diff --git a/bddtests/common/common_pb2.py b/bddtests/common/common_pb2.py
index 1eb0f65c9f6..4915ad86823 100644
--- a/bddtests/common/common_pb2.py
+++ b/bddtests/common/common_pb2.py
@@ -3,6 +3,7 @@
 
 import sys
 _b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
+from google.protobuf.internal import enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import message as _message
 from google.protobuf import reflection as _reflection
@@ -20,16 +21,14 @@
   name='common/common.proto',
   package='common',
   syntax='proto3',
-  serialized_pb=_b('\n\x13\x63ommon/common.proto\x12\x06\x63ommon\x1a\x1fgoogle/protobuf/timestamp.proto\"\xe8\x01\n\x06Header\x12\x0f\n\x07version\x18\x01 \x01(\x05\x12-\n\ttimestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12!\n\x04type\x18\x03 \x01(\x0e\x32\x13.common.Header.Type\x12\x0f\n\x07\x63reator\x18\x04 \x01(\x0c\x12\r\n\x05nonce\x18\x05 \x01(\x0c\x12\x0f\n\x07\x63hainID\x18\x06 \x01(\x0c\"J\n\x04Type\x12\x0b\n\x07MESSAGE\x10\x00\x12\x1d\n\x19\x43ONFIGURATION_TRANSACTION\x10\x01\x12\x16\n\x12\x43ONFIGURATION_ITEM\x10\x02\"7\n\x07Payload\x12\x1e\n\x06header\x18\x01 \x01(\x0b\x32\x0e.common.Header\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\x0c\".\n\x08\x45nvelope\x12\x0f\n\x07payload\x18\x01 \x01(\x0c\x12\x11\n\tsignature\x18\x02 \x01(\x0c\"v\n\x05\x42lock\x12#\n\x06Header\x18\x01 \x01(\x0b\x32\x13.common.BlockHeader\x12\x1f\n\x04\x44\x61ta\x18\x02 \x01(\x0b\x32\x11.common.BlockData\x12\'\n\x08Metadata\x18\x03 \x01(\x0b\x32\x15.common.BlockMetadata\"E\n\x0b\x42lockHeader\x12\x0e\n\x06Number\x18\x01 \x01(\x04\x12\x14\n\x0cPreviousHash\x18\x02 \x01(\x0c\x12\x10\n\x08\x44\x61taHash\x18\x03 \x01(\x0c\"\x19\n\tBlockData\x12\x0c\n\x04\x44\x61ta\x18\x01 \x03(\x0c\"!\n\rBlockMetadata\x12\x10\n\x08Metadata\x18\x01 \x03(\x0c\x42-Z+github.com/hyperledger/fabric/protos/commonb\x06proto3')
+  serialized_pb=_b('\n\x13\x63ommon/common.proto\x12\x06\x63ommon\x1a\x1fgoogle/protobuf/timestamp.proto\"d\n\x06Header\x12(\n\x0b\x63hainHeader\x18\x01 \x01(\x0b\x32\x13.common.ChainHeader\x12\x30\n\x0fsignatureHeader\x18\x02 \x01(\x0b\x32\x17.common.SignatureHeader\"l\n\x0b\x43hainHeader\x12\x0c\n\x04type\x18\x01 \x01(\x05\x12\x0f\n\x07version\x18\x02 \x01(\x05\x12-\n\ttimestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07\x63hainID\x18\x04 \x01(\x0c\"@\n\x0fSignatureHeader\x12\x0f\n\x07\x63reator\x18\x01 \x01(\x0c\x12\r\n\x05nonce\x18\x02 \x01(\x0c\x12\r\n\x05\x65poch\x18\x03 \x01(\x04\"7\n\x07Payload\x12\x1e\n\x06header\x18\x01 \x01(\x0b\x32\x0e.common.Header\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\x0c\".\n\x08\x45nvelope\x12\x0f\n\x07payload\x18\x01 \x01(\x0c\x12\x11\n\tsignature\x18\x02 \x01(\x0c\"v\n\x05\x42lock\x12#\n\x06Header\x18\x01 \x01(\x0b\x32\x13.common.BlockHeader\x12\x1f\n\x04\x44\x61ta\x18\x02 \x01(\x0b\x32\x11.common.BlockData\x12\'\n\x08Metadata\x18\x03 \x01(\x0b\x32\x15.common.BlockMetadata\"E\n\x0b\x42lockHeader\x12\x0e\n\x06Number\x18\x01 \x01(\x04\x12\x14\n\x0cPreviousHash\x18\x02 \x01(\x0c\x12\x10\n\x08\x44\x61taHash\x18\x03 \x01(\x0c\"\x19\n\tBlockData\x12\x0c\n\x04\x44\x61ta\x18\x01 \x03(\x0c\"!\n\rBlockMetadata\x12\x10\n\x08Metadata\x18\x01 \x03(\x0c*j\n\nHeaderType\x12\x0b\n\x07MESSAGE\x10\x00\x12\x1d\n\x19\x43ONFIGURATION_TRANSACTION\x10\x01\x12\x16\n\x12\x43ONFIGURATION_ITEM\x10\x02\x12\x18\n\x14\x45NDORSER_TRANSACTION\x10\x03\x42-Z+github.com/hyperledger/fabric/protos/commonb\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_timestamp__pb2.DESCRIPTOR,])
 _sym_db.RegisterFileDescriptor(DESCRIPTOR)
 
-
-
-_HEADER_TYPE = _descriptor.EnumDescriptor(
-  name='Type',
-  full_name='common.Header.Type',
+_HEADERTYPE = _descriptor.EnumDescriptor(
+  name='HeaderType',
+  full_name='common.HeaderType',
   filename=None,
   file=DESCRIPTOR,
   values=[
@@ -45,13 +44,24 @@
       name='CONFIGURATION_ITEM', index=2, number=2,
       options=None,
       type=None),
+    _descriptor.EnumValueDescriptor(
+      name='ENDORSER_TRANSACTION', index=3, number=3,
+      options=None,
+      type=None),
   ],
   containing_type=None,
   options=None,
-  serialized_start=223,
-  serialized_end=297,
+  serialized_start=700,
+  serialized_end=806,
 )
-_sym_db.RegisterEnumDescriptor(_HEADER_TYPE)
+_sym_db.RegisterEnumDescriptor(_HEADERTYPE)
+
+HeaderType = enum_type_wrapper.EnumTypeWrapper(_HEADERTYPE)
+MESSAGE = 0
+CONFIGURATION_TRANSACTION = 1
+CONFIGURATION_ITEM = 2
+ENDORSER_TRANSACTION = 3
+
 
 
 _HEADER = _descriptor.Descriptor(
@@ -62,53 +72,121 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='version', full_name='common.Header.version', index=0,
-      number=1, type=5, cpp_type=1, label=1,
-      has_default_value=False, default_value=0,
+      name='chainHeader', full_name='common.Header.chainHeader', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='timestamp', full_name='common.Header.timestamp', index=1,
+      name='signatureHeader', full_name='common.Header.signatureHeader', index=1,
       number=2, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=64,
+  serialized_end=164,
+)
+
+
+_CHAINHEADER = _descriptor.Descriptor(
+  name='ChainHeader',
+  full_name='common.ChainHeader',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
     _descriptor.FieldDescriptor(
-      name='type', full_name='common.Header.type', index=2,
-      number=3, type=14, cpp_type=8, label=1,
+      name='type', full_name='common.ChainHeader.type', index=0,
+      number=1, type=5, cpp_type=1, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='creator', full_name='common.Header.creator', index=3,
+      name='version', full_name='common.ChainHeader.version', index=1,
+      number=2, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None),
+    _descriptor.FieldDescriptor(
+      name='timestamp', full_name='common.ChainHeader.timestamp', index=2,
+      number=3, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None),
+    _descriptor.FieldDescriptor(
+      name='chainID', full_name='common.ChainHeader.chainID', index=3,
       number=4, type=12, cpp_type=9, label=1,
       has_default_value=False, default_value=_b(""),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=166,
+  serialized_end=274,
+)
+
+
+_SIGNATUREHEADER = _descriptor.Descriptor(
+  name='SignatureHeader',
+  full_name='common.SignatureHeader',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
     _descriptor.FieldDescriptor(
-      name='nonce', full_name='common.Header.nonce', index=4,
-      number=5, type=12, cpp_type=9, label=1,
+      name='creator', full_name='common.SignatureHeader.creator', index=0,
+      number=1, type=12, cpp_type=9, label=1,
       has_default_value=False, default_value=_b(""),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='chainID', full_name='common.Header.chainID', index=5,
-      number=6, type=12, cpp_type=9, label=1,
+      name='nonce', full_name='common.SignatureHeader.nonce', index=1,
+      number=2, type=12, cpp_type=9, label=1,
       has_default_value=False, default_value=_b(""),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
+    _descriptor.FieldDescriptor(
+      name='epoch', full_name='common.SignatureHeader.epoch', index=2,
+      number=3, type=4, cpp_type=4, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None),
   ],
   extensions=[
   ],
   nested_types=[],
   enum_types=[
-    _HEADER_TYPE,
   ],
   options=None,
   is_extendable=False,
@@ -116,8 +194,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=65,
-  serialized_end=297,
+  serialized_start=276,
+  serialized_end=340,
 )
 
 
@@ -154,8 +232,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=299,
-  serialized_end=354,
+  serialized_start=342,
+  serialized_end=397,
 )
 
 
@@ -192,8 +270,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=356,
-  serialized_end=402,
+  serialized_start=399,
+  serialized_end=445,
 )
 
 
@@ -237,8 +315,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=404,
-  serialized_end=522,
+  serialized_start=447,
+  serialized_end=565,
 )
 
 
@@ -282,8 +360,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=524,
-  serialized_end=593,
+  serialized_start=567,
+  serialized_end=636,
 )
 
 
@@ -313,8 +391,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=595,
-  serialized_end=620,
+  serialized_start=638,
+  serialized_end=663,
 )
 
 
@@ -344,24 +422,27 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=622,
-  serialized_end=655,
+  serialized_start=665,
+  serialized_end=698,
 )
 
-_HEADER.fields_by_name['timestamp'].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP
-_HEADER.fields_by_name['type'].enum_type = _HEADER_TYPE
-_HEADER_TYPE.containing_type = _HEADER
+_HEADER.fields_by_name['chainHeader'].message_type = _CHAINHEADER
+_HEADER.fields_by_name['signatureHeader'].message_type = _SIGNATUREHEADER
+_CHAINHEADER.fields_by_name['timestamp'].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP
 _PAYLOAD.fields_by_name['header'].message_type = _HEADER
 _BLOCK.fields_by_name['Header'].message_type = _BLOCKHEADER
 _BLOCK.fields_by_name['Data'].message_type = _BLOCKDATA
 _BLOCK.fields_by_name['Metadata'].message_type = _BLOCKMETADATA
 DESCRIPTOR.message_types_by_name['Header'] = _HEADER
+DESCRIPTOR.message_types_by_name['ChainHeader'] = _CHAINHEADER
+DESCRIPTOR.message_types_by_name['SignatureHeader'] = _SIGNATUREHEADER
 DESCRIPTOR.message_types_by_name['Payload'] = _PAYLOAD
 DESCRIPTOR.message_types_by_name['Envelope'] = _ENVELOPE
 DESCRIPTOR.message_types_by_name['Block'] = _BLOCK
 DESCRIPTOR.message_types_by_name['BlockHeader'] = _BLOCKHEADER
 DESCRIPTOR.message_types_by_name['BlockData'] = _BLOCKDATA
 DESCRIPTOR.message_types_by_name['BlockMetadata'] = _BLOCKMETADATA
+DESCRIPTOR.enum_types_by_name['HeaderType'] = _HEADERTYPE
 
 Header = _reflection.GeneratedProtocolMessageType('Header', (_message.Message,), dict(
   DESCRIPTOR = _HEADER,
@@ -370,6 +451,20 @@
   ))
 _sym_db.RegisterMessage(Header)
 
