlock_unlock(&crypto_lock);
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED));
   }
-  encsym = pssl_rsa_encrypt(crypto_pubkey, (unsigned char *)&sym,
+  encsym = psymkey_encrypt(crypto_pubkey, (unsigned char *)&sym,
                                       sizeof(sym));
   pthread_rwlock_unlock(&crypto_lock);
   if (encsym == PSYNC_INVALID_ENC_SYM_KEY) {
@@ -1782,7 +1782,7 @@ char *pcryptofolder_filencoder_key_newplain(
     return (char *)err_to_ptr(PRINT_RETURN_CONST(PSYNC_CRYPTO_RSA_ERROR));
   }
   *deckey = psync_crypto_sym_key_ver1_to_sym_key(&sym);
-  pssl_memclean(&sym, sizeof(sym));
+  pssl_cleanup(&sym, sizeof(sym));
   ret = (char *)psync_base64_encode(encsym->data, encsym->datalen, keylen);
   psync_free(encsym);
   return ret;
@@ -1801,16 +1801,16 @@ int pcryptofolder_mkdir(psync_folderid_t folderid, const char *name,
   ename = NULL;
   sym.type = PSYNC_CRYPTO_SYM_AES256_1024BIT_HMAC;
   sym.flags = PSYNC_CRYPTO_SYM_FLAG_ISDIR;
-  pssl_rand_strong(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
-  pssl_rand_strong(sym.aeskey, PSYNC_AES256_KEY_SIZE);
+  pssl_random(sym.hmackey, PSYNC_CRYPTO_HMAC_SHA512_KEY_LEN);
+  pssl_random(sym.aeskey, PSYNC_AES256_KEY_SIZE);
   pthread_rwlock_rdlock(&crypto_lock);
   if (!crypto_started_l) {
     pthread_rwlock_unlock(&crypto_lock);
     return set_err(PRINT_RETURN_CONST(PSYNC_CRYPTO_NOT_STARTED), err);
   }
-  encsym = pssl_rsa_encrypt(crypto_pubkey, (unsigned char *)&sym,
+  encsym = psymkey_encrypt(crypto_pubkey, (unsigned char *)&sym,
                                       sizeof(sym));
-  pssl_memclean(&sym, sizeof(sym));
+  pssl_cleanup(&sym, sizeof(sym));
   ret = get_name_for_folder_locked(folderid, name, &ename, err);
   pthread_rwlock_unlock(&crypto_lock);
   if (ret) {
@@ -1849,7 +1849,7 @@ int psync_pcloud_crypto_reencode_key(
   case PSYNC_CRYPTO_PUB_TYPE_RSA4096:
     if (offsetof(pub_key_ver1, key) >= rsapublen)
       goto err_bk_0;
-    pub = pssl_rsa_load_pub(rsapub + offsetof(pub_key_ver1, key),
+    pub = prsa_load_public(rsapub + offsetof(pub_key_ver1, key),
                                     rsapublen - offsetof(pub_key_ver1, key));
     if (pub == PSYNC_INVALID_RSA)
       goto err_bk_0;
@@ -1869,14 +1869,14 @@ int psync_pcloud_crypto_reencode_key(
     if (offsetof(priv_key_ver1, key) >= rsaprivlen)
       goto err_bk_1;
     rsapriv_struct = (priv_key_ver1 *)rsapriv;
-    aeskey = pssl_gen_symkey_pass(
+    aeskey = psymkey_generate_passphrase(
         oldpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
         rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
     if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
       goto err_nm_1;
     rsaprivlen -= offsetof(priv_key_ver1, key);
     enc = pcrypto_ctr_encdec_create(aeskey);
-    pssl_symkey_free(aeskey);
+    psymkey_free(aeskey);
     if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
       goto err_nm_1;
     rsaprivdec = (unsigned char *)psync_malloc(rsaprivlen);
@@ -1895,15 +1895,15 @@ int psync_pcloud_crypto_reencode_key(
     rsapriv_struct = (priv_key_ver1 *)newpriv;
     rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT;
     rsapriv_struct->flags = flags;
-    pssl_rand_weak(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
-    aeskey = pssl_gen_symkey_pass(
+    pssl_random(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
+    aeskey = psymkey_generate_passphrase(
         newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
         rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
     if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
       goto err_nm_1;
     // rsaprivlen-=offsetof(priv_key_ver1, key);
     enc = pcrypto_ctr_encdec_create(aeskey);
-    pssl_symkey_free(aeskey);
+    psymkey_free(aeskey);
     if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
       goto err_nm_1;
     memcpy(rsapriv_struct->key, rsaprivdec, rsaprivlen);
@@ -1911,8 +1911,8 @@ int psync_pcloud_crypto_reencode_key(
                                                   rsaprivlen, 0);
     pcrypto_ctr_encdec_free(enc);
     newprivlen = offsetof(priv_key_ver1, key) + rsaprivlen;
-    priv = pssl_rsa_load_priv(rsaprivdec, rsaprivlen);
-    pssl_memclean(rsaprivdec, rsaprivlen);
+    priv = prsa_load_private(rsaprivdec, rsaprivlen);
+    pssl_cleanup(rsaprivdec, rsaprivlen);
     psync_free(rsaprivdec);
     if (unlikely(priv == PSYNC_INVALID_RSA))
       goto err_ph_1;
@@ -1925,19 +1925,19 @@ int psync_pcloud_crypto_reencode_key(
   if (!crypto_keys_match(pub, priv))
     goto err_ph_2;
   psync_sha256(newpriv, newprivlen, newprivsha);
-  rsasign = pssl_sha256_sign(priv, newprivsha);
+  rsasign = prsa_signature(priv, newprivsha);
   if (psync_crypto_is_error(rsasign)) {
     psync_free(newpriv);
-    pssl_rsa_free_pub(pub);
-    pssl_rsa_free_priv(priv);
+    prsa_free_public(pub);
+    prsa_free_private(priv);
     return psync_crypto_to_error(rsasign);
   }
   *privenc = (char *)psync_base64_encode(newpriv, newprivlen, &dummy);
   *sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy);
   psync_free(rsasign);
   psync_free(newpriv);
-  pssl_rsa_free_pub(pub);
-  pssl_rsa_free_priv(priv);
+  prsa_free_public(pub);
+  prsa_free_private(priv);
 
   if (!*privenc || !*sign) {
     psync_free(*privenc);
@@ -1947,18 +1947,18 @@ int psync_pcloud_crypto_reencode_key(
 
   return PSYNC_CRYPTO_SUCCESS;
 err_bk_1:
-  pssl_rsa_free_pub(pub);
+  prsa_free_public(pub);
 err_bk_0:
   return PSYNC_CRYPTO_BAD_KEY;
 err_nm_1:
   psync_free(newpriv);
-  pssl_rsa_free_pub(pub);
+  prsa_free_public(pub);
   return PERROR_NO_MEMORY;
 err_ph_2:
-  pssl_rsa_free_priv(priv);
+  prsa_free_private(priv);
 err_ph_1:
   psync_free(newpriv);
-  pssl_rsa_free_pub(pub);
+  prsa_free_public(pub);
   return PSYNC_CRYPTO_BAD_PASSPHRASE;
 }
 
