diff --git a/configure.in b/configure.in
index b5eea6b..e3e178c 100644
--- a/configure.in
+++ b/configure.in
@@ -39,6 +39,11 @@
 	[enable_talloc=0], [enable_talloc=1])
 AM_CONDITIONAL(ENABLE_TALLOC, test "x$enable_talloc" = "x1")
 
+AC_ARG_ENABLE(plugin,
+	[  --disable-plugin Disable support for dlopen plugins ],
+	[enable_plugin=0], [enable_plugin=1])
+AM_CONDITIONAL(ENABLE_PLUGIN, test "x$enable_plugin" = "x1")
+
 AC_ARG_ENABLE(tests,
 	[  --disable-tests Disable building test programs ],
 	[enable_tests=0], [enable_tests=1])
@@ -55,6 +60,7 @@
 	libosmovty.pc
 	include/osmocom/Makefile
 	include/osmocom/vty/Makefile
+	include/osmocom/crypt/Makefile
 	include/osmocore/Makefile
 	include/osmocore/protocol/Makefile
 	include/Makefile
diff --git a/include/osmocom/Makefile.am b/include/osmocom/Makefile.am
index 71293d1..fd9074c 100644
--- a/include/osmocom/Makefile.am
+++ b/include/osmocom/Makefile.am
@@ -1,3 +1,5 @@
 if ENABLE_VTY
-SUBDIRS = vty
+SUBDIRS = vty crypt
+else
+SUBDIRS = crypt
 endif
diff --git a/include/osmocom/crypt/Makefile.am b/include/osmocom/crypt/Makefile.am
new file mode 100644
index 0000000..7ce69fd
--- /dev/null
+++ b/include/osmocom/crypt/Makefile.am
@@ -0,0 +1,3 @@
+osmocrypt_HEADERS = gprs_cipher.h
+
+osmocryptdir = $(includedir)/osmocom/crypt
diff --git a/include/osmocom/crypt/gprs_cipher.h b/include/osmocom/crypt/gprs_cipher.h
new file mode 100644
index 0000000..1656037
--- /dev/null
+++ b/include/osmocom/crypt/gprs_cipher.h
@@ -0,0 +1,48 @@
+#ifndef _GPRS_CIPHER_H
+#define _GPRS_CIPHER_H
+
+#include <osmocore/linuxlist.h>
+
+#define GSM0464_CIPH_MAX_BLOCK	1523
+
+enum gprs_ciph_algo {
+	GPRS_ALGO_GEA0,
+	GPRS_ALGO_GEA1,
+	GPRS_ALGO_GEA2,
+	GPRS_ALGO_GEA3,
+	_GPRS_ALGO_NUM
+};
+
+enum gprs_cipher_direction {
+	GPRS_CIPH_MS2SGSN,
+	GPRS_CIPH_SGSN2MS,
+};
+
+/* An implementation of a GPRS cipher */
+struct gprs_cipher_impl {
+	struct llist_head list;
+	enum gprs_ciph_algo algo;
+	const char *name;
+	unsigned int priority;
+
+	/* As specified in 04.64 Annex A.  Uses Kc, IV and direction
+	 * to generate the 1523 bytes cipher stream that need to be
+	 * XORed wit the plaintext for encrypt / ciphertext for decrypt */
+	int (*run)(uint8_t *out, uint16_t len, uint64_t kc, uint32_t iv,
+		   enum gprs_cipher_direction direction);
+};
+
+/* register a cipher with the core (from a plugin) */
+int gprs_cipher_register(struct gprs_cipher_impl *ciph);
+
+/* load all available GPRS cipher plugins */
+int gprs_cipher_load(const char *path);
+
+/* function to be called by core code */
+int gprs_cipher_run(uint8_t *out, uint16_t len, enum gprs_ciph_algo algo,
+		    uint64_t kc, uint32_t iv, enum gprs_cipher_direction dir);
+
+/* Do we have an implementation for this cipher? */
+int gprs_cipher_supported(enum gprs_ciph_algo algo);
+
+#endif /* _GPRS_CIPHER_H */
diff --git a/include/osmocore/Makefile.am b/include/osmocore/Makefile.am
index 647b5c0..84859a4 100644
--- a/include/osmocore/Makefile.am
+++ b/include/osmocore/Makefile.am
@@ -1,7 +1,8 @@
 osmocore_HEADERS = signal.h linuxlist.h timer.h select.h msgb.h \
 		   tlv.h bitvec.h comp128.h statistics.h gsm_utils.h utils.h \
 		   gsmtap.h write_queue.h rsl.h gsm48.h rxlev_stat.h mncc.h \
-		   gsm48_ie.h logging.h gsm0808.h rate_ctr.h gsmtap_util.h
+		   gsm48_ie.h logging.h gsm0808.h rate_ctr.h gsmtap_util.h \
+		   plugin.h
 
