Jan Včelák
--- a/src/dnssec/lib/error.c
+++ b/src/dnssec/lib/error.c
 	{ DNSSEC_SIGN_INIT_ERROR,	"signing initialization error" },
 	{ DNSSEC_SIGN_ERROR,		"signing error" },
 	{ DNSSEC_INVALID_SIGNATURE,	"invalid signature" },
+
 	{ DNSSEC_INVALID_NSEC3_ALGORITHM, "invalid NSEC3 algorithm" },
--- a/src/dnssec/lib/key/ds.c
+++ b/src/dnssec/lib/key/ds.c
+/*!
+* Convert DNSSEC DS digest algorithm to GnuTLS digest algorithm.
+*/
+static gnutls_digest_algorithm_t lookup_algorithm(dnssec_key_digest_t algorithm)
+{
+	switch (algorithm) {
+	case DNSSEC_KEY_DIGEST_SHA1:   return GNUTLS_DIG_SHA1;
+	case DNSSEC_KEY_DIGEST_SHA256: return GNUTLS_DIG_SHA256;
+	case DNSSEC_KEY_DIGEST_SHA384: return GNUTLS_DIG_SHA384;
+	default:
+		return GNUTLS_DIG_UNKNOWN;
+	};
+}
+
+static void wire_write_digest(wire_ctx_t *wire,
+			      gnutls_hash_hd_t digest, int digest_size)
--- a/src/dnssec/lib/key/ds.c
+++ b/src/dnssec/lib/key/ds.c
+	};
+}
+
+static void wire_write_digest(wire_ctx_t *wire,
+			      gnutls_hash_hd_t digest, int digest_size)
+{
+	assert(wire_available(wire) >= digest_size);
+	gnutls_hash_output(digest, wire->position);
+	wire->position += digest_size;
+}
+
 _public_
-int dnssec_key_create_ds(const dnssec_key_t *key, dnssec_key_digest_t digest,
-			 dnssec_binary_t *rdata)
+int dnssec_key_create_ds(const dnssec_key_t *key,
+			 dnssec_key_digest_t ds_algorithm,