+ChainHeader = _reflection.GeneratedProtocolMessageType('ChainHeader', (_message.Message,), dict(
+  DESCRIPTOR = _CHAINHEADER,
+  __module__ = 'common.common_pb2'
+  # @@protoc_insertion_point(class_scope:common.ChainHeader)
+  ))
+_sym_db.RegisterMessage(ChainHeader)
+
+SignatureHeader = _reflection.GeneratedProtocolMessageType('SignatureHeader', (_message.Message,), dict(
+  DESCRIPTOR = _SIGNATUREHEADER,
+  __module__ = 'common.common_pb2'
+  # @@protoc_insertion_point(class_scope:common.SignatureHeader)
+  ))
+_sym_db.RegisterMessage(SignatureHeader)
+
 Payload = _reflection.GeneratedProtocolMessageType('Payload', (_message.Message,), dict(
   DESCRIPTOR = _PAYLOAD,
   __module__ = 'common.common_pb2'
diff --git a/bddtests/orderer/ab_pb2.py b/bddtests/orderer/ab_pb2.py
index f86f6e66ba0..edbc0c0e53d 100644
--- a/bddtests/orderer/ab_pb2.py
+++ b/bddtests/orderer/ab_pb2.py
@@ -21,7 +21,7 @@
   name='orderer/ab.proto',
   package='orderer',
   syntax='proto3',
-  serialized_pb=_b('\n\x10orderer/ab.proto\x12\x07orderer\x1a\x13\x63ommon/common.proto\"4\n\x11\x42roadcastResponse\x12\x1f\n\x06Status\x18\x01 \x01(\x0e\x32\x0f.orderer.Status\"k\n\x15\x43onfigurationEnvelope\x12\x10\n\x08Sequence\x18\x01 \x01(\x04\x12\x0f\n\x07\x43hainID\x18\x02 \x01(\x0c\x12/\n\x05Items\x18\x03 \x03(\x0b\x32 .orderer.SignedConfigurationItem\"V\n\x17SignedConfigurationItem\x12\x15\n\rConfiguration\x18\x01 \x01(\x0c\x12$\n\nSignatures\x18\x02 \x03(\x0b\x32\x10.common.Envelope\"\xf3\x01\n\x11\x43onfigurationItem\x12\x0f\n\x07\x43hainID\x18\x01 \x01(\x0c\x12\x14\n\x0cLastModified\x18\x02 \x01(\x04\x12:\n\x04Type\x18\x03 \x01(\x0e\x32,.orderer.ConfigurationItem.ConfigurationType\x12\x1a\n\x12ModificationPolicy\x18\x04 \x01(\t\x12\x0b\n\x03Key\x18\x05 \x01(\t\x12\r\n\x05Value\x18\x06 \x01(\x0c\"C\n\x11\x43onfigurationType\x12\n\n\x06Policy\x10\x00\x12\t\n\x05\x43hain\x10\x01\x12\x0b\n\x07Orderer\x10\x02\x12\n\n\x06\x46\x61\x62ric\x10\x03\"M\n\x06Policy\x12;\n\x0fSignaturePolicy\x18\x01 \x01(\x0b\x32 .orderer.SignaturePolicyEnvelopeH\x00\x42\x06\n\x04Type\"h\n\x17SignaturePolicyEnvelope\x12\x0f\n\x07Version\x18\x01 \x01(\x05\x12(\n\x06Policy\x18\x02 \x01(\x0b\x32\x18.orderer.SignaturePolicy\x12\x12\n\nIdentities\x18\x03 \x03(\x0c\"\x9f\x01\n\x0fSignaturePolicy\x12\x12\n\x08SignedBy\x18\x01 \x01(\x05H\x00\x12/\n\x04\x46rom\x18\x02 \x01(\x0b\x32\x1f.orderer.SignaturePolicy.NOutOfH\x00\x1a?\n\x06NOutOf\x12\t\n\x01N\x18\x01 \x01(\x05\x12*\n\x08Policies\x18\x02 \x03(\x0b\x32\x18.orderer.SignaturePolicyB\x06\n\x04Type\"\xa8\x01\n\x08SeekInfo\x12*\n\x05Start\x18\x01 \x01(\x0e\x32\x1b.orderer.SeekInfo.StartType\x12\x17\n\x0fSpecifiedNumber\x18\x02 \x01(\x04\x12\x12\n\nWindowSize\x18\x03 \x01(\x04\x12\x0f\n\x07\x43hainID\x18\x04 \x01(\x0c\"2\n\tStartType\x12\n\n\x06NEWEST\x10\x00\x12\n\n\x06OLDEST\x10\x01\x12\r\n\tSPECIFIED\x10\x02\"!\n\x0f\x41\x63knowledgement\x12\x0e\n\x06Number\x18\x01 \x01(\x04\"o\n\rDeliverUpdate\x12\x33\n\x0f\x41\x63knowledgement\x18\x01 \x01(\x0b\x32\x18.orderer.AcknowledgementH\x00\x12!\n\x04Seek\x18\x02 \x01(\x0b\x32\x11.orderer.SeekInfoH\x00\x42\x06\n\x04Type\"[\n\x0f\x44\x65liverResponse\x12 \n\x05\x45rror\x18\x01 \x01(\x0e\x32\x0f.orderer.StatusH\x00\x12\x1e\n\x05\x42lock\x18\x02 \x01(\x0b\x32\r.common.BlockH\x00\x42\x06\n\x04Type*\x8b\x01\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0c\n\x07SUCCESS\x10\xc8\x01\x12\x10\n\x0b\x42\x41\x44_REQUEST\x10\x90\x03\x12\x0e\n\tFORBIDDEN\x10\x93\x03\x12\x0e\n\tNOT_FOUND\x10\x94\x03\x12\x1a\n\x15INTERNAL_SERVER_ERROR\x10\xf4\x03\x12\x18\n\x13SERVICE_UNAVAILABLE\x10\xf7\x03\x32\x95\x01\n\x0f\x41tomicBroadcast\x12?\n\tBroadcast\x12\x10.common.Envelope\x1a\x1a.orderer.BroadcastResponse\"\x00(\x01\x30\x01\x12\x41\n\x07\x44\x65liver\x12\x16.orderer.DeliverUpdate\x1a\x18.orderer.DeliverResponse\"\x00(\x01\x30\x01\x42.Z,github.com/hyperledger/fabric/protos/ordererb\x06proto3')
+  serialized_pb=_b('\n\x10orderer/ab.proto\x12\x07orderer\x1a\x13\x63ommon/common.proto\"4\n\x11\x42roadcastResponse\x12\x1f\n\x06Status\x18\x01 \x01(\x0e\x32\x0f.orderer.Status\"k\n\x15\x43onfigurationEnvelope\x12/\n\x05Items\x18\x01 \x03(\x0b\x32 .orderer.SignedConfigurationItem\x12\x0f\n\x07\x43hainID\x18\x02 \x01(\x0c\x12\x10\n\x08Sequence\x18\x03 \x01(\x04\"i\n\x17SignedConfigurationItem\x12\x19\n\x11\x43onfigurationItem\x18\x01 \x01(\x0c\x12\x33\n\nSignatures\x18\x02 \x03(\x0b\x32\x1f.orderer.ConfigurationSignature\"\x87\x02\n\x11\x43onfigurationItem\x12#\n\x06Header\x18\x01 \x01(\x0b\x32\x13.common.ChainHeader\x12:\n\x04Type\x18\x02 \x01(\x0e\x32,.orderer.ConfigurationItem.ConfigurationType\x12\x14\n\x0cLastModified\x18\x03 \x01(\x04\x12\x1a\n\x12ModificationPolicy\x18\x04 \x01(\t\x12\x0b\n\x03Key\x18\x05 \x01(\t\x12\r\n\x05Value\x18\x06 \x01(\x0c\"C\n\x11\x43onfigurationType\x12\n\n\x06Policy\x10\x00\x12\t\n\x05\x43hain\x10\x01\x12\x0b\n\x07Orderer\x10\x02\x12\n\n\x06\x46\x61\x62ric\x10\x03\"D\n\x16\x43onfigurationSignature\x12\x17\n\x0fsignatureHeader\x18\x01 \x01(\x0c\x12\x11\n\tsignature\x18\x02 \x01(\x0c\"M\n\x06Policy\x12;\n\x0fSignaturePolicy\x18\x01 \x01(\x0b\x32 .orderer.SignaturePolicyEnvelopeH\x00\x42\x06\n\x04Type\"h\n\x17SignaturePolicyEnvelope\x12\x0f\n\x07Version\x18\x01 \x01(\x05\x12(\n\x06Policy\x18\x02 \x01(\x0b\x32\x18.orderer.SignaturePolicy\x12\x12\n\nIdentities\x18\x03 \x03(\x0c\"\x9f\x01\n\x0fSignaturePolicy\x12\x12\n\x08SignedBy\x18\x01 \x01(\x05H\x00\x12/\n\x04\x46rom\x18\x02 \x01(\x0b\x32\x1f.orderer.SignaturePolicy.NOutOfH\x00\x1a?\n\x06NOutOf\x12\t\n\x01N\x18\x01 \x01(\x05\x12*\n\x08Policies\x18\x02 \x03(\x0b\x32\x18.orderer.SignaturePolicyB\x06\n\x04Type\"\xa8\x01\n\x08SeekInfo\x12*\n\x05Start\x18\x01 \x01(\x0e\x32\x1b.orderer.SeekInfo.StartType\x12\x17\n\x0fSpecifiedNumber\x18\x02 \x01(\x04\x12\x12\n\nWindowSize\x18\x03 \x01(\x04\x12\x0f\n\x07\x43hainID\x18\x04 \x01(\x0c\"2\n\tStartType\x12\n\n\x06NEWEST\x10\x00\x12\n\n\x06OLDEST\x10\x01\x12\r\n\tSPECIFIED\x10\x02\"!\n\x0f\x41\x63knowledgement\x12\x0e\n\x06Number\x18\x01 \x01(\x04\"o\n\rDeliverUpdate\x12\x33\n\x0f\x41\x63knowledgement\x18\x01 \x01(\x0b\x32\x18.orderer.AcknowledgementH\x00\x12!\n\x04Seek\x18\x02 \x01(\x0b\x32\x11.orderer.SeekInfoH\x00\x42\x06\n\x04Type\"[\n\x0f\x44\x65liverResponse\x12 \n\x05\x45rror\x18\x01 \x01(\x0e\x32\x0f.orderer.StatusH\x00\x12\x1e\n\x05\x42lock\x18\x02 \x01(\x0b\x32\r.common.BlockH\x00\x42\x06\n\x04Type*\x8b\x01\n\x06Status\x12\x0b\n\x07UNKNOWN\x10\x00\x12\x0c\n\x07SUCCESS\x10\xc8\x01\x12\x10\n\x0b\x42\x41\x44_REQUEST\x10\x90\x03\x12\x0e\n\tFORBIDDEN\x10\x93\x03\x12\x0e\n\tNOT_FOUND\x10\x94\x03\x12\x1a\n\x15INTERNAL_SERVER_ERROR\x10\xf4\x03\x12\x18\n\x13SERVICE_UNAVAILABLE\x10\xf7\x03\x32\x95\x01\n\x0f\x41tomicBroadcast\x12?\n\tBroadcast\x12\x10.common.Envelope\x1a\x1a.orderer.BroadcastResponse\"\x00(\x01\x30\x01\x12\x41\n\x07\x44\x65liver\x12\x16.orderer.DeliverUpdate\x1a\x18.orderer.DeliverResponse\"\x00(\x01\x30\x01\x42.Z,github.com/hyperledger/fabric/protos/ordererb\x06proto3')
   ,
   dependencies=[common_dot_common__pb2.DESCRIPTOR,])
 _sym_db.RegisterFileDescriptor(DESCRIPTOR)
@@ -63,8 +63,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1307,
-  serialized_end=1446,
+  serialized_start=1416,
+  serialized_end=1555,
 )
 _sym_db.RegisterEnumDescriptor(_STATUS)
 
@@ -103,8 +103,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=478,
-  serialized_end=545,
+  serialized_start=517,
+  serialized_end=584,
 )
 _sym_db.RegisterEnumDescriptor(_CONFIGURATIONITEM_CONFIGURATIONTYPE)
 
@@ -129,8 +129,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1013,
-  serialized_end=1063,
+  serialized_start=1122,
+  serialized_end=1172,
 )
 _sym_db.RegisterEnumDescriptor(_SEEKINFO_STARTTYPE)
 
@@ -174,9 +174,9 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='Sequence', full_name='orderer.ConfigurationEnvelope.Sequence', index=0,
-      number=1, type=4, cpp_type=4, label=1,
-      has_default_value=False, default_value=0,
+      name='Items', full_name='orderer.ConfigurationEnvelope.Items', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
@@ -188,9 +188,9 @@
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='Items', full_name='orderer.ConfigurationEnvelope.Items', index=2,
-      number=3, type=11, cpp_type=10, label=3,
-      has_default_value=False, default_value=[],
+      name='Sequence', full_name='orderer.ConfigurationEnvelope.Sequence', index=2,
+      number=3, type=4, cpp_type=4, label=1,
+      has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
@@ -219,7 +219,7 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='Configuration', full_name='orderer.SignedConfigurationItem.Configuration', index=0,
+      name='ConfigurationItem', full_name='orderer.SignedConfigurationItem.ConfigurationItem', index=0,
       number=1, type=12, cpp_type=9, label=1,
       has_default_value=False, default_value=_b(""),
       message_type=None, enum_type=None, containing_type=None,
@@ -245,7 +245,7 @@
   oneofs=[
   ],
   serialized_start=213,
-  serialized_end=299,
+  serialized_end=318,
 )
 
 
@@ -257,22 +257,22 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='ChainID', full_name='orderer.ConfigurationItem.ChainID', index=0,
-      number=1, type=12, cpp_type=9, label=1,
-      has_default_value=False, default_value=_b(""),
+      name='Header', full_name='orderer.ConfigurationItem.Header', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='LastModified', full_name='orderer.ConfigurationItem.LastModified', index=1,
-      number=2, type=4, cpp_type=4, label=1,
+      name='Type', full_name='orderer.ConfigurationItem.Type', index=1,
+      number=2, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None),
     _descriptor.FieldDescriptor(
-      name='Type', full_name='orderer.ConfigurationItem.Type', index=2,
-      number=3, type=14, cpp_type=8, label=1,
+      name='LastModified', full_name='orderer.ConfigurationItem.LastModified', index=2,
+      number=3, type=4, cpp_type=4, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
@@ -311,8 +311,46 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=302,
-  serialized_end=545,
+  serialized_start=321,
+  serialized_end=584,
+)
+
+
+_CONFIGURATIONSIGNATURE = _descriptor.Descriptor(
+  name='ConfigurationSignature',
+  full_name='orderer.ConfigurationSignature',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='signatureHeader', full_name='orderer.ConfigurationSignature.signatureHeader', index=0,
+      number=1, type=12, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b(""),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None),
+    _descriptor.FieldDescriptor(
+      name='signature', full_name='orderer.ConfigurationSignature.signature', index=1,
+      number=2, type=12, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b(""),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=586,
+  serialized_end=654,
 )
 
 
@@ -345,8 +383,8 @@
       name='Type', full_name='orderer.Policy.Type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=547,
-  serialized_end=624,
+  serialized_start=656,
+  serialized_end=733,
 )
 
 
@@ -390,8 +428,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=626,
-  serialized_end=730,
+  serialized_start=735,
+  serialized_end=839,
 )
 
 
@@ -428,8 +466,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=821,
-  serialized_end=884,
+  serialized_start=930,
+  serialized_end=993,
 )
 
 _SIGNATUREPOLICY = _descriptor.Descriptor(
@@ -468,8 +506,8 @@
       name='Type', full_name='orderer.SignaturePolicy.Type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=733,
-  serialized_end=892,
+  serialized_start=842,
+  serialized_end=1001,
 )
 
 
@@ -521,8 +559,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=895,
-  serialized_end=1063,
+  serialized_start=1004,
+  serialized_end=1172,
 )
 
 
@@ -552,8 +590,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1065,
-  serialized_end=1098,
+  serialized_start=1174,
+  serialized_end=1207,
 )
 
 
@@ -593,8 +631,8 @@
       name='Type', full_name='orderer.DeliverUpdate.Type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1100,
-  serialized_end=1211,
+  serialized_start=1209,
+  serialized_end=1320,
 )
 
