Merge branch 'retargeting-contracts'

author: Andrew Arnott <andrewarnott@gmail.com> 2012-12-26 20:22:14 -0800
committer: Andrew Arnott <andrewarnott@gmail.com> 2012-12-26 20:22:14 -0800
commit: 391397a341282d0c088bc9e9901ced9b19a62e5a (patch)
tree: bc1cc264acba9edc486eefbbfbb5fd4822111fb1 /src
parent: 8f48e3f1daedb77e451f9fe8ac497741c6bb06f9 (diff)
parent: 3475fab579db0f6a1454ebc83d2e8a9c271e4c18 (diff)
download: DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.zip
DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.tar.gz
DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.tar.bz2
427 files changed, 968 insertions, 4884 deletions
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth/DotNetOpenAuthWebConsumer.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth/DotNetOpenAuthWebConsumer.cs
index 9af6804..e216906 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth/DotNetOpenAuthWebConsumer.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth/DotNetOpenAuthWebConsumer.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The dot net open auth web consumer.
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth/InMemoryOAuthTokenManager.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth/InMemoryOAuthTokenManager.cs
index b45a65b..a7b641c 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth/InMemoryOAuthTokenManager.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth/InMemoryOAuthTokenManager.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An implementation of IOAuthTokenManager which stores keys in memory.
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs
index 1ae64fc..a0afeca 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs
@@ -16,6 +16,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Represents base class for OAuth 1.0 clients
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth/SimpleConsumerTokenManager.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth/SimpleConsumerTokenManager.cs
index 22156e9..899204c 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth/SimpleConsumerTokenManager.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth/SimpleConsumerTokenManager.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.AspNet.Clients {
 	using System;
 	using DotNetOpenAuth.OAuth.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// Simple wrapper around IConsumerTokenManager
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/FacebookClient.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/FacebookClient.cs
index a8c121d..d20e452 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/FacebookClient.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/FacebookClient.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using System.Net;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The facebook client.
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/JsonHelper.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/JsonHelper.cs
index a7ff79e..918a8a9 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/JsonHelper.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/JsonHelper.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using System;
 	using System.IO;
 	using System.Runtime.Serialization.Json;
+	using Validation;
 
 	/// <summary>
 	/// The json helper.
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/MicrosoftClient.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/MicrosoftClient.cs
index 653a0b0..3e5f71f 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/MicrosoftClient.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/MicrosoftClient.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using System.IO;
 	using System.Net;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The Microsoft account client.
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/OAuth2Client.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/OAuth2Client.cs
index 138fac2..014f459 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OAuth2/OAuth2Client.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth2/OAuth2Client.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
 	using System.Web;
+	using Validation;
 
 	/// <summary>
 	/// Represents the base class for OAuth 2.0 clients
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OpenID/OpenIDClient.cs b/src/DotNetOpenAuth.AspNet/Clients/OpenID/OpenIDClient.cs
index bd706f5..a41b504 100644
--- a/src/DotNetOpenAuth.AspNet/Clients/OpenID/OpenIDClient.cs
+++ b/src/DotNetOpenAuth.AspNet/Clients/OpenID/OpenIDClient.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.AspNet.Clients {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Base classes for OpenID clients.
diff --git a/src/DotNetOpenAuth.AspNet/DotNetOpenAuth.AspNet.csproj b/src/DotNetOpenAuth.AspNet/DotNetOpenAuth.AspNet.csproj
index 405ac3c..c608c97 100644
--- a/src/DotNetOpenAuth.AspNet/DotNetOpenAuth.AspNet.csproj
+++ b/src/DotNetOpenAuth.AspNet/DotNetOpenAuth.AspNet.csproj
@@ -40,6 +40,10 @@
     <Reference Include="Microsoft.CSharp" />
     <Reference Include="System.Data" />
     <Reference Include="System.Xml" />
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <Compile Include="AuthenticationResult.cs" />
@@ -108,6 +112,9 @@
       <Name>DotNetOpenAuth.OpenId</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.AspNet/OpenAuthAuthenticationTicketHelper.cs b/src/DotNetOpenAuth.AspNet/OpenAuthAuthenticationTicketHelper.cs
index f51de1c..63f89b7 100644
--- a/src/DotNetOpenAuth.AspNet/OpenAuthAuthenticationTicketHelper.cs
+++ b/src/DotNetOpenAuth.AspNet/OpenAuthAuthenticationTicketHelper.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.AspNet {
 	using System.Diagnostics;
 	using System.Web;
 	using System.Web.Security;
+	using Validation;
 
 	/// <summary>
 	/// Helper methods for setting and retrieving a custom forms authentication ticket for delegation protocols.
diff --git a/src/DotNetOpenAuth.AspNet/OpenAuthSecurityManager.cs b/src/DotNetOpenAuth.AspNet/OpenAuthSecurityManager.cs
index 2d18b7b..6736205 100644
--- a/src/DotNetOpenAuth.AspNet/OpenAuthSecurityManager.cs
+++ b/src/DotNetOpenAuth.AspNet/OpenAuthSecurityManager.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.AspNet {
 	using System.Web.Security;
 	using DotNetOpenAuth.AspNet.Clients;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Manage authenticating with an external OAuth or OpenID provider
diff --git a/src/DotNetOpenAuth.AspNet/packages.config b/src/DotNetOpenAuth.AspNet/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.AspNet/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.BuildTasks/DotNetOpenAuth.BuildTasks.csproj b/src/DotNetOpenAuth.BuildTasks/DotNetOpenAuth.BuildTasks.csproj
index f7d7256..64e3ab9 100644
--- a/src/DotNetOpenAuth.BuildTasks/DotNetOpenAuth.BuildTasks.csproj
+++ b/src/DotNetOpenAuth.BuildTasks/DotNetOpenAuth.BuildTasks.csproj
@@ -28,7 +28,6 @@
     <IsWebBootstrapper>false</IsWebBootstrapper>
     <UseApplicationTrust>false</UseApplicationTrust>
     <BootstrapperEnabled>true</BootstrapperEnabled>
-    <CodeContractsAssemblyMode>1</CodeContractsAssemblyMode>
     <TargetFrameworkProfile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
@@ -39,35 +38,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
-    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
-    <CodeContractsRuntimeThrowOnFailure>False</CodeContractsRuntimeThrowOnFailure>
-    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
-    <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
-    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
-    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
-    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
-    <CodeContractsRedundantAssumptions>False</CodeContractsRedundantAssumptions>
-    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
-    <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
-    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
-    <CodeContractsEmitXMLDocs>False</CodeContractsEmitXMLDocs>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
-    <CodeContractsLibPaths>
-    </CodeContractsLibPaths>
-    <CodeContractsPlatformPath>
-    </CodeContractsPlatformPath>
-    <CodeContractsExtraAnalysisOptions>
-    </CodeContractsExtraAnalysisOptions>
-    <CodeContractsBaseLineFile>
-    </CodeContractsBaseLineFile>
-    <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
-    <CodeContractsReferenceAssembly>%28none%29</CodeContractsReferenceAssembly>
     <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
-    <CodeContractsExtraRewriteOptions />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>
diff --git a/src/DotNetOpenAuth.Core.UI/ComponentModel/ConverterBase.cs b/src/DotNetOpenAuth.Core.UI/ComponentModel/ConverterBase.cs
index ca17197..eec2304 100644
--- a/src/DotNetOpenAuth.Core.UI/ComponentModel/ConverterBase.cs
+++ b/src/DotNetOpenAuth.Core.UI/ComponentModel/ConverterBase.cs
@@ -145,7 +145,7 @@ namespace DotNetOpenAuth.ComponentModel {
 		/// </exception>
 		[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "System.Diagnostics.Contracts.__ContractsRuntime.Assume(System.Boolean,System.String,System.String)", Justification = "No localization required.")]
 		public override object ConvertTo(ITypeDescriptorContext context, CultureInfo culture, object value, Type destinationType) {
-			Contract.Assume(destinationType != null, "Missing contract.");
+			Assumes.True(destinationType != null, "Missing contract.");
 			if (destinationType.IsInstanceOfType(value)) {
 				return value;
 			}
@@ -181,7 +181,6 @@ namespace DotNetOpenAuth.ComponentModel {
 		[Pure]
 		[SuppressMessage("Microsoft.Design", "CA1024:UsePropertiesWhereAppropriate", Justification = "Potentially expensive call.")]
 		protected virtual ICollection GetStandardValuesForCache() {
-			Contract.Ensures(Contract.Result<ICollection>() != null);
 			return new T[0];
 		}
 
diff --git a/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverter.cs b/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverter.cs
index c382716..fd960d3 100644
--- a/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverter.cs
+++ b/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverter.cs
@@ -11,12 +11,12 @@ namespace DotNetOpenAuth.ComponentModel {
 	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A type that generates suggested strings for Intellisense,
 	/// but doesn't actually convert between strings and other types.
 	/// </summary>
-	[ContractClass(typeof(SuggestedStringsConverterContract))]
 	public abstract class SuggestedStringsConverter : ConverterBase<string> {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="SuggestedStringsConverter"/> class.
@@ -37,7 +37,6 @@ namespace DotNetOpenAuth.ComponentModel {
 		/// <returns>A collection of values.</returns>
 		internal static ICollection GetStandardValuesForCacheShared(Type type) {
 			Requires.NotNull(type, "type");
-			Contract.Ensures(Contract.Result<ICollection>() != null);
 
 			var fields = from field in type.GetFields(BindingFlags.Static | BindingFlags.Public)
 						 select field.GetValue(null);
diff --git a/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverterContract.cs b/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverterContract.cs
deleted file mode 100644
index dbd2278..0000000
--- a/src/DotNetOpenAuth.Core.UI/ComponentModel/SuggestedStringsConverterContract.cs
+++ /dev/null
@@ -1,30 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="SuggestedStringsConverterContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.ComponentModel {
-	using System;
-	using System.Collections;
-	using System.ComponentModel.Design.Serialization;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Reflection;
-
-	/// <summary>
-	/// Contract class for the <see cref="SuggestedStringsConverter"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(SuggestedStringsConverter))]
-	internal abstract class SuggestedStringsConverterContract : SuggestedStringsConverter {
-		/// <summary>
-		/// Gets the type to reflect over for the well known values.
-		/// </summary>
-		protected override Type WellKnownValuesType {
-			get {
-				Contract.Ensures(Contract.Result<Type>() != null);
-				throw new NotImplementedException();
-			}
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.Core.UI/DotNetOpenAuth.Core.UI.csproj b/src/DotNetOpenAuth.Core.UI/DotNetOpenAuth.Core.UI.csproj
index eba7fbe..1b138c7 100644
--- a/src/DotNetOpenAuth.Core.UI/DotNetOpenAuth.Core.UI.csproj
+++ b/src/DotNetOpenAuth.Core.UI/DotNetOpenAuth.Core.UI.csproj
@@ -23,7 +23,6 @@
     <Compile Include="ComponentModel\ClaimTypeSuggestions.cs" />
     <Compile Include="ComponentModel\ConverterBase.cs" />
     <Compile Include="ComponentModel\SuggestedStringsConverter.cs" />
-    <Compile Include="ComponentModel\SuggestedStringsConverterContract.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
   </ItemGroup>
   <ItemGroup>
@@ -32,6 +31,15 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.Core.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.Core.UI/Properties/AssemblyInfo.cs
index 4eb88a3..23a9f9b 100644
--- a/src/DotNetOpenAuth.Core.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.Core.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.Core.UI/packages.config b/src/DotNetOpenAuth.Core.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.Core.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.Core/Configuration/DotNetOpenAuthSection.cs b/src/DotNetOpenAuth.Core/Configuration/DotNetOpenAuthSection.cs
index 7c03c48..cdcd670 100644
--- a/src/DotNetOpenAuth.Core/Configuration/DotNetOpenAuthSection.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/DotNetOpenAuthSection.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using System.Web;
 	using System.Web.Configuration;
 
