Index: jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/jackrabbit/SimpleReferenceBinary.java
===================================================================
--- jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/jackrabbit/SimpleReferenceBinary.java	(revision 0)
+++ jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/jackrabbit/SimpleReferenceBinary.java	(revision 0)
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.commons.jackrabbit;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+import javax.jcr.RepositoryException;
+
+import org.apache.jackrabbit.api.ReferenceBinary;
+import org.apache.jackrabbit.api.ReferenceBinaryException;
+
+public class SimpleReferenceBinary implements ReferenceBinary {
+
+    private final String reference;
+
+    public SimpleReferenceBinary(String reference) {
+        this.reference = reference;
+    }
+
+    //---------------------------------------------------< ReferenceBinary >--
+
+    @Override
+    public String getReference() {
+        return reference;
+    }
+
+    //------------------------------------------------------------< Binary >--
+
+    @Override
+    public InputStream getStream() throws RepositoryException {
+        throw new ReferenceBinaryException(
+                "Broken binary reference: " + reference);
+    }
+
+    @Override
+    public int read(byte[] b, long position)
+            throws IOException, RepositoryException {
+        throw new ReferenceBinaryException(
+                "Broken binary reference: " + reference);
+    }
+
+    @Override
+    public long getSize() throws RepositoryException {
+        throw new ReferenceBinaryException(
+                "Broken binary reference: " + reference);
+    }
+
+    @Override
+    public void dispose() {
+        // ignore
+    }
+
+}

Property changes on: jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/jackrabbit/SimpleReferenceBinary.java
___________________________________________________________________
Added: svn:eol-style
   + native

Index: jackrabbit-core/src/test/repository/repository.xml
===================================================================
--- jackrabbit-core/src/test/repository/repository.xml	(revision 1480214)
+++ jackrabbit-core/src/test/repository/repository.xml	(working copy)
@@ -30,7 +30,9 @@
     <!--
         data store configuration
     -->
-	<DataStore class="org.apache.jackrabbit.core.data.FileDataStore"/>
+    <DataStore class="org.apache.jackrabbit.core.data.FileDataStore">
+        <param name="secret" value="a very well kept secret"/>
+    </DataStore>
     <!--
         sample database data store configuration
         <DataStore class="org.apache.jackrabbit.core.data.db.DbDataStore">
Index: jackrabbit-core/src/test/java/org/apache/jackrabbit/core/value/ReferenceBinaryTest.java
===================================================================
--- jackrabbit-core/src/test/java/org/apache/jackrabbit/core/value/ReferenceBinaryTest.java	(revision 0)
+++ jackrabbit-core/src/test/java/org/apache/jackrabbit/core/value/ReferenceBinaryTest.java	(revision 0)
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.core.value;
+
+import javax.jcr.Binary;
+import javax.jcr.Session;
+import javax.jcr.SimpleCredentials;
+
+import org.apache.jackrabbit.api.ReferenceBinary;
+import org.apache.jackrabbit.commons.jackrabbit.SimpleReferenceBinary;
+import org.apache.jackrabbit.core.data.RandomInputStream;
+import org.apache.jackrabbit.test.AbstractJCRTest;
+
+/**
+ * Testcase for JCR-3534.
+ */
+public class ReferenceBinaryTest extends AbstractJCRTest {
+
+    private static final int STREAM_LENGTH = 256 * 1024;
+
+    public void testReferenceBinaryExchangeWithSharedRepository() throws Exception {
+
+        Session firstSession = superuser;
+
+        // create a binary
+        Binary b = vf.createBinary(new RandomInputStream(1, STREAM_LENGTH));
+
+        ReferenceBinary referenceBinary = null;
+        if (b instanceof ReferenceBinary) {
+            referenceBinary = (ReferenceBinary) b;
+        }
+
+        assertNotNull(referenceBinary);
+
+        assertNotNull(referenceBinary.getReference());
+
+        // in the current test the message is exchanged via repository which is shared as well
+        // put the reference message value in a property on a node
+        String newNode = "sample_" + System.nanoTime();
+        firstSession.getRootNode().addNode(newNode).setProperty("reference", referenceBinary.getReference());
+
+        // save the first session
+        firstSession.save();
+
+        // get a second session over the same repository / ds
+        Session secondSession = getHelper().getRepository().login(new SimpleCredentials("admin", "admin".toCharArray()));
+
+        // read the binary referenced by the referencing binary
+        String reference = secondSession.getRootNode().getNode(newNode).getProperty("reference").getString();
+
+        ReferenceBinary ref = new SimpleReferenceBinary(reference);
+
+        assertEquals(b, secondSession.getValueFactory().createValue(ref).getBinary());
+
+    }
+
+}
\ No newline at end of file