@@ -1972,7 +1972,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
   size_t rsaprivlen, dummy;
   unsigned char newprivsha[PSYNC_SHA256_DIGEST_LEN];
   psync_rsa_signature_t rsasign;
-  rsapriv = pssl_rsa_priv_bin(crypto_privkey);
+  rsapriv = prsa_binary_private(crypto_privkey);
   if (rsapriv == PSYNC_INVALID_RSA)
     goto err_nm_0;
   rsaprivlen = rsapriv->datalen;
@@ -1983,14 +1983,14 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
   rsapriv_struct = (priv_key_ver1 *)newpriv;
   rsapriv_struct->type = PSYNC_CRYPTO_TYPE_RSA4096_64BYTESALT_20000IT;
   rsapriv_struct->flags = flags;
-  pssl_rand_weak(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
-  aeskey = pssl_gen_symkey_pass(
+  pssl_random(rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN);
+  aeskey = psymkey_generate_passphrase(
       newpassphrase, PSYNC_AES256_KEY_SIZE + PSYNC_AES256_BLOCK_SIZE,
       rsapriv_struct->salt, PSYNC_CRYPTO_PBKDF2_SALT_LEN, 20000);
   if (unlikely(aeskey == PSYNC_INVALID_SYM_KEY))
     goto err_nm_1;
   enc = pcrypto_ctr_encdec_create(aeskey);
-  pssl_symkey_free(aeskey);
+  psymkey_free(aeskey);
   if (unlikely(enc == PSYNC_CRYPTO_INVALID_ENCODER))
     goto err_nm_1;
   memcpy(rsapriv_struct->key, rsapriv->data, rsaprivlen);
@@ -2000,17 +2000,17 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
   rsaprivlen += offsetof(priv_key_ver1, key);
 
   psync_sha256(newpriv, rsaprivlen, newprivsha);
-  rsasign = pssl_sha256_sign(crypto_privkey, newprivsha);
+  rsasign = prsa_signature(crypto_privkey, newprivsha);
   if (psync_crypto_is_error(rsasign)) {
     psync_free(newpriv);
-    pssl_rsa_bin_free(rsapriv);
+    prsa_binary_free(rsapriv);
     return psync_crypto_to_error(rsasign);
   }
   *privenc = (char *)psync_base64_encode(newpriv, rsaprivlen, &dummy);
   *sign = (char *)psync_base64_encode(rsasign->data, rsasign->datalen, &dummy);
   psync_free(rsasign);
   psync_free(newpriv);
-  pssl_rsa_bin_free(rsapriv);
+  prsa_binary_free(rsapriv);
 
   if (!*privenc || !*sign) {
     psync_free(*privenc);
@@ -2022,7 +2022,7 @@ int psync_pcloud_crypto_encode_key(const char *newpassphrase, uint32_t flags,
 
 err_nm_1:
   psync_free(newpriv);
-  pssl_rsa_bin_free(rsapriv);
+  prsa_binary_free(rsapriv);
 err_nm_0:
   return PERROR_NO_MEMORY;
 }
diff --git a/pclsync/pdiff.c b/pclsync/pdiff.c
index 9541b50..1922b9d 100644
--- a/pclsync/pdiff.c
+++ b/pclsync/pdiff.c
@@ -328,7 +328,7 @@ static psock_t *get_connected_socket() {
     psync_sql_res *q;
     unsigned char deviceidbin[16];
     char deviceidhex[32 + 2];
-    pssl_rand_strong(deviceidbin, sizeof(deviceidbin));
+    pssl_random(deviceidbin, sizeof(deviceidbin));
     psync_binhex(deviceidhex, deviceidbin, sizeof(deviceidbin));
     deviceidhex[sizeof(deviceidbin) * 2] = 0;
     q = psync_sql_prep_statement(
diff --git a/pclsync/pfs.c b/pclsync/pfs.c
index c64759b..4ca3d4a 100644
--- a/pclsync/pfs.c
+++ b/pclsync/pfs.c
@@ -1468,7 +1468,7 @@ static int psync_fs_open(const char *path, struct fuse_file_info *fi) {
           goto ex0;
         }
         encoder = pcrypto_sec_encdec_create(symkey);
-        pssl_symkey_free(symkey);
+        psymkey_free(symkey);
         if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) {
           psync_free(encsymkey);
           ret = -ENOMEM;
@@ -1639,7 +1639,7 @@ static int psync_fs_creat(const char *path, mode_t mode,
       return -psync_fs_crypto_err_to_errno(psync_crypto_to_error(encsymkey));
     }
     encoder = pcrypto_sec_encdec_create(symkey);
-    pssl_symkey_free(symkey);
+    psymkey_free(symkey);
     if (unlikely_log(encoder == PSYNC_CRYPTO_INVALID_ENCODER)) {
       psync_fstask_release_folder_tasks_locked(folder);
       psync_sql_unlock();
@@ -3367,7 +3367,7 @@ void psync_fs_refresh_folder(psync_folderid_t folderid) {
       pfolder_path_sep(folderid, "/", NULL);
   if (path == PSYNC_INVALID_PATH)
     return;
-  pssl_rand_weak(rndbuff, sizeof(rndbuff));
+  pssl_random(rndbuff, sizeof(rndbuff));
   psync_binhex(rndhex, rndbuff, sizeof(rndbuff));
   rndhex[2 * sizeof(rndbuff)] = 0;
   pthread_mutex_lock(&start_mutex);
@@ -3565,7 +3565,7 @@ static void psync_fs_init_once() {
 #if psync_fs_need_per_folder_refresh_const()
   unsigned char rndbuff[16];
   char rndhex[34];
-  pssl_rand_weak(rndbuff, sizeof(rndbuff));
+  pssl_random(rndbuff, sizeof(rndbuff));
   psync_binhex(rndhex, rndbuff, sizeof(rndbuff));
   rndhex[2 * sizeof(rndbuff)] = 0;
   psync_fake_prefix = psync_strcat(".refresh", rndhex, NULL);
diff --git a/pclsync/pp2p.c b/pclsync/pp2p.c
index 9df588d..4703457 100644
--- a/pclsync/pp2p.c
+++ b/pclsync/pp2p.c
@@ -221,7 +221,7 @@ static void psync_p2p_check(const packet_check *packet) {
   else
     return;
   resp.port = tcpport;
-  pssl_rand_weak(resp.rand, sizeof(resp.rand));
+  pssl_random(resp.rand, sizeof(resp.rand));
   memcpy(hashsource, hashhex, PSYNC_HASH_DIGEST_HEXLEN);
   memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, resp.rand, sizeof(resp.rand));
   psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin);
@@ -361,7 +361,7 @@ static void psync_p2p_tcphandler(void *ptr) {
     goto err0;
   }
   psync_free(token);
-  pubrsa = pssl_rsa_load_pub(binpubrsa->data, binpubrsa->datalen);
+  pubrsa = prsa_load_public(binpubrsa->data, binpubrsa->datalen);
   psync_free(binpubrsa);
   if (unlikely_log(pubrsa == PSYNC_INVALID_RSA))
     goto err0;
@@ -377,9 +377,10 @@ static void psync_p2p_tcphandler(void *ptr) {
     goto err0;
   }
   aeskey = pcrypto_key();
-  encaeskey = pssl_symkey_encrypt(pubrsa, aeskey);
+  encaeskey = psymkey_encrypt(pubrsa, aeskey->key, aeskey->keylen);
+
   encoder = pcrypto_ctr_encdec_create(aeskey);
-  pssl_symkey_free(aeskey);
+  psymkey_free(aeskey);
   keylen = encaeskey->datalen;
   enctype = P2P_ENCTYPE_RSA_AES;
   if (unlikely_log(encaeskey == PSYNC_INVALID_ENC_SYM_KEY) ||
@@ -550,7 +551,7 @@ static void psync_p2p_wake() {
 