 
@@ -634,13 +672,14 @@
       name='Type', full_name='orderer.DeliverResponse.Type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1213,
-  serialized_end=1304,
+  serialized_start=1322,
+  serialized_end=1413,
 )
 
 _BROADCASTRESPONSE.fields_by_name['Status'].enum_type = _STATUS
 _CONFIGURATIONENVELOPE.fields_by_name['Items'].message_type = _SIGNEDCONFIGURATIONITEM
-_SIGNEDCONFIGURATIONITEM.fields_by_name['Signatures'].message_type = common_dot_common__pb2._ENVELOPE
+_SIGNEDCONFIGURATIONITEM.fields_by_name['Signatures'].message_type = _CONFIGURATIONSIGNATURE
+_CONFIGURATIONITEM.fields_by_name['Header'].message_type = common_dot_common__pb2._CHAINHEADER
 _CONFIGURATIONITEM.fields_by_name['Type'].enum_type = _CONFIGURATIONITEM_CONFIGURATIONTYPE
 _CONFIGURATIONITEM_CONFIGURATIONTYPE.containing_type = _CONFIGURATIONITEM
 _POLICY.fields_by_name['SignaturePolicy'].message_type = _SIGNATUREPOLICYENVELOPE
@@ -679,6 +718,7 @@
 DESCRIPTOR.message_types_by_name['ConfigurationEnvelope'] = _CONFIGURATIONENVELOPE
 DESCRIPTOR.message_types_by_name['SignedConfigurationItem'] = _SIGNEDCONFIGURATIONITEM
 DESCRIPTOR.message_types_by_name['ConfigurationItem'] = _CONFIGURATIONITEM
+DESCRIPTOR.message_types_by_name['ConfigurationSignature'] = _CONFIGURATIONSIGNATURE
 DESCRIPTOR.message_types_by_name['Policy'] = _POLICY
 DESCRIPTOR.message_types_by_name['SignaturePolicyEnvelope'] = _SIGNATUREPOLICYENVELOPE
 DESCRIPTOR.message_types_by_name['SignaturePolicy'] = _SIGNATUREPOLICY
@@ -716,6 +756,13 @@
   ))
 _sym_db.RegisterMessage(ConfigurationItem)
 
+ConfigurationSignature = _reflection.GeneratedProtocolMessageType('ConfigurationSignature', (_message.Message,), dict(
+  DESCRIPTOR = _CONFIGURATIONSIGNATURE,
+  __module__ = 'orderer.ab_pb2'
+  # @@protoc_insertion_point(class_scope:orderer.ConfigurationSignature)
+  ))
+_sym_db.RegisterMessage(ConfigurationSignature)
+
 Policy = _reflection.GeneratedProtocolMessageType('Policy', (_message.Message,), dict(
   DESCRIPTOR = _POLICY,
   __module__ = 'orderer.ab_pb2'
diff --git a/bddtests/steps/orderer_util.py b/bddtests/steps/orderer_util.py
index 71a2484302b..1f36c18bee0 100644
--- a/bddtests/steps/orderer_util.py
+++ b/bddtests/steps/orderer_util.py
@@ -226,8 +226,8 @@ def generateBroadcastMessages(numToGenerate = 1, timeToHoldOpen = 1):
     messages = []
     for i in range(0, numToGenerate):
         envelope = common_pb2.Envelope()
-        payload = common_pb2.Payload()
-        payload.header.type = common_pb2.Header.MESSAGE
+        payload = common_pb2.Payload(header = common_pb2.Header(chainHeader = common_pb2.ChainHeader()))
+        # TODO, appropriately set the header type
         payload.data = str("BDD test: {0}".format(datetime.datetime.utcnow()))
         envelope.payload = payload.SerializeToString()
         messages.append(envelope)
diff --git a/orderer/common/bootstrap/static/static.go b/orderer/common/bootstrap/static/static.go
index b8a3987fcc4..3f354c53929 100644
--- a/orderer/common/bootstrap/static/static.go
+++ b/orderer/common/bootstrap/static/static.go
@@ -53,7 +53,9 @@ func errorlessMarshal(thing proto.Message) []byte {
 
 func (b *bootstrapper) makeSignedConfigurationItem(id string, ctype ab.ConfigurationItem_ConfigurationType, data []byte, modificationPolicyID string) *ab.SignedConfigurationItem {
 	configurationBytes := errorlessMarshal(&ab.ConfigurationItem{
-		ChainID:            b.chainID,
+		Header: &cb.ChainHeader{
+			ChainID: b.chainID,
+		},
 		LastModified:       0,
 		Type:               ctype,
 		ModificationPolicy: modificationPolicyID,
@@ -61,7 +63,7 @@ func (b *bootstrapper) makeSignedConfigurationItem(id string, ctype ab.Configura
 		Value:              data,
 	})
 	return &ab.SignedConfigurationItem{
-		Configuration: configurationBytes,
+		ConfigurationItem: configurationBytes,
 	}
 }
 
diff --git a/orderer/common/broadcastfilter/configfilter/configfilter.go b/orderer/common/broadcastfilter/configfilter/configfilter.go
index fe9d2daf852..7fc48b4e961 100644
--- a/orderer/common/broadcastfilter/configfilter/configfilter.go
+++ b/orderer/common/broadcastfilter/configfilter/configfilter.go
@@ -44,7 +44,7 @@ func (cf *configFilter) Apply(message *cb.Envelope) broadcastfilter.Action {
 		return broadcastfilter.Forward
 	}
 
-	if msgData.Header == nil || msgData.Header.Type != cb.Header_CONFIGURATION_TRANSACTION {
+	if msgData.Header == nil || msgData.Header.ChainHeader == nil || msgData.Header.ChainHeader.Type != int32(cb.HeaderType_CONFIGURATION_TRANSACTION) {
 		return broadcastfilter.Forward
 	}
 
diff --git a/orderer/common/broadcastfilter/configfilter/configfilter_test.go b/orderer/common/broadcastfilter/configfilter/configfilter_test.go
index 7032bfdbb05..3050f708a68 100644
--- a/orderer/common/broadcastfilter/configfilter/configfilter_test.go
+++ b/orderer/common/broadcastfilter/configfilter/configfilter_test.go
@@ -52,7 +52,7 @@ func TestForwardNonConfig(t *testing.T) {
 func TestAcceptGoodConfig(t *testing.T) {
 	cf := New(&mockConfigManager{})
 	config, _ := proto.Marshal(&ab.ConfigurationEnvelope{})
-	configBytes, _ := proto.Marshal(&cb.Payload{Header: &cb.Header{Type: cb.Header_CONFIGURATION_TRANSACTION}, Data: config})
+	configBytes, _ := proto.Marshal(&cb.Payload{Header: &cb.Header{ChainHeader: &cb.ChainHeader{Type: int32(cb.HeaderType_CONFIGURATION_TRANSACTION)}}, Data: config})
 	result := cf.Apply(&cb.Envelope{
 		Payload: configBytes,
 	})
@@ -64,7 +64,7 @@ func TestAcceptGoodConfig(t *testing.T) {
 func TestRejectBadConfig(t *testing.T) {
 	cf := New(&mockConfigManager{err: fmt.Errorf("Error")})
 	config, _ := proto.Marshal(&ab.ConfigurationEnvelope{})
-	configBytes, _ := proto.Marshal(&cb.Payload{Header: &cb.Header{Type: cb.Header_CONFIGURATION_TRANSACTION}, Data: config})
+	configBytes, _ := proto.Marshal(&cb.Payload{Header: &cb.Header{ChainHeader: &cb.ChainHeader{Type: int32(cb.HeaderType_CONFIGURATION_TRANSACTION)}}, Data: config})
 	result := cf.Apply(&cb.Envelope{
 		Payload: configBytes,
 	})
diff --git a/orderer/common/configtx/configtx.go b/orderer/common/configtx/configtx.go
index f72f28dc3c8..e1f57cc53da 100644
--- a/orderer/common/configtx/configtx.go
+++ b/orderer/common/configtx/configtx.go
@@ -56,7 +56,7 @@ const DefaultModificationPolicyID = "DefaultModificationPolicy"
 
 type acceptAllPolicy struct{}
 
-func (ap *acceptAllPolicy) Evaluate(msg []byte, sigs []*cb.Envelope) error {
+func (ap *acceptAllPolicy) Evaluate(headers [][]byte, payload []byte, identities [][]byte, signatures [][]byte) error {
 	return nil
 }
 
@@ -142,14 +142,14 @@ func (cm *configurationManager) processConfig(configtx *ab.ConfigurationEnvelope
 	for _, entry := range configtx.Items {
 		// Verify every entry is well formed
 		config := &ab.ConfigurationItem{}
-		err = proto.Unmarshal(entry.Configuration, config)
+		err = proto.Unmarshal(entry.ConfigurationItem, config)
 		if err != nil {
 			return nil, err
 		}
 
 		// Ensure this configuration was intended for this chain
-		if !bytes.Equal(config.ChainID, cm.chainID) {
-			return nil, fmt.Errorf("Config item %v for type %v was not meant for a different chain %x", config.Key, config.Type, config.ChainID)
+		if !bytes.Equal(config.Header.ChainID, cm.chainID) {
+			return nil, fmt.Errorf("Config item %v for type %v was not meant for a different chain %x", config.Key, config.Type, config.Header.ChainID)
 		}
 
 		// Get the modification policy for this config item if one was previously specified
@@ -162,8 +162,23 @@ func (cm *configurationManager) processConfig(configtx *ab.ConfigurationEnvelope
 			policy = defaultModificationPolicy
 		}
 
+		headers := make([][]byte, len(entry.Signatures))
+		signatures := make([][]byte, len(entry.Signatures))
+		identities := make([][]byte, len(entry.Signatures))
+
+		for i, configSig := range entry.Signatures {
+			headers[i] = configSig.Signature
+			signatures[i] = configSig.SignatureHeader
+			sigHeader := &cb.SignatureHeader{}
+			err := proto.Unmarshal(configSig.SignatureHeader, sigHeader)
+			if err != nil {
+				return nil, err
+			}
+			identities[i] = sigHeader.Creator
+		}
+
 		// Ensure the policy is satisfied
-		if err = policy.Evaluate(entry.Configuration, entry.Signatures); err != nil {
+		if err = policy.Evaluate(headers, entry.ConfigurationItem, identities, signatures); err != nil {
 			return nil, err
 		}
 
diff --git a/orderer/common/configtx/configtx_test.go b/orderer/common/configtx/configtx_test.go
index 5c0721437e1..94e184277ef 100644
--- a/orderer/common/configtx/configtx_test.go
+++ b/orderer/common/configtx/configtx_test.go
@@ -42,7 +42,7 @@ type mockPolicy struct {
 	policyResult error
 }
 
-func (mp *mockPolicy) Evaluate(msg []byte, sigs []*cb.Envelope) error {
+func (mp *mockPolicy) Evaluate(headers [][]byte, payload []byte, identities [][]byte, signatures [][]byte) error {
 	if mp == nil {
 		return fmt.Errorf("Invoked nil policy")
 	}
@@ -60,7 +60,7 @@ func (mpm *mockPolicyManager) GetPolicy(id string) (policies.Policy, bool) {
 
 func makeConfiguration(id, modificationPolicy string, lastModified uint64, data []byte) *ab.ConfigurationItem {
 	return &ab.ConfigurationItem{
-		ChainID:            defaultChain,
+		Header:             &cb.ChainHeader{ChainID: defaultChain},
 		ModificationPolicy: modificationPolicy,
 		LastModified:       lastModified,
 		Key:                id,
@@ -75,7 +75,7 @@ func makeSignedConfigurationItem(id, modificationPolicy string, lastModified uin
 		panic(err)
 	}
 	return &ab.SignedConfigurationItem{
-		Configuration: marshaledConfig,
+		ConfigurationItem: marshaledConfig,
 	}
 }
 
@@ -148,7 +148,7 @@ func TestOldConfigReplay(t *testing.T) {
 // TestInvalidInitialConfigByStructure tests to make sure that if the config contains corrupted configuration that construction results in error
 func TestInvalidInitialConfigByStructure(t *testing.T) {
 	entries := []*ab.SignedConfigurationItem{makeSignedConfigurationItem("foo", "foo", 0, []byte("foo"))}
-	entries[0].Configuration = []byte("Corrupted")
+	entries[0].ConfigurationItem = []byte("Corrupted")
 	_, err := NewConfigurationManager(&ab.ConfigurationEnvelope{
 		Sequence: 0,
 		ChainID:  defaultChain,
@@ -477,7 +477,7 @@ func TestConfigItemOnWrongChain(t *testing.T) {
 	}
 
 	config := makeConfiguration("foo", "foo", 1, []byte("foo"))
-	config.ChainID = []byte("Wrong")
+	config.Header = &cb.ChainHeader{ChainID: []byte("Wrong")}
 	marshaledConfig, err := proto.Marshal(config)
 	if err != nil {
 		t.Fatalf("Should have been able marshal config: %s", err)
@@ -485,7 +485,7 @@ func TestConfigItemOnWrongChain(t *testing.T) {
 	newConfig := &ab.ConfigurationEnvelope{
 		Sequence: 1,
 		ChainID:  defaultChain,
-		Items:    []*ab.SignedConfigurationItem{&ab.SignedConfigurationItem{Configuration: marshaledConfig}},
+		Items:    []*ab.SignedConfigurationItem{&ab.SignedConfigurationItem{ConfigurationItem: marshaledConfig}},
 	}
 
 	err = cm.Validate(newConfig)
diff --git a/orderer/common/policies/policy.go b/orderer/common/policies/policy.go
index b12a615a8e4..ce0175f8ada 100644
--- a/orderer/common/policies/policy.go
+++ b/orderer/common/policies/policy.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 
 	"github.com/hyperledger/fabric/orderer/common/cauthdsl"
-	cb "github.com/hyperledger/fabric/protos/common"
 	ab "github.com/hyperledger/fabric/protos/orderer"
 
 	"github.com/golang/protobuf/proto"
@@ -28,8 +27,8 @@ import (
 
 // Policy is used to determine if a signature is valid
 type Policy interface {
-	// Evaluate returns nil if a msg is properly signed by sigs, or an error indicating why it failed
-	Evaluate(msg []byte, sigs []*cb.Envelope) error
+	// Evaluate returns nil if a digest is properly signed by sigs, or an error indicating why it failed
+	Evaluate(header [][]byte, payload []byte, identities [][]byte, signatures [][]byte) error
 }
 
