diff --git a/alethzero/MainWin.cpp b/alethzero/MainWin.cpp
index c58d6f931..b771d4836 100644
--- a/alethzero/MainWin.cpp
+++ b/alethzero/MainWin.cpp
@@ -1597,7 +1597,7 @@ void Main::on_destination_currentTextChanged()
 //	updateFee();
 }
 
-static shh::Topic topicFromText(QString _s)
+static shh::FullTopic topicFromText(QString _s)
 {
 	shh::BuildTopic ret;
 	while (_s.size())
diff --git a/libdevcrypto/Common.cpp b/libdevcrypto/Common.cpp
index 2c13c40bf..0a94662c8 100644
--- a/libdevcrypto/Common.cpp
+++ b/libdevcrypto/Common.cpp
@@ -80,6 +80,18 @@ bool dev::decrypt(Secret const& _k, bytesConstRef _cipher, bytes& o_plaintext)
 	return true;
 }
 
+void dev::encryptSym(Secret const& _k, bytesConstRef _plain, bytes& o_cipher)
+{
+	// TOOD: @alex @subtly do this properly.
+	encrypt(KeyPair(_k).pub(), _plain, o_cipher);
+}
+
+bool dev::decryptSym(Secret const& _k, bytesConstRef _cipher, bytes& o_plain)
+{
+	// TODO: @alex @subtly do this properly.
+	return decrypt(_k, _cipher, o_plain);
+}
+
 Public dev::recover(Signature const& _sig, h256 const& _message)
 {
 	return s_secp256k1.recover(_sig, _message.ref());
diff --git a/libdevcrypto/Common.h b/libdevcrypto/Common.h
index 2eea2b83c..e91df2526 100644
--- a/libdevcrypto/Common.h
+++ b/libdevcrypto/Common.h
@@ -86,7 +86,13 @@ void encrypt(Public const& _k, bytesConstRef _plain, bytes& o_cipher);
 
 /// Decrypts cipher using Secret key.
 bool decrypt(Secret const& _k, bytesConstRef _cipher, bytes& o_plaintext);
-	
+
+/// Symmetric encryption.
+void encryptSym(Secret const& _k, bytesConstRef _plain, bytes& o_cipher);
+
+/// Symmetric decryption.
+bool decryptSym(Secret const& _k, bytesConstRef _cipher, bytes& o_plaintext);
+
 /// Recovers Public key from signed message hash.
 Public recover(Signature const& _sig, h256 const& _hash);
 	
diff --git a/libdevcrypto/CryptoPP.h b/libdevcrypto/CryptoPP.h
index 7ec95c552..fa9d92aa1 100644
--- a/libdevcrypto/CryptoPP.h
+++ b/libdevcrypto/CryptoPP.h
@@ -62,7 +62,7 @@ using namespace CryptoPP;
 inline ECP::Point publicToPoint(Public const& _p) { Integer x(_p.data(), 32); Integer y(_p.data() + 32, 32); return std::move(ECP::Point(x,y)); }
 
 inline Integer secretToExponent(Secret const& _s) { return std::move(Integer(_s.data(), Secret::size)); }
-	
+
 /**
  * CryptoPP secp256k1 algorithms.
  */
diff --git a/libweb3jsonrpc/WebThreeStubServerBase.cpp b/libweb3jsonrpc/WebThreeStubServerBase.cpp
index 55812f34a..bd09ac9c6 100644
--- a/libweb3jsonrpc/WebThreeStubServerBase.cpp
+++ b/libweb3jsonrpc/WebThreeStubServerBase.cpp
@@ -571,18 +571,21 @@ Json::Value WebThreeStubServerBase::shh_changed(int const& _id)
 	if (!pub || m_ids.count(pub))
 		for (h256 const& h: face()->checkWatch(_id))
 		{
-			face()->watchFilter(_id).topics();
 			auto e = face()->envelope(h);
 			shh::Message m;
 			if (pub)
 			{
 				cwarn << "Silently decrypting message from identity" << pub.abridged() << ": User validation hook goes here.";
-				m = e.open(m_ids[pub]);
+				m = e.open(m_ids[pub], shh::NotPublic);
 				if (!m)
 					continue;
 			}
 			else
-				m = e.open();
+			{
+				unsigned i = 0;
+				for (; i < face()->getFilter(_id).size() && !face()->getFilter(_id)[i]; ++i) {}
+				m = e.open(face()->getFilter(_id)[i], i);
+			}
 			ret.append(toJson(h, e, m));
 		}
 	
diff --git a/libwhisper/Common.cpp b/libwhisper/Common.cpp
index a057157d1..bbc7ecdf7 100644
--- a/libwhisper/Common.cpp
+++ b/libwhisper/Common.cpp
@@ -37,15 +37,6 @@ Topic BuildTopic::toTopic() const
 	return ret;
 }
 