 void pp2p_init() {
   unsigned char computerbin[PSYNC_HASH_DIGEST_LEN];
-  pssl_rand_weak(computerbin, PSYNC_HASH_DIGEST_LEN);
+  pssl_random(computerbin, PSYNC_HASH_DIGEST_LEN);
   psync_binhex(computername, computerbin, PSYNC_HASH_DIGEST_LEN);
   ptimer_exception_handler(psync_p2p_wake);
   if (!psync_setting_get_bool(_PS(p2psync)))
@@ -574,17 +575,17 @@ static int psync_p2p_check_rsa() {
     psync_rsa_publickey_t rsapub;
     psync_binary_rsa_key_t rsapubbin;
     debug(D_NOTICE, "generating %ubit RSA key", PSYNC_P2P_RSA_SIZE);
-    rsa = pssl_rsa_gen(PSYNC_P2P_RSA_SIZE);
+    rsa = prsa_generate(PSYNC_P2P_RSA_SIZE);
     debug(D_NOTICE, "key generated");
     if (unlikely_log(rsa == PSYNC_INVALID_RSA))
       goto rete;
-    rsapriv = pssl_rsa_get_priv(rsa);
-    rsapub = pssl_rsa_get_pub(rsa);
+    rsapriv = prsa_get_private(rsa);
+    rsapub = prsa_get_public(rsa);
     if (likely_log(rsapub != PSYNC_INVALID_RSA))
-      rsapubbin = pssl_rsa_bin_pub(rsapub);
+      rsapubbin = prsa_binary_public(rsapub);
     else
       rsapubbin = PSYNC_INVALID_BIN_RSA;
-    pssl_rsa_free(rsa);
+    prsa_free(rsa);
     if (likely_log(rsapriv != PSYNC_INVALID_RSA &&
                    rsapub != PSYNC_INVALID_RSA &&
                    rsapubbin != PSYNC_INVALID_BIN_RSA)) {
@@ -594,11 +595,11 @@ static int psync_p2p_check_rsa() {
       goto ret0;
     } else {
       if (rsapriv != PSYNC_INVALID_RSA)
-        pssl_rsa_free_priv(rsapriv);
+        prsa_free_private(rsapriv);
       if (rsapub != PSYNC_INVALID_RSA)
-        pssl_rsa_free_pub(rsapub);
+        prsa_free_public(rsapub);
       if (rsapubbin != PSYNC_INVALID_BIN_RSA)
-        pssl_rsa_bin_free(rsapubbin);
+        prsa_binary_free(rsapubbin);
       goto rete;
     }
   }
@@ -672,18 +673,16 @@ static int psync_p2p_download(int sock, psync_fileid_t fileid,
     debug(D_ERROR, "too long key - %u bytes", (unsigned)keylen);
     return PSYNC_NET_PERMFAIL;
   }
-  ekey = pssl_alloc_symkey(keylen);
+  ekey = psymkey_alloc(keylen);
   if (unlikely_log(socket_read_all(sock, ekey->data, keylen)) ||
-      unlikely_log((key = pssl_symkey_decrypt_lock(
+      unlikely_log((key = psymkey_decrypt_lock(
                         &privkey, &ekey)) == PSYNC_INVALID_SYM_KEY)) {
-    // unlikely_log((key=pssl_symkey_decrypt(&psync_rsa_private,
-    // &ekey))==PSYNC_INVALID_SYM_KEY)){
     psync_free(ekey);
     return PSYNC_NET_TEMPFAIL;
   }
   psync_free(ekey);
   decoder = pcrypto_ctr_encdec_create(key);
-  pssl_symkey_free(key);
+  psymkey_free(key);
   if (decoder == PSYNC_CRYPTO_INVALID_ENCODER)
     return PSYNC_NET_PERMFAIL;
   fd = pfile_open(filename, O_WRONLY, O_CREAT | O_TRUNC);
@@ -754,7 +753,7 @@ int pp2p_check_download(psync_fileid_t fileid,
   pct1.type = P2P_CHECK;
   memcpy(pct1.hashstart, filehashhex, PSYNC_P2P_HEXHASH_BYTES);
   pct1.filesize = fsize;
-  pssl_rand_weak(pct1.rand, sizeof(pct1.rand));
+  pssl_random(pct1.rand, sizeof(pct1.rand));
   memcpy(hashsource, filehashhex, PSYNC_HASH_DIGEST_HEXLEN);
   memcpy(hashsource + PSYNC_HASH_DIGEST_HEXLEN, pct1.rand, sizeof(pct1.rand));
   psync_hash(hashsource, PSYNC_HASH_BLOCK_SIZE, hashbin);
@@ -841,7 +840,7 @@ int pp2p_check_download(psync_fileid_t fileid,
     goto err_perm2;
   else if (bresp == P2P_RESP_WAIT) {
     uint32_t rnd;
-    pssl_rand_weak((unsigned char *)&rnd, sizeof(rnd));
+    pssl_random((unsigned char *)&rnd, sizeof(rnd));
     rnd &= 0x7ff;
     psys_sleep_milliseconds(PSYNC_P2P_SLEEP_WAIT_DOWNLOAD + rnd);
     goto err_temp2;
diff --git a/pclsync/ppassword.c b/pclsync/ppassword.c
index 704617c..926db14 100644
--- a/pclsync/ppassword.c
+++ b/pclsync/ppassword.c
@@ -351,8 +351,8 @@ uint64_t ppassword_score(const char *cpassword) {
       ldpwd[nlen] = lpwd[nlen];
   }
   num = score_variants(password, lpwd, ldpwd, plen);
-  pssl_memclean(lpwd, plen);
-  pssl_memclean(ldpwd, plen);
+  pssl_cleanup(lpwd, plen);
+  pssl_cleanup(ldpwd, plen);
   psync_free(lpwd);
   psync_free(ldpwd);
   mul_score(num);
diff --git a/pclsync/ppathstatus.c b/pclsync/ppathstatus.c
index 8c11cf9..369a1b0 100644
--- a/pclsync/ppathstatus.c
+++ b/pclsync/ppathstatus.c
@@ -216,7 +216,7 @@ void ppathstatus_reload_syncs() {
 void ppathstatus_clear_cache() {
   uint64_t ndrv_hash_seed, nsync_hash_seed;
   do {
-    pssl_rand_strong((unsigned char *)&ndrv_hash_seed,
+    pssl_random((unsigned char *)&ndrv_hash_seed,
                           sizeof(ndrv_hash_seed));
   } while (unlikely(!ndrv_hash_seed));
   nsync_hash_seed = 0x49916a8e891d1dafULL * ndrv_hash_seed;
@@ -229,7 +229,7 @@ void ppathstatus_clear_cache() {
 void ppathstatus_clear_sync_cache() {
   uint64_t nsync_hash_seed;
   do {
-    pssl_rand_strong((unsigned char *)&nsync_hash_seed,
+    pssl_random((unsigned char *)&nsync_hash_seed,
                           sizeof(nsync_hash_seed));
   } while (unlikely(nsync_hash_seed == drv_hash_seed));
   psync_sql_lock();
diff --git a/pclsync/psock.c b/pclsync/psock.c
index 8a8bef1..7a01d95 100644
--- a/pclsync/psock.c
+++ b/pclsync/psock.c
@@ -38,6 +38,7 @@
 #include "plibs.h"
 #include "psettings.h"
 #include "psock.h"
+#include "pssl.h"
 #include "ptimer.h"
 
