diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml
index 32327027218..aa533f1bc24 100644
--- a/.idea/codeStyles/Project.xml
+++ b/.idea/codeStyles/Project.xml
@@ -125,6 +125,8 @@
     <codeStyleSettings language="kotlin">
       <option name="CODE_STYLE_DEFAULTS" value="KOTLIN_OFFICIAL" />
       <option name="KEEP_BLANK_LINES_IN_DECLARATIONS" value="1" />
+      <option name="KEEP_BLANK_LINES_IN_CODE" value="1" />
+      <option name="KEEP_BLANK_LINES_BEFORE_RBRACE" value="0" />
     </codeStyleSettings>
   </code_scheme>
 </component>
diff --git a/Corona-Warn-App/build.gradle b/Corona-Warn-App/build.gradle
index 1d3229d5b65..384bcddf02b 100644
--- a/Corona-Warn-App/build.gradle
+++ b/Corona-Warn-App/build.gradle
@@ -276,6 +276,8 @@ dependencies {
     testImplementation "io.kotest:kotest-runner-junit5:4.2.0"
     testImplementation "io.kotest:kotest-assertions-core-jvm:4.2.0"
     testImplementation "io.kotest:kotest-property-jvm:4.2.0"
+    androidTestImplementation "io.kotest:kotest-assertions-core-jvm:4.2.0"
+    androidTestImplementation "io.kotest:kotest-property-jvm:4.2.0"
 
     // Testing - Instrumentation
     androidTestImplementation 'androidx.test:runner:1.2.0'
diff --git a/Corona-Warn-App/schemas/de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheDatabase/1.json b/Corona-Warn-App/schemas/de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheDatabase/1.json
new file mode 100644
index 00000000000..72e78dde4ed
--- /dev/null
+++ b/Corona-Warn-App/schemas/de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheDatabase/1.json
@@ -0,0 +1,76 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 1,
+    "identityHash": "c4ef5f7d4d9672d11c8eb97a63d4a3c5",
+    "entities": [
+      {
+        "tableName": "keyfiles",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `type` TEXT NOT NULL, `location` TEXT NOT NULL, `day` TEXT NOT NULL, `hour` TEXT, `createdAt` TEXT NOT NULL, `checksumMD5` TEXT, `completed` INTEGER NOT NULL, PRIMARY KEY(`id`))",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "location",
+            "columnName": "location",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "day",
+            "columnName": "day",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "hour",
+            "columnName": "hour",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "createdAt",
+            "columnName": "createdAt",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "checksumMD5",
+            "columnName": "checksumMD5",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "isDownloadComplete",
+            "columnName": "completed",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "columnNames": [
+            "id"
+          ],
+          "autoGenerate": false
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'c4ef5f7d4d9672d11c8eb97a63d4a3c5')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/Corona-Warn-App/schemas/de.rki.coronawarnapp.storage.keycache.KeyCacheDatabase/1.json b/Corona-Warn-App/schemas/de.rki.coronawarnapp.storage.keycache.KeyCacheDatabase/1.json
new file mode 100644
index 00000000000..9d856a5a015
--- /dev/null
+++ b/Corona-Warn-App/schemas/de.rki.coronawarnapp.storage.keycache.KeyCacheDatabase/1.json
@@ -0,0 +1,82 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 1,
+    "identityHash": "03f6e8cba631c8ef60e506006913a1ad",
+    "entities": [
+      {
+        "tableName": "keyfiles",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`id` TEXT NOT NULL, `type` TEXT NOT NULL, `location` TEXT NOT NULL, `day` TEXT NOT NULL, `hour` TEXT, `sourceUrl` TEXT NOT NULL, `createdAt` TEXT NOT NULL, `checksumMD5` TEXT, `completed` INTEGER NOT NULL, PRIMARY KEY(`id`))",
+        "fields": [
+          {
+            "fieldPath": "id",
+            "columnName": "id",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "type",
+            "columnName": "type",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "location",
+            "columnName": "location",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "day",
+            "columnName": "day",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "hour",
+            "columnName": "hour",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "sourceUrl",
+            "columnName": "sourceUrl",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "createdAt",
+            "columnName": "createdAt",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "checksumMD5",
+            "columnName": "checksumMD5",
+            "affinity": "TEXT",
+            "notNull": false
+          },
+          {
+            "fieldPath": "isDownloadComplete",
+            "columnName": "completed",
+            "affinity": "INTEGER",
+            "notNull": true
+          }
+        ],
+        "primaryKey": {
+          "columnNames": [
+            "id"
+          ],
+          "autoGenerate": false
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '03f6e8cba631c8ef60e506006913a1ad')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabaseTest.kt b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabaseTest.kt
new file mode 100644
index 00000000000..ac0ccdefe87
--- /dev/null
+++ b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabaseTest.kt
@@ -0,0 +1,79 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import android.content.Context
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import io.kotest.matchers.shouldBe
+import kotlinx.coroutines.runBlocking
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@RunWith(AndroidJUnit4::class)
+class KeyCacheDatabaseTest {
+    private val database = KeyCacheDatabase.Factory(
+        ApplicationProvider.getApplicationContext<Context>()
+    ).create()
+    private val dao = database.cachedKeyFiles()
+
+    @Test
+    fun crud() {
+        val keyDay = CachedKeyInfo(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("DE"),
+            day = LocalDate.now(),
+            hour = null,
+            createdAt = Instant.now()
+        )
+        val keyHour = CachedKeyInfo(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("DE"),
+            day = LocalDate.now(),
+            hour = LocalTime.now(),
+            createdAt = Instant.now()
+        )
+        runBlocking {
+            dao.clear()
+
+            dao.insertEntry(keyDay)
+            dao.insertEntry(keyHour)
+            dao.getAllEntries() shouldBe listOf(keyDay, keyHour)
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_DAY.typeValue) shouldBe listOf(keyDay)
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_HOUR.typeValue) shouldBe listOf(keyHour)
+
+            dao.updateDownloadState(keyDay.toDownloadUpdate("coffee"))
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_DAY.typeValue).single().apply {
+                isDownloadComplete shouldBe true
+                checksumMD5 shouldBe "coffee"
+            }
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_HOUR.typeValue).single().apply {
+                isDownloadComplete shouldBe false
+                checksumMD5 shouldBe null
+            }
+
+            dao.updateDownloadState(keyHour.toDownloadUpdate("with milk"))
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_DAY.typeValue).single().apply {
+                isDownloadComplete shouldBe true
+                checksumMD5 shouldBe "coffee"
+            }
+            dao.getEntriesForType(CachedKeyInfo.Type.COUNTRY_HOUR.typeValue).single().apply {
+                isDownloadComplete shouldBe true
+                checksumMD5 shouldBe "with milk"
+            }
+
+            dao.deleteEntry(keyDay)
+            dao.getAllEntries() shouldBe listOf(
+                keyHour.copy(
+                    isDownloadComplete = true,
+                    checksumMD5 = "with milk"
+                )
+            )
+
+            dao.clear()
+            dao.getAllEntries() shouldBe emptyList()
+        }
+    }
+}
diff --git a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDaoTest.kt b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDaoTest.kt
deleted file mode 100644
index 31f173f6c73..00000000000
--- a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDaoTest.kt
+++ /dev/null
@@ -1,88 +0,0 @@
-package de.rki.coronawarnapp.storage.keycache
-
-import android.content.Context
-import androidx.room.Room
-import androidx.test.core.app.ApplicationProvider
-import androidx.test.ext.junit.runners.AndroidJUnit4
-import com.google.common.truth.Truth.assertThat
-import de.rki.coronawarnapp.storage.AppDatabase
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Before
-import org.junit.Test
-import org.junit.runner.RunWith
-
-/**
- * KeyCacheDao test.
- */
-@RunWith(AndroidJUnit4::class)
-class KeyCacheDaoTest {
-    private lateinit var keyCacheDao: KeyCacheDao
-    private lateinit var db: AppDatabase
-
-    @Before
-    fun setUp() {
-        val context = ApplicationProvider.getApplicationContext<Context>()
-        db = Room.inMemoryDatabaseBuilder(
-            context, AppDatabase::class.java
-        ).build()
-        keyCacheDao = db.dateDao()
-    }
-
-    /**
-     * Test Create / Read / Delete DB operations.
-     */
-    @Test
-    fun testCRDOperations() {
-        runBlocking {
-            val dates = KeyCacheEntity().apply {
-                this.id = "0"
-                this.path = "0"
-                this.type = 0
-            }
-            val hours = KeyCacheEntity().apply {
-                this.id = "1"
-                this.path = "1"
-                this.type = 1
-            }
-
-            assertThat(keyCacheDao.getAllEntries().isEmpty()).isTrue()
-
-            keyCacheDao.insertEntry(dates)
-            keyCacheDao.insertEntry(hours)
-
-            var all = keyCacheDao.getAllEntries()
-
-            assertThat(all.size).isEqualTo(2)
-
-            val selectedDates = keyCacheDao.getDates()
-            assertThat(selectedDates.size).isEqualTo(1)
-            assertThat(selectedDates[0].type).isEqualTo(0)
-            assertThat(selectedDates[0].id).isEqualTo(dates.id)
-
-            val selectedHours = keyCacheDao.getHours()
-            assertThat(selectedHours.size).isEqualTo(1)
-            assertThat(selectedHours[0].type).isEqualTo(1)
-            assertThat(selectedHours[0].id).isEqualTo(hours.id)
-
-            keyCacheDao.clearHours()
-
-            all = keyCacheDao.getAllEntries()
-            assertThat(all.size).isEqualTo(1)
-            assertThat(all[0].type).isEqualTo(0)
-
-            keyCacheDao.insertEntry(hours)
-
-            assertThat(keyCacheDao.getAllEntries().size).isEqualTo(2)
-
-            keyCacheDao.clear()
-
-            assertThat(keyCacheDao.getAllEntries().isEmpty()).isTrue()
-        }
-    }
-
-    @After
-    fun closeDb() {
-        db.close()
-    }
-}
diff --git a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/DBPasswordTest.kt b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/DBPasswordTest.kt
index 5f1267524ea..efbab656804 100644
--- a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/DBPasswordTest.kt
+++ b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/DBPasswordTest.kt
@@ -22,7 +22,8 @@ package de.rki.coronawarnapp.util.security
 import android.content.Context
 import androidx.test.core.app.ApplicationProvider
 import de.rki.coronawarnapp.storage.AppDatabase
-import de.rki.coronawarnapp.storage.keycache.KeyCacheEntity
+import de.rki.coronawarnapp.storage.tracing.TracingIntervalEntity
+import io.kotest.matchers.shouldBe
 import kotlinx.coroutines.runBlocking
 import net.sqlcipher.database.SQLiteException
 import org.hamcrest.Matchers.equalTo
@@ -33,8 +34,6 @@ import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 import org.junit.runners.JUnit4
-import java.util.UUID
-import kotlin.random.Random
 
 @RunWith(JUnit4::class)
 class DBPasswordTest {
@@ -70,16 +69,14 @@ class DBPasswordTest {
     @Test
     fun canLoadDataFromEncryptedDatabase() {
         runBlocking {
-            val id = UUID.randomUUID().toString()
-            val path = UUID.randomUUID().toString()
-            val type = Random.nextInt(1000)
-
-            insertFakeEntity(id, path, type)
-            val keyCacheEntity = loadFakeEntity()
-
-            assertThat(keyCacheEntity.id, equalTo(id))
-            assertThat(keyCacheEntity.path, equalTo(path))
-            assertThat(keyCacheEntity.type, equalTo(type))
+            val from = 123L
+            val to = 456L
+            insertFakeEntity(from, to)
+
+            loadFakeEntity().apply {
+                this.from shouldBe from
+                this.to shouldBe to
+            }
         }
     }
 
@@ -95,34 +92,32 @@ class DBPasswordTest {
     @Test(expected = SQLiteException::class)
     fun loadingDataFromDatabaseWillFailWhenPassphraseIsIncorrect() {
         runBlocking {
-            val id = UUID.randomUUID().toString()
-            val path = UUID.randomUUID().toString()
-            val type = Random.nextInt(1000)
-            insertFakeEntity(id, path, type)
+            val from = 123L
+            val to = 456L
+            insertFakeEntity(from, to)
 
             clearSharedPreferences()
             AppDatabase.resetInstance()
 
-            val keyCacheEntity = loadFakeEntity()
-            assertThat(keyCacheEntity.id, equalTo(id))
-            assertThat(keyCacheEntity.path, equalTo(path))
-            assertThat(keyCacheEntity.type, equalTo(type))
+            loadFakeEntity().apply {
+                this.from shouldBe from
+                this.to shouldBe to
+            }
         }
     }
 
     private suspend fun insertFakeEntity(
-        id: String,
-        path: String,
-        type: Int
+        from: Long,
+        to: Long
     ) {
-        db.dateDao().insertEntry(KeyCacheEntity().apply {
-            this.id = id
-            this.path = path
-            this.type = type
+        db.tracingIntervalDao().insertInterval(TracingIntervalEntity().apply {
+            this.from = from
+            this.to = to
         })
     }
 
-    private suspend fun loadFakeEntity(): KeyCacheEntity = db.dateDao().getAllEntries().first()
+    private suspend fun loadFakeEntity(): TracingIntervalEntity =
+        db.tracingIntervalDao().getAllIntervals().first()
 
     private fun clearSharedPreferences() =
         SecurityHelper.globalEncryptedSharedPreferencesInstance.edit().clear().commit()
diff --git a/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/VerificationKeysTest.kt b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/VerificationKeysTest.kt
new file mode 100644
index 00000000000..f43f22095c6
--- /dev/null
+++ b/Corona-Warn-App/src/androidTest/java/de/rki/coronawarnapp/util/security/VerificationKeysTest.kt
@@ -0,0 +1,71 @@
+package de.rki.coronawarnapp.util.security
+
+import de.rki.coronawarnapp.exception.CwaSecurityException
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.matchers.shouldBe
+import okio.ByteString.Companion.decodeHex
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.junit.runners.JUnit4
+
+@RunWith(JUnit4::class)
+class VerificationKeysTest {
+
+    private fun createTool() = VerificationKeys()
+
+    @Test
+    fun goodBinaryAndSignature() {
+        val tool = createTool()
+        tool.hasInvalidSignature(
+            GOOD_BINARY.decodeHex().toByteArray(),
+            GOOD_SIGNATURE.decodeHex().toByteArray()
+        ) shouldBe false
+    }
+
+    @Test
+    fun badBinaryGoodSignature() {
+        val tool = createTool()
+        tool.hasInvalidSignature(
+            "123ABC".decodeHex().toByteArray(),
+            GOOD_SIGNATURE.decodeHex().toByteArray()
+        ) shouldBe true
+    }
+
+    @Test
+    fun goodBinaryBadSignature() {
+        val tool = createTool()
+        shouldThrow<CwaSecurityException> {
+            tool.hasInvalidSignature(
+                GOOD_BINARY.decodeHex().toByteArray(),
+                "123ABC".decodeHex().toByteArray()
+            )
+        }
+    }
+
+    @Test
+    fun badEverything() {
+        val tool = createTool()
+        shouldThrow<CwaSecurityException> {
+            tool.hasInvalidSignature(
+                "123ABC".decodeHex().toByteArray(),
+                "123ABC".decodeHex().toByteArray()
+            )
+        }
+    }
+
+    companion object {
+        private const val GOOD_BINARY =
+            "080b124d0a230a034c4f57180f221a68747470733a2f2f7777772e636f726f6e617761726e2e6170700a26" +
+                    "0a0448494748100f1848221a68747470733a2f2f7777772e636f726f6e617761726e2e6170701a" +
+                    "640a10080110021803200428053006380740081100000000000049401a0a200128013001380140" +
+                    "012100000000000049402a10080510051805200528053005380540053100000000000034403a0e" +
+                    "1001180120012801300138014001410000000000004940221c0a040837103f1212090000000000" +
+                    "00f03f11000000000000e03f20192a1a0a0a0a041008180212021005120c0a0408011804120408" +
+                    "011804"
+        private const val GOOD_SIGNATURE =
+            "0a87010a380a1864652e726b692e636f726f6e617761726e6170702d6465761a02763122033236322a1331" +
+                    "2e322e3834302e31303034352e342e332e321001180122473045022100cf32ff24ea18a1ffcc7f" +
+                    "f4c9fe8d1808cecbc5a37e3e1d4c9ce682120450958c022064bf124b6973a9b510a43d479ff93e" +
+                    "0ef97a5b893c7af4abc4a8d399969cd8a0"
+    }
+}
diff --git a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/RiskLevelAndKeyRetrievalBenchmark.kt b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/RiskLevelAndKeyRetrievalBenchmark.kt
index 85b980a36e0..e92c287573f 100644
--- a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/RiskLevelAndKeyRetrievalBenchmark.kt
+++ b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/RiskLevelAndKeyRetrievalBenchmark.kt
@@ -5,9 +5,9 @@ import android.text.format.Formatter
 import de.rki.coronawarnapp.exception.ExceptionCategory
 import de.rki.coronawarnapp.exception.TransactionException
 import de.rki.coronawarnapp.exception.reporting.report
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction
 import de.rki.coronawarnapp.transaction.RiskLevelTransaction
+import de.rki.coronawarnapp.util.di.AppInjector
 import timber.log.Timber
 import kotlin.system.measureTimeMillis
 
@@ -19,8 +19,7 @@ class RiskLevelAndKeyRetrievalBenchmark(
     /**
      * the key cache instance used to store queried dates and hours
      */
-    private val keyCache =
-        KeyCacheRepository.getDateRepository(context)
+    private val keyCache = AppInjector.component.keyCacheRepository
 
     /**
      * Calls the RetrieveDiagnosisKeysTransaction and RiskLevelTransaction and measures them.
@@ -36,7 +35,7 @@ class RiskLevelAndKeyRetrievalBenchmark(
         var resultInfo = StringBuilder()
             .append(
                 "MEASUREMENT Running for Countries:\n " +
-                        "${countries?.joinToString(", ")}\n\n"
+                        "${countries.joinToString(", ")}\n\n"
             )
             .append("Result: \n\n")
             .append("#\t Combined \t Download \t Sub \t Risk \t File # \t  F. size\n")
diff --git a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestForAPIFragment.kt b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestForAPIFragment.kt
index ac579527077..1e457e5ad9f 100644
--- a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestForAPIFragment.kt
+++ b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestForAPIFragment.kt
@@ -33,6 +33,7 @@ import com.google.zxing.integration.android.IntentIntegrator
 import com.google.zxing.integration.android.IntentResult
 import com.google.zxing.qrcode.QRCodeWriter
 import de.rki.coronawarnapp.databinding.FragmentTestForAPIBinding
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
 import de.rki.coronawarnapp.exception.ExceptionCategory
 import de.rki.coronawarnapp.exception.ExceptionCategory.INTERNAL
 import de.rki.coronawarnapp.exception.TransactionException
@@ -50,8 +51,8 @@ import de.rki.coronawarnapp.storage.LocalData
 import de.rki.coronawarnapp.storage.tracing.TracingIntervalRepository
 import de.rki.coronawarnapp.transaction.RiskLevelTransaction
 import de.rki.coronawarnapp.ui.viewmodel.TracingViewModel
-import de.rki.coronawarnapp.util.CachedKeyFileHolder
 import de.rki.coronawarnapp.util.KeyFileHelper
+import de.rki.coronawarnapp.util.di.AppInjector
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
@@ -60,7 +61,6 @@ import org.joda.time.DateTimeZone
 import timber.log.Timber
 import java.io.File
 import java.lang.reflect.Type
-import java.util.Date
 import java.util.UUID
 
 @SuppressWarnings("TooManyFunctions", "MagicNumber", "LongMethod")
@@ -321,9 +321,9 @@ class TestForAPIFragment : Fragment(), InternalExposureNotificationPermissionHel
         lastSetCountries = countryCodes
 
         // Trigger asyncFetchFiles which will use all Countries passed as parameter
-        val currentDate = Date(System.currentTimeMillis())
         lifecycleScope.launch {
-            CachedKeyFileHolder.asyncFetchFiles(currentDate, countryCodes)
+            val locationCodes = countryCodes.map { LocationCode(it) }
+            AppInjector.component.keyFileDownloader.asyncFetchKeyFiles(locationCodes)
             updateCountryStatusLabel()
         }
     }
diff --git a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestRiskLevelCalculation.kt b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestRiskLevelCalculation.kt
index 14ddf7a9291..945ddca4e51 100644
--- a/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestRiskLevelCalculation.kt
+++ b/Corona-Warn-App/src/deviceForTesters/java/de.rki.coronawarnapp/TestRiskLevelCalculation.kt
@@ -27,7 +27,6 @@ import de.rki.coronawarnapp.server.protocols.AppleLegacyKeyExchange
 import de.rki.coronawarnapp.service.applicationconfiguration.ApplicationConfigurationService
 import de.rki.coronawarnapp.sharing.ExposureSharingService
 import de.rki.coronawarnapp.storage.AppDatabase
-import de.rki.coronawarnapp.storage.FileStorageHelper
 import de.rki.coronawarnapp.storage.LocalData
 import de.rki.coronawarnapp.storage.RiskLevelRepository
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction
@@ -36,6 +35,7 @@ import de.rki.coronawarnapp.ui.viewmodel.SettingsViewModel
 import de.rki.coronawarnapp.ui.viewmodel.SubmissionViewModel
 import de.rki.coronawarnapp.ui.viewmodel.TracingViewModel
 import de.rki.coronawarnapp.util.KeyFileHelper
+import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.util.security.SecurityHelper
 import kotlinx.android.synthetic.deviceForTesters.fragment_test_risk_level_calculation.*
 import kotlinx.coroutines.Dispatchers
@@ -112,7 +112,7 @@ class TestRiskLevelCalculation : Fragment() {
                         // Database Reset
                         AppDatabase.reset(requireContext())
                         // Export File Reset
-                        FileStorageHelper.getAllFilesInKeyExportDirectory().forEach { it.delete() }
+                        AppInjector.component.keyCacheRepository.clear()
 
                         LocalData.lastCalculatedRiskLevel(RiskLevel.UNDETERMINED.raw)
                         LocalData.lastSuccessfullyCalculatedRiskLevel(RiskLevel.UNDETERMINED.raw)
@@ -130,6 +130,12 @@ class TestRiskLevelCalculation : Fragment() {
             }
         }
 
+        binding.buttonClearDiagnosisKeyCache.setOnClickListener {
+            lifecycleScope.launch {
+                AppInjector.component.keyCacheRepository.clear()
+            }
+        }
+
         startObserving()
     }
 
diff --git a/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_for_a_p_i.xml b/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_for_a_p_i.xml
index 2452245478a..09ac7491525 100644
--- a/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_for_a_p_i.xml
+++ b/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_for_a_p_i.xml
@@ -1,5 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
-<layout xmlns:android="http://schemas.android.com/apk/res/android">
+<layout xmlns:tools="http://schemas.android.com/tools"
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    tools:ignore="HardcodedText">
 
     <data>
 
@@ -241,8 +243,7 @@
                     android:id="@+id/input_country_codes_editText"
                     android:layout_width="0dp"
                     android:layout_height="wrap_content"
-                    android:layout_weight="1"
-                    />
+                    android:layout_weight="1" />
 
                 <Button
                     android:id="@+id/button_filter_country_codes"
diff --git a/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_risk_level_calculation.xml b/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_risk_level_calculation.xml
index a2fe370331b..83c27d3f815 100644
--- a/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_risk_level_calculation.xml
+++ b/Corona-Warn-App/src/deviceForTesters/res/layout/fragment_test_risk_level_calculation.xml
@@ -1,6 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <layout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:app="http://schemas.android.com/apk/res-auto">
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    tools:ignore="HardcodedText">
 
     <data>
 
@@ -103,6 +105,14 @@
                 android:layout_marginTop="@dimen/spacing_normal"
                 android:text="Reset Risk Level" />
 