Property changes on: jackrabbit-core/src/test/java/org/apache/jackrabbit/core/value/ReferenceBinaryTest.java
___________________________________________________________________
Added: svn:eol-style
   + native

Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/ValueFactoryImpl.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/ValueFactoryImpl.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/ValueFactoryImpl.java	(working copy)
@@ -17,6 +17,7 @@
 package org.apache.jackrabbit.core.value;
 
 import org.apache.commons.io.IOUtils;
+import org.apache.jackrabbit.api.ReferenceBinary;
 import org.apache.jackrabbit.core.data.DataIdentifier;
 import org.apache.jackrabbit.core.data.DataStore;
 import org.apache.jackrabbit.spi.commons.conversion.NamePathResolver;
@@ -106,6 +107,14 @@
                 }
             } else if (binary instanceof BLOBFileValue) {
                 return new BinaryValueImpl(((BLOBFileValue) binary).copy());
+            } else if (binary instanceof ReferenceBinary) {
+                String reference = ((ReferenceBinary) binary).getReference();
+                DataIdentifier identifier = store.getIdentifierFromReference(reference);
+                if (identifier != null) {
+                    InternalValue value = InternalValue.getInternalValue(
+                            identifier, store, false);
+                    return new BinaryValueImpl(value.getBLOBFileValue());
+                }
             }
             return createValue(binary.getStream());
         } catch (RepositoryException e) {
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/BLOBInDataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/BLOBInDataStore.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/value/BLOBInDataStore.java	(working copy)
@@ -16,6 +16,7 @@
  */
 package org.apache.jackrabbit.core.value;
 
+import org.apache.jackrabbit.api.ReferenceBinary;
 import org.apache.jackrabbit.core.data.DataIdentifier;
 import org.apache.jackrabbit.core.data.DataRecord;
 import org.apache.jackrabbit.core.data.DataStore;
@@ -30,7 +31,7 @@
 /**
  * Represents binary data which is stored in the data store.
  */
-class BLOBInDataStore extends BLOBFileValue {
+class BLOBInDataStore extends BLOBFileValue implements ReferenceBinary {
 
     private final DataStore store;
     private final DataIdentifier identifier;
@@ -103,6 +104,11 @@
         return getDataRecord().getStream();
     }
 
+    @Override
+    public String getReference() {
+        return identifier.getReference();
+    }
+
     public String toString() {
         return PREFIX + identifier;
     }
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/MultiDataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/MultiDataStore.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/MultiDataStore.java	(working copy)
@@ -313,6 +313,15 @@
         return archiveDataStore.getAllIdentifiers();
     }
 
+    @Override
+    public DataIdentifier getIdentifierFromReference(String reference) {
+        DataIdentifier identifier = primaryDataStore.getIdentifierFromReference(reference);
+        if (identifier == null) {
+            identifier = archiveDataStore.getIdentifierFromReference(reference);
+        }
+        return identifier;
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -709,4 +718,5 @@
             }
         }
     }
+
 }
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/db/DbDataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/db/DbDataStore.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/db/DbDataStore.java	(working copy)
@@ -17,9 +17,9 @@
 package org.apache.jackrabbit.core.data.db;
 
 import org.apache.commons.io.input.CountingInputStream;
+import org.apache.jackrabbit.core.data.AbstractDataStore;
 import org.apache.jackrabbit.core.data.DataIdentifier;
 import org.apache.jackrabbit.core.data.DataRecord;
-import org.apache.jackrabbit.core.data.DataStore;
 import org.apache.jackrabbit.core.data.DataStoreException;
 import org.apache.jackrabbit.core.data.MultiDataStoreAware;
 import org.apache.jackrabbit.core.util.db.CheckSchemaOperation;
@@ -98,7 +98,8 @@
  * The tablePrefix can be used to specify a schema and / or catalog name:
  * &lt;param name="tablePrefix" value="ds.">
  */
-public class DbDataStore implements DataStore, DatabaseAware, MultiDataStoreAware {
+public class DbDataStore extends AbstractDataStore
+        implements DatabaseAware, MultiDataStoreAware {
 
     /**
      * The default value for the minimum object size.
@@ -355,7 +356,8 @@
             // UPDATE DATASTORE SET DATA=? WHERE ID=?
             conHelper.exec(updateDataSQL, wrapper, tempId);
             long length = in.getByteCount();
-            DataIdentifier identifier = new DataIdentifier(digest.digest());
+            DataIdentifier identifier =
+                    createIdentifier(encodeHexString(digest.digest()));
             usesIdentifier(identifier);
             String id = identifier.toString();
             long newModified;
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/AbstractDataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/AbstractDataStore.java	(revision 0)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/AbstractDataStore.java	(revision 0)
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.core.data;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+public abstract class AbstractDataStore implements DataStore {
+
+    private static final String ALGORITHM = "HmacSHA1";
+
+    /**
+     * Array of hexadecimal digits.
+     */
+    private static final char[] HEX = "0123456789abcdef".toCharArray();
+
+    private String secret;
+
+    public void setSecret(String secret) {
+        this.secret = secret;
+    }
+
+    /**
+     * Returns the hex encoding of the given bytes.
+     *
+     * @param value value to be encoded
+     * @return encoded value
+     */
+    protected static String encodeHexString(byte[] value) {
+        char[] buffer = new char[value.length * 2];
+        for (int i = 0; i < value.length; i++) {
+            buffer[2 * i] = HEX[(value[i] >> 4) & 0x0f];
+            buffer[2 * i + 1] = HEX[value[i] & 0x0f];
+        }
+        return new String(buffer);
+    }
+
+
+    @Override
+    public DataIdentifier getIdentifierFromReference(String reference) {
+        if (secret != null) {
+            int colon = reference.indexOf(':');
+            if (colon != -1) {
+                String identifier = reference.substring(0, colon);
+                String signature = reference.substring(colon + 1);
+                if (signature.equals(sign(identifier))) {
+                    return new DataIdentifier(identifier, reference);
+                }
+            }
+        }
+        return null;
+    }
+
+    //---------------------------------------------------------< protected >--
+
+    protected DataIdentifier createIdentifier(final String identifier) {
+        if (secret != null) {
+            return new DataIdentifier(identifier) {
+                public String getReference() {
+                    return identifier + ':' + sign(identifier);
+                }
+            };
+        } else {
+            return new DataIdentifier(identifier);
+        }
+    }
+
+    private String sign(String identifier) {
+        try {
+            Mac mac = Mac.getInstance(ALGORITHM);
+            mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), ALGORITHM));
+            return encodeHexString(mac.doFinal(identifier.getBytes("UTF-8")));
+        } catch (Exception e) {
+            // TODO: log a warning about this exception
+            return null;
+        }
+    }
+
+}

Property changes on: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/AbstractDataStore.java
___________________________________________________________________
Added: svn:eol-style
   + native

Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataIdentifier.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataIdentifier.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataIdentifier.java	(working copy)
@@ -23,7 +23,7 @@
  * All identifiers must be serializable and implement the standard
  * object equality and hash code methods.
  */
-public final class DataIdentifier implements Serializable {
+public class DataIdentifier implements Serializable {
 
     /**
      * Serial version UID.
@@ -31,39 +31,45 @@
     private static final long serialVersionUID = -9197191401131100016L;
 
     /**
-     * Array of hexadecimal digits.
+     * Data identifier.
      */
-    private static final char[] HEX = "0123456789abcdef".toCharArray();
+    private final String identifier;
 
     /**
-     * Data identifier.
+     * Binary reference, or {@code null}.
      */
-    private final String identifier;
+    private final String reference;
 
     /**
      * Creates a data identifier from the given string.
      *
      * @param identifier data identifier
+     * @param reference binary reference, or {@code null}
      */
-    public DataIdentifier(String identifier) {
+    public DataIdentifier(String identifier, String reference) {
         this.identifier = identifier;
+        this.reference = reference;
     }
 
     /**
-     * Creates a data identifier from the hexadecimal string
-     * representation of the given bytes.
+     * Creates a data identifier from the given string.
      *
      * @param identifier data identifier
      */
-    public DataIdentifier(byte[] identifier) {
-        char[] buffer = new char[identifier.length * 2];
-        for (int i = 0; i < identifier.length; i++) {
-            buffer[2 * i] = HEX[(identifier[i] >> 4) & 0x0f];
-            buffer[2 * i + 1] = HEX[identifier[i] & 0x0f];
-        }
-        this.identifier = new String(buffer);
+    public DataIdentifier(String identifier) {
+        this(identifier, null);
     }
 
+    /**
+     * Returns a secure reference to the identified binary, or {@code null}
+     * if no such reference is available.
+     *
+     * @return binary reference, or {@code null}
+     */
+    public String getReference() {
+        return reference;
+    }
+
     //-------------------------------------------------------------< Object >
 
     /**
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/FileDataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/FileDataStore.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/FileDataStore.java	(working copy)
@@ -59,7 +59,8 @@
  * This implementation relies on the underlying file system to support
  * atomic O(1) move operations with {@link File#renameTo(File)}.
  */
-public class FileDataStore implements DataStore, MultiDataStoreAware {
+public class FileDataStore extends AbstractDataStore
+        implements MultiDataStoreAware {
 
     /**
      * Logger instance
@@ -207,7 +208,8 @@
             } finally {
                 output.close();
             }
-            DataIdentifier identifier = new DataIdentifier(digest.digest());
+            DataIdentifier identifier =
+                    createIdentifier(encodeHexString(digest.digest()));
             File file;
 
             synchronized (this) {
Index: jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataStore.java
===================================================================
--- jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataStore.java	(revision 1480214)
+++ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/data/DataStore.java	(working copy)
@@ -109,6 +109,15 @@
     Iterator<DataIdentifier> getAllIdentifiers() throws DataStoreException;
 
     /**
+     * Returns the identifier that matches the given binary reference.
+     * If the reference is invalid, returns {@code null}.
+     *
+     * @param reference binary reference
+     * @return matching identifier, or {@code null}
+     */
+    DataIdentifier getIdentifierFromReference(String reference);
+
+    /**
      * Initialized the data store
      *
      * @param homeDir the home directory of the repository
Index: jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinary.java
===================================================================
--- jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinary.java	(revision 0)
+++ jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinary.java	(revision 0)
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.api;
+
+import javax.jcr.Binary;
+
+/**
+ * Referenceable binary. In addition to the normal JCR {@link Binary}
+ * functionality, implementations of this class contain a <em>secure
+ * reference</em> to the storage location of the binary stream. This
+ * reference can be used to efficiently copy binaries across servers as
+ * long as both the source and target servers use the same underlying
+ * storage for binaries.
+ */
+public interface ReferenceBinary extends Binary {
+
+    /**
+     * Returns a secure reference to this binary, or {@code null} if such
+     * a reference is not available.
+     *
+     * @return binary reference, or {@code null}
+     */
+    String getReference();
+
+}

Property changes on: jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinary.java
___________________________________________________________________
Added: svn:eol-style
   + native

Index: jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinaryException.java
===================================================================
--- jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinaryException.java	(revision 0)
+++ jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinaryException.java	(revision 0)
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.api;
+
+import javax.jcr.RepositoryException;
+
+public class ReferenceBinaryException extends RepositoryException {
+
+    public ReferenceBinaryException(String message) {
+        super(message);
+    }
+
+}

Property changes on: jackrabbit-api/src/main/java/org/apache/jackrabbit/api/ReferenceBinaryException.java
___________________________________________________________________
Added: svn:eol-style
   + native