 #define PROXY_NONE 0
@@ -431,7 +432,7 @@ int psock_try_write_buffer_thread(psock_t *sock) {
 
 int psock_readable(psock_t *sock) {
   psock_try_write_buffer(sock);
-  if (sock->ssl && pssl_pending(sock->ssl))
+  if (sock->ssl && pssl_bytes_left(sock->ssl))
     return 1;
   else if (wait_readable(sock->sock, 0, 0))
     return 0;
@@ -455,7 +456,7 @@ int psock_create(int domain, int type, int protocol) {
 
 psock_t *psock_connect(const char *host, int unsigned port, int ssl) {
   psock_t *ret;
-  void *sslc;
+  ssl_connection_t *sslc;
   int sock;
   char sport[8];
   psync_slprintf(sport, sizeof(sport), "%d", port);
@@ -466,13 +467,13 @@ psock_t *psock_connect(const char *host, int unsigned port, int ssl) {
   }
 
   if (ssl) {
-    ssl = pssl_connect(sock, &sslc, host);
+    ssl = pssl_open(sock, &sslc, host);
     while (ssl == PSYNC_SSL_NEED_FINISH) {
       if (wait_ssl_ready(sock)) {
         pssl_free(sslc);
         break;
       }
-      ssl = pssl_connect_finish(sslc, host);
+      ssl = pssl_finish(sslc, host);
     }
     if (unlikely_log(ssl != PSYNC_SSL_SUCCESS)) {
       close(sock);
@@ -495,7 +496,7 @@ int psock_wait_write_timeout(int sock) {
 
 void psock_close(psock_t *sock) {
   if (sock->ssl)
-    while (pssl_shutdown(sock->ssl) == PSYNC_SSL_NEED_FINISH)
+    while (pssl_close(sock->ssl) == PSYNC_SSL_NEED_FINISH)
       if (wait_ssl_ready(sock->sock)) {
         pssl_free(sock->ssl);
         break;
@@ -576,7 +577,7 @@ int psock_pendingdata(psock_t *sock) {
   if (sock->pending)
     return 1;
   if (sock->ssl)
-    return pssl_pending(sock->ssl);
+    return pssl_bytes_left(sock->ssl);
   else
     return 0;
 }
@@ -590,7 +591,7 @@ int psock_pendingdata_buf(psock_t *sock) {
   return -1;
 #endif
   if (sock->ssl)
-    ret += pssl_pending(sock->ssl);
+    ret += pssl_bytes_left(sock->ssl);
   return ret;
 }
 
@@ -605,7 +606,7 @@ int psock_pendingdata_buf_thread(psock_t *sock) {
 static int psync_socket_read_ssl(psock_t *sock, void *buff, int num) {
   int r;
   psock_try_write_buffer(sock);
-  if (!pssl_pending(sock->ssl) && !sock->pending &&
+  if (!pssl_bytes_left(sock->ssl) && !sock->pending &&
       psock_wait_read_timeout(sock->sock))
     return -1;
   sock->pending = 0;
@@ -701,7 +702,7 @@ static int psync_socket_read_ssl_thread(psock_t *sock, void *buff, int num) {
   pthread_mutex_lock(&mutex);
   psock_try_write_buffer(sock);
   pthread_mutex_unlock(&mutex);
-  if (!pssl_pending(sock->ssl) && !sock->pending &&
+  if (!pssl_bytes_left(sock->ssl) && !sock->pending &&
       psock_wait_read_timeout(sock->sock))
     return -1;
   sock->pending = 0;
@@ -826,7 +827,7 @@ static int psync_socket_readall_ssl(psock_t *sock, void *buff, int num) {
 
   psock_try_write_buffer(sock);
 