+            <Button
+                android:id="@+id/button_clear_diagnosis_key_cache"
+                style="@style/buttonPrimary"
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:layout_marginTop="@dimen/spacing_normal"
+                android:text="Clear Diagnosis-Key cache" />
+
             <TextView
                 android:id="@+id/label_exposure_summary_title"
                 style="@style/headline6"
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModule.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModule.kt
new file mode 100644
index 00000000000..88be7abab62
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModule.kt
@@ -0,0 +1,101 @@
+package de.rki.coronawarnapp.diagnosiskeys
+
+import android.content.Context
+import dagger.Module
+import dagger.Provides
+import dagger.Reusable
+import de.rki.coronawarnapp.BuildConfig
+import de.rki.coronawarnapp.diagnosiskeys.server.AppConfigApiV1
+import de.rki.coronawarnapp.diagnosiskeys.server.DiagnosisKeyApiV1
+import de.rki.coronawarnapp.diagnosiskeys.server.DownloadHomeCountry
+import de.rki.coronawarnapp.diagnosiskeys.server.DownloadHttpClient
+import de.rki.coronawarnapp.diagnosiskeys.server.DownloadServerUrl
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.legacy.KeyCacheLegacyDao
+import de.rki.coronawarnapp.http.HttpClientDefault
+import de.rki.coronawarnapp.storage.AppDatabase
+import okhttp3.Cache
+import okhttp3.ConnectionSpec
+import okhttp3.OkHttpClient
+import okhttp3.TlsVersion
+import retrofit2.Retrofit
+import retrofit2.converter.gson.GsonConverterFactory
+import java.io.File
+import javax.inject.Singleton
+
+@Module
+class DiagnosisKeysModule {
+
+    @Singleton
+    @DownloadHomeCountry
+    @Provides
+    fun provideDiagnosisHomeCountry(): LocationCode = LocationCode("DE")
+
+    @Reusable
+    @DownloadHttpClient
+    @Provides
+    fun cdnHttpClient(@HttpClientDefault defaultHttpClient: OkHttpClient): OkHttpClient =
+        defaultHttpClient.newBuilder().connectionSpecs(CDN_CONNECTION_SPECS).build()
+
+    @Singleton
+    @Provides
+    fun provideDiagnosisKeyApi(
+        @DownloadHttpClient client: OkHttpClient,
+        @DownloadServerUrl url: String,
+        gsonConverterFactory: GsonConverterFactory
+    ): DiagnosisKeyApiV1 = Retrofit.Builder()
+        .client(client)
+        .baseUrl(url)
+        .addConverterFactory(gsonConverterFactory)
+        .build()
+        .create(DiagnosisKeyApiV1::class.java)
+
+    @Singleton
+    @Provides
+    fun provideAppConfigApi(
+        context: Context,
+        @DownloadHttpClient client: OkHttpClient,
+        @DownloadServerUrl url: String,
+        gsonConverterFactory: GsonConverterFactory
+    ): AppConfigApiV1 {
+        val cacheSize = 1 * 1024 * 1024L // 1MB
+        val cacheDir = File(context.cacheDir, "http_app-config")
+        val cache = Cache(cacheDir, cacheSize)
+        val cachingClient = client.newBuilder().cache(cache).build()
+        return Retrofit.Builder()
+            .client(cachingClient)
+            .baseUrl(url)
+            .addConverterFactory(gsonConverterFactory)
+            .build()
+            .create(AppConfigApiV1::class.java)
+    }
+
+    @Singleton
+    @DownloadServerUrl
+    @Provides
+    fun provideDownloadServerUrl(): String {
+        val url = BuildConfig.DOWNLOAD_CDN_URL
+        if (!url.startsWith("https://")) throw IllegalStateException("Innvalid: $url")
+        return url
+    }
+
+    @Singleton
+    @Provides
+    fun legacyKeyCacheDao(context: Context): KeyCacheLegacyDao {
+        return AppDatabase.getInstance(context).dateDao()
+    }
+
+    companion object {
+        private val CDN_CONNECTION_SPECS = listOf(
+            ConnectionSpec.Builder(ConnectionSpec.COMPATIBLE_TLS)
+                .tlsVersions(
+                    TlsVersion.TLS_1_0,
+                    TlsVersion.TLS_1_1,
+                    TlsVersion.TLS_1_2,
+                    TlsVersion.TLS_1_3
+                )
+                .allEnabledCipherSuites()
+                .build()
+        )
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryData.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryData.kt
new file mode 100644
index 00000000000..f9b4abd9485
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryData.kt
@@ -0,0 +1,66 @@
+package de.rki.coronawarnapp.diagnosiskeys.download
+
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.CachedKeyInfo
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+
+sealed class CountryData {
+
+    abstract val country: LocationCode
+}
+
+internal data class CountryDays(
+    override val country: LocationCode,
+    val dayData: Collection<LocalDate>
+) : CountryData() {
+
+    /**
+     * Return a filtered list that contains all dates which are part of this wrapper, but not in the parameter.
+     */
+    fun getMissingDays(cachedKeys: List<CachedKeyInfo>): Collection<LocalDate>? {
+        val cachedCountryDates = cachedKeys
+            .filter { it.location == country }
+            .map { it.day }
+
+        return dayData.filter { date ->
+            !cachedCountryDates.contains(date)
+        }
+    }
+
+    /**
+     * Create a new country object that only contains those elements,
+     * that are part of this wrapper, but not in the cache.
+     */
+    fun toMissingDays(cachedKeys: List<CachedKeyInfo>): CountryDays? {
+        val missingDays = this.getMissingDays(cachedKeys)
+        if (missingDays == null || missingDays.isEmpty()) return null
+
+        return CountryDays(this.country, missingDays)
+    }
+}
+
+internal data class CountryHours(
+    override val country: LocationCode,
+    val hourData: Map<LocalDate, List<LocalTime>>
+) : CountryData() {
+
+    fun getMissingHours(cachedKeys: List<CachedKeyInfo>): Map<LocalDate, List<LocalTime>>? {
+        val cachedHours = cachedKeys
+            .filter { it.location == country }
+
+        return hourData.mapNotNull { (day, dayHours) ->
+            val missingHours = dayHours.filter { hour ->
+                cachedHours.none { it.day == day && it.hour == hour }
+            }
+            if (missingHours.isEmpty()) null else day to missingHours
+        }.toMap()
+    }
+
+    fun toMissingHours(cachedKeys: List<CachedKeyInfo>): CountryHours? {
+        val missingHours = this.getMissingHours(cachedKeys)
+        if (missingHours == null || missingHours.isEmpty()) return null
+
+        return CountryHours(this.country, missingHours)
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloader.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloader.kt
new file mode 100644
index 00000000000..4cf842ea929
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloader.kt
@@ -0,0 +1,341 @@
+package de.rki.coronawarnapp.diagnosiskeys.download
+
+import dagger.Reusable
+import de.rki.coronawarnapp.diagnosiskeys.server.DiagnosisKeyServer
+import de.rki.coronawarnapp.diagnosiskeys.server.KeyFileHeaderHook
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.CachedKeyInfo
+import de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheRepository
+import de.rki.coronawarnapp.diagnosiskeys.storage.legacy.LegacyKeyCacheMigration
+import de.rki.coronawarnapp.risk.TimeVariables
+import de.rki.coronawarnapp.storage.AppSettings
+import de.rki.coronawarnapp.storage.DeviceStorage
+import de.rki.coronawarnapp.storage.InsufficientStorageException
+import de.rki.coronawarnapp.util.CWADebug
+import de.rki.coronawarnapp.util.HashExtensions.hashToMD5
+import de.rki.coronawarnapp.util.debug.measureTimeMillisWithResult
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitAll
+import kotlinx.coroutines.withContext
+import org.joda.time.LocalTime
+import timber.log.Timber
+import java.io.File
+import javax.inject.Inject
+
+/**
+ * Downloads new or missing key files from the CDN
+ */
+@Reusable
+class KeyFileDownloader @Inject constructor(
+    private val deviceStorage: DeviceStorage,
+    private val keyServer: DiagnosisKeyServer,
+    private val keyCache: KeyCacheRepository,
+    private val legacyKeyCache: LegacyKeyCacheMigration,
+    private val settings: AppSettings
+) {
+
+    private suspend fun checkStorageSpace(countries: List<LocationCode>): DeviceStorage.CheckResult {
+        val storageResult = deviceStorage.checkSpacePrivateStorage(
+            // 512KB per day file, for 15 days, for each country ~ 65MB for 9 countries
+            requiredBytes = countries.size * EXPECTED_STORAGE_PER_COUNTRY
+        )
+        Timber.tag(TAG).d("Storage check result: %s", storageResult)
+        return storageResult
+    }
+
+    private suspend fun getCompletedKeyFiles(type: CachedKeyInfo.Type): List<CachedKeyInfo> {
+        return keyCache
+            .getEntriesForType(type)
+            .filter { (keyInfo, file) ->
+                val complete = keyInfo.isDownloadComplete
+                val exists = file.exists()
+                if (complete && !exists) {
+                    Timber.tag(TAG).v("Incomplete download, will overwrite: %s", keyInfo)
+                }
+                // We overwrite not completed ones
+                complete && exists
+            }
+            .map { it.first }
+    }
+
+    /**
+     * Fetches all necessary Files from the Cached KeyFile Entries out of the [KeyCacheRepository] and
+     * adds to that all open Files currently available from the Server.
+     *
+     * Assumptions made about the implementation:
+     * - the app initializes with an empty cache and draws in every available data set in the beginning
+     * - the difference can only work properly if the date from the device is synchronized through the net
+     * - the difference in timezone is taken into account by using UTC in the Conversion from the Date to Server format
+     *
+     * @return list of all files from both the cache and the diff query
+     */
+    suspend fun asyncFetchKeyFiles(wantedCountries: List<LocationCode>): List<File> =
+        withContext(Dispatchers.IO) {
+            val availableCountries = keyServer.getCountryIndex()
+            val filteredCountries = availableCountries.filter { wantedCountries.contains(it) }
+            Timber.tag(TAG).v(
+                "Available=%s; Wanted=%s; Intersect=%s",
+                availableCountries, wantedCountries, filteredCountries
+            )
+
+            val storageResult = checkStorageSpace(filteredCountries)
+            if (!storageResult.isSpaceAvailable) throw InsufficientStorageException(storageResult)
+
+            val availableKeys =
+                if (CWADebug.isDebugBuildOrMode && settings.isLast3HourModeEnabled) {
+                    syncMissing3Hours(filteredCountries, DEBUG_HOUR_LIMIT)
+                    keyCache.getEntriesForType(CachedKeyInfo.Type.COUNTRY_HOUR)
+                } else {
+                    syncMissingDays(filteredCountries)
+                    keyCache.getEntriesForType(CachedKeyInfo.Type.COUNTRY_DAY)
+                }
+
+            return@withContext availableKeys
+                .filter { it.first.isDownloadComplete && it.second.exists() }
+                .mapNotNull { (keyInfo, path) ->
+                    if (!path.exists()) {
+                        Timber.tag(TAG).w("Missing keyfile for : %s", keyInfo)
+                        null
+                    } else {
+                        path
+                    }
+                }
+                .also { Timber.tag(TAG).d("Returning %d available keyfiles", it.size) }
+        }
+
+    private suspend fun determineMissingDays(availableCountries: List<LocationCode>): List<CountryDays> {
+        val availableDays = availableCountries.map {
+            val days = keyServer.getDayIndex(it)
+            CountryDays(it, days)
+        }
+
+        val cachedDays = getCompletedKeyFiles(CachedKeyInfo.Type.COUNTRY_DAY)
+
+        val staleDays = getStale(cachedDays, availableDays)
+
+        if (staleDays.isNotEmpty()) {
+            Timber.tag(TAG).v("Deleting stale days: %s", staleDays)
+            keyCache.delete(staleDays)
+        }
+
+        val nonStaleDays = cachedDays.minus(staleDays)
+
+        // The missing days
+        return availableDays.mapNotNull { it.toMissingDays(nonStaleDays) }
+    }
+
+    /**
+     * Fetches files given by serverDates by respecting countries
+     * @param availableCountries pair of dates per country code
+     */
+    private suspend fun syncMissingDays(
+        availableCountries: List<LocationCode>
+    ) = withContext(Dispatchers.IO) {
+        val countriesWithMissingDays = determineMissingDays(availableCountries)
+
+        Timber.tag(TAG).d("Downloading missing days: %s", countriesWithMissingDays)
+        val batchDownloadStart = System.currentTimeMillis()
+        val dayDownloads = countriesWithMissingDays
+            .flatMap { country ->
+                country.dayData.map { dayDate -> country to dayDate }
+            }
+            .map { (countryWrapper, dayDate) ->
+                async {
+                    val (keyInfo, path) = keyCache.createCacheEntry(
+                        location = countryWrapper.country,
+                        dayIdentifier = dayDate,
+                        hourIdentifier = null,
+                        type = CachedKeyInfo.Type.COUNTRY_DAY
+                    )
+
+                    return@async downloadKeyFile(keyInfo, path)
+                }
+            }
+
+        Timber.tag(TAG).d("Waiting for %d missing day downloads.", dayDownloads.size)
+        // execute the query plan
+        val downloadedDays = dayDownloads.awaitAll().filterNotNull()
+
+        Timber.tag(TAG).d(
+            "Batch download (%d files) finished in %dms",
+            dayDownloads.size,
+            (System.currentTimeMillis() - batchDownloadStart)
+        )
+
+        downloadedDays.map { (keyInfo, path) ->
+            Timber.tag(TAG).v("Downloaded keyfile: %s to %s", keyInfo, path)
+            path
+        }
+
+        return@withContext
+    }
+
+    private suspend fun determineMissingHours(
+        availableCountries: List<LocationCode>,
+        itemLimit: Int
+    ): List<CountryHours> {
+
+        val availableHours = availableCountries.flatMap { location ->
+            var remainingItems = itemLimit
+            // Descending because we go backwards newest -> oldest
+            keyServer.getDayIndex(location).sortedDescending().mapNotNull { day ->
+                // Limit reached, return null (filtered out) instead of new CountryHours object
+                if (remainingItems <= 0) return@mapNotNull null
+
+                val hoursForDate = mutableListOf<LocalTime>()
+                for (hour in keyServer.getHourIndex(location, day).sortedDescending()) {
+                    if (remainingItems <= 0) break
+                    remainingItems--
+                    hoursForDate.add(hour)
+                }
+
+                CountryHours(location, mapOf(day to hoursForDate))
+            }
+        }
+
+        val cachedHours = getCompletedKeyFiles(CachedKeyInfo.Type.COUNTRY_HOUR)
+
+        val staleHours = getStale(cachedHours, availableHours)
+
+        if (staleHours.isNotEmpty()) {
+            Timber.tag(TAG).v("Deleting stale hours: %s", staleHours)
+            keyCache.delete(staleHours)
+        }
+
+        val nonStaleHours = cachedHours.minus(staleHours)
+
+        // The missing hours
+        return availableHours.mapNotNull { it.toMissingHours(nonStaleHours) }
+    }
+
+    // All cached files that are no longer on the server are considered stale
+    private fun getStale(
+        cachedKeys: List<CachedKeyInfo>,
+        availableData: List<CountryData>
+    ): List<CachedKeyInfo> = cachedKeys.filter { cachedKey ->
+        val availableCountry = availableData
+            .filter { it.country == cachedKey.location }
+            .singleOrNull {
+                when (cachedKey.type) {
+                    CachedKeyInfo.Type.COUNTRY_DAY -> true
+                    CachedKeyInfo.Type.COUNTRY_HOUR -> {
+                        it as CountryHours
+                        it.hourData.containsKey(cachedKey.day)
+                    }
+                }
+            }
+        if (availableCountry == null) {
+            Timber.w("Unknown location %s, assuming stale hour.", cachedKey.location)
+            return@filter true // It's stale
+        }
+
+        when (cachedKey.type) {
+            CachedKeyInfo.Type.COUNTRY_DAY -> {
+                availableCountry as CountryDays
+                availableCountry.dayData.none { date ->
+                    cachedKey.day == date
+                }
+            }
+            CachedKeyInfo.Type.COUNTRY_HOUR -> {
+                availableCountry as CountryHours
+                val availableDay = availableCountry.hourData[cachedKey.day]
+                if (availableDay == null) {
+                    Timber.d("Unknown day %s, assuming stale hour.", cachedKey.location)
+                    return@filter true // It's stale
+                }
+
+                availableDay.none { time ->
+                    cachedKey.hour == time
+                }
+            }
+        }
+    }
+
+    /**
+     * Fetches files given by serverDates by respecting countries
+     * @param availableCountries pair of dates per country code
+     * @param hourItemLimit how many hours to go back
+     */
+    private suspend fun syncMissing3Hours(
+        availableCountries: List<LocationCode>,
+        hourItemLimit: Int
+    ) = withContext(Dispatchers.IO) {
+        Timber.tag(TAG).v(
+            "asyncHandleLast3HoursFilesFetch(availableCountries=%s, hourLimit=%d)",
+            availableCountries, hourItemLimit
+        )
+        val missingHours = determineMissingHours(availableCountries, hourItemLimit)
+        Timber.tag(TAG).d("Downloading missing hours: %s", missingHours)
+
+        val hourDownloads = missingHours.flatMap { country ->
+            country.hourData.flatMap { (day, missingHours) ->
+                missingHours.map { missingHour ->
+                    async {
+                        val (keyInfo, path) = keyCache.createCacheEntry(
+                            location = country.country,
+                            dayIdentifier = day,
+                            hourIdentifier = missingHour,
+                            type = CachedKeyInfo.Type.COUNTRY_HOUR
+                        )
+
+                        return@async downloadKeyFile(keyInfo, path)
+                    }
+                }
+            }
+        }
+
+        Timber.tag(TAG).d("Waiting for %d missing hour downloads.", hourDownloads.size)
+        val downloadedHours = hourDownloads.awaitAll().filterNotNull()
+
+        downloadedHours.map { (keyInfo, path) ->
+            Timber.tag(TAG).d("Downloaded keyfile: %s to %s", keyInfo, path)
+            path
+        }
+
+        return@withContext
+    }
+
+    private suspend fun downloadKeyFile(
+        keyInfo: CachedKeyInfo,
+        saveTo: File
+    ): Pair<CachedKeyInfo, File>? = try {
+        val validation = KeyFileHeaderHook { headers ->
+            // tryMigration returns true when a file was migrated, meaning, no download necessary
+            return@KeyFileHeaderHook !legacyKeyCache.tryMigration(
+                headers.getPayloadChecksumMD5(),
+                saveTo
+            )
+        }
+
+        keyServer.downloadKeyFile(
+            locationCode = keyInfo.location,
+            day = keyInfo.day,
+            hour = keyInfo.hour,
+            saveTo = saveTo,
+            headerHook = validation
+        )
+
+        Timber.tag(TAG).v("Dowwnload finished: %s -> %s", keyInfo, saveTo)
+
+        val (downloadedMD5, duration) = measureTimeMillisWithResult { saveTo.hashToMD5() }
+        Timber.tag(TAG).v("Hashed to MD5 in %dms: %s", duration, saveTo)
+
+        keyCache.markKeyComplete(keyInfo, downloadedMD5)
+        keyInfo to saveTo
+    } catch (e: Exception) {
+        Timber.tag(TAG).e(e, "Download failed: %s", keyInfo)
+        keyCache.delete(listOf(keyInfo))
+        null
+    }
+
+    companion object {
+        private val TAG: String? = KeyFileDownloader::class.simpleName
+        private const val DEBUG_HOUR_LIMIT = 3
+
+        // Daymode: ~512KB per day, ~14 days
+        // Hourmode: ~20KB per hour, 24 hours, also ~512KB
+        private val EXPECTED_STORAGE_PER_COUNTRY =
+            TimeVariables.getDefaultRetentionPeriodInDays() * 512 * 1024L
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiV1.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiV1.kt
new file mode 100644
index 00000000000..95a99141304
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiV1.kt
@@ -0,0 +1,13 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import okhttp3.ResponseBody
+import retrofit2.http.GET
+import retrofit2.http.Path
+
+interface AppConfigApiV1 {
+
+    @GET("/version/v1/configuration/country/{country}/app_config")
+    suspend fun getApplicationConfiguration(
+        @Path("country") country: String
+    ): ResponseBody
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServer.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServer.kt
new file mode 100644
index 00000000000..f5bee9979a8
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServer.kt
@@ -0,0 +1,61 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import com.google.protobuf.InvalidProtocolBufferException
+import dagger.Lazy
+import de.rki.coronawarnapp.exception.ApplicationConfigurationCorruptException
+import de.rki.coronawarnapp.exception.ApplicationConfigurationInvalidException
+import de.rki.coronawarnapp.server.protocols.ApplicationConfigurationOuterClass
+import de.rki.coronawarnapp.util.ZipHelper.unzip
+import de.rki.coronawarnapp.util.security.VerificationKeys
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import timber.log.Timber
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class AppConfigServer @Inject constructor(
+    private val appConfigAPI: Lazy<AppConfigApiV1>,
+    private val verificationKeys: VerificationKeys,
+    @DownloadHomeCountry private val homeCountry: LocationCode
+) {
+
+    private val configApi: AppConfigApiV1
+        get() = appConfigAPI.get()
+
+    suspend fun downloadAppConfig(): ApplicationConfigurationOuterClass.ApplicationConfiguration =
+        withContext(Dispatchers.IO) {
+            Timber.tag(TAG).d("Fetching app config.")
+            var exportBinary: ByteArray? = null
+            var exportSignature: ByteArray? = null
+            configApi.getApplicationConfiguration(homeCountry.identifier).byteStream()
+                .unzip { entry, entryContent ->
+                    if (entry.name == EXPORT_BINARY_FILE_NAME) exportBinary =
+                        entryContent.copyOf()
+                    if (entry.name == EXPORT_SIGNATURE_FILE_NAME) exportSignature =
+                        entryContent.copyOf()
+                }
+            if (exportBinary == null || exportSignature == null) {
+                throw ApplicationConfigurationInvalidException()
+            }
+
+            if (verificationKeys.hasInvalidSignature(exportBinary, exportSignature)) {
+                throw ApplicationConfigurationCorruptException()
+            }
+
+            try {
+                return@withContext ApplicationConfigurationOuterClass.ApplicationConfiguration.parseFrom(
+                    exportBinary
+                )
+            } catch (e: InvalidProtocolBufferException) {
+                throw ApplicationConfigurationInvalidException()
+            }
+        }
+
+    companion object {
+        private val TAG = AppConfigServer::class.java.simpleName
+
+        private const val EXPORT_BINARY_FILE_NAME = "export.bin"
+        private const val EXPORT_SIGNATURE_FILE_NAME = "export.sig"
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiV1.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiV1.kt
new file mode 100644
index 00000000000..258321c44c0
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiV1.kt
@@ -0,0 +1,41 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import okhttp3.ResponseBody
+import retrofit2.Response
+import retrofit2.http.GET
+import retrofit2.http.Path
+import retrofit2.http.Streaming
+
+interface DiagnosisKeyApiV1 {
+    // TODO Let retrofit format this to CountryCode
+    @GET("/version/v1/diagnosis-keys/country")
+    suspend fun getCountryIndex(): List<String>
+
+    // TODO Let retrofit format this to LocalDate
+    @GET("/version/v1/diagnosis-keys/country/{country}/date")
+    suspend fun getDayIndex(
+        @Path("country") country: String
+    ): List<String>
+
+    // TODO Let retrofit format this to LocalTime
+    @GET("/version/v1/diagnosis-keys/country/{country}/date/{day}/hour")
+    suspend fun getHourIndex(
+        @Path("country") country: String,
+        @Path("day") day: String
+    ): List<String>
+
+    @Streaming
+    @GET("/version/v1/diagnosis-keys/country/{country}/date/{day}")
+    suspend fun downloadKeyFileForDay(
+        @Path("country") country: String,
+        @Path("day") day: String
+    ): Response<ResponseBody>
+
+    @Streaming
+    @GET("/version/v1/diagnosis-keys/country/{country}/date/{day}/hour/{hour}")
+    suspend fun downloadKeyFileForHour(
+        @Path("country") country: String,
+        @Path("day") day: String,
+        @Path("hour") hour: String
+    ): Response<ResponseBody>
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServer.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServer.kt
new file mode 100644
index 00000000000..8995751a9ee
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServer.kt
@@ -0,0 +1,108 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import dagger.Lazy
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import okhttp3.Headers
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.joda.time.format.DateTimeFormat
+import retrofit2.HttpException
+import timber.log.Timber
+import java.io.File
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class DiagnosisKeyServer @Inject constructor(
+    private val diagnosisKeyAPI: Lazy<DiagnosisKeyApiV1>,
+    @DownloadHomeCountry private val homeCountry: LocationCode
+) {
+
+    private val keyApi: DiagnosisKeyApiV1
+        get() = diagnosisKeyAPI.get()
+
+    suspend fun getCountryIndex(): List<LocationCode> = withContext(Dispatchers.IO) {
+        keyApi
+            .getCountryIndex()
+            .map { LocationCode(it) }
+    }
+
+    suspend fun getDayIndex(location: LocationCode): List<LocalDate> = withContext(Dispatchers.IO) {
+        keyApi
+            .getDayIndex(location.identifier)
+            .map { dayString ->
+                // 2020-08-19
+                LocalDate.parse(dayString, DAY_FORMATTER)
+            }
+    }
+
+    suspend fun getHourIndex(location: LocationCode, day: LocalDate): List<LocalTime> =
+        withContext(Dispatchers.IO) {
+            keyApi
+                .getHourIndex(location.identifier, day.toString(DAY_FORMATTER))
+                .map { hourString -> LocalTime.parse(hourString, HOUR_FORMATTER) }
+        }
+
+    interface HeaderHook {
+        suspend fun validate(headers: Headers): Boolean = true
+    }
+
+    /**
+     * Retrieves Key Files from the Server
+     * Leave **[hour]** null to download a day package
+     */
+    suspend fun downloadKeyFile(
+        locationCode: LocationCode,
+        day: LocalDate,
+        hour: LocalTime? = null,
+        saveTo: File,
+        headerHook: HeaderHook = object : HeaderHook {}
+    ) = withContext(Dispatchers.IO) {
+        Timber.tag(TAG).v(
+            "Starting download: country=%s, day=%s, hour=%s -> %s.",
+            locationCode, day, hour, saveTo
+        )
+
+        if (saveTo.exists()) {
+            Timber.tag(TAG).w("File existed, overwriting: %s", saveTo)
+            if (saveTo.delete()) {
+                Timber.tag(TAG).e("%s exists, but can't be deleted.", saveTo)
+            }
+        }
+
+        val response = if (hour != null) {
+            keyApi.downloadKeyFileForHour(
+                locationCode.identifier,
+                day.toString(DAY_FORMATTER),
+                hour.toString(HOUR_FORMATTER)
+            )
+        } else {
+            keyApi.downloadKeyFileForDay(
+                locationCode.identifier,
+                day.toString(DAY_FORMATTER)
+            )
+        }
+
+        if (!headerHook.validate(response.headers())) {
+            Timber.tag(TAG).d("validateHeaders() told us to abort.")
+            return@withContext
+        }
+        if (response.isSuccessful) {
+            saveTo.outputStream().use { target ->
+                response.body()!!.byteStream().use { source ->
+                    source.copyTo(target, DEFAULT_BUFFER_SIZE)
+                }
+            }
+            Timber.tag(TAG).v("Key file download successful: %s", saveTo)
+        } else {
+            throw HttpException(response)
+        }
+    }
+
+    companion object {
+        private val TAG = DiagnosisKeyServer::class.java.simpleName
+        private val DAY_FORMATTER = DateTimeFormat.forPattern("yyyy-MM-dd")
+        private val HOUR_FORMATTER = DateTimeFormat.forPattern("HH")
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHomeCountry.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHomeCountry.kt
new file mode 100644
index 00000000000..69aa0f792cb
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHomeCountry.kt
@@ -0,0 +1,8 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import javax.inject.Qualifier
+
+@Qualifier
+@MustBeDocumented
+@Retention(AnnotationRetention.RUNTIME)
+annotation class DownloadHomeCountry
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHttpClient.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHttpClient.kt
new file mode 100644
index 00000000000..f9536135c97
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadHttpClient.kt
@@ -0,0 +1,8 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import javax.inject.Qualifier
+
+@Qualifier
+@MustBeDocumented
+@Retention(AnnotationRetention.RUNTIME)
+annotation class DownloadHttpClient
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadServerUrl.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadServerUrl.kt
new file mode 100644
index 00000000000..f347e533316
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/DownloadServerUrl.kt
@@ -0,0 +1,8 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import javax.inject.Qualifier
+
+@Qualifier
+@MustBeDocumented
+@Retention(AnnotationRetention.RUNTIME)
+annotation class DownloadServerUrl
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/KeyFileHeaderHook.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/KeyFileHeaderHook.kt
new file mode 100644
index 00000000000..51b89d5f891
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/KeyFileHeaderHook.kt
@@ -0,0 +1,24 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import okhttp3.Headers
+
+class KeyFileHeaderHook(
+    private val onEval: suspend KeyFileHeaderHook.(Headers) -> Boolean
+) : DiagnosisKeyServer.HeaderHook {
+
+    override suspend fun validate(headers: Headers): Boolean = onEval(headers)
+
+    fun Headers.getPayloadChecksumMD5(): String? {
+        // TODO Ping backend regarding alternative checksum sources
+        var fileMD5 = values("ETag").singleOrNull()
+        // The hash from these headers doesn't match, TODO EXPOSUREBACK-178
+//                var fileMD5 = headers.values("x-amz-meta-cwa-hash-md5").singleOrNull()
+//                if (fileMD5 == null) {
+//                    headers.values("x-amz-meta-cwa-hash").singleOrNull()
+//                }
+//                if (fileMD5 == null) { // Fallback
+//                    fileMD5 = headers.values("ETag").singleOrNull()
+//                }
+        return fileMD5?.removePrefix("\"")?.removeSuffix("\"")
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/LocationCode.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/LocationCode.kt
new file mode 100644
index 00000000000..8201571a46b
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/server/LocationCode.kt
@@ -0,0 +1,10 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import java.util.Locale
+
+data class LocationCode(
+    private val rawIdentifier: String
+) {
+    @Transient
+    val identifier: String = rawIdentifier.toUpperCase(Locale.ROOT)
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyInfo.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyInfo.kt
new file mode 100644
index 00000000000..b77f11c7be3
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyInfo.kt
@@ -0,0 +1,84 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import androidx.room.ColumnInfo
+import androidx.room.Entity
+import androidx.room.PrimaryKey
+import androidx.room.TypeConverter
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.util.HashExtensions.toSHA1
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+
+@Entity(tableName = "keyfiles")
+data class CachedKeyInfo(
+    @PrimaryKey @ColumnInfo(name = "id") val id: String,
+    @ColumnInfo(name = "type") val type: Type,
+    @ColumnInfo(name = "location") val location: LocationCode, // i.e. "DE"
+    @ColumnInfo(name = "day") val day: LocalDate, // i.e. 2020-08-23
+    @ColumnInfo(name = "hour") val hour: LocalTime?, // i.e. 23
+    @ColumnInfo(name = "createdAt") val createdAt: Instant,
+    @ColumnInfo(name = "checksumMD5") val checksumMD5: String?,
+    @ColumnInfo(name = "completed") val isDownloadComplete: Boolean
+) {
+
+    constructor(
+        type: Type,
+        location: LocationCode,
+        day: LocalDate,
+        hour: LocalTime?,
+        createdAt: Instant
+    ) : this(
+        id = calcluateId(location, day, hour, type),
+        location = location,
+        day = day,
+        hour = hour,
+        type = type,
+        createdAt = createdAt,
+        checksumMD5 = null,
+        isDownloadComplete = false
+    )
+
+    @Transient
+    val fileName: String = "$id.zip"
+
+    fun toDownloadUpdate(checksumMD5: String?): DownloadUpdate = DownloadUpdate(
+        id = id,
+        checksumMD5 = checksumMD5,
+        isDownloadComplete = checksumMD5 != null
+    )
+
+    companion object {
+        fun calcluateId(
+            location: LocationCode,
+            day: LocalDate,
+            hour: LocalTime?,
+            type: Type
+        ): String {
+            var rawId = "${location.identifier}.${type.typeValue}.$day"
+            hour?.let { rawId += ".$hour" }
+            return rawId.toSHA1()
+        }
+    }
+
+    enum class Type constructor(internal val typeValue: String) {
+        COUNTRY_DAY("country_day"),
+        COUNTRY_HOUR("country_hour");
+
+        class Converter {
+            @TypeConverter
+            fun toType(value: String?): Type? =
+                value?.let { values().single { it.typeValue == value } }
+
+            @TypeConverter
+            fun fromType(type: Type?): String? = type?.typeValue
+        }
+    }
+
+    @Entity
+    data class DownloadUpdate(
+        @PrimaryKey @ColumnInfo(name = "id") val id: String,
+        @ColumnInfo(name = "checksumMD5") val checksumMD5: String?,
+        @ColumnInfo(name = "completed") val isDownloadComplete: Boolean
+    )
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabase.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabase.kt
new file mode 100644
index 00000000000..e4be6ba4700
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheDatabase.kt
@@ -0,0 +1,62 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import android.content.Context
+import androidx.room.Dao
+import androidx.room.Database
+import androidx.room.Delete
+import androidx.room.Insert
+import androidx.room.OnConflictStrategy
+import androidx.room.Query
+import androidx.room.Room
+import androidx.room.RoomDatabase
+import androidx.room.TypeConverters
+import androidx.room.Update
+import de.rki.coronawarnapp.util.database.CommonConverters
+import javax.inject.Inject
+
+@Database(
+    entities = [CachedKeyInfo::class],
+    version = 1,
+    exportSchema = true
+)
+@TypeConverters(CommonConverters::class, CachedKeyInfo.Type.Converter::class)
+abstract class KeyCacheDatabase : RoomDatabase() {
+
+    abstract fun cachedKeyFiles(): CachedKeyFileDao
+
+    @Dao
+    interface CachedKeyFileDao {
+        @Query("SELECT * FROM keyfiles")
+        suspend fun getAllEntries(): List<CachedKeyInfo>
+
+        @Query("SELECT * FROM keyfiles WHERE type = :type")
+        suspend fun getEntriesForType(type: String): List<CachedKeyInfo>
+
+        @Query("DELETE FROM keyfiles")
+        suspend fun clear()
+
+        @Insert(onConflict = OnConflictStrategy.ABORT)
+        suspend fun insertEntry(cachedKeyInfo: CachedKeyInfo)
+
+        @Delete
+        suspend fun deleteEntry(cachedKeyInfo: CachedKeyInfo)
+
+        @Update(entity = CachedKeyInfo::class)
+        suspend fun updateDownloadState(update: CachedKeyInfo.DownloadUpdate)
+    }
+
+    class Factory @Inject constructor(private val context: Context) {
+        /**
+         * The fallback behavior is to reset the app as we only store exposure summaries
+         * and cached references that are non-critical to app operation.
+         */
+        fun create(): KeyCacheDatabase = Room
+            .databaseBuilder(context, KeyCacheDatabase::class.java, DATABASE_NAME)
+            .fallbackToDestructiveMigrationFrom()
+            .build()
+    }
+
+    companion object {
+        private const val DATABASE_NAME = "keycache.db"
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepository.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepository.kt
new file mode 100644
index 00000000000..4336c7ac87f
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepository.kt
@@ -0,0 +1,153 @@
+/******************************************************************************
+ * Corona-Warn-App                                                            *
+ *                                                                            *
+ * SAP SE and all other contributors /                                        *
+ * copyright owners license this file to you under the Apache                 *
+ * License, Version 2.0 (the "License"); you may not use this                 *
+ * file except in compliance with the License.                                *
+ * You may obtain a copy of the License at                                    *
+ *                                                                            *
+ * http://www.apache.org/licenses/LICENSE-2.0                                 *
+ *                                                                            *
+ * Unless required by applicable law or agreed to in writing,                 *
+ * software distributed under the License is distributed on an                *
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
+ * KIND, either express or implied.  See the License for the                  *
+ * specific language governing permissions and limitations                    *
+ * under the License.                                                         *
+ ******************************************************************************/
+
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import android.content.Context
+import android.database.sqlite.SQLiteConstraintException
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.util.TimeStamper
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import timber.log.Timber
+import java.io.File
+import java.io.IOException
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class KeyCacheRepository @Inject constructor(
+    private val context: Context,
+    private val databaseFactory: KeyCacheDatabase.Factory,
+    private val timeStamper: TimeStamper
+) {
+
+    private val storageDir by lazy {
+        File(context.cacheDir, "diagnosis_keys").apply {
+            if (!exists()) {
+                if (mkdirs()) {
+                    Timber.d("KeyCache directory created: %s", this)
+                } else {
+                    throw IOException("KeyCache directory creation failed: $this")
+                }
+            }
+        }
+    }
+
+    private val database by lazy { databaseFactory.create() }
+
+    private var isInitDone = false
+    private val initMutex = Mutex()
+
+    private suspend fun getDao(): KeyCacheDatabase.CachedKeyFileDao {
+        val dao = database.cachedKeyFiles()
+
+        if (!isInitDone) {
+            initMutex.withLock {
+                if (isInitDone) return@withLock
+                isInitDone = true
+
+                doHouseKeeping()
+            }
+        }
+
+        return dao
+    }
+
+    private suspend fun doHouseKeeping() {
+        val dirtyInfos = getDao().getAllEntries().filter {
+            it.isDownloadComplete && !getPathForKey(it).exists()
+        }
+        Timber.v("HouseKeeping, deleting: %s", dirtyInfos)
+        delete(dirtyInfos)
+    }
+
+    fun getPathForKey(cachedKeyInfo: CachedKeyInfo): File {
+        return File(storageDir, cachedKeyInfo.fileName)
+    }
+
+    suspend fun getAllCachedKeys(): List<Pair<CachedKeyInfo, File>> {
+        return getDao().getAllEntries().map { it to getPathForKey(it) }
+    }
+
+    suspend fun getEntriesForType(type: CachedKeyInfo.Type): List<Pair<CachedKeyInfo, File>> {
+        return getDao().getEntriesForType(type.typeValue).map { it to getPathForKey(it) }
+    }
+
+    suspend fun createCacheEntry(
+        type: CachedKeyInfo.Type,
+        location: LocationCode,
+        dayIdentifier: LocalDate,
+        hourIdentifier: LocalTime?
+    ): Pair<CachedKeyInfo, File> {
+        val newKeyFile = CachedKeyInfo(
+            type = type,
+            location = location,
+            day = dayIdentifier,
+            hour = hourIdentifier,
+            createdAt = timeStamper.nowUTC
+        )
+
+        val targetFile = getPathForKey(newKeyFile)
+
+        try {
+            getDao().insertEntry(newKeyFile)
+            if (targetFile.exists()) {
+                Timber.w("Target path despite no collision exists, deleting: %s", targetFile)
+            }
+        } catch (e: SQLiteConstraintException) {
+            Timber.e(e, "Insertion collision? Overwriting for %s", newKeyFile)
+            delete(listOf(newKeyFile))
+
+            Timber.d(e, "Retrying insertion for %s", newKeyFile)
+            getDao().insertEntry(newKeyFile)
+        }
+
+        // This can't be null unless our cache dir is root `/`
+        val targetParent = targetFile.parentFile!!
+        if (!targetParent.exists()) {
+            Timber.w("Parent folder doesn't exist, cache cleared? %s", targetParent)
+            targetParent.mkdirs()
+        }
+
+        return newKeyFile to targetFile
+    }
+
+    suspend fun markKeyComplete(cachedKeyInfo: CachedKeyInfo, checksumMD5: String) {
+        val update = cachedKeyInfo.toDownloadUpdate(checksumMD5)
+        getDao().updateDownloadState(update)
+    }
+
+    suspend fun delete(keyInfos: Collection<CachedKeyInfo>) {
+        Timber.d("delete(keyFiles=%s)", keyInfos)
+        keyInfos.forEach { key ->
+            getDao().deleteEntry(key)
+            Timber.v("Deleted %s", key)
+            val path = getPathForKey(key)
+            if (path.delete()) Timber.v("Deleted cache key file at %s", path)
+        }
+    }
+
+    suspend fun clear() {
+        Timber.i("clear()")
+        delete(getDao().getAllEntries())
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/Converters.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyDao.kt
similarity index 75%
rename from Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/Converters.kt
rename to Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyDao.kt
index 7b5c36d3937..3418ebd0cbe 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/Converters.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyDao.kt
@@ -17,23 +17,13 @@
  * under the License.                                                         *
  ******************************************************************************/
 
