diff --git a/commonspace/object/tree/objecttree/objecttreefactory.go b/commonspace/object/tree/objecttree/objecttreefactory.go
index bcdf6513..b3b757fb 100644
--- a/commonspace/object/tree/objecttree/objecttreefactory.go
+++ b/commonspace/object/tree/objecttree/objecttreefactory.go
@@ -37,7 +37,7 @@ func defaultObjectTreeDeps(
 	rootChange *treechangeproto.RawTreeChangeWithId,
 	treeStorage treestorage.TreeStorage,
 	aclList list.AclList) objectTreeDeps {
-	changeBuilder := NewChangeBuilder(aclList.KeyStorage(), rootChange)
+	changeBuilder := NewChangeBuilder(crypto.NewKeyStorage(), rootChange)
 	treeBuilder := newTreeBuilder(treeStorage, changeBuilder)
 	return objectTreeDeps{
 		changeBuilder:   changeBuilder,
@@ -170,7 +170,7 @@ func createObjectTreeRoot(
 		Seed:          seed,
 	}
 
-	_, root, err = NewChangeBuilder(aclList.KeyStorage(), nil).BuildRoot(cnt)
+	_, root, err = NewChangeBuilder(crypto.NewKeyStorage(), nil).BuildRoot(cnt)
 	return
 }
 
diff --git a/util/crypto/ed25519_test.go b/util/crypto/ed25519_test.go
index abda9e44..5b96ecb6 100644
--- a/util/crypto/ed25519_test.go
+++ b/util/crypto/ed25519_test.go
@@ -7,9 +7,10 @@ import (
 )
 
 func Test_EncryptDecrypt(t *testing.T) {
-	privKey, pubKey, _ := GenerateEd25519Key(rand.Reader)
+	privKey, pubKey, err := GenerateEd25519Key(rand.Reader)
+	require.NoError(t, err)
 	msg := make([]byte, 32768)
-	_, err := rand.Read(msg)
+	_, err = rand.Read(msg)
 	require.NoError(t, err)
 	enc, err := pubKey.Encrypt(msg)
 	require.NoError(t, err)
diff --git a/util/crypto/keystorage.go b/util/crypto/keystorage.go
index 80b1892d..faedd4a4 100644
--- a/util/crypto/keystorage.go
+++ b/util/crypto/keystorage.go
@@ -1,9 +1,39 @@
 package crypto
 
+import "bytes"
+
 type KeyStorage interface {
 	PubKeyFromProto(protoBytes []byte) (PubKey, error)
 }
 
 func NewKeyStorage() KeyStorage {
-	return nil
+	return &keyStorage{}
+}
+
+type pubKeyEntry struct {
+	protoKey []byte
+	key      PubKey
+}
+
+type keyStorage struct {
+	keys []pubKeyEntry
+}
+
+func (k *keyStorage) PubKeyFromProto(protoBytes []byte) (PubKey, error) {
+	for _, k := range k.keys {
+		// it is not guaranteed that proto will always marshal to the same bytes (but in our case it probably will)
+		// but this shouldn't be the problem, because we will just create another copy
+		if bytes.Equal(protoBytes, k.protoKey) {
+			return k.key, nil
+		}
+	}
+	key, err := UnmarshalEd25519PublicKeyProto(protoBytes)
+	if err != nil {
+		return nil, err
+	}
+	k.keys = append(k.keys, pubKeyEntry{
+		protoKey: protoBytes,
+		key:      key,
+	})
+	return key, nil
 }
diff --git a/util/crypto/keystorage_test.go b/util/crypto/keystorage_test.go
new file mode 100644
index 00000000..8f4426b5
--- /dev/null
+++ b/util/crypto/keystorage_test.go
@@ -0,0 +1,21 @@
+package crypto
+
+import (
+	"crypto/rand"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestKeyStorage_PubKeyFromProto(t *testing.T) {
+	st := NewKeyStorage().(*keyStorage)
+	_, pubKey, err := GenerateEd25519Key(rand.Reader)
+	require.NoError(t, err)
+	for i := 0; i < 100; i++ {
+		marshalled, err := pubKey.Marshall()
+		require.NoError(t, err)
+		pk, err := st.PubKeyFromProto(marshalled)
+		require.NoError(t, err)
+		require.Equal(t, pk.Storage(), pubKey.Storage())
+	}
+	require.Equal(t, 1, len(st.keys))
+}