 // Manager is intended to be the primary accessor of ManagerImpl
@@ -70,24 +69,15 @@ func newPolicy(policySource *ab.Policy, ch cauthdsl.CryptoHelper) (*policy, erro
 }
 
 // Evaluate returns nil if a msg is properly signed by sigs, or an error indicating why it failed
-func (p *policy) Evaluate(msg []byte, sigs []*cb.Envelope) error {
+// For each identity, it concatenates the corresponding header and the payload together, then
+// verifies the corresponding signature.
+func (p *policy) Evaluate(header [][]byte, payload []byte, identities [][]byte, signatures [][]byte) error {
 	if p == nil {
 		return fmt.Errorf("Evaluated default policy, results in reject")
 	}
 
-	identities := make([][]byte, len(sigs))
-	signatures := make([][]byte, len(sigs))
-	for i, sigpair := range sigs {
-		payload := &cb.Payload{}
-		if err := proto.Unmarshal(sigpair.Payload, payload); err != nil {
-			return fmt.Errorf("Failed to unmarshal the payload to extract the signatures")
-		}
-		identities[i] = payload.Header.Creator
-		signatures[i] = sigpair.Signature
-	}
-
 	// XXX This is wrong, as the signatures are over the payload envelope, not the message, fix either here, or in cauthdsl once transaction is finalized
-	if !p.evaluator.Authenticate(msg, identities, signatures) {
+	if !p.evaluator.Authenticate(payload, identities, signatures) {
 		return fmt.Errorf("Failed to authenticate policy")
 	}
 	return nil
diff --git a/orderer/common/policies/policy_test.go b/orderer/common/policies/policy_test.go
index f6efde05647..2fc9b004bcb 100644
--- a/orderer/common/policies/policy_test.go
+++ b/orderer/common/policies/policy_test.go
@@ -79,7 +79,7 @@ func TestAccept(t *testing.T) {
 	if !ok {
 		t.Errorf("Should have found policy which was just added, but did not")
 	}
-	err := policy.Evaluate(nil, nil)
+	err := policy.Evaluate(nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Should not have errored evaluating an acceptAll policy: %s", err)
 	}
@@ -93,7 +93,7 @@ func TestReject(t *testing.T) {
 	if !ok {
 		t.Errorf("Should have found policy which was just added, but did not")
 	}
-	err := policy.Evaluate(nil, nil)
+	err := policy.Evaluate(nil, nil, nil, nil)
 	if err == nil {
 		t.Fatalf("Should have errored evaluating the rejectAll policy")
 	}
@@ -105,7 +105,7 @@ func TestRejectOnUnknown(t *testing.T) {
 	if ok {
 		t.Errorf("Should not have found policy which was never added, but did")
 	}
-	err := policy.Evaluate(nil, nil)
+	err := policy.Evaluate(nil, nil, nil, nil)
 	if err == nil {
 		t.Fatalf("Should have errored evaluating the default policy")
 	}
diff --git a/protos/common/common.pb.go b/protos/common/common.pb.go
index 04cd0870f9c..37193555300 100644
--- a/protos/common/common.pb.go
+++ b/protos/common/common.pb.go
@@ -10,6 +10,8 @@ It is generated from these files:
 
 It has these top-level messages:
 	Header
+	ChainHeader
+	SignatureHeader
 	Payload
 	Envelope
 	Block
@@ -35,45 +37,36 @@ var _ = math.Inf
 // proto package needs to be updated.
 const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
-type Header_Type int32
+type HeaderType int32
 
 const (
-	Header_MESSAGE                   Header_Type = 0
-	Header_CONFIGURATION_TRANSACTION Header_Type = 1
-	Header_CONFIGURATION_ITEM        Header_Type = 2
+	HeaderType_MESSAGE                   HeaderType = 0
+	HeaderType_CONFIGURATION_TRANSACTION HeaderType = 1
+	HeaderType_CONFIGURATION_ITEM        HeaderType = 2
+	HeaderType_ENDORSER_TRANSACTION      HeaderType = 3
 )
 
-var Header_Type_name = map[int32]string{
+var HeaderType_name = map[int32]string{
 	0: "MESSAGE",
 	1: "CONFIGURATION_TRANSACTION",
 	2: "CONFIGURATION_ITEM",
+	3: "ENDORSER_TRANSACTION",
 }
-var Header_Type_value = map[string]int32{
+var HeaderType_value = map[string]int32{
 	"MESSAGE":                   0,
 	"CONFIGURATION_TRANSACTION": 1,
 	"CONFIGURATION_ITEM":        2,
+	"ENDORSER_TRANSACTION":      3,
 }
 
-func (x Header_Type) String() string {
-	return proto.EnumName(Header_Type_name, int32(x))
+func (x HeaderType) String() string {
+	return proto.EnumName(HeaderType_name, int32(x))
 }
-func (Header_Type) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0} }
+func (HeaderType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-// Header is a generic replay prevention and identity message to include in a signed payload
 type Header struct {
-	// Version indicates message protocol version
-	Version int32 `protobuf:"varint,1,opt,name=version" json:"version,omitempty"`
-	// Timestamp is the local time when the message was created
-	// by the sender
-	Timestamp *google_protobuf.Timestamp `protobuf:"bytes,2,opt,name=timestamp" json:"timestamp,omitempty"`
-	// Type of the transaction
-	Type Header_Type `protobuf:"varint,3,opt,name=type,enum=common.Header_Type" json:"type,omitempty"`
-	// Creator of the message, specified as a certificate chain
-	Creator []byte `protobuf:"bytes,4,opt,name=creator,proto3" json:"creator,omitempty"`
-	// Arbitrary number that may only be used once. Can be used to detect replay attacks.
-	Nonce []byte `protobuf:"bytes,5,opt,name=nonce,proto3" json:"nonce,omitempty"`
-	// Identifier of the chain this message is bound for
-	ChainID []byte `protobuf:"bytes,6,opt,name=chainID,proto3" json:"chainID,omitempty"`
+	ChainHeader     *ChainHeader     `protobuf:"bytes,1,opt,name=chainHeader" json:"chainHeader,omitempty"`
+	SignatureHeader *SignatureHeader `protobuf:"bytes,2,opt,name=signatureHeader" json:"signatureHeader,omitempty"`
 }
 
 func (m *Header) Reset()                    { *m = Header{} }
@@ -81,13 +74,58 @@ func (m *Header) String() string            { return proto.CompactTextString(m)
 func (*Header) ProtoMessage()               {}
 func (*Header) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
-func (m *Header) GetTimestamp() *google_protobuf.Timestamp {
+func (m *Header) GetChainHeader() *ChainHeader {
+	if m != nil {
+		return m.ChainHeader
+	}
+	return nil
+}
+
+func (m *Header) GetSignatureHeader() *SignatureHeader {
+	if m != nil {
+		return m.SignatureHeader
+	}
+	return nil
+}
+
+// Header is a generic replay prevention and identity message to include in a signed payload
+type ChainHeader struct {
+	Type int32 `protobuf:"varint,1,opt,name=Type" json:"Type,omitempty"`
+	// Version indicates message protocol version
+	Version int32 `protobuf:"varint,2,opt,name=version" json:"version,omitempty"`
+	// Timestamp is the local time when the message was created
+	// by the sender
+	Timestamp *google_protobuf.Timestamp `protobuf:"bytes,3,opt,name=timestamp" json:"timestamp,omitempty"`
+	// Identifier of the chain this message is bound for
+	ChainID []byte `protobuf:"bytes,4,opt,name=chainID,proto3" json:"chainID,omitempty"`
+}
+
+func (m *ChainHeader) Reset()                    { *m = ChainHeader{} }
+func (m *ChainHeader) String() string            { return proto.CompactTextString(m) }
+func (*ChainHeader) ProtoMessage()               {}
+func (*ChainHeader) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+
+func (m *ChainHeader) GetTimestamp() *google_protobuf.Timestamp {
 	if m != nil {
 		return m.Timestamp
 	}
 	return nil
 }
 
+type SignatureHeader struct {
+	// Creator of the message, specified as a certificate chain
+	Creator []byte `protobuf:"bytes,1,opt,name=creator,proto3" json:"creator,omitempty"`
+	// Arbitrary number that may only be used once. Can be used to detect replay attacks.
+	Nonce []byte `protobuf:"bytes,2,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// The epoch in which this header was generated, where epoch is defined based on block height
+	Epoch uint64 `protobuf:"varint,3,opt,name=epoch" json:"epoch,omitempty"`
+}
+
+func (m *SignatureHeader) Reset()                    { *m = SignatureHeader{} }
+func (m *SignatureHeader) String() string            { return proto.CompactTextString(m) }
+func (*SignatureHeader) ProtoMessage()               {}
+func (*SignatureHeader) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+
 // Payload is the message contents (and header to allow for signing)
 type Payload struct {
 	// Header is included to provide identity and prevent replay
@@ -99,7 +137,7 @@ type Payload struct {
 func (m *Payload) Reset()                    { *m = Payload{} }
 func (m *Payload) String() string            { return proto.CompactTextString(m) }
 func (*Payload) ProtoMessage()               {}
-func (*Payload) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{1} }
+func (*Payload) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
 
 func (m *Payload) GetHeader() *Header {
 	if m != nil {
@@ -119,7 +157,7 @@ type Envelope struct {
 func (m *Envelope) Reset()                    { *m = Envelope{} }
 func (m *Envelope) String() string            { return proto.CompactTextString(m) }
 func (*Envelope) ProtoMessage()               {}
-func (*Envelope) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+func (*Envelope) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
 
 // This is finalized block structure to be shared among the orderer and peer
 // Note that the BlockHeader chains to the previous BlockHeader, and the BlockData hash is embedded
@@ -134,7 +172,7 @@ type Block struct {
 func (m *Block) Reset()                    { *m = Block{} }
 func (m *Block) String() string            { return proto.CompactTextString(m) }
 func (*Block) ProtoMessage()               {}
-func (*Block) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
+func (*Block) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
 
 func (m *Block) GetHeader() *BlockHeader {
 	if m != nil {
@@ -166,7 +204,7 @@ type BlockHeader struct {
 func (m *BlockHeader) Reset()                    { *m = BlockHeader{} }
 func (m *BlockHeader) String() string            { return proto.CompactTextString(m) }
 func (*BlockHeader) ProtoMessage()               {}
-func (*BlockHeader) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+func (*BlockHeader) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
 
 type BlockData struct {
 	Data [][]byte `protobuf:"bytes,1,rep,name=Data,proto3" json:"Data,omitempty"`
@@ -175,7 +213,7 @@ type BlockData struct {
 func (m *BlockData) Reset()                    { *m = BlockData{} }
 func (m *BlockData) String() string            { return proto.CompactTextString(m) }
 func (*BlockData) ProtoMessage()               {}
-func (*BlockData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+func (*BlockData) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
 
 type BlockMetadata struct {
 	Metadata [][]byte `protobuf:"bytes,1,rep,name=Metadata,proto3" json:"Metadata,omitempty"`
@@ -184,52 +222,57 @@ type BlockMetadata struct {
 func (m *BlockMetadata) Reset()                    { *m = BlockMetadata{} }
 func (m *BlockMetadata) String() string            { return proto.CompactTextString(m) }
 func (*BlockMetadata) ProtoMessage()               {}
-func (*BlockMetadata) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
+func (*BlockMetadata) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
 
 func init() {
 	proto.RegisterType((*Header)(nil), "common.Header")
+	proto.RegisterType((*ChainHeader)(nil), "common.ChainHeader")
+	proto.RegisterType((*SignatureHeader)(nil), "common.SignatureHeader")
 	proto.RegisterType((*Payload)(nil), "common.Payload")
 	proto.RegisterType((*Envelope)(nil), "common.Envelope")
 	proto.RegisterType((*Block)(nil), "common.Block")
 	proto.RegisterType((*BlockHeader)(nil), "common.BlockHeader")
 	proto.RegisterType((*BlockData)(nil), "common.BlockData")
 	proto.RegisterType((*BlockMetadata)(nil), "common.BlockMetadata")
-	proto.RegisterEnum("common.Header_Type", Header_Type_name, Header_Type_value)
+	proto.RegisterEnum("common.HeaderType", HeaderType_name, HeaderType_value)
 }
 