-FullTopic BuildTopic::toFullTopic() const
-{
-	FullTopic ret;
-	ret.reserve(m_parts.size());
-	for (auto const& h: m_parts)
-		ret.push_back(h);
-	return ret;
-}
-
 BuildTopic& BuildTopic::shiftBytes(bytes const& _b)
 {
 	m_parts.push_back(dev::sha3(_b));
diff --git a/libwhisper/Common.h b/libwhisper/Common.h
index 442e71830..e19c65ea9 100644
--- a/libwhisper/Common.h
+++ b/libwhisper/Common.h
@@ -62,7 +62,7 @@ enum WhisperPacket
 using TopicPart = FixedHash<4>;
 
 using Topic = std::vector<TopicPart>;
-using FullTopic = std::vector<h256>;
+using FullTopic = h256s;
 
 class BuildTopic
 {
@@ -93,6 +93,7 @@ class TopicFilter
 {
 public:
 	TopicFilter() {}
+	TopicFilter(FullTopic const& _m) { m_topicMasks.push_back(TopicMask()); for (auto const& h: _m) m_topicMasks.back().push_back(std::make_pair(TopicPart(h), h ? ~TopicPart() : TopicPart())); }
 	TopicFilter(TopicMask const& _m): m_topicMasks(1, _m) {}
 	TopicFilter(TopicMasks const& _m): m_topicMasks(_m) {}
 	TopicFilter(RLP const& _r)//: m_topicMasks(_r.toVector<std::vector<>>())
@@ -111,7 +112,6 @@ public:
 	bool matches(Envelope const& _m) const;
 
 private:
-	h256s m_parts;
 	TopicMasks m_topicMasks;
 };
 
@@ -127,7 +127,9 @@ public:
 	template <class T> BuildTopicMask& operator()(T const& _t) { shift(_t); return *this; }
 
 	operator TopicMask() const { return toTopicMask(); }
+	operator FullTopic() const { return toFullTopic(); }
 	TopicMask toTopicMask() const;
+	FullTopic toFullTopic() const { return m_parts; }
 };
 
 }
diff --git a/libwhisper/Interface.cpp b/libwhisper/Interface.cpp
index c00c3ebb2..72bca9785 100644
--- a/libwhisper/Interface.cpp
+++ b/libwhisper/Interface.cpp
@@ -34,7 +34,6 @@ using namespace dev::shh;
 #endif
 #define clogS(X) dev::LogOutputStream<X, true>(false) << "| " << std::setw(2) << session()->socketId() << "] "
 
-unsigned Interface::installWatch(TopicMask const& _mask)
+Interface::~Interface()
 {
-	return installWatch(TopicFilter(_mask));
 }
diff --git a/libwhisper/Interface.h b/libwhisper/Interface.h
index fdac29cba..1ee36c756 100644
--- a/libwhisper/Interface.h
+++ b/libwhisper/Interface.h
@@ -47,7 +47,7 @@ class Watch;
 
 struct InstalledFilter
 {
-	InstalledFilter(FullTopic const& _f): full(_f), filter(fullToFilter(_f)) {}
+	InstalledFilter(FullTopic const& _f): full(_f), filter(_f) {}
 
 	FullTopic full;
 	TopicFilter filter;
@@ -66,13 +66,12 @@ struct ClientWatch
 class Interface
 {
 public:
-	virtual ~Interface() {}
+	virtual ~Interface();
 
 	virtual void inject(Envelope const& _m, WhisperPeer* _from = nullptr) = 0;
 
-	unsigned installWatch(TopicMask const& _mask);
 	virtual FullTopic getFilter(unsigned _id) const = 0;
-	virtual unsigned installWatch(FullTopic const& _filter) = 0;
+	virtual unsigned installWatch(FullTopic const& _mask) = 0;
 	virtual unsigned installWatchOnId(h256 _filterId) = 0;
 	virtual void uninstallWatch(unsigned _watchId) = 0;
 	virtual h256s peekWatch(unsigned _watchId) const = 0;
@@ -81,10 +80,10 @@ public:
 
 	virtual Envelope envelope(h256 _m) const = 0;
 