@@ -15,7 +14,6 @@ namespace DotNetOpenAuth.Configuration {
 	/// Represents the section in the host's .config file that configures
 	/// this library's settings.
 	/// </summary>
-	[ContractVerification(true)]
 	public class DotNetOpenAuthSection : ConfigurationSectionGroup {
 		/// <summary>
 		/// The name of the section under which this library's settings must be found.
diff --git a/src/DotNetOpenAuth.Core/Configuration/HostNameElement.cs b/src/DotNetOpenAuth.Core/Configuration/HostNameElement.cs
index b46ece9..5386314 100644
--- a/src/DotNetOpenAuth.Core/Configuration/HostNameElement.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/HostNameElement.cs
@@ -6,12 +6,10 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents the name of a single host or a regex pattern for host names.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class HostNameElement : ConfigurationElement {
 		/// <summary>
 		/// Gets the name of the @name attribute.
diff --git a/src/DotNetOpenAuth.Core/Configuration/HostNameOrRegexCollection.cs b/src/DotNetOpenAuth.Core/Configuration/HostNameOrRegexCollection.cs
index f009ce5..8f537c3 100644
--- a/src/DotNetOpenAuth.Core/Configuration/HostNameOrRegexCollection.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/HostNameOrRegexCollection.cs
@@ -7,13 +7,12 @@
 namespace DotNetOpenAuth.Configuration {
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using System.Text.RegularExpressions;
+	using Validation;
 
 	/// <summary>
 	/// Represents a collection of child elements that describe host names either as literal host names or regex patterns.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class HostNameOrRegexCollection : ConfigurationElementCollection {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="HostNameOrRegexCollection"/> class.
@@ -63,7 +62,7 @@ namespace DotNetOpenAuth.Configuration {
 		/// An <see cref="T:System.Object"/> that acts as the key for the specified <see cref="T:System.Configuration.ConfigurationElement"/>.
 		/// </returns>
 		protected override object GetElementKey(ConfigurationElement element) {
-			Contract.Assume(element != null); // this should be Contract.Requires in base class.
+			Requires.NotNull(element, "element");
 			return ((HostNameElement)element).Name ?? string.Empty;
 		}
 	}
diff --git a/src/DotNetOpenAuth.Core/Configuration/MessagingElement.cs b/src/DotNetOpenAuth.Core/Configuration/MessagingElement.cs
index ff98d36..64dfba3 100644
--- a/src/DotNetOpenAuth.Core/Configuration/MessagingElement.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/MessagingElement.cs
@@ -7,14 +7,12 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 
 	/// <summary>
 	/// Represents the &lt;messaging&gt; element in the host's .config file.
 	/// </summary>
-	[ContractVerification(true)]
 	public class MessagingElement : ConfigurationSection {
 		/// <summary>
 		/// The name of the &lt;webResourceUrlProvider&gt; sub-element.
@@ -75,7 +73,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		public static MessagingElement Configuration {
 			get {
-				Contract.Ensures(Contract.Result<MessagingElement>() != null);
 				return (MessagingElement)ConfigurationManager.GetSection(MessagingElementName) ?? new MessagingElement();
 			}
 		}
diff --git a/src/DotNetOpenAuth.Core/Configuration/ReportingElement.cs b/src/DotNetOpenAuth.Core/Configuration/ReportingElement.cs
index 0af8205..f0184a6 100644
--- a/src/DotNetOpenAuth.Core/Configuration/ReportingElement.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/ReportingElement.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
@@ -76,7 +75,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		public static ReportingElement Configuration {
 			get {
-				Contract.Ensures(Contract.Result<ReportingElement>() != null);
 				return (ReportingElement)ConfigurationManager.GetSection(ReportingElementName) ?? new ReportingElement();
 			}
 		}
diff --git a/src/DotNetOpenAuth.Core/Configuration/TrustedProviderConfigurationCollection.cs b/src/DotNetOpenAuth.Core/Configuration/TrustedProviderConfigurationCollection.cs
index 96f60bf..de70f64 100644
--- a/src/DotNetOpenAuth.Core/Configuration/TrustedProviderConfigurationCollection.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/TrustedProviderConfigurationCollection.cs
@@ -9,7 +9,7 @@ namespace DotNetOpenAuth.Configuration {
 	using System.Collections.Generic;
 	using System.Configuration;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A configuration collection of trusted OP Endpoints.
diff --git a/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationCollection.cs b/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationCollection.cs
index 3e72722..08bd2a1 100644
--- a/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationCollection.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationCollection.cs
@@ -8,16 +8,15 @@ namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A collection of <see cref="TypeConfigurationElement&lt;T&gt;"/>.
 	/// </summary>
 	/// <typeparam name="T">The type that all types specified in the elements must derive from.</typeparam>
-	[ContractVerification(true)]
 	internal class TypeConfigurationCollection<T> : ConfigurationElementCollection
 		where T : class {
 		/// <summary>
@@ -44,7 +43,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// <param name="allowInternals">if set to <c>true</c> then internal types may be instantiated.</param>
 		/// <returns>A sequence of instances generated from types in this collection.  May be empty, but never null.</returns>
 		internal IEnumerable<T> CreateInstances(bool allowInternals) {
-			Contract.Ensures(Contract.Result<IEnumerable<T>>() != null);
 			return from element in this.Cast<TypeConfigurationElement<T>>()
 			       where !element.IsEmpty
 			       select element.CreateInstance(default(T), allowInternals);
@@ -68,7 +66,7 @@ namespace DotNetOpenAuth.Configuration {
 		/// An <see cref="T:System.Object"/> that acts as the key for the specified <see cref="T:System.Configuration.ConfigurationElement"/>.
 		/// </returns>
 		protected override object GetElementKey(ConfigurationElement element) {
-			Contract.Assume(element != null); // this should be Contract.Requires in base class.
+			Requires.NotNull(element, "element");
 			TypeConfigurationElement<T> typedElement = (TypeConfigurationElement<T>)element;
 			return (!string.IsNullOrEmpty(typedElement.TypeName) ? typedElement.TypeName : typedElement.XamlSource) ?? string.Empty;
 		}
diff --git a/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationElement.cs b/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationElement.cs
index edbb614..a3a8140 100644
--- a/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationElement.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/TypeConfigurationElement.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Reflection;
 	using System.Web;
@@ -82,8 +81,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// <param name="defaultValue">The value to return if no type is given in the .config file.</param>
 		/// <returns>The newly instantiated type.</returns>
 		public T CreateInstance(T defaultValue) {
-			Contract.Ensures(Contract.Result<T>() != null || Contract.Result<T>() == defaultValue);
-
 			return this.CreateInstance(defaultValue, false);
 		}
 
@@ -95,8 +92,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// <returns>The newly instantiated type.</returns>
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "No apparent problem.  False positive?")]
 		public T CreateInstance(T defaultValue, bool allowInternals) {
-			Contract.Ensures(Contract.Result<T>() != null || Contract.Result<T>() == defaultValue);
-
 			if (this.CustomType != null) {
 				if (!allowInternals) {
 					// Although .NET will usually prevent our instantiating non-public types,
@@ -132,7 +127,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// be present.
 		/// </remarks>
 		private static T CreateInstanceFromXaml(Stream xaml) {
-			Contract.Ensures(Contract.Result<T>() != null);
 #if CLR4
 			return (T)XamlServices.Load(xaml);
 #else
diff --git a/src/DotNetOpenAuth.Core/Configuration/UntrustedWebRequestElement.cs b/src/DotNetOpenAuth.Core/Configuration/UntrustedWebRequestElement.cs
index b49452a..a16522a 100644
--- a/src/DotNetOpenAuth.Core/Configuration/UntrustedWebRequestElement.cs
+++ b/src/DotNetOpenAuth.Core/Configuration/UntrustedWebRequestElement.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents the section of a .config file where security policies regarding web requests
diff --git a/src/DotNetOpenAuth.Core/DotNetOpenAuth.Core.csproj b/src/DotNetOpenAuth.Core/DotNetOpenAuth.Core.csproj
index dc47259..71965ed 100644
--- a/src/DotNetOpenAuth.Core/DotNetOpenAuth.Core.csproj
+++ b/src/DotNetOpenAuth.Core/DotNetOpenAuth.Core.csproj
@@ -27,12 +27,10 @@
     <Compile Include="Messaging\Bindings\MemoryCryptoKeyStore.cs" />
     <Compile Include="Messaging\BinaryDataBagFormatter.cs" />
     <Compile Include="Messaging\CachedDirectWebResponse.cs" />
-    <Compile Include="Messaging\ChannelContract.cs" />
     <Compile Include="Messaging\DataBagFormatterBase.cs" />
     <Compile Include="Messaging\HmacAlgorithms.cs" />
     <Compile Include="Messaging\HttpRequestHeaders.cs" />
     <Compile Include="Messaging\IHttpDirectRequest.cs" />
-    <Compile Include="Messaging\IHttpDirectRequestContract.cs" />
     <Compile Include="Messaging\IHttpIndirectResponse.cs" />
     <Compile Include="Messaging\IMessageOriginalPayload.cs" />
     <Compile Include="Messaging\DirectWebRequestOptions.cs" />
@@ -40,7 +38,6 @@
     <Compile Include="Messaging\HostErrorException.cs" />
     <Compile Include="Messaging\IHttpDirectResponse.cs" />
     <Compile Include="Messaging\IExtensionMessage.cs" />
-    <Compile Include="Messaging\IHttpDirectResponseContract.cs" />
     <Compile Include="Messaging\IMessage.cs" />
     <Compile Include="Messaging\IncomingWebResponse.cs" />
     <Compile Include="Messaging\IDirectResponseProtocolMessage.cs" />
@@ -49,7 +46,6 @@
     <Compile Include="Messaging\EmptyList.cs" />
     <Compile Include="Messaging\ErrorUtilities.cs" />
     <Compile Include="Messaging\IMessageWithEvents.cs" />
-    <Compile Include="Messaging\IncomingWebResponseContract.cs" />
     <Compile Include="Messaging\IProtocolMessageWithExtensions.cs" />
     <Compile Include="Messaging\InternalErrorException.cs" />
     <Compile Include="Messaging\IStreamSerializingDataBag.cs" />
@@ -116,6 +112,7 @@
     <None Include="Messaging\Bindings\Bindings.cd" />
     <None Include="Messaging\Exceptions.cd" />
     <None Include="Messaging\Messaging.cd" />
+    <None Include="packages.config" />
   </ItemGroup>
   <ItemGroup>
     <Compile Include="Configuration\DotNetOpenAuthSection.cs" />
@@ -136,8 +133,9 @@
     <Compile Include="Loggers\TraceLogger.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="Messaging\ReadOnlyDictionary.cs" />
+    <Compile Include="PureAttribute.cs" />
     <Compile Include="Reporting.cs" />
-    <Compile Include="Requires.cs" />
+    <Compile Include="RequiresEx.cs" />
     <Compile Include="Strings.Designer.cs">
       <AutoGen>True</AutoGen>
       <DesignTime>True</DesignTime>
@@ -173,6 +171,9 @@
     <Reference Include="log4net, Version=1.2.10.0, Culture=neutral, PublicKeyToken=1b44e1d426115821, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
     </Reference>
+    <Reference Include="Validation">
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
diff --git a/src/DotNetOpenAuth.Core/Logger.cs b/src/DotNetOpenAuth.Core/Logger.cs
index 975b391..cf9343b 100644
--- a/src/DotNetOpenAuth.Core/Logger.cs
+++ b/src/DotNetOpenAuth.Core/Logger.cs
@@ -6,11 +6,11 @@
 
 namespace DotNetOpenAuth {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Loggers;
 	using DotNetOpenAuth.Messaging;
 	using log4net.Core;
+	using Validation;
 