 func init() { proto.RegisterFile("common/common.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 494 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x54, 0x53, 0x5f, 0x8f, 0xd2, 0x4e,
-	0x14, 0xfd, 0x15, 0x4a, 0x81, 0x0b, 0xbf, 0x0d, 0xce, 0xea, 0xa6, 0x12, 0xcd, 0x92, 0x26, 0x2a,
-	0x09, 0xb1, 0x44, 0x7c, 0xf1, 0x15, 0x76, 0x71, 0x17, 0x13, 0xd8, 0xcd, 0x80, 0x2f, 0xbe, 0x98,
-	0x69, 0x99, 0x6d, 0x1b, 0xdb, 0x4e, 0x33, 0x6d, 0x49, 0xf8, 0x12, 0x7e, 0x01, 0xbf, 0xac, 0x99,
-	0x3f, 0xed, 0xda, 0xa7, 0xce, 0xb9, 0xe7, 0xf4, 0xde, 0x73, 0xee, 0x64, 0xe0, 0xd2, 0x67, 0x49,
-	0xc2, 0xd2, 0xb9, 0xfa, 0xb8, 0x19, 0x67, 0x05, 0x43, 0x96, 0x42, 0xe3, 0xeb, 0x80, 0xb1, 0x20,
-	0xa6, 0x73, 0x59, 0xf5, 0xca, 0xa7, 0x79, 0x11, 0x25, 0x34, 0x2f, 0x48, 0x92, 0x29, 0xa1, 0xf3,
-	0xa7, 0x05, 0xd6, 0x3d, 0x25, 0x47, 0xca, 0x91, 0x0d, 0xdd, 0x13, 0xe5, 0x79, 0xc4, 0x52, 0xdb,
-	0x98, 0x18, 0xd3, 0x0e, 0xae, 0x20, 0xfa, 0x02, 0xfd, 0xfa, 0x3f, 0xbb, 0x35, 0x31, 0xa6, 0x83,
-	0xc5, 0xd8, 0x55, 0x9d, 0xdd, 0xaa, 0xb3, 0x7b, 0xa8, 0x14, 0xf8, 0x59, 0x8c, 0x3e, 0x80, 0x59,
-	0x9c, 0x33, 0x6a, 0xb7, 0x27, 0xc6, 0xf4, 0x62, 0x71, 0xe9, 0x6a, 0x93, 0x6a, 0xa2, 0x7b, 0x38,
-	0x67, 0x14, 0x4b, 0x81, 0x18, 0xee, 0x73, 0x4a, 0x0a, 0xc6, 0x6d, 0x73, 0x62, 0x4c, 0x87, 0xb8,
-	0x82, 0xe8, 0x25, 0x74, 0x52, 0x96, 0xfa, 0xd4, 0xee, 0xc8, 0xba, 0x02, 0x52, 0x1f, 0x92, 0x28,
-	0xdd, 0xdc, 0xda, 0x96, 0xd6, 0x2b, 0xe8, 0x7c, 0x03, 0x53, 0xf4, 0x45, 0x03, 0xe8, 0x6e, 0xd7,
-	0xfb, 0xfd, 0xf2, 0x6e, 0x3d, 0xfa, 0x0f, 0xbd, 0x85, 0xd7, 0x37, 0x0f, 0xbb, 0xaf, 0x9b, 0xbb,
-	0xef, 0x78, 0x79, 0xd8, 0x3c, 0xec, 0x7e, 0x1e, 0xf0, 0x72, 0xb7, 0x5f, 0xde, 0x88, 0xf3, 0xc8,
-	0x40, 0x57, 0x80, 0x9a, 0xf4, 0xe6, 0xb0, 0xde, 0x8e, 0x5a, 0xce, 0x1a, 0xba, 0x8f, 0xe4, 0x1c,
-	0x33, 0x72, 0x44, 0xef, 0xc1, 0x0a, 0xa5, 0x6b, 0xb9, 0x9c, 0xc1, 0xe2, 0xa2, 0x99, 0x05, 0x6b,
-	0x16, 0x21, 0x30, 0x8f, 0xa4, 0x20, 0x72, 0x4d, 0x43, 0x2c, 0xcf, 0xce, 0x0a, 0x7a, 0xeb, 0xf4,
-	0x44, 0x63, 0xa6, 0x82, 0x66, 0xaa, 0xa5, 0x6c, 0x34, 0xc4, 0x15, 0x44, 0x6f, 0xa0, 0x9f, 0x47,
-	0x41, 0x4a, 0x8a, 0x92, 0x53, 0xfd, 0xfb, 0x73, 0xc1, 0xf9, 0x6d, 0x40, 0x67, 0x15, 0x33, 0xff,
-	0x17, 0x9a, 0x55, 0x37, 0xa6, 0x9d, 0xd4, 0x5b, 0x95, 0x74, 0x65, 0x47, 0x5f, 0xea, 0x3b, 0x30,
-	0x6f, 0x2b, 0x3b, 0x83, 0xc5, 0x8b, 0x86, 0x54, 0x10, 0x58, 0xd2, 0xe8, 0x13, 0xf4, 0xb6, 0xb4,
-	0x20, 0xd2, 0x79, 0x5b, 0x4a, 0x5f, 0x35, 0xa4, 0x15, 0x89, 0x6b, 0x99, 0x43, 0x61, 0xf0, 0xcf,
-	0x40, 0x74, 0x05, 0xd6, 0xae, 0x4c, 0x3c, 0xed, 0xca, 0xc4, 0x1a, 0x21, 0x07, 0x86, 0x8f, 0x9c,
-	0x9e, 0x22, 0x56, 0xe6, 0xf7, 0x24, 0x0f, 0x75, 0xb0, 0x46, 0x0d, 0x8d, 0xa1, 0x27, 0x5c, 0x48,
-	0xbe, 0x2d, 0xf9, 0x1a, 0x3b, 0xd7, 0xd0, 0xaf, 0xcd, 0x8a, 0xe5, 0xca, 0x34, 0xc6, 0xa4, 0x2d,
-	0x96, 0x2b, 0xce, 0xce, 0x0c, 0xfe, 0x6f, 0x58, 0x14, 0xdd, 0xea, 0x2c, 0x4a, 0x58, 0xe3, 0xd5,
-	0xc7, 0x1f, 0xb3, 0x20, 0x2a, 0xc2, 0xd2, 0x13, 0xe9, 0xe6, 0xe1, 0x39, 0xa3, 0x3c, 0xa6, 0xc7,
-	0x80, 0xf2, 0xf9, 0x13, 0xf1, 0x78, 0xe4, 0xab, 0x87, 0x92, 0xeb, 0xc7, 0xe4, 0x59, 0x12, 0x7e,
-	0xfe, 0x1b, 0x00, 0x00, 0xff, 0xff, 0x3d, 0xc8, 0xca, 0x95, 0x64, 0x03, 0x00, 0x00,
+	// 541 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x5c, 0x54, 0x5d, 0x8f, 0xd2, 0x40,
+	0x14, 0xb5, 0xcb, 0xf7, 0x2d, 0xba, 0x38, 0xbb, 0xae, 0x48, 0x34, 0x4b, 0x26, 0xd1, 0x6c, 0x24,
+	0x42, 0x5c, 0x63, 0xe2, 0x2b, 0x1f, 0x75, 0x97, 0x07, 0x60, 0x33, 0x60, 0x4c, 0x7c, 0x31, 0x43,
+	0x99, 0xa5, 0x55, 0xe8, 0x34, 0xfd, 0x20, 0xe1, 0xd5, 0x1f, 0xa0, 0x7f, 0xd9, 0xcc, 0x57, 0xa1,
+	0x3c, 0x31, 0xe7, 0x9e, 0x73, 0x6f, 0xcf, 0x3d, 0x1d, 0x0a, 0x17, 0x2e, 0xdf, 0x6e, 0x79, 0xd0,
+	0x53, 0x3f, 0xdd, 0x30, 0xe2, 0x09, 0x47, 0x65, 0x85, 0x5a, 0xd7, 0x6b, 0xce, 0xd7, 0x1b, 0xd6,
+	0x93, 0xd5, 0x65, 0xfa, 0xd8, 0x4b, 0xfc, 0x2d, 0x8b, 0x13, 0xba, 0x0d, 0x95, 0x10, 0xff, 0xb1,
+	0xa0, 0x7c, 0xcf, 0xe8, 0x8a, 0x45, 0xe8, 0x33, 0xd8, 0xae, 0x47, 0xfd, 0x40, 0xc1, 0xa6, 0xd5,
+	0xb6, 0x6e, 0xec, 0xdb, 0x8b, 0xae, 0x9e, 0x3b, 0x3c, 0x50, 0xe4, 0x58, 0x87, 0xfa, 0x70, 0x1e,
+	0xfb, 0xeb, 0x80, 0x26, 0x69, 0xc4, 0x74, 0xeb, 0x99, 0x6c, 0x7d, 0x69, 0x5a, 0xe7, 0x79, 0x9a,
+	0x9c, 0xea, 0xf1, 0x3f, 0x0b, 0xec, 0xa3, 0xf9, 0x08, 0x41, 0x71, 0xb1, 0x0f, 0x99, 0xb4, 0x50,
+	0x22, 0xf2, 0x8c, 0x9a, 0x50, 0xd9, 0xb1, 0x28, 0xf6, 0x79, 0x20, 0xc7, 0x97, 0x88, 0x81, 0xe8,
+	0x0b, 0xd4, 0xb2, 0xad, 0x9a, 0x05, 0xf9, 0xe8, 0x56, 0x57, 0xed, 0xdd, 0x35, 0x7b, 0x77, 0x17,
+	0x46, 0x41, 0x0e, 0x62, 0x31, 0x53, 0x6e, 0x32, 0x1e, 0x35, 0x8b, 0x6d, 0xeb, 0xa6, 0x4e, 0x0c,
+	0xc4, 0xdf, 0xe1, 0xfc, 0xc4, 0xb5, 0x14, 0x47, 0x8c, 0x26, 0x5c, 0x45, 0x23, 0xc4, 0x0a, 0xa2,
+	0x4b, 0x28, 0x05, 0x3c, 0x70, 0x99, 0x34, 0x56, 0x27, 0x0a, 0x88, 0x2a, 0x0b, 0xb9, 0xeb, 0x49,
+	0x4b, 0x45, 0xa2, 0x00, 0x76, 0xa0, 0xf2, 0x40, 0xf7, 0x1b, 0x4e, 0x57, 0xe8, 0x1d, 0x94, 0xbd,
+	0xe3, 0xa8, 0x9f, 0x99, 0xbc, 0x74, 0x4c, 0x9a, 0x15, 0x69, 0xac, 0x68, 0x42, 0xf5, 0x74, 0x79,
+	0xc6, 0x03, 0xa8, 0x3a, 0xc1, 0x8e, 0x6d, 0xb8, 0x4a, 0x26, 0x54, 0x23, 0x8d, 0x31, 0x0d, 0xd1,
+	0x6b, 0xa8, 0x65, 0x51, 0xeb, 0xf6, 0x43, 0x01, 0xff, 0xb5, 0xa0, 0x34, 0xd8, 0x70, 0xf7, 0x37,
+	0xea, 0x98, 0x3b, 0x70, 0xfa, 0xd2, 0x25, 0x6d, 0xec, 0xe8, 0x1c, 0xde, 0x42, 0x71, 0x64, 0xec,
+	0xd8, 0xb7, 0xcf, 0x73, 0x52, 0x41, 0x10, 0x49, 0xa3, 0x8f, 0x50, 0x9d, 0xb0, 0x84, 0x4a, 0xe7,
+	0xea, 0xa5, 0xbc, 0xc8, 0x49, 0x0d, 0x49, 0x32, 0x19, 0x66, 0x60, 0x1f, 0x3d, 0x10, 0x5d, 0x41,
+	0x79, 0x9a, 0x6e, 0x97, 0xda, 0x55, 0x91, 0x68, 0x84, 0x30, 0xd4, 0x1f, 0x22, 0xb6, 0xf3, 0x79,
+	0x1a, 0xdf, 0xd3, 0xd8, 0xd3, 0x8b, 0xe5, 0x6a, 0xa8, 0x05, 0x55, 0xe1, 0x42, 0xf2, 0x05, 0xc9,
+	0x67, 0x18, 0x5f, 0x43, 0x2d, 0x33, 0x2b, 0xc2, 0x95, 0xdb, 0x58, 0xed, 0x82, 0x08, 0x57, 0x9c,
+	0x71, 0x07, 0x9e, 0xe6, 0x2c, 0x8a, 0x69, 0xd9, 0x2e, 0x4a, 0x98, 0xe1, 0xf7, 0xbf, 0x00, 0x94,
+	0x5f, 0x79, 0x4b, 0x6d, 0xa8, 0x4c, 0x9c, 0xf9, 0xbc, 0x7f, 0xe7, 0x34, 0x9e, 0xa0, 0x37, 0xf0,
+	0x6a, 0x38, 0x9b, 0x7e, 0x1d, 0xdf, 0x7d, 0x23, 0xfd, 0xc5, 0x78, 0x36, 0xfd, 0xb9, 0x20, 0xfd,
+	0xe9, 0xbc, 0x3f, 0x14, 0xe7, 0x86, 0x85, 0xae, 0x00, 0xe5, 0xe9, 0xf1, 0xc2, 0x99, 0x34, 0xce,
+	0x50, 0x13, 0x2e, 0x9d, 0xe9, 0x68, 0x46, 0xe6, 0x0e, 0xc9, 0x75, 0x14, 0x06, 0x1f, 0x7e, 0x74,
+	0xd6, 0x7e, 0xe2, 0xa5, 0x4b, 0x91, 0x64, 0xcf, 0xdb, 0x87, 0x2c, 0xda, 0xb0, 0xd5, 0x9a, 0x45,
+	0xbd, 0x47, 0xba, 0x8c, 0x7c, 0x57, 0xfd, 0xcd, 0x63, 0xfd, 0x29, 0x58, 0x96, 0x25, 0xfc, 0xf4,
+	0x3f, 0x00, 0x00, 0xff, 0xff, 0x34, 0x1c, 0x38, 0x98, 0x22, 0x04, 0x00, 0x00,
 }
diff --git a/protos/common/common.proto b/protos/common/common.proto
index a015b7747a0..3c10600f3f3 100644
--- a/protos/common/common.proto
+++ b/protos/common/common.proto
@@ -22,32 +22,42 @@ option go_package = "github.com/hyperledger/fabric/protos/common";
 
 package common;
 
-// Header is a generic replay prevention and identity message to include in a signed payload
-message Header {
-    enum Type {
+enum HeaderType {
         MESSAGE = 0;                   // Used for messages which are signed but opaque
         CONFIGURATION_TRANSACTION = 1; // Used for messages which reconfigure the chain
         CONFIGURATION_ITEM = 2;        // Used inside of the the reconfiguration message for signing over ConfigurationItems
-    }
+        ENDORSER_TRANSACTION = 3;      // Used by the SDK to submit endorser based transactions
+}
+
+message Header {
+    ChainHeader chainHeader = 1;
+    SignatureHeader signatureHeader = 2;
+}
+
+// Header is a generic replay prevention and identity message to include in a signed payload
+message ChainHeader {
+    int32 type = 1; // Header types 0-10000 are reserved and defined by HeaderType
 
     // Version indicates message protocol version
-    int32 version = 1;
+    int32 version = 2;
 
     // Timestamp is the local time when the message was created
     // by the sender
-    google.protobuf.Timestamp timestamp = 2;
+    google.protobuf.Timestamp timestamp = 3;
 
-    // Type of the transaction
-    Type type = 3;
+    // Identifier of the chain this message is bound for
+    bytes chainID = 4;
+}
 
+message SignatureHeader {
     // Creator of the message, specified as a certificate chain
-    bytes creator = 4;
+    bytes creator = 1;
 
     // Arbitrary number that may only be used once. Can be used to detect replay attacks.
-    bytes nonce = 5;
+    bytes nonce = 2;
 
-    // Identifier of the chain this message is bound for
-    bytes chainID = 6;
+    // The epoch in which this header was generated, where epoch is defined based on block height
+    uint64 epoch = 3;
 }
 