-	void post(bytes const& _payload, Topic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_topic, _ttl, _workToProve)); }
-	void post(Public _to, bytes const& _payload, Topic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_to, _topic, _ttl, _workToProve)); }
-	void post(Secret _from, bytes const& _payload, Topic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_from, _topic, _ttl, _workToProve)); }
-	void post(Secret _from, Public _to, bytes const& _payload, Topic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_from, _to, _topic, _ttl, _workToProve)); }
+	void post(bytes const& _payload, FullTopic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_topic, _ttl, _workToProve)); }
+	void post(Public _to, bytes const& _payload, FullTopic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_to, _topic, _ttl, _workToProve)); }
+	void post(Secret _from, bytes const& _payload, FullTopic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_from, _topic, _ttl, _workToProve)); }
+	void post(Secret _from, Public _to, bytes const& _payload, FullTopic _topic, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_from, _to, _topic, _ttl, _workToProve)); }
 };
 
 struct WatshhChannel: public dev::LogChannel { static const char* name() { return "shh"; } static const int verbosity = 1; };
@@ -106,11 +105,10 @@ class Watch: public boost::noncopyable
 
 public:
 	Watch() {}
-	Watch(Interface& _c, TopicMask const& _f): m_c(&_c), m_id(_c.installWatch(_f)) {}
-	Watch(Interface& _c, TopicFilter const& _tf): m_c(&_c), m_id(_c.installWatch(_tf)) {}
+	Watch(Interface& _c, FullTopic const& _f): m_c(&_c), m_id(_c.installWatch(_f)) {}
 	~Watch() { if (m_c) m_c->uninstallWatch(m_id); }
 
-	FullTopic fullTopic() const { return m_c ? m_c->fullTopic(m_id) : FullTopic(); }
+	FullTopic fullTopic() const { return m_c ? m_c->getFilter(m_id) : FullTopic(); }
 	h256s check() { return m_c ? m_c->checkWatch(m_id) : h256s(); }
 	h256s peek() { return m_c ? m_c->peekWatch(m_id) : h256s(); }
 
diff --git a/libwhisper/Message.cpp b/libwhisper/Message.cpp
index 5a10fc323..ed7faaea8 100644
--- a/libwhisper/Message.cpp
+++ b/libwhisper/Message.cpp
@@ -35,13 +35,13 @@ Message::Message(Envelope const& _e, Secret const& _s, unsigned _topicIndex)
 			if (!decrypt(_s, &(_e.data()), b))
 				return;
 			else{}
-		else
+		else if (_topicIndex != (unsigned)-1)
 		{
 			// public - need to get the key through combining with the topic/topicIndex we know.
 			if (_e.data().size() < _e.topics().size() * 32)
 				return;
 			// get key from decrypted topic key: just xor
-			if (!decrypt(_s ^ h256(bytesConstRef(&(_e.data())).cropped(32 * _topicIndex, 32)), bytesConstRef(&(_e.data())).cropped(32 * _e.topics().size()), b))
+			if (!decryptSym(_s ^ h256(bytesConstRef(&(_e.data())).cropped(32 * _topicIndex, 32)), bytesConstRef(&(_e.data())).cropped(32 * _e.topics().size()), b))
 				return;
 		}
 
@@ -74,9 +74,12 @@ bool Message::populate(bytes const& _data)
 	return true;
 }
 
-Envelope Message::seal(Secret _from, FullTopic const& _topic, unsigned _ttl, unsigned _workToProve) const
+Envelope Message::seal(Secret _from, FullTopic const& _fullTopic, unsigned _ttl, unsigned _workToProve) const
 {
-	Envelope ret(time(0) + _ttl, _ttl, _topic);
+	Topic topic;
+	for (auto const& ft: _fullTopic)
+		topic.push_back(TopicPart(ft));
+	Envelope ret(time(0) + _ttl, _ttl, topic);
 
 	bytes input(1 + m_payload.size());
 	input[0] = 0;
@@ -94,7 +97,15 @@ Envelope Message::seal(Secret _from, FullTopic const& _topic, unsigned _ttl, uns
 	if (m_to)
 		encrypt(m_to, &input, ret.m_data);
 	else
-		swap(ret.m_data, input);
+	{
+		// create the shared secret and encrypt
+		Secret s = Secret::random();
+		for (h256 const& t: _fullTopic)
+			ret.m_data += (t ^ s).asBytes();
+		bytes d;
+		encryptSym(s, &input, d);
+		ret.m_data += d;
+	}
 
 	ret.proveWork(_workToProve);
 	return ret;
@@ -109,9 +120,9 @@ Envelope::Envelope(RLP const& _m)
 	m_nonce = _m[4].toInt<u256>();
 }
 