-  if (!pssl_pending(sock->ssl) && !sock->pending &&
+  if (!pssl_bytes_left(sock->ssl) && !sock->pending &&
       psock_wait_read_timeout(sock->sock)) {
     return -1;
   }
@@ -948,7 +949,7 @@ static int psync_socket_readall_ssl_thread(psock_t *sock, void *buff, int num) {
   br = 0;
   pthread_mutex_lock(&mutex);
   psock_try_write_buffer(sock);
-  r = pssl_pending(sock->ssl);
+  r = pssl_bytes_left(sock->ssl);
   pthread_mutex_unlock(&mutex);
   if (!r && !sock->pending && psock_wait_read_timeout(sock->sock))
     return -1;
diff --git a/pclsync/pssl.c b/pclsync/pssl.c
index 677918c..1cd0d8d 100644
--- a/pclsync/pssl.c
+++ b/pclsync/pssl.c
@@ -66,15 +66,6 @@ typedef struct {
   pthread_mutex_t mutex;
 } ctr_drbg_context_locked;
 
-typedef struct {
-  mbedtls_net_context srv;
-  mbedtls_ssl_context ssl;
-  mbedtls_ssl_config cfg;
-  int sock;
-  int isbroken;
-  char cachekey[];
-} ssl_connection_t;
-
 static pthread_mutex_t rsa_decr_mutex = PTHREAD_MUTEX_INITIALIZER;
 static ctr_drbg_context_locked psync_mbed_rng;
 static mbedtls_entropy_context psync_mbed_entropy;
@@ -98,7 +89,7 @@ static const int psync_mbed_ciphersuite[] = {
     0};
 
 static void encdata_free(psync_encrypted_data_t e) {
-  pssl_memclean(e->data, e->datalen);
+  pssl_cleanup(e->data, e->datalen);
   pmemlock_free(e);
 }
 
@@ -225,32 +216,32 @@ static int ctr_drbg_random_locked(void *p_rng, unsigned char *output, size_t out
   return ret;
 }
 
-void pssl_set_log_threshold(int threshold) {
+void pssl_log_level(int threshold) {
   mbedtls_debug_set_threshold(threshold);
 }
 
-void pssl_set_debug_cb(psync_ssl_debug_callback_t cb, void *ctx) {
+void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx) {
   debug_cb = cb;
   debug_ctx = ctx;
 }
 
-void pssl_rsa_bin_free(psync_binary_rsa_key_t bin) {
+void prsa_binary_free(psync_binary_rsa_key_t bin) {
   encdata_free(bin);
 }
 
-void pssl_symkey_free(psync_symmetric_key_t key) {
-  pssl_memclean(key->key, key->keylen);
+void psymkey_free(psync_symmetric_key_t key) {
+  pssl_cleanup(key->key, key->keylen);
   pmemlock_free(key);
 }
 
-psync_encrypted_symmetric_key_t pssl_alloc_symkey(size_t len) {
+psync_encrypted_symmetric_key_t psymkey_alloc(size_t len) {
   psync_encrypted_symmetric_key_t ret;
   ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) + len);
   ret->datalen = len;
   return ret;
 }
 
-psync_encrypted_symmetric_key_t pssl_symkey_copy(psync_encrypted_symmetric_key_t src) {
+psync_encrypted_symmetric_key_t psymkey_copy(psync_encrypted_symmetric_key_t src) {
   psync_encrypted_symmetric_key_t ret;
   ret = psync_malloc(offsetof(psync_encrypted_data_struct_t, data) +
                      src->datalen);
@@ -259,13 +250,13 @@ psync_encrypted_symmetric_key_t pssl_symkey_copy(psync_encrypted_symmetric_key_t
   return ret;
 }
 
-psync_symmetric_key_t pssl_symkey_decrypt_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey) {
+psync_symmetric_key_t psymkey_decrypt_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey) {
   psync_symmetric_key_t sym_key;
 
   debug(D_NOTICE, "Get RSA decrypt key lock.");
   pthread_mutex_lock(&rsa_decr_mutex);
 
-  sym_key = pssl_symkey_decrypt(*rsa, *enckey);
+  sym_key = psymkey_decrypt(*rsa, (*enckey)->data, (*enckey)->datalen);
 
   pthread_mutex_unlock(&rsa_decr_mutex);
   debug(D_NOTICE, "RSA decrypt key Lock released.");
@@ -306,13 +297,13 @@ int pssl_init() {
   return 0;
 }
 
-void pssl_memclean(void *ptr, size_t len) {
+void pssl_cleanup(void *ptr, size_t len) {
   volatile unsigned char *p = ptr;
   while (len--)
     *p++ = 0;
 }
 
-int pssl_connect(int sock, void **sslconn, const char *hostname) {
+int pssl_open(int sock, ssl_connection_t **sslconn, const char *hostname) {
   ssl_connection_t *conn;
   mbedtls_ssl_session *sess;
   int ret;
@@ -404,7 +395,7 @@ err0:
   return PRINT_RETURN_CONST(PSYNC_SSL_FAIL);
 }
 
-int pssl_connect_finish(void *sslconn, const char *hostname) {
+int pssl_finish(ssl_connection_t *sslconn, const char *hostname) {
   ssl_connection_t *conn;
   int ret;
 
@@ -429,7 +420,7 @@ fail:
   return PRINT_RETURN_CONST(PSYNC_SSL_FAIL);
 }
 
-int pssl_shutdown(void *sslconn) {
+int pssl_close(ssl_connection_t *sslconn) {
   ssl_connection_t *conn;
   int ret;
   conn = (ssl_connection_t *)sslconn;
@@ -448,18 +439,18 @@ noshutdown:
   return PSYNC_SSL_SUCCESS;
 }
 
-void pssl_free(void *sslconn) {
+void pssl_free(ssl_connection_t *sslconn) {
   ssl_connection_t *conn;
   conn = (ssl_connection_t *)sslconn;
   mbedtls_ssl_free(&conn->ssl);
   psync_free(conn);
 }
 
-int pssl_pending(void *sslconn) {
+int pssl_bytes_left(ssl_connection_t *sslconn) {
   return mbedtls_ssl_get_bytes_avail(&((ssl_connection_t *)sslconn)->ssl);
 }
 
-int pssl_read(void *sslconn, void *buf, int num) {
+int pssl_read(ssl_connection_t *sslconn, void *buf, int num) {
   ssl_connection_t *conn;
   int res;
   conn = (ssl_connection_t *)sslconn;
@@ -470,7 +461,7 @@ int pssl_read(void *sslconn, void *buf, int num) {
   return PSYNC_SSL_FAIL;
 }
 
-int pssl_write(void *sslconn, const void *buf, int num) {
+int pssl_write(ssl_connection_t *sslconn, const void *buf, int num) {
   ssl_connection_t *conn;
   int res;
   conn = (ssl_connection_t *)sslconn;
@@ -481,19 +472,14 @@ int pssl_write(void *sslconn, const void *buf, int num) {
   return PSYNC_SSL_FAIL;
 }
 