 // Payload is the message contents (and header to allow for signing)
diff --git a/protos/orderer/ab.pb.go b/protos/orderer/ab.pb.go
index cc97634f267..11ed74bc47b 100644
--- a/protos/orderer/ab.pb.go
+++ b/protos/orderer/ab.pb.go
@@ -13,6 +13,7 @@ It has these top-level messages:
 	ConfigurationEnvelope
 	SignedConfigurationItem
 	ConfigurationItem
+	ConfigurationSignature
 	Policy
 	SignaturePolicyEnvelope
 	SignaturePolicy
@@ -136,7 +137,7 @@ var SeekInfo_StartType_value = map[string]int32{
 func (x SeekInfo_StartType) String() string {
 	return proto.EnumName(SeekInfo_StartType_name, int32(x))
 }
-func (SeekInfo_StartType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0} }
+func (SeekInfo_StartType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{8, 0} }
 
 type BroadcastResponse struct {
 	Status Status `protobuf:"varint,1,opt,name=Status,enum=orderer.Status" json:"Status,omitempty"`
@@ -152,12 +153,11 @@ func (*BroadcastResponse) Descriptor() ([]byte, []int) { return fileDescriptor0,
 //
 // It is generated with the following scheme:
 //   1. Retrieve the existing configuration
-//   2. Increment Sequence in the ConfigurationEnvelope
-//   3. Modify desired ConfigurationItems, setting each LastModified to the ConfigurationEnvelope Sequence
+//   2. Note the highest configuration sequence number, store it an increment it by one
+//   3. Modify desired ConfigurationItems, setting each LastModified to the stored and incremented sequence number
 //   4. Update SignedConfigurationItem with appropriate signatures over the modified ConfigurationItem
-//     a) Each signature is of type common.Envelope
-//     b) The common.Envelope common.Payload has data set to the hash of the ConfigurationItem
-//     c) The common.Envelope common.Payload has a header with the type set to common.Header.Type.CONFIGURATION_ITEM
+//     a) Each signature is of type ConfigurationSignature
+//     b) The ConfigurationSignature signature is over the concatenation of signatureHeader and the ConfigurationItem header
 //   5. Submit new Configuration for ordering in Envelope signed by submitter
 //     a) The common.Envelope common.Payload has data set to the marshaled ConfigurationEnvelope
 //     b) The common.Envelope common.Payload has a header of type common.Header.Type.CONFIGURATION_TRANSACTION
@@ -166,12 +166,12 @@ func (*BroadcastResponse) Descriptor() ([]byte, []int) { return fileDescriptor0,
 //   1. All configuration items and the envelope refer to the correct chain
 //   2. Some configuration item has been added or modified
 //   3. No existing configuration item has been ommitted
-//   4. All configuration changes have a LastModification equal to Sequence from the ConfigurationEnvelope
+//   4. All configuration changes have a LastModification of one more than the last configuration's sequence
 //   5. All configuration changes satisfy the corresponding modification policy
 type ConfigurationEnvelope struct {
-	Sequence uint64                     `protobuf:"varint,1,opt,name=Sequence" json:"Sequence,omitempty"`
+	Items    []*SignedConfigurationItem `protobuf:"bytes,1,rep,name=Items" json:"Items,omitempty"`
 	ChainID  []byte                     `protobuf:"bytes,2,opt,name=ChainID,proto3" json:"ChainID,omitempty"`
-	Items    []*SignedConfigurationItem `protobuf:"bytes,3,rep,name=Items" json:"Items,omitempty"`
+	Sequence uint64                     `protobuf:"varint,3,opt,name=Sequence" json:"Sequence,omitempty"`
 }
 
 func (m *ConfigurationEnvelope) Reset()                    { *m = ConfigurationEnvelope{} }
@@ -188,8 +188,8 @@ func (m *ConfigurationEnvelope) GetItems() []*SignedConfigurationItem {
 
 // This message may change slightly depending on the finalization of signature schemes for transactions
 type SignedConfigurationItem struct {
-	Configuration []byte             `protobuf:"bytes,1,opt,name=Configuration,proto3" json:"Configuration,omitempty"`
-	Signatures    []*common.Envelope `protobuf:"bytes,2,rep,name=Signatures" json:"Signatures,omitempty"`
+	ConfigurationItem []byte                    `protobuf:"bytes,1,opt,name=ConfigurationItem,proto3" json:"ConfigurationItem,omitempty"`
+	Signatures        []*ConfigurationSignature `protobuf:"bytes,2,rep,name=Signatures" json:"Signatures,omitempty"`
 }
 
 func (m *SignedConfigurationItem) Reset()                    { *m = SignedConfigurationItem{} }
@@ -197,7 +197,7 @@ func (m *SignedConfigurationItem) String() string            { return proto.Comp
 func (*SignedConfigurationItem) ProtoMessage()               {}
 func (*SignedConfigurationItem) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
 
-func (m *SignedConfigurationItem) GetSignatures() []*common.Envelope {
+func (m *SignedConfigurationItem) GetSignatures() []*ConfigurationSignature {
 	if m != nil {
 		return m.Signatures
 	}
@@ -205,9 +205,9 @@ func (m *SignedConfigurationItem) GetSignatures() []*common.Envelope {
 }
 
 type ConfigurationItem struct {
-	ChainID            []byte                              `protobuf:"bytes,1,opt,name=ChainID,proto3" json:"ChainID,omitempty"`
-	LastModified       uint64                              `protobuf:"varint,2,opt,name=LastModified" json:"LastModified,omitempty"`
-	Type               ConfigurationItem_ConfigurationType `protobuf:"varint,3,opt,name=Type,enum=orderer.ConfigurationItem_ConfigurationType" json:"Type,omitempty"`
+	Header             *common.ChainHeader                 `protobuf:"bytes,1,opt,name=Header" json:"Header,omitempty"`
+	Type               ConfigurationItem_ConfigurationType `protobuf:"varint,2,opt,name=Type,enum=orderer.ConfigurationItem_ConfigurationType" json:"Type,omitempty"`
+	LastModified       uint64                              `protobuf:"varint,3,opt,name=LastModified" json:"LastModified,omitempty"`
 	ModificationPolicy string                              `protobuf:"bytes,4,opt,name=ModificationPolicy" json:"ModificationPolicy,omitempty"`
 	Key                string                              `protobuf:"bytes,5,opt,name=Key" json:"Key,omitempty"`
 	Value              []byte                              `protobuf:"bytes,6,opt,name=Value,proto3" json:"Value,omitempty"`
@@ -218,6 +218,23 @@ func (m *ConfigurationItem) String() string            { return proto.CompactTex
 func (*ConfigurationItem) ProtoMessage()               {}
 func (*ConfigurationItem) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
 
+func (m *ConfigurationItem) GetHeader() *common.ChainHeader {
+	if m != nil {
+		return m.Header
+	}
+	return nil
+}
+
+type ConfigurationSignature struct {
+	SignatureHeader []byte `protobuf:"bytes,1,opt,name=signatureHeader,proto3" json:"signatureHeader,omitempty"`
+	Signature       []byte `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
+}
+
+func (m *ConfigurationSignature) Reset()                    { *m = ConfigurationSignature{} }
+func (m *ConfigurationSignature) String() string            { return proto.CompactTextString(m) }
+func (*ConfigurationSignature) ProtoMessage()               {}
+func (*ConfigurationSignature) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+
 // Policy expresses a policy which the orderer can evaluate, because there has been some desire expressed to support
 // multiple policy engines, this is typed as a oneof for now
 type Policy struct {
@@ -229,7 +246,7 @@ type Policy struct {
 func (m *Policy) Reset()                    { *m = Policy{} }
 func (m *Policy) String() string            { return proto.CompactTextString(m) }
 func (*Policy) ProtoMessage()               {}
-func (*Policy) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{4} }
+func (*Policy) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
 
 type isPolicy_Type interface {
 	isPolicy_Type()
@@ -320,7 +337,7 @@ type SignaturePolicyEnvelope struct {
 func (m *SignaturePolicyEnvelope) Reset()                    { *m = SignaturePolicyEnvelope{} }
 func (m *SignaturePolicyEnvelope) String() string            { return proto.CompactTextString(m) }
 func (*SignaturePolicyEnvelope) ProtoMessage()               {}
-func (*SignaturePolicyEnvelope) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+func (*SignaturePolicyEnvelope) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
 
 func (m *SignaturePolicyEnvelope) GetPolicy() *SignaturePolicy {
 	if m != nil {
@@ -345,7 +362,7 @@ type SignaturePolicy struct {
 func (m *SignaturePolicy) Reset()                    { *m = SignaturePolicy{} }
 func (m *SignaturePolicy) String() string            { return proto.CompactTextString(m) }
 func (*SignaturePolicy) ProtoMessage()               {}
-func (*SignaturePolicy) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
+func (*SignaturePolicy) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
 
 type isSignaturePolicy_Type interface {
 	isSignaturePolicy_Type()
@@ -459,7 +476,7 @@ type SignaturePolicy_NOutOf struct {
 func (m *SignaturePolicy_NOutOf) Reset()                    { *m = SignaturePolicy_NOutOf{} }
 func (m *SignaturePolicy_NOutOf) String() string            { return proto.CompactTextString(m) }
 func (*SignaturePolicy_NOutOf) ProtoMessage()               {}
-func (*SignaturePolicy_NOutOf) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6, 0} }
+func (*SignaturePolicy_NOutOf) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0} }
 
 func (m *SignaturePolicy_NOutOf) GetPolicies() []*SignaturePolicy {
 	if m != nil {
@@ -478,7 +495,7 @@ type SeekInfo struct {
 func (m *SeekInfo) Reset()                    { *m = SeekInfo{} }
 func (m *SeekInfo) String() string            { return proto.CompactTextString(m) }
 func (*SeekInfo) ProtoMessage()               {}
-func (*SeekInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
+func (*SeekInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
 
 type Acknowledgement struct {
 	Number uint64 `protobuf:"varint,1,opt,name=Number" json:"Number,omitempty"`
@@ -487,7 +504,7 @@ type Acknowledgement struct {
 func (m *Acknowledgement) Reset()                    { *m = Acknowledgement{} }
 func (m *Acknowledgement) String() string            { return proto.CompactTextString(m) }
 func (*Acknowledgement) ProtoMessage()               {}
-func (*Acknowledgement) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
+func (*Acknowledgement) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
 
 // The update message either causes a seek to a new stream start with a new window, or acknowledges a received block and advances the base of the window
 type DeliverUpdate struct {
@@ -500,7 +517,7 @@ type DeliverUpdate struct {
 func (m *DeliverUpdate) Reset()                    { *m = DeliverUpdate{} }
 func (m *DeliverUpdate) String() string            { return proto.CompactTextString(m) }
 func (*DeliverUpdate) ProtoMessage()               {}
-func (*DeliverUpdate) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
+func (*DeliverUpdate) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
 
 type isDeliverUpdate_Type interface {
 	isDeliverUpdate_Type()
@@ -621,7 +638,7 @@ type DeliverResponse struct {
 func (m *DeliverResponse) Reset()                    { *m = DeliverResponse{} }
 func (m *DeliverResponse) String() string            { return proto.CompactTextString(m) }
 func (*DeliverResponse) ProtoMessage()               {}
-func (*DeliverResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
+func (*DeliverResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
 