 	/// <summary>
 	/// A general logger for the entire DotNetOpenAuth library.
diff --git a/src/DotNetOpenAuth.Core/Messaging/BinaryDataBagFormatter.cs b/src/DotNetOpenAuth.Core/Messaging/BinaryDataBagFormatter.cs
index 4f4bf0e..554205a 100644
--- a/src/DotNetOpenAuth.Core/Messaging/BinaryDataBagFormatter.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/BinaryDataBagFormatter.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// A compact binary <see cref="DataBag"/> serialization class.
@@ -45,7 +45,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="decodeOnceOnly">The nonce store to use to ensure that this instance is only decoded once.</param>
 		protected internal BinaryDataBagFormatter(ICryptoKeyStore cryptoKeyStore = null, string bucket = null, bool signed = false, bool encrypted = false, bool compressed = false, TimeSpan? minimumAge = null, TimeSpan? maximumAge = null, INonceStore decodeOnceOnly = null)
 			: base(cryptoKeyStore, bucket, signed, encrypted, compressed, minimumAge, maximumAge, decodeOnceOnly) {
-			Requires.True((cryptoKeyStore != null && bucket != null) || (!signed && !encrypted), null);
+			Requires.That((cryptoKeyStore != null && bucket != null) || (!signed && !encrypted), null, "Signing or encryption requires a crypto key store and bucket.");
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Core/Messaging/Bindings/AsymmetricCryptoKeyStoreWrapper.cs b/src/DotNetOpenAuth.Core/Messaging/Bindings/AsymmetricCryptoKeyStoreWrapper.cs
index 4cb5337..0439908 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Bindings/AsymmetricCryptoKeyStoreWrapper.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Bindings/AsymmetricCryptoKeyStoreWrapper.cs
@@ -8,11 +8,11 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Provides RSA encryption of symmetric keys to protect them from a theft of
@@ -42,7 +42,7 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		public AsymmetricCryptoKeyStoreWrapper(ICryptoKeyStore dataStore, RSACryptoServiceProvider asymmetricCrypto) {
 			Requires.NotNull(dataStore, "dataStore");
 			Requires.NotNull(asymmetricCrypto, "asymmetricCrypto");
-			Requires.True(!asymmetricCrypto.PublicOnly, "asymmetricCrypto");
+			Requires.That(!asymmetricCrypto.PublicOnly, "asymmetricCrypto", "Private key required.");
 			this.dataStore = dataStore;
 			this.asymmetricCrypto = asymmetricCrypto;
 		}
@@ -138,9 +138,9 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 			/// <param name="decrypted">The decrypted key.</param>
 			internal CachedCryptoKey(CryptoKey encrypted, CryptoKey decrypted)
 				: base(decrypted.Key, decrypted.ExpiresUtc) {
-				Contract.Requires(encrypted != null);
-				Contract.Requires(decrypted != null);
-				Contract.Requires(encrypted.ExpiresUtc == decrypted.ExpiresUtc);
+				Requires.NotNull(encrypted, "encrypted");
+				Requires.NotNull(decrypted, "decrypted");
+				Requires.That(encrypted.ExpiresUtc == decrypted.ExpiresUtc, "encrypted", "encrypted and decrypted expirations must equal.");
 
 				this.EncryptedKey = encrypted.Key;
 			}
@@ -149,16 +149,6 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 			/// Gets the encrypted key.
 			/// </summary>
 			internal byte[] EncryptedKey { get; private set; }
-
-			/// <summary>
-			/// Invariant conditions.
-			/// </summary>
-			[ContractInvariantMethod]
-			[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Code contracts")]
-			[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Required for code contracts.")]
-			private void ObjectInvariant() {
-				Contract.Invariant(this.EncryptedKey != null);
-			}
 		}
 	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/Bindings/CryptoKey.cs b/src/DotNetOpenAuth.Core/Messaging/Bindings/CryptoKey.cs
index 3fa50d4..d6fef62 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Bindings/CryptoKey.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Bindings/CryptoKey.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A cryptographic key and metadata concerning it.
@@ -34,7 +34,7 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		/// <param name="expiresUtc">The expires UTC.</param>
 		public CryptoKey(byte[] key, DateTime expiresUtc) {
 			Requires.NotNull(key, "key");
-			Requires.True(expiresUtc.Kind == DateTimeKind.Utc, "expiresUtc");
+			Requires.That(expiresUtc.Kind == DateTimeKind.Utc, "expiresUtc", "Time must be expressed in UTC.");
 			this.key = key;
 			this.expiresUtc = expiresUtc;
 		}
@@ -45,7 +45,6 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		[SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays", Justification = "It's a buffer")]
 		public byte[] Key {
 			get {
-				Contract.Ensures(Contract.Result<byte[]>() != null);
 				return this.key;
 			}
 		}
@@ -55,7 +54,6 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		/// </summary>
 		public DateTime ExpiresUtc {
 			get {
-				Contract.Ensures(Contract.Result<DateTime>().Kind == DateTimeKind.Utc);
 				return this.expiresUtc;
 			}
 		}
diff --git a/src/DotNetOpenAuth.Core/Messaging/Bindings/ExpiredMessageException.cs b/src/DotNetOpenAuth.Core/Messaging/Bindings/ExpiredMessageException.cs
index 88b8fed..8c5db3c 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Bindings/ExpiredMessageException.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Bindings/ExpiredMessageException.cs
@@ -6,8 +6,8 @@
 
 namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
+	using Validation;
 
 	/// <summary>
 	/// An exception thrown when a message is received that exceeds the maximum message age limit.
@@ -21,7 +21,7 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		/// <param name="faultedMessage">The expired message.</param>
 		public ExpiredMessageException(DateTime utcExpirationDate, IProtocolMessage faultedMessage)
 			: base(string.Format(CultureInfo.CurrentCulture, MessagingStrings.ExpiredMessage, utcExpirationDate.ToLocalTime(), DateTime.Now), faultedMessage) {
-			Requires.True(utcExpirationDate.Kind == DateTimeKind.Utc, "utcExpirationDate");
+			Requires.Argument(utcExpirationDate.Kind == DateTimeKind.Utc, "utcExpirationDate", "Time must be expressed as UTC.");
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Core/Messaging/Bindings/ICryptoKeyStore.cs b/src/DotNetOpenAuth.Core/Messaging/Bindings/ICryptoKeyStore.cs
index 2e43bba..ce7bf42 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Bindings/ICryptoKeyStore.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Bindings/ICryptoKeyStore.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A persistent store for rotating symmetric cryptographic keys.
@@ -23,7 +23,6 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 	/// of the confidentiality of the keys.  One possible mitigation is to asymmetrically encrypt
 	/// each key using a certificate installed in the server's certificate store.
 	/// </remarks>
-	[ContractClass(typeof(ICryptoKeyStoreContract))]
 	public interface ICryptoKeyStore {
 		/// <summary>
 		/// Gets the key in a given bucket and handle.
@@ -57,62 +56,4 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		/// <param name="handle">The key handle.  Case sensitive.</param>
 		void RemoveKey(string bucket, string handle);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="ICryptoKeyStore"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(ICryptoKeyStore))]
-	internal abstract class ICryptoKeyStoreContract : ICryptoKeyStore {
-		/// <summary>
-		/// Gets the key in a given bucket and handle.
-		/// </summary>
-		/// <param name="bucket">The bucket name.  Case sensitive.</param>
-		/// <param name="handle">The key handle.  Case sensitive.</param>
-		/// <returns>
-		/// The cryptographic key, or <c>null</c> if no matching key was found.
-		/// </returns>
-		CryptoKey ICryptoKeyStore.GetKey(string bucket, string handle) {
-			Requires.NotNullOrEmpty(bucket, "bucket");
-			Requires.NotNullOrEmpty(handle, "handle");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets a sequence of existing keys within a given bucket.
-		/// </summary>
-		/// <param name="bucket">The bucket name.  Case sensitive.</param>
-		/// <returns>
-		/// A sequence of handles and keys, ordered by descending <see cref="CryptoKey.ExpiresUtc"/>.
-		/// </returns>
-		IEnumerable<KeyValuePair<string, CryptoKey>> ICryptoKeyStore.GetKeys(string bucket) {
-			Requires.NotNullOrEmpty(bucket, "bucket");
-			Contract.Ensures(Contract.Result<IEnumerable<KeyValuePair<string, CryptoKey>>>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Stores a cryptographic key.
-		/// </summary>
-		/// <param name="bucket">The name of the bucket to store the key in.  Case sensitive.</param>
-		/// <param name="handle">The handle to the key, unique within the bucket.  Case sensitive.</param>
-		/// <param name="key">The key to store.</param>
-		/// <exception cref="CryptoKeyCollisionException">Thrown in the event of a conflict with an existing key in the same bucket and with the same handle.</exception>
-		void ICryptoKeyStore.StoreKey(string bucket, string handle, CryptoKey key) {
-			Requires.NotNullOrEmpty(bucket, "bucket");
-			Requires.NotNullOrEmpty(handle, "handle");
-			Requires.NotNull(key, "key");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Removes the key.
-		/// </summary>
-		/// <param name="bucket">The bucket name.  Case sensitive.</param>
-		/// <param name="handle">The key handle.  Case sensitive.</param>
-		void ICryptoKeyStore.RemoveKey(string bucket, string handle) {
-			Requires.NotNullOrEmpty(bucket, "bucket");
-			Requires.NotNullOrEmpty(handle, "handle");
-			throw new NotImplementedException();
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/Bindings/StandardReplayProtectionBindingElement.cs b/src/DotNetOpenAuth.Core/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
index 7e39536..45bccdf 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
@@ -7,7 +7,7 @@
 namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A binding element that checks/verifies a nonce message part.
diff --git a/src/DotNetOpenAuth.Core/Messaging/CachedDirectWebResponse.cs b/src/DotNetOpenAuth.Core/Messaging/CachedDirectWebResponse.cs
index 16e92a8..20b1831 100644
--- a/src/DotNetOpenAuth.Core/Messaging/CachedDirectWebResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/CachedDirectWebResponse.cs
@@ -8,15 +8,14 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Cached details on the response from a direct web request to a remote party.
 	/// </summary>
-	[ContractVerification(true)]
 	[DebuggerDisplay("{Status} {ContentType.MediaType}, length: {ResponseStream.Length}")]
 	internal class CachedDirectWebResponse : IncomingWebResponse {
 		/// <summary>
@@ -160,14 +159,13 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "System.Diagnostics.Contracts.__ContractsRuntime.Assume(System.Boolean,System.String,System.String)", Justification = "No localization required.")]
 		private static MemoryStream CacheNetworkStreamAndClose(HttpWebResponse response, int maximumBytesToRead) {
 			Requires.NotNull(response, "response");
-			Contract.Ensures(Contract.Result<MemoryStream>() != null);
 