-package de.rki.coronawarnapp.util
+package de.rki.coronawarnapp.diagnosiskeys.storage.legacy
 
-import androidx.room.TypeConverter
-import com.google.gson.Gson
-import com.google.gson.reflect.TypeToken
+import androidx.room.Dao
+import androidx.room.Query
 
-class Converters {
-    private val gson = Gson()
-
-    @TypeConverter
-    fun fromString(value: String?): List<Int> {
-        val listType = object : TypeToken<List<Int?>?>() {}.type
-        return gson.fromJson(value, listType)
-    }
-
-    @TypeConverter
-    fun fromArrayList(list: List<Int?>?): String {
-        return gson.toJson(list)
-    }
+@Dao
+interface KeyCacheLegacyDao {
+    @Query("DELETE FROM date")
+    suspend fun clear()
 }
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheEntity.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyEntity.kt
similarity index 95%
rename from Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheEntity.kt
rename to Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyEntity.kt
index 8bd2ac55df3..0a8593c004e 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheEntity.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheLegacyEntity.kt
@@ -17,7 +17,7 @@
  * under the License.                                                         *
  ******************************************************************************/
 
-package de.rki.coronawarnapp.storage.keycache
+package de.rki.coronawarnapp.diagnosiskeys.storage.legacy
 
 import androidx.room.Entity
 import androidx.room.Index
@@ -27,7 +27,7 @@ import androidx.room.PrimaryKey
     tableName = "date",
     indices = [Index("id")]
 )
-class KeyCacheEntity {
+class KeyCacheLegacyEntity {
     @PrimaryKey
     var id: String = ""
 
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigration.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigration.kt
new file mode 100644
index 00000000000..ca2cf95867b
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigration.kt
@@ -0,0 +1,103 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage.legacy
+
+import android.content.Context
+import dagger.Lazy
+import de.rki.coronawarnapp.risk.TimeVariables
+import de.rki.coronawarnapp.util.HashExtensions.hashToMD5
+import de.rki.coronawarnapp.util.TimeStamper
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import org.joda.time.Duration
+import org.joda.time.Instant
+import timber.log.Timber
+import java.io.File
+import javax.inject.Inject
+
+class LegacyKeyCacheMigration @Inject constructor(
+    private val context: Context,
+    private val legacyDao: Lazy<KeyCacheLegacyDao>,
+    private val timeStamper: TimeStamper
+) {
+
+    private val cacheDir by lazy {
+        File(context.cacheDir, "key-export")
+    }
+
+    private val workMutex = Mutex()
+    private var isInit = false
+    private val legacyCacheMap = mutableMapOf<String, File>()
+
+    private suspend fun tryInit() {
+        if (isInit) return
+        isInit = true
+
+        if (!cacheDir.exists()) {
+            Timber.tag(TAG).v("Legacy cache dir doesn't exist, we are done.")
+            return
+        }
+
+        try {
+            legacyDao.get().clear()
+        } catch (e: Exception) {
+            // Not good, but not a problem, we don't need the actual entities for migration.
+            Timber.tag(TAG).w(e, "Failed to clear legacy key cache from db.")
+        }
+
+        try {
+            cacheDir.listFiles()?.forEach { file ->
+                val isExpired = Duration(
+                    Instant.ofEpochMilli(file.lastModified()),
+                    timeStamper.nowUTC
+                ).standardDays > TimeVariables.getDefaultRetentionPeriodInDays()
+
+                if (isExpired) {
+                    Timber.tag(TAG).d("Deleting expired file: %s", file)
+                    file.delete()
+                } else {
+                    val md5 = file.hashToMD5()
+                    Timber.tag(TAG).v("MD5 %s for %s", md5, file)
+                    legacyCacheMap[md5] = file
+                }
+            }
+        } catch (e: Exception) {
+            Timber.tag(TAG).e(e, "Reading legacy cached failed. Clearing.")
+            cacheDir.deleteRecursively()
+        }
+
+        if (cacheDir.exists() && cacheDir.listFiles()?.isNullOrEmpty() == true) {
+            Timber.tag(TAG).v("Legacy cache dir is empty, deleting.")
+            cacheDir.delete()
+        }
+    }
+
+    suspend fun tryMigration(fileMD5: String?, targetPath: File): Boolean = workMutex.withLock {
+        if (fileMD5 == null) return false
+        tryInit()
+
+        val legacyFile = legacyCacheMap[fileMD5] ?: return false
+        Timber.tag(TAG).i("Migrating legacy file for %s to %s", fileMD5, targetPath)
+
+        return try {
+            legacyFile.inputStream().use { from ->
+                targetPath.outputStream().use { to ->
+                    from.copyTo(to, DEFAULT_BUFFER_SIZE)
+                }
+            }
+            true
+        } catch (e: Exception) {
+            Timber.tag(TAG).e(e, "Failed to migrate %s", legacyFile)
+            false
+        } finally {
+            try {
+                val removedFile = legacyCacheMap.remove(fileMD5)
+                if (removedFile?.delete() == true) Timber.tag(TAG).d("Deleted %s", removedFile)
+            } catch (e: Exception) {
+                Timber.tag(TAG).e(e, "Failed to delete %s", legacyFile)
+            }
+        }
+    }
+
+    companion object {
+        private val TAG = this::class.java.simpleName
+    }
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpClientDefault.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpClientDefault.kt
new file mode 100644
index 00000000000..dca6b3f7826
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpClientDefault.kt
@@ -0,0 +1,8 @@
+package de.rki.coronawarnapp.http
+
+import javax.inject.Qualifier
+
+@Qualifier
+@MustBeDocumented
+@Retention(AnnotationRetention.RUNTIME)
+annotation class HttpClientDefault
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpModule.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpModule.kt
new file mode 100644
index 00000000000..a8c68ad05ff
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/HttpModule.kt
@@ -0,0 +1,56 @@
+package de.rki.coronawarnapp.http
+
+import dagger.Module
+import dagger.Provides
+import dagger.Reusable
+import de.rki.coronawarnapp.BuildConfig
+import de.rki.coronawarnapp.http.config.HTTPVariables
+import de.rki.coronawarnapp.http.interceptor.RetryInterceptor
+import de.rki.coronawarnapp.http.interceptor.WebSecurityVerificationInterceptor
+import de.rki.coronawarnapp.risk.TimeVariables
+import okhttp3.Interceptor
+import okhttp3.OkHttpClient
+import okhttp3.logging.HttpLoggingInterceptor
+import retrofit2.converter.gson.GsonConverterFactory
+import retrofit2.converter.protobuf.ProtoConverterFactory
+import timber.log.Timber
+import java.util.concurrent.TimeUnit
+
+@Module
+class HttpModule {
+
+    @Reusable
+    @HttpClientDefault
+    @Provides
+    fun defaultHttpClient(): OkHttpClient {
+        val interceptors: List<Interceptor> = listOf(
+            WebSecurityVerificationInterceptor(),
+            HttpLoggingInterceptor(object : HttpLoggingInterceptor.Logger {
+                override fun log(message: String) {
+                    Timber.tag("OkHttp").v(message)
+                }
+            }).apply {
+                if (BuildConfig.DEBUG) setLevel(HttpLoggingInterceptor.Level.BODY)
+            },
+            RetryInterceptor(),
+            HttpErrorParser()
+        )
+
+        return OkHttpClient.Builder().apply {
+            connectTimeout(HTTPVariables.getHTTPConnectionTimeout(), TimeUnit.MILLISECONDS)
+            readTimeout(HTTPVariables.getHTTPReadTimeout(), TimeUnit.MILLISECONDS)
+            writeTimeout(HTTPVariables.getHTTPWriteTimeout(), TimeUnit.MILLISECONDS)
+            callTimeout(TimeVariables.getTransactionTimeout(), TimeUnit.MILLISECONDS)
+
+            interceptors.forEach { addInterceptor(it) }
+        }.build()
+    }
+
+    @Reusable
+    @Provides
+    fun provideGSONConverter(): GsonConverterFactory = GsonConverterFactory.create()
+
+    @Reusable
+    @Provides
+    fun provideProtoonverter(): ProtoConverterFactory = ProtoConverterFactory.create()
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/ServiceFactory.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/ServiceFactory.kt
index 9e383ff44cf..7e9712436e2 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/ServiceFactory.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/ServiceFactory.kt
@@ -4,172 +4,37 @@ import android.webkit.URLUtil
 import de.rki.coronawarnapp.BuildConfig
 import de.rki.coronawarnapp.CoronaWarnApplication
 import de.rki.coronawarnapp.exception.http.ServiceFactoryException
-import de.rki.coronawarnapp.http.config.HTTPVariables
-import de.rki.coronawarnapp.http.interceptor.RetryInterceptor
-import de.rki.coronawarnapp.http.interceptor.WebSecurityVerificationInterceptor
-import de.rki.coronawarnapp.http.service.DistributionService
 import de.rki.coronawarnapp.http.service.SubmissionService
 import de.rki.coronawarnapp.http.service.VerificationService
-import de.rki.coronawarnapp.risk.TimeVariables
 import okhttp3.Cache
 import okhttp3.CipherSuite
-import okhttp3.ConnectionPool
 import okhttp3.ConnectionSpec
-import okhttp3.Interceptor
 import okhttp3.OkHttpClient
 import okhttp3.TlsVersion
-import okhttp3.logging.HttpLoggingInterceptor
 import retrofit2.Retrofit
 import retrofit2.converter.gson.GsonConverterFactory
 import retrofit2.converter.protobuf.ProtoConverterFactory
-import timber.log.Timber
 import java.io.File
-import java.util.concurrent.TimeUnit
-
-class ServiceFactory {
-    companion object {
-        /**
-         * 10 MiB
-         */
-        private const val HTTP_CACHE_SIZE = 10L * 1024L * 1024L
-
-        /**
-         * Cache file name
-         */
-        private const val HTTP_CACHE_NAME = "http_cache"
-    }
-
-    /**
-     * List of interceptors, e.g. logging
-     */
-    private val mInterceptors: List<Interceptor> = listOf(
-        WebSecurityVerificationInterceptor(),
-        HttpLoggingInterceptor(object : HttpLoggingInterceptor.Logger {
-            override fun log(message: String) {
-                Timber.tag("OkHttp").v(message)
-            }
-        }).apply {
-            if (BuildConfig.DEBUG) setLevel(HttpLoggingInterceptor.Level.BODY)
-        },
-        RetryInterceptor(),
-        HttpErrorParser()
-    )
-
-    /**
-     * connection pool held in-memory, especially useful for key retrieval
-     */
-    private val conPool = ConnectionPool()
-
-    /**
-     * Basic disk cache backed by LRU
-     */
-    private val cache = Cache(
-        directory = File(CoronaWarnApplication.getAppContext().cacheDir, HTTP_CACHE_NAME),
-        maxSize = HTTP_CACHE_SIZE
-    )
-
-    private val gsonConverterFactory = GsonConverterFactory.create()
-    private val protoConverterFactory = ProtoConverterFactory.create()
-
-    private val okHttpClient by lazy {
-        val clientBuilder = OkHttpClient.Builder()
-
-        clientBuilder.connectTimeout(
-            HTTPVariables.getHTTPConnectionTimeout(),
-            TimeUnit.MILLISECONDS
+import javax.inject.Inject
+
+class ServiceFactory @Inject constructor(
+    private val gsonConverterFactory: GsonConverterFactory,
+    private val protoConverterFactory: ProtoConverterFactory,
+    @HttpClientDefault private val defaultHttpClient: OkHttpClient
+) {
+
+    private val cache by lazy {
+        Cache(
+            directory = File(CoronaWarnApplication.getAppContext().cacheDir, HTTP_CACHE_FOLDER),
+            maxSize = HTTP_CACHE_SIZE
         )
-        clientBuilder.readTimeout(
-            HTTPVariables.getHTTPReadTimeout(),
-            TimeUnit.MILLISECONDS
-        )
-        clientBuilder.writeTimeout(
-            HTTPVariables.getHTTPWriteTimeout(),
-            TimeUnit.MILLISECONDS
-        )
-        clientBuilder.callTimeout(
-            TimeVariables.getTransactionTimeout(),
-            TimeUnit.MILLISECONDS
-        )
-
-        clientBuilder.connectionPool(conPool)
-
-        cache.evictAll()
-        clientBuilder.cache(cache)
-
-        mInterceptors.forEach { clientBuilder.addInterceptor(it) }
-
-        clientBuilder.build()
     }
-
-    /**
-     * For the CDN we want to ensure maximum Compatibility.
-     */
-    private fun getCDNSpecs(): List<ConnectionSpec> = listOf(
-        ConnectionSpec.Builder(ConnectionSpec.COMPATIBLE_TLS)
-            .tlsVersions(
-                TlsVersion.TLS_1_0,
-                TlsVersion.TLS_1_1,
-                TlsVersion.TLS_1_2,
-                TlsVersion.TLS_1_3
-            )
-            .allEnabledCipherSuites()
-            .build()
-    )
-
-    /**
-     * For Submission and Verification we want to limit our specifications for TLS.
-     */
-    private fun getRestrictedSpecs(): List<ConnectionSpec> = listOf(
-        ConnectionSpec.Builder(ConnectionSpec.RESTRICTED_TLS)
-            .tlsVersions(
-                TlsVersion.TLS_1_2,
-                TlsVersion.TLS_1_3
-            )
-            .cipherSuites(
-                // TLS 1.2 with Perfect Forward Secrecy (BSI TR-02102-2)
-                CipherSuite.TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
-                CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
-                CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-                CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-                CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-                CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
-                CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-                CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-                CipherSuite.TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
-                CipherSuite.TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
-                CipherSuite.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
-                CipherSuite.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
-                CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
-                CipherSuite.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
-                CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
-                CipherSuite.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
-                // TLS 1.3 (BSI TR-02102-2)
-                CipherSuite.TLS_AES_128_GCM_SHA256,
-                CipherSuite.TLS_AES_256_GCM_SHA384,
-                CipherSuite.TLS_AES_128_CCM_SHA256
-            )
-            .build()
-    )
-
-    /**
-     * Helper function to create a new client from an existent Client with New Specs.
-     *
-     * @param specs
-     */
-    private fun OkHttpClient.buildClientWithNewSpecs(specs: List<ConnectionSpec>) =
-        this.newBuilder().connectionSpecs(specs).build()
-
-    private val downloadCdnUrl
-        get() = getValidUrl(BuildConfig.DOWNLOAD_CDN_URL)
-
-    fun distributionService(): DistributionService = distributionService
-    private val distributionService by lazy {
-        Retrofit.Builder()
-            .client(okHttpClient.buildClientWithNewSpecs(getCDNSpecs()))
-            .baseUrl(downloadCdnUrl)
-            .addConverterFactory(gsonConverterFactory)
+    private val okHttpClient by lazy {
+        defaultHttpClient
+            .newBuilder()
+            .connectionSpecs(getRestrictedSpecs())
+            .cache(cache)
             .build()
-            .create(DistributionService::class.java)
     }
 
     private val verificationCdnUrl
@@ -178,7 +43,7 @@ class ServiceFactory {
     fun verificationService(): VerificationService = verificationService
     private val verificationService by lazy {
         Retrofit.Builder()
-            .client(okHttpClient.buildClientWithNewSpecs(getRestrictedSpecs()))
+            .client(okHttpClient)
             .baseUrl(verificationCdnUrl)
             .addConverterFactory(gsonConverterFactory)
             .build()
@@ -191,7 +56,7 @@ class ServiceFactory {
     fun submissionService(): SubmissionService = submissionService
     private val submissionService by lazy {
         Retrofit.Builder()
-            .client(okHttpClient.buildClientWithNewSpecs(getRestrictedSpecs()))
+            .client(okHttpClient)
             .baseUrl(submissionCdnUrl)
             .addConverterFactory(protoConverterFactory)
             .addConverterFactory(gsonConverterFactory)
@@ -205,4 +70,44 @@ class ServiceFactory {
         }
         return url
     }
+
+    companion object {
+        private const val HTTP_CACHE_SIZE = 10L * 1024L * 1024L // 10 MiB
+        private const val HTTP_CACHE_FOLDER = "http_cache" // <pkg>/cache/http_cache
+
+        /**
+         * For Submission and Verification we want to limit our specifications for TLS.
+         */
+        private fun getRestrictedSpecs(): List<ConnectionSpec> = listOf(
+            ConnectionSpec.Builder(ConnectionSpec.RESTRICTED_TLS)
+                .tlsVersions(
+                    TlsVersion.TLS_1_2,
+                    TlsVersion.TLS_1_3
+                )
+                .cipherSuites(
+                    // TLS 1.2 with Perfect Forward Secrecy (BSI TR-02102-2)
+                    CipherSuite.TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
+                    CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+                    CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                    CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                    CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+                    CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+                    CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                    CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                    CipherSuite.TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
+                    CipherSuite.TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
+                    CipherSuite.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                    CipherSuite.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                    CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
+                    CipherSuite.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
+                    CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
+                    CipherSuite.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                    // TLS 1.3 (BSI TR-02102-2)
+                    CipherSuite.TLS_AES_128_GCM_SHA256,
+                    CipherSuite.TLS_AES_256_GCM_SHA384,
+                    CipherSuite.TLS_AES_128_CCM_SHA256
+                )
+                .build()
+        )
+    }
 }
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/WebRequestBuilder.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/WebRequestBuilder.kt
index a92142a6781..d0bee06128a 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/WebRequestBuilder.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/WebRequestBuilder.kt
@@ -21,43 +21,27 @@ package de.rki.coronawarnapp.http
 
 import KeyExportFormat
 import com.google.protobuf.ByteString
-import com.google.protobuf.InvalidProtocolBufferException
-import de.rki.coronawarnapp.exception.ApplicationConfigurationCorruptException
-import de.rki.coronawarnapp.exception.ApplicationConfigurationInvalidException
 import de.rki.coronawarnapp.http.requests.RegistrationRequest
 import de.rki.coronawarnapp.http.requests.RegistrationTokenRequest
 import de.rki.coronawarnapp.http.requests.TanRequestBody
-import de.rki.coronawarnapp.http.service.DistributionService
 import de.rki.coronawarnapp.http.service.SubmissionService
 import de.rki.coronawarnapp.http.service.VerificationService
-import de.rki.coronawarnapp.server.protocols.ApplicationConfigurationOuterClass.ApplicationConfiguration
 import de.rki.coronawarnapp.service.diagnosiskey.DiagnosisKeyConstants
 import de.rki.coronawarnapp.service.submission.KeyType
 import de.rki.coronawarnapp.service.submission.SubmissionConstants
-import de.rki.coronawarnapp.storage.FileStorageHelper
-import de.rki.coronawarnapp.util.TimeAndDateExtensions.toServerFormat
-import de.rki.coronawarnapp.util.ZipHelper.unzip
+import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.util.security.HashHelper
-import de.rki.coronawarnapp.util.security.VerificationKeys
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import timber.log.Timber
-import java.io.File
-import java.util.Date
-import java.util.Locale
-import java.util.UUID
 import kotlin.math.max
 
 class WebRequestBuilder(
-    private val distributionService: DistributionService,
     private val verificationService: VerificationService,
-    private val submissionService: SubmissionService,
-    private val verificationKeys: VerificationKeys
+    private val submissionService: SubmissionService
 ) {
     companion object {
         private val TAG: String? = WebRequestBuilder::class.simpleName
-        private const val EXPORT_BINARY_FILE_NAME = "export.bin"
-        private const val EXPORT_SIGNATURE_FILE_NAME = "export.sig"
 