-Message Envelope::open(Secret const& _s) const
+Message Envelope::open(Secret const& _s, unsigned _topicIndex) const
 {
-	return Message(*this, _s);
+	return Message(*this, _s, _topicIndex);
 }
 
 unsigned Envelope::workProved() const
diff --git a/libwhisper/Message.h b/libwhisper/Message.h
index eeb7446eb..b23e5d576 100644
--- a/libwhisper/Message.h
+++ b/libwhisper/Message.h
@@ -85,13 +85,15 @@ enum /*Message Flags*/
 	ContainsSignature = 1
 };
 
+static const unsigned NotPublic = (unsigned)-1;
+
 /// An (unencrypted) message, constructed from the combination of an Envelope, and, potentially,
 /// a Secret key to decrypt the Message.
 class Message
 {
 public:
 	Message() {}
-	Message(Envelope const& _e, Secret const& _s = Secret(), unsigned _topicIndex = (unsigned)-1);
+	Message(Envelope const& _e, Secret const& _s, unsigned _topicIndex);
 	Message(bytes const& _payload): m_payload(_payload) {}
 	Message(bytesConstRef _payload): m_payload(_payload.toBytes()) {}
 	Message(bytes&& _payload) { std::swap(_payload, m_payload); }
diff --git a/libwhisper/WhisperHost.cpp b/libwhisper/WhisperHost.cpp
index 7bf427aa6..609d5e8bf 100644
--- a/libwhisper/WhisperHost.cpp
+++ b/libwhisper/WhisperHost.cpp
@@ -104,14 +104,15 @@ unsigned WhisperHost::installWatchOnId(h256 _h)
 	return ret;
 }
 
-unsigned WhisperHost::installWatch(shh::TopicFilter const& _f)
+unsigned WhisperHost::installWatch(shh::FullTopic const& _ft)
 {
 	Guard l(m_filterLock);
 
-	h256 h = _f.sha3();
+	InstalledFilter f(_ft);
+	h256 h = f.filter.sha3();
 
 	if (!m_filters.count(h))
-		m_filters.insert(make_pair(h, _f));
+		m_filters.insert(make_pair(h, f));
 
 	return installWatchOnId(h);
 }
diff --git a/libwhisper/WhisperHost.h b/libwhisper/WhisperHost.h
index 1a4ec2a71..07207989e 100644
--- a/libwhisper/WhisperHost.h
+++ b/libwhisper/WhisperHost.h
@@ -51,8 +51,8 @@ public:
 
 	virtual void inject(Envelope const& _e, WhisperPeer* _from = nullptr) override;
 
-	using Interface::installWatch;
-	virtual unsigned installWatch(TopicFilter const& _filter) override;
+	virtual FullTopic getFilter(unsigned _id) const { try { return m_filters.at(m_watches.at(_id).id).full; } catch (...) { return FullTopic(); } }
+	virtual unsigned installWatch(FullTopic const& _filter) override;
 	virtual unsigned installWatchOnId(h256 _filterId) override;
 	virtual void uninstallWatch(unsigned _watchId) override;
 	virtual h256s peekWatch(unsigned _watchId) const override { dev::Guard l(m_filterLock); try { return m_watches.at(_watchId).changes; } catch (...) { return h256s(); } }
diff --git a/libwhisper/WhisperPeer.cpp b/libwhisper/WhisperPeer.cpp
index dfa7ab628..7480a104e 100644
--- a/libwhisper/WhisperPeer.cpp
+++ b/libwhisper/WhisperPeer.cpp
@@ -106,7 +106,7 @@ void WhisperPeer::sendMessages()
 	}
 }
 
-void WhisperPeer::noteNewMessage(h256 _h, Message const& _m)
+void WhisperPeer::noteNewMessage(h256 _h, Envelope const& _m)
 {
 	Guard l(x_unseen);
 	m_unseen.insert(make_pair(rating(_m), _h));
diff --git a/libwhisper/WhisperPeer.h b/libwhisper/WhisperPeer.h
index d21f33725..5dd265e5a 100644
--- a/libwhisper/WhisperPeer.h
+++ b/libwhisper/WhisperPeer.h
@@ -63,8 +63,8 @@ private:
 
 	void sendMessages();
 
-	unsigned rating(Message const&) const { return 0; }	// TODO
-	void noteNewMessage(h256 _h, Message const& _m);
+	unsigned rating(Envelope const&) const { return 0; }	// TODO
+	void noteNewMessage(h256 _h, Envelope const& _m);
 
 	mutable dev::Mutex x_unseen;
 	std::multimap<unsigned, h256> m_unseen;	///< Rated according to what they want.