 			// Now read and cache the network stream
 			Stream networkStream = response.GetResponseStream();
 			MemoryStream cachedStream = new MemoryStream(response.ContentLength < 0 ? 4 * 1024 : Math.Min((int)response.ContentLength, maximumBytesToRead));
 			try {
-				Contract.Assume(networkStream.CanRead, "HttpWebResponse.GetResponseStream() always returns a readable stream."); // CC missing
-				Contract.Assume(cachedStream.CanWrite, "This is a MemoryStream -- it's always writable."); // CC missing
+				Assumes.True(networkStream.CanRead, "HttpWebResponse.GetResponseStream() always returns a readable stream."); // CC missing
+				Assumes.True(cachedStream.CanWrite, "This is a MemoryStream -- it's always writable."); // CC missing
 				networkStream.CopyTo(cachedStream);
 				cachedStream.Seek(0, SeekOrigin.Begin);
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/Channel.cs b/src/DotNetOpenAuth.Core/Messaging/Channel.cs
index f8ac6a1..9c2ba8c 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Channel.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Channel.cs
@@ -24,13 +24,12 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Web;
 	using System.Xml;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// Manages sending direct messages to a remote party and receiving responses.
 	/// </summary>
 	[SuppressMessage("Microsoft.Maintainability", "CA1506:AvoidExcessiveClassCoupling", Justification = "Unavoidable.")]
-	[ContractVerification(true)]
-	[ContractClass(typeof(ChannelContract))]
 	public abstract class Channel : IDisposable {
 		/// <summary>
 		/// The encoding to use when writing out POST entity strings.
@@ -201,7 +200,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				Requires.InRange(value >= 500 && value <= 4096, "value");
+				Requires.Range(value >= 500 && value <= 4096, "value");
 				this.maximumIndirectMessageUrlLength = value;
 			}
 		}
@@ -233,9 +232,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		protected internal ReadOnlyCollection<IChannelBindingElement> BindingElements {
 			get {
-				Contract.Ensures(Contract.Result<ReadOnlyCollection<IChannelBindingElement>>() != null);
 				var result = this.outgoingBindingElements.AsReadOnly();
-				Contract.Assume(result != null);  // should be an implicit BCL contract
+				Assumes.True(result != null);  // should be an implicit BCL contract
 				return result;
 			}
 		}
@@ -252,8 +250,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		protected internal ReadOnlyCollection<IChannelBindingElement> IncomingBindingElements {
 			get {
-				Contract.Ensures(Contract.Result<ReadOnlyCollection<IChannelBindingElement>>().All(be => be.Channel != null));
-				Contract.Ensures(Contract.Result<ReadOnlyCollection<IChannelBindingElement>>().All(be => be != null));
 				return this.incomingBindingElements.AsReadOnly();
 			}
 		}
@@ -308,7 +304,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		[EditorBrowsable(EditorBrowsableState.Never)]
 		public void Send(IProtocolMessage message) {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
 			Requires.NotNull(message, "message");
 			this.PrepareResponse(message).Respond(HttpContext.Current, true);
 		}
@@ -327,7 +323,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// Use the <see cref="Send"/> method instead for web forms.
 		/// </remarks>
 		public void Respond(IProtocolMessage message) {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
 			Requires.NotNull(message, "message");
 			this.PrepareResponse(message).Respond();
 		}
@@ -340,7 +336,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The pending user agent redirect based message to be sent as an HttpResponse.</returns>
 		public OutgoingWebResponse PrepareResponse(IProtocolMessage message) {
 			Requires.NotNull(message, "message");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
 			this.ProcessOutgoingMessage(message);
 			Logger.Channel.DebugFormat("Sending message: {0}", message.GetType().Name);
@@ -420,7 +415,6 @@ namespace DotNetOpenAuth.Messaging {
 		public bool TryReadFromRequest<TRequest>(HttpRequestBase httpRequest, out TRequest request)
 			where TRequest : class, IProtocolMessage {
 			Requires.NotNull(httpRequest, "httpRequest");
-			Contract.Ensures(Contract.Result<bool>() == (Contract.ValueAtReturn<TRequest>(out request) != null));
 
 			IProtocolMessage untypedRequest = this.ReadFromRequest(httpRequest);
 			if (untypedRequest == null) {
@@ -511,7 +505,6 @@ namespace DotNetOpenAuth.Messaging {
 		public TResponse Request<TResponse>(IDirectedProtocolMessage requestMessage)
 			where TResponse : class, IProtocolMessage {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Contract.Ensures(Contract.Result<TResponse>() != null);
 
 			IProtocolMessage response = this.Request(requestMessage);
 			ErrorUtilities.VerifyProtocol(response != null, MessagingStrings.ExpectedMessageNotReceived, typeof(TResponse));
@@ -620,7 +613,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>An HttpContextBase instance.</returns>
 		[SuppressMessage("Microsoft.Design", "CA1024:UsePropertiesWhereAppropriate", Justification = "Allocates memory")]
 		protected internal virtual HttpContextBase GetHttpContext() {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
 			return new HttpContextWrapper(HttpContext.Current);
 		}
 
@@ -634,11 +627,10 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		[SuppressMessage("Microsoft.Design", "CA1024:UsePropertiesWhereAppropriate", Justification = "Costly call should not be a property.")]
 		protected internal virtual HttpRequestBase GetRequestFromContext() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
-			Contract.Ensures(Contract.Result<HttpRequestBase>() != null);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
-			Contract.Assume(HttpContext.Current.Request.Url != null);
-			Contract.Assume(HttpContext.Current.Request.RawUrl != null);
+			Assumes.True(HttpContext.Current.Request.Url != null);
+			Assumes.True(HttpContext.Current.Request.RawUrl != null);
 			return new HttpRequestWrapper(HttpContext.Current.Request);
 		}
 
@@ -729,7 +721,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual IProtocolMessage RequestCore(IDirectedProtocolMessage request) {
 			Requires.NotNull(request, "request");
-			Requires.True(request.Recipient != null, "request", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That(request.Recipient != null, "request", MessagingStrings.DirectedMessageMissingRecipient);
 
 			HttpWebRequest webRequest = this.CreateHttpRequest(request);
 			var directRequest = request as IHttpDirectRequest;
@@ -785,7 +777,7 @@ namespace DotNetOpenAuth.Messaging {
 			Logger.Channel.DebugFormat("Incoming HTTP request: {0} {1}", request.HttpMethod, request.GetPublicFacingUrl().AbsoluteUri);
 
 			// Search Form data first, and if nothing is there search the QueryString
-			Contract.Assume(request.Form != null && request.GetQueryStringBeforeRewriting() != null);
+			Assumes.True(request.Form != null && request.GetQueryStringBeforeRewriting() != null);
 			var fields = request.Form.ToDictionary();
 			if (fields.Count == 0 && request.HttpMethod != "POST") { // OpenID 2.0 section 4.1.2
 				fields = request.GetQueryStringBeforeRewriting().ToDictionary();
@@ -837,13 +829,12 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The pending user agent redirect based message to be sent as an HttpResponse.</returns>
 		protected virtual OutgoingWebResponse PrepareIndirectResponse(IDirectedProtocolMessage message) {
 			Requires.NotNull(message, "message");
-			Requires.True(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
-			Requires.True((message.HttpMethods & (HttpDeliveryMethods.GetRequest | HttpDeliveryMethods.PostRequest)) != 0, "message");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
+			Requires.That(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That((message.HttpMethods & (HttpDeliveryMethods.GetRequest | HttpDeliveryMethods.PostRequest)) != 0, "message", "GET or POST expected.");
 
-			Contract.Assert(message != null && message.Recipient != null);
+			Assumes.True(message != null && message.Recipient != null);
 			var messageAccessor = this.MessageDescriptions.GetAccessor(message);
-			Contract.Assert(message != null && message.Recipient != null);
+			Assumes.True(message != null && message.Recipient != null);
 			var fields = messageAccessor.Serialize();
 
 			OutgoingWebResponse response = null;
@@ -887,9 +878,8 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		protected virtual OutgoingWebResponse Create301RedirectResponse(IDirectedProtocolMessage message, IDictionary<string, string> fields, bool payloadInFragment = false) {
 			Requires.NotNull(message, "message");
-			Requires.True(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
 			Requires.NotNull(fields, "fields");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
 			// As part of this redirect, we include an HTML body in order to get passed some proxy filters
 			// such as WebSense.
@@ -924,9 +914,8 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "No apparent problem.  False positive?")]
 		protected virtual OutgoingWebResponse CreateFormPostResponse(IDirectedProtocolMessage message, IDictionary<string, string> fields) {
 			Requires.NotNull(message, "message");
-			Requires.True(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
 			Requires.NotNull(fields, "fields");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
 			WebHeaderCollection headers = new WebHeaderCollection();
 			headers.Add(HttpResponseHeader.ContentType, "text/html");
@@ -973,8 +962,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest CreateHttpRequest(IDirectedProtocolMessage request) {
 			Requires.NotNull(request, "request");
-			Requires.True(request.Recipient != null, "request", MessagingStrings.DirectedMessageMissingRecipient);
-			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
+			Requires.That(request.Recipient != null, "request", MessagingStrings.DirectedMessageMissingRecipient);
 			throw new NotImplementedException();
 		}
 
@@ -1039,7 +1027,7 @@ namespace DotNetOpenAuth.Messaging {
 
 			MessageProtections appliedProtection = MessageProtections.None;
 			foreach (IChannelBindingElement bindingElement in this.outgoingBindingElements) {
-				Contract.Assume(bindingElement.Channel != null);
+				Assumes.True(bindingElement.Channel != null);
 				MessageProtections? elementProtection = bindingElement.ProcessOutgoingMessage(message);
 				if (elementProtection.HasValue) {
 					Logger.Bindings.DebugFormat("Binding element {0} applied to message.", bindingElement.GetType().FullName);
@@ -1086,7 +1074,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsGet(IDirectedProtocolMessage requestMessage) {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Requires.True(requestMessage.Recipient != null, "requestMessage", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That(requestMessage.Recipient != null, "requestMessage", MessagingStrings.DirectedMessageMissingRecipient);
 
 			var messageAccessor = this.MessageDescriptions.GetAccessor(requestMessage);
 			var fields = messageAccessor.Serialize();
@@ -1110,7 +1098,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsHead(IDirectedProtocolMessage requestMessage) {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Requires.True(requestMessage.Recipient != null, "requestMessage", MessagingStrings.DirectedMessageMissingRecipient);
+			Requires.That(requestMessage.Recipient != null, "requestMessage", MessagingStrings.DirectedMessageMissingRecipient);
 
 			HttpWebRequest request = this.InitializeRequestAsGet(requestMessage);
 			request.Method = "HEAD";
@@ -1129,7 +1117,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsPost(IDirectedProtocolMessage requestMessage) {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
 
 			var messageAccessor = this.MessageDescriptions.GetAccessor(requestMessage);
 			var fields = messageAccessor.Serialize();
@@ -1164,7 +1151,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsPut(IDirectedProtocolMessage requestMessage) {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
 
 			HttpWebRequest request = this.InitializeRequestAsGet(requestMessage);
 			request.Method = "PUT";
@@ -1181,7 +1167,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsDelete(IDirectedProtocolMessage requestMessage) {
 			Requires.NotNull(requestMessage, "requestMessage");
-			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
 
 			HttpWebRequest request = this.InitializeRequestAsGet(requestMessage);
 			request.Method = "DELETE";
@@ -1254,7 +1239,7 @@ namespace DotNetOpenAuth.Messaging {
 