         @Volatile
         private var instance: WebRequestBuilder? = null
@@ -69,98 +53,14 @@ class WebRequestBuilder(
         }
 
         private fun buildWebRequestBuilder(): WebRequestBuilder {
-            val serviceFactory = ServiceFactory()
+            val serviceFactory = AppInjector.component.serviceFactory
             return WebRequestBuilder(
-                serviceFactory.distributionService(),
                 serviceFactory.verificationService(),
-                serviceFactory.submissionService(),
-                VerificationKeys()
+                serviceFactory.submissionService()
             )
         }
     }
 
-    /**
-     * Gets the country index which is then filtered by given filter param or if param not set
-     * @param wantedCountries (array of country codes) used to filter
-     * only wanted countries of the country index (case insensitive)
-     */
-    suspend fun asyncGetCountryIndex(
-        wantedCountries: List<String>
-    ): List<String> =
-        withContext(Dispatchers.IO) {
-            return@withContext distributionService
-                .getDateIndex(DiagnosisKeyConstants.AVAILABLE_COUNTRIES_URL)
-                .filter {
-                    wantedCountries.map { c -> c.toUpperCase(Locale.ROOT) }
-                        .contains(it.toUpperCase(Locale.ROOT))
-                }
-                .toList()
-        }
-
-    suspend fun asyncGetHourIndex(day: Date): List<String> = withContext(Dispatchers.IO) {
-        return@withContext distributionService
-            .getHourIndex(
-                DiagnosisKeyConstants.AVAILABLE_DATES_URL +
-                        "/${day.toServerFormat()}/${DiagnosisKeyConstants.HOUR}"
-            )
-            .toList()
-    }
-
-    /**
-     * Get the date index based on the given country
-     * @param country the country where the date index should be requested
-     */
-    suspend fun asyncGetDateIndex(country: String): List<String> = withContext(Dispatchers.IO) {
-        return@withContext distributionService
-            .getDateIndex("${DiagnosisKeyConstants.AVAILABLE_COUNTRIES_URL}/$country/${DiagnosisKeyConstants.DATE}")
-            .toList()
-    }
-
-    /**
-     * Retrieves Key Files from the Server based on a URL
-     *
-     * @param url the given URL
-     */
-    suspend fun asyncGetKeyFilesFromServer(
-        url: String
-    ): File = withContext(Dispatchers.IO) {
-        val fileName = "${UUID.nameUUIDFromBytes(url.toByteArray())}.zip"
-        val file = File(FileStorageHelper.keyExportDirectory, fileName)
-        file.outputStream().use {
-            Timber.v("Added $url to queue.")
-            distributionService.getKeyFiles(url).byteStream().copyTo(it, DEFAULT_BUFFER_SIZE)
-            Timber.v("key file request successful.")
-        }
-        return@withContext file
-    }
-
-    suspend fun asyncGetApplicationConfigurationFromServer(): ApplicationConfiguration =
-        withContext(Dispatchers.IO) {
-            var exportBinary: ByteArray? = null
-            var exportSignature: ByteArray? = null
-
-            distributionService.getApplicationConfiguration(
-                DiagnosisKeyConstants.COUNTRY_APPCONFIG_DOWNLOAD_URL
-            ).byteStream().unzip { entry, entryContent ->
-                if (entry.name == EXPORT_BINARY_FILE_NAME) exportBinary = entryContent.copyOf()
-                if (entry.name == EXPORT_SIGNATURE_FILE_NAME) exportSignature =
-                    entryContent.copyOf()
-            }
-            if (exportBinary == null || exportSignature == null) {
-                throw ApplicationConfigurationInvalidException()
-            }
-
-            if (verificationKeys.hasInvalidSignature(exportBinary, exportSignature)) {
-                throw ApplicationConfigurationCorruptException()
-            }
-
-            try {
-                return@withContext ApplicationConfiguration.parseFrom(exportBinary)
-            } catch (e: InvalidProtocolBufferException) {
-                throw ApplicationConfigurationInvalidException()
-            }
-        }
-
     suspend fun asyncGetRegistrationToken(
         key: String,
         keyType: KeyType
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/service/DistributionService.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/service/DistributionService.kt
deleted file mode 100644
index 1571fc4b66c..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/http/service/DistributionService.kt
+++ /dev/null
@@ -1,22 +0,0 @@
-package de.rki.coronawarnapp.http.service
-
-import okhttp3.ResponseBody
-import retrofit2.http.GET
-import retrofit2.http.Streaming
-import retrofit2.http.Url
-
-interface DistributionService {
-
-    @GET
-    suspend fun getDateIndex(@Url url: String): List<String>
-
-    @GET
-    suspend fun getHourIndex(@Url url: String): List<String>
-
-    @Streaming
-    @GET
-    suspend fun getKeyFiles(@Url url: String): ResponseBody
-
-    @GET
-    suspend fun getApplicationConfiguration(@Url url: String): ResponseBody
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationService.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationService.kt
index 314b7c1197d..e9e3a09a8f8 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationService.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationService.kt
@@ -1,14 +1,14 @@
 package de.rki.coronawarnapp.service.applicationconfiguration
 
 import com.google.android.gms.nearby.exposurenotification.ExposureConfiguration
-import de.rki.coronawarnapp.http.WebRequestBuilder
 import de.rki.coronawarnapp.server.protocols.ApplicationConfigurationOuterClass.ApplicationConfiguration
 import de.rki.coronawarnapp.util.CWADebug
+import de.rki.coronawarnapp.util.di.AppInjector
 
 object ApplicationConfigurationService {
     suspend fun asyncRetrieveApplicationConfiguration(): ApplicationConfiguration {
-        return WebRequestBuilder.getInstance().asyncGetApplicationConfigurationFromServer().let {
-            return if (CWADebug.isDebugBuildOrMode) {
+        return AppInjector.component.appConfigServer.downloadAppConfig().let {
+            if (CWADebug.isDebugBuildOrMode) {
                 // TODO: THIS IS A MOCK -> Remove after Backend is providing this information.
                 it.toBuilder()
                     .clearSupportedCountries()
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstants.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstants.kt
index e36b9111864..8acfd1c5ef2 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstants.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstants.kt
@@ -26,61 +26,17 @@ object DiagnosisKeyConstants {
     /** version resource variable for REST-like Service Calls */
     private const val VERSION = "version"
 
-    /** parameter resource variable for REST-like Service Calls */
-    private const val PARAMETERS = "parameters"
-    private const val APPCONFIG = "configuration"
-
     /** diagnosis keys resource variable for REST-like Service Calls */
     private const val DIAGNOSIS_KEYS = "diagnosis-keys"
 
-    /** country resource variable for REST-like Service Calls */
-    private const val COUNTRY = "country"
-
-    /** date resource variable for REST-like Service Calls */
-    const val DATE = "date"
-
-    /** hour resource variable for REST-like Service Calls */
-    const val HOUR = "hour"
-
-    private const val INDEX_FILE_NAME = "index.txt"
-
     /** resource variables but non-static context */
     private var CURRENT_VERSION = "v1"
-    private const val CURRENT_COUNTRY = "DE"
-
-    /** Distribution URL built from CDN URL's and REST resources */
-    private var VERSIONED_DISTRIBUTION_CDN_URL = "$VERSION/$CURRENT_VERSION"
 
     /** Submission URL built from CDN URL's and REST resources */
     private var VERSIONED_SUBMISSION_CDN_URL = "$VERSION/$CURRENT_VERSION"
 
-    /** Parameter Download URL built from CDN URL's and REST resources */
-    private val PARAMETERS_DOWNLOAD_URL = "$VERSIONED_DISTRIBUTION_CDN_URL/$PARAMETERS"
-    private val APPCONFIG_DOWNLOAD_URL = "$VERSIONED_DISTRIBUTION_CDN_URL/$APPCONFIG"
-
-    /** Index Download URL built from CDN URL's and REST resources */
-    val INDEX_DOWNLOAD_URL = "$VERSIONED_DISTRIBUTION_CDN_URL/$INDEX_FILE_NAME"
-
-    /** Diagnosis key Download URL built from CDN URL's and REST resources */
-    val DIAGNOSIS_KEYS_DOWNLOAD_URL = "$VERSIONED_DISTRIBUTION_CDN_URL/$DIAGNOSIS_KEYS"
-
     /** Diagnosis key Submission URL built from CDN URL's and REST resources */
     val DIAGNOSIS_KEYS_SUBMISSION_URL = "$VERSIONED_SUBMISSION_CDN_URL/$DIAGNOSIS_KEYS"
 
-    /** Country-Specific Parameter URL built from CDN URL's and REST resources */
-    val PARAMETERS_COUNTRY_DOWNLOAD_URL = "$PARAMETERS_DOWNLOAD_URL/$COUNTRY"
-    val APPCONFIG_COUNTRY_DOWNLOAD_URL = "$APPCONFIG_DOWNLOAD_URL/$COUNTRY"
-
-    val COUNTRY_APPCONFIG_DOWNLOAD_URL =
-        "$APPCONFIG_COUNTRY_DOWNLOAD_URL/$CURRENT_COUNTRY/app_config"
-
-    /** Dynamic URL to be able to specify which country should be used
-     * instead of $CURRENT_COUNTRY
-     **/
-    val AVAILABLE_COUNTRIES_URL = "$DIAGNOSIS_KEYS_DOWNLOAD_URL/$COUNTRY"
-
-    /** Available Dates URL built from CDN URL's and REST resources */
-    val AVAILABLE_DATES_URL = "$AVAILABLE_COUNTRIES_URL/$CURRENT_COUNTRY/$DATE"
-
     const val SERVER_ERROR_CODE_403 = 403
 }
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppDatabase.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppDatabase.kt
index ce4640c15db..454055162dc 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppDatabase.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppDatabase.kt
@@ -7,27 +7,28 @@ import androidx.room.Database
 import androidx.room.Room
 import androidx.room.RoomDatabase
 import androidx.room.TypeConverters
-import de.rki.coronawarnapp.storage.keycache.KeyCacheDao
-import de.rki.coronawarnapp.storage.keycache.KeyCacheEntity
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository
+import de.rki.coronawarnapp.diagnosiskeys.storage.legacy.KeyCacheLegacyDao
+import de.rki.coronawarnapp.diagnosiskeys.storage.legacy.KeyCacheLegacyEntity
 import de.rki.coronawarnapp.storage.tracing.TracingIntervalDao
 import de.rki.coronawarnapp.storage.tracing.TracingIntervalEntity
 import de.rki.coronawarnapp.storage.tracing.TracingIntervalRepository
-import de.rki.coronawarnapp.util.Converters
+import de.rki.coronawarnapp.util.database.CommonConverters
+import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.util.security.SecurityHelper
+import kotlinx.coroutines.runBlocking
 import net.sqlcipher.database.SupportFactory
 import java.io.File
 
 @Database(
-    entities = [ExposureSummaryEntity::class, KeyCacheEntity::class, TracingIntervalEntity::class],
+    entities = [ExposureSummaryEntity::class, KeyCacheLegacyEntity::class, TracingIntervalEntity::class],
     version = 1,
     exportSchema = true
 )
-@TypeConverters(Converters::class)
+@TypeConverters(CommonConverters::class)
 abstract class AppDatabase : RoomDatabase() {
 
     abstract fun exposureSummaryDao(): ExposureSummaryDao
-    abstract fun dateDao(): KeyCacheDao
+    abstract fun dateDao(): KeyCacheLegacyDao
     abstract fun tracingIntervalDao(): TracingIntervalDao
 
     companion object {
@@ -54,7 +55,8 @@ abstract class AppDatabase : RoomDatabase() {
             resetInstance()
 
             // reset also the repo instances
-            KeyCacheRepository.resetInstance()
+            val keyRepository = AppInjector.component.keyCacheRepository
+            runBlocking { keyRepository.clear() } // TODO this is not nice
             TracingIntervalRepository.resetInstance()
             ExposureSummaryRepository.resetInstance()
         }
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppSettings.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppSettings.kt
new file mode 100644
index 00000000000..f687e24adf5
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/AppSettings.kt
@@ -0,0 +1,11 @@
+package de.rki.coronawarnapp.storage
+
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class AppSettings @Inject constructor() {
+
+    val isLast3HourModeEnabled: Boolean
+        get() = LocalData.last3HoursMode()
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/DeviceStorage.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/DeviceStorage.kt
index 40bb35e9cbd..75caa3780c9 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/DeviceStorage.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/DeviceStorage.kt
@@ -6,10 +6,11 @@ import android.content.Context
 import android.os.Build
 import android.os.storage.StorageManager
 import android.text.format.Formatter
-import androidx.annotation.WorkerThread
 import dagger.Reusable
 import de.rki.coronawarnapp.util.ApiLevel
 import de.rki.coronawarnapp.util.storage.StatsFsProvider
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
 import timber.log.Timber
 import java.io.File
 import java.io.IOException
@@ -55,6 +56,7 @@ class DeviceStorage @Inject constructor(
         return CheckResult(
             path = targetPath,
             isSpaceAvailable = availableBytes >= requiredBytes || requiredBytes == -1L,
+            requiredBytes = requiredBytes,
             freeBytes = availableBytes,
             totalBytes = totalBytes
         )
@@ -70,14 +72,16 @@ class DeviceStorage @Inject constructor(
         return CheckResult(
             path = targetPath,
             isSpaceAvailable = stats.availableBytes >= requiredBytes || requiredBytes == -1L,
+            requiredBytes = requiredBytes,
             freeBytes = stats.availableBytes,
             totalBytes = stats.totalBytes
         )
     }
 
-    @WorkerThread
-    @Throws(IOException::class)
-    private fun checkSpace(path: File, requiredBytes: Long = -1L): CheckResult {
+    private suspend fun checkSpace(
+        path: File,
+        requiredBytes: Long = -1L
+    ): CheckResult = withContext(Dispatchers.IO) {
         try {
             Timber.tag(TAG).v("checkSpace(path=%s, requiredBytes=%d)", path, requiredBytes)
             val result: CheckResult = if (apiLevel.hasAPILevel(Build.VERSION_CODES.O)) {
@@ -92,7 +96,7 @@ class DeviceStorage @Inject constructor(
             }
 
             Timber.tag(TAG).d("Requested %d from %s: %s", requiredBytes, path, result)
-            return result
+            return@withContext result
         } catch (e: Exception) {
             throw IOException("checkSpace(path=$path, requiredBytes=$requiredBytes) FAILED", e)
                 .also { Timber.tag(TAG).e(it) }
@@ -108,14 +112,13 @@ class DeviceStorage @Inject constructor(
      *
      * @throws IOException if storage check or allocation fails.
      */
-    @WorkerThread
-    @Throws(IOException::class)
-    fun checkSpacePrivateStorage(requiredBytes: Long = -1L): CheckResult =
+    suspend fun checkSpacePrivateStorage(requiredBytes: Long = -1L): CheckResult =
         checkSpace(privateStorage, requiredBytes)
 
     data class CheckResult(
         val path: File,
         val isSpaceAvailable: Boolean,
+        val requiredBytes: Long = -1L,
         val freeBytes: Long,
         val totalBytes: Long
     ) {
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageConstants.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageConstants.kt
deleted file mode 100644
index 9571157bb5f..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageConstants.kt
+++ /dev/null
@@ -1,18 +0,0 @@
-package de.rki.coronawarnapp.storage
-
-/**
- * The File Storage constants are used inside the FileStorageHelper
- *
- * @see FileStorageHelper
- */
-object FileStorageConstants {
-
-    /** Days to keep data in internal storage */
-    const val DAYS_TO_KEEP: Long = 14
-
-    /** Size (Mb) threshold for free space check */
-    const val FREE_SPACE_THRESHOLD = 15
-
-    /** Key export directory name in internal storage */
-    const val KEY_EXPORT_DIRECTORY_NAME = "key-export"
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageHelper.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageHelper.kt
deleted file mode 100644
index 44442e9e61d..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/FileStorageHelper.kt
+++ /dev/null
@@ -1,90 +0,0 @@
-package de.rki.coronawarnapp.storage
-
-import android.content.Context
-import android.os.Build
-import android.os.storage.StorageManager
-import de.rki.coronawarnapp.CoronaWarnApplication
-import de.rki.coronawarnapp.exception.NotEnoughSpaceOnDiskException
-import timber.log.Timber
-import java.io.File
-import java.util.UUID
-import java.util.concurrent.TimeUnit
-
-/**
- * A helper class for file storage manipulation
- * The helper uses externalised constants for readability.
- *
- * @see FileStorageConstants
- */
-object FileStorageHelper {
-
-    private val TAG: String? = FileStorageHelper::class.simpleName
-    private val TIME_TO_KEEP = TimeUnit.DAYS.toMillis(FileStorageConstants.DAYS_TO_KEEP)
-    private const val BYTES = 1048576
-
-    /**
-     * create the needed key export directory (recursively)
-     *
-     */
-    fun initializeExportSubDirectory() = keyExportDirectory.mkdirs()
-
-    /**
-     * Get key files export directory used to store all export files for the transaction
-     * Uses FileStorageConstants.KEY_EXPORT_DIRECTORY_NAME constant
-     *
-     * @return File of key export directory
-     */
-    val keyExportDirectory = File(
-        CoronaWarnApplication.getAppContext().cacheDir,
-        FileStorageConstants.KEY_EXPORT_DIRECTORY_NAME
-    )
-
-    /**
-     * Checks if internal store has free memory.
-     * Threshold: FileStorageConstants.FREE_SPACE_THRESHOLD
-     * Bound to .usableSpace due to API level restrictions (minimum required level - 23)
-     */
-    fun checkFileStorageFreeSpace() {
-        val availableSpace = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            val storageManager = CoronaWarnApplication.getAppContext()
-                .getSystemService(Context.STORAGE_SERVICE) as StorageManager
-            val storageVolume = storageManager.primaryStorageVolume
-            val storageUUID =
-                UUID.fromString(storageVolume.uuid ?: StorageManager.UUID_DEFAULT.toString())
-            storageManager.getAllocatableBytes(storageUUID) / BYTES
-        } else {
-            keyExportDirectory.usableSpace / BYTES
-        }
-        if (availableSpace < FileStorageConstants.FREE_SPACE_THRESHOLD) {
-            throw NotEnoughSpaceOnDiskException()
-        }
-    }
-
-    fun getAllFilesInKeyExportDirectory(): List<File> {
-        return keyExportDirectory
-            .walk(FileWalkDirection.BOTTOM_UP)
-            .filter(File::isFile)
-            .toList()
-    }
-
-    fun File.isOutdated(): Boolean =
-        (System.currentTimeMillis() - lastModified() > TIME_TO_KEEP)
-
-    private fun File.checkAndRemove(): Boolean {
-        return if (exists() && isDirectory) {
-            deleteRecursively()
-        } else {
-            false
-        }
-    }
-
-    // LOGGING
-    private fun logFileRemovalResult(fileName: String, result: Boolean) =
-        Timber.d("File $fileName was deleted: $result")
-
-    private fun logAvailableSpace(availableSpace: Long) =
-        Timber.d("Available space: $availableSpace")
-
-    private fun logInsufficientSpace(availableSpace: Long) =
-        Timber.e("Not enough free space! Required: ${FileStorageConstants.FREE_SPACE_THRESHOLD} Has: $availableSpace")
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/InsufficientStorageException.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/InsufficientStorageException.kt
new file mode 100644
index 00000000000..32d18cb7c27
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/InsufficientStorageException.kt
@@ -0,0 +1,7 @@
+package de.rki.coronawarnapp.storage
+
+import java.io.IOException
+
+class InsufficientStorageException(
+    val result: DeviceStorage.CheckResult
+) : IOException("Not enough free space (Want:${result.requiredBytes}; Have:${result.freeBytes}")
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDao.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDao.kt
deleted file mode 100644
index ec812964a59..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheDao.kt
+++ /dev/null
@@ -1,49 +0,0 @@
-/******************************************************************************
- * Corona-Warn-App                                                            *
- *                                                                            *
- * SAP SE and all other contributors /                                        *
- * copyright owners license this file to you under the Apache                 *
- * License, Version 2.0 (the "License"); you may not use this                 *
- * file except in compliance with the License.                                *
- * You may obtain a copy of the License at                                    *
- *                                                                            *
- * http://www.apache.org/licenses/LICENSE-2.0                                 *
- *                                                                            *
- * Unless required by applicable law or agreed to in writing,                 *
- * software distributed under the License is distributed on an                *
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
- * KIND, either express or implied.  See the License for the                  *
- * specific language governing permissions and limitations                    *
- * under the License.                                                         *
- ******************************************************************************/
-
-package de.rki.coronawarnapp.storage.keycache
-
-import androidx.room.Dao
-import androidx.room.Delete
-import androidx.room.Insert
-import androidx.room.Query
-
-@Dao
-interface KeyCacheDao {
-    @Query("SELECT * FROM date WHERE type=0")
-    suspend fun getDates(): List<KeyCacheEntity>
-
-    @Query("SELECT * FROM date WHERE type=1")
-    suspend fun getHours(): List<KeyCacheEntity>
-
-    @Query("SELECT * FROM date")
-    suspend fun getAllEntries(): List<KeyCacheEntity>
-
-    @Query("DELETE FROM date")
-    suspend fun clear()
-
-    @Query("DELETE FROM date WHERE type=1")
-    suspend fun clearHours()
-
-    @Delete
-    suspend fun deleteEntry(entity: KeyCacheEntity)
-
-    @Insert
-    suspend fun insertEntry(keyCacheEntity: KeyCacheEntity): Long
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepository.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepository.kt
deleted file mode 100644
index 9e3ce000310..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepository.kt
+++ /dev/null
@@ -1,95 +0,0 @@
-/******************************************************************************
- * Corona-Warn-App                                                            *
- *                                                                            *
- * SAP SE and all other contributors /                                        *
- * copyright owners license this file to you under the Apache                 *
- * License, Version 2.0 (the "License"); you may not use this                 *
- * file except in compliance with the License.                                *
- * You may obtain a copy of the License at                                    *
- *                                                                            *
- * http://www.apache.org/licenses/LICENSE-2.0                                 *
- *                                                                            *
- * Unless required by applicable law or agreed to in writing,                 *
- * software distributed under the License is distributed on an                *
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
- * KIND, either express or implied.  See the License for the                  *
- * specific language governing permissions and limitations                    *
- * under the License.                                                         *
- ******************************************************************************/
-
-package de.rki.coronawarnapp.storage.keycache
-
-import android.content.Context
-import de.rki.coronawarnapp.storage.AppDatabase
-import timber.log.Timber
-import java.io.File
-import java.net.URI
-
-class KeyCacheRepository(private val keyCacheDao: KeyCacheDao) {
-    companion object {
-        @Volatile
-        private var instance: KeyCacheRepository? = null
-
-        private fun getInstance(keyCacheDao: KeyCacheDao) =
-            instance ?: synchronized(this) {
-                instance
-                    ?: KeyCacheRepository(keyCacheDao)
-                        .also { instance = it }
-            }
-
-        fun resetInstance() = synchronized(this) {
-            instance = null
-        }
-
-        fun getDateRepository(context: Context): KeyCacheRepository {
-            return getInstance(
-                AppDatabase.getInstance(context.applicationContext)
-                    .dateDao()
-            )
-        }
-    }
-
-    enum class DateEntryType {
-        DAY,
-        HOUR
-    }
-
-    suspend fun createEntry(key: String, uri: URI, type: DateEntryType) = keyCacheDao.insertEntry(
-        KeyCacheEntity().apply {
-            this.id = key
-            this.path = uri.rawPath
-            this.type = type.ordinal
-        }
-    )
-
-    suspend fun deleteOutdatedEntries(validEntries: List<String>) =
-        keyCacheDao.getAllEntries().forEach {
-            Timber.v("valid entries for cache from server: $validEntries")
-            val file = File(it.path)
-            if (!validEntries.contains(it.id) || !file.exists()) {
-                Timber.w("${it.id} will be deleted from the cache")
-                deleteFileForEntry(it)
-                keyCacheDao.deleteEntry(it)
-            }
-        }
-
-    private fun deleteFileForEntry(entry: KeyCacheEntity) = File(entry.path).delete()
-
-    suspend fun getDates() = keyCacheDao.getDates()
-    suspend fun getHours() = keyCacheDao.getHours()
-
-    suspend fun clearHours() {
-        getHours().forEach { deleteFileForEntry(it) }
-        keyCacheDao.clearHours()
-    }
-
-    suspend fun clear() {
-        keyCacheDao.getAllEntries().forEach { deleteFileForEntry(it) }
-        keyCacheDao.clear()
-    }
-
-    suspend fun getFilesFromEntries() = keyCacheDao
-        .getAllEntries()
-        .map { File(it.path) }
-        .filter { it.exists() }
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransaction.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransaction.kt
index cdbbe414155..06bd08ecd9a 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransaction.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransaction.kt
@@ -20,12 +20,12 @@
 package de.rki.coronawarnapp.transaction
 
 import com.google.android.gms.nearby.exposurenotification.ExposureConfiguration
-import de.rki.coronawarnapp.CoronaWarnApplication
+import de.rki.coronawarnapp.diagnosiskeys.download.KeyFileDownloader
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheRepository
 import de.rki.coronawarnapp.nearby.InternalExposureNotificationClient
 import de.rki.coronawarnapp.service.applicationconfiguration.ApplicationConfigurationService
-import de.rki.coronawarnapp.storage.FileStorageHelper
 import de.rki.coronawarnapp.storage.LocalData
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.RetrieveDiagnosisKeysTransactionState.API_SUBMISSION
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.RetrieveDiagnosisKeysTransactionState.CLOSE
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.RetrieveDiagnosisKeysTransactionState.FETCH_DATE_UPDATE
@@ -36,7 +36,6 @@ import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.Retriev
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.rollback
 import de.rki.coronawarnapp.transaction.RetrieveDiagnosisKeysTransaction.start
 import de.rki.coronawarnapp.util.CWADebug
-import de.rki.coronawarnapp.util.CachedKeyFileHolder
 import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.worker.BackgroundWorkHelper
 import org.joda.time.DateTime
@@ -123,6 +122,12 @@ object RetrieveDiagnosisKeysTransaction : Transaction() {
     private val transactionScope: TransactionCoroutineScope by lazy {
         AppInjector.component.transRetrieveKeysInjection.transactionScope
     }
+    private val keyCacheRepository: KeyCacheRepository by lazy {
+        AppInjector.component.keyCacheRepository
+    }
+    private val keyFileDownloader: KeyFileDownloader by lazy {
+        AppInjector.component.keyFileDownloader
+    }
 
     var onApiSubmissionStarted: (() -> Unit)? = null
     var onApiSubmissionFinished: (() -> Unit)? = null
@@ -148,7 +153,7 @@ object RetrieveDiagnosisKeysTransaction : Transaction() {
     }
 