-void pssl_rand_strong(unsigned char *buf, int num) {
-  // FIXME: causing segfault
+void pssl_random(unsigned char *buf, int num) {
   if (unlikely(ctr_drbg_random_locked(&psync_mbed_rng, buf, num))) {
     debug(D_CRITICAL, "could not generate %d random bytes, exiting", num);
     abort();
   }
 }
 
-void pssl_rand_weak(unsigned char *buf, int num) {
-  pssl_rand_strong(buf, num);
-}
-
-psync_rsa_t pssl_rsa_gen(int bits) {
+psync_rsa_t prsa_generate(int bits) {
   mbedtls_rsa_context *ctx;
   ctx = psync_new(mbedtls_rsa_context);
   mbedtls_rsa_init(ctx);
@@ -507,27 +493,27 @@ psync_rsa_t pssl_rsa_gen(int bits) {
     return ctx;
 }
 
-void pssl_rsa_free(psync_rsa_t rsa) {
+void prsa_free(psync_rsa_t rsa) {
   mbedtls_rsa_free(rsa);
   psync_free(rsa);
 }
 
-psync_rsa_publickey_t pssl_rsa_get_pub(psync_rsa_t rsa) {
+psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa) {
   psync_binary_rsa_key_t bin;
   psync_rsa_publickey_t ret;
-  bin = pssl_rsa_bin_pub(rsa);
+  bin = prsa_binary_public(rsa);
   if (bin == PSYNC_INVALID_BIN_RSA)
     return PSYNC_INVALID_RSA;
-  ret = pssl_rsa_load_pub(bin->data, bin->datalen);  
-  pssl_rsa_bin_free(bin);
+  ret = prsa_load_public(bin->data, bin->datalen);  
+  prsa_binary_free(bin);
   return ret;
 }
 
-void pssl_rsa_free_pub(psync_rsa_publickey_t key) {
-  pssl_rsa_free(key);
+void prsa_free_public(psync_rsa_publickey_t key) {
+  prsa_free(key);
 }
 
-psync_rsa_privatekey_t pssl_rsa_get_priv(psync_rsa_t rsa) {
+psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa) {
   mbedtls_rsa_context *ctx;
   ctx = psync_new(mbedtls_rsa_context);
   mbedtls_rsa_init(ctx);
@@ -540,11 +526,11 @@ psync_rsa_privatekey_t pssl_rsa_get_priv(psync_rsa_t rsa) {
     return ctx;
 }
 
-void pssl_rsa_free_priv(psync_rsa_privatekey_t key) {
-  pssl_rsa_free(key);
+void prsa_free_private(psync_rsa_privatekey_t key) {
+  prsa_free(key);
 }
 
-psync_binary_rsa_key_t pssl_rsa_bin_pub(psync_rsa_publickey_t rsa) {
+psync_binary_rsa_key_t prsa_binary_public(psync_rsa_publickey_t rsa) {
   unsigned char buff[4096], *p;
   mbedtls_pk_context ctx;
   psync_binary_rsa_key_t ret;
@@ -565,7 +551,7 @@ psync_binary_rsa_key_t pssl_rsa_bin_pub(psync_rsa_publickey_t rsa) {
   return ret;
 }
 
-psync_binary_rsa_key_t pssl_rsa_priv_bin(psync_rsa_privatekey_t rsa) {
+psync_binary_rsa_key_t prsa_binary_private(psync_rsa_privatekey_t rsa) {
   unsigned char buff[4096];
   mbedtls_pk_context ctx;
   psync_binary_rsa_key_t ret;
@@ -582,11 +568,11 @@ psync_binary_rsa_key_t pssl_rsa_priv_bin(psync_rsa_privatekey_t rsa) {
       pmemlock_malloc(offsetof(psync_encrypted_data_struct_t, data) + len);
   ret->datalen = len;
   memcpy(ret->data, buff + sizeof(buff) - len, len);
-  pssl_memclean(buff + sizeof(buff) - len, len);
+  pssl_cleanup(buff + sizeof(buff) - len, len);
   return ret;
 }
 
-psync_rsa_publickey_t pssl_rsa_load_pub(const unsigned char *keydata, size_t keylen) {
+psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata, size_t keylen) {
   mbedtls_pk_context ctx;
   mbedtls_rsa_context *rsa;
   int ret;
@@ -614,7 +600,7 @@ psync_rsa_publickey_t pssl_rsa_load_pub(const unsigned char *keydata, size_t key
   }
 }
 
-psync_rsa_privatekey_t pssl_rsa_load_priv(const unsigned char *keydata, size_t keylen) {
+psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen) {
   mbedtls_pk_context pkctx;
   mbedtls_rsa_context *rsactx;
   int ret;
@@ -643,7 +629,7 @@ psync_rsa_privatekey_t pssl_rsa_load_priv(const unsigned char *keydata, size_t k
   }
 }
 
-psync_symmetric_key_t pssl_gen_symkey_pass(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations) {
+psync_symmetric_key_t psymkey_generate_passphrase(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations) {
   psync_symmetric_key_t key = (psync_symmetric_key_t)pmemlock_malloc(
       keylen + offsetof(psync_symmetric_key_struct_t, key));
   mbedtls_md_context_t ctx;
@@ -659,7 +645,7 @@ psync_symmetric_key_t pssl_gen_symkey_pass(const char *password, size_t keylen,
   return key;
 }
 
-char *pssl_derive_pwd(const char *username, const char *passphrase) {
+char *psymkey_derive_passphrase(const char *username, const char *passphrase) {
   unsigned char *usercopy;
   unsigned char usersha512[PSYNC_SHA512_DIGEST_LEN], passwordbin[32];
   mbedtls_md_context_t ctx;
@@ -685,7 +671,7 @@ char *pssl_derive_pwd(const char *username, const char *passphrase) {
   return (char *)usercopy;
 }
 
-psync_encrypted_symmetric_key_t pssl_rsa_encrypt(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen) {
+psync_encrypted_symmetric_key_t psymkey_encrypt(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen) {
   psync_encrypted_symmetric_key_t ret;
   int code;
   size_t rsalen;
@@ -708,7 +694,7 @@ psync_encrypted_symmetric_key_t pssl_rsa_encrypt(psync_rsa_publickey_t rsa, cons
   return ret;
 }
 