 			MessageProtections appliedProtection = MessageProtections.None;
 			foreach (IChannelBindingElement bindingElement in this.IncomingBindingElements) {
-				Contract.Assume(bindingElement.Channel != null); // CC bug: this.IncomingBindingElements ensures this... why must we assume it here?
+				Assumes.True(bindingElement.Channel != null); // CC bug: this.IncomingBindingElements ensures this... why must we assume it here?
 				MessageProtections? elementProtection = bindingElement.ProcessIncomingMessage(message);
 				if (elementProtection.HasValue) {
 					Logger.Bindings.DebugFormat("Binding element {0} applied to message.", bindingElement.GetType().FullName);
@@ -1350,8 +1335,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The properly ordered list of elements.</returns>
 		/// <exception cref="ProtocolException">Thrown when the binding elements are incomplete or inconsistent with each other.</exception>
 		private static IEnumerable<IChannelBindingElement> ValidateAndPrepareBindingElements(IEnumerable<IChannelBindingElement> elements) {
-			Requires.NullOrWithNoNullElements(elements, "elements");
-			Contract.Ensures(Contract.Result<IEnumerable<IChannelBindingElement>>() != null);
+			Requires.NullOrNotNullElements(elements, "elements");
 			if (elements == null) {
 				return new IChannelBindingElement[0];
 			}
diff --git a/src/DotNetOpenAuth.Core/Messaging/ChannelContract.cs b/src/DotNetOpenAuth.Core/Messaging/ChannelContract.cs
deleted file mode 100644
index b48d45b..0000000
--- a/src/DotNetOpenAuth.Core/Messaging/ChannelContract.cs
+++ /dev/null
@@ -1,54 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="ChannelContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.Messaging {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-
-	/// <summary>
-	/// Code contract for the <see cref="Channel"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(Channel))]
-	internal abstract class ChannelContract : Channel {
-		/// <summary>
-		/// Prevents a default instance of the ChannelContract class from being created.
-		/// </summary>
-		private ChannelContract()
-			: base(null, null) {
-		}
-
-		/// <summary>
-		/// Gets the protocol message that may be in the given HTTP response.
-		/// </summary>
-		/// <param name="response">The response that is anticipated to contain an protocol message.</param>
-		/// <returns>
-		/// The deserialized message parts, if found.  Null otherwise.
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown when the response is not valid.</exception>
-		protected override IDictionary<string, string> ReadFromResponseCore(IncomingWebResponse response) {
-			Requires.NotNull(response, "response");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Queues a message for sending in the response stream where the fields
-		/// are sent in the response stream in querystring style.
-		/// </summary>
-		/// <param name="response">The message to send as a response.</param>
-		/// <returns>
-		/// The pending user agent redirect based message to be sent as an HttpResponse.
-		/// </returns>
-		/// <remarks>
-		/// This method implements spec V1.0 section 5.3.
-		/// </remarks>
-		protected override OutgoingWebResponse PrepareDirectResponse(IProtocolMessage response) {
-			Requires.NotNull(response, "response");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.Core/Messaging/ChannelEventArgs.cs b/src/DotNetOpenAuth.Core/Messaging/ChannelEventArgs.cs
index f3ebc04..5c69e4d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/ChannelEventArgs.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/ChannelEventArgs.cs
@@ -6,7 +6,7 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// The data packet sent with Channel events.
diff --git a/src/DotNetOpenAuth.Core/Messaging/DataBag.cs b/src/DotNetOpenAuth.Core/Messaging/DataBag.cs
index 0800840..8469676 100644
--- a/src/DotNetOpenAuth.Core/Messaging/DataBag.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/DataBag.cs
@@ -8,7 +8,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A collection of message parts that will be serialized into a single string,
@@ -42,7 +42,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="version">The DataBag version.</param>
 		protected DataBag(Version version) {
-			Contract.Requires(version != null);
+			Requires.NotNull(version, "version");
 			this.version = version;
 		}
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/DataBagFormatterBase.cs b/src/DotNetOpenAuth.Core/Messaging/DataBagFormatterBase.cs
index e7ac254..210a95e 100644
--- a/src/DotNetOpenAuth.Core/Messaging/DataBagFormatterBase.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/DataBagFormatterBase.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Linq;
 	using System.Security.Cryptography;
@@ -17,6 +16,7 @@ namespace DotNetOpenAuth.Messaging {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A serializer for <see cref="DataBag"/>-derived types
@@ -110,8 +110,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="decodeOnceOnly">The nonce store to use to ensure that this instance is only decoded once.</param>
 		protected DataBagFormatterBase(ICryptoKeyStore cryptoKeyStore = null, string bucket = null, bool signed = false, bool encrypted = false, bool compressed = false, TimeSpan? minimumAge = null, TimeSpan? maximumAge = null, INonceStore decodeOnceOnly = null)
 			: this(signed, encrypted, compressed, maximumAge, decodeOnceOnly) {
-			Requires.True(!string.IsNullOrEmpty(bucket) || cryptoKeyStore == null, null);
-			Requires.True(cryptoKeyStore != null || (!signed && !encrypted), null);
+			Requires.That(!string.IsNullOrEmpty(bucket) || cryptoKeyStore == null, "bucket", "Bucket name required when cryptoKeyStore is non-null.");
+			Requires.That(cryptoKeyStore != null || (!signed && !encrypted), "cryptoKeyStore", "cryptoKeyStore required if signing or encrypting.");
 
 			this.cryptoKeyStore = cryptoKeyStore;
 			this.cryptoKeyBucket = bucket;
@@ -129,8 +129,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="maximumAge">The maximum age of a token that can be decoded; useful only when <paramref name="decodeOnceOnly"/> is <c>true</c>.</param>
 		/// <param name="decodeOnceOnly">The nonce store to use to ensure that this instance is only decoded once.</param>
 		private DataBagFormatterBase(bool signed = false, bool encrypted = false, bool compressed = false, TimeSpan? maximumAge = null, INonceStore decodeOnceOnly = null) {
-			Requires.True(signed || decodeOnceOnly == null, null);
-			Requires.True(maximumAge.HasValue || decodeOnceOnly == null, null);
+			Requires.That(signed || decodeOnceOnly == null, "decodeOnceOnly", "Nonce only valid with signing.");
+			Requires.That(maximumAge.HasValue || decodeOnceOnly == null, "decodeOnceOnly", "Nonce requires a maximum message age.");
 
 			this.signed = signed;
 			this.maximumAge = maximumAge;
@@ -303,8 +303,7 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "No apparent problem.  False positive?")]
 		private byte[] CalculateSignature(byte[] bytesToSign, string symmetricSecretHandle) {
 			Requires.NotNull(bytesToSign, "bytesToSign");
-			Requires.ValidState(this.asymmetricSigning != null || this.cryptoKeyStore != null);
-			Contract.Ensures(Contract.Result<byte[]>() != null);
+			RequiresEx.ValidState(this.asymmetricSigning != null || this.cryptoKeyStore != null);
 
 			if (this.asymmetricSigning != null) {
 				using (var hasher = SHA1.Create()) {
@@ -328,7 +327,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// The encrypted value.
 		/// </returns>
 		private byte[] Encrypt(byte[] value, out string symmetricSecretHandle) {
-			Requires.ValidState(this.asymmetricEncrypting != null || this.cryptoKeyStore != null);
+			Assumes.True(this.asymmetricEncrypting != null || this.cryptoKeyStore != null);
 
 			if (this.asymmetricEncrypting != null) {
 				symmetricSecretHandle = null;
@@ -349,7 +348,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// The decrypted value.
 		/// </returns>
 		private byte[] Decrypt(byte[] value, string symmetricSecretHandle) {
-			Requires.ValidState(this.asymmetricEncrypting != null || symmetricSecretHandle != null);
+			RequiresEx.ValidState(this.asymmetricEncrypting != null || symmetricSecretHandle != null);
 
 			if (this.asymmetricEncrypting != null) {
 				return this.asymmetricEncrypting.DecryptWithRandomSymmetricKey(value);
diff --git a/src/DotNetOpenAuth.Core/Messaging/EnumerableCacheExtensions.cs b/src/DotNetOpenAuth.Core/Messaging/EnumerableCacheExtensions.cs
index 5e9cf93..0886ef2 100644
--- a/src/DotNetOpenAuth.Core/Messaging/EnumerableCacheExtensions.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/EnumerableCacheExtensions.cs
@@ -9,7 +9,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Extension methods for <see cref="IEnumerable&lt;T&gt;"/> types.
diff --git a/src/DotNetOpenAuth.Core/Messaging/ErrorUtilities.cs b/src/DotNetOpenAuth.Core/Messaging/ErrorUtilities.cs
index 2237cc7..71c904b 100644
--- a/src/DotNetOpenAuth.Core/Messaging/ErrorUtilities.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/ErrorUtilities.cs
@@ -11,11 +11,11 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Web;
+	using Validation;
 
 	/// <summary>
 	/// A collection of error checking and reporting methods.
 	/// </summary>
-	[ContractVerification(true)]
 	[Pure]
 	internal static class ErrorUtilities {
 		/// <summary>
@@ -28,7 +28,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static Exception Wrap(Exception inner, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			return new ProtocolException(string.Format(CultureInfo.CurrentCulture, errorMessage, args), inner);
 		}
 
@@ -58,8 +58,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InternalErrorException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyInternal(bool condition, string errorMessage) {
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<InternalErrorException>(!condition);
 			if (!condition) {
 				ThrowInternal(errorMessage);
 			}
@@ -75,9 +73,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyInternal(bool condition, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<InternalErrorException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				errorMessage = string.Format(CultureInfo.CurrentCulture, errorMessage, args);
 				throw new InternalErrorException(errorMessage);
@@ -92,8 +88,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InvalidOperationException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyOperation(bool condition, string errorMessage) {
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<InvalidOperationException>(!condition);
 			if (!condition) {
 				throw new InvalidOperationException(errorMessage);
 			}
@@ -107,8 +101,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="NotSupportedException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifySupported(bool condition, string errorMessage) {
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<NotSupportedException>(!condition);
 			if (!condition) {
 				throw new NotSupportedException(errorMessage);
 			}
@@ -124,9 +116,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifySupported(bool condition, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<NotSupportedException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				throw new NotSupportedException(string.Format(CultureInfo.CurrentCulture, errorMessage, args));
 			}
@@ -142,9 +132,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyOperation(bool condition, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<InvalidOperationException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				errorMessage = string.Format(CultureInfo.CurrentCulture, errorMessage, args);
 				throw new InvalidOperationException(errorMessage);
@@ -161,9 +149,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyHost(bool condition, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<ProtocolException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				throw new HostErrorException(string.Format(CultureInfo.CurrentCulture, errorMessage, args));
 			}
@@ -181,9 +167,7 @@ namespace DotNetOpenAuth.Messaging {
 		internal static void VerifyProtocol(bool condition, IProtocolMessage faultedMessage, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
 			Requires.NotNull(faultedMessage, "faultedMessage");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<ProtocolException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				throw new ProtocolException(string.Format(CultureInfo.CurrentCulture, errorMessage, args), faultedMessage);
 			}
@@ -199,9 +183,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyProtocol(bool condition, string unformattedMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<ProtocolException>(!condition);
-			Contract.Assume(unformattedMessage != null);
+			Assumes.True(unformattedMessage != null);
 			if (!condition) {
 				var exception = new ProtocolException(string.Format(CultureInfo.CurrentCulture, unformattedMessage, args));
 				if (Logger.Messaging.IsErrorEnabled) {
@@ -231,7 +213,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static Exception ThrowProtocol(string unformattedMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Assume(unformattedMessage != null);
+			Assumes.True(unformattedMessage != null);
 			VerifyProtocol(false, unformattedMessage, args);
 
 			// we never reach here, but this allows callers to "throw" this method.
@@ -247,7 +229,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static Exception ThrowFormat(string message, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Assume(message != null);
+			Assumes.True(message != null);
 			throw new FormatException(string.Format(CultureInfo.CurrentCulture, message, args));
 		}
 
