Index: /trunk/src/VBox/Main/include/ApplianceImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ApplianceImpl.h	(revision 55183)
+++ /trunk/src/VBox/Main/include/ApplianceImpl.h	(revision 55184)
@@ -105,4 +105,7 @@
                   ComPtr<IProgress> &aProgress);
     HRESULT getWarnings(std::vector<com::Utf8Str> &aWarnings);
+    HRESULT getPasswordIds(std::vector<com::Utf8Str> &aIdentifiers);
+    HRESULT addPasswords(const std::vector<com::Utf8Str> &aIdentifiers,
+                         const std::vector<com::Utf8Str> &aPasswords);
 
     /** weak VirtualBox parent */
Index: /trunk/src/VBox/Main/include/ApplianceImplPrivate.h
===================================================================
--- /trunk/src/VBox/Main/include/ApplianceImplPrivate.h	(revision 55183)
+++ /trunk/src/VBox/Main/include/ApplianceImplPrivate.h	(revision 55184)
@@ -21,5 +21,7 @@
 
 #include "ovfreader.h"
+#include "SecretKeyStore.h"
 #include <map>
+#include <vector>
 #include <iprt/vfs.h>
 
@@ -61,4 +63,5 @@
       , ulTotalDisksMB(0)
       , cDisks(0)
+      , m_cPwProvided(0)
     {
     }
@@ -99,4 +102,11 @@
 
     std::list<Guid>     llGuidsMachinesCreated;
+
+    /** Sequence of password identifiers to encrypt disk images during export. */
+    std::vector<com::Utf8Str> m_vecPasswordIdentifiers;
+    /** Secret key store used to hold the passwords during export. */
+    SecretKeyStore            *m_pSecretKeyStore;
+    /** Number of passwords provided. */
+    uint32_t                  m_cPwProvided;
 };
 
Index: /trunk/src/VBox/Main/include/ConsoleImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 55183)
+++ /trunk/src/VBox/Main/include/ConsoleImpl.h	(revision 55184)
@@ -22,4 +22,5 @@
 #include "VBox/com/array.h"
 #include "EventImpl.h"
+#include "SecretKeyStore.h"
 #include "ConsoleWrap.h"
 
@@ -582,48 +583,8 @@
     };
 
-    /**
-     * Class for managing cryptographic keys.
-     * @todo: Replace with a keystore implementation once it is ready.
-     */
-    class SecretKey
-    {
-        public:
-            SecretKey() { }
-
-            SecretKey(uint8_t *pbKey, size_t cbKey, bool fRemoveOnSuspend)
-               : m_cRefs(0),
-                 m_pbKey(pbKey),
-                 m_cbKey(cbKey),
-                 m_fRemoveOnSuspend(fRemoveOnSuspend),
-                 m_cDisks(0)
-            { }
-
-            ~SecretKey()
-            {
-                RTMemSaferFree(m_pbKey, m_cbKey);
-                m_cRefs = 0;
-                m_pbKey = NULL;
-                m_cbKey = 0;
-                m_fRemoveOnSuspend = false;
-                m_cDisks = 0;
-            }
-
-            /** Reference counter of the key. */
-            volatile uint32_t m_cRefs;
-            /** Key material. */
-            uint8_t          *m_pbKey;
-            /** Size of the key in bytes. */
-            size_t            m_cbKey;
-            /** Flag whether to remove the key on suspend. */
-            bool              m_fRemoveOnSuspend;
-            /** Number of disks using this key. */
-            uint32_t          m_cDisks;
-    };
-
     typedef std::map<Utf8Str, ComObjPtr<SharedFolder> > SharedFolderMap;
     typedef std::map<Utf8Str, SharedFolderData> SharedFolderDataMap;
     typedef std::map<Utf8Str, ComPtr<IMediumAttachment> > MediumAttachmentMap;
     typedef std::list <USBStorageDevice> USBStorageDeviceList;
-    typedef std::map<Utf8Str, SecretKey *> SecretKeyMap;
 
 private:
@@ -997,10 +958,10 @@
     USBStorageDeviceList mUSBStorageDevices;
 
-    /** Map of secret keys used for disk encryption. */
-    SecretKeyMap         m_mapSecretKeys;
+    /** Store for secret keys. */
+    SecretKeyStore * const m_pKeyStore;
     /** Number of disks configured for encryption. */
-    unsigned             m_cDisksEncrypted;
+    unsigned               m_cDisksEncrypted;
     /** Number of disks which have the key in the map. */
-    unsigned             m_cDisksPwProvided;
+    unsigned               m_cDisksPwProvided;
 
     /** Pointer to the key consumer -> provider (that's us) callbacks. */