 type isDeliverResponse_Type interface {
 	isDeliverResponse_Type()
@@ -732,6 +749,7 @@ func init() {
 	proto.RegisterType((*ConfigurationEnvelope)(nil), "orderer.ConfigurationEnvelope")
 	proto.RegisterType((*SignedConfigurationItem)(nil), "orderer.SignedConfigurationItem")
 	proto.RegisterType((*ConfigurationItem)(nil), "orderer.ConfigurationItem")
+	proto.RegisterType((*ConfigurationSignature)(nil), "orderer.ConfigurationSignature")
 	proto.RegisterType((*Policy)(nil), "orderer.Policy")
 	proto.RegisterType((*SignaturePolicyEnvelope)(nil), "orderer.SignaturePolicyEnvelope")
 	proto.RegisterType((*SignaturePolicy)(nil), "orderer.SignaturePolicy")
@@ -925,64 +943,67 @@ var _AtomicBroadcast_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("orderer/ab.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 934 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x74, 0x55, 0xcd, 0x8e, 0xe3, 0x44,
-	0x10, 0x4e, 0x4f, 0xfe, 0x26, 0x35, 0x99, 0x8d, 0xa7, 0x97, 0xdd, 0xb5, 0x02, 0x82, 0xc8, 0x02,
-	0x6d, 0x40, 0xab, 0x64, 0x08, 0x3f, 0x27, 0x24, 0xc8, 0x8f, 0xa3, 0xb1, 0x36, 0xd8, 0x4b, 0x7b,
-	0x32, 0x23, 0x71, 0x20, 0x72, 0xec, 0xce, 0x8c, 0xb5, 0x89, 0x3b, 0xdb, 0x76, 0x76, 0x35, 0xdc,
-	0xe1, 0xc2, 0x05, 0x09, 0x78, 0x0f, 0x1e, 0x80, 0x07, 0xe0, 0x05, 0x78, 0x13, 0x24, 0xae, 0xa8,
-	0xdb, 0x3f, 0x13, 0x27, 0x9b, 0x93, 0xbb, 0xbe, 0xaa, 0xae, 0x9f, 0xaf, 0xaa, 0xcb, 0xa0, 0x30,
-	0xee, 0x51, 0x4e, 0x79, 0xd7, 0x99, 0x77, 0xd6, 0x9c, 0x45, 0x0c, 0x57, 0x13, 0xa4, 0xf9, 0xd0,
-	0x65, 0xab, 0x15, 0x0b, 0xba, 0xf1, 0x27, 0xd6, 0x6a, 0x5f, 0xc1, 0xd9, 0x80, 0x33, 0xc7, 0x73,
-	0x9d, 0x30, 0x22, 0x34, 0x5c, 0xb3, 0x20, 0xa4, 0xf8, 0x29, 0x54, 0xec, 0xc8, 0x89, 0x36, 0xa1,
-	0x8a, 0x5a, 0xa8, 0xfd, 0xa0, 0xd7, 0xe8, 0x24, 0x3e, 0x3a, 0x31, 0x4c, 0x12, 0xb5, 0xf6, 0x13,
-	0x82, 0x47, 0x43, 0x16, 0x2c, 0xfc, 0x9b, 0x0d, 0x77, 0x22, 0x9f, 0x05, 0x7a, 0xf0, 0x9a, 0x2e,
-	0xd9, 0x9a, 0xe2, 0x26, 0x1c, 0xdb, 0xf4, 0xd5, 0x86, 0x06, 0x2e, 0x95, 0x4e, 0x4a, 0x24, 0x93,
-	0xb1, 0x0a, 0xd5, 0xe1, 0xad, 0xe3, 0x07, 0xc6, 0x48, 0x3d, 0x6a, 0xa1, 0x76, 0x9d, 0xa4, 0x22,
-	0xfe, 0x12, 0xca, 0x46, 0x44, 0x57, 0xa1, 0x5a, 0x6c, 0x15, 0xdb, 0x27, 0xbd, 0xd6, 0x7d, 0x5c,
-	0xff, 0x26, 0xa0, 0x5e, 0x2e, 0x94, 0x30, 0x24, 0xb1, 0xb9, 0xf6, 0x0a, 0x9e, 0x1c, 0xb0, 0xc0,
-	0x1f, 0xc2, 0x69, 0x0e, 0x94, 0xd9, 0xd4, 0x49, 0x1e, 0xc4, 0xe7, 0x00, 0xc2, 0x81, 0x13, 0x6d,
-	0x38, 0x0d, 0xd5, 0x23, 0x19, 0x5d, 0xe9, 0x24, 0x4c, 0xa5, 0x45, 0x91, 0x2d, 0x1b, 0xed, 0xcf,
-	0x23, 0x38, 0xdb, 0x8f, 0xb6, 0x55, 0x1a, 0xca, 0x97, 0xa6, 0x41, 0x7d, 0xe2, 0x84, 0xd1, 0xb7,
-	0xcc, 0xf3, 0x17, 0x3e, 0xf5, 0x64, 0xe5, 0x25, 0x92, 0xc3, 0xf0, 0x37, 0x50, 0xba, 0xbc, 0x5b,
-	0x53, 0xb5, 0x28, 0x59, 0x7f, 0x96, 0x55, 0xbf, 0x17, 0x27, 0x8f, 0x88, 0x3b, 0x44, 0xde, 0xc4,
-	0x1d, 0xc0, 0xb1, 0x37, 0x57, 0x6a, 0x5e, 0xb0, 0xa5, 0xef, 0xde, 0xa9, 0xa5, 0x16, 0x6a, 0xd7,
-	0xc8, 0x5b, 0x34, 0x58, 0x81, 0xe2, 0x73, 0x7a, 0xa7, 0x96, 0xa5, 0x81, 0x38, 0xe2, 0x77, 0xa0,
-	0x7c, 0xe5, 0x2c, 0x37, 0x54, 0xad, 0xc8, 0xfc, 0x63, 0x41, 0x1b, 0xee, 0x14, 0x2b, 0x83, 0x01,
-	0x54, 0x62, 0x37, 0x4a, 0x01, 0xd7, 0xa0, 0x2c, 0x2b, 0x55, 0x10, 0x3e, 0x81, 0xaa, 0x15, 0x27,
-	0xae, 0x1c, 0x09, 0x9b, 0xb1, 0x33, 0xe7, 0xbe, 0xab, 0x14, 0xb5, 0x1f, 0x52, 0x7b, 0x3c, 0x81,
-	0x46, 0x46, 0x65, 0x92, 0xa3, 0xa0, 0x6b, 0xb7, 0xe3, 0x5b, 0xfa, 0xb4, 0x07, 0x17, 0x05, 0xb2,
-	0x7b, 0x75, 0x50, 0x89, 0x69, 0x13, 0xd3, 0xf8, 0xe4, 0xc0, 0x35, 0xd1, 0x98, 0x2b, 0xca, 0xc3,
-	0x74, 0x00, 0xca, 0x24, 0x15, 0xf1, 0x79, 0x9a, 0x95, 0x6c, 0xc9, 0x49, 0x4f, 0x3d, 0x94, 0x02,
-	0x49, 0xb3, 0x7f, 0x1f, 0xc0, 0xf0, 0x68, 0x10, 0xf9, 0x91, 0x4f, 0xe3, 0x51, 0xad, 0x93, 0x2d,
-	0x44, 0xfb, 0x0b, 0xed, 0x95, 0x87, 0xdf, 0x83, 0xe3, 0x78, 0x42, 0x07, 0x71, 0xa9, 0xe5, 0x8b,
-	0x02, 0xc9, 0x10, 0xfc, 0x05, 0x94, 0xc6, 0x9c, 0xad, 0x92, 0x0c, 0x3e, 0x38, 0x94, 0x41, 0xc7,
-	0xb4, 0x36, 0x91, 0xb5, 0xb8, 0x28, 0x10, 0x69, 0xde, 0x9c, 0x40, 0x25, 0x46, 0x70, 0x1d, 0x90,
-	0x99, 0x14, 0x86, 0x4c, 0xfc, 0x39, 0x1c, 0xcb, 0x0b, 0x7e, 0x36, 0xcb, 0x87, 0x8b, 0xca, 0x2c,
-	0x33, 0x1a, 0xff, 0x41, 0xe2, 0xed, 0xd2, 0x97, 0x46, 0xb0, 0x60, 0xf8, 0x53, 0x28, 0xdb, 0x91,
-	0xc3, 0xa3, 0x64, 0x13, 0xbc, 0x7b, 0xef, 0x27, 0xb1, 0xe8, 0x48, 0xb5, 0x1c, 0xc1, 0xd8, 0x12,
-	0xb7, 0xa1, 0x61, 0xaf, 0xa9, 0x2b, 0x47, 0xda, 0xdc, 0xac, 0xe6, 0x94, 0x27, 0xc3, 0xbe, 0x0b,
-	0x0b, 0x22, 0xaf, 0xfd, 0xc0, 0x63, 0x6f, 0x6c, 0xff, 0xc7, 0x78, 0xea, 0x4b, 0x64, 0x0b, 0xd9,
-	0x7e, 0x4d, 0xa5, 0xdc, 0x6b, 0xd2, 0x7a, 0x50, 0xcb, 0xe2, 0x8a, 0x19, 0x33, 0xf5, 0x6b, 0xdd,
-	0xbe, 0x54, 0x0a, 0xe2, 0x6c, 0x4d, 0x46, 0xe2, 0x8c, 0xf0, 0x29, 0xd4, 0xec, 0x17, 0xfa, 0xd0,
-	0x18, 0x1b, 0xfa, 0x48, 0x39, 0xd2, 0x3e, 0x86, 0x46, 0xdf, 0x7d, 0x19, 0xb0, 0x37, 0x4b, 0xea,
-	0xdd, 0xd0, 0x15, 0x0d, 0x22, 0xfc, 0x18, 0x2a, 0x49, 0x86, 0xf1, 0x8e, 0x4a, 0x24, 0xed, 0x67,
-	0x04, 0xa7, 0x23, 0xba, 0xf4, 0x5f, 0x53, 0x3e, 0x5d, 0x7b, 0x4e, 0x44, 0xf1, 0x68, 0xef, 0x72,
-	0x32, 0xb1, 0xf7, 0xcc, 0xee, 0xe8, 0xc5, 0xa4, 0xee, 0xc6, 0x7b, 0x0a, 0x25, 0xc1, 0x5b, 0xd2,
-	0xe7, 0xb3, 0x3d, 0x32, 0x45, 0x67, 0xc5, 0x39, 0xeb, 0x85, 0x0f, 0x8d, 0x24, 0x8f, 0xad, 0xe5,
-	0x5c, 0xd6, 0x39, 0x67, 0xfc, 0xc0, 0x6e, 0xbe, 0x28, 0x90, 0x58, 0x8f, 0x3f, 0x82, 0xf2, 0x60,
-	0xc9, 0xdc, 0x34, 0xda, 0x69, 0xba, 0xce, 0x24, 0x28, 0xcc, 0xe4, 0x21, 0x0d, 0xf5, 0xc9, 0x2f,
-	0x28, 0xdd, 0xfa, 0xe2, 0x05, 0x4f, 0xcd, 0xe7, 0xa6, 0x75, 0x6d, 0x2a, 0x05, 0x5c, 0x87, 0xaa,
-	0x3d, 0x1d, 0x0e, 0x75, 0xdb, 0x56, 0xfe, 0x46, 0x58, 0x81, 0x93, 0x41, 0x7f, 0x34, 0x23, 0xfa,
-	0x77, 0x53, 0x41, 0xf2, 0xaf, 0x45, 0xfc, 0x00, 0x6a, 0x63, 0x8b, 0x0c, 0x8c, 0xd1, 0x48, 0x37,
-	0x95, 0xdf, 0xa4, 0x6c, 0x5a, 0x97, 0xb3, 0xb1, 0x35, 0x35, 0x47, 0xca, 0xef, 0x45, 0xdc, 0x84,
-	0x47, 0x86, 0x79, 0xa9, 0x13, 0xb3, 0x3f, 0x99, 0xd9, 0x3a, 0xb9, 0xd2, 0xc9, 0x4c, 0x27, 0xc4,
-	0x22, 0xca, 0xbf, 0x45, 0xac, 0xc2, 0x43, 0x01, 0x19, 0x43, 0x7d, 0x36, 0x35, 0xfb, 0x57, 0x7d,
-	0x63, 0xd2, 0x1f, 0x4c, 0x74, 0xe5, 0xbf, 0x62, 0xef, 0x0f, 0x04, 0x8d, 0x7e, 0xc4, 0x56, 0xbe,
-	0x9b, 0xfd, 0x9e, 0xf0, 0xd7, 0x50, 0xbb, 0x17, 0xf6, 0xb6, 0x73, 0xb3, 0x99, 0x31, 0xb1, 0xf7,
-	0x47, 0xd3, 0x0a, 0x6d, 0x74, 0x8e, 0x70, 0x1f, 0xaa, 0x09, 0x9b, 0xf8, 0x71, 0x66, 0x9c, 0xeb,
-	0x73, 0x53, 0xdd, 0xc5, 0xf3, 0x2e, 0x06, 0x9d, 0xef, 0x9f, 0xdd, 0xf8, 0xd1, 0xed, 0x66, 0x2e,
-	0xc2, 0x77, 0x6f, 0xef, 0xd6, 0x94, 0xcb, 0xf6, 0xf2, 0xee, 0x42, 0xae, 0xb9, 0xae, 0xfc, 0xad,
-	0x86, 0xdd, 0xc4, 0xcb, 0xbc, 0x22, 0xe5, 0xcf, 0xfe, 0x0f, 0x00, 0x00, 0xff, 0xff, 0x79, 0xff,
-	0x04, 0x06, 0x98, 0x07, 0x00, 0x00,
+	// 982 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x74, 0x55, 0x5b, 0x6f, 0xe3, 0x44,
+	0x14, 0xce, 0xd4, 0xb9, 0x34, 0x27, 0x69, 0xe3, 0x4e, 0xd9, 0xae, 0x15, 0x56, 0x6c, 0x64, 0x09,
+	0x6d, 0x80, 0x2a, 0x59, 0xc2, 0xe5, 0x09, 0x69, 0xc9, 0xc5, 0x51, 0xac, 0x0d, 0xce, 0x32, 0x6e,
+	0x5a, 0x89, 0x07, 0x82, 0x63, 0x4f, 0x5a, 0x6b, 0x13, 0x4f, 0xb0, 0x9d, 0x5d, 0x95, 0x77, 0x10,
+	0x12, 0x2f, 0x48, 0xc0, 0xbf, 0xe1, 0x8d, 0x17, 0xfe, 0x00, 0xff, 0x04, 0x89, 0x57, 0x34, 0xe3,
+	0x4b, 0x6e, 0xcd, 0x93, 0x7d, 0xbe, 0x73, 0xff, 0xce, 0x99, 0x19, 0x90, 0x99, 0xef, 0x50, 0x9f,
+	0xfa, 0x4d, 0x6b, 0xda, 0x58, 0xfa, 0x2c, 0x64, 0xb8, 0x10, 0x23, 0xd5, 0x73, 0x9b, 0x2d, 0x16,
+	0xcc, 0x6b, 0x46, 0x9f, 0x48, 0xab, 0x7e, 0x01, 0x67, 0x1d, 0x9f, 0x59, 0x8e, 0x6d, 0x05, 0x21,
+	0xa1, 0xc1, 0x92, 0x79, 0x01, 0xc5, 0xcf, 0x20, 0x6f, 0x86, 0x56, 0xb8, 0x0a, 0x14, 0x54, 0x43,
+	0xf5, 0xd3, 0x56, 0xa5, 0x11, 0xc7, 0x68, 0x44, 0x30, 0x89, 0xd5, 0xea, 0x8f, 0x08, 0x1e, 0x75,
+	0x99, 0x37, 0x73, 0x6f, 0x57, 0xbe, 0x15, 0xba, 0xcc, 0xd3, 0xbc, 0x37, 0x74, 0xce, 0x96, 0x14,
+	0x7f, 0x0e, 0x39, 0x3d, 0xa4, 0x0b, 0x1e, 0x41, 0xaa, 0x97, 0x5a, 0xb5, 0x75, 0x04, 0xf7, 0xd6,
+	0xa3, 0xce, 0x96, 0x13, 0x37, 0x24, 0x91, 0x39, 0x56, 0xa0, 0xd0, 0xbd, 0xb3, 0x5c, 0x4f, 0xef,
+	0x29, 0x47, 0x35, 0x54, 0x2f, 0x93, 0x44, 0xc4, 0x55, 0x38, 0x36, 0xe9, 0xf7, 0x2b, 0xea, 0xd9,
+	0x54, 0x91, 0x6a, 0xa8, 0x9e, 0x25, 0xa9, 0xac, 0xfe, 0x8c, 0xe0, 0xf1, 0x81, 0xc0, 0xf8, 0x12,
+	0xce, 0xf6, 0x40, 0xd1, 0x57, 0x99, 0xec, 0x2b, 0xf0, 0x0b, 0x00, 0x1e, 0xc8, 0x0a, 0x57, 0x3e,
+	0x0d, 0x94, 0x23, 0x51, 0xfc, 0xd3, 0xb4, 0xf8, 0x2d, 0xfb, 0xd4, 0x8e, 0x6c, 0xb8, 0xa8, 0x7f,
+	0x1d, 0x3d, 0x90, 0x0f, 0x7f, 0x04, 0xf9, 0x01, 0xb5, 0x1c, 0xea, 0x8b, 0xcc, 0xa5, 0xd6, 0x79,
+	0x23, 0x9e, 0x82, 0xe8, 0x2e, 0x52, 0x91, 0xd8, 0x04, 0x7f, 0x09, 0xd9, 0xab, 0xfb, 0x25, 0x15,
+	0x04, 0x9c, 0xb6, 0x2e, 0x1f, 0xce, 0xce, 0xc3, 0x6e, 0x23, 0xdc, 0x87, 0x08, 0x4f, 0xac, 0x42,
+	0x79, 0x68, 0x05, 0xe1, 0x57, 0xcc, 0x71, 0x67, 0x2e, 0x75, 0x62, 0xbe, 0xb6, 0x30, 0xdc, 0x00,
+	0x1c, 0xfd, 0xdb, 0xc2, 0xfb, 0x15, 0x9b, 0xbb, 0xf6, 0xbd, 0x92, 0xad, 0xa1, 0x7a, 0x91, 0x3c,
+	0xa0, 0xc1, 0x32, 0x48, 0x2f, 0xe9, 0xbd, 0x92, 0x13, 0x06, 0xfc, 0x17, 0xbf, 0x03, 0xb9, 0x6b,
+	0x6b, 0xbe, 0xa2, 0x4a, 0x5e, 0xb0, 0x19, 0x09, 0x6a, 0x77, 0xa7, 0x7f, 0x51, 0x10, 0x40, 0x3e,
+	0x0a, 0x23, 0x67, 0x70, 0x11, 0x72, 0xa2, 0x6b, 0x19, 0xe1, 0x12, 0x14, 0x46, 0x51, 0x73, 0xf2,
+	0x11, 0xb7, 0xe9, 0x5b, 0x53, 0xdf, 0xb5, 0x65, 0x49, 0xfd, 0x0e, 0x2e, 0x1e, 0xe6, 0x1a, 0xd7,
+	0xa1, 0x12, 0x24, 0xc2, 0x06, 0xa5, 0x65, 0xb2, 0x0b, 0xe3, 0x27, 0x50, 0x4c, 0xa1, 0x78, 0x99,
+	0xd6, 0x80, 0xfa, 0x6d, 0x52, 0x11, 0x1e, 0x42, 0x25, 0x0d, 0x1f, 0xb3, 0x10, 0x0d, 0x69, 0x7b,
+	0x69, 0x37, 0xf4, 0xc9, 0x96, 0x0f, 0x32, 0x64, 0xd7, 0xb5, 0x93, 0x8f, 0x86, 0xc7, 0x8f, 0xc6,
+	0xe3, 0x03, 0x6e, 0x7c, 0xc9, 0xaf, 0xa9, 0x1f, 0xb8, 0xcc, 0x13, 0x99, 0x72, 0x24, 0x11, 0xf1,
+	0xf3, 0xa4, 0x2a, 0x51, 0x70, 0xa9, 0xa5, 0x1c, 0x2a, 0x81, 0x24, 0xd5, 0xbf, 0x07, 0xa0, 0x3b,
+	0xd4, 0x0b, 0xdd, 0xd0, 0xa5, 0x81, 0x22, 0xd5, 0xa4, 0x7a, 0x99, 0x6c, 0x20, 0xea, 0x9f, 0x68,
+	0xaf, 0x3d, 0xfc, 0x04, 0x8e, 0xa3, 0xd3, 0xd2, 0x89, 0x5a, 0xcd, 0x0d, 0x32, 0x24, 0x45, 0xf0,
+	0x67, 0x90, 0xed, 0xfb, 0x6c, 0x11, 0x57, 0xf0, 0xf4, 0x50, 0x05, 0x0d, 0x63, 0xb4, 0x0a, 0x47,
+	0xb3, 0x41, 0x86, 0x08, 0xf3, 0xea, 0x10, 0xf2, 0x11, 0x82, 0xcb, 0x80, 0x8c, 0xb8, 0x31, 0x64,
+	0xe0, 0x4f, 0xe1, 0x58, 0x38, 0xb8, 0xe9, 0x79, 0x3a, 0xdc, 0x54, 0x6a, 0x99, 0xd2, 0xf8, 0x0f,
+	0xe2, 0xc7, 0x9e, 0xbe, 0xd6, 0xbd, 0x19, 0xc3, 0x1f, 0x43, 0xce, 0x0c, 0x2d, 0x3f, 0x8c, 0xaf,
+	0xa5, 0x77, 0xd7, 0x71, 0x62, 0x8b, 0x86, 0x50, 0x8b, 0x83, 0x10, 0x59, 0xf2, 0x75, 0x31, 0x97,
+	0xd4, 0x16, 0x2b, 0x6f, 0xac, 0x16, 0x53, 0xea, 0x8b, 0xbe, 0xb2, 0x64, 0x17, 0xe6, 0x44, 0xde,
+	0xb8, 0x9e, 0xc3, 0xde, 0x9a, 0xee, 0x0f, 0xc9, 0x0d, 0xb3, 0x81, 0x6c, 0xde, 0x4c, 0xd9, 0xad,
+	0x9b, 0x49, 0x6d, 0x41, 0x31, 0xcd, 0xcb, 0xb7, 0xd8, 0xd0, 0x6e, 0x34, 0xf3, 0x4a, 0xce, 0xf0,
+	0xff, 0xd1, 0xb0, 0xc7, 0xff, 0x11, 0x3e, 0x81, 0xa2, 0xf9, 0x4a, 0xeb, 0xea, 0x7d, 0x5d, 0xeb,
+	0xc9, 0x47, 0xea, 0x07, 0x50, 0x69, 0xdb, 0xaf, 0x3d, 0xf6, 0x76, 0x4e, 0x9d, 0x5b, 0xba, 0xa0,
+	0x5e, 0x88, 0x2f, 0x20, 0x1f, 0x57, 0x88, 0x44, 0xf2, 0x58, 0x52, 0x7f, 0x42, 0x70, 0xd2, 0xa3,
+	0x73, 0xf7, 0x0d, 0xf5, 0xc7, 0x4b, 0xc7, 0x0a, 0x29, 0xee, 0xed, 0x39, 0xc7, 0x1b, 0xbb, 0x66,
+	0x76, 0x47, 0xcf, 0x37, 0x75, 0x37, 0xdf, 0x33, 0xc8, 0x72, 0xde, 0xe2, 0x39, 0x9f, 0xed, 0x91,
+	0xc9, 0x27, 0xcb, 0xff, 0xd3, 0x59, 0xb8, 0x50, 0x89, 0xeb, 0xd8, 0x78, 0x29, 0x72, 0x9a, 0xef,
+	0x33, 0xff, 0xc0, 0x43, 0x31, 0xc8, 0x90, 0x48, 0x8f, 0xdf, 0x87, 0x5c, 0x67, 0xce, 0xec, 0x24,
+	0xdb, 0x49, 0x72, 0xff, 0x09, 0x90, 0x9b, 0x89, 0x9f, 0x24, 0xd5, 0x87, 0xbf, 0xa0, 0xe4, 0x09,
+	0xe2, 0x77, 0xc4, 0xd8, 0x78, 0x69, 0x8c, 0x6e, 0x0c, 0x39, 0x83, 0xcb, 0x50, 0x30, 0xc7, 0xdd,
+	0xae, 0x66, 0x9a, 0xf2, 0xdf, 0x08, 0xcb, 0x50, 0xea, 0xb4, 0x7b, 0x13, 0xa2, 0x7d, 0x3d, 0xe6,
+	0x24, 0xff, 0x2a, 0xe1, 0x53, 0x28, 0xf6, 0x47, 0xa4, 0xa3, 0xf7, 0x7a, 0x9a, 0x21, 0xff, 0x26,
+	0x64, 0x63, 0x74, 0x35, 0xe9, 0x8f, 0xc6, 0x46, 0x4f, 0xfe, 0x5d, 0xc2, 0x55, 0x78, 0xa4, 0x1b,
+	0x57, 0x1a, 0x31, 0xda, 0xc3, 0x89, 0xa9, 0x91, 0x6b, 0x8d, 0x4c, 0x34, 0x42, 0x46, 0x44, 0xfe,
+	0x57, 0xc2, 0x0a, 0x9c, 0x73, 0x48, 0xef, 0x6a, 0x93, 0xb1, 0xd1, 0xbe, 0x6e, 0xeb, 0xc3, 0x76,
+	0x67, 0xa8, 0xc9, 0xff, 0x49, 0xad, 0x3f, 0x10, 0x54, 0xda, 0x21, 0x5b, 0xb8, 0x76, 0xfa, 0x56,
+	0xe2, 0x17, 0x50, 0x5c, 0x0b, 0x72, 0xd2, 0x4e, 0x72, 0xc4, 0xab, 0xd5, 0x94, 0x89, 0xbd, 0xe7,
+	0x55, 0xcd, 0xd4, 0xd1, 0x73, 0x84, 0xdb, 0x50, 0x88, 0xd9, 0xc4, 0x17, 0xa9, 0xf1, 0xd6, 0x9c,
+	0xab, 0xca, 0x2e, 0xbe, 0x1d, 0xa2, 0xd3, 0xf8, 0xe6, 0xf2, 0xd6, 0x0d, 0xef, 0x56, 0x53, 0x9e,
+	0xbe, 0x79, 0x77, 0xbf, 0xa4, 0xbe, 0x18, 0xaf, 0xdf, 0x9c, 0x89, 0x8b, 0xb4, 0x29, 0xde, 0xf8,
+	0xa0, 0x19, 0x47, 0x99, 0xe6, 0x85, 0xfc, 0xc9, 0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0xc5, 0xb3,
+	0x73, 0x13, 0x25, 0x08, 0x00, 0x00,
 }
diff --git a/protos/orderer/ab.proto b/protos/orderer/ab.proto
index 43b6ddc79e4..eeac3b5218d 100644
--- a/protos/orderer/ab.proto
+++ b/protos/orderer/ab.proto
@@ -42,12 +42,11 @@ message BroadcastResponse {
 //
 // It is generated with the following scheme:
 //   1. Retrieve the existing configuration
-//   2. Increment Sequence in the ConfigurationEnvelope
-//   3. Modify desired ConfigurationItems, setting each LastModified to the ConfigurationEnvelope Sequence
+//   2. Note the highest configuration sequence number, store it an increment it by one
+//   3. Modify desired ConfigurationItems, setting each LastModified to the stored and incremented sequence number
 //   4. Update SignedConfigurationItem with appropriate signatures over the modified ConfigurationItem
-//     a) Each signature is of type common.Envelope
-//     b) The common.Envelope common.Payload has data set to the hash of the ConfigurationItem
-//     c) The common.Envelope common.Payload has a header with the type set to common.Header.Type.CONFIGURATION_ITEM
+//     a) Each signature is of type ConfigurationSignature
+//     b) The ConfigurationSignature signature is over the concatenation of signatureHeader and the ConfigurationItem header
 //   5. Submit new Configuration for ordering in Envelope signed by submitter
 //     a) The common.Envelope common.Payload has data set to the marshaled ConfigurationEnvelope
 //     b) The common.Envelope common.Payload has a header of type common.Header.Type.CONFIGURATION_TRANSACTION 
@@ -56,21 +55,20 @@ message BroadcastResponse {
 //   1. All configuration items and the envelope refer to the correct chain
 //   2. Some configuration item has been added or modified
 //   3. No existing configuration item has been ommitted
-//   4. All configuration changes have a LastModification equal to Sequence from the ConfigurationEnvelope
+//   4. All configuration changes have a LastModification of one more than the last configuration's sequence
 //   5. All configuration changes satisfy the corresponding modification policy 
 message ConfigurationEnvelope {
-    uint64 Sequence = 1;
-    bytes ChainID = 2;
-    repeated SignedConfigurationItem Items = 3;
+    repeated SignedConfigurationItem Items = 1;
+    bytes ChainID = 2;   // XXX remove me, and infer from the items set
+    uint64 Sequence = 3; // XXX remove me, infer from the items set
 }
 