@@ -261,9 +243,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyFormat(bool condition, string message, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<FormatException>(!condition);
-			Contract.Assume(message != null);
+			Assumes.True(message != null);
 			if (!condition) {
 				throw ThrowFormat(message, args);
 			}
@@ -279,9 +259,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyArgument(bool condition, string message, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<ArgumentException>(!condition);
-			Contract.Assume(message != null);
+			Assumes.True(message != null);
 			if (!condition) {
 				throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, message, args));
 			}
@@ -297,7 +275,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static Exception ThrowArgumentNamed(string parameterName, string message, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Assume(message != null);
+			Assumes.True(message != null);
 			throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, message, args), parameterName);
 		}
 
@@ -312,9 +290,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyArgumentNamed(bool condition, string parameterName, string message, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<ArgumentException>(!condition);
-			Contract.Assume(message != null);
+			Assumes.True(message != null);
 			if (!condition) {
 				throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, message, args), parameterName);
 			}
@@ -328,8 +304,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ArgumentNullException">Thrown if <paramref name="value"/> is null.</exception>
 		[Pure]
 		internal static void VerifyArgumentNotNull(object value, string paramName) {
-			Contract.Ensures(value != null);
-			Contract.EnsuresOnThrow<ArgumentNullException>(value == null);
 			if (value == null) {
 				throw new ArgumentNullException(paramName);
 			}
@@ -344,8 +318,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ArgumentException">Thrown if <paramref name="value"/> has zero length.</exception>
 		[Pure]
 		internal static void VerifyNonZeroLength(string value, string paramName) {
-			Contract.Ensures((value != null && value.Length > 0) && !string.IsNullOrEmpty(value));
-			Contract.EnsuresOnThrow<ArgumentException>(value == null || value.Length == 0);
 			VerifyArgumentNotNull(value, paramName);
 			if (value.Length == 0) {
 				throw new ArgumentException(MessagingStrings.UnexpectedEmptyString, paramName);
@@ -358,8 +330,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current"/> == <c>null</c></exception>
 		[Pure]
 		internal static void VerifyHttpContext() {
-			Contract.Ensures(HttpContext.Current != null);
-			Contract.Ensures(HttpContext.Current.Request != null);
 			ErrorUtilities.VerifyOperation(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 		}
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/HmacAlgorithms.cs b/src/DotNetOpenAuth.Core/Messaging/HmacAlgorithms.cs
index 872b4ac..c80ebfe 100644
--- a/src/DotNetOpenAuth.Core/Messaging/HmacAlgorithms.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/HmacAlgorithms.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// HMAC-SHA algorithm names that can be passed to the <see cref="HMAC.Create(string)"/> method.
diff --git a/src/DotNetOpenAuth.Core/Messaging/HttpRequestInfo.cs b/src/DotNetOpenAuth.Core/Messaging/HttpRequestInfo.cs
index 75da833..55233c2 100644
--- a/src/DotNetOpenAuth.Core/Messaging/HttpRequestInfo.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/HttpRequestInfo.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Collections.Specialized;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Net;
@@ -20,6 +19,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Net.Mime;
 	using System.ServiceModel.Channels;
 	using System.Web;
+	using Validation;
 
 	/// <summary>
 	/// A property store of details of an incoming HTTP request.
diff --git a/src/DotNetOpenAuth.Core/Messaging/IChannelBindingElement.cs b/src/DotNetOpenAuth.Core/Messaging/IChannelBindingElement.cs
index 1047ec5..fca46a0 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IChannelBindingElement.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IChannelBindingElement.cs
@@ -6,13 +6,12 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// An interface that must be implemented by message transforms/validators in order
 	/// to be included in the channel stack.
 	/// </summary>
-	[ContractClass(typeof(IChannelBindingElementContract))]
 	public interface IChannelBindingElement {
 		/// <summary>
 		/// Gets or sets the channel that this binding element belongs to.
@@ -63,84 +62,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		MessageProtections? ProcessIncomingMessage(IProtocolMessage message);
 	}
-
-	/// <summary>
-	/// Code Contract for the <see cref="IChannelBindingElement"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IChannelBindingElement))]
-	internal abstract class IChannelBindingElementContract : IChannelBindingElement {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IChannelBindingElementContract"/> class from being created.
-		/// </summary>
-		private IChannelBindingElementContract() {
-		}
-
-		#region IChannelBindingElement Members
-
-		/// <summary>
-		/// Gets or sets the channel that this binding element belongs to.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// This property is set by the channel when it is first constructed.
-		/// </remarks>
-		Channel IChannelBindingElement.Channel {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the protection commonly offered (if any) by this binding element.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// This value is used to assist in sorting binding elements in the channel stack.
-		/// </remarks>
-		MessageProtections IChannelBindingElement.Protection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Prepares a message for sending based on the rules of this channel binding element.
-		/// </summary>
-		/// <param name="message">The message to prepare for sending.</param>
-		/// <returns>
-		/// The protections (if any) that this binding element applied to the message.
-		/// Null if this binding element did not even apply to this binding element.
-		/// </returns>
-		/// <remarks>
-		/// Implementations that provide message protection must honor the
-		/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
-		/// </remarks>
-		MessageProtections? IChannelBindingElement.ProcessOutgoingMessage(IProtocolMessage message) {
-			Requires.NotNull(message, "message");
-			Requires.ValidState(((IChannelBindingElement)this).Channel != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Performs any transformation on an incoming message that may be necessary and/or
-		/// validates an incoming message based on the rules of this channel binding element.
-		/// </summary>
-		/// <param name="message">The incoming message to process.</param>
-		/// <returns>
-		/// The protections (if any) that this binding element applied to the message.
-		/// Null if this binding element did not even apply to this binding element.
-		/// </returns>
-		/// <exception cref="ProtocolException">
-		/// Thrown when the binding element rules indicate that this message is invalid and should
-		/// NOT be processed.
-		/// </exception>
-		/// <remarks>
-		/// Implementations that provide message protection must honor the
-		/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
-		/// </remarks>
-		MessageProtections? IChannelBindingElement.ProcessIncomingMessage(IProtocolMessage message) {
-			Requires.NotNull(message, "message");
-			Requires.ValidState(((IChannelBindingElement)this).Channel != null);
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IDataBagFormatter.cs b/src/DotNetOpenAuth.Core/Messaging/IDataBagFormatter.cs
index 0d1ab03..955d7c0 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IDataBagFormatter.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IDataBagFormatter.cs
@@ -6,13 +6,12 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A serializer for <see cref="DataBag"/>-derived types
 	/// </summary>
 	/// <typeparam name="T">The DataBag-derived type that is to be serialized/deserialized.</typeparam>
-	[ContractClass(typeof(IDataBagFormatterContract<>))]
 	internal interface IDataBagFormatter<in T> where T : DataBag {
 		/// <summary>
 		/// Serializes the specified message.
@@ -30,50 +29,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="messagePartName">The name of the parameter whose value is to be deserialized.  Used for error message generation, but may be <c>null</c>.</param>
 		void Deserialize(T message, string data, IProtocolMessage containingMessage = null, string messagePartName = null);
 	}
-
-	/// <summary>
-	/// Contract class for the IDataBagFormatter interface.
-	/// </summary>
-	/// <typeparam name="T">The type of DataBag to serialize.</typeparam>
-	[ContractClassFor(typeof(IDataBagFormatter<>))]
-	internal abstract class IDataBagFormatterContract<T> : IDataBagFormatter<T> where T : DataBag, new() {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IDataBagFormatterContract&lt;T&gt;"/> class from being created.
-		/// </summary>
-		private IDataBagFormatterContract() {
-		}
-
-		#region IDataBagFormatter<T> Members
-
-		/// <summary>
-		/// Serializes the specified message.
-		/// </summary>
-		/// <param name="message">The message to serialize.  Must not be null.</param>
-		/// <returns>A non-null, non-empty value.</returns>
-		string IDataBagFormatter<T>.Serialize(T message) {
-			Requires.NotNull(message, "message");
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
-
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Deserializes a <see cref="DataBag"/>.
-		/// </summary>
-		/// <param name="message">The instance to deserialize into</param>
-		/// <param name="data">The serialized form of the <see cref="DataBag"/> to deserialize.  Must not be null or empty.</param>
-		/// <param name="containingMessage">The message that contains the <see cref="DataBag"/> serialized value.  Must not be nulll.</param>
-		/// <param name="messagePartName">Name of the message part whose value is to be deserialized.  Used for exception messages.</param>
-		void IDataBagFormatter<T>.Deserialize(T message, string data, IProtocolMessage containingMessage, string messagePartName) {
-			Requires.NotNull(message, "message");
-			Requires.NotNull(containingMessage, "containingMessage");
-			Requires.NotNullOrEmpty(data, "data");
-			Requires.NotNullOrEmpty(messagePartName, "messagePartName");
-			Contract.Ensures(Contract.Result<T>() != null);
-
-			throw new System.NotImplementedException();
-		}
-
-		#endregion
-	}
 }
 \ No newline at end of file
diff --git a/src/DotNetOpenAuth.Core/Messaging/IDirectWebRequestHandler.cs b/src/DotNetOpenAuth.Core/Messaging/IDirectWebRequestHandler.cs
index 7878405..f3975b3 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IDirectWebRequestHandler.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IDirectWebRequestHandler.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.IO;
 	using System.Net;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A contract for <see cref="HttpWebRequest"/> handling.
@@ -18,7 +19,6 @@ namespace DotNetOpenAuth.Messaging {
 	/// <remarks>
 	/// Implementations of this interface must be thread safe.
 	/// </remarks>
-	[ContractClass(typeof(IDirectWebRequestHandlerContract))]
 	public interface IDirectWebRequestHandler {
 		/// <summary>
 		/// Determines whether this instance can support the specified options.
@@ -102,122 +102,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		IncomingWebResponse GetResponse(HttpWebRequest request, DirectWebRequestOptions options);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IDirectWebRequestHandler"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IDirectWebRequestHandler))]
-	internal abstract class IDirectWebRequestHandlerContract : IDirectWebRequestHandler {
-		#region IDirectWebRequestHandler Members
-
-		/// <summary>
-		/// Determines whether this instance can support the specified options.
-		/// </summary>
-		/// <param name="options">The set of options that might be given in a subsequent web request.</param>
-		/// <returns>
-		/// 	<c>true</c> if this instance can support the specified options; otherwise, <c>false</c>.
-		/// </returns>
-		bool IDirectWebRequestHandler.CanSupport(DirectWebRequestOptions options) {
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Prepares an <see cref="HttpWebRequest"/> that contains an POST entity for sending the entity.
-		/// </summary>
-		/// <param name="request">The <see cref="HttpWebRequest"/> that should contain the entity.</param>
-		/// <returns>
-		/// The stream the caller should write out the entity data to.
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
-		/// <remarks>
-		/// 	<para>The caller should have set the <see cref="HttpWebRequest.ContentLength"/>
-		/// and any other appropriate properties <i>before</i> calling this method.
-		/// Callers <i>must</i> close and dispose of the request stream when they are done
-		/// writing to it to avoid taking up the connection too long and causing long waits on
-		/// subsequent requests.</para>
-		/// 	<para>Implementations should catch <see cref="WebException"/> and wrap it in a
-		/// <see cref="ProtocolException"/> to abstract away the transport and provide
-		/// a single exception type for hosts to catch.</para>
-		/// </remarks>
-		Stream IDirectWebRequestHandler.GetRequestStream(HttpWebRequest request) {
-			Requires.NotNull(request, "request");
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Prepares an <see cref="HttpWebRequest"/> that contains an POST entity for sending the entity.
-		/// </summary>
-		/// <param name="request">The <see cref="HttpWebRequest"/> that should contain the entity.</param>
-		/// <param name="options">The options to apply to this web request.</param>
-		/// <returns>
-		/// The stream the caller should write out the entity data to.
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
-		/// <remarks>
-		/// 	<para>The caller should have set the <see cref="HttpWebRequest.ContentLength"/>
-		/// and any other appropriate properties <i>before</i> calling this method.
-		/// Callers <i>must</i> close and dispose of the request stream when they are done
-		/// writing to it to avoid taking up the connection too long and causing long waits on
-		/// subsequent requests.</para>
-		/// 	<para>Implementations should catch <see cref="WebException"/> and wrap it in a
-		/// <see cref="ProtocolException"/> to abstract away the transport and provide
-		/// a single exception type for hosts to catch.</para>
-		/// </remarks>
-		Stream IDirectWebRequestHandler.GetRequestStream(HttpWebRequest request, DirectWebRequestOptions options) {
-			Requires.NotNull(request, "request");
-			Requires.Support(((IDirectWebRequestHandler)this).CanSupport(options), MessagingStrings.DirectWebRequestOptionsNotSupported);
-			////ErrorUtilities.VerifySupported(((IDirectWebRequestHandler)this).CanSupport(options), string.Format(MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name));
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Processes an <see cref="HttpWebRequest"/> and converts the
-		/// <see cref="HttpWebResponse"/> to a <see cref="IncomingWebResponse"/> instance.
-		/// </summary>
-		/// <param name="request">The <see cref="HttpWebRequest"/> to handle.</param>
-		/// <returns>
-		/// An instance of <see cref="IncomingWebResponse"/> describing the response.
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
-		/// <remarks>
-		/// Implementations should catch <see cref="WebException"/> and wrap it in a
-		/// <see cref="ProtocolException"/> to abstract away the transport and provide
-		/// a single exception type for hosts to catch.  The <see cref="WebException.Response"/>
-		/// value, if set, should be Closed before throwing.
-		/// </remarks>
-		IncomingWebResponse IDirectWebRequestHandler.GetResponse(HttpWebRequest request) {
-			Requires.NotNull(request, "request");
-			Contract.Ensures(Contract.Result<IncomingWebResponse>() != null);
-			Contract.Ensures(Contract.Result<IncomingWebResponse>().ResponseStream != null);
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Processes an <see cref="HttpWebRequest"/> and converts the
-		/// <see cref="HttpWebResponse"/> to a <see cref="IncomingWebResponse"/> instance.
-		/// </summary>
-		/// <param name="request">The <see cref="HttpWebRequest"/> to handle.</param>
-		/// <param name="options">The options to apply to this web request.</param>
-		/// <returns>
-		/// An instance of <see cref="IncomingWebResponse"/> describing the response.
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
-		/// <remarks>
-		/// Implementations should catch <see cref="WebException"/> and wrap it in a
-		/// <see cref="ProtocolException"/> to abstract away the transport and provide
-		/// a single exception type for hosts to catch.  The <see cref="WebException.Response"/>
-		/// value, if set, should be Closed before throwing.
-		/// </remarks>
-		IncomingWebResponse IDirectWebRequestHandler.GetResponse(HttpWebRequest request, DirectWebRequestOptions options) {
-			Requires.NotNull(request, "request");
-			Contract.Ensures(Contract.Result<IncomingWebResponse>() != null);
-			Contract.Ensures(Contract.Result<IncomingWebResponse>().ResponseStream != null);
-			Requires.Support(((IDirectWebRequestHandler)this).CanSupport(options), MessagingStrings.DirectWebRequestOptionsNotSupported);
-
-			////ErrorUtilities.VerifySupported(((IDirectWebRequestHandler)this).CanSupport(options), string.Format(MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name));
-			throw new System.NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequest.cs b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequest.cs
index 7153334..7b26869 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequest.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequest.cs
@@ -5,13 +5,11 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Messaging {
-	using System.Diagnostics.Contracts;
 	using System.Net;
 