 if ENABLE_TALLOC
 osmocore_HEADERS += talloc.h
diff --git a/include/osmocore/plugin.h b/include/osmocore/plugin.h
new file mode 100644
index 0000000..98f9b56
--- /dev/null
+++ b/include/osmocore/plugin.h
@@ -0,0 +1,6 @@
+#ifndef _OSMO_PLUGIN_H
+#define _OSMO_PLUGIN_H
+
+int plugin_load_all(const char *directory);
+
+#endif
diff --git a/src/Makefile.am b/src/Makefile.am
index dc2309a..a7d450b 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -12,7 +12,13 @@
 libosmocore_la_SOURCES = timer.c select.c signal.c msgb.c rxlev_stat.c \
 			 tlv_parser.c bitvec.c comp128.c gsm_utils.c statistics.c \
 			 write_queue.c utils.c rsl.c gsm48.c gsm48_ie.c \
-			 logging.c gsm0808.c rate_ctr.c gsmtap_util.c
+			 logging.c gsm0808.c rate_ctr.c gsmtap_util.c \
+			 gprs_cipher_core.c
+
+if ENABLE_PLUGIN
+libosmocore_la_SOURCES += plugin.c
+libosmocore_la_LDFLAGS = -ldl
+endif
 
 if ENABLE_TALLOC
 libosmocore_la_SOURCES += talloc.c
diff --git a/src/gprs_cipher_core.c b/src/gprs_cipher_core.c
new file mode 100644
index 0000000..a72dda8
--- /dev/null
+++ b/src/gprs_cipher_core.c
@@ -0,0 +1,85 @@
+/* GPRS LLC cipher core infrastructure */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <osmocore/utils.h>
+#include <osmocore/linuxlist.h>
+#include <osmocore/plugin.h>
+
+#include <osmocom/crypt/gprs_cipher.h>
+
+static LLIST_HEAD(gprs_ciphers);
+
+static struct gprs_cipher_impl *selected_ciphers[_GPRS_ALGO_NUM];
+
+/* register a cipher with the core */
+int gprs_cipher_register(struct gprs_cipher_impl *ciph)
+{
+	if (ciph->algo > ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	llist_add_tail(&ciph->list, &gprs_ciphers);
+
+	/* check if we want to select this implementation over others */
+	if (!selected_ciphers[ciph->algo] ||
+	    (selected_ciphers[ciph->algo]->priority > ciph->priority))
+		selected_ciphers[ciph->algo] = ciph;
+
+	return 0;
+}
+
+/* load all available GPRS cipher plugins */
+int gprs_cipher_load(const char *path)
+{
+	/* load all plugins available from path */
+	return plugin_load_all(path);
+}
+
+/* function to be called by core code */
+int gprs_cipher_run(uint8_t *out, uint16_t len, enum gprs_ciph_algo algo,
+		    uint64_t kc, uint32_t iv, enum gprs_cipher_direction dir)
+{
+	if (algo > ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	if (!selected_ciphers[algo])
+		return -EINVAL;
+
+	if (len > GSM0464_CIPH_MAX_BLOCK)
+		return -ERANGE;
+
+	/* run the actual cipher from the plugin */
+	return selected_ciphers[algo]->run(out, len, kc, iv, dir);
+}
+
+int gprs_cipher_supported(enum gprs_ciph_algo algo)
+{
+	if (algo > ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	if (selected_ciphers[algo])
+		return 1;
+
+	return 0;
+}
diff --git a/src/plugin.c b/src/plugin.c
new file mode 100644
index 0000000..e953508
--- /dev/null
+++ b/src/plugin.c
@@ -0,0 +1,62 @@
+/* plugin infrastructure */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include "../config.h"
+
+#if HAVE_DLFCN_H
+
+#include <sys/types.h>
+#include <dirent.h>
+#include <dlfcn.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include <osmocore/plugin.h>
+
+int plugin_load_all(const char *directory)
+{
+	unsigned int num = 0;
+	char fname[PATH_MAX];
+	DIR *dir;
+	struct dirent *entry;
+
+	dir = opendir(directory);
+	if (!dir)
+		return -errno;
+
+	while ((entry = readdir(dir))) {
+		snprintf(fname, sizeof(fname), "%s/%s", directory,
+			entry->d_name);
+		if (dlopen(fname, RTLD_NOW))
+			num++;
+	}
+
+	closedir(dir);
+
+	return num;
+}
+#else
+int plugin_load_all(const char *directory)
+{
+	return 0;
+}
+#endif /* HAVE_DLFCN_H */