-psync_symmetric_key_t pssl_rsa_decrypt(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen) {
+psync_symmetric_key_t psymkey_decrypt(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen) {
   unsigned char buff[2048];
   psync_symmetric_key_t ret;
   size_t len;
@@ -720,19 +706,11 @@ psync_symmetric_key_t pssl_rsa_decrypt(psync_rsa_privatekey_t rsa, const unsigne
       offsetof(psync_symmetric_key_struct_t, key) + len);
   ret->keylen = len;
   memcpy(ret->key, buff, len);
-  pssl_memclean(buff, len);
+  pssl_cleanup(buff, len);
   return ret;
 }
 
-psync_encrypted_symmetric_key_t pssl_symkey_encrypt(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key) {
-  return pssl_rsa_encrypt(rsa, key->key, key->keylen);
-}
-
-psync_symmetric_key_t pssl_symkey_decrypt(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey) {
-  return pssl_rsa_decrypt(rsa, enckey->data, enckey->datalen);
-}
-
-psync_aes256_encoder pssl_enc_create(psync_symmetric_key_t key) {
+psync_aes256_encoder paes_encoder_create(psync_symmetric_key_t key) {
   mbedtls_aes_context *aes;
   assert(key->keylen >= PSYNC_AES256_KEY_SIZE);
   aes = psync_new(mbedtls_aes_context);
@@ -740,12 +718,12 @@ psync_aes256_encoder pssl_enc_create(psync_symmetric_key_t key) {
   return aes;
 }
 
-void pssl_enc_free(psync_aes256_encoder aes) {
-  pssl_memclean(aes, sizeof(mbedtls_aes_context));
+void paes_encoder_free(psync_aes256_encoder aes) {
+  pssl_cleanup(aes, sizeof(mbedtls_aes_context));
   psync_free(aes);
 }
 
-psync_aes256_encoder pssl_dec_create(psync_symmetric_key_t key) {
+psync_aes256_encoder paes_decoder_create(psync_symmetric_key_t key) {
   mbedtls_aes_context *aes;
   assert(key->keylen >= PSYNC_AES256_KEY_SIZE);
   aes = psync_new(mbedtls_aes_context);
@@ -753,12 +731,12 @@ psync_aes256_encoder pssl_dec_create(psync_symmetric_key_t key) {
   return aes;
 }
 
-void pssl_dec_free(psync_aes256_encoder aes) {
-  pssl_memclean(aes, sizeof(mbedtls_aes_context));
+void paes_decoder_free(psync_aes256_encoder aes) {
+  pssl_cleanup(aes, sizeof(mbedtls_aes_context));
   psync_free(aes);
 }
 
-psync_rsa_signature_t pssl_sha256_sign(psync_rsa_privatekey_t rsa, const unsigned char *data) {
+psync_rsa_signature_t prsa_signature(psync_rsa_privatekey_t rsa, const unsigned char *data) {
   psync_rsa_signature_t ret;
   int padding, hash_id;
   size_t rsalen;
@@ -798,27 +776,27 @@ void psync_aes256_decode_4blocks_consec_xor_sw(psync_aes256_decoder enc, const u
     ((unsigned long *)dst)[i] ^= ((unsigned long *)bxor)[i];
 }
 
-void pssl_enc_blk(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst) {
+void paes_blk_encode(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst) {
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst);
 }
 
-void pssl_dec_blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
+void paes_blk_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
 }
 
-void pssl_enc_2blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
+void paes_2blk_encode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src, dst);
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_ENCRYPT, src + PSYNC_AES256_BLOCK_SIZE,
                         dst + PSYNC_AES256_BLOCK_SIZE);
 }
 
-void pssl_dec_2blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
+void paes_2blk_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst) {
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE,
                         dst + PSYNC_AES256_BLOCK_SIZE);
 }
 
-void pssl_dec_4blk_xor(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor) {
+void paes_4blk_xor_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor) {
   unsigned long i;
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src, dst);
   mbedtls_aes_crypt_ecb(enc, MBEDTLS_AES_DECRYPT, src + PSYNC_AES256_BLOCK_SIZE,
diff --git a/pclsync/pssl.h b/pclsync/pssl.h
index 0bf3297..961f688 100644
--- a/pclsync/pssl.h
+++ b/pclsync/pssl.h
@@ -33,6 +33,7 @@
 #define _PSYNC_SSL_H
 
 #include <mbedtls/aes.h>
+#include <mbedtls/net_sockets.h>
 #include <mbedtls/rsa.h>
 #include <mbedtls/sha1.h>
 #include <mbedtls/sha256.h>
@@ -95,7 +96,7 @@ extern PSYNC_THREAD int psync_ssl_errno;
 #define PSYNC_SSL_FAIL -1
 #define PSYNC_SSL_SUCCESS 0
 
-#define psync_ssl_alloc_binary_rsa pssl_alloc_symkey
+#define psync_ssl_alloc_binary_rsa psymkey_alloc
 
 typedef struct {
   size_t datalen;
@@ -116,51 +117,61 @@ typedef psync_encrypted_data_t psync_encrypted_symmetric_key_t;
 typedef psync_encrypted_data_t psync_binary_rsa_key_t;
 typedef psync_encrypted_data_t psync_rsa_signature_t;
 
+typedef struct {
+  mbedtls_net_context srv;
+  mbedtls_ssl_context ssl;
+  mbedtls_ssl_config cfg;
+  int sock;
+  int isbroken;
+  char cachekey[];
+} ssl_connection_t;
+
 typedef void (*psync_ssl_debug_callback_t)(void *ctx, int level, const char *msg, int, const char *);
 
-void pssl_set_log_threshold(int threshold);
-void pssl_set_debug_cb(psync_ssl_debug_callback_t cb, void *ctx);
+int pssl_bytes_left(ssl_connection_t *sslconn);
+void pssl_cleanup(void *ptr, size_t len);
+int pssl_close(ssl_connection_t *sslconn);
+void pssl_debug_cb(psync_ssl_debug_callback_t cb, void *ctx);
+int pssl_finish(ssl_connection_t *sslconn, const char *hostname);
+void pssl_free(ssl_connection_t *sslconn);
 int pssl_init();
-void pssl_memclean(void *ptr, size_t len);
-int pssl_connect(int sock, void **sslconn, const char *hostname);
-int pssl_connect_finish(void *sslconn, const char *hostname);
-void pssl_free(void *sslconn);
-int pssl_shutdown(void *sslconn);
-int pssl_pending(void *sslconn);
-int pssl_read(void *sslconn, void *buf, int num);
-int pssl_write(void *sslconn, const void *buf, int num);
-void pssl_rand_strong(unsigned char *buf, int num);
-void pssl_rand_weak(unsigned char *buf, int num);
-psync_rsa_t pssl_rsa_gen(int bits);
-void pssl_rsa_free(psync_rsa_t rsa);
-psync_rsa_publickey_t pssl_rsa_get_pub(psync_rsa_t rsa);
-void pssl_rsa_free_pub(psync_rsa_publickey_t key);
-psync_rsa_privatekey_t pssl_rsa_get_priv(psync_rsa_t rsa);
-void pssl_rsa_free_priv(psync_rsa_privatekey_t key);
-psync_binary_rsa_key_t pssl_rsa_bin_pub(psync_rsa_publickey_t rsa);
-psync_binary_rsa_key_t pssl_rsa_priv_bin(psync_rsa_privatekey_t rsa);
-psync_rsa_publickey_t pssl_rsa_load_pub(const unsigned char *keydata, size_t keylen);
-psync_rsa_privatekey_t pssl_rsa_load_priv(const unsigned char *keydata, size_t keylen);
-void pssl_rsa_bin_free(psync_binary_rsa_key_t bin);
-psync_symmetric_key_t pssl_gen_symkey_pass(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations);
-char *pssl_derive_pwd(const char *username, const char *passphrase);
-psync_encrypted_symmetric_key_t pssl_alloc_symkey(size_t len);
-psync_encrypted_symmetric_key_t pssl_symkey_copy(psync_encrypted_symmetric_key_t src);
-void pssl_symkey_free(psync_symmetric_key_t key);
-psync_encrypted_symmetric_key_t pssl_rsa_encrypt(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen);
-psync_symmetric_key_t pssl_rsa_decrypt(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen);
-psync_encrypted_symmetric_key_t pssl_symkey_encrypt(psync_rsa_publickey_t rsa, const psync_symmetric_key_t key);
-psync_symmetric_key_t pssl_symkey_decrypt(psync_rsa_privatekey_t rsa, const psync_encrypted_symmetric_key_t enckey);
-psync_aes256_encoder pssl_enc_create(psync_symmetric_key_t key);
-void pssl_enc_free(psync_aes256_encoder aes);
-psync_aes256_encoder pssl_dec_create(psync_symmetric_key_t key);
-void pssl_dec_free(psync_aes256_encoder aes);
-psync_rsa_signature_t pssl_sha256_sign(psync_rsa_privatekey_t rsa, const unsigned char *data);
-psync_symmetric_key_t pssl_symkey_decrypt_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey);
-void pssl_enc_blk(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst);
-void pssl_dec_blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
-void pssl_enc_2blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
-void pssl_dec_2blk(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
-void pssl_dec_4blk_xor(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor);
+void pssl_log_level(int threshold);
+int pssl_open(int sock, ssl_connection_t **sslconn, const char *hostname);
+void pssl_random(unsigned char *buf, int num);
+int pssl_read(ssl_connection_t *sslconn, void *buf, int num);
+int pssl_write(ssl_connection_t *sslconn, const void *buf, int num);
+
+// rsa
+void prsa_binary_free(psync_binary_rsa_key_t bin);
+psync_binary_rsa_key_t prsa_binary_private(psync_rsa_privatekey_t rsa);
+psync_binary_rsa_key_t prsa_binary_public(psync_rsa_publickey_t rsa);
+void prsa_free(psync_rsa_t rsa);
+void prsa_free_private(psync_rsa_privatekey_t key);
+void prsa_free_public(psync_rsa_publickey_t key);
+psync_rsa_t prsa_generate(int bits);
+psync_rsa_privatekey_t prsa_get_private(psync_rsa_t rsa);
+psync_rsa_publickey_t prsa_get_public(psync_rsa_t rsa);
+psync_rsa_privatekey_t prsa_load_private(const unsigned char *keydata, size_t keylen);
+psync_rsa_publickey_t prsa_load_public(const unsigned char *keydata, size_t keylen);
+psync_rsa_signature_t prsa_signature(psync_rsa_privatekey_t rsa, const unsigned char *data);
+
+psync_encrypted_symmetric_key_t psymkey_alloc(size_t len);
+psync_encrypted_symmetric_key_t psymkey_copy(psync_encrypted_symmetric_key_t src);
+psync_symmetric_key_t psymkey_decrypt(psync_rsa_privatekey_t rsa, const unsigned char *data, size_t datalen);
+psync_symmetric_key_t psymkey_decrypt_lock(psync_rsa_privatekey_t *rsa, const psync_encrypted_symmetric_key_t *enckey);
+char *psymkey_derive_passphrase(const char *username, const char *passphrase);
+psync_encrypted_symmetric_key_t psymkey_encrypt(psync_rsa_publickey_t rsa, const unsigned char *data, size_t datalen);
+void psymkey_free(psync_symmetric_key_t key);
+psync_symmetric_key_t psymkey_generate_passphrase(const char *password, size_t keylen, const unsigned char *salt, size_t saltlen, size_t iterations);
+
+void paes_2blk_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
+void paes_2blk_encode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
+void paes_4blk_xor_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst, unsigned char *bxor);
+void paes_blk_decode(psync_aes256_decoder enc, const unsigned char *src, unsigned char *dst);
+void paes_blk_encode(psync_aes256_encoder enc, const unsigned char *src, unsigned char *dst);
+psync_aes256_encoder paes_decoder_create(psync_symmetric_key_t key);
+void paes_decoder_free(psync_aes256_encoder aes);
+psync_aes256_encoder paes_encoder_create(psync_symmetric_key_t key);
+void paes_encoder_free(psync_aes256_encoder aes);
 
 #endif
diff --git a/pclsync/psynclib.c b/pclsync/psynclib.c
index f0109a4..5a1a3e5 100644
--- a/pclsync/psynclib.c
+++ b/pclsync/psynclib.c
@@ -230,11 +230,11 @@ static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1,
 
 void psync_set_ssl_debug_callback(psync_ssl_debug_callback_t cb) {
   if (cb) {
-    pssl_set_log_threshold(PSYNC_SSL_DEBUG_LEVEL);
-    pssl_set_debug_cb(cb, NULL);
+    pssl_log_level(PSYNC_SSL_DEBUG_LEVEL);
+    pssl_debug_cb(cb, NULL);
   } else {
-    pssl_set_log_threshold(0);
-    pssl_set_debug_cb(NULL, NULL);
+    pssl_log_level(0);
+    pssl_debug_cb(NULL, NULL);
   }
 }
 
@@ -2182,7 +2182,7 @@ int psync_password_quality10000(const char *password) {
 
 char *psync_derive_password_from_passphrase(const char *username,
                                             const char *passphrase) {
-  return pssl_derive_pwd(username, passphrase);
+  return psymkey_derive_passphrase(username, passphrase);
 }
 
 int psync_crypto_setup(const char *password, const char *hint) {