 	/// <summary>
 	/// An interface that allows direct request messages to capture the details of the HTTP request they arrived on.
 	/// </summary>
-	[ContractClass(typeof(IHttpDirectRequestContract))]
 	public interface IHttpDirectRequest : IMessage {
 		/// <summary>
 		/// Gets the HTTP headers of the request.
diff --git a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequestContract.cs b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequestContract.cs
deleted file mode 100644
index cfde6cf..0000000
--- a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectRequestContract.cs
+++ /dev/null
@@ -1,75 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IHttpDirectRequestContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.Messaging {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Net;
-	using System.Text;
-
-	/// <summary>
-	/// Contract class for the <see cref="IHttpDirectRequest"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IHttpDirectRequest))]
-	public abstract class IHttpDirectRequestContract : IHttpDirectRequest {
-		#region IHttpDirectRequest Members
-
-		/// <summary>
-		/// Gets the HTTP headers of the request.
-		/// </summary>
-		/// <value>May be an empty collection, but must not be <c>null</c>.</value>
-		WebHeaderCollection IHttpDirectRequest.Headers {
-			get {
-				Contract.Ensures(Contract.Result<WebHeaderCollection>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IMessage Members
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		Version IMessage.Version {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IDictionary<string, string> IMessage.ExtraData {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <remarks>
-		/// <para>Some messages have required fields, or combinations of fields that must relate to each other
-		/// in specialized ways.  After deserializing a message, this method checks the state of the 
-		/// message to see if it conforms to the protocol.</para>
-		/// <para>Note that this property should <i>not</i> check signatures or perform any state checks
-		/// outside this scope of this particular message.</para>
-		/// </remarks>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
-}
diff --git a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponse.cs b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponse.cs
index d942366..f455fcf 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponse.cs
@@ -5,14 +5,12 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Messaging {
-	using System.Diagnostics.Contracts;
 	using System.Net;
 
 	/// <summary>
 	/// An interface that allows direct response messages to specify
 	/// HTTP transport specific properties.
 	/// </summary>
-	[ContractClass(typeof(IHttpDirectResponseContract))]
 	public interface IHttpDirectResponse {
 		/// <summary>
 		/// Gets the HTTP status code that the direct response should be sent with.
diff --git a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponseContract.cs b/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponseContract.cs
deleted file mode 100644
index a04ba62..0000000
--- a/src/DotNetOpenAuth.Core/Messaging/IHttpDirectResponseContract.cs
+++ /dev/null
@@ -1,43 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IHttpDirectResponseContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.Messaging {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Net;
-	using System.Text;
-
-	/// <summary>
-	/// Contract class for the <see cref="IHttpDirectResponse"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IHttpDirectResponse))]
-	public abstract class IHttpDirectResponseContract : IHttpDirectResponse {
-		#region IHttpDirectResponse Members
-
-		/// <summary>
-		/// Gets the HTTP status code that the direct response should be sent with.
-		/// </summary>
-		/// <value></value>
-		HttpStatusCode IHttpDirectResponse.HttpStatusCode {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the HTTP headers to add to the response.
-		/// </summary>
-		/// <value>May be an empty collection, but must not be <c>null</c>.</value>
-		WebHeaderCollection IHttpDirectResponse.Headers {
-			get {
-				Contract.Ensures(Contract.Result<WebHeaderCollection>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-	}
-}
diff --git a/src/DotNetOpenAuth.Core/Messaging/IHttpIndirectResponse.cs b/src/DotNetOpenAuth.Core/Messaging/IHttpIndirectResponse.cs
index e0e8665..c9ab73b 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IHttpIndirectResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IHttpIndirectResponse.cs
@@ -5,7 +5,6 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Messaging {
-	using System.Diagnostics.Contracts;
 	using System.Net;
 
