diff --git a/.gitmodules b/.gitmodules
index 6a56b5e..8098791 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -20,3 +20,9 @@
 [submodule "upstream/mbedtls"]
 	path = upstream/mbedtls
 	url = https://github.com/ARMmbed/mbedtls
+[submodule "upstream/musl"]
+	path = upstream/musl
+	url = git://git.musl-libc.org/musl
+[submodule "upstream/tinyalloc"]
+	path = upstream/tinyalloc
+	url = https://github.com/thi-ng/tinyalloc
diff --git a/demo/fw/Makefile b/demo/fw/Makefile
index 7c728e3..355241f 100644
--- a/demo/fw/Makefile
+++ b/demo/fw/Makefile
@@ -7,6 +7,7 @@ CUBE_CMSIS_DIR 	?= ../../upstream/cmsis_device_f4
 CMSIS_DIR 		?= ../../upstream/CMSIS_5
 MUSL_DIR		?= ../../upstream/musl
 MBEDTLS_DIR		?= ../../upstream/mbedtls
+TINYALLOC_DIR	?= ../../upstream/tinyalloc
 
 ########################################################################################################################
 # Sources
@@ -22,8 +23,18 @@ C_SOURCES		+= src/cage.c
 C_SOURCES		+= src/cage_base64.c
 C_SOURCES		+= src/bech32.c
 C_SOURCES		+= tinyprintf/tinyprintf.c
+C_SOURCES		+= $(TINYALLOC_DIR)/tinyalloc.c
 
-MUSL_SOURCES		:=
+MUSL_SOURCES		:= string/strchr.c
+MUSL_SOURCES		+= string/strchrnul.c
+MUSL_SOURCES		+= string/strstr.c
+MUSL_SOURCES		+= string/memchr.c
+MUSL_SOURCES		+= string/memset.c
+MUSL_SOURCES		+= string/memcmp.c
+MUSL_SOURCES		+= string/memcpy.c
+MUSL_SOURCES		+= string/strlen.c
+MUSL_SOURCES		+= string/strnlen.c
+MUSL_SOURCES		+= string/strncmp.c
 MUSL_SOURCES		:= $(addprefix $(MUSL_DIR)/src/,$(MUSL_SOURCES))
 
 C_SOURCES += $(MUSL_SOURCES)
@@ -75,10 +86,9 @@ SYSTEM_FLAGS	?= -nostdlib -ffreestanding -nostartfiles
 
 #CFLAGS				+= -I$(abspath musl_include_shims)
 INCLUDES			+= -I$(CUBE_CMSIS_DIR)/Include -I$(CMSIS_DIR)/CMSIS/Core/Include
-INCLUDES			+= -Itinyprintf -I$(MBEDTLS_DIR)/include
-COMMON_INCLUDES		+= -I$(BUILDDIR) -Isrc
-MBEDTLS_CONFIG_INCLUDE := -I$(realpath include)
-INCLUDES			+= $(MBEDTLS_CONFIG_INCLUDE)
+INCLUDES			+= -Itinyprintf -I$(MBEDTLS_DIR)/include -I$(TINYALLOC_DIR)
+MBEDTLS_CONFIG_INCLUDE := -I$(realpath include) -DMBEDTLS_CONFIG_FILE='<tb_mbedtls_config.h>'
+COMMON_INCLUDES		+= -I$(BUILDDIR) -Isrc $(MBEDTLS_CONFIG_INCLUDE)
 
 COMMON_CFLAGS	+= -O0 -std=gnu11 -g -DSTM32F407xx -DSTM32F4 -DDEBUG=$(DEBUG) -DMBEDTLS_ALLOW_PRIVATE_ACCESS
 CFLAGS			+= $(ARCH_FLAGS) $(SYSTEM_FLAGS)
@@ -86,7 +96,7 @@ CFLAGS			+= $(ARCH_FLAGS) $(SYSTEM_FLAGS)
 CFLAGS			+= -fno-common -ffunction-sections -fdata-sections
 
 # for musl
-#CFLAGS			+= -Dhidden=
+CFLAGS			+= -Dhidden= 
 
 SIM_CFLAGS	+= -lm -DSIMULATION
 SIM_CFLAGS	+= -Wall -Wextra -Wpedantic -Wshadow -Wimplicit-function-declaration -Wundef -Wno-unused-parameter
@@ -120,7 +130,7 @@ all: binsize
 
 .PHONY: binsize
 binsize: $(BUILDDIR)/$(BINARY) $(BUILDDIR)/$(BINARY:.elf=-symbol-sizes.pdf)
-	$(LD) -T$(LDSCRIPT) $(LDFLAGS) -Wl,--print-memory-usage -o /dev/null $(ALL_OBJS) $(LIBS)
+	$(LD) -T$(LDSCRIPT) $(LDFLAGS) -Wl,--print-memory-usage -o /dev/null $(ALL_OBJS) $(BUILDDIR)/libmbedcrypto.a $(LIBS)
 	@echo
 	@echo "▐▬▬▬▌ SyMbOL sIzE HiGhScORe LiSt ▐▬▬▬▌"
 	$(NM) --print-size --size-sort --radix=d $< | tail -n 20
@@ -129,12 +139,12 @@ binsize: $(BUILDDIR)/$(BINARY) $(BUILDDIR)/$(BINARY:.elf=-symbol-sizes.pdf)
 $(BUILDDIR)/generated: ; mkdir -p $@
 
 .PRECIOUS: $(BUILDDIR)/$(BINARY) 
-$(BUILDDIR)/$(BINARY) $(BUILDDIR)/$(BINARY:.elf=.map) &: $(ALL_OBJS)
+$(BUILDDIR)/$(BINARY) $(BUILDDIR)/$(BINARY:.elf=.map) &: $(ALL_OBJS) $(BUILDDIR)/libmbedcrypto.a
 	$(LD) -T$(LDSCRIPT) $(LDFLAGS) -o $@ -Wl,-Map=$(BUILDDIR)/$(BINARY:.elf=.map) $^ $(LIBS)
 
 $(BUILDDIR)/libmbedcrypto.a:
 	make -C $(MBEDTLS_DIR) clean
-	make -C $(MBEDTLS_DIR) CC=$(CC) LD=$(LD) CFLAGS="$(CFLAGS) $(COMMON_CFLAGS) $(MBEDTLS_CONFIG_INCLUDE)" LDFLAGS="$(LDFLAGS)" lib
+	make -C $(MBEDTLS_DIR) CC=$(CC) LD=$(LD) CFLAGS="$(CFLAGS) $(COMMON_CFLAGS) $(MBEDTLS_CONFIG_INCLUDE) -w" LDFLAGS="$(LDFLAGS)" lib
 	mv $(MBEDTLS_DIR)/library/libmbedcrypto.a $@
 
 build/$(BINARY:.elf=-symbol-sizes.dot): $(ALL_OBJS) $(BUILDDIR)/libmbedcrypto.a
@@ -170,6 +180,7 @@ clean:
 	make -C $(MBEDTLS_DIR) clean
 	rm -rf $(BUILDDIR)/src
 	rm -rf $(BUILDDIR)/generated
+	rm -f $(BUILDDIR)/libmbedcrypto.a
 	rm -f $(BUILDDIR)/$(BINARY)
 	rm -f $(BUILDDIR)/$(BINARY:.elf=.map)
 	rm -f $(BUILDDIR)/$(BINARY:.elf=-symbol-sizes.dot)
diff --git a/demo/fw/include/mbedtls/mbedtls_config.h b/demo/fw/include/tb_mbedtls_config.h
similarity index 99%
rename from demo/fw/include/mbedtls/mbedtls_config.h
rename to demo/fw/include/tb_mbedtls_config.h
index 09775e2..30e69a3 100644
--- a/demo/fw/include/mbedtls/mbedtls_config.h
+++ b/demo/fw/include/tb_mbedtls_config.h
@@ -2657,7 +2657,7 @@
  * Caller:  library/md.c
  *
  */
-#define MBEDTLS_RIPEMD160_C
+//#define MBEDTLS_RIPEMD160_C
 
 /**
  * \def MBEDTLS_RSA_C
@@ -2765,7 +2765,7 @@
  *
  * This module adds support for SHA-512.
  */
-#define MBEDTLS_SHA512_C
+//#define MBEDTLS_SHA512_C
 
 /**
  * \def MBEDTLS_SSL_CACHE_C
diff --git a/demo/fw/src/main.c b/demo/fw/src/main.c
index 1bf4511..8f17c2f 100644
--- a/demo/fw/src/main.c
+++ b/demo/fw/src/main.c
@@ -26,11 +26,14 @@
 #include <string.h>
 #include <math.h>
 
+#include <tinyalloc.h>
 #include <stm32f407xx.h>
 
 #include "jl_global.h"
 #include "con_usart.h"
 #include "spi.h"
+#include "cage.h"
+#include "bech32.h"
 
 unsigned int sysclk_speed = 0;
 unsigned int apb1_speed = 0;
@@ -174,6 +177,40 @@ static void spi_fpga_setup(void)
     spif_init(&spif, SPI1, &spi_fpga_if_set_cs);
 }
 
+unsigned long strtoul(const char *nptr, char **endptr, int base) {
+    if (endptr)
+        *endptr = NULL;
+
+    assert (0 < base && base <= 16);
+
+    unsigned long acc = 0;
+    while (1) {
+        int val = -1;
+        char c = *nptr;
+        if ('0' <= c && c <= '9')
+            val = c - '0';
+        else if ('a' <= c && c <= 'f')
+            val = c - 'a';
+        else
+            val = c - 'A';
+
+        if (val < 0 || val >= base) {
+            if (endptr)
+                *endptr = nptr;
+            return acc;
+        }
+
+        acc = acc * base + val;
+        nptr += 1;
+    }
+}
+
+void *malloc(size_t size) { return ta_alloc(size); }
+void free(void *ptr) { ta_free(ptr); }
+void *calloc(size_t nmemb, size_t size) { return ta_calloc(nmemb, size); }
+
+unsigned char ta_heap[0x10000];
+
 int main(void)
 {
     if (((SCB->CPACR>>20) & 0xf) != 0xf) {
@@ -198,6 +235,38 @@ int main(void)
     GPIOA->MODER |= (1<<GPIO_MODER_MODER11_Pos) | (1<<GPIO_MODER_MODER12_Pos) | (1<<GPIO_MODER_MODER15_Pos);
 #endif
 
+    ta_init(ta_heap, ta_heap+sizeof(ta_heap), 256, 16, 8);
+
+    /* Begin crypto test */
+    char hrp[64];
+    char private_key[64];
+    size_t bech32_key_len;
+    enum bech32_err b32_err = bech32_decode(hrp, sizeof(hrp), private_key, sizeof(private_key), &bech32_key_len, "AGE-SECRET-KEY-14KZ457X5JQUZCMAXJ0EVHFH23RTMG3QD2FURNK5H7XXGCEU9FSXQWD2ZPW", NULL);
+    assert (!b32_err);
+    assert (bech32_key_len == 32);
+
+    struct ca_keystore ks;
+    ca_keystore_init(&ks);
+    enum ca_error err = ca_keystore_load_x25519_private_key(&ks, private_key);
+    assert (!err);
+
+    size_t bufsize = 16384;
+    char *buf = malloc(bufsize);
+    assert (buf);
+    size_t read_pos = 0;
+    buf[0] = '\0';
+
+    unsigned char file_key[16];
+    err = parse_age_buf(&ks, buf, read_pos+1, file_key);
+    assert (!err);
+    unsigned char *decrypted = malloc(bufsize);
+    assert (decrypted);
+
+    size_t decrypted_size = 0;
+    err = stream_decrypt(decrypted, bufsize, &decrypted_size, buf, read_pos, file_key);
+    assert (!err);
+
+    /* End crypto test */
     con_printf("Booted.\r\n");
 
     unsigned int i = 0;
diff --git a/upstream/musl b/upstream/musl
new file mode 160000
index 0000000..1f0c7cb
--- /dev/null
+++ b/upstream/musl
@@ -0,0 +1 @@
+Subproject commit 1f0c7cb1cc2170bf230623dc0b57d9a9f001af08
diff --git a/upstream/tinyalloc b/upstream/tinyalloc
new file mode 160000
index 0000000..7273051
--- /dev/null
+++ b/upstream/tinyalloc
@@ -0,0 +1 @@
+Subproject commit 7273051682ee0b9235bd24b7544f9fe643a023f5