 // This message may change slightly depending on the finalization of signature schemes for transactions
 message SignedConfigurationItem {
-    bytes Configuration = 1;
-    repeated common.Envelope Signatures = 2; // Signatures over the hash of Configuration
+    bytes ConfigurationItem = 1;
+    repeated ConfigurationSignature Signatures = 2; // Signatures over the hash of Configuration
 }
 
-
 message ConfigurationItem {
     enum ConfigurationType {
         Policy = 0;   // Implies that the Value is a marshaled Policy message, and may be referred to by Key as a ModificationPolicy
@@ -78,15 +76,19 @@ message ConfigurationItem {
         Orderer = 2;  // Marshaled format for this type is yet to be determined
         Fabric = 3;   // Marshaled format for this type is yet to be determined
     }
-
-    bytes ChainID = 1;              // A Globally Unique Chain ID
-    uint64 LastModified = 2;        // The Sequence number in the ConfigurationEnvelope this item was last modified
-    ConfigurationType Type = 3;     // The type of configuration
+    common.ChainHeader Header = 1;  // The header which ties this configuration to a particular chain
+    ConfigurationType Type = 2;     // The type of configuration this is.
+    uint64 LastModified = 3;        // The Sequence number in the ConfigurationEnvelope this item was last modified
     string ModificationPolicy = 4;  // What policy to check before allowing modification
     string Key = 5;                 // A unique ID, unique scoped by Type, to reference the value by
     bytes Value = 6;                // The byte representation of this configuration, usually a marshaled message
 }
 
+message ConfigurationSignature {
+    bytes signatureHeader = 1;
+    bytes signature = 2; // Signature over the concatenation of configurationItem bytes and signatureHeader bytes
+}
+
 // Policy expresses a policy which the orderer can evaluate, because there has been some desire expressed to support
 // multiple policy engines, this is typed as a oneof for now
 message Policy {