 	/// <summary>
diff --git a/src/DotNetOpenAuth.Core/Messaging/IMessage.cs b/src/DotNetOpenAuth.Core/Messaging/IMessage.cs
index 62673ef..c007913 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IMessage.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IMessage.cs
@@ -7,14 +7,12 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 
 	/// <summary>
 	/// The interface that classes must implement to be serialized/deserialized
 	/// as protocol or extension messages.
 	/// </summary>
-	[ContractClass(typeof(IMessageContract))]
 	public interface IMessage {
 		/// <summary>
 		/// Gets the version of the protocol or extension this message is prepared to implement.
@@ -46,55 +44,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
 		void EnsureValidMessage();
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IMessage"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IMessage))]
-	internal abstract class IMessageContract : IMessage {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IMessageContract"/> class from being created.
-		/// </summary>
-		private IMessageContract() {
-		}
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		Version IMessage.Version {
-			get {
-				Contract.Ensures(Contract.Result<Version>() != null);
-				return default(Version); // dummy return
-			}
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IDictionary<string, string> IMessage.ExtraData {
-			get {
-				Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
-				return default(IDictionary<string, string>);
-			}
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <remarks>
-		/// 	<para>Some messages have required fields, or combinations of fields that must relate to each other
-		/// in specialized ways.  After deserializing a message, this method checks the state of the
-		/// message to see if it conforms to the protocol.</para>
-		/// 	<para>Note that this property should <i>not</i> check signatures or perform any state checks
-		/// outside this scope of this particular message.</para>
-		/// </remarks>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void IMessage.EnsureValidMessage() {
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IMessageFactory.cs b/src/DotNetOpenAuth.Core/Messaging/IMessageFactory.cs
index e45ac1d..1e86328 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IMessageFactory.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IMessageFactory.cs
@@ -7,13 +7,12 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A tool to analyze an incoming message to figure out what concrete class
 	/// is designed to deserialize it and instantiates that class.
 	/// </summary>
-	[ContractClass(typeof(IMessageFactoryContract))]
 	public interface IMessageFactory {
 		/// <summary>
 		/// Analyzes an incoming request message payload to discover what kind of 
@@ -41,53 +40,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// </returns>
 		IDirectResponseProtocolMessage GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IMessageFactory"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IMessageFactory))]
-	internal abstract class IMessageFactoryContract : IMessageFactory {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IMessageFactoryContract"/> class from being created.
-		/// </summary>
-		private IMessageFactoryContract() {
-		}
-
-		#region IMessageFactory Members
-
-		/// <summary>
-		/// Analyzes an incoming request message payload to discover what kind of
-		/// message is embedded in it and returns the type, or null if no match is found.
-		/// </summary>
-		/// <param name="recipient">The intended or actual recipient of the request message.</param>
-		/// <param name="fields">The name/value pairs that make up the message payload.</param>
-		/// <returns>
-		/// A newly instantiated <see cref="IProtocolMessage"/>-derived object that this message can
-		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
-		/// </returns>
-		IDirectedProtocolMessage IMessageFactory.GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			Requires.NotNull(recipient, "recipient");
-			Requires.NotNull(fields, "fields");
-
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Analyzes an incoming request message payload to discover what kind of
-		/// message is embedded in it and returns the type, or null if no match is found.
-		/// </summary>
-		/// <param name="request">The message that was sent as a request that resulted in the response.</param>
-		/// <param name="fields">The name/value pairs that make up the message payload.</param>
-		/// <returns>
-		/// A newly instantiated <see cref="IProtocolMessage"/>-derived object that this message can
-		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
-		/// </returns>
-		IDirectResponseProtocolMessage IMessageFactory.GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields) {
-			Requires.NotNull(request, "request");
-			Requires.NotNull(fields, "fields");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IMessageOriginalPayload.cs b/src/DotNetOpenAuth.Core/Messaging/IMessageOriginalPayload.cs
index 099f54b..33fa860 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IMessageOriginalPayload.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IMessageOriginalPayload.cs
@@ -8,14 +8,12 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 
 	/// <summary>
 	/// An interface that appears on messages that need to retain a description of
 	/// what their literal payload was when they were deserialized.
 	/// </summary>
-	[ContractClass(typeof(IMessageOriginalPayloadContract))]
 	public interface IMessageOriginalPayload {
 		/// <summary>
 		/// Gets or sets the original message parts, before any normalization or default values were assigned.
@@ -23,18 +21,4 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Usage", "CA2227:CollectionPropertiesShouldBeReadOnly", Justification = "By design")]
 		IDictionary<string, string> OriginalPayload { get; set; }
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IMessageOriginalPayload"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IMessageOriginalPayload))]
-	internal abstract class IMessageOriginalPayloadContract : IMessageOriginalPayload {
-		/// <summary>
-		/// Gets or sets the original message parts, before any normalization or default values were assigned.
-		/// </summary>
-		IDictionary<string, string> IMessageOriginalPayload.OriginalPayload {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IMessageWithBinaryData.cs b/src/DotNetOpenAuth.Core/Messaging/IMessageWithBinaryData.cs
index 60e1f50..2992678 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IMessageWithBinaryData.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IMessageWithBinaryData.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
@@ -15,7 +14,6 @@ namespace DotNetOpenAuth.Messaging {
 	/// The interface that classes must implement to be serialized/deserialized
 	/// as protocol or extension messages that uses POST multi-part data for binary content.
 	/// </summary>
-	[ContractClass(typeof(IMessageWithBinaryDataContract))]
 	public interface IMessageWithBinaryData : IDirectedProtocolMessage {
 		/// <summary>
 		/// Gets the parts of the message that carry binary data.
@@ -28,129 +26,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		bool SendAsMultipart { get; }
 	}
-
-	/// <summary>
-	/// The contract class for the <see cref="IMessageWithBinaryData"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IMessageWithBinaryData))]
-	internal abstract class IMessageWithBinaryDataContract : IMessageWithBinaryData {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IMessageWithBinaryDataContract"/> class from being created.
-		/// </summary>
-		private IMessageWithBinaryDataContract() {
-		}
-
-		#region IMessageWithBinaryData Members
-
-		/// <summary>
-		/// Gets the parts of the message that carry binary data.
-		/// </summary>
-		/// <value>A list of parts.  Never null.</value>
-		IList<MultipartPostPart> IMessageWithBinaryData.BinaryData {
-			get {
-				Contract.Ensures(Contract.Result<IList<MultipartPostPart>>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether this message should be sent as multi-part POST.
-		/// </summary>
-		bool IMessageWithBinaryData.SendAsMultipart {
-			get { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IMessage Properties
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		Version IMessage.Version {
-			get {
-				return default(Version); // dummy return
-			}
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IDictionary<string, string> IMessage.ExtraData {
-			get {
-				return default(IDictionary<string, string>);
-			}
-		}
-
-		#endregion
-
-		#region IDirectedProtocolMessage Members
-
-		/// <summary>
-		/// Gets the preferred method of transport for the message.
-		/// </summary>
-		/// <remarks>
-		/// For indirect messages this will likely be GET+POST, which both can be simulated in the user agent:
-		/// the GET with a simple 301 Redirect, and the POST with an HTML form in the response with javascript
-		/// to automate submission.
-		/// </remarks>
-		HttpDeliveryMethods IDirectedProtocolMessage.HttpMethods {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the URL of the intended receiver of this message.
-		/// </summary>
-		Uri IDirectedProtocolMessage.Recipient {
-			get { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IProtocolMessage Members
-
-		/// <summary>
-		/// Gets the level of protection this message requires.
-		/// </summary>
-		MessageProtections IProtocolMessage.RequiredProtection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether this is a direct or indirect message.
-		/// </summary>
-		MessageTransport IProtocolMessage.Transport {
-			get { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IMessage methods
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <remarks>
-		/// 	<para>Some messages have required fields, or combinations of fields that must relate to each other
-		/// in specialized ways.  After deserializing a message, this method checks the state of the
-		/// message to see if it conforms to the protocol.</para>
-		/// 	<para>Note that this property should <i>not</i> check signatures or perform any state checks
-		/// outside this scope of this particular message.</para>
-		/// </remarks>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IProtocolMessageWithExtensions.cs b/src/DotNetOpenAuth.Core/Messaging/IProtocolMessageWithExtensions.cs
index c492e65..436c7a9 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IProtocolMessageWithExtensions.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IProtocolMessageWithExtensions.cs
@@ -7,12 +7,10 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// A protocol message that supports adding extensions to the payload for transmission.
 	/// </summary>
-	[ContractClass(typeof(IProtocolMessageWithExtensionsContract))]
 	public interface IProtocolMessageWithExtensions : IProtocolMessage {
 		/// <summary>
 		/// Gets the list of extensions that are included with this message.
@@ -22,95 +20,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		IList<IExtensionMessage> Extensions { get; }
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IProtocolMessageWithExtensions"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IProtocolMessageWithExtensions))]
-	internal abstract class IProtocolMessageWithExtensionsContract : IProtocolMessageWithExtensions {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IProtocolMessageWithExtensionsContract"/> class from being created.
-		/// </summary>
-		private IProtocolMessageWithExtensionsContract() {
-		}
-
-		#region IProtocolMessageWithExtensions Members
-
-		/// <summary>
-		/// Gets the list of extensions that are included with this message.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IList<IExtensionMessage> IProtocolMessageWithExtensions.Extensions {
-			get {
-				Contract.Ensures(Contract.Result<IList<IExtensionMessage>>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IProtocolMessage Members
-
-		/// <summary>
-		/// Gets the level of protection this message requires.
-		/// </summary>
-		MessageProtections IProtocolMessage.RequiredProtection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether this is a direct or indirect message.
-		/// </summary>
-		MessageTransport IProtocolMessage.Transport {
-			get { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IMessage Members
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		Version IMessage.Version {
-			get {
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IDictionary<string, string> IMessage.ExtraData {
-			get {
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <remarks>
-		/// 	<para>Some messages have required fields, or combinations of fields that must relate to each other
-		/// in specialized ways.  After deserializing a message, this method checks the state of the
-		/// message to see if it conforms to the protocol.</para>
-		/// 	<para>Note that this property should <i>not</i> check signatures or perform any state checks
-		/// outside this scope of this particular message.</para>
-		/// </remarks>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IStreamSerializingDataBag.cs b/src/DotNetOpenAuth.Core/Messaging/IStreamSerializingDataBag.cs
index cc82d6a..16fed67 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IStreamSerializingDataBag.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IStreamSerializingDataBag.cs
@@ -6,13 +6,11 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 
 	/// <summary>
 	/// An interface implemented by <see cref="DataBag"/>-derived types that support binary serialization.
 	/// </summary>
-	[ContractClass(typeof(IStreamSerializingDataBaContract))]
 	internal interface IStreamSerializingDataBag {
 		/// <summary>
 		/// Serializes the instance to the specified stream.
@@ -26,30 +24,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="stream">The stream.</param>
 		void Deserialize(Stream stream);
 	}
-
-	/// <summary>
-	/// Code Contract for the <see cref="IStreamSerializingDataBag"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IStreamSerializingDataBag))]
-	internal abstract class IStreamSerializingDataBaContract : IStreamSerializingDataBag {
-		/// <summary>
-		/// Serializes the instance to the specified stream.
-		/// </summary>
-		/// <param name="stream">The stream.</param>
-		void IStreamSerializingDataBag.Serialize(Stream stream) {
-			Contract.Requires(stream != null);
-			Contract.Requires(stream.CanWrite);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Initializes the fields on this instance from the specified stream.
-		/// </summary>
-		/// <param name="stream">The stream.</param>
-		void IStreamSerializingDataBag.Deserialize(Stream stream) {
-			Contract.Requires(stream != null);
-			Contract.Requires(stream.CanRead);
-			throw new NotImplementedException();
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponse.cs b/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponse.cs
index cdb26ae..abb01a1 100644
--- a/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponse.cs
@@ -7,18 +7,16 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Net;
 	using System.Net.Mime;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Details on the incoming response from a direct web request to a remote party.
 	/// </summary>
-	[ContractVerification(true)]
-	[ContractClass(typeof(IncomingWebResponseContract))]
 	public abstract class IncomingWebResponse : IDisposable {
 		/// <summary>
 		/// The encoding to use in reading a response that does not declare its own content encoding.
diff --git a/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponseContract.cs b/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponseContract.cs
deleted file mode 100644
index 5c94e47..0000000
--- a/src/DotNetOpenAuth.Core/Messaging/IncomingWebResponseContract.cs
+++ /dev/null
@@ -1,54 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IncomingWebResponseContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.Messaging {
-	using System;
-	using System.Diagnostics.Contracts;
-	using System.IO;
-
-	/// <summary>
-	/// Code contract for the <see cref="IncomingWebResponse"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(IncomingWebResponse))]
-	internal abstract class IncomingWebResponseContract : IncomingWebResponse {
-		/// <summary>
-		/// Gets the body of the HTTP response.
-		/// </summary>
-		/// <value></value>
-		public override Stream ResponseStream {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Creates a text reader for the response stream.
-		/// </summary>
-		/// <returns>
-		/// The text reader, initialized for the proper encoding.
-		/// </returns>
-		public override StreamReader GetResponseReader() {
-			Contract.Ensures(Contract.Result<StreamReader>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets an offline snapshot version of this instance.
-		/// </summary>
-		/// <param name="maximumBytesToCache">The maximum bytes from the response stream to cache.</param>
-		/// <returns>A snapshot version of this instance.</returns>
-		/// <remarks>
-		/// If this instance is a <see cref="NetworkDirectWebResponse"/> creating a snapshot
-		/// will automatically close and dispose of the underlying response stream.
-		/// If this instance is a <see cref="CachedDirectWebResponse"/>, the result will
-		/// be the self same instance.
-		/// </remarks>
-		internal override CachedDirectWebResponse GetSnapshot(int maximumBytesToCache) {
-			Requires.InRange(maximumBytesToCache >= 0, "maximumBytesToCache");
-			Requires.ValidState(this.RequestUri != null);
-			Contract.Ensures(Contract.Result<CachedDirectWebResponse>() != null);
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.Core/Messaging/KeyedCollectionDelegate.cs b/src/DotNetOpenAuth.Core/Messaging/KeyedCollectionDelegate.cs
index d0988c8..251ff30 100644
--- a/src/DotNetOpenAuth.Core/Messaging/KeyedCollectionDelegate.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/KeyedCollectionDelegate.cs
@@ -7,7 +7,7 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.ObjectModel;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A KeyedCollection whose item -&gt; key transform is provided via a delegate
diff --git a/src/DotNetOpenAuth.Core/Messaging/MessageReceivingEndpoint.cs b/src/DotNetOpenAuth.Core/Messaging/MessageReceivingEndpoint.cs
index cf5ea92..34be92d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/MessageReceivingEndpoint.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/MessageReceivingEndpoint.cs
@@ -7,7 +7,7 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// An immutable description of a URL that receives messages.
@@ -23,8 +23,8 @@ namespace DotNetOpenAuth.Messaging {
 		public MessageReceivingEndpoint(string locationUri, HttpDeliveryMethods method)
 			: this(new Uri(locationUri), method) {
 			Requires.NotNull(locationUri, "locationUri");
-			Requires.InRange(method != HttpDeliveryMethods.None, "method");
-			Requires.InRange((method & HttpDeliveryMethods.HttpVerbMask) != 0, "method", MessagingStrings.GetOrPostFlagsRequired);
+			Requires.Range(method != HttpDeliveryMethods.None, "method");
+			Requires.Range((method & HttpDeliveryMethods.HttpVerbMask) != 0, "method", MessagingStrings.GetOrPostFlagsRequired);
 		}
 
 		/// <summary>
@@ -34,8 +34,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="method">The HTTP method(s) allowed.</param>
 		public MessageReceivingEndpoint(Uri location, HttpDeliveryMethods method) {
 			Requires.NotNull(location, "location");
-			Requires.InRange(method != HttpDