diff --git a/commonspace/object/acl/aclrecordproto/aclrecord.pb.go b/commonspace/object/acl/aclrecordproto/aclrecord.pb.go
index 3a25533b..c77e7818 100644
--- a/commonspace/object/acl/aclrecordproto/aclrecord.pb.go
+++ b/commonspace/object/acl/aclrecordproto/aclrecord.pb.go
@@ -171,11 +171,11 @@ func (m *RawAclRecordWithId) GetId() string {
 }
 
 type AclRecord struct {
-	PrevId             string `protobuf:"bytes,1,opt,name=prevId,proto3" json:"prevId,omitempty"`
-	Identity           []byte `protobuf:"bytes,2,opt,name=identity,proto3" json:"identity,omitempty"`
-	Data               []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
-	CurrentReadKeyHash uint64 `protobuf:"varint,4,opt,name=currentReadKeyHash,proto3" json:"currentReadKeyHash,omitempty"`
-	Timestamp          int64  `protobuf:"varint,5,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	PrevId    string `protobuf:"bytes,1,opt,name=prevId,proto3" json:"prevId,omitempty"`
+	Identity  []byte `protobuf:"bytes,2,opt,name=identity,proto3" json:"identity,omitempty"`
+	Data      []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
+	ReadKeyId string `protobuf:"bytes,4,opt,name=readKeyId,proto3" json:"readKeyId,omitempty"`
+	Timestamp int64  `protobuf:"varint,5,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 }
 
 func (m *AclRecord) Reset()         { *m = AclRecord{} }
@@ -232,11 +232,11 @@ func (m *AclRecord) GetData() []byte {
 	return nil
 }
 
-func (m *AclRecord) GetCurrentReadKeyHash() uint64 {
+func (m *AclRecord) GetReadKeyId() string {
 	if m != nil {
-		return m.CurrentReadKeyHash
+		return m.ReadKeyId
 	}
-	return 0
+	return ""
 }
 
 func (m *AclRecord) GetTimestamp() int64 {
@@ -248,12 +248,11 @@ func (m *AclRecord) GetTimestamp() int64 {
 
 type AclRoot struct {
 	Identity           []byte `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
-	EncryptionKey      []byte `protobuf:"bytes,2,opt,name=encryptionKey,proto3" json:"encryptionKey,omitempty"`
-	SpaceId            string `protobuf:"bytes,3,opt,name=spaceId,proto3" json:"spaceId,omitempty"`
-	EncryptedReadKey   []byte `protobuf:"bytes,4,opt,name=encryptedReadKey,proto3" json:"encryptedReadKey,omitempty"`
-	DerivationScheme   string `protobuf:"bytes,5,opt,name=derivationScheme,proto3" json:"derivationScheme,omitempty"`
-	CurrentReadKeyHash uint64 `protobuf:"varint,6,opt,name=currentReadKeyHash,proto3" json:"currentReadKeyHash,omitempty"`
-	Timestamp          int64  `protobuf:"varint,7,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	SpaceId            string `protobuf:"bytes,2,opt,name=spaceId,proto3" json:"spaceId,omitempty"`
+	EncryptedReadKey   []byte `protobuf:"bytes,3,opt,name=encryptedReadKey,proto3" json:"encryptedReadKey,omitempty"`
+	DerivationScheme   string `protobuf:"bytes,4,opt,name=derivationScheme,proto3" json:"derivationScheme,omitempty"`
+	CurrentReadKeyHash uint64 `protobuf:"varint,5,opt,name=currentReadKeyHash,proto3" json:"currentReadKeyHash,omitempty"`
+	Timestamp          int64  `protobuf:"varint,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 }
 
 func (m *AclRoot) Reset()         { *m = AclRoot{} }
@@ -296,13 +295,6 @@ func (m *AclRoot) GetIdentity() []byte {
 	return nil
 }
 
-func (m *AclRoot) GetEncryptionKey() []byte {
-	if m != nil {
-		return m.EncryptionKey
-	}
-	return nil
-}
-
 func (m *AclRoot) GetSpaceId() string {
 	if m != nil {
 		return m.SpaceId
@@ -508,9 +500,9 @@ func (m *AclData) GetAclContent() []*AclContentValue {
 }
 
 type AclState struct {
-	ReadKeyHashes []uint64                  `protobuf:"varint,1,rep,packed,name=readKeyHashes,proto3" json:"readKeyHashes,omitempty"`
-	UserStates    []*AclUserState           `protobuf:"bytes,2,rep,name=userStates,proto3" json:"userStates,omitempty"`
-	Invites       map[string]*AclUserInvite `protobuf:"bytes,3,rep,name=invites,proto3" json:"invites,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ReadKeyIds []string                  `protobuf:"bytes,1,rep,name=readKeyIds,proto3" json:"readKeyIds,omitempty"`
+	UserStates []*AclUserState           `protobuf:"bytes,2,rep,name=userStates,proto3" json:"userStates,omitempty"`
+	Invites    map[string]*AclUserInvite `protobuf:"bytes,3,rep,name=invites,proto3" json:"invites,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 }
 
 func (m *AclState) Reset()         { *m = AclState{} }
@@ -546,9 +538,9 @@ func (m *AclState) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_AclState proto.InternalMessageInfo
 
-func (m *AclState) GetReadKeyHashes() []uint64 {
+func (m *AclState) GetReadKeyIds() []string {
 	if m != nil {
-		return m.ReadKeyHashes
+		return m.ReadKeyIds
 	}
 	return nil
 }
@@ -568,9 +560,8 @@ func (m *AclState) GetInvites() map[string]*AclUserInvite {
 }
 
 type AclUserState struct {
-	Identity      []byte             `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
-	EncryptionKey []byte             `protobuf:"bytes,2,opt,name=encryptionKey,proto3" json:"encryptionKey,omitempty"`
-	Permissions   AclUserPermissions `protobuf:"varint,3,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
+	Identity    []byte             `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
+	Permissions AclUserPermissions `protobuf:"varint,2,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
 }
 
 func (m *AclUserState) Reset()         { *m = AclUserState{} }
@@ -613,13 +604,6 @@ func (m *AclUserState) GetIdentity() []byte {
 	return nil
 }
 
-func (m *AclUserState) GetEncryptionKey() []byte {
-	if m != nil {
-		return m.EncryptionKey
-	}
-	return nil
-}
-
 func (m *AclUserState) GetPermissions() AclUserPermissions {
 	if m != nil {
 		return m.Permissions
@@ -629,9 +613,8 @@ func (m *AclUserState) GetPermissions() AclUserPermissions {
 
 type AclUserAdd struct {
 	Identity          []byte             `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
-	EncryptionKey     []byte             `protobuf:"bytes,2,opt,name=encryptionKey,proto3" json:"encryptionKey,omitempty"`
-	EncryptedReadKeys [][]byte           `protobuf:"bytes,3,rep,name=encryptedReadKeys,proto3" json:"encryptedReadKeys,omitempty"`
-	Permissions       AclUserPermissions `protobuf:"varint,4,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
+	EncryptedReadKeys [][]byte           `protobuf:"bytes,2,rep,name=encryptedReadKeys,proto3" json:"encryptedReadKeys,omitempty"`
+	Permissions       AclUserPermissions `protobuf:"varint,3,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
 }
 
 func (m *AclUserAdd) Reset()         { *m = AclUserAdd{} }
@@ -674,13 +657,6 @@ func (m *AclUserAdd) GetIdentity() []byte {
 	return nil
 }
 
-func (m *AclUserAdd) GetEncryptionKey() []byte {
-	if m != nil {
-		return m.EncryptionKey
-	}
-	return nil
-}
-
 func (m *AclUserAdd) GetEncryptedReadKeys() [][]byte {
 	if m != nil {
 		return m.EncryptedReadKeys
@@ -697,9 +673,8 @@ func (m *AclUserAdd) GetPermissions() AclUserPermissions {
 
 type AclUserInvite struct {
 	AcceptPublicKey   []byte             `protobuf:"bytes,1,opt,name=acceptPublicKey,proto3" json:"acceptPublicKey,omitempty"`
-	EncryptSymKeyHash uint64             `protobuf:"varint,2,opt,name=encryptSymKeyHash,proto3" json:"encryptSymKeyHash,omitempty"`
-	EncryptedReadKeys [][]byte           `protobuf:"bytes,3,rep,name=encryptedReadKeys,proto3" json:"encryptedReadKeys,omitempty"`
-	Permissions       AclUserPermissions `protobuf:"varint,4,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
+	EncryptedReadKeys [][]byte           `protobuf:"bytes,2,rep,name=encryptedReadKeys,proto3" json:"encryptedReadKeys,omitempty"`
+	Permissions       AclUserPermissions `protobuf:"varint,3,opt,name=permissions,proto3,enum=aclrecord.AclUserPermissions" json:"permissions,omitempty"`
 }
 
 func (m *AclUserInvite) Reset()         { *m = AclUserInvite{} }
@@ -742,13 +717,6 @@ func (m *AclUserInvite) GetAcceptPublicKey() []byte {
 	return nil
 }
 
-func (m *AclUserInvite) GetEncryptSymKeyHash() uint64 {
-	if m != nil {
-		return m.EncryptSymKeyHash
-	}
-	return 0
-}
-
 func (m *AclUserInvite) GetEncryptedReadKeys() [][]byte {
 	if m != nil {
 		return m.EncryptedReadKeys
@@ -893,8 +861,7 @@ func (m *AclUserRemove) GetReadKeyReplaces() []*AclReadKeyReplace {
 
 type AclReadKeyReplace struct {
 	Identity         []byte `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
-	EncryptionKey    []byte `protobuf:"bytes,2,opt,name=encryptionKey,proto3" json:"encryptionKey,omitempty"`
-	EncryptedReadKey []byte `protobuf:"bytes,3,opt,name=encryptedReadKey,proto3" json:"encryptedReadKey,omitempty"`
+	EncryptedReadKey []byte `protobuf:"bytes,2,opt,name=encryptedReadKey,proto3" json:"encryptedReadKey,omitempty"`
 }
 
 func (m *AclReadKeyReplace) Reset()         { *m = AclReadKeyReplace{} }
@@ -937,13 +904,6 @@ func (m *AclReadKeyReplace) GetIdentity() []byte {
 	return nil
 }
 
-func (m *AclReadKeyReplace) GetEncryptionKey() []byte {
-	if m != nil {
-		return m.EncryptionKey
-	}
-	return nil
-}
-
 func (m *AclReadKeyReplace) GetEncryptedReadKey() []byte {
 	if m != nil {
 		return m.EncryptedReadKey
@@ -1004,7 +964,7 @@ func (m *AclUserPermissionChange) GetPermissions() AclUserPermissions {
 }
 
 type AclSyncMessage struct {
-	Content *AclSyncContentValue `protobuf:"bytes,2,opt,name=content,proto3" json:"content,omitempty"`
+	Content *AclSyncContentValue `protobuf:"bytes,1,opt,name=content,proto3" json:"content,omitempty"`
 }
 
 func (m *AclSyncMessage) Reset()         { *m = AclSyncMessage{} }
@@ -1192,68 +1152,66 @@ func init() {
 }
 
 var fileDescriptor_c8e9f754f34e929b = []byte{
-	// 962 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0xcf, 0x6f, 0x1b, 0xc5,
-	0x17, 0xf7, 0xac, 0x9d, 0x38, 0x7e, 0x76, 0x13, 0x67, 0xbe, 0x5f, 0x5a, 0x2b, 0x2a, 0x56, 0xb4,
-	0x02, 0x29, 0xaa, 0x2a, 0x47, 0x18, 0xa4, 0x54, 0x11, 0xa2, 0x72, 0x4b, 0x91, 0xdd, 0x08, 0xa9,
-	0x9a, 0x00, 0x45, 0xbd, 0x4d, 0x66, 0x47, 0xc9, 0xc2, 0xfe, 0xd2, 0xcc, 0xd8, 0x68, 0x8f, 0x9c,
-	0xb9, 0xc0, 0x7f, 0x00, 0x7f, 0x08, 0x77, 0x24, 0x2e, 0xbd, 0x80, 0x38, 0xa2, 0xe4, 0xcf, 0xe0,
-	0x82, 0x66, 0xf6, 0xf7, 0xae, 0x13, 0xb5, 0x52, 0xc4, 0x21, 0xc9, 0xcc, 0x7b, 0x9f, 0x37, 0xf9,
-	0xbc, 0xcf, 0x7b, 0xf3, 0x66, 0xe1, 0x63, 0x16, 0xfa, 0x7e, 0x18, 0xc8, 0x88, 0x32, 0x7e, 0x18,
-	0x9e, 0x7d, 0xc3, 0x99, 0x3a, 0xa4, 0xcc, 0xd3, 0x3f, 0x82, 0xb3, 0x50, 0x38, 0x91, 0x08, 0x55,
-	0x78, 0x68, 0x7e, 0xcb, 0xc2, 0x3a, 0x31, 0x06, 0xdc, 0xcb, 0x0d, 0xf6, 0xcf, 0x08, 0x06, 0x84,
-	0x7e, 0x37, 0x63, 0x1e, 0x31, 0x06, 0x3c, 0x82, 0x6e, 0x44, 0x63, 0x2f, 0xa4, 0xce, 0x08, 0xed,
-	0xa3, 0x83, 0x01, 0xc9, 0xb6, 0xf8, 0x3e, 0xf4, 0xa4, 0x7b, 0x1e, 0x50, 0xb5, 0x14, 0x7c, 0x64,
-	0x19, 0x5f, 0x61, 0xc0, 0x0f, 0x60, 0x48, 0x19, 0xe3, 0x91, 0x0a, 0xc5, 0xc2, 0xe1, 0x81, 0x72,
-	0x55, 0x3c, 0x6a, 0x1b, 0x50, 0xc3, 0x8e, 0x1f, 0xc2, 0x6e, 0x66, 0x3b, 0xcd, 0x4f, 0xec, 0x18,
-	0x70, 0xd3, 0x61, 0x7f, 0x02, 0xb8, 0xcc, 0xf0, 0xa5, 0xab, 0x2e, 0x16, 0x37, 0xf1, 0xdc, 0x06,
-	0xcb, 0x75, 0x0c, 0xc1, 0x1e, 0xb1, 0x5c, 0xc7, 0xfe, 0x05, 0x41, 0xaf, 0xc8, 0xef, 0x2e, 0x6c,
-	0x46, 0x82, 0xaf, 0x16, 0x49, 0x58, 0x8f, 0xa4, 0x3b, 0xbc, 0x07, 0x5b, 0x6e, 0xc6, 0x3b, 0x49,
-	0x2e, 0xdf, 0x63, 0x0c, 0x1d, 0x87, 0x2a, 0x9a, 0xe6, 0x63, 0xd6, 0x78, 0x02, 0x98, 0x2d, 0x85,
-	0xe0, 0x81, 0x22, 0x9c, 0x3a, 0x27, 0x3c, 0x9e, 0x53, 0x79, 0x61, 0x92, 0xe8, 0x90, 0x35, 0x1e,
-	0xad, 0x9e, 0x72, 0x7d, 0x2e, 0x15, 0xf5, 0xa3, 0xd1, 0xc6, 0x3e, 0x3a, 0x68, 0x93, 0xc2, 0x60,
-	0xff, 0x60, 0x41, 0x57, 0x73, 0x0c, 0x43, 0x55, 0x61, 0x82, 0x6a, 0x4c, 0xde, 0x83, 0x3b, 0x3c,
-	0x60, 0x22, 0x8e, 0x94, 0x1b, 0x06, 0x27, 0x3c, 0xa3, 0x5a, 0x35, 0x6a, 0x6d, 0x4c, 0x67, 0x2c,
-	0x1c, 0x43, 0xb9, 0x47, 0xb2, 0xad, 0xae, 0x52, 0x0a, 0xe5, 0x4e, 0xca, 0x2e, 0x15, 0xbe, 0x61,
-	0xd7, 0x58, 0x87, 0x0b, 0x77, 0x45, 0xf5, 0xb1, 0xa7, 0xec, 0x82, 0xfb, 0xdc, 0x10, 0xef, 0x91,
-	0x86, 0xfd, 0x1a, 0x35, 0x36, 0xdf, 0x4c, 0x8d, 0x6e, 0x5d, 0x8d, 0x3f, 0x2c, 0xd8, 0x99, 0x31,
-	0xef, 0x69, 0x18, 0x28, 0x1e, 0xa8, 0xaf, 0xa8, 0xb7, 0xe4, 0xf8, 0x03, 0xe8, 0x2e, 0x25, 0x17,
-	0x33, 0x27, 0x29, 0x5c, 0x7f, 0xfa, 0xce, 0xa4, 0x68, 0xeb, 0x19, 0xf3, 0xbe, 0x4c, 0x9c, 0xf3,
-	0x16, 0xc9, 0x70, 0xf8, 0x18, 0x40, 0x2f, 0x09, 0xf7, 0xc3, 0x55, 0xd2, 0xb1, 0xfd, 0xe9, 0xa8,
-	0x19, 0x95, 0xf8, 0xe7, 0x2d, 0x52, 0x42, 0xe3, 0xaf, 0xe1, 0xff, 0x7a, 0xf7, 0x82, 0x0b, 0xdf,
-	0x95, 0xd2, 0x0d, 0x83, 0xa7, 0x17, 0x34, 0x38, 0xe7, 0x46, 0xcf, 0xfe, 0xd4, 0x6e, 0x9e, 0x52,
-	0x47, 0xce, 0x5b, 0x64, 0xed, 0x09, 0x19, 0xab, 0x45, 0xb0, 0x72, 0x55, 0xd2, 0xf5, 0x6b, 0x59,
-	0x25, 0xfe, 0x8c, 0x55, 0xb2, 0xc3, 0x1f, 0xc1, 0x96, 0xde, 0x3d, 0x0f, 0xdd, 0xc0, 0x94, 0xa2,
-	0x3f, 0xbd, 0xdb, 0x8c, 0xd4, 0xde, 0x79, 0x8b, 0xe4, 0xc8, 0x27, 0x5d, 0xd8, 0x58, 0x69, 0x0d,
-	0xed, 0x67, 0xa6, 0xc9, 0x3e, 0xd5, 0xed, 0x7b, 0x0c, 0x40, 0x73, 0x85, 0x47, 0x68, 0xbf, 0x7d,
-	0xd0, 0x9f, 0xee, 0x55, 0xcf, 0x2a, 0xcb, 0x4f, 0x4a, 0x68, 0xfb, 0x1f, 0x04, 0x5b, 0x33, 0xe6,
-	0x9d, 0x2a, 0xaa, 0xb8, 0xee, 0x48, 0x51, 0x14, 0x96, 0x4b, 0x73, 0x56, 0x87, 0x54, 0x8d, 0xf8,
-	0x28, 0x49, 0xda, 0x84, 0xc8, 0x91, 0x65, 0xfe, 0xdd, 0xbd, 0x26, 0x75, 0xe3, 0x27, 0x25, 0x28,
-	0x3e, 0x86, 0xae, 0x6b, 0x72, 0x97, 0xa3, 0xb6, 0x89, 0xda, 0xaf, 0x46, 0x19, 0xd8, 0x24, 0x91,
-	0x47, 0x3e, 0x0b, 0x94, 0x88, 0x49, 0x16, 0xb0, 0xf7, 0x05, 0x0c, 0xca, 0x0e, 0x3c, 0x84, 0xf6,
-	0xb7, 0x3c, 0x4e, 0xef, 0xbd, 0x5e, 0xe2, 0x49, 0xaa, 0xcc, 0xf5, 0xcd, 0x91, 0x1c, 0x40, 0x12,
-	0xd8, 0xb1, 0xf5, 0x08, 0xd9, 0x3f, 0x21, 0x18, 0x94, 0xe9, 0xde, 0xc2, 0x7d, 0x7d, 0x0c, 0xfd,
-	0x28, 0x6f, 0x13, 0x69, 0x7a, 0x6c, 0x7b, 0xfa, 0xee, 0x4d, 0x3d, 0x26, 0x49, 0x39, 0xc2, 0xfe,
-	0x15, 0x01, 0x14, 0x77, 0xe0, 0x16, 0x18, 0x3d, 0x84, 0xdd, 0xfa, 0x3c, 0x48, 0x0a, 0x30, 0x20,
-	0x4d, 0x47, 0x9d, 0x7f, 0xe7, 0xad, 0xf9, 0xff, 0x89, 0xe0, 0x4e, 0x45, 0x70, 0x7c, 0x00, 0x3b,
-	0xc9, 0x4b, 0xf0, 0x62, 0x79, 0xe6, 0xb9, 0xec, 0x84, 0x67, 0x99, 0xd4, 0xcd, 0x25, 0xaa, 0xa7,
-	0xb1, 0x9f, 0x4d, 0x1e, 0xcb, 0x4c, 0x9e, 0xa6, 0xe3, 0xbf, 0x4e, 0xec, 0x77, 0x04, 0xfd, 0xd2,
-	0xb5, 0xbc, 0x85, 0xca, 0xe4, 0xc2, 0x14, 0x2f, 0x67, 0xbb, 0x2c, 0x4c, 0x6e, 0xc6, 0x36, 0x0c,
-	0x72, 0xad, 0x8a, 0x39, 0x5f, 0xb1, 0xad, 0x97, 0x63, 0xe3, 0x1a, 0x39, 0x6c, 0x99, 0x57, 0x29,
-	0x9d, 0x92, 0x37, 0xa5, 0xf3, 0x19, 0xec, 0xa4, 0x33, 0x80, 0xf0, 0xc8, 0xa3, 0x2c, 0xbf, 0xf7,
-	0xf7, 0xab, 0xfa, 0x91, 0x0a, 0x88, 0xd4, 0x83, 0xec, 0xef, 0x11, 0xec, 0x36, 0x60, 0xb7, 0x20,
-	0xe4, 0xba, 0xa7, 0xb0, 0xbd, 0xfe, 0x29, 0xb4, 0x57, 0x70, 0xef, 0x9a, 0x31, 0x7f, 0x23, 0x91,
-	0x5a, 0xfb, 0x58, 0x6f, 0xdd, 0x3e, 0xcf, 0x61, 0x5b, 0xcf, 0xb8, 0x38, 0x60, 0x9f, 0x73, 0x29,
-	0xe9, 0x39, 0xc7, 0x8f, 0xa0, 0xcb, 0xd2, 0xa1, 0x9d, 0xcc, 0xac, 0x71, 0x6d, 0x1e, 0xc6, 0x01,
-	0xab, 0x0c, 0xee, 0x0c, 0x6e, 0xbf, 0x82, 0xff, 0xad, 0xf1, 0x9b, 0x87, 0xc0, 0x71, 0x92, 0x8f,
-	0x23, 0x99, 0x3e, 0xad, 0xb5, 0x39, 0x38, 0xcb, 0xfd, 0xfa, 0x39, 0x2a, 0xd0, 0xc5, 0xc3, 0x32,
-	0x37, 0x8d, 0x51, 0xe0, 0xf0, 0x11, 0x74, 0x45, 0x7e, 0xa4, 0x2e, 0x7a, 0x39, 0xeb, 0xe6, 0xd7,
-	0x1c, 0xc9, 0xd0, 0x0f, 0x8e, 0x00, 0x37, 0x45, 0xc1, 0x3d, 0xd8, 0x98, 0x39, 0xbe, 0x1b, 0x0c,
-	0x5b, 0x18, 0x60, 0xf3, 0xa5, 0x70, 0x15, 0x17, 0x43, 0xa4, 0xd7, 0xba, 0x42, 0x5c, 0x0c, 0xad,
-	0x27, 0x8f, 0x7f, 0xbb, 0x1c, 0xa3, 0xd7, 0x97, 0x63, 0xf4, 0xf7, 0xe5, 0x18, 0xfd, 0x78, 0x35,
-	0x6e, 0xbd, 0xbe, 0x1a, 0xb7, 0xfe, 0xba, 0x1a, 0xb7, 0x5e, 0xbd, 0xff, 0x46, 0xdf, 0xca, 0x67,
-	0x9b, 0xe6, 0xcf, 0x87, 0xff, 0x06, 0x00, 0x00, 0xff, 0xff, 0x3e, 0xd9, 0x79, 0xd5, 0x5b, 0x0b,
-	0x00, 0x00,
+	// 943 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0x4f, 0x6f, 0x1b, 0x45,
+	0x14, 0xf7, 0xda, 0x49, 0x1c, 0x3f, 0xbb, 0x89, 0x33, 0x40, 0xbb, 0x8a, 0x8a, 0x15, 0xad, 0x40,
+	0x8a, 0xaa, 0xca, 0x11, 0x06, 0x29, 0x55, 0x84, 0xa8, 0xdc, 0x52, 0x64, 0xb7, 0x42, 0xaa, 0x26,
+	0x40, 0x51, 0x39, 0x4d, 0x66, 0x47, 0xf1, 0xd0, 0xf5, 0xee, 0x6a, 0x66, 0x6c, 0xe4, 0x4f, 0x01,
+	0x37, 0xae, 0x1c, 0xf9, 0x28, 0x48, 0x5c, 0x72, 0x41, 0xe2, 0x88, 0x12, 0xf1, 0x11, 0xb8, 0xa3,
+	0x99, 0xd9, 0xff, 0xeb, 0x58, 0x70, 0x80, 0x43, 0xe2, 0x9d, 0xf7, 0x7e, 0xef, 0xcd, 0xef, 0xfd,
+	0xe6, 0xcd, 0xdb, 0x85, 0x8f, 0x69, 0x34, 0x9f, 0x47, 0xa1, 0x8c, 0x09, 0x65, 0x27, 0xd1, 0xc5,
+	0xb7, 0x8c, 0xaa, 0x13, 0x42, 0x03, 0xfd, 0x27, 0x18, 0x8d, 0x84, 0x1f, 0x8b, 0x48, 0x45, 0x27,
+	0xe6, 0xbf, 0xcc, 0xad, 0x43, 0x63, 0x40, 0x9d, 0xcc, 0xe0, 0xfd, 0xe4, 0x40, 0x0f, 0x93, 0xef,
+	0xc6, 0x34, 0xc0, 0xc6, 0x80, 0x5c, 0x68, 0xc7, 0x64, 0x15, 0x44, 0xc4, 0x77, 0x9d, 0x23, 0xe7,
+	0xb8, 0x87, 0xd3, 0x25, 0xba, 0x0f, 0x1d, 0xc9, 0x2f, 0x43, 0xa2, 0x16, 0x82, 0xb9, 0x4d, 0xe3,
+	0xcb, 0x0d, 0xe8, 0x01, 0xf4, 0x09, 0xa5, 0x2c, 0x56, 0x91, 0x98, 0xfa, 0x2c, 0x54, 0x5c, 0xad,
+	0xdc, 0x96, 0x01, 0xd5, 0xec, 0xe8, 0x21, 0x1c, 0xa4, 0xb6, 0xf3, 0x2c, 0xe3, 0x96, 0x01, 0xd7,
+	0x1d, 0xde, 0x27, 0x80, 0x8a, 0x0c, 0x5f, 0x71, 0x35, 0x9b, 0x6e, 0xe2, 0xb9, 0x07, 0x4d, 0xee,
+	0x1b, 0x82, 0x1d, 0xdc, 0xe4, 0xbe, 0xf7, 0xbd, 0x03, 0x9d, 0xbc, 0xbe, 0xbb, 0xb0, 0x13, 0x0b,
+	0xb6, 0x9c, 0xda, 0xb0, 0x0e, 0x4e, 0x56, 0xe8, 0x10, 0x76, 0x79, 0xca, 0xdb, 0x16, 0x97, 0xad,
+	0x11, 0x82, 0x2d, 0x9f, 0x28, 0x92, 0xd4, 0x63, 0x9e, 0xb5, 0x1a, 0x82, 0x11, 0xff, 0x05, 0x5b,
+	0x4d, 0x7d, 0xc3, 0xbd, 0x83, 0x73, 0x83, 0xf6, 0x2a, 0x3e, 0x67, 0x52, 0x91, 0x79, 0xec, 0x6e,
+	0x1f, 0x39, 0xc7, 0x2d, 0x9c, 0x1b, 0xbc, 0x3f, 0x1d, 0x68, 0x6b, 0x46, 0x51, 0xa4, 0x4a, 0xfb,
+	0x3a, 0x95, 0x7d, 0x5d, 0x68, 0x9b, 0x13, 0x9e, 0xa6, 0xe5, 0xa4, 0x4b, 0xad, 0x36, 0x0b, 0xa9,
+	0x58, 0xc5, 0x8a, 0xf9, 0xd8, 0xee, 0x9a, 0xaa, 0x5d, 0xb5, 0x6b, 0xac, 0xcf, 0x04, 0x5f, 0x12,
+	0xc5, 0xa3, 0xf0, 0x9c, 0xce, 0xd8, 0x9c, 0x25, 0x84, 0x6b, 0x76, 0x34, 0x04, 0x44, 0x17, 0x42,
+	0xb0, 0x50, 0x25, 0xd1, 0x13, 0x22, 0x67, 0xa6, 0x80, 0x2d, 0xbc, 0xc6, 0x53, 0xae, 0x73, 0xa7,
+	0x5a, 0xe7, 0x6f, 0x4d, 0xd8, 0x1f, 0xd3, 0xe0, 0x69, 0x14, 0x2a, 0x16, 0xaa, 0xaf, 0x48, 0xb0,
+	0x60, 0xe8, 0x03, 0x68, 0x2f, 0x24, 0x13, 0x63, 0xdf, 0x1e, 0x40, 0x77, 0xf4, 0xce, 0x30, 0x6f,
+	0xcf, 0x31, 0x0d, 0xbe, 0xb4, 0xce, 0x49, 0x03, 0xa7, 0x38, 0x74, 0x06, 0xa0, 0x1f, 0x31, 0x9b,
+	0x47, 0x4b, 0xdb, 0x79, 0xdd, 0x91, 0x5b, 0x8f, 0xb2, 0xfe, 0x49, 0x03, 0x17, 0xd0, 0xe8, 0x6b,
+	0x78, 0x5b, 0xaf, 0x5e, 0x32, 0x31, 0xe7, 0x52, 0xf2, 0x28, 0x7c, 0x3a, 0x23, 0xe1, 0x25, 0x33,
+	0x62, 0x75, 0x47, 0x5e, 0x3d, 0x4b, 0x15, 0x39, 0x69, 0xe0, 0xb5, 0x19, 0x52, 0x56, 0xd3, 0x70,
+	0xc9, 0x95, 0x15, 0x74, 0x2d, 0x2b, 0xeb, 0x4f, 0x59, 0xd9, 0x15, 0xfa, 0x08, 0x76, 0xf5, 0xea,
+	0x79, 0xc4, 0x43, 0x23, 0x6e, 0x77, 0x74, 0xb7, 0x1e, 0xa9, 0xbd, 0x93, 0x06, 0xce, 0x90, 0x4f,
+	0xda, 0xb0, 0xbd, 0xd4, 0x1a, 0x7a, 0xcf, 0x4c, 0xfb, 0x7c, 0xaa, 0xdb, 0xf0, 0x0c, 0x80, 0x64,
+	0x0a, 0xbb, 0xce, 0x51, 0xeb, 0xb8, 0x3b, 0x3a, 0x2c, 0xe7, 0x2a, 0xca, 0x8f, 0x0b, 0x68, 0xef,
+	0x2f, 0x07, 0x76, 0xc7, 0x34, 0x38, 0x57, 0x44, 0x31, 0x34, 0x00, 0xc8, 0xda, 0x57, 0x9a, 0x44,
+	0x1d, 0x5c, 0xb0, 0xa0, 0x53, 0x5b, 0xae, 0x01, 0x4b, 0xb7, 0x69, 0x36, 0xba, 0x57, 0x27, 0x6d,
+	0xfc, 0xb8, 0x00, 0x45, 0x67, 0xd0, 0xe6, 0xa6, 0x6a, 0xe9, 0xb6, 0x4c, 0xd4, 0x51, 0x39, 0xca,
+	0xc0, 0x86, 0x56, 0x18, 0xf9, 0x2c, 0x54, 0x62, 0x85, 0xd3, 0x80, 0xc3, 0x2f, 0xa0, 0x57, 0x74,
+	0xa0, 0x3e, 0xb4, 0xde, 0xb0, 0x55, 0x72, 0x73, 0xf5, 0x23, 0x1a, 0x26, 0x9a, 0xdc, 0xde, 0x16,
+	0x36, 0x01, 0xb6, 0xb0, 0xb3, 0xe6, 0x23, 0xc7, 0x7b, 0x03, 0xbd, 0x22, 0xdb, 0x8d, 0x57, 0xf0,
+	0x31, 0x74, 0xe3, 0xec, 0xe4, 0xa5, 0xd9, 0x65, 0x6f, 0xf4, 0xee, 0xa6, 0xb6, 0x91, 0xb8, 0x18,
+	0xe1, 0xfd, 0xe8, 0x00, 0xe4, 0x6d, 0xbd, 0x71, 0xaf, 0x87, 0x70, 0x50, 0xbd, 0xbc, 0x56, 0xe9,
+	0x1e, 0xae, 0x3b, 0xaa, 0xcc, 0x5a, 0xff, 0x9a, 0xd9, 0xcf, 0x0e, 0xdc, 0x29, 0x69, 0x84, 0x8e,
+	0x61, 0xdf, 0x8e, 0xdf, 0x97, 0x8b, 0x8b, 0x80, 0xd3, 0x17, 0x2c, 0xe5, 0x58, 0x35, 0xff, 0xdf,
+	0x54, 0x7f, 0x75, 0xa0, 0x5b, 0xb8, 0x15, 0x1b, 0x55, 0x7c, 0x0f, 0xee, 0x24, 0x0c, 0x78, 0x14,
+	0xea, 0x12, 0xec, 0x34, 0x2f, 0x1b, 0xf3, 0x52, 0xf3, 0x17, 0x50, 0xab, 0x58, 0x6a, 0x66, 0x46,
+	0x1e, 0xf4, 0xb2, 0xea, 0x75, 0x3a, 0xfb, 0x9e, 0x2a, 0xd9, 0xd6, 0xcb, 0xb1, 0x7d, 0x8b, 0x1c,
+	0x9e, 0xcc, 0x74, 0x4f, 0x86, 0xd4, 0xa6, 0x72, 0x3e, 0x83, 0xfd, 0xe4, 0x16, 0x62, 0x16, 0x07,
+	0x84, 0x66, 0x97, 0xef, 0x7e, 0x59, 0x3f, 0x5c, 0x02, 0xe1, 0x6a, 0x90, 0xf7, 0x0d, 0x1c, 0xd4,
+	0x50, 0x1b, 0x37, 0x5e, 0xf7, 0x8a, 0x69, 0xae, 0x7f, 0xc5, 0x78, 0x4b, 0xb8, 0x77, 0xcb, 0xf8,
+	0xfc, 0x6f, 0x2f, 0xd7, 0x73, 0xd8, 0xd3, 0x13, 0x64, 0x15, 0xd2, 0xcf, 0x99, 0x94, 0xe4, 0x92,
+	0xa1, 0x47, 0xd0, 0xa6, 0xd9, 0x30, 0xd4, 0x13, 0x61, 0x50, 0x99, 0x36, 0xab, 0x90, 0x96, 0x06,
+	0x62, 0x0a, 0xf7, 0x5e, 0xc3, 0x5b, 0x6b, 0xfc, 0x66, 0xc0, 0xfa, 0xbe, 0xfd, 0x78, 0x90, 0x49,
+	0xce, 0xca, 0x94, 0x19, 0x67, 0x7e, 0x3d, 0xe6, 0x73, 0x74, 0x3e, 0xb0, 0x27, 0xe6, 0xc4, 0x73,
+	0x1c, 0x3a, 0x85, 0xb6, 0xc8, 0x52, 0xea, 0xd3, 0x2c, 0x56, 0x5d, 0xff, 0xda, 0xc1, 0x29, 0xfa,
+	0xc1, 0x29, 0xa0, 0xba, 0x28, 0xa8, 0x03, 0xdb, 0x63, 0x7f, 0xce, 0xc3, 0x7e, 0x03, 0x01, 0xec,
+	0xbc, 0x12, 0x5c, 0x31, 0xd1, 0x77, 0xf4, 0xb3, 0x3e, 0x21, 0x26, 0xfa, 0xcd, 0x27, 0x8f, 0x7f,
+	0xb9, 0x1e, 0x38, 0x57, 0xd7, 0x03, 0xe7, 0x8f, 0xeb, 0x81, 0xf3, 0xc3, 0xcd, 0xa0, 0x71, 0x75,
+	0x33, 0x68, 0xfc, 0x7e, 0x33, 0x68, 0xbc, 0x7e, 0xff, 0x1f, 0x7d, 0x4b, 0x5e, 0xec, 0x98, 0x9f,
+	0x0f, 0xff, 0x0e, 0x00, 0x00, 0xff, 0xff, 0xca, 0x88, 0xea, 0x1c, 0x7b, 0x0a, 0x00, 0x00,
 }
 
 func (m *RawAclRecord) Marshal() (dAtA []byte, err error) {
@@ -1369,10 +1327,12 @@ func (m *AclRecord) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x28
 	}
-	if m.CurrentReadKeyHash != 0 {
-		i = encodeVarintAclrecord(dAtA, i, uint64(m.CurrentReadKeyHash))
+	if len(m.ReadKeyId) > 0 {
+		i -= len(m.ReadKeyId)
+		copy(dAtA[i:], m.ReadKeyId)
+		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.ReadKeyId)))
 		i--
-		dAtA[i] = 0x20
+		dAtA[i] = 0x22
 	}
 	if len(m.Data) > 0 {
 		i -= len(m.Data)
@@ -1421,39 +1381,32 @@ func (m *AclRoot) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	if m.Timestamp != 0 {
 		i = encodeVarintAclrecord(dAtA, i, uint64(m.Timestamp))
 		i--
-		dAtA[i] = 0x38
+		dAtA[i] = 0x30
 	}
 	if m.CurrentReadKeyHash != 0 {
 		i = encodeVarintAclrecord(dAtA, i, uint64(m.CurrentReadKeyHash))
 		i--
-		dAtA[i] = 0x30
+		dAtA[i] = 0x28
 	}
 	if len(m.DerivationScheme) > 0 {
 		i -= len(m.DerivationScheme)
 		copy(dAtA[i:], m.DerivationScheme)
 		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.DerivationScheme)))
 		i--
-		dAtA[i] = 0x2a
+		dAtA[i] = 0x22
 	}
 	if len(m.EncryptedReadKey) > 0 {
 		i -= len(m.EncryptedReadKey)
 		copy(dAtA[i:], m.EncryptedReadKey)
 		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptedReadKey)))
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0x1a
 	}
 	if len(m.SpaceId) > 0 {
 		i -= len(m.SpaceId)
 		copy(dAtA[i:], m.SpaceId)
 		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.SpaceId)))
 		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.EncryptionKey) > 0 {
-		i -= len(m.EncryptionKey)
-		copy(dAtA[i:], m.EncryptionKey)
-		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptionKey)))
-		i--
 		dAtA[i] = 0x12
 	}
 	if len(m.Identity) > 0 {
@@ -1700,23 +1653,14 @@ func (m *AclState) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x12
 		}
 	}
-	if len(m.ReadKeyHashes) > 0 {
-		dAtA8 := make([]byte, len(m.ReadKeyHashes)*10)
-		var j7 int
-		for _, num := range m.ReadKeyHashes {
-			for num >= 1<<7 {
-				dAtA8[j7] = uint8(uint64(num)&0x7f | 0x80)
-				num >>= 7
-				j7++
-			}
-			dAtA8[j7] = uint8(num)
-			j7++
+	if len(m.ReadKeyIds) > 0 {
+		for iNdEx := len(m.ReadKeyIds) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ReadKeyIds[iNdEx])
+			copy(dAtA[i:], m.ReadKeyIds[iNdEx])
+			i = encodeVarintAclrecord(dAtA, i, uint64(len(m.ReadKeyIds[iNdEx])))
+			i--
+			dAtA[i] = 0xa
 		}
-		i -= j7
-		copy(dAtA[i:], dAtA8[:j7])
-		i = encodeVarintAclrecord(dAtA, i, uint64(j7))
-		i--
-		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
@@ -1744,14 +1688,7 @@ func (m *AclUserState) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	if m.Permissions != 0 {
 		i = encodeVarintAclrecord(dAtA, i, uint64(m.Permissions))
 		i--
-		dAtA[i] = 0x18
-	}
-	if len(m.EncryptionKey) > 0 {
-		i -= len(m.EncryptionKey)
-		copy(dAtA[i:], m.EncryptionKey)
-		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptionKey)))
-		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x10
 	}
 	if len(m.Identity) > 0 {
 		i -= len(m.Identity)
@@ -1786,7 +1723,7 @@ func (m *AclUserAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	if m.Permissions != 0 {
 		i = encodeVarintAclrecord(dAtA, i, uint64(m.Permissions))
 		i--
-		dAtA[i] = 0x20
+		dAtA[i] = 0x18
 	}
 	if len(m.EncryptedReadKeys) > 0 {
 		for iNdEx := len(m.EncryptedReadKeys) - 1; iNdEx >= 0; iNdEx-- {
@@ -1794,16 +1731,9 @@ func (m *AclUserAdd) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			copy(dAtA[i:], m.EncryptedReadKeys[iNdEx])
 			i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptedReadKeys[iNdEx])))
 			i--
-			dAtA[i] = 0x1a
+			dAtA[i] = 0x12
 		}
 	}
-	if len(m.EncryptionKey) > 0 {
-		i -= len(m.EncryptionKey)
-		copy(dAtA[i:], m.EncryptionKey)
-		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptionKey)))
-		i--
-		dAtA[i] = 0x12
-	}
 	if len(m.Identity) > 0 {
 		i -= len(m.Identity)
 		copy(dAtA[i:], m.Identity)
@@ -1837,7 +1767,7 @@ func (m *AclUserInvite) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	if m.Permissions != 0 {
 		i = encodeVarintAclrecord(dAtA, i, uint64(m.Permissions))
 		i--
-		dAtA[i] = 0x20
+		dAtA[i] = 0x18
 	}
 	if len(m.EncryptedReadKeys) > 0 {
 		for iNdEx := len(m.EncryptedReadKeys) - 1; iNdEx >= 0; iNdEx-- {
@@ -1845,14 +1775,9 @@ func (m *AclUserInvite) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			copy(dAtA[i:], m.EncryptedReadKeys[iNdEx])
 			i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptedReadKeys[iNdEx])))
 			i--
-			dAtA[i] = 0x1a
+			dAtA[i] = 0x12
 		}
 	}
-	if m.EncryptSymKeyHash != 0 {
-		i = encodeVarintAclrecord(dAtA, i, uint64(m.EncryptSymKeyHash))
-		i--
-		dAtA[i] = 0x10
-	}
 	if len(m.AcceptPublicKey) > 0 {
 		i -= len(m.AcceptPublicKey)
 		copy(dAtA[i:], m.AcceptPublicKey)
@@ -1992,13 +1917,6 @@ func (m *AclReadKeyReplace) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.EncryptedReadKey)
 		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptedReadKey)))
 		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.EncryptionKey) > 0 {
-		i -= len(m.EncryptionKey)
-		copy(dAtA[i:], m.EncryptionKey)
-		i = encodeVarintAclrecord(dAtA, i, uint64(len(m.EncryptionKey)))
-		i--
 		dAtA[i] = 0x12
 	}
 	if len(m.Identity) > 0 {
@@ -2076,7 +1994,7 @@ func (m *AclSyncMessage) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintAclrecord(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
@@ -2242,8 +2160,9 @@ func (m *AclRecord) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	if m.CurrentReadKeyHash != 0 {
-		n += 1 + sovAclrecord(uint64(m.CurrentReadKeyHash))
+	l = len(m.ReadKeyId)
+	if l > 0 {
+		n += 1 + l + sovAclrecord(uint64(l))
 	}
 	if m.Timestamp != 0 {
 		n += 1 + sovAclrecord(uint64(m.Timestamp))
@@ -2261,10 +2180,6 @@ func (m *AclRoot) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	l = len(m.EncryptionKey)
-	if l > 0 {
-		n += 1 + l + sovAclrecord(uint64(l))
-	}
 	l = len(m.SpaceId)
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
@@ -2379,12 +2294,11 @@ func (m *AclState) Size() (n int) {
 	}
 	var l int
 	_ = l
-	if len(m.ReadKeyHashes) > 0 {
-		l = 0
-		for _, e := range m.ReadKeyHashes {
-			l += sovAclrecord(uint64(e))
+	if len(m.ReadKeyIds) > 0 {
+		for _, s := range m.ReadKeyIds {
+			l = len(s)
+			n += 1 + l + sovAclrecord(uint64(l))
 		}
-		n += 1 + sovAclrecord(uint64(l)) + l
 	}
 	if len(m.UserStates) > 0 {
 		for _, e := range m.UserStates {
@@ -2418,10 +2332,6 @@ func (m *AclUserState) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	l = len(m.EncryptionKey)
-	if l > 0 {
-		n += 1 + l + sovAclrecord(uint64(l))
-	}
 	if m.Permissions != 0 {
 		n += 1 + sovAclrecord(uint64(m.Permissions))
 	}
@@ -2438,10 +2348,6 @@ func (m *AclUserAdd) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	l = len(m.EncryptionKey)
-	if l > 0 {
-		n += 1 + l + sovAclrecord(uint64(l))
-	}
 	if len(m.EncryptedReadKeys) > 0 {
 		for _, b := range m.EncryptedReadKeys {
 			l = len(b)
@@ -2464,9 +2370,6 @@ func (m *AclUserInvite) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	if m.EncryptSymKeyHash != 0 {
-		n += 1 + sovAclrecord(uint64(m.EncryptSymKeyHash))
-	}
 	if len(m.EncryptedReadKeys) > 0 {
 		for _, b := range m.EncryptedReadKeys {
 			l = len(b)
@@ -2539,10 +2442,6 @@ func (m *AclReadKeyReplace) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
 	}
-	l = len(m.EncryptionKey)
-	if l > 0 {
-		n += 1 + l + sovAclrecord(uint64(l))
-	}
 	l = len(m.EncryptedReadKey)
 	if l > 0 {
 		n += 1 + l + sovAclrecord(uint64(l))
@@ -3056,10 +2955,10 @@ func (m *AclRecord) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CurrentReadKeyHash", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReadKeyId", wireType)
 			}
-			m.CurrentReadKeyHash = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowAclrecord
@@ -3069,11 +2968,24 @@ func (m *AclRecord) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.CurrentReadKeyHash |= uint64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAclrecord
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAclrecord
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReadKeyId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 5:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Timestamp", wireType)
@@ -3178,40 +3090,6 @@ func (m *AclRoot) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAclrecord
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.EncryptionKey == nil {
-				m.EncryptionKey = []byte{}
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SpaceId", wireType)
 			}
@@ -3243,7 +3121,7 @@ func (m *AclRoot) Unmarshal(dAtA []byte) error {
 			}
 			m.SpaceId = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EncryptedReadKey", wireType)
 			}
@@ -3277,7 +3155,7 @@ func (m *AclRoot) Unmarshal(dAtA []byte) error {
 				m.EncryptedReadKey = []byte{}
 			}
 			iNdEx = postIndex
-		case 5:
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field DerivationScheme", wireType)
 			}
@@ -3309,7 +3187,7 @@ func (m *AclRoot) Unmarshal(dAtA []byte) error {
 			}
 			m.DerivationScheme = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 5:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field CurrentReadKeyHash", wireType)
 			}
@@ -3328,7 +3206,7 @@ func (m *AclRoot) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
-		case 7:
+		case 6:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Timestamp", wireType)
 			}
@@ -3707,81 +3585,37 @@ func (m *AclState) Unmarshal(dAtA []byte) error {
 		}
 		switch fieldNum {
 		case 1:
-			if wireType == 0 {
-				var v uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowAclrecord
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					v |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReadKeyIds", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowAclrecord
 				}
-				m.ReadKeyHashes = append(m.ReadKeyHashes, v)
-			} else if wireType == 2 {
-				var packedLen int
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowAclrecord
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					packedLen |= int(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				if packedLen < 0 {
-					return ErrInvalidLengthAclrecord
-				}
-				postIndex := iNdEx + packedLen
-				if postIndex < 0 {
-					return ErrInvalidLengthAclrecord
-				}
-				if postIndex > l {
+				if iNdEx >= l {
 					return io.ErrUnexpectedEOF
 				}
-				var elementCount int
-				var count int
-				for _, integer := range dAtA[iNdEx:postIndex] {
-					if integer < 128 {
-						count++
-					}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
-				elementCount = count
-				if elementCount != 0 && len(m.ReadKeyHashes) == 0 {
-					m.ReadKeyHashes = make([]uint64, 0, elementCount)
-				}
-				for iNdEx < postIndex {
-					var v uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowAclrecord
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						v |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					m.ReadKeyHashes = append(m.ReadKeyHashes, v)
-				}
-			} else {
-				return fmt.Errorf("proto: wrong wireType = %d for field ReadKeyHashes", wireType)
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthAclrecord
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthAclrecord
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReadKeyIds = append(m.ReadKeyIds, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field UserStates", wireType)
@@ -4030,40 +3864,6 @@ func (m *AclUserState) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAclrecord
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.EncryptionKey == nil {
-				m.EncryptionKey = []byte{}
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
 			}
@@ -4167,40 +3967,6 @@ func (m *AclUserAdd) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAclrecord
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.EncryptionKey == nil {
-				m.EncryptionKey = []byte{}
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EncryptedReadKeys", wireType)
 			}
@@ -4232,7 +3998,7 @@ func (m *AclUserAdd) Unmarshal(dAtA []byte) error {
 			m.EncryptedReadKeys = append(m.EncryptedReadKeys, make([]byte, postIndex-iNdEx))
 			copy(m.EncryptedReadKeys[len(m.EncryptedReadKeys)-1], dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
 			}
@@ -4336,25 +4102,6 @@ func (m *AclUserInvite) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EncryptSymKeyHash", wireType)
-			}
-			m.EncryptSymKeyHash = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAclrecord
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.EncryptSymKeyHash |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EncryptedReadKeys", wireType)
 			}
@@ -4386,7 +4133,7 @@ func (m *AclUserInvite) Unmarshal(dAtA []byte) error {
 			m.EncryptedReadKeys = append(m.EncryptedReadKeys, make([]byte, postIndex-iNdEx))
 			copy(m.EncryptedReadKeys[len(m.EncryptedReadKeys)-1], dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Permissions", wireType)
 			}
@@ -4826,40 +4573,6 @@ func (m *AclReadKeyReplace) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAclrecord
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAclrecord
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
-			if m.EncryptionKey == nil {
-				m.EncryptionKey = []byte{}
-			}
-			iNdEx = postIndex
-		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field EncryptedReadKey", wireType)
 			}
@@ -5046,7 +4759,7 @@ func (m *AclSyncMessage) Unmarshal(dAtA []byte) error {
 			return fmt.Errorf("proto: AclSyncMessage: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 2:
+		case 1:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Content", wireType)
 			}
diff --git a/commonspace/object/acl/aclrecordproto/protos/aclrecord.proto b/commonspace/object/acl/aclrecordproto/protos/aclrecord.proto
index 56cc2c28..f13ea819 100644
--- a/commonspace/object/acl/aclrecordproto/protos/aclrecord.proto
+++ b/commonspace/object/acl/aclrecordproto/protos/aclrecord.proto
@@ -18,18 +18,17 @@ message AclRecord {
     string prevId = 1;
     bytes identity = 2;
     bytes data = 3;
-    uint64 currentReadKeyHash = 4;
+    string readKeyId = 4;
     int64 timestamp = 5;
 }
 
 message AclRoot {
     bytes identity = 1;
-    bytes encryptionKey = 2;
-    string spaceId = 3;
-    bytes encryptedReadKey = 4;
-    string derivationScheme = 5;
-    uint64 currentReadKeyHash = 6;
-    int64 timestamp = 7;
+    string spaceId = 2;
+    bytes encryptedReadKey = 3;
+    string derivationScheme = 4;
+    uint64 currentReadKeyHash = 5;
+    int64 timestamp = 6;
 }
 
 message AclContentValue {
@@ -47,29 +46,26 @@ message AclData {
 }
 
 message AclState {
-    repeated uint64 readKeyHashes = 1;
+    repeated string readKeyIds = 1;
     repeated AclUserState userStates = 2;
     map<string, AclUserInvite> invites = 3;
 }
 
 message AclUserState {
     bytes identity = 1;
-    bytes encryptionKey = 2;
-    AclUserPermissions permissions = 3;
+    AclUserPermissions permissions = 2;
 }
 
 message AclUserAdd {
     bytes identity = 1;
-    bytes encryptionKey = 2;
-    repeated bytes encryptedReadKeys = 3;
-    AclUserPermissions permissions = 4;
+    repeated bytes encryptedReadKeys = 2;
+    AclUserPermissions permissions = 3;
 }
 
 message AclUserInvite {
     bytes acceptPublicKey = 1;
-    uint64 encryptSymKeyHash = 2;
-    repeated bytes encryptedReadKeys = 3;
-    AclUserPermissions permissions = 4;
+    repeated bytes encryptedReadKeys = 2;
+    AclUserPermissions permissions = 3;
 }
 
 message AclUserJoin {
@@ -87,8 +83,7 @@ message AclUserRemove {
 
 message AclReadKeyReplace {
     bytes identity = 1;
-    bytes encryptionKey = 2;
-    bytes encryptedReadKey = 3;
+    bytes encryptedReadKey = 2;
 }
 
 message AclUserPermissionChange {
@@ -103,7 +98,7 @@ enum AclUserPermissions {
 }
 
 message AclSyncMessage {
-    AclSyncContentValue content = 2;
+    AclSyncContentValue content = 1;
 }
 
 // AclSyncContentValue provides different types for acl sync
diff --git a/commonspace/object/tree/treechangeproto/protos/treechange.proto b/commonspace/object/tree/treechangeproto/protos/treechange.proto
index 2211f58f..dfc74a42 100644
--- a/commonspace/object/tree/treechangeproto/protos/treechange.proto
+++ b/commonspace/object/tree/treechangeproto/protos/treechange.proto
@@ -30,8 +30,8 @@ message TreeChange {
   string snapshotBaseId = 3;
   // ChangesData is an arbitrary payload to be read by the client
   bytes changesData = 4;
-  // CurrentReadKeyHash is the hash of the read key which is used to encrypt this change
-  uint64 currentReadKeyHash = 5;
+  // ReadKeyId is the id of the read key
+  string readKeyId = 5;
   // Timestamp is this change creation timestamp
   int64 timestamp = 6;
   // Identity is a public key with which the raw payload of this change is signed
diff --git a/commonspace/object/tree/treechangeproto/treechange.pb.go b/commonspace/object/tree/treechangeproto/treechange.pb.go
index da70a466..60eb619b 100644
--- a/commonspace/object/tree/treechangeproto/treechange.pb.go
+++ b/commonspace/object/tree/treechangeproto/treechange.pb.go
@@ -132,8 +132,8 @@ type TreeChange struct {
 	SnapshotBaseId string `protobuf:"bytes,3,opt,name=snapshotBaseId,proto3" json:"snapshotBaseId,omitempty"`
 	// ChangesData is an arbitrary payload to be read by the client
 	ChangesData []byte `protobuf:"bytes,4,opt,name=changesData,proto3" json:"changesData,omitempty"`
-	// CurrentReadKeyHash is the hash of the read key which is used to encrypt this change
-	CurrentReadKeyHash uint64 `protobuf:"varint,5,opt,name=currentReadKeyHash,proto3" json:"currentReadKeyHash,omitempty"`
+	// ReadKeyId is the id of the read key
+	ReadKeyId string `protobuf:"bytes,5,opt,name=readKeyId,proto3" json:"readKeyId,omitempty"`
 	// Timestamp is this change creation timestamp
 	Timestamp int64 `protobuf:"varint,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 	// Identity is a public key with which the raw payload of this change is signed
@@ -203,11 +203,11 @@ func (m *TreeChange) GetChangesData() []byte {
 	return nil
 }
 
-func (m *TreeChange) GetCurrentReadKeyHash() uint64 {
+func (m *TreeChange) GetReadKeyId() string {
 	if m != nil {
-		return m.CurrentReadKeyHash
+		return m.ReadKeyId
 	}
-	return 0
+	return ""
 }
 
 func (m *TreeChange) GetTimestamp() int64 {
@@ -806,51 +806,50 @@ func init() {
 }
 
 var fileDescriptor_5033f0301ef9b772 = []byte{
-	// 690 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x55, 0xc1, 0x4e, 0xdb, 0x4a,
-	0x14, 0xf5, 0x38, 0x01, 0xc3, 0x25, 0xc0, 0x7b, 0x03, 0x0b, 0x0b, 0xbd, 0xe7, 0x5a, 0x56, 0xd5,
-	0xa6, 0x1b, 0x90, 0xe8, 0xaa, 0x55, 0x25, 0x54, 0x28, 0xd4, 0x11, 0x6a, 0x85, 0x06, 0x4a, 0xa5,
-	0xee, 0x06, 0xfb, 0x42, 0x5c, 0x25, 0xb6, 0xeb, 0x99, 0x14, 0xe5, 0x03, 0xba, 0x69, 0xa5, 0xaa,
-	0x9f, 0xd0, 0x5f, 0xe9, 0xae, 0x4b, 0x96, 0x2c, 0x2b, 0xf8, 0x91, 0xca, 0x63, 0x3b, 0xb1, 0x1d,
-	0x2f, 0xd8, 0xb1, 0x71, 0x72, 0x8f, 0xef, 0x3d, 0x73, 0xee, 0xb9, 0x33, 0x63, 0xd8, 0xf1, 0xa2,
-	0xe1, 0x30, 0x0a, 0x45, 0xcc, 0x3d, 0xdc, 0x8a, 0xce, 0x3e, 0xa2, 0x27, 0xb7, 0x64, 0x82, 0xa8,
-	0x1e, 0x5e, 0x9f, 0x87, 0x17, 0x18, 0x27, 0x91, 0x8c, 0xb6, 0xd4, 0x53, 0x94, 0xe0, 0x4d, 0x85,
-	0x50, 0x98, 0x22, 0xce, 0x35, 0x01, 0x60, 0x51, 0x24, 0xf7, 0x54, 0x48, 0xff, 0x83, 0x45, 0xee,
-	0x0d, 0x5c, 0xe4, 0x7e, 0xcf, 0x37, 0x89, 0x4d, 0xba, 0x8b, 0x6c, 0x0a, 0x50, 0x13, 0x0c, 0xb5,
-	0x6a, 0xcf, 0x37, 0x75, 0xf5, 0xae, 0x08, 0xa9, 0x05, 0x90, 0x11, 0x9e, 0x8c, 0x63, 0x34, 0x5b,
-	0xea, 0x65, 0x09, 0x49, 0x79, 0x65, 0x30, 0x44, 0x21, 0xf9, 0x30, 0x36, 0xdb, 0x36, 0xe9, 0xb6,
-	0xd8, 0x14, 0xa0, 0x14, 0xda, 0x02, 0xd1, 0x37, 0xe7, 0x6c, 0xd2, 0xed, 0x30, 0xf5, 0x9f, 0x6e,
-	0xc0, 0x42, 0xe0, 0x63, 0x28, 0x03, 0x39, 0x36, 0xe7, 0x15, 0x3e, 0x89, 0xe9, 0x43, 0x58, 0xce,
-	0xb8, 0x8f, 0xf8, 0x78, 0x10, 0x71, 0xdf, 0x34, 0x54, 0x42, 0x15, 0x74, 0x7e, 0xea, 0x00, 0x27,
-	0x09, 0x62, 0xde, 0x9a, 0x0d, 0x4b, 0x69, 0xdf, 0x59, 0x2b, 0xc2, 0x24, 0x76, 0xab, 0xbb, 0xc8,
-	0xca, 0x50, 0xb5, 0x79, 0xbd, 0xde, 0xfc, 0x23, 0x58, 0x11, 0x21, 0x8f, 0x45, 0x3f, 0x92, 0xbb,
-	0x5c, 0xa4, 0x1e, 0x64, 0x6d, 0xd6, 0xd0, 0x74, 0x9d, 0x4c, 0x87, 0x78, 0xc5, 0x25, 0x57, 0xcd,
-	0x76, 0x58, 0x19, 0xa2, 0x9b, 0x40, 0xbd, 0x51, 0x92, 0x60, 0x28, 0x19, 0x72, 0xff, 0x10, 0xc7,
-	0x2e, 0x17, 0x7d, 0xd5, 0x7c, 0x9b, 0x35, 0xbc, 0xa9, 0x9a, 0x37, 0x5f, 0x37, 0xaf, 0x6c, 0x94,
-	0x51, 0x33, 0xca, 0x02, 0x08, 0xc4, 0x71, 0xae, 0xcf, 0x5c, 0xb0, 0x49, 0x77, 0x81, 0x95, 0x10,
-	0xe7, 0x35, 0x2c, 0x33, 0x7e, 0x59, 0x32, 0xc9, 0x04, 0x23, 0xce, 0x3d, 0x25, 0x8a, 0xab, 0x08,
-	0x53, 0x11, 0x22, 0xb8, 0x08, 0xb9, 0x1c, 0x25, 0xa8, 0xcc, 0xe9, 0xb0, 0x29, 0xe0, 0xec, 0xc1,
-	0x5a, 0x85, 0xe8, 0x7d, 0x20, 0xfb, 0x3d, 0x55, 0x94, 0xf0, 0xcb, 0x0c, 0xca, 0x09, 0xa7, 0x00,
-	0x5d, 0x01, 0x3d, 0x28, 0x8c, 0xd6, 0x03, 0xdf, 0xf9, 0x4e, 0x60, 0x35, 0xa5, 0x38, 0x1e, 0x87,
-	0xde, 0x1b, 0x14, 0x82, 0x5f, 0x20, 0x7d, 0x0e, 0x86, 0x17, 0x85, 0x12, 0x43, 0xa9, 0xea, 0x97,
-	0xb6, 0xed, 0xcd, 0xd2, 0x7e, 0x2e, 0xb2, 0xf7, 0xb2, 0x94, 0x53, 0x3e, 0x18, 0x21, 0x2b, 0x0a,
-	0xe8, 0x0e, 0x40, 0x32, 0xd9, 0xda, 0x6a, 0x9d, 0xa5, 0xed, 0x07, 0xe5, 0xf2, 0x06, 0xc9, 0xac,
-	0x54, 0xe2, 0xfc, 0xd2, 0x61, 0xbd, 0x69, 0x09, 0xfa, 0x02, 0xa0, 0x8f, 0xdc, 0x7f, 0x17, 0xfb,
-	0x5c, 0x62, 0x2e, 0x6c, 0xa3, 0x2e, 0xcc, 0x9d, 0x64, 0xb8, 0x1a, 0x2b, 0xe5, 0xd3, 0x43, 0x58,
-	0x3d, 0x1f, 0x0d, 0x06, 0x29, 0x2b, 0xc3, 0x4f, 0x23, 0x14, 0xb2, 0x49, 0x5c, 0x4a, 0x71, 0x50,
-	0x4d, 0x73, 0x35, 0x56, 0xaf, 0xa4, 0x6f, 0xe1, 0x9f, 0x29, 0x24, 0xe2, 0x28, 0x14, 0xd9, 0xf9,
-	0x6b, 0x70, 0xea, 0xa0, 0x96, 0xe7, 0x6a, 0x6c, 0xa6, 0x96, 0xee, 0xc3, 0x32, 0x26, 0x49, 0x94,
-	0x4c, 0xc8, 0xda, 0x8a, 0xec, 0xff, 0x3a, 0xd9, 0x7e, 0x39, 0xc9, 0xd5, 0x58, 0xb5, 0x6a, 0xd7,
-	0x80, 0xb9, 0xcf, 0xa9, 0x55, 0xce, 0x17, 0x02, 0x2b, 0x55, 0x37, 0xe8, 0x3a, 0xcc, 0xa5, 0x6e,
-	0x14, 0x67, 0x30, 0x0b, 0xe8, 0x33, 0x30, 0xf2, 0x43, 0x62, 0xea, 0x76, 0xeb, 0x2e, 0xa3, 0x2a,
-	0xf2, 0xa9, 0x03, 0x9d, 0xe2, 0x10, 0x1e, 0x71, 0xd9, 0x37, 0x5b, 0x8a, 0xb7, 0x82, 0x39, 0x5f,
-	0x09, 0xac, 0x35, 0x58, 0x7a, 0x3f, 0x62, 0xbe, 0x91, 0x6c, 0x63, 0xd5, 0x27, 0x72, 0x3f, 0x6a,
-	0x9e, 0xc0, 0xbf, 0x33, 0x13, 0x4d, 0x95, 0xa8, 0x89, 0xe6, 0x5f, 0x81, 0x2c, 0x70, 0x4e, 0xb3,
-	0x61, 0x66, 0x6b, 0xf5, 0xc2, 0xf3, 0xa8, 0x76, 0xf3, 0x93, 0x99, 0x9b, 0x7f, 0xe6, 0xae, 0xd6,
-	0x1b, 0xee, 0xea, 0xdd, 0x97, 0xbf, 0x6f, 0x2c, 0x72, 0x75, 0x63, 0x91, 0x3f, 0x37, 0x16, 0xf9,
-	0x71, 0x6b, 0x69, 0x57, 0xb7, 0x96, 0x76, 0x7d, 0x6b, 0x69, 0x1f, 0x1e, 0xdf, 0xf1, 0x6b, 0x77,
-	0x36, 0xaf, 0x7e, 0x9e, 0xfe, 0x0d, 0x00, 0x00, 0xff, 0xff, 0x24, 0x93, 0x3b, 0x00, 0x1f, 0x07,
-	0x00, 0x00,
+	// 677 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x55, 0xcf, 0x4f, 0xd4, 0x40,
+	0x14, 0xee, 0x74, 0x81, 0xb2, 0x8f, 0x05, 0x74, 0xe0, 0xd0, 0x10, 0xad, 0x4d, 0x63, 0x74, 0xbd,
+	0x40, 0x82, 0x27, 0x8d, 0x09, 0x11, 0x04, 0x77, 0x43, 0x34, 0x64, 0x40, 0x4c, 0xbc, 0x0d, 0xed,
+	0xc0, 0xd6, 0xec, 0x76, 0x6a, 0x67, 0x56, 0xb2, 0x7f, 0x80, 0x17, 0x4d, 0x88, 0xff, 0x92, 0x37,
+	0x8f, 0x1c, 0x39, 0x1a, 0xf6, 0x1f, 0x31, 0x9d, 0x69, 0xb7, 0x3f, 0x76, 0x0f, 0xdc, 0xb8, 0x74,
+	0xf7, 0x7d, 0x7d, 0xef, 0x7b, 0xdf, 0xfb, 0xe6, 0x47, 0x61, 0xc7, 0xe7, 0x83, 0x01, 0x8f, 0x44,
+	0x4c, 0x7d, 0xb6, 0xc5, 0xcf, 0xbe, 0x32, 0x5f, 0x6e, 0xc9, 0x84, 0x31, 0xf5, 0xf0, 0x7b, 0x34,
+	0xba, 0x60, 0x71, 0xc2, 0x25, 0xdf, 0x52, 0x4f, 0x51, 0x82, 0x37, 0x15, 0x82, 0xa1, 0x40, 0xbc,
+	0x1b, 0x04, 0x40, 0x38, 0x97, 0x7b, 0x2a, 0xc4, 0x8f, 0xa0, 0x49, 0xfd, 0x7e, 0x87, 0xd1, 0xa0,
+	0x1b, 0xd8, 0xc8, 0x45, 0xed, 0x26, 0x29, 0x00, 0x6c, 0x83, 0xa5, 0xba, 0x76, 0x03, 0xdb, 0x54,
+	0xef, 0xf2, 0x10, 0x3b, 0x00, 0x9a, 0xf0, 0x64, 0x14, 0x33, 0xbb, 0xa1, 0x5e, 0x96, 0x90, 0x94,
+	0x57, 0x86, 0x03, 0x26, 0x24, 0x1d, 0xc4, 0xf6, 0x9c, 0x8b, 0xda, 0x0d, 0x52, 0x00, 0x18, 0xc3,
+	0x9c, 0x60, 0x2c, 0xb0, 0xe7, 0x5d, 0xd4, 0x6e, 0x11, 0xf5, 0x1f, 0x6f, 0xc0, 0x62, 0x18, 0xb0,
+	0x48, 0x86, 0x72, 0x64, 0x2f, 0x28, 0x7c, 0x12, 0xe3, 0xa7, 0xb0, 0xac, 0xb9, 0x8f, 0xe8, 0xa8,
+	0xcf, 0x69, 0x60, 0x5b, 0x2a, 0xa1, 0x0a, 0x7a, 0x57, 0x26, 0xc0, 0x49, 0xc2, 0x58, 0x36, 0x9a,
+	0x0b, 0x4b, 0xe9, 0xdc, 0x7a, 0x14, 0x61, 0x23, 0xb7, 0xd1, 0x6e, 0x92, 0x32, 0x54, 0x1d, 0xde,
+	0xac, 0x0f, 0xff, 0x0c, 0x56, 0x44, 0x44, 0x63, 0xd1, 0xe3, 0x72, 0x97, 0x8a, 0xd4, 0x03, 0x3d,
+	0x66, 0x0d, 0x4d, 0xfb, 0x68, 0x1d, 0xe2, 0x1d, 0x95, 0x54, 0x0d, 0xdb, 0x22, 0x65, 0x28, 0xed,
+	0x93, 0x30, 0x1a, 0x1c, 0xb2, 0x51, 0x57, 0xcf, 0xdc, 0x24, 0x05, 0x50, 0xb5, 0x6a, 0xa1, 0x6e,
+	0x55, 0xd9, 0x16, 0xab, 0x66, 0x8b, 0x03, 0x10, 0x8a, 0xe3, 0x4c, 0x8d, 0xbd, 0xe8, 0xa2, 0xf6,
+	0x22, 0x29, 0x21, 0xde, 0x7b, 0x58, 0x26, 0xf4, 0xb2, 0x64, 0x89, 0x0d, 0x56, 0x9c, 0x39, 0x88,
+	0x14, 0x57, 0x1e, 0xa6, 0x22, 0x44, 0x78, 0x11, 0x51, 0x39, 0x4c, 0x98, 0xb2, 0xa2, 0x45, 0x0a,
+	0xc0, 0xdb, 0x83, 0xb5, 0x0a, 0xd1, 0xe7, 0x50, 0xf6, 0xb4, 0xf2, 0x84, 0x5e, 0x6a, 0x28, 0x23,
+	0x2c, 0x00, 0xbc, 0x02, 0x66, 0x98, 0xdb, 0x6a, 0x86, 0x81, 0x77, 0x85, 0x60, 0x35, 0xa5, 0x38,
+	0x1e, 0x45, 0xfe, 0x07, 0x26, 0x04, 0xbd, 0x60, 0xf8, 0x35, 0x58, 0x3e, 0x8f, 0x24, 0x8b, 0xa4,
+	0xaa, 0x5f, 0xda, 0x76, 0x37, 0x4b, 0xbb, 0x37, 0xcf, 0xde, 0xd3, 0x29, 0xa7, 0xb4, 0x3f, 0x64,
+	0x24, 0x2f, 0xc0, 0x3b, 0x00, 0xc9, 0x64, 0x23, 0xab, 0x3e, 0x4b, 0xdb, 0x4f, 0xca, 0xe5, 0x33,
+	0x24, 0x93, 0x52, 0x89, 0xf7, 0xc7, 0x84, 0xf5, 0x59, 0x2d, 0xf0, 0x1b, 0x80, 0x1e, 0xa3, 0xc1,
+	0xa7, 0x38, 0xa0, 0x92, 0x65, 0xc2, 0x36, 0xea, 0xc2, 0x3a, 0x93, 0x8c, 0x8e, 0x41, 0x4a, 0xf9,
+	0xf8, 0x10, 0x56, 0xcf, 0x87, 0xfd, 0x7e, 0xca, 0x4a, 0xd8, 0xb7, 0x21, 0x13, 0x72, 0x96, 0xb8,
+	0x94, 0xe2, 0xa0, 0x9a, 0xd6, 0x31, 0x48, 0xbd, 0x12, 0x7f, 0x84, 0x07, 0x05, 0x24, 0x62, 0x1e,
+	0x09, 0x7d, 0xda, 0x66, 0x38, 0x75, 0x50, 0xcb, 0xeb, 0x18, 0x64, 0xaa, 0x16, 0xef, 0xc3, 0x32,
+	0x4b, 0x12, 0x9e, 0x4c, 0xc8, 0xe6, 0x14, 0xd9, 0xe3, 0x3a, 0xd9, 0x7e, 0x39, 0xa9, 0x63, 0x90,
+	0x6a, 0xd5, 0xae, 0x05, 0xf3, 0xdf, 0x53, 0xab, 0xbc, 0x1f, 0x08, 0x56, 0xaa, 0x6e, 0xe0, 0x75,
+	0x98, 0x4f, 0xdd, 0xc8, 0x4f, 0x9c, 0x0e, 0xf0, 0x2b, 0xb0, 0xb2, 0x23, 0x61, 0x9b, 0x6e, 0xe3,
+	0x2e, 0x4b, 0x95, 0xe7, 0x63, 0x0f, 0x5a, 0xf9, 0x91, 0x3b, 0xa2, 0xb2, 0x67, 0x37, 0x14, 0x6f,
+	0x05, 0xf3, 0x7e, 0x22, 0x58, 0x9b, 0x61, 0xe9, 0xfd, 0x88, 0xf9, 0x85, 0xf4, 0xc6, 0xaa, 0xaf,
+	0xc8, 0xfd, 0xa8, 0x79, 0x01, 0x0f, 0xa7, 0x56, 0x34, 0x55, 0xa2, 0x56, 0x34, 0xbb, 0xf3, 0x75,
+	0xe0, 0x9d, 0xea, 0xc5, 0xd4, 0xbd, 0xba, 0xd1, 0x39, 0xaf, 0xdd, 0xf3, 0x68, 0xea, 0x9e, 0x9f,
+	0xba, 0x99, 0xcd, 0x19, 0x37, 0xf3, 0xee, 0xdb, 0xbf, 0xb7, 0x0e, 0xba, 0xbe, 0x75, 0xd0, 0xbf,
+	0x5b, 0x07, 0xfd, 0x1e, 0x3b, 0xc6, 0xf5, 0xd8, 0x31, 0x6e, 0xc6, 0x8e, 0xf1, 0xe5, 0xf9, 0x1d,
+	0xbf, 0x6d, 0x67, 0x0b, 0xea, 0xe7, 0xe5, 0xff, 0x00, 0x00, 0x00, 0xff, 0xff, 0xbc, 0xc0, 0xf7,
+	0x30, 0x0d, 0x07, 0x00, 0x00,
 }
 
 func (m *RootChange) Marshal() (dAtA []byte, err error) {
@@ -965,10 +964,12 @@ func (m *TreeChange) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x30
 	}
-	if m.CurrentReadKeyHash != 0 {
-		i = encodeVarintTreechange(dAtA, i, uint64(m.CurrentReadKeyHash))
+	if len(m.ReadKeyId) > 0 {
+		i -= len(m.ReadKeyId)
+		copy(dAtA[i:], m.ReadKeyId)
+		i = encodeVarintTreechange(dAtA, i, uint64(len(m.ReadKeyId)))
 		i--
-		dAtA[i] = 0x28
+		dAtA[i] = 0x2a
 	}
 	if len(m.ChangesData) > 0 {
 		i -= len(m.ChangesData)
@@ -1543,8 +1544,9 @@ func (m *TreeChange) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovTreechange(uint64(l))
 	}
-	if m.CurrentReadKeyHash != 0 {
-		n += 1 + sovTreechange(uint64(m.CurrentReadKeyHash))
+	l = len(m.ReadKeyId)
+	if l > 0 {
+		n += 1 + l + sovTreechange(uint64(l))
 	}
 	if m.Timestamp != 0 {
 		n += 1 + sovTreechange(uint64(m.Timestamp))
@@ -2214,10 +2216,10 @@ func (m *TreeChange) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CurrentReadKeyHash", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReadKeyId", wireType)
 			}
-			m.CurrentReadKeyHash = 0
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowTreechange
@@ -2227,11 +2229,24 @@ func (m *TreeChange) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.CurrentReadKeyHash |= uint64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthTreechange
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthTreechange
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ReadKeyId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 6:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Timestamp", wireType)