     /** initiates the transaction. This suspend function guarantees a successful transaction once completed.
-     * @param countries defines which countries (country codes) should be used. If not filled the
+     * @param requestedCountries defines which countries (country codes) should be used. If not filled the
      * country codes will be loaded from the ApplicationConfigurationService
      */
     suspend fun start(
@@ -192,10 +197,7 @@ object RetrieveDiagnosisKeysTransaction : Transaction() {
             onKeyFilesDownloadStarted = null
         }
 
-        val keyFiles = executeFetchKeyFilesFromServer(
-            currentDate,
-            countries
-        )
+        val keyFiles = executeFetchKeyFilesFromServer(countries)
 
         if (CWADebug.isDebugBuildOrMode) {
             val totalFileSize = keyFiles.fold(0L, { acc, file ->
@@ -267,8 +269,7 @@ object RetrieveDiagnosisKeysTransaction : Transaction() {
 
     private suspend fun rollbackFilesFromWebRequests() {
         Timber.tag(TAG).v("rollback $FILES_FROM_WEB_REQUESTS")
-        KeyCacheRepository.getDateRepository(CoronaWarnApplication.getAppContext())
-            .clear()
+        keyCacheRepository.clear()
     }
 
     /**
@@ -303,11 +304,10 @@ object RetrieveDiagnosisKeysTransaction : Transaction() {
      * Executes the WEB_REQUESTS Transaction State
      */
     private suspend fun executeFetchKeyFilesFromServer(
-        currentDate: Date,
         countries: List<String>
     ) = executeState(FILES_FROM_WEB_REQUESTS) {
-        FileStorageHelper.initializeExportSubDirectory()
-        CachedKeyFileHolder.asyncFetchFiles(currentDate, countries)
+        val locationCodes = countries.map { LocationCode(it) }
+        keyFileDownloader.asyncFetchKeyFiles(locationCodes)
     }
 
     /**
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/CachedKeyFileHolder.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/CachedKeyFileHolder.kt
deleted file mode 100644
index 5330e409d92..00000000000
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/CachedKeyFileHolder.kt
+++ /dev/null
@@ -1,283 +0,0 @@
-/******************************************************************************
- * Corona-Warn-App                                                            *
- *                                                                            *
- * SAP SE and all other contributors /                                        *
- * copyright owners license this file to you under the Apache                 *
- * License, Version 2.0 (the "License"); you may not use this                 *
- * file except in compliance with the License.                                *
- * You may obtain a copy of the License at                                    *
- *                                                                            *
- * http://www.apache.org/licenses/LICENSE-2.0                                 *
- *                                                                            *
- * Unless required by applicable law or agreed to in writing,                 *
- * software distributed under the License is distributed on an                *
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
- * KIND, either express or implied.  See the License for the                  *
- * specific language governing permissions and limitations                    *
- * under the License.                                                         *
- ******************************************************************************/
-
-package de.rki.coronawarnapp.util
-
-import de.rki.coronawarnapp.CoronaWarnApplication
-import de.rki.coronawarnapp.http.WebRequestBuilder
-import de.rki.coronawarnapp.service.diagnosiskey.DiagnosisKeyConstants
-import de.rki.coronawarnapp.storage.FileStorageHelper
-import de.rki.coronawarnapp.storage.LocalData
-import de.rki.coronawarnapp.storage.keycache.KeyCacheEntity
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository.DateEntryType.DAY
-import de.rki.coronawarnapp.util.CachedKeyFileHolder.asyncFetchFiles
-import de.rki.coronawarnapp.util.CachedKeyFileHolder.generateCacheKeyFromString
-import de.rki.coronawarnapp.util.TimeAndDateExtensions.toServerFormat
-import kotlinx.coroutines.Deferred
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.async
-import kotlinx.coroutines.awaitAll
-import kotlinx.coroutines.withContext
-import timber.log.Timber
-import java.io.File
-import java.util.Date
-import java.util.UUID
-
-/**
- * Singleton used for accessing key files via combining cached entries from existing files and new requests.
- * made explicitly with [asyncFetchFiles] in mind
- */
-object CachedKeyFileHolder {
-    private val TAG: String? = CachedKeyFileHolder::class.simpleName
-
-    /**
-     * the key cache instance used to store queried dates and hours
-     */
-    private val keyCache =
-        KeyCacheRepository.getDateRepository(CoronaWarnApplication.getAppContext())
-
-    /**
-     * Fetches all necessary Files from the Cached KeyFile Entries out of the [KeyCacheRepository] and
-     * adds to that all open Files currently available from the Server.
-     *
-     * Assumptions made about the implementation:
-     * - the app initializes with an empty cache and draws in every available data set in the beginning
-     * - the difference can only work properly if the date from the device is synchronized through the net
-     * - the difference in timezone is taken into account by using UTC in the Conversion from the Date to Server format
-     * - the missing days and hours are stored in one table as the actual stored data amount is low
-     * - the underlying repository from the database has no error and is reliable as source of truth
-     *
-     * @param currentDate the current date - if this is adjusted by the calendar, the cache is affected.
-     * @return list of all files from both the cache and the diff query
-     */
-    suspend fun asyncFetchFiles(
-        currentDate: Date,
-        countries: List<String>
-    ): List<File> = withContext(Dispatchers.IO) {
-        // Initiate key-cache folder needed for saving downloaded key files
-        FileStorageHelper.initializeExportSubDirectory()
-
-        checkForFreeSpace()
-
-        // Build pair of country to date <Country, Date[]>
-        val serverDates = getCountriesFromServer(countries).map {
-            CountryDataWrapper(it, getDatesFromServer((it)))
-        }
-
-        if (CWADebug.isDebugBuildOrMode && LocalData.last3HoursMode()) {
-            asyncHandleLast3HoursFilesFetch(currentDate, serverDates)
-        } else {
-            asyncHandleFilesFetch(serverDates)
-        }
-    }
-
-    private fun checkForFreeSpace() = FileStorageHelper.checkFileStorageFreeSpace()
-
-    /**
-     * Fetches files given by serverDates by respecting countries
-     * @param serverDates pair of dates per country code
-     */
-    private suspend fun asyncHandleFilesFetch(
-        serverDates: List<CountryDataWrapper>
-    ): List<File> = withContext(Dispatchers.IO) {
-        // Build flat map of uuids from dates of countries
-        val uuidListFromServer = serverDates.flatMap { countryWrapper ->
-            countryWrapper.dates.map { date ->
-                countryWrapper.getURLForDay(date)
-            }
-        }
-
-        Timber.v("${uuidListFromServer.size} available dates from server for ${serverDates.size} countries")
-
-        // queries will be executed after the "query plan" was set
-        val deferredQueries: MutableCollection<Deferred<Any>> = mutableListOf()
-        keyCache.deleteOutdatedEntries(uuidListFromServer)
-
-        val countryWithMissingDays = getMissingDaysFromDiff(serverDates)
-        if (countryWithMissingDays.isNotEmpty()) {
-            // we have a date difference
-            countryWithMissingDays
-                .flatMap { country ->
-                    country.dates.map { country.getURLForDay(it) }
-                }
-                .map { url ->
-                    async {
-                        keyCache.createEntry(
-                            url.generateCacheKeyFromString(),
-                            WebRequestBuilder.getInstance().asyncGetKeyFilesFromServer(url).toURI(),
-                            DAY
-                        )
-                    }
-                }
-                .toList()
-                .also { deferredQueries.addAll(it) }
-        }
-
-        // execute the query plan
-        try {
-            deferredQueries.awaitAll()
-        } catch (e: Exception) {
-            // For an error we clear the cache to try again
-            keyCache.clear()
-            throw e
-        }
-
-        keyCache.getFilesFromEntries()
-            .also { it.forEach { file -> Timber.v("cached file:${file.path}") } }
-    }
-
-    /**
-     * Fetches files given by serverDates by respecting countries
-     * @param currentDate base for where only dates within 3 hours before will be fetched
-     * @param serverDates pair of dates per country code
-     */
-    private suspend fun asyncHandleLast3HoursFilesFetch(
-        currentDate: Date,
-        serverDates: List<CountryDataWrapper>
-    ): List<File> = withContext(Dispatchers.IO) {
-        Timber.v("Last 3 Hours will be Fetched. Only use for Debugging!")
-        val currentDateServerFormat = currentDate.toServerFormat()
-
-        // just fetch the hours if the date is available
-        // extend fetch for all dates in all countries provided in serverDates
-        val packagesWithCurrentDate = serverDates
-            .filter { countryWithDates ->
-                countryWithDates.dates.contains(currentDateServerFormat)
-            }
-
-        if (packagesWithCurrentDate.isEmpty()) {
-            throw IllegalStateException(
-                "you cannot use the last 3 hour mode if the date index " +
-                        "does not contain any data for today"
-            )
-        }
-
-        return@withContext serverDates
-            .flatMap { countryWithDates ->
-                getLast3Hours(currentDate)
-                    .map { hour ->
-                        countryWithDates.getURLForHour(currentDate.toServerFormat(), hour)
-                    }
-                    .map { url ->
-                        async {
-                            return@async WebRequestBuilder.getInstance()
-                                .asyncGetKeyFilesFromServer(url)
-                        }
-                    }
-            }
-            .awaitAll()
-    }
-
-    /**
-     * Calculates the missing days based on current missing entries in the cache
-     * with respect to all countries defined
-     */
-    private suspend fun getMissingDaysFromDiff(
-        serverCountryData: Collection<CountryDataWrapper>
-    ): Collection<CountryDataWrapper> {
-        val cacheEntries = keyCache.getDates()
-        return serverCountryData
-            .also { Timber.d("Server country data: %s", it) }
-            .map { availCountry ->
-                CountryDataWrapper(
-                    availCountry.country,
-                    availCountry.getMissingDates(cacheEntries)
-                )
-            }
-            .filter { countryData ->
-                // Only return countries with missing dates.
-                countryData.dates.isNotEmpty()
-            }
-            .also { Timber.d("Locally missing country data: %s", it) }
-    }
-
-    private const val LATEST_HOURS_NEEDED = 3
-
-    /**
-     * Calculates the last 3 hours
-     */
-    private suspend fun getLast3Hours(day: Date): List<String> = getHoursFromServer(day)
-        .also { Timber.v("${it.size} hours from server, but only latest 3 hours needed") }
-        .filter { TimeAndDateExtensions.getCurrentHourUTC() - LATEST_HOURS_NEEDED <= it.toInt() }
-        .toList()
-        .also { Timber.d("${it.size} missing hours") }
-
-    /**
-     * Generates a unique key name (UUIDv3) for the cache entry based out of a string (e.g. an url)
-     */
-    fun String.generateCacheKeyFromString() =
-        "${UUID.nameUUIDFromBytes(this.toByteArray())}".also {
-            Timber.v("$this mapped to cache entry $it")
-        }
-
-    /**
-     * Get all dates of a country from server based as formatted dates
-     *
-     * @param country the country where the dates are got from
-     */
-    private suspend fun getDatesFromServer(country: String) =
-        WebRequestBuilder.getInstance().asyncGetDateIndex(country)
-
-    /**
-     * Get all hours from server based as formatted dates
-     */
-    private suspend fun getHoursFromServer(day: Date) =
-        WebRequestBuilder.getInstance().asyncGetHourIndex(day)
-
-    /**
-     * Get all countries from the server
-     */
-    private suspend fun getCountriesFromServer(countries: List<String>) =
-        WebRequestBuilder.getInstance().asyncGetCountryIndex(countries)
-}
-
-internal data class CountryDataWrapper(val country: String, val dates: Collection<String>) {
-
-    /**
-     * Return a filtered list that contains all dates which are part of this wrapper, but not in the parameter.
-     */
-    fun getMissingDates(cachedKeys: Collection<KeyCacheEntity>): Collection<String> {
-        val cacheIds = cachedKeys.map { it.id }
-
-        return dates.filterNot { date ->
-            val formattedDateUrl = getURLForDay(date)
-            val cacheKeyFromUrl = formattedDateUrl.generateCacheKeyFromString()
-            // If the cache doesn't contain our ID, it's a missing date
-            cacheIds.contains(cacheKeyFromUrl)
-        }
-    }
-
-    /**
-     * Gets the correct URL String for querying a day bucket
-     *
-     * @param formattedDate the formatted date
-     */
-    fun getURLForDay(formattedDate: String) =
-        "${DiagnosisKeyConstants.AVAILABLE_COUNTRIES_URL}/$country/${DiagnosisKeyConstants.DATE}/$formattedDate"
-
-    /**
-     * Gets the correct URL String for querying an hour bucket
-     *
-     * @param formattedDate the formatted date for the hour bucket request
-     * @param formattedHour the formatted hour
-     */
-    fun getURLForHour(formattedDate: String, formattedHour: String) =
-        "${getURLForDay(formattedDate)}/${DiagnosisKeyConstants.HOUR}/$formattedHour"
-}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/DataRetentionHelper.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/DataRetentionHelper.kt
index 46343586783..1ce93fc10fa 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/DataRetentionHelper.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/DataRetentionHelper.kt
@@ -22,9 +22,10 @@ package de.rki.coronawarnapp.util
 import android.annotation.SuppressLint
 import android.content.Context
 import de.rki.coronawarnapp.storage.AppDatabase
-import de.rki.coronawarnapp.storage.FileStorageHelper
 import de.rki.coronawarnapp.storage.RiskLevelRepository
+import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.util.security.SecurityHelper
+import kotlinx.coroutines.runBlocking
 import timber.log.Timber
 
 /**
@@ -47,7 +48,8 @@ object DataRetentionHelper {
         // Reset the current risk level stored in LiveData
         RiskLevelRepository.reset()
         // Export File Reset
-        FileStorageHelper.getAllFilesInKeyExportDirectory().forEach { it.delete() }
+        // TODO runBlocking, but also all of the above is BLOCKING and should be called more nicely
+        runBlocking { AppInjector.component.keyCacheRepository.clear() }
         Timber.w("CWA LOCAL DATA DELETION COMPLETED.")
     }
 }
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/HashExtensions.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/HashExtensions.kt
new file mode 100644
index 00000000000..b99b9f2ccd8
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/HashExtensions.kt
@@ -0,0 +1,39 @@
+package de.rki.coronawarnapp.util
+
+import java.io.File
+import java.security.MessageDigest
+import java.util.Locale
+
+internal object HashExtensions {
+
+    fun String.toSHA256() = this.hashString("SHA-256")
+
+    fun String.toSHA1() = this.hashString("SHA-1")
+
+    fun String.toMD5() = this.hashString("MD5")
+
+    private fun ByteArray.formatHash(): String = this
+        .joinToString(separator = "") { String.format("%02X", it) }
+        .toLowerCase(Locale.ROOT)
+
+    private fun String.hashString(type: String): String = MessageDigest
+        .getInstance(type)
+        .digest(this.toByteArray())
+        .formatHash()
+
+    fun File.hashToMD5(): String = this.hashTo("MD5")
+
+    private fun File.hashTo(type: String): String = MessageDigest
+        .getInstance(type)
+        .let { md ->
+            inputStream().use { stream ->
+                val buffer = ByteArray(8192)
+                var read: Int
+                while (stream.read(buffer).also { read = it } > 0) {
+                    md.update(buffer, 0, read)
+                }
+            }
+            md.digest()
+        }
+        .formatHash()
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/TimeStamper.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/TimeStamper.kt
new file mode 100644
index 00000000000..fcbfc75d600
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/TimeStamper.kt
@@ -0,0 +1,12 @@
+package de.rki.coronawarnapp.util
+
+import org.joda.time.Instant
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class TimeStamper @Inject constructor() {
+
+    val nowUTC: Instant
+        get() = Instant.now()
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/database/CommonConverters.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/database/CommonConverters.kt
new file mode 100644
index 00000000000..cbbf8366f3d
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/database/CommonConverters.kt
@@ -0,0 +1,81 @@
+/******************************************************************************
+ * Corona-Warn-App                                                            *
+ *                                                                            *
+ * SAP SE and all other contributors /                                        *
+ * copyright owners license this file to you under the Apache                 *
+ * License, Version 2.0 (the "License"); you may not use this                 *
+ * file except in compliance with the License.                                *
+ * You may obtain a copy of the License at                                    *
+ *                                                                            *
+ * http://www.apache.org/licenses/LICENSE-2.0                                 *
+ *                                                                            *
+ * Unless required by applicable law or agreed to in writing,                 *
+ * software distributed under the License is distributed on an                *
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
+ * KIND, either express or implied.  See the License for the                  *
+ * specific language governing permissions and limitations                    *
+ * under the License.                                                         *
+ ******************************************************************************/
+
+package de.rki.coronawarnapp.util.database
+
+import androidx.room.TypeConverter
+import com.google.gson.Gson
+import com.google.gson.reflect.TypeToken
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import java.io.File
+import java.util.UUID
+
+class CommonConverters {
+    private val gson = Gson()
+
+    @TypeConverter
+    fun toIntList(value: String?): List<Int> {
+        val listType = object : TypeToken<List<Int?>?>() {}.type
+        return gson.fromJson(value, listType)
+    }
+
+    @TypeConverter
+    fun fromIntList(list: List<Int?>?): String {
+        return gson.toJson(list)
+    }
+
+    @TypeConverter
+    fun toUUID(value: String?): UUID? = value?.let { UUID.fromString(it) }
+
+    @TypeConverter
+    fun fromUUID(uuid: UUID?): String? = uuid?.toString()
+
+    @TypeConverter
+    fun toPath(value: String?): File? = value?.let { File(it) }
+
+    @TypeConverter
+    fun fromPath(path: File?): String? = path?.path
+
+    @TypeConverter
+    fun toLocalDate(value: String?): LocalDate? = value?.let { LocalDate.parse(it) }
+
+    @TypeConverter
+    fun fromLocalDate(date: LocalDate?): String? = date?.toString()
+
+    @TypeConverter
+    fun toLocalTime(value: String?): LocalTime? = value?.let { LocalTime.parse(it) }
+
+    @TypeConverter
+    fun fromLocalTime(date: LocalTime?): String? = date?.toString()
+
+    @TypeConverter
+    fun toInstant(value: String?): Instant? = value?.let { Instant.parse(it) }
+
+    @TypeConverter
+    fun fromInstant(date: Instant?): String? = date?.toString()
+
+    @TypeConverter
+    fun toLocationCode(value: String?): LocationCode? = value?.let { LocationCode(it) }
+
+    @TypeConverter
+    fun fromLocationCode(code: LocationCode?): String? = code?.identifier
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/debug/TimeMeasurement.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/debug/TimeMeasurement.kt
new file mode 100644
index 00000000000..58c06b520ba
--- /dev/null
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/debug/TimeMeasurement.kt
@@ -0,0 +1,7 @@
+package de.rki.coronawarnapp.util.debug
+
+inline fun <T> measureTimeMillisWithResult(block: () -> T): Pair<T, Long> {
+    val start = System.currentTimeMillis()
+    val result = block()
+    return result to (System.currentTimeMillis() - start)
+}
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/di/ApplicationComponent.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/di/ApplicationComponent.kt
index b175c93c808..2e6290343c5 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/di/ApplicationComponent.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/di/ApplicationComponent.kt
@@ -5,6 +5,12 @@ import dagger.Component
 import dagger.android.AndroidInjector
 import dagger.android.support.AndroidSupportInjectionModule
 import de.rki.coronawarnapp.CoronaWarnApplication
+import de.rki.coronawarnapp.diagnosiskeys.DiagnosisKeysModule
+import de.rki.coronawarnapp.diagnosiskeys.download.KeyFileDownloader
+import de.rki.coronawarnapp.diagnosiskeys.server.AppConfigServer
+import de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheRepository
+import de.rki.coronawarnapp.http.HttpModule
+import de.rki.coronawarnapp.http.ServiceFactory
 import de.rki.coronawarnapp.receiver.ReceiverBinder
 import de.rki.coronawarnapp.risk.RiskModule
 import de.rki.coronawarnapp.service.ServiceBinder
@@ -28,7 +34,9 @@ import javax.inject.Singleton
         ActivityBinder::class,
         RiskModule::class,
         UtilModule::class,
-        DeviceModule::class
+        DeviceModule::class,
+        HttpModule::class,
+        DiagnosisKeysModule::class
     ]
 )
 interface ApplicationComponent : AndroidInjector<CoronaWarnApplication> {
@@ -42,6 +50,12 @@ interface ApplicationComponent : AndroidInjector<CoronaWarnApplication> {
 
     val settingsRepository: SettingsRepository
 
+    val keyCacheRepository: KeyCacheRepository
+    val keyFileDownloader: KeyFileDownloader
+    val serviceFactory: ServiceFactory
+
+    val appConfigServer: AppConfigServer
+
     @Component.Factory
     interface Factory {
         fun create(@BindsInstance app: CoronaWarnApplication): ApplicationComponent
diff --git a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/VerificationKeys.kt b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/VerificationKeys.kt
index b70af82ba6d..03ec87d302f 100644
--- a/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/VerificationKeys.kt
+++ b/Corona-Warn-App/src/main/java/de/rki/coronawarnapp/util/security/VerificationKeys.kt
@@ -8,8 +8,11 @@ import timber.log.Timber
 import java.security.KeyFactory
 import java.security.Signature
 import java.security.spec.X509EncodedKeySpec
+import javax.inject.Inject
+import javax.inject.Singleton
 
