diff --git a/tests/buffertest.c b/tests/buffertest.c
index 2b3270b..89cfcf1 100644
--- a/tests/buffertest.c
+++ b/tests/buffertest.c
@@ -4,6 +4,7 @@
 int main() {
   /* testing basic Buffer api */
   Buffer *test = buffer_new(16, "test");
+  PCPCTX *ptx = ptx_new();
 
   byte *a = ucmalloc(32);
   byte *b = ucmalloc(32);
@@ -92,7 +93,7 @@ int main() {
   munmap(r, rs);
   fclose(RFD);
 
-  fatals_ifany();
+  fatals_ifany(ptx);
 
   return 0;
 }
diff --git a/tests/cpptest.cpp b/tests/cpptest.cpp
index d11bf08..eee1a92 100644
--- a/tests/cpptest.cpp
+++ b/tests/cpptest.cpp
@@ -14,76 +14,76 @@ void pr(string name, unsigned char *data, size_t len) {
   cout << endl;
 }
 
-FILE *_openwr(string file) {
+FILE *_openwr(string file, PcpContext &ptx) {
   FILE *fd;
   if((fd = fopen(file.c_str(), "wb+")) == NULL) {
-    throw pcp::exception("Could not open output file " + file + "\n");
+    throw pcp::exception(ptx, "Could not open output file " + file + "\n");
   }
   return fd;
 }
 
-FILE *_openrd(string file) {
+FILE *_openrd(string file, PcpContext &ptx) {
   FILE *fd;
   if((fd = fopen(file.c_str(), "rb")) == NULL) {
-    throw pcp::exception("Could not open input file " + file + "\n");
+    throw pcp::exception(ptx, "Could not open input file " + file + "\n");
   }
   return fd;
 }
 
-void test0() {
+void test0(PcpContext &ptx) {
   // test keygen and crypto
   FILE *CLEAR, *CIPHER, *DECRYPTED;
-  Key A = Key("a", "alicia", "alicia@local");
-  Key B = Key("b", "bobby",  "bobby@local");
+  Key A = Key(ptx, "a", "alicia", "alicia@local");
+  Key B = Key(ptx, "b", "bobby",  "bobby@local");
   PubKey PA = A.get_public();
   PubKey PB = B.get_public();
 
   A.decrypt("a");
   B.decrypt("b");
   
-  Crypto A2B(A, PB);
-  Crypto B2A(B, PA);
+  Crypto A2B(ptx, A, PB);
+  Crypto B2A(ptx, B, PA);
 
-  CLEAR = _openwr("testcppclear");
+  CLEAR = _openwr("testcppclear", ptx);
   fprintf(CLEAR, "HALLO\n");
   fclose(CLEAR);
   
-  CIPHER = _openwr("testcpcipher");
-  CLEAR = _openrd("testcppclear");
+  CIPHER = _openwr("testcpcipher", ptx);
+  CLEAR = _openrd("testcppclear", ptx);
 
   if(A2B.encrypt(CLEAR, CIPHER, false)) {
 
-    CIPHER = _openrd("testcpcipher");
-    DECRYPTED = _openwr("testcppdecrypted");
+    CIPHER = _openrd("testcpcipher", ptx);
+    DECRYPTED = _openwr("testcppdecrypted", ptx);
 
     if(B2A.decrypt(CIPHER, DECRYPTED, false)) {
 
-      DECRYPTED = _openrd("testcppdecrypted");
+      DECRYPTED = _openrd("testcppdecrypted", ptx);
       char *got = (char *)ucmalloc(10);
       if(fread(got, 1, 6, DECRYPTED) < 6) {
-	throw pcp::exception("read error, could not read decrypted content");
+	throw pcp::exception(ptx, "read error, could not read decrypted content");
       }
       if(strncmp(got, "HALLO", 5) != 0) {
-	throw pcp::exception();
+	throw pcp::exception(ptx);
       }
     }
     else
-      throw pcp::exception("failed to decrypt");
+      throw pcp::exception(ptx, "failed to decrypt");
   }
   else
-    throw pcp::exception("failed to encrypt");
+    throw pcp::exception(ptx, "failed to encrypt");
 
   cout << "0 ok" << endl;
 }
 
-void test1() {
+void test1(PcpContext &ptx) {
   // test the vault
-  Key A = Key("a", "alicia", "alicia@local");
-  Key B = Key("b", "bobby",  "bobby@local");
+  Key A = Key(ptx, "a", "alicia", "alicia@local");
+  Key B = Key(ptx, "b", "bobby",  "bobby@local");
   PubKey PA = A.get_public();
   PubKey PB = B.get_public();
 
-  Vault vault = Vault("vcpp1");
+  Vault vault = Vault(ptx, "vcpp1");
   vault.key_add(A);
   vault.pubkey_add(PB);
 
@@ -102,12 +102,12 @@ void test1() {
   }
 
   if(gotp == false || gots == false)
-    throw pcp::exception("wtf - didnt find installed keys");
+    throw pcp::exception(ptx, "wtf - didnt find installed keys");
   else
     cout << "1 ok" << endl;
 }
 
-void test2() {
+void test2(PcpContext &ptx) {
   // try importing a key from disk
   ifstream pf("key-bobby-pub");
   string z;
@@ -118,22 +118,22 @@ void test2() {
     if(strlen(buf) > 0)
       z += buf + string("\n");
   }
-  PubKey B(z);
+  PubKey B(ptx, z);
   //cout << B.to_text();
   cout << "2 ok" << endl;
 }
 
 
-void test3() {
+void test3(PcpContext &ptx) {
   // signature test
-  Key A = Key("a", "alicia", "alicia@local");
+  Key A = Key(ptx, "a", "alicia", "alicia@local");
   A.decrypt("a");
   PubKey PA = A.get_public();
 
   string message = "hallo baby";
 
-  Signature SigA(A);
-  Signature SigB(PA);
+  Signature SigA(ptx, A);
+  Signature SigB(ptx, PA);
 
   if(SigA.sign((unsigned char*)message.c_str(), message.length()))
     if(SigB.verify(SigA.sig) )
@@ -158,29 +158,30 @@ void test4() {
 
 int main(int argc, char **argv) {
   sodium_init();
+  PcpContext ptx;
 
   try {
     if(argc < 2)
-      throw pcp::exception("usage: cpptest N");
+      throw pcp::exception(ptx, "usage: cpptest N");
     switch(argv[1][0]) {
     case '0':
-      test0();
+      test0(ptx);
       break;
 
     case '1':
-      test1();
+      test1(ptx);
       break;
 
     case '2':
-      test2();
+      test2(ptx);
       break;
 
     case '3':
-      test3();
+      test3(ptx);
       break;
 
     case '4':
-      test3();
+      test4();
       break;
 
     default:
diff --git a/tests/decodertest.c b/tests/decodertest.c
index 2fb1f8c..59dc3e0 100644
--- a/tests/decodertest.c
+++ b/tests/decodertest.c
@@ -21,6 +21,8 @@ int main(int argc, char **argv) {
   size_t clearlen = 256;
   size_t zlen = (clearlen * 5 / 4);
 
+  PCPCTX *ptx = ptx_new();
+
   if(argc < 2) {
     fprintf(stderr, "Usage: decodertest <N>\n");
     return 1;
@@ -40,8 +42,8 @@ int main(int argc, char **argv) {
 
   if(z85 == NULL) {
     ret = FALSE;
-    if(PCP_ERRSET == 0) {
-      fatal("failed to encoded data to Z85\n");
+    if(ptx->pcp_errset == 0) {
+      fatal(ptx, "failed to encoded data to Z85\n");
     }
     goto OUT;
   }
@@ -103,14 +105,14 @@ int main(int argc, char **argv) {
 
   /* line decoder */
 
-  char *raw = pcp_readz85string(buffer_get(zdone), buffer_size(zdone));
+  char *raw = pcp_readz85string(ptx, buffer_get(zdone), buffer_size(zdone));
 
   if(raw == NULL) {
     /* unexpected */
     ret = FALSE;
   }
   else {
-    back = pcp_z85_decode(raw, &zlen);
+    back = pcp_z85_decode(ptx, raw, &zlen);
     if(back == NULL) {
       if(mode > 3) {
 	/* expected fail */
@@ -137,8 +139,8 @@ int main(int argc, char **argv) {
   if(back != NULL) {
     if(mode <= 3 && memcmp(back, clear, 256) != 0) {
       ret = FALSE;
-      if(PCP_ERRSET == 0) {
-	fatal("decoded content doesn't match\n");
+      if(ptx->pcp_errset == 0) {
+	fatal(ptx, "decoded content doesn't match\n");
       }
     }
   }
@@ -157,8 +159,10 @@ int main(int argc, char **argv) {
   }
   else {
     fprintf(stdout, "%d - failed\n", mode);
-    fatals_ifany();
+    fatals_ifany(ptx);
   }
 
+  ptx_clean(ptx);
+
   return ret;
 }
diff --git a/tests/gencheader.c b/tests/gencheader.c
index d931cc6..cbc8f98 100644
--- a/tests/gencheader.c
+++ b/tests/gencheader.c
@@ -16,12 +16,13 @@ int main() {
 
   pcp_key_t *a = pcpkey_new();
   pcp_key_t *b = pcpkey_new();
+  PCPCTX *ptx = ptx_new();
   pcp_pubkey_t *p = pcpkey_pub_from_secret(b);
 
   unsigned char m[12] = "hallo world";
 
   size_t clen;
-  unsigned char *c = pcp_box_encrypt(a, p, m, 12, &clen);
+  unsigned char *c = pcp_box_encrypt(ptx, a, p, m, 12, &clen);
   unsigned char *n = ucmalloc(24);
 
   memcpy(n, c, 24);
diff --git a/tests/invalidkeys.c b/tests/invalidkeys.c
index 8b90fe7..6088834 100644
--- a/tests/invalidkeys.c
+++ b/tests/invalidkeys.c
@@ -11,26 +11,26 @@ int main() {
   strcpy(m, "xxxx");
 
   sodium_init();
-
+  PCPCTX *ptx = ptx_new();
   pcp_key_t *k = pcpkey_new ();
 
   memcpy(k->owner, o, 8);
   memcpy(k->mail, m, 8);
 
-  pcp_key_t *key = pcpkey_encrypt(k, pw);
+  pcp_key_t *key = pcpkey_encrypt(ptx, k, pw);
 
   int i;
   for(i=0; i<3; i++)
-    mkinvalid_secret(key, i);
+    mkinvalid_secret(ptx, key, i);
 
   for(i=0; i<4; i++)
     mkinvalid_public(key, i);
 
-  mkinvv("testvault-invalidheader",  0);
-  mkinvv("testvault-invalidversion",  1);
-  mkinvv("testvault-invaliditemsize", 2);
-  mkinvv("testvault-invaliditemtype",  3);
-  mkinvv("testvault-invalidkeytype", 4);
+  mkinvv(ptx, "testvault-invalidheader",  0);
+  mkinvv(ptx, "testvault-invalidversion",  1);
+  mkinvv(ptx, "testvault-invaliditemsize", 2);
+  mkinvv(ptx, "testvault-invaliditemtype",  3);
+  mkinvv(ptx, "testvault-invalidkeytype", 4);
 
   return 0;
 }
@@ -43,9 +43,9 @@ void pr(char *t, unsigned char *b, size_t s) {
   printf("\n");
 }
 
-void mkinvv(const char *name, int type) {
+void mkinvv(PCPCTX *ptx, const char *name, int type) {
   unlink(name);
-  vault_t *v = pcpvault_new((char *)name, 0);
+  vault_t *v = pcpvault_new(ptx, (char *)name, 0);
   vault_item_header_t *item = ucmalloc(sizeof(vault_item_header_t));
   vault_header_t *header = ucmalloc(sizeof(vault_header_t));
 
@@ -135,7 +135,7 @@ void mkinvalid_public(pcp_key_t *k, int type) {
   free(key);
 }
 
-void mkinvalid_secret(pcp_key_t *k, int type) {
+void mkinvalid_secret(PCPCTX *ptx, pcp_key_t *k, int type) {
   pcp_key_t *key = ucmalloc(sizeof(pcp_key_t));
   memcpy(key, k, sizeof(pcp_key_t));
   FILE *fd = NULL;
@@ -159,7 +159,7 @@ void mkinvalid_secret(pcp_key_t *k, int type) {
 
   if(fd != NULL) {
     pcp_dumpkey(key);
-    Buffer *b = pcp_export_secret(key, "xxx");
+    Buffer *b = pcp_export_secret(ptx, key, "xxx");
     fwrite(buffer_get(b), 1, buffer_size(b), fd);
     fclose(fd);
   }
diff --git a/tests/sample.c b/tests/sample.c
index c426529..0ccdb60 100644
--- a/tests/sample.c
+++ b/tests/sample.c
@@ -5,8 +5,12 @@ int main() {
   pcp_key_t *alice, *bob;
   pcp_pubkey_t *alicepub, *bobpub, *pubhash;
   Pcpstream *clear_in, *crypt_out, *clear_out;
+  PCPCTX *ptx;
   char message[] = "hello world"; 
 
+  /* we always need a context */
+  ptx = ptx_new();
+
   /* generate the keypairs for both */
   alice = pcpkey_new();
   bob = pcpkey_new();
@@ -30,7 +34,7 @@ int main() {
 
   /* actually encrypt the message, don't sign it
      Alice is the sender, Bob is the recipient */
-  pcp_encrypt_stream(clear_in, crypt_out, alice, pubhash, 0);
+  pcp_encrypt_stream(ptx, clear_in, crypt_out, alice, pubhash, 0);
 
   /* now, print the encrypted result */
   fprintf(stderr, "Alice encrypted %"FMT_SIZE_T" bytes for Bob:\n", (SIZE_T_CAST)strlen(message));
@@ -42,14 +46,13 @@ int main() {
   clear_out =  ps_new_outbuffer();
 
   /* in order for the decryptor find the senders public key,
-     we need to put it into the global hash. this step can be
-  omitted when using a Vault. */
-  pcppubkey_hash = NULL;
-  HASH_ADD_STR( pcppubkey_hash , id, alicepub);
+     we need to put it into the context hash. this step can be
+     omitted when using a Vault. */
+  pcphash_add(ptx, alicepub, alicepub->type);
 
   /* try to decrypt the message */
-  if(pcp_decrypt_stream(crypt_out, clear_out, bob, NULL, 0) == 0)
-    fatals_ifany();
+  if(pcp_decrypt_stream(ptx, crypt_out, clear_out, bob, NULL, 0) == 0)
+    fatals_ifany(ptx);
   else {
     /* and finally print out the decrypted message */
     fprintf(stderr, "Bob decrypted %"FMT_SIZE_T" bytes from Alice:\n", (SIZE_T_CAST)buffer_size(ps_buffer(crypt_out)));
@@ -60,6 +63,8 @@ int main() {
   ps_close(crypt_out);
   ps_close(clear_out);
 
+  ptx_clean(ptx);
+
   free(alice);
   free(alicepub);
   free(bob);