diff --git a/src/main.rs b/src/main.rs
index b1df999b6734c274cb7a615ff595ac0218a88dcc..d56e0d3631bf93972fd52fb52634ef9e384b22c8 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -3,6 +3,9 @@
 
 // The trusted code base, providing services such as Authorization, Encrytion
 mod trusted {
+    use std::str::from_utf8;
+    pub type Key = [u8; 3];
+
     pub struct Sec {
         level: u8,
     }
@@ -32,9 +35,60 @@ mod trusted {
         }
     }
 
-    pub fn auth(s: &str) -> Sec {
-        unsafe { if s == "abc" { Sec::new(2) } else { Sec::new(0) } }
+    pub mod aut {
+        use trusted::*;
+        // should be in State
+        static CH: [(&str, &str); 3] =
+            [("abc", "abc"), ("bcd", "bcd"), ("cde", "cde")];
+        static mut CH_NR: usize = 0;
+
+        pub fn expire() {
+            unsafe {
+                CH_NR = (CH_NR + 1).wrapping_rem(CH.len());
+                println!("ch {} your challenge is {:?}", CH_NR, CH[CH_NR].0);
+            }
+        }
+
+        pub fn check(key: &Key) -> bool {
+            let s = from_utf8(key).unwrap();
+            unsafe { s == CH[CH_NR].1 }
+        }
+
+        pub fn auth(key: &Key) -> Sec {
+            unsafe { if check(key) { Sec::new(2) } else { Sec::new(0) } }
+        }
+    }
+
+    // structure to pass decryptable data
+    struct Data<T> {
+        key: Key,
+        data: T,
     }
+
+    impl<T> Data<T> {
+        pub const fn new(d: T) -> Self {
+            Data {
+                key: [0, 0, 0],
+                data: d,
+            }
+        }
+
+        // deref ?
+        pub fn get(&self) -> Option<&T> {
+            if aut::check(&self.key) {
+                Some(&self.data)
+            } else {
+                None
+            }
+        }
+    }
+
+    /*
+    impl Aut for Data {
+	    fn encrypt(aut: Sec, R) -> S;
+        fn decrypt(aut: Sec, S) -> R;	
+    }
+    */
 }
 
 static mut U1: u1::State = u1::State::new();
@@ -44,9 +98,11 @@ static mut U2: u2::State = u2::State::new();
 // Main should be inside trusted
 fn main() {
     println!("trusted base");
+
     let mut u1 = unsafe { &mut U1 };
     let mut u2 = unsafe { &mut U2 };
     unsafe {
+
         let s = Sec::new(1);
         // s.level = 3;
         u1.user1(&s);
@@ -56,6 +112,14 @@ fn main() {
         u2.user2(&s, &mut u1); // try with key set
         u2.expire(&s);
         u2.user2(&s, &mut u1); // try with key set
+
+        u2.enter(&s, "abc"); //
+        u2.user2(&s, &mut u1); // try with key set
+        trusted::aut::expire();
+        u2.user2(&s, &mut u1); // try with key set
+        u2.enter(&s, "bcd"); //
+        u2.user2(&s, &mut u1); // try with key set
+
     };
 }
 
@@ -63,7 +127,8 @@ fn main() {
 // user code
 // compiler directive, disallow unsafe code
 // unsafe constructor new
-use trusted::{Sec, auth};
+use trusted::Sec;
+use trusted::aut::auth;
 
 //
 
@@ -108,30 +173,39 @@ mod u1 {
 
 mod u2 {
     use ::*;
+    use trusted::*;
+    //  use std::slice::bytes;
+    //  use std::cmp;
 
     pub struct State {
-        key: &'static str,
+        key: Key,
+    }
+
+    fn copy_slice(dst: &mut [u8], src: &[u8]) -> () {
+        for (d, s) in dst.iter_mut().zip(src.iter()) {
+            *d = *s;
+        }
     }
 
     impl State {
         pub const fn new() -> Self {
-            State { key: "---" }
+            State { key: [0, 0, 0] }
         }
 
         pub fn user2(&mut self, sec: &Sec, u1: &mut u1::State) {
             println!("user2, level = {}", sec.level());
-            let s = auth(self.key);
+            let s = auth(&self.key);
             println!("user2, data = {:?}", u1.get_data(sec, &s));
         }
 
         pub fn enter(&mut self, sec: &Sec, k: &str) {
             println!("enter, level = {}", sec.level());
-            self.key = "abc";
+            copy_slice(&mut self.key, k.as_bytes());
         }
 
         pub fn expire(&mut self, sec: &Sec) {
             println!("enter, level = {}", sec.level());
-            self.key = "---";
+            self.key = [0, 0, 0];
         }
     }
 }