-class VerificationKeys {
+@Singleton
+class VerificationKeys @Inject constructor() {
     companion object {
         private const val KEY_DELIMITER = ","
     }
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModuleTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModuleTest.kt
new file mode 100644
index 00000000000..35331290907
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/DiagnosisKeysModuleTest.kt
@@ -0,0 +1,23 @@
+package de.rki.coronawarnapp.diagnosiskeys
+
+import de.rki.coronawarnapp.BuildConfig
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import io.kotest.matchers.shouldBe
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+
+class DiagnosisKeysModuleTest : BaseIOTest() {
+
+    private val module = DiagnosisKeysModule()
+
+    @Test
+    fun `home country should be DE`() {
+        module.provideDiagnosisHomeCountry() shouldBe LocationCode("DE")
+    }
+
+    @Test
+    fun `download URL comes from BuildConfig`() {
+        module.provideDownloadServerUrl() shouldBe BuildConfig.DOWNLOAD_CDN_URL
+    }
+
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryDataTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryDataTest.kt
new file mode 100644
index 00000000000..199ddb20c55
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/CountryDataTest.kt
@@ -0,0 +1,241 @@
+package de.rki.coronawarnapp.diagnosiskeys.download
+
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.CachedKeyInfo
+import io.kotest.matchers.shouldBe
+import io.mockk.every
+import io.mockk.mockk
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.Test
+import testhelpers.BaseTest
+
+class CountryDataTest : BaseTest() {
+    private val locationCode = LocationCode("DE")
+
+    private fun createCachedKey(dayString: String, hourString: String? = null): CachedKeyInfo {
+        return mockk<CachedKeyInfo>().apply {
+            every { location } returns locationCode
+            every { day } returns LocalDate.parse(dayString)
+            every { hour } returns hourString?.let { LocalTime.parse(it) }
+        }
+    }
+
+    @Test
+    fun `missing days default`() {
+        val availableDates = listOf(
+            "2222-12-30", "2222-12-31"
+        ).map { LocalDate.parse(it) }
+        val cd = CountryDays(locationCode, availableDates)
+
+        cd.dayData shouldBe availableDates
+
+        val cachedDays = listOf(
+            createCachedKey("2222-12-30")
+        )
+
+        cd.getMissingDays(cachedDays) shouldBe listOf(availableDates[1])
+        cd.toMissingDays(cachedDays) shouldBe cd.copy(
+            dayData = listOf(availableDates[1])
+        )
+    }
+
+    @Test
+    fun `missing days empty day data`() {
+        val availableDates = emptyList<LocalDate>()
+        val cd = CountryDays(locationCode, availableDates)
+
+        cd.dayData shouldBe availableDates
+
+        val cachedDays = listOf(
+            createCachedKey("2222-12-30"),
+            createCachedKey("2222-12-31")
+        )
+
+        cd.getMissingDays(cachedDays) shouldBe emptyList()
+        cd.toMissingDays(cachedDays) shouldBe null
+    }
+
+    @Test
+    fun `missing days empty cache`() {
+        val availableDates = listOf(
+            "2222-11-28", "2222-11-29"
+        ).map { LocalDate.parse(it) }
+        val cd = CountryDays(locationCode, availableDates)
+
+        cd.dayData shouldBe availableDates
+
+        val cachedDays = emptyList<CachedKeyInfo>()
+
+        cd.getMissingDays(cachedDays) shouldBe availableDates
+        cd.toMissingDays(cachedDays) shouldBe cd
+    }
+
+    @Test
+    fun `missing days disjunct`() {
+        val availableDates = listOf(
+            "2222-11-28", "2222-11-29"
+        ).map { LocalDate.parse(it) }
+        val cd = CountryDays(locationCode, availableDates)
+
+        cd.dayData shouldBe availableDates
+
+        val cachedDays = listOf(
+            createCachedKey("2222-12-28"),
+            createCachedKey("2222-12-29")
+        )
+
+        cd.getMissingDays(cachedDays) shouldBe availableDates
+        cd.toMissingDays(cachedDays) shouldBe cd
+    }
+
+    @Test
+    fun `missing days none missing`() {
+        val availableDates = listOf(
+            "2222-12-30", "2222-12-31"
+        ).map { LocalDate.parse(it) }
+        val cd = CountryDays(locationCode, availableDates)
+
+        cd.dayData shouldBe availableDates
+
+        val cachedDays = listOf(
+            createCachedKey("2222-12-30"),
+            createCachedKey("2222-12-31")
+        )
+
+        cd.getMissingDays(cachedDays) shouldBe emptyList()
+        cd.toMissingDays(cachedDays) shouldBe null
+    }
+
+    @Test
+    fun `missing hours default`() {
+        val availableHours = mapOf(
+            LocalDate.parse("2222-12-30") to listOf(
+                LocalTime.parse("19:00"), LocalTime.parse("20:00")
+            ),
+            LocalDate.parse("2222-12-31") to listOf(
+                LocalTime.parse("22:00"), LocalTime.parse("23:00")
+            )
+        )
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = listOf(
+            createCachedKey("2222-12-30", "19:00"),
+            createCachedKey("2222-12-31", "23:00")
+        )
+
+        val missingHours = mapOf(
+            LocalDate.parse("2222-12-30") to listOf(LocalTime.parse("20:00")),
+            LocalDate.parse("2222-12-31") to listOf(LocalTime.parse("22:00"))
+        )
+
+        cd.getMissingHours(cachedHours) shouldBe missingHours
+        cd.toMissingHours(cachedHours) shouldBe cd.copy(hourData = missingHours)
+    }
+
+    @Test
+    fun `missing hours empty available hour data`() {
+        val availableHours: Map<LocalDate, List<LocalTime>> = emptyMap()
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = listOf(
+            createCachedKey("2222-12-30", "19:00"),
+            createCachedKey("2222-12-31", "23:00")
+        )
+
+        cd.getMissingHours(cachedHours) shouldBe emptyMap()
+        cd.toMissingHours(cachedHours) shouldBe null
+    }
+
+    @Test
+    fun `missing hours faulty hour map`() {
+        val availableHours = mapOf(
+            LocalDate.parse("2222-12-30") to emptyList<LocalTime>()
+        )
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = listOf(
+            createCachedKey("2222-12-30", "19:00"),
+            createCachedKey("2222-12-31", "23:00")
+        )
+
+        cd.getMissingHours(cachedHours) shouldBe emptyMap()
+        cd.toMissingHours(cachedHours) shouldBe null
+    }
+
+    @Test
+    fun `missing hours empty cache`() {
+        val availableHours = mapOf(
+            LocalDate.parse("2222-12-30") to listOf(
+                LocalTime.parse("19:00"), LocalTime.parse("20:00")
+            ),
+            LocalDate.parse("2222-12-31") to listOf(
+                LocalTime.parse("22:00"), LocalTime.parse("23:00")
+            )
+        )
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = emptyList<CachedKeyInfo>()
+
+        cd.getMissingHours(cachedHours) shouldBe availableHours
+        cd.toMissingHours(cachedHours) shouldBe cd.copy(hourData = availableHours)
+    }
+
+    @Test
+    fun `missing hours disjunct`() {
+        val availableHours = mapOf(
+            LocalDate.parse("2222-12-30") to listOf(
+                LocalTime.parse("19:00"), LocalTime.parse("20:00")
+            ),
+            LocalDate.parse("2222-12-31") to listOf(
+                LocalTime.parse("22:00"), LocalTime.parse("23:00")
+            )
+        )
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = listOf(
+            createCachedKey("2022-12-30", "19:00"),
+            createCachedKey("2022-12-31", "23:00")
+        )
+
+        cd.getMissingHours(cachedHours) shouldBe availableHours
+        cd.toMissingHours(cachedHours) shouldBe cd.copy(hourData = availableHours)
+    }
+
+    @Test
+    fun `missing hours none missing`() {
+        val availableHours = mapOf(
+            LocalDate.parse("2222-12-30") to listOf(
+                LocalTime.parse("19:00"), LocalTime.parse("20:00")
+            ),
+            LocalDate.parse("2222-12-31") to listOf(
+                LocalTime.parse("22:00"), LocalTime.parse("23:00")
+            )
+        )
+        val cd = CountryHours(locationCode, availableHours)
+
+        cd.hourData shouldBe availableHours
+
+        val cachedHours = listOf(
+            createCachedKey("2222-12-30", "19:00"),
+            createCachedKey("2222-12-30", "20:00"),
+            createCachedKey("2222-12-31", "22:00"),
+            createCachedKey("2222-12-31", "23:00")
+        )
+
+
+        cd.getMissingHours(cachedHours) shouldBe emptyMap()
+        cd.toMissingHours(cachedHours) shouldBe null
+    }
+
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloaderTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloaderTest.kt
new file mode 100644
index 00000000000..d9df9734b50
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/download/KeyFileDownloaderTest.kt
@@ -0,0 +1,684 @@
+package de.rki.coronawarnapp.diagnosiskeys.download
+
+import android.database.SQLException
+import de.rki.coronawarnapp.diagnosiskeys.server.DiagnosisKeyServer
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.diagnosiskeys.storage.CachedKeyInfo
+import de.rki.coronawarnapp.diagnosiskeys.storage.KeyCacheRepository
+import de.rki.coronawarnapp.diagnosiskeys.storage.legacy.LegacyKeyCacheMigration
+import de.rki.coronawarnapp.storage.AppSettings
+import de.rki.coronawarnapp.storage.DeviceStorage
+import de.rki.coronawarnapp.storage.InsufficientStorageException
+import de.rki.coronawarnapp.util.CWADebug
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.coEvery
+import io.mockk.coVerify
+import io.mockk.every
+import io.mockk.impl.annotations.MockK
+import io.mockk.mockk
+import io.mockk.mockkObject
+import kotlinx.coroutines.runBlocking
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import timber.log.Timber
+import java.io.File
+import java.io.IOException
+
+/**
+ * CachedKeyFileHolder test.
+ */
+class KeyFileDownloaderTest : BaseIOTest() {
+
+    @MockK
+    private lateinit var keyCache: KeyCacheRepository
+
+    @MockK
+    private lateinit var legacyMigration: LegacyKeyCacheMigration
+
+    @MockK
+    private lateinit var diagnosisKeyServer: DiagnosisKeyServer
+
+    @MockK
+    private lateinit var deviceStorage: DeviceStorage
+
+    @MockK
+    private lateinit var settings: AppSettings
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+    private val keyRepoData = mutableMapOf<String, CachedKeyInfo>()
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        testDir.mkdirs()
+        testDir.exists() shouldBe true
+
+        mockkObject(CWADebug)
+
+        coEvery { diagnosisKeyServer.getCountryIndex() } returns listOf(
+            LocationCode("DE"),
+            LocationCode("NL")
+        )
+        coEvery { deviceStorage.checkSpacePrivateStorage(any()) } returns mockk<DeviceStorage.CheckResult>().apply {
+            every { isSpaceAvailable } returns true
+        }
+
+        coEvery { settings.isLast3HourModeEnabled } returns false
+
+
+        coEvery { diagnosisKeyServer.getCountryIndex() } returns listOf(
+            LocationCode("DE"), LocationCode("NL")
+        )
+        coEvery { diagnosisKeyServer.getDayIndex(LocationCode("DE")) } returns listOf(
+            LocalDate.parse("2020-09-01"), LocalDate.parse("2020-09-02")
+        )
+        coEvery {
+            diagnosisKeyServer.getHourIndex(LocationCode("DE"), LocalDate.parse("2020-09-01"))
+        } returns listOf(
+            LocalTime.parse("18"), LocalTime.parse("19"), LocalTime.parse("20")
+        )
+        coEvery {
+            diagnosisKeyServer.getHourIndex(LocationCode("DE"), LocalDate.parse("2020-09-02"))
+        } returns listOf(
+            LocalTime.parse("20"), LocalTime.parse("21")
+        )
+        coEvery { diagnosisKeyServer.getDayIndex(LocationCode("NL")) } returns listOf(
+            LocalDate.parse("2020-09-02"), LocalDate.parse("2020-09-03")
+        )
+        coEvery {
+            diagnosisKeyServer.getHourIndex(LocationCode("NL"), LocalDate.parse("2020-09-02"))
+        } returns listOf(
+            LocalTime.parse("20"), LocalTime.parse("21"), LocalTime.parse("22")
+        )
+        coEvery {
+            diagnosisKeyServer.getHourIndex(LocationCode("NL"), LocalDate.parse("2020-09-03"))
+        } returns listOf(
+            LocalTime.parse("22"), LocalTime.parse("23")
+        )
+        coEvery { diagnosisKeyServer.downloadKeyFile(any(), any(), any(), any(), any()) } answers {
+            mockDownloadServerDownload(arg(0), arg(1), arg(2), arg(3), arg(4))
+        }
+
+        coEvery { keyCache.createCacheEntry(any(), any(), any(), any()) } answers {
+            mockKeyCacheCreateEntry(arg(0), arg(1), arg(2), arg(3))
+        }
+        coEvery { keyCache.markKeyComplete(any(), any()) } answers {
+            mockKeyCacheUpdateComplete(arg(0), arg(1))
+        }
+        coEvery { keyCache.getEntriesForType(any()) } answers {
+            val type = arg<CachedKeyInfo.Type>(0)
+            keyRepoData.values.filter { it.type == type }.map { it to File(testDir, it.id) }
+        }
+        coEvery { keyCache.getAllCachedKeys() } returns keyRepoData.values.map {
+            it to File(
+                testDir,
+                it.id
+            )
+        }
+        coEvery { keyCache.delete(any()) } answers {
+            val keyInfos = arg<List<CachedKeyInfo>>(0)
+            keyInfos.forEach {
+                keyRepoData.remove(it.id)
+            }
+        }
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        keyRepoData.clear()
+        testDir.deleteRecursively()
+    }
+
+    private fun mockKeyCacheCreateEntry(
+        type: CachedKeyInfo.Type,
+        location: LocationCode,
+        dayIdentifier: LocalDate,
+        hourIdentifier: LocalTime?
+    ): Pair<CachedKeyInfo, File> {
+        val keyInfo = CachedKeyInfo(
+            type = type,
+            location = location,
+            day = dayIdentifier,
+            hour = hourIdentifier,
+            createdAt = Instant.now()
+        )
+        Timber.i("mockKeyCacheCreateEntry(...): %s", keyInfo)
+        val file = File(testDir, keyInfo.id)
+        keyRepoData[keyInfo.id] = keyInfo
+        return keyInfo to file
+    }
+
+    private fun mockKeyCacheUpdateComplete(
+        keyInfo: CachedKeyInfo, checksum: String
+    ) {
+        keyRepoData[keyInfo.id] = keyInfo.copy(
+            isDownloadComplete = checksum != null, checksumMD5 = checksum
+        )
+    }
+
+    private fun mockDownloadServerDownload(
+        locationCode: LocationCode,
+        day: LocalDate,
+        hour: LocalTime? = null,
+        saveTo: File,
+        validator: DiagnosisKeyServer.HeaderHook = object :
+            DiagnosisKeyServer.HeaderHook {}
+    ) {
+        saveTo.writeText("$locationCode.$day.$hour")
+    }
+
+    private fun mockAddData(
+        type: CachedKeyInfo.Type,
+        location: LocationCode,
+        day: LocalDate,
+        hour: LocalTime?,
+        isCompleted: Boolean
+    ): Pair<CachedKeyInfo, File> {
+        val (keyInfo, file) = mockKeyCacheCreateEntry(type, location, day, hour)
+        if (isCompleted) {
+            mockDownloadServerDownload(location, day, hour, file)
+            mockKeyCacheUpdateComplete(keyInfo, "checksum")
+        }
+        return keyRepoData[keyInfo.id]!! to file
+    }
+
+    private fun createDownloader(): KeyFileDownloader {
+        val downloader = KeyFileDownloader(
+            deviceStorage = deviceStorage,
+            keyServer = diagnosisKeyServer,
+            keyCache = keyCache,
+            legacyKeyCache = legacyMigration,
+            settings = settings
+        )
+        Timber.i("createDownloader(): %s", downloader)
+        return downloader
+    }
+
+    @Test
+    fun `storage is checked before fetching`() {
+        val downloader = createDownloader()
+        runBlocking {
+            downloader.asyncFetchKeyFiles(emptyList()) shouldBe emptyList()
+        }
+    }
+
+    @Test
+    fun `fetching is aborted if not enough free storage`() {
+        coEvery { deviceStorage.checkSpacePrivateStorage(any()) } returns mockk<DeviceStorage.CheckResult>().apply {
+            every { isSpaceAvailable } returns false
+            every { freeBytes } returns 1337L
+            every { requiredBytes } returns 5000L
+        }
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            shouldThrow<InsufficientStorageException> {
+                downloader.asyncFetchKeyFiles(listOf(LocationCode("DE")))
+            }
+        }
+    }
+
+    @Test
+    fun `error during country index fetch`() {
+        coEvery { diagnosisKeyServer.getCountryIndex() } throws IOException()
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            shouldThrow<IOException> {
+                downloader.asyncFetchKeyFiles(listOf(LocationCode("DE")))
+            }
+        }
+    }
+
+    @Test
+    fun `day fetch without prior data`() {
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 4
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-01"),
+                hourIdentifier = null
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = null
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = null
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = null
+            )
+        }
+        keyRepoData.size shouldBe 4
+        keyRepoData.values.forEach { it.isDownloadComplete shouldBe true }
+    }
+
+    @Test
+    fun `day fetch with existing data`() {
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("DE"),
+            day = LocalDate.parse("2020-09-01"),
+            hour = null,
+            isCompleted = true
+        )
+
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-02"),
+            hour = null,
+            isCompleted = true
+        )
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 4
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = null
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = null
+            )
+        }
+
+        coVerify(exactly = 2) { keyCache.createCacheEntry(any(), any(), any(), any()) }
+        coVerify(exactly = 2) { keyCache.markKeyComplete(any(), any()) }
+    }
+
+    @Test
+    fun `day fetch deletes stale data`() {
+        coEvery { diagnosisKeyServer.getDayIndex(LocationCode("DE")) } returns listOf(
+            LocalDate.parse("2020-09-02")
+        )
+        val (staleKeyInfo, _) = mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("DE"),
+            day = LocalDate.parse("2020-09-01"),
+            hour = null,
+            isCompleted = true
+        )
+
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-02"),
+            hour = null,
+            isCompleted = true
+        )
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 3
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = null
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = null
+            )
+        }
+        coVerify(exactly = 1) { keyCache.delete(listOf(staleKeyInfo)) }
+        coVerify(exactly = 2) { keyCache.createCacheEntry(any(), any(), any(), any()) }
+        coVerify(exactly = 2) { keyCache.markKeyComplete(any(), any()) }
+    }
+
+    @Test
+    fun `day fetch skips single download failures`() {
+        var dlCounter = 0
+        coEvery { diagnosisKeyServer.downloadKeyFile(any(), any(), any(), any(), any()) } answers {
+            dlCounter++
+            if (dlCounter == 2) throw IOException("Timeout")
+            mockDownloadServerDownload(arg(0), arg(1), arg(2), arg(3), arg(4))
+        }
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 3
+        }
+
+        // We delete the entry for the failed download
+        coVerify(exactly = 1) { keyCache.delete(any()) }
+    }
+
+    @Test
+    fun `last3Hours fetch without prior data`() {
+        every { CWADebug.isDebugBuildOrMode } returns true
+        every { settings.isLast3HourModeEnabled } returns true
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 6
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("21")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("20")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-01"),
+                hourIdentifier = LocalTime.parse("20")
+            )
+
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("23")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("22")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("22")
+            )
+        }
+        coVerify(exactly = 6) { keyCache.markKeyComplete(any(), any()) }
+
+        keyRepoData.size shouldBe 6
+        keyRepoData.values.forEach { it.isDownloadComplete shouldBe true }
+    }
+
+    @Test
+    fun `last3Hours fetch with prior data`() {
+        every { CWADebug.isDebugBuildOrMode } returns true
+        every { settings.isLast3HourModeEnabled } returns true
+
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("DE"),
+            day = LocalDate.parse("2020-09-01"),
+            hour = LocalTime.parse("20"),
+            isCompleted = true
+        )
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-02"),
+            hour = LocalTime.parse("22"),
+            isCompleted = true
+        )
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 6
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("21")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("20")
+            )
+
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("23")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("22")
+            )
+        }
+        coVerify(exactly = 4) {
+            diagnosisKeyServer.downloadKeyFile(
+                any(),
+                any(),
+                any(),
+                any(),
+                any()
+            )
+        }
+    }
+
+    @Test
+    fun `last3Hours fetch deletes stale data`() {
+        every { CWADebug.isDebugBuildOrMode } returns true
+        every { settings.isLast3HourModeEnabled } returns true
+
+        val (staleKey1, _) = mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-02"),
+            hour = LocalTime.parse("12"), // Stale hour
+            isCompleted = true
+        )
+
+        val (staleKey2, _) = mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-01"), // Stale day
+            hour = LocalTime.parse("22"),
+            isCompleted = true
+        )
+
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("DE"),
+            day = LocalDate.parse("2020-09-01"),
+            hour = LocalTime.parse("20"),
+            isCompleted = true
+        )
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            location = LocationCode("NL"),
+            day = LocalDate.parse("2020-09-02"),
+            hour = LocalTime.parse("22"),
+            isCompleted = true
+        )
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 6
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("21")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-02"),
+                hourIdentifier = LocalTime.parse("20")
+            )
+
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("23")
+            )
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_HOUR,
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-03"),
+                hourIdentifier = LocalTime.parse("22")
+            )
+        }
+        coVerify(exactly = 4) {
+            diagnosisKeyServer.downloadKeyFile(
+                any(),
+                any(),
+                any(),
+                any(),
+                any()
+            )
+        }
+        coVerify(exactly = 1) { keyCache.delete(listOf(staleKey1, staleKey2)) }
+    }
+
+    @Test
+    fun `last3Hours fetch skips single download failures`() {
+        every { CWADebug.isDebugBuildOrMode } returns true
+        every { settings.isLast3HourModeEnabled } returns true
+
+        var dlCounter = 0
+        coEvery { diagnosisKeyServer.downloadKeyFile(any(), any(), any(), any(), any()) } answers {
+            dlCounter++
+            if (dlCounter == 2) throw IOException("Timeout")
+            mockDownloadServerDownload(arg(0), arg(1), arg(2), arg(3), arg(4))
+        }
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 5
+        }
+
+        // We delete the entry for the failed download
+        coVerify(exactly = 1) { keyCache.delete(any()) }
+    }
+
+    @Test
+    fun `not completed cache entries are overwritten`() {
+        mockAddData(
+            type = CachedKeyInfo.Type.COUNTRY_DAY,
+            location = LocationCode("DE"),
+            day = LocalDate.parse("2020-09-01"),
+            hour = null,
+            isCompleted = false
+        )
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 4
+        }
+
+        coVerify {
+            keyCache.createCacheEntry(
+                type = CachedKeyInfo.Type.COUNTRY_DAY,
+                location = LocationCode("DE"),
+                dayIdentifier = LocalDate.parse("2020-09-01"),
+                hourIdentifier = null
+            )
+        }
+    }
+
+    @Test
+    fun `database errors do not abort the whole process`() {
+        var completionCounter = 0
+        coEvery { keyCache.markKeyComplete(any(), any()) } answers {
+            completionCounter++
+            if (completionCounter == 2) throw SQLException(":)")
+            mockKeyCacheUpdateComplete(arg(0), arg(1))
+        }
+
+        val downloader = createDownloader()
+
+        runBlocking {
+            downloader.asyncFetchKeyFiles(
+                listOf(LocationCode("DE"), LocationCode("NL"))
+            ).size shouldBe 3
+        }
+
+        coVerify(exactly = 4) {
+            diagnosisKeyServer.downloadKeyFile(
+                any(),
+                any(),
+                any(),
+                any(),
+                any()
+            )
+        }
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiTest.kt
new file mode 100644
index 00000000000..4db01f22b51
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigApiTest.kt
@@ -0,0 +1,157 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import android.content.Context
+import de.rki.coronawarnapp.diagnosiskeys.DiagnosisKeysModule
+import de.rki.coronawarnapp.http.HttpModule
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.every
+import io.mockk.impl.annotations.MockK
+import kotlinx.coroutines.runBlocking
+import okhttp3.ConnectionSpec
+import okhttp3.mockwebserver.MockResponse
+import okhttp3.mockwebserver.MockWebServer
+import okhttp3.mockwebserver.SocketPolicy
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.io.File
+import java.util.concurrent.TimeUnit
+
+class AppConfigApiTest : BaseIOTest() {
+
+    @MockK
+    private lateinit var context: Context
+
+    private lateinit var webServer: MockWebServer
+    private lateinit var serverAddress: String
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.java.simpleName)
+    private val appConfigCacheDir = File(testDir, "http_app-config")
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        every { context.cacheDir } returns testDir
+
+        webServer = MockWebServer()
+        webServer.start()
+        serverAddress = "http://${webServer.hostName}:${webServer.port}"
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        webServer.shutdown()
+        testDir.deleteRecursively()
+    }
+
+    private fun createAPI(): AppConfigApiV1 {
+        val httpModule = HttpModule()
+        val defaultHttpClient = httpModule.defaultHttpClient()
+        val gsonConverterFactory = httpModule.provideGSONConverter()
+
+        return DiagnosisKeysModule().let {
+            val downloadHttpClient = it.cdnHttpClient(defaultHttpClient)
+                .newBuilder()
+                .connectionSpecs(listOf(ConnectionSpec.CLEARTEXT, ConnectionSpec.MODERN_TLS))
+                .build()
+            it.provideAppConfigApi(
+                context = context,
+                client = downloadHttpClient,
+                url = serverAddress,
+                gsonConverterFactory = gsonConverterFactory
+            )
+        }
+    }
+
+    @Test
+    fun `application config download`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("~appconfig"))
+
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/configuration/country/DE/app_config"
+    }
+
+    @Test
+    fun `application config download uses cache`() {
+        appConfigCacheDir.exists() shouldBe false
+
+        val api = createAPI()
+
+        val configResponse =
+            MockResponse().setBody("~appconfig").addHeader("Cache-Control: max-age=2")
+
+        webServer.enqueue(configResponse)
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+        appConfigCacheDir.exists() shouldBe true
+        appConfigCacheDir.listFiles()!!.size shouldBe 3
+
+        webServer.takeRequest(5, TimeUnit.SECONDS)!!.apply {
+            method shouldBe "GET"
+            path shouldBe "/version/v1/configuration/country/DE/app_config"
+        }
+
+        webServer.enqueue(configResponse)
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+        appConfigCacheDir.exists() shouldBe true
+        appConfigCacheDir.listFiles()!!.size shouldBe 3
+
+        webServer.takeRequest(2, TimeUnit.SECONDS) shouldBe null
+
+        Thread.sleep(4000) // Let the cache expire
+
+        webServer.enqueue(configResponse)
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+        appConfigCacheDir.exists() shouldBe true
+        appConfigCacheDir.listFiles()!!.size shouldBe 3
+
+        webServer.takeRequest(5, TimeUnit.SECONDS)!!.apply {
+            method shouldBe "GET"
+            path shouldBe "/version/v1/configuration/country/DE/app_config"
+        }
+    }
+
+    @Test
+    fun `cache is used when connection is flaky`() {
+        appConfigCacheDir.exists() shouldBe false
+
+        val api = createAPI()
+
+        val configResponse =
+            MockResponse().setBody("~appconfig").addHeader("Cache-Control: max-age=300")
+
+        webServer.enqueue(configResponse)
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+        appConfigCacheDir.exists() shouldBe true
+        appConfigCacheDir.listFiles()!!.size shouldBe 3
+
+        webServer.takeRequest(5, TimeUnit.SECONDS)!!.apply {
+            method shouldBe "GET"
+            path shouldBe "/version/v1/configuration/country/DE/app_config"
+        }
+
+        webServer.enqueue(MockResponse().setSocketPolicy(SocketPolicy.DISCONNECT_DURING_REQUEST_BODY))
+
+        runBlocking {
+            api.getApplicationConfiguration("DE").string() shouldBe "~appconfig"
+        }
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServerTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServerTest.kt
new file mode 100644
index 00000000000..0fbd9e4c8f8
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/AppConfigServerTest.kt
@@ -0,0 +1,131 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import dagger.Lazy
+import de.rki.coronawarnapp.exception.ApplicationConfigurationCorruptException
+import de.rki.coronawarnapp.exception.ApplicationConfigurationInvalidException
+import de.rki.coronawarnapp.util.security.VerificationKeys
+import io.kotest.assertions.throwables.shouldThrow
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.coEvery
+import io.mockk.every
+import io.mockk.impl.annotations.MockK
+import io.mockk.verify
+import kotlinx.coroutines.runBlocking
+import okhttp3.ResponseBody.Companion.toResponseBody
+import okio.ByteString.Companion.decodeHex
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.io.File
+
+class AppConfigServerTest : BaseIOTest() {
+
+    @MockK
+    lateinit var api: AppConfigApiV1
+
+    @MockK
+    lateinit var verificationKeys: VerificationKeys
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+
+    private val defaultHomeCountry = LocationCode("DE")
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        testDir.mkdirs()
+        testDir.exists() shouldBe true
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        testDir.deleteRecursively()
+    }
+
+    private fun createDownloadServer(
+        homeCountry: LocationCode = defaultHomeCountry
+    ) = AppConfigServer(
+        appConfigAPI = Lazy { api },
+        verificationKeys = verificationKeys,
+        homeCountry = homeCountry
+    )
+
+    @Test
+    fun `application config download`() {
+        coEvery { api.getApplicationConfiguration("DE") } returns APPCONFIG_HEX.decodeHex()
+            .toResponseBody()
+
+        every { verificationKeys.hasInvalidSignature(any(), any()) } returns false
+
+        val downloadServer = createDownloadServer()
+
+        runBlocking {
+            val config = downloadServer.downloadAppConfig()
+            config.apply {
+                // We just care here that it's non default values, i.e. conversion worked
+                minRiskScore shouldBe 11
+                appVersion.android.latest.major shouldBe 1
+                appVersion.android.latest.minor shouldBe 0
+                appVersion.android.latest.patch shouldBe 4
+
+            }
+        }
+
+        verify(exactly = 1) { verificationKeys.hasInvalidSignature(any(), any()) }
+    }
+
+    @Test
+    fun `application config data is faulty`() {
+        coEvery { api.getApplicationConfiguration("DE") } returns "123ABC".decodeHex()
+            .toResponseBody()
+
+        every { verificationKeys.hasInvalidSignature(any(), any()) } returns false
+
+        val downloadServer = createDownloadServer()
+
+        runBlocking {
+            shouldThrow<ApplicationConfigurationInvalidException> {
+                downloadServer.downloadAppConfig()
+            }
+        }
+    }
+
+    @Test
+    fun `application config verification fails`() {
+        coEvery { api.getApplicationConfiguration("DE") } returns APPCONFIG_HEX.decodeHex()
+            .toResponseBody()
+
+        every { verificationKeys.hasInvalidSignature(any(), any()) } returns true
+
+        val downloadServer = createDownloadServer()
+
+        runBlocking {
+            shouldThrow<ApplicationConfigurationCorruptException> {
+                downloadServer.downloadAppConfig()
+            }
+        }
+    }
+
+    companion object {
+        private const val APPCONFIG_HEX =
+            "504b0304140008080800856b22510000000000000000000000000a0000006578706f72742e62696ee3e016" +
+                    "f2e552e662f6f10f97e05792ca28292928b6d2d72f2f2fd74bce2fcacf4b2c4f2ccad34b2c28e0" +
+                    "52e362f1f074f710e097f0c0a74e2a854b80835180498259814583d580cd82dd814390010c3c1d" +
+                    "a4b8141835180d182d181d181561825a021cac02ac12ac0aac40f5ac16ac0eac86102913072b3e" +
+                    "01460946841e47981e25192e160e73017b21214e88d0077ba8250fec1524b5a4b8b8b858043824" +
+                    "98849804588578806a19255884c02400504b0708df2c788daf000000f1000000504b0304140008" +
+                    "080800856b22510000000000000000000000000a0000006578706f72742e736967018a0075ff0a" +
+                    "87010a380a1864652e726b692e636f726f6e617761726e6170702d6465761a0276312203323632" +
+                    "2a13312e322e3834302e31303034352e342e332e321001180122473045022100cf32ff24ea18a1" +
+                    "ffcc7ff4c9fe8d1808cecbc5a37e3e1d4c9ce682120450958c022064bf124b6973a9b510a43d47" +
+                    "9ff93e0ef97a5b893c7af4abc4a8d399969cd8a0504b070813c517c68f0000008a000000504b01" +
+                    "021400140008080800856b2251df2c788daf000000f10000000a00000000000000000000000000" +
+                    "000000006578706f72742e62696e504b01021400140008080800856b225113c517c68f0000008a" +
+                    "0000000a00000000000000000000000000e70000006578706f72742e736967504b050600000000" +
+                    "0200020070000000ae0100000000"
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiTest.kt
new file mode 100644
index 00000000000..2c6c522ed40
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyApiTest.kt
@@ -0,0 +1,127 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import de.rki.coronawarnapp.diagnosiskeys.DiagnosisKeysModule
+import de.rki.coronawarnapp.http.HttpModule
+import io.kotest.matchers.shouldBe
+import kotlinx.coroutines.runBlocking
+import okhttp3.ConnectionSpec
+import okhttp3.mockwebserver.MockResponse
+import okhttp3.mockwebserver.MockWebServer
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.util.concurrent.TimeUnit
+
+class DiagnosisKeyApiTest : BaseIOTest() {
+
+    lateinit var webServer: MockWebServer
+    lateinit var serverAddress: String
+
+    @BeforeEach
+    fun setup() {
+        webServer = MockWebServer()
+        webServer.start()
+        serverAddress = "http://${webServer.hostName}:${webServer.port}"
+    }
+
+    @AfterEach
+    fun teardown() {
+        webServer.shutdown()
+    }
+
+    private fun createAPI(): DiagnosisKeyApiV1 {
+        val httpModule = HttpModule()
+        val defaultHttpClient = httpModule.defaultHttpClient()
+        val gsonConverterFactory = httpModule.provideGSONConverter()
+
+        return DiagnosisKeysModule().let {
+            val downloadHttpClient = it.cdnHttpClient(defaultHttpClient)
+                .newBuilder()
+                .connectionSpecs(listOf(ConnectionSpec.CLEARTEXT, ConnectionSpec.MODERN_TLS))
+                .build()
+            it.provideDiagnosisKeyApi(
+                client = downloadHttpClient,
+                url = serverAddress,
+                gsonConverterFactory = gsonConverterFactory
+            )
+        }
+    }
+
+    @Test
+    fun `download country index`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("[\"DE\",\"NL\"]"))
+
+        runBlocking {
+            api.getCountryIndex() shouldBe listOf("DE", "NL")
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/diagnosis-keys/country"
+    }
+
+    @Test
+    fun `download day index for country`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("[\"2020-08-19\",\"2020-08-20\"]"))
+
+        runBlocking {
+            api.getDayIndex("DE") shouldBe listOf("2020-08-19", "2020-08-20")
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/diagnosis-keys/country/DE/date"
+    }
+
+    @Test
+    fun `download hour index for country and day`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("[22,23]"))
+
+        runBlocking {
+            api.getHourIndex("DE", "2020-08-19") shouldBe listOf("22", "23")
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/diagnosis-keys/country/DE/date/2020-08-19/hour"
+    }
+
+    @Test
+    fun `download key files for day`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("~daykeyfile"))
+
+        runBlocking {
+            api.downloadKeyFileForDay("DE", "2020-09-09").body()!!.string() shouldBe "~daykeyfile"
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/diagnosis-keys/country/DE/date/2020-09-09"
+    }
+
+    @Test
+    fun `download key files for hour`() {
+        val api = createAPI()
+
+        webServer.enqueue(MockResponse().setBody("~hourkeyfile"))
+
+        runBlocking {
+            api.downloadKeyFileForHour("DE", "2020-09-09", "23").body()!!
+                .string() shouldBe "~hourkeyfile"
+        }
+
+        val request = webServer.takeRequest(5, TimeUnit.SECONDS)!!
+        request.method shouldBe "GET"
+        request.path shouldBe "/version/v1/diagnosis-keys/country/DE/date/2020-09-09/hour/23"
+    }
+
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServerTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServerTest.kt
new file mode 100644
index 00000000000..16edc6a932c
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/server/DiagnosisKeyServerTest.kt
@@ -0,0 +1,150 @@
+package de.rki.coronawarnapp.diagnosiskeys.server
+
+import dagger.Lazy
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.coEvery
+import io.mockk.coVerify
+import io.mockk.impl.annotations.MockK
+import kotlinx.coroutines.runBlocking
+import okhttp3.ResponseBody.Companion.toResponseBody
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import retrofit2.Response
+import testhelpers.BaseIOTest
+import java.io.File
+
+class DiagnosisKeyServerTest : BaseIOTest() {
+
+    @MockK
+    lateinit var api: DiagnosisKeyApiV1
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+
+    private val defaultHomeCountry = LocationCode("DE")
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        testDir.mkdirs()
+        testDir.exists() shouldBe true
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        testDir.deleteRecursively()
+    }
+
+    private fun createDownloadServer(
+        homeCountry: LocationCode = defaultHomeCountry
+    ) = DiagnosisKeyServer(
+        diagnosisKeyAPI = Lazy { api },
+        homeCountry = homeCountry
+    )
+
+    @Test
+    fun `download country index`() {
+        val downloadServer = createDownloadServer()
+        coEvery { api.getCountryIndex() } returns listOf("DE", "NL")
+
+        runBlocking {
+            downloadServer.getCountryIndex() shouldBe listOf(
+                LocationCode("DE"), LocationCode("NL")
+            )
+        }
+
+        coVerify { api.getCountryIndex() }
+    }
+
+    @Test
+    fun `download day index for country`() {
+        val downloadServer = createDownloadServer()
+        coEvery { api.getDayIndex("DE") } returns listOf(
+            "2000-01-01", "2000-01-02"
+        )
+
+        runBlocking {
+            downloadServer.getDayIndex(LocationCode("DE")) shouldBe listOf(
+                "2000-01-01", "2000-01-02"
+            ).map { LocalDate.parse(it) }
+        }
+
+        coVerify { api.getDayIndex("DE") }
+    }
+
+    @Test
+    fun `download hour index for country and day`() {
+        val downloadServer = createDownloadServer()
+        coEvery { api.getHourIndex("DE", "2000-01-01") } returns listOf(
+            "20", "21"
+        )
+
+        runBlocking {
+            downloadServer.getHourIndex(
+                LocationCode("DE"),
+                LocalDate.parse("2000-01-01")
+            ) shouldBe listOf(
+                "20:00", "21:00"
+            ).map { LocalTime.parse(it) }
+        }
+
+        coVerify { api.getHourIndex("DE", "2000-01-01") }
+    }
+
+
+    @Test
+    fun `download key files for day`() {
+        val downloadServer = createDownloadServer()
+        coEvery {
+            api.downloadKeyFileForDay(
+                "DE",
+                "2000-01-01"
+            )
+        } returns Response.success("testdata-day".toResponseBody())
+
+        val targetFile = File(testDir, "day-keys")
+
+        runBlocking {
+            downloadServer.downloadKeyFile(
+                locationCode = LocationCode("DE"),
+                day = LocalDate.parse("2000-01-01"),
+                hour = null,
+                saveTo = targetFile
+            )
+        }
+
+        targetFile.exists() shouldBe true
+        targetFile.readText() shouldBe "testdata-day"
+    }
+
+    @Test
+    fun `download key files for hour`() {
+        val downloadServer = createDownloadServer()
+        coEvery {
+            api.downloadKeyFileForHour(
+                "DE",
+                "2000-01-01",
+                "01"
+            )
+        } returns Response.success("testdata-hour".toResponseBody())
+
+        val targetFile = File(testDir, "hour-keys")
+
+        runBlocking {
+            downloadServer.downloadKeyFile(
+                locationCode = LocationCode("DE"),
+                day = LocalDate.parse("2000-01-01"),
+                hour = LocalTime.parse("01:00"),
+                saveTo = targetFile
+            )
+        }
+
+        targetFile.exists() shouldBe true
+        targetFile.readText() shouldBe "testdata-hour"
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyFileTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyFileTest.kt
new file mode 100644
index 00000000000..cf1d1ebe08d
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/CachedKeyFileTest.kt
@@ -0,0 +1,62 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import io.kotest.matchers.shouldBe
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.Test
+import testhelpers.BaseTest
+
+class CachedKeyFileTest : BaseTest() {
+    private val type = CachedKeyInfo.Type.COUNTRY_DAY
+    private val location = LocationCode("DE")
+    private val day = LocalDate.parse("2222-12-31")
+    private val hour = LocalTime.parse("23:59")
+    private val now = Instant.EPOCH
+
+    @Test
+    fun `secondary constructor`() {
+        val key = CachedKeyInfo(type, location, day, hour, now)
+
+        key.id shouldBe CachedKeyInfo.calcluateId(location, day, hour, type)
+        key.checksumMD5 shouldBe null
+        key.isDownloadComplete shouldBe false
+    }
+
+    @Test
+    fun `keyfile id calculation`() {
+        val calculatedId1 = CachedKeyInfo.calcluateId(location, day, hour, type)
+        val calculatedId2 = CachedKeyInfo.calcluateId(location, day, hour, type)
+        calculatedId1 shouldBe calculatedId2
+
+        calculatedId1 shouldBe "550b64773e052b9ddf232998a92846833ed3f907"
+    }
+
+    @Test
+    fun `to completion`() {
+        val key = CachedKeyInfo(type, location, day, hour, now)
+        val testChecksum = "testchecksum"
+        val downloadCompleteUpdate = key.toDownloadUpdate(testChecksum)
+
+        downloadCompleteUpdate shouldBe CachedKeyInfo.DownloadUpdate(
+            id = downloadCompleteUpdate.id,
+            isDownloadComplete = true,
+            checksumMD5 = testChecksum
+        )
+
+        val resetDownloadUpdate = key.toDownloadUpdate(null)
+
+        resetDownloadUpdate shouldBe CachedKeyInfo.DownloadUpdate(
+            id = downloadCompleteUpdate.id,
+            isDownloadComplete = false,
+            checksumMD5 = null
+        )
+    }
+
+    @Test
+    fun `trip changed typing`() {
+        CachedKeyInfo.Type.COUNTRY_DAY.typeValue shouldBe "country_day"
+        CachedKeyInfo.Type.COUNTRY_HOUR.typeValue shouldBe "country_hour"
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepositoryTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepositoryTest.kt
new file mode 100644
index 00000000000..a45a79487ab
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/KeyCacheRepositoryTest.kt
@@ -0,0 +1,207 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage
+
+import android.content.Context
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import de.rki.coronawarnapp.util.TimeStamper
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.coEvery
+import io.mockk.coVerify
+import io.mockk.every
+import io.mockk.impl.annotations.MockK
+import kotlinx.coroutines.runBlocking
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.io.File
+
+class KeyCacheRepositoryTest : BaseIOTest() {
+    @MockK
+    lateinit var context: Context
+
+    @MockK
+    lateinit var timeStamper: TimeStamper
+
+    @MockK
+    lateinit var databaseFactory: KeyCacheDatabase.Factory
+
+    @MockK
+    lateinit var database: KeyCacheDatabase
+
+    @MockK
+    lateinit var keyfileDAO: KeyCacheDatabase.CachedKeyFileDao
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        testDir.mkdirs()
+        testDir.exists() shouldBe true
+
+        every { timeStamper.nowUTC } returns Instant.EPOCH
+        every { context.cacheDir } returns File(testDir, "cache")
+
+        every { databaseFactory.create() } returns database
+        every { database.cachedKeyFiles() } returns keyfileDAO
+
+        coEvery { keyfileDAO.getAllEntries() } returns emptyList()
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        testDir.deleteRecursively()
+    }
+
+    private fun createRepo(): KeyCacheRepository = KeyCacheRepository(
+        context = context,
+        databaseFactory = databaseFactory,
+        timeStamper = timeStamper
+    )
+
+    @Test
+    fun `housekeeping runs before data access`() {
+        val lostKey = CachedKeyInfo(
+            location = LocationCode("DE"),
+            day = LocalDate.now(),
+            hour = LocalTime.now(),
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            createdAt = Instant.now()
+        ).copy(
+            isDownloadComplete = true,
+            checksumMD5 = "checksum"
+        )
+
+        val existingKey = CachedKeyInfo(
+            location = LocationCode("NL"),
+            day = LocalDate.now(),
+            hour = LocalTime.now(),
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            createdAt = Instant.now()
+        )
+
+        File(testDir, "diagnosis_keys/${existingKey.id}.zip").apply {
+            parentFile!!.mkdirs()
+            createNewFile()
+        }
+
+        coEvery { keyfileDAO.getAllEntries() } returns listOf(lostKey, existingKey)
+        coEvery { keyfileDAO.updateDownloadState(any()) } returns Unit
+        coEvery { keyfileDAO.deleteEntry(lostKey) } returns Unit
+
+        val repo = createRepo()
+
+        coVerify(exactly = 0) { keyfileDAO.updateDownloadState(any()) }
+
+        runBlocking {
+            repo.getAllCachedKeys()
+            coVerify(exactly = 2) { keyfileDAO.getAllEntries() }
+            coVerify { keyfileDAO.deleteEntry(lostKey) }
+        }
+    }
+
+    @Test
+    fun `insert and retrieve`() {
+        val repo = createRepo()
+
+        coEvery { keyfileDAO.insertEntry(any()) } returns Unit
+
+        runBlocking {
+            val (keyFile, path) = repo.createCacheEntry(
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-09"),
+                hourIdentifier = LocalTime.parse("23:00"),
+                type = CachedKeyInfo.Type.COUNTRY_HOUR
+            )
+
+            path shouldBe File(context.cacheDir, "diagnosis_keys/${keyFile.id}.zip")
+
+            coVerify { keyfileDAO.insertEntry(keyFile) }
+        }
+    }
+
+    @Test
+    fun `update download state`() {
+        val repo = createRepo()
+
+        coEvery { keyfileDAO.insertEntry(any()) } returns Unit
+        coEvery { keyfileDAO.updateDownloadState(any()) } returns Unit
+
+        runBlocking {
+            val (keyFile, _) = repo.createCacheEntry(
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-09"),
+                hourIdentifier = LocalTime.parse("23:00"),
+                type = CachedKeyInfo.Type.COUNTRY_HOUR
+            )
+
+            repo.markKeyComplete(keyFile, "checksum")
+
+            coVerify {
+                keyfileDAO.insertEntry(keyFile)
+                keyfileDAO.updateDownloadState(keyFile.toDownloadUpdate("checksum"))
+            }
+        }
+    }
+
+    @Test
+    fun `delete only selected entries`() {
+        val repo = createRepo()
+
+        coEvery { keyfileDAO.insertEntry(any()) } returns Unit
+        coEvery { keyfileDAO.deleteEntry(any()) } returns Unit
+
+        runBlocking {
+            val (keyFile, path) = repo.createCacheEntry(
+                location = LocationCode("NL"),
+                dayIdentifier = LocalDate.parse("2020-09-09"),
+                hourIdentifier = LocalTime.parse("23:00"),
+                type = CachedKeyInfo.Type.COUNTRY_HOUR
+            )
+
+            path.createNewFile() shouldBe true
+            path.exists() shouldBe true
+
+            repo.delete(listOf(keyFile))
+
+            coVerify { keyfileDAO.deleteEntry(keyFile) }
+
+            path.exists() shouldBe false
+        }
+    }
+
+    @Test
+    fun `clear all files`() {
+        val repo = createRepo()
+
+        val keyFileToClear = CachedKeyInfo(
+            location = LocationCode("DE"),
+            day = LocalDate.now(),
+            hour = LocalTime.now(),
+            type = CachedKeyInfo.Type.COUNTRY_HOUR,
+            createdAt = Instant.now()
+        )
+
+        coEvery { keyfileDAO.getAllEntries() } returns listOf(keyFileToClear)
+        coEvery { keyfileDAO.deleteEntry(any()) } returns Unit
+
+        val keyFilePath = repo.getPathForKey(keyFileToClear)
+        keyFilePath.createNewFile() shouldBe true
+        keyFilePath.exists() shouldBe true
+
+        runBlocking {
+            repo.clear()
+
+            coVerify { keyfileDAO.deleteEntry(keyFileToClear) }
+
+            keyFilePath.exists() shouldBe false
+        }
+    }
+
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheEntityTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheEntityTest.kt
new file mode 100644
index 00000000000..311923c1019
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/KeyCacheEntityTest.kt
@@ -0,0 +1,5 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage.legacy
+
+import testhelpers.BaseTest
+
+class KeyCacheEntityTest : BaseTest()
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigrationTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigrationTest.kt
new file mode 100644
index 00000000000..e1a33d27180
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/diagnosiskeys/storage/legacy/LegacyKeyCacheMigrationTest.kt
@@ -0,0 +1,215 @@
+package de.rki.coronawarnapp.diagnosiskeys.storage.legacy
+
+import android.content.Context
+import android.database.SQLException
+import dagger.Lazy
+import de.rki.coronawarnapp.util.HashExtensions.hashToMD5
+import de.rki.coronawarnapp.util.TimeStamper
+import io.kotest.matchers.shouldBe
+import io.mockk.MockKAnnotations
+import io.mockk.clearAllMocks
+import io.mockk.coEvery
+import io.mockk.coVerify
+import io.mockk.every
+import io.mockk.impl.annotations.MockK
+import io.mockk.mockk
+import kotlinx.coroutines.runBlocking
+import org.joda.time.Duration
+import org.joda.time.Instant
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.io.File
+import java.io.IOException
+
+class LegacyKeyCacheMigrationTest : BaseIOTest() {
+
+    @MockK
+    lateinit var context: Context
+
+    @MockK
+    lateinit var timeStamper: TimeStamper
+
+    @MockK
+    lateinit var legacyDao: KeyCacheLegacyDao
+
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+    private val legacyDir = File(testDir, "key-export")
+
+    @BeforeEach
+    fun setup() {
+        MockKAnnotations.init(this)
+        testDir.mkdirs()
+        testDir.exists() shouldBe true
+
+        every { context.cacheDir } returns testDir
+        every { timeStamper.nowUTC } returns Instant.EPOCH
+
+        coEvery { legacyDao.clear() } returns Unit
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+        testDir.deleteRecursively()
+    }
+
+    private fun createTool() = LegacyKeyCacheMigration(
+        context = context,
+        legacyDao = Lazy { legacyDao },
+        timeStamper = timeStamper
+    )
+
+    @Test
+    fun `nothing happens on null checksum`() {
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(null, File(testDir, "something"))
+        }
+
+        coVerify(exactly = 0) { legacyDao.clear() }
+    }
+
+    @Test
+    fun `migrate a file successfully`() {
+        val legacyFile1 = File(legacyDir, "1234.zip")
+        legacyFile1.parentFile!!.mkdirs()
+        legacyFile1.writeText("testdata")
+        legacyFile1.exists() shouldBe true
+
+        val legacyFile1MD5 = legacyFile1.hashToMD5()
+        legacyFile1MD5.isNotEmpty() shouldBe true
+
+        val migrationTarget = File(testDir, "migratedkey.zip")
+
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(legacyFile1MD5, migrationTarget)
+        }
+
+        legacyFile1.exists() shouldBe false
+        migrationTarget.exists() shouldBe true
+        migrationTarget.hashToMD5() shouldBe legacyFile1MD5
+
+        coVerify(exactly = 1) { legacyDao.clear() }
+    }
+
+    @Test
+    fun `migrating a single file fails gracefully`() {
+        val legacyFile1 = File(legacyDir, "1234.zip")
+        legacyFile1.parentFile!!.mkdirs()
+        legacyFile1.writeText("testdata")
+        legacyFile1.exists() shouldBe true
+
+        val legacyFile1MD5 = legacyFile1.hashToMD5()
+        legacyFile1MD5.isNotEmpty() shouldBe true
+
+        val migrationTarget = mockk<File>()
+        every { migrationTarget.path } throws IOException()
+
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(legacyFile1MD5, migrationTarget)
+        }
+
+        legacyFile1.exists() shouldBe false
+
+        coVerify(exactly = 1) { legacyDao.clear() }
+    }
+
+    @Test
+    fun `legacy app database can crash, we don't care`() {
+        val legacyFile1 = File(legacyDir, "1234.zip")
+        legacyFile1.parentFile!!.mkdirs()
+        legacyFile1.writeText("testdata")
+        legacyFile1.exists() shouldBe true
+
+        val legacyFile1MD5 = legacyFile1.hashToMD5()
+        legacyFile1MD5.isNotEmpty() shouldBe true
+
+        val migrationTarget = File(testDir, "migratedkey.zip")
+
+        coEvery { legacyDao.clear() } throws SQLException()
+
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(legacyFile1MD5, migrationTarget)
+        }
+
+        legacyFile1.exists() shouldBe false
+        migrationTarget.exists() shouldBe true
+        migrationTarget.hashToMD5() shouldBe legacyFile1MD5
+
+        coVerify(exactly = 1) { legacyDao.clear() }
+    }
+
+    @Test
+    fun `init failure causes legacy cache to be cleared`() {
+        val legacyFile1 = File(legacyDir, "1234.zip")
+        legacyFile1.parentFile!!.mkdirs()
+        legacyFile1.writeText("testdata")
+
+        val legacyFile1MD5 = legacyFile1.hashToMD5()
+        legacyFile1MD5.isNotEmpty() shouldBe true
+
+        legacyFile1.setReadable(false)
+
+        val migrationTarget = File(testDir, "migratedkey.zip")
+
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(legacyFile1MD5, migrationTarget)
+        }
+
+        legacyFile1.exists() shouldBe false
+        migrationTarget.exists() shouldBe false
+    }
+
+    @Test
+    fun `stale legacy files (older than 15 days) are cleaned up on init`() {
+        val legacyFile1 = File(legacyDir, "1234.zip")
+        legacyFile1.parentFile!!.mkdirs()
+        legacyFile1.writeText("testdata")
+
+        val legacyFile1MD5 = legacyFile1.hashToMD5()
+        legacyFile1MD5.isNotEmpty() shouldBe true
+
+        every { timeStamper.nowUTC } returns Instant.ofEpochMilli(legacyFile1.lastModified())
+            .plus(Duration.standardDays(16))
+
+        val migrationTarget = File(testDir, "migratedkey.zip")
+
+        coEvery { legacyDao.clear() } throws SQLException()
+
+        val tool = createTool()
+        runBlocking {
+            tool.tryMigration(legacyFile1MD5, migrationTarget)
+        }
+
+        legacyFile1.exists() shouldBe false
+        migrationTarget.exists() shouldBe false
+    }
+
+    @Test
+    fun `init deletes empty cache dir`() {
+        legacyDir.mkdirs()
+        legacyDir.exists() shouldBe true
+
+        runBlocking {
+            val tool = createTool()
+            tool.tryMigration("doesntmatter", File(testDir, "1"))
+        }
+        legacyDir.exists() shouldBe false
+        legacyDir.parentFile!!.exists() shouldBe true
+
+        runBlocking {
+            val tool = createTool()
+            tool.tryMigration("doesntmatter", File(testDir, "1"))
+        }
+        legacyDir.exists() shouldBe false
+        legacyDir.parentFile!!.exists() shouldBe true
+
+        coVerify(exactly = 1) { legacyDao.clear() }
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/http/WebRequestBuilderTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/http/WebRequestBuilderTest.kt
index 0f63f670412..cb1bb4a51e2 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/http/WebRequestBuilderTest.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/http/WebRequestBuilderTest.kt
@@ -1,30 +1,18 @@
 package de.rki.coronawarnapp.http
 
-import de.rki.coronawarnapp.http.service.DistributionService
 import de.rki.coronawarnapp.http.service.SubmissionService
 import de.rki.coronawarnapp.http.service.VerificationService
-import de.rki.coronawarnapp.service.diagnosiskey.DiagnosisKeyConstants
-import de.rki.coronawarnapp.util.TimeAndDateExtensions.toServerFormat
 import de.rki.coronawarnapp.util.security.VerificationKeys
 import io.mockk.MockKAnnotations
-import io.mockk.coEvery
-import io.mockk.coVerify
 import io.mockk.impl.annotations.MockK
 import io.mockk.unmockkAll
-import kotlinx.coroutines.runBlocking
 import org.junit.After
-import org.junit.Assert
 import org.junit.Before
-import org.junit.Test
-import java.util.Date
 
 class WebRequestBuilderTest {
     @MockK
     private lateinit var verificationService: VerificationService
 
-    @MockK
-    private lateinit var distributionService: DistributionService
-
     @MockK
     private lateinit var submissionService: SubmissionService
 
@@ -37,46 +25,11 @@ class WebRequestBuilderTest {
     fun setUp() = run {
         MockKAnnotations.init(this)
         webRequestBuilder = WebRequestBuilder(
-            distributionService,
             verificationService,
-            submissionService,
-            verificationKeys
+            submissionService
         )
     }
 
     @After
     fun tearDown() = unmockkAll()
-
-    @Test
-    fun retrievingDateIndexIsSuccessful() {
-        val urlString = DiagnosisKeyConstants.AVAILABLE_DATES_URL
-        coEvery { distributionService.getDateIndex(urlString) }
-            .returns(listOf("1900-01-01", "2000-01-01"))
-
-        runBlocking {
-            val expectedResult = listOf("1900-01-01", "2000-01-01")
-            Assert.assertEquals(webRequestBuilder.asyncGetDateIndex("DE"), expectedResult)
-            coVerify {
-                distributionService.getDateIndex(urlString)
-            }
-        }
-    }
-
-    @Test
-    fun asyncGetHourIndex() {
-        val day = Date()
-        val urlString = DiagnosisKeyConstants.AVAILABLE_DATES_URL +
-                "/${day.toServerFormat()}/${DiagnosisKeyConstants.HOUR}"
-
-        coEvery { distributionService.getHourIndex(urlString) }
-            .returns(listOf("1", "2"))
-
-        runBlocking {
-            val expectedResult = listOf("1", "2")
-            Assert.assertEquals(webRequestBuilder.asyncGetHourIndex(day), expectedResult)
-            coVerify {
-                distributionService.getHourIndex(urlString)
-            }
-        }
-    }
 }
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationServiceTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationServiceTest.kt
index 771b9d242da..06f4368a048 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationServiceTest.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/applicationconfiguration/ApplicationConfigurationServiceTest.kt
@@ -1,8 +1,11 @@
 package de.rki.coronawarnapp.service.applicationconfiguration
 
+import de.rki.coronawarnapp.diagnosiskeys.server.AppConfigServer
 import de.rki.coronawarnapp.http.WebRequestBuilder
 import de.rki.coronawarnapp.server.protocols.ApplicationConfigurationOuterClass
 import de.rki.coronawarnapp.util.CWADebug
+import de.rki.coronawarnapp.util.di.AppInjector
+import de.rki.coronawarnapp.util.di.ApplicationComponent
 import io.kotest.matchers.shouldBe
 import io.mockk.coEvery
 import io.mockk.every
@@ -23,7 +26,6 @@ class ApplicationConfigurationServiceTest : BaseTest() {
         CWADebug.isDebugBuildOrMode shouldBe true
 
         mockkObject(WebRequestBuilder)
-        val requestBuilder = mockk<WebRequestBuilder>()
         val appConfig = mockk<ApplicationConfigurationOuterClass.ApplicationConfiguration>()
         val appConfigBuilder =
             mockk<ApplicationConfigurationOuterClass.ApplicationConfiguration.Builder>()
@@ -36,9 +38,15 @@ class ApplicationConfigurationServiceTest : BaseTest() {
 
         every { appConfigBuilder.build() } returns appConfig
 
-        coEvery { requestBuilder.asyncGetApplicationConfigurationFromServer() } returns appConfig
+        val downloadServer = mockk<AppConfigServer>()
+        coEvery { downloadServer.downloadAppConfig() } returns appConfig
+
+        mockkObject(AppInjector)
+        mockk<ApplicationComponent>().apply {
+            every { this@apply.appConfigServer } returns downloadServer
+            every { AppInjector.component } returns this@apply
+        }
 
-        every { WebRequestBuilder.getInstance() } returns requestBuilder
 
         runBlocking {
             ApplicationConfigurationService.asyncRetrieveApplicationConfiguration()
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstantsTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstantsTest.kt
index a7a85c26881..2bb68c7fbbf 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstantsTest.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/service/diagnosiskey/DiagnosisKeyConstantsTest.kt
@@ -7,17 +7,7 @@ class DiagnosisKeyConstantsTest {
 
     @Test
     fun allDiagnosisKeyConstants() {
-        Assert.assertEquals(DiagnosisKeyConstants.HOUR, "hour")
         Assert.assertEquals(DiagnosisKeyConstants.SERVER_ERROR_CODE_403, 403)
-        Assert.assertEquals(DiagnosisKeyConstants.INDEX_DOWNLOAD_URL, "version/v1/index.txt")
-        Assert.assertEquals(DiagnosisKeyConstants.DIAGNOSIS_KEYS_DOWNLOAD_URL, "version/v1/diagnosis-keys")
         Assert.assertEquals(DiagnosisKeyConstants.DIAGNOSIS_KEYS_SUBMISSION_URL, "version/v1/diagnosis-keys")
-        Assert.assertEquals(DiagnosisKeyConstants.PARAMETERS_COUNTRY_DOWNLOAD_URL, "version/v1/parameters/country")
-        Assert.assertEquals(DiagnosisKeyConstants.APPCONFIG_COUNTRY_DOWNLOAD_URL, "version/v1/configuration/country")
-        Assert.assertEquals(
-            DiagnosisKeyConstants.COUNTRY_APPCONFIG_DOWNLOAD_URL,
-            "version/v1/configuration/country/DE/app_config"
-        )
-        Assert.assertEquals(DiagnosisKeyConstants.AVAILABLE_DATES_URL, "version/v1/diagnosis-keys/country/DE/date")
     }
 }
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/DeviceStorageTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/DeviceStorageTest.kt
index 84a551dc012..eed7854bfbf 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/DeviceStorageTest.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/DeviceStorageTest.kt
@@ -15,6 +15,7 @@ import io.mockk.every
 import io.mockk.impl.annotations.MockK
 import io.mockk.mockk
 import io.mockk.verify
+import kotlinx.coroutines.runBlocking
 import org.junit.jupiter.api.AfterEach
 import org.junit.jupiter.api.BeforeEach
 import org.junit.jupiter.api.Test
@@ -84,14 +85,14 @@ class DeviceStorageTest : BaseIOTest() {
     @Test
     fun `check private storage space`() {
         val deviceStorage = buildInstance()
-
-        deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
-
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
         verify { storageManager.getUuidForPath(any()) }
         verify(exactly = 0) { statsFsProvider.createStats(any()) }
 
@@ -101,14 +102,14 @@ class DeviceStorageTest : BaseIOTest() {
     @Test
     fun `check private storage space, sub API26`() {
         val deviceStorage = buildInstance(level = legacyApiLevel)
-
-        deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
-
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
         verify(exactly = 0) { storageManager.getUuidForPath(any()) }
         verify { statsFsProvider.createStats(any()) }
     }
@@ -116,40 +117,45 @@ class DeviceStorageTest : BaseIOTest() {
     @Test
     fun `request space from private storage successfully`() {
         val deviceStorage = buildInstance()
-
-        deviceStorage.checkSpacePrivateStorage(requiredBytes = defaultFreeSpace) shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
-
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage(requiredBytes = defaultFreeSpace) shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                requiredBytes = defaultFreeSpace,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
         verify(exactly = 0) { storageManager.allocateBytes(any<UUID>(), any()) }
     }
 
     @Test
     fun `request space from private storage successfully, sub API26`() {
         val deviceStorage = buildInstance(level = legacyApiLevel)
-
-        deviceStorage.checkSpacePrivateStorage(requiredBytes = defaultFreeSpace) shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage(requiredBytes = defaultFreeSpace) shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                requiredBytes = defaultFreeSpace,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
     }
 
     @Test
     fun `request space from private storage wth allocation`() {
         val deviceStorage = buildInstance()
-
-        val targetBytes = defaultFreeSpace + defaultAllocatableBytes
-        deviceStorage.checkSpacePrivateStorage(requiredBytes = targetBytes) shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = targetBytes,
-            totalBytes = defaultTotalSpace
-        )
+        runBlocking {
+            val targetBytes = defaultFreeSpace + defaultAllocatableBytes
+            deviceStorage.checkSpacePrivateStorage(requiredBytes = targetBytes) shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                requiredBytes = targetBytes,
+                freeBytes = targetBytes,
+                totalBytes = defaultTotalSpace
+            )
+        }
 
         verify { storageManager.allocateBytes(privateDataDirUUID, defaultAllocatableBytes) }
     }
@@ -157,25 +163,29 @@ class DeviceStorageTest : BaseIOTest() {
     @Test
     fun `request space from private storage unsuccessfully`() {
         val deviceStorage = buildInstance()
-
-        deviceStorage.checkSpacePrivateStorage(requiredBytes = Long.MAX_VALUE) shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = false,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage(requiredBytes = Long.MAX_VALUE) shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = false,
+                freeBytes = defaultFreeSpace,
+                requiredBytes = Long.MAX_VALUE,
+                totalBytes = defaultTotalSpace
+            )
+        }
     }
 
     @Test
     fun `request space from private storage unsuccessfully, sub API26`() {
         val deviceStorage = buildInstance(level = legacyApiLevel)
-
-        deviceStorage.checkSpacePrivateStorage(requiredBytes = Long.MAX_VALUE) shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = false,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage(requiredBytes = Long.MAX_VALUE) shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = false,
+                requiredBytes = Long.MAX_VALUE,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
     }
 
     @Test
@@ -183,13 +193,14 @@ class DeviceStorageTest : BaseIOTest() {
         every { storageManager.getUuidForPath(privateDataDir) } throws IOException("uh oh")
 
         val deviceStorage = buildInstance()
-
-        deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
-            path = privateDataDir,
-            isSpaceAvailable = true,
-            freeBytes = defaultFreeSpace,
-            totalBytes = defaultTotalSpace
-        )
+        runBlocking {
+            deviceStorage.checkSpacePrivateStorage() shouldBe DeviceStorage.CheckResult(
+                path = privateDataDir,
+                isSpaceAvailable = true,
+                freeBytes = defaultFreeSpace,
+                totalBytes = defaultTotalSpace
+            )
+        }
 
         verify { statsFsProvider.createStats(privateDataDir) }
     }
@@ -199,7 +210,8 @@ class DeviceStorageTest : BaseIOTest() {
         every { statsFsProvider.createStats(privateDataDir) } throws IOException("uh oh")
 
         val deviceStorage = buildInstance(level = legacyApiLevel)
-
-        shouldThrow<IOException> { deviceStorage.checkSpacePrivateStorage() }
+        runBlocking {
+            shouldThrow<IOException> { deviceStorage.checkSpacePrivateStorage() }
+        }
     }
 }
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/FileStorageConstantsTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/FileStorageConstantsTest.kt
deleted file mode 100644
index a9d31199602..00000000000
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/FileStorageConstantsTest.kt
+++ /dev/null
@@ -1,14 +0,0 @@
-package de.rki.coronawarnapp.storage
-
-import org.junit.Assert
-import org.junit.Test
-
-class FileStorageConstantsTest {
-
-    @Test
-    fun allFileStorageConstants() {
-        Assert.assertEquals(FileStorageConstants.DAYS_TO_KEEP, 14)
-        Assert.assertEquals(FileStorageConstants.FREE_SPACE_THRESHOLD, 15)
-        Assert.assertEquals(FileStorageConstants.KEY_EXPORT_DIRECTORY_NAME, "key-export")
-    }
-}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepositoryTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepositoryTest.kt
deleted file mode 100644
index ea58f3a5f15..00000000000
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/storage/keycache/KeyCacheRepositoryTest.kt
+++ /dev/null
@@ -1,88 +0,0 @@
-package de.rki.coronawarnapp.storage.keycache
-
-import io.mockk.MockKAnnotations
-import io.mockk.Runs
-import io.mockk.coEvery
-import io.mockk.coVerify
-import io.mockk.coVerifyOrder
-import io.mockk.impl.annotations.MockK
-import io.mockk.just
-import io.mockk.unmockkAll
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Before
-import org.junit.Test
-import java.net.URI
-
-/**
- * KeyCacheRepository test.
- */
-class KeyCacheRepositoryTest {
-
-    @MockK
-    private lateinit var keyCacheDao: KeyCacheDao
-
-    private lateinit var keyCacheRepository: KeyCacheRepository
-
-    @Before
-    fun setUp() {
-        MockKAnnotations.init(this)
-        keyCacheRepository = KeyCacheRepository(keyCacheDao)
-
-        // DAO tests in another test
-        coEvery { keyCacheDao.getAllEntries() } returns listOf()
-        coEvery { keyCacheDao.getHours() } returns listOf()
-        coEvery { keyCacheDao.clear() } just Runs
-        coEvery { keyCacheDao.clearHours() } just Runs
-        coEvery { keyCacheDao.insertEntry(any()) } returns 0
-    }
-
-    /**
-     * Test clear order.
-     */
-    @Test
-    fun testClear() {
-        runBlocking {
-            keyCacheRepository.clear()
-
-            coVerifyOrder {
-                keyCacheDao.getAllEntries()
-
-                keyCacheDao.clear()
-            }
-        }
-
-        runBlocking {
-            keyCacheRepository.clearHours()
-
-            coVerifyOrder {
-                keyCacheDao.getHours()
-
-                keyCacheDao.clearHours()
-            }
-        }
-    }
-
-    /**
-     * Test insert order.
-     */
-    @Test
-    fun testInsert() {
-        runBlocking {
-            keyCacheRepository.createEntry(
-                key = "1",
-                type = KeyCacheRepository.DateEntryType.DAY,
-                uri = URI("1")
-            )
-
-            coVerify {
-                keyCacheDao.insertEntry(any())
-            }
-        }
-    }
-
-    @After
-    fun cleanUp() {
-        unmockkAll()
-    }
-}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransactionTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransactionTest.kt
index f5da25fac19..c13d4f6f2c3 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransactionTest.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/transaction/RetrieveDiagnosisKeysTransactionTest.kt
@@ -1,16 +1,12 @@
 package de.rki.coronawarnapp.transaction
 
 import com.google.android.gms.nearby.exposurenotification.ExposureConfiguration
-import de.rki.coronawarnapp.http.WebRequestBuilder
 import de.rki.coronawarnapp.nearby.InternalExposureNotificationClient
-import de.rki.coronawarnapp.server.protocols.ApplicationConfigurationOuterClass
 import de.rki.coronawarnapp.service.applicationconfiguration.ApplicationConfigurationService
 import de.rki.coronawarnapp.storage.LocalData
-import de.rki.coronawarnapp.util.CWADebug
-import de.rki.coronawarnapp.util.CachedKeyFileHolder
-import io.kotest.matchers.shouldBe
 import de.rki.coronawarnapp.util.di.AppInjector
 import de.rki.coronawarnapp.util.di.ApplicationComponent
+import io.kotest.matchers.shouldBe
 import io.mockk.Runs
 import io.mockk.coEvery
 import io.mockk.coVerifyOrder
@@ -20,6 +16,7 @@ import io.mockk.mockk
 import io.mockk.mockkObject
 import io.mockk.unmockkAll
 import kotlinx.coroutines.runBlocking
+import org.joda.time.LocalDate
 import org.junit.After
 import org.junit.Before
 import org.junit.Test
@@ -66,8 +63,11 @@ class RetrieveDiagnosisKeysTransactionTest {
     @Test
     fun testTransactionNoFiles() {
         val requestedCountries = listOf("DE")
-        coEvery { RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](any<Date>(),
-            requestedCountries) } returns listOf<File>()
+        coEvery {
+            RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](
+                requestedCountries
+            )
+        } returns listOf<File>()
 
         runBlocking {
             RetrieveDiagnosisKeysTransaction.start(requestedCountries)
@@ -75,7 +75,9 @@ class RetrieveDiagnosisKeysTransactionTest {
             coVerifyOrder {
                 RetrieveDiagnosisKeysTransaction["executeSetup"]()
                 RetrieveDiagnosisKeysTransaction["executeRetrieveRiskScoreParams"]()
-                RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](any<Date>(), requestedCountries)
+                RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](
+                    requestedCountries
+                )
                 RetrieveDiagnosisKeysTransaction["executeFetchDateUpdate"](any<Date>())
             }
         }
@@ -86,7 +88,11 @@ class RetrieveDiagnosisKeysTransactionTest {
         val file = Paths.get("src", "test", "resources", "keys.bin").toFile()
         val requestedCountries = listOf("DE")
 
-        coEvery { RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](any<Date>(), requestedCountries) } returns listOf(file)
+        coEvery {
+            RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](
+                requestedCountries
+            )
+        } returns listOf(file)
 
         runBlocking {
             RetrieveDiagnosisKeysTransaction.start(requestedCountries)
@@ -94,7 +100,9 @@ class RetrieveDiagnosisKeysTransactionTest {
             coVerifyOrder {
                 RetrieveDiagnosisKeysTransaction["executeSetup"]()
                 RetrieveDiagnosisKeysTransaction["executeRetrieveRiskScoreParams"]()
-                RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](any<Date>(), requestedCountries)
+                RetrieveDiagnosisKeysTransaction["executeFetchKeyFilesFromServer"](
+                    requestedCountries
+                )
                 RetrieveDiagnosisKeysTransaction["executeAPISubmission"](
                     any<String>(),
                     listOf(file),
@@ -105,6 +113,11 @@ class RetrieveDiagnosisKeysTransactionTest {
         }
     }
 
+    @Test
+    fun `conversion from date to localdate`() {
+        LocalDate.fromDateFields(Date(0)) shouldBe LocalDate.parse("1970-01-01")
+    }
+
     @After
     fun cleanUp() {
         unmockkAll()
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/CachedKeyFileHolderTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/CachedKeyFileHolderTest.kt
deleted file mode 100644
index a9a1e502d98..00000000000
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/CachedKeyFileHolderTest.kt
+++ /dev/null
@@ -1,126 +0,0 @@
-package de.rki.coronawarnapp.util
-
-import android.content.Context
-import de.rki.coronawarnapp.CoronaWarnApplication
-import de.rki.coronawarnapp.storage.keycache.KeyCacheEntity
-import de.rki.coronawarnapp.storage.keycache.KeyCacheRepository
-import io.kotest.matchers.shouldBe
-import io.mockk.MockKAnnotations
-import io.mockk.Runs
-import io.mockk.coEvery
-import io.mockk.coVerifyOrder
-import io.mockk.every
-import io.mockk.impl.annotations.MockK
-import io.mockk.just
-import io.mockk.mockkObject
-import io.mockk.unmockkAll
-import kotlinx.coroutines.runBlocking
-import org.junit.After
-import org.junit.Before
-import org.junit.Test
-import java.io.File
-import java.util.Date
-
-/**
- * CachedKeyFileHolder test.
- */
-class CachedKeyFileHolderTest {
-
-    @MockK
-    private lateinit var keyCacheRepository: KeyCacheRepository
-
-    @MockK
-    private lateinit var context: Context
-
-    @Before
-    fun setUp() {
-        MockKAnnotations.init(this)
-        mockkObject(CoronaWarnApplication.Companion)
-        mockkObject(KeyCacheRepository.Companion)
-        every { CoronaWarnApplication.getAppContext() } returns context
-        every { KeyCacheRepository.getDateRepository(any()) } returns keyCacheRepository
-        mockkObject(CachedKeyFileHolder)
-        coEvery { keyCacheRepository.deleteOutdatedEntries(any()) } just Runs
-    }
-
-    /**
-     * Test call order is correct.
-     */
-    @Test
-    fun testAsyncFetchFiles() {
-        val date = Date()
-        val countries = listOf("DE")
-        val country = "DE"
-
-        mockkObject(CWADebug)
-
-        coEvery { keyCacheRepository.getDates() } returns listOf()
-        coEvery { keyCacheRepository.getFilesFromEntries() } returns listOf()
-        every { CWADebug.isDebugBuildOrMode } returns false
-        every { CachedKeyFileHolder["checkForFreeSpace"]() } returns Unit
-        every { CachedKeyFileHolder["getDatesFromServer"](country) } returns arrayListOf<String>()
-
-        every { CoronaWarnApplication.getAppContext().cacheDir } returns File("./")
-        every { CachedKeyFileHolder["getCountriesFromServer"](countries) } returns countries
-
-        runBlocking {
-
-            CachedKeyFileHolder.asyncFetchFiles(date, countries)
-
-            coVerifyOrder {
-                CachedKeyFileHolder.asyncFetchFiles(date, countries)
-                CachedKeyFileHolder["getCountriesFromServer"](countries)
-                CachedKeyFileHolder["getDatesFromServer"](country)
-                CachedKeyFileHolder["asyncHandleFilesFetch"](
-                    listOf(
-                        CountryDataWrapper(
-                            country,
-                            listOf()
-                        )
-                    )
-                )
-                keyCacheRepository.deleteOutdatedEntries(any())
-                CachedKeyFileHolder["getMissingDaysFromDiff"](
-                    listOf(
-                        CountryDataWrapper(
-                            country,
-                            listOf()
-                        )
-                    )
-                )
-                keyCacheRepository.getDates()
-                keyCacheRepository.getFilesFromEntries()
-            }
-        }
-    }
-
-    @Test
-    fun testGetMissingDaysFromDiff() {
-        val c1 = KeyCacheEntity()
-        c1.id = "10008bf0-8890-356d-a4a4-dc375553160a"
-        c1.path =
-            "/data/user/0/de.rki.coronawarnapp.dev/cache/key-export/10008bf0-8890-356d-a4a4-dc375553160a.zip"
-        c1.type = KeyCacheRepository.DateEntryType.DAY.ordinal
-
-        val c2 = KeyCacheEntity()
-        c2.id = "a8cc7b31-843e-3924-b918-023c386aec69"
-        c2.path =
-            "/data/user/0/de.rki.coronawarnapp.dev/cache/key-export/a8cc7b31-843e-3924-b918-023c386aec69.zip"
-        c2.type = KeyCacheRepository.DateEntryType.DAY.ordinal
-
-        val cacheEntries: Collection<KeyCacheEntity> = listOf(c1, c2)
-
-        val countryDataWrapper =
-            CountryDataWrapper("DE", listOf("2020-08-29", "2020-08-26", "2020-08-28"))
-
-        val result = countryDataWrapper.getMissingDates(cacheEntries)
-
-        result.size shouldBe 1
-        result.elementAt(0) shouldBe "2020-08-28"
-    }
-
-    @After
-    fun cleanUp() {
-        unmockkAll()
-    }
-}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/HashExtensionsTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/HashExtensionsTest.kt
new file mode 100644
index 00000000000..186d2973e59
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/HashExtensionsTest.kt
@@ -0,0 +1,60 @@
+package de.rki.coronawarnapp.util
+
+import de.rki.coronawarnapp.util.HashExtensions.hashToMD5
+import de.rki.coronawarnapp.util.HashExtensions.toMD5
+import de.rki.coronawarnapp.util.HashExtensions.toSHA1
+import de.rki.coronawarnapp.util.HashExtensions.toSHA256
+import io.kotest.matchers.shouldBe
+import io.mockk.clearAllMocks
+import org.junit.jupiter.api.AfterEach
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import testhelpers.BaseIOTest
+import java.io.File
+
+class HashExtensionsTest : BaseIOTest() {
+
+    private val testInput = "The Cake Is A Lie"
+    private val testDir = File(IO_TEST_BASEDIR, this::class.simpleName!!)
+
+    @BeforeEach
+    fun setup() {
+        testDir.mkdirs()
+    }
+
+    @AfterEach
+    fun teardown() {
+        clearAllMocks()
+
+        testDir.deleteRecursively()
+    }
+
+    @Test
+    fun `hash string to MD5`() {
+        testInput.toMD5() shouldBe "e42997e37d8d70d4927b0b396254c179"
+    }
+
+    @Test
+    fun `hash string to SHA256`() {
+        testInput.toSHA256() shouldBe "3afc82e0c5df81d1733fe0c289538a1a1f7a5038d5c261860a5c83952f4bcb61"
+    }
+
+    @Test
+    fun `hash string to SHA1`() {
+        testInput.toSHA1() shouldBe "4d57f806e5f714ebdb5a74a12fda9523fae21d76"
+    }
+
+    @Test
+    fun `hash file to md5`() {
+        val fileName = "FileToMD5.txt"
+        val testFile = File(testDir, fileName)
+        try {
+            testFile.printWriter().use { out ->
+                out.println("This is a test")
+            }
+            testFile.hashToMD5() shouldBe "ff22941336956098ae9a564289d1bf1b"
+        } finally {
+            testFile.delete()
+        }
+    }
+}
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/MockWebServerUtil.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/MockWebServerUtil.kt
index 5a908210db8..0dd704f7313 100644
--- a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/MockWebServerUtil.kt
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/MockWebServerUtil.kt
@@ -3,10 +3,8 @@ package de.rki.coronawarnapp.util
 import de.rki.coronawarnapp.http.HttpErrorParser
 import de.rki.coronawarnapp.http.WebRequestBuilder
 import de.rki.coronawarnapp.http.interceptor.RetryInterceptor
-import de.rki.coronawarnapp.http.service.DistributionService
 import de.rki.coronawarnapp.http.service.SubmissionService
 import de.rki.coronawarnapp.http.service.VerificationService
-import de.rki.coronawarnapp.util.security.VerificationKeys
 import okhttp3.OkHttpClient
 import okhttp3.logging.HttpLoggingInterceptor
 import okhttp3.mockwebserver.MockWebServer
@@ -29,13 +27,10 @@ fun MockWebServer.newWebRequestBuilder(): WebRequestBuilder {
         .addConverterFactory(GsonConverterFactory.create())
 
     return WebRequestBuilder(
-        retrofit.baseUrl(this.url("/distribution/")).build()
-            .create(DistributionService::class.java),
         retrofit.baseUrl(this.url("/verification/")).build()
             .create(VerificationService::class.java),
         retrofit.baseUrl(this.url("/submission/")).build()
-            .create(SubmissionService::class.java),
-        VerificationKeys()
+            .create(SubmissionService::class.java)
     )
 }
 
diff --git a/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/database/CommonConvertersTest.kt b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/database/CommonConvertersTest.kt
new file mode 100644
index 00000000000..baddf45d799
--- /dev/null
+++ b/Corona-Warn-App/src/test/java/de/rki/coronawarnapp/util/database/CommonConvertersTest.kt
@@ -0,0 +1,105 @@
+/******************************************************************************
+ * Corona-Warn-App                                                            *
+ *                                                                            *
+ * SAP SE and all other contributors /                                        *
+ * copyright owners license this file to you under the Apache                 *
+ * License, Version 2.0 (the "License"); you may not use this                 *
+ * file except in compliance with the License.                                *
+ * You may obtain a copy of the License at                                    *
+ *                                                                            *
+ * http://www.apache.org/licenses/LICENSE-2.0                                 *
+ *                                                                            *
+ * Unless required by applicable law or agreed to in writing,                 *
+ * software distributed under the License is distributed on an                *
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY                     *
+ * KIND, either express or implied.  See the License for the                  *
+ * specific language governing permissions and limitations                    *
+ * under the License.                                                         *
+ ******************************************************************************/
+
+package de.rki.coronawarnapp.util.database
+
+import de.rki.coronawarnapp.diagnosiskeys.server.LocationCode
+import io.kotest.matchers.shouldBe
+import org.joda.time.Instant
+import org.joda.time.LocalDate
+import org.joda.time.LocalTime
+import org.junit.jupiter.api.Test
+import testhelpers.BaseTest
+import java.io.File
+import java.util.UUID
+
+class CommonConvertersTest : BaseTest() {
+    private val converters = CommonConverters()
+
+    @Test
+    fun `int list conversion`() {
+        converters.apply {
+            val orig = listOf(1, 2, 3)
+            val raw = "[1,2,3]"
+            fromIntList(orig) shouldBe raw
+            toIntList(raw) shouldBe orig
+        }
+    }
+
+    @Test
+    fun `UUID conversion`() {
+        converters.apply {
+            val orig = UUID.fromString("123e4567-e89b-12d3-a456-426614174000")
+            val raw = "123e4567-e89b-12d3-a456-426614174000"
+            fromUUID(orig) shouldBe raw
+            toUUID(raw) shouldBe orig
+        }
+    }
+
+
+    @Test
+    fun `path conversion`() {
+        converters.apply {
+            val orig = File("/row/row/row/your/boat")
+            val raw = "/row/row/row/your/boat"
+            fromPath(orig) shouldBe raw
+            toPath(raw) shouldBe orig
+        }
+    }
+
+    @Test
+    fun `local date conversion`() {
+        converters.apply {
+            val orig = LocalDate.parse("2222-12-31")
+            val raw = "2222-12-31"
+            fromLocalDate(orig) shouldBe raw
+            toLocalDate(raw) shouldBe orig
+        }
+    }
+
+    @Test
+    fun `local time conversion`() {
+        converters.apply {
+            val orig = LocalTime.parse("23:59")
+            val raw = "23:59:00.000"
+            fromLocalTime(orig) shouldBe raw
+            toLocalTime(raw) shouldBe orig
+        }
+    }
+
+    @Test
+    fun `instant conversion`() {
+        converters.apply {
+            val orig = Instant.EPOCH
+            val raw = "1970-01-01T00:00:00.000Z"
+            fromInstant(orig) shouldBe raw
+            toInstant(raw) shouldBe orig
+        }
+    }
+
+    @Test
+    fun `LocationCode conversion`() {
+        converters.apply {
+            val orig = LocationCode("DE")
+            val raw = "DE"
+            fromLocationCode(orig) shouldBe raw
+            toLocationCode(raw) shouldBe orig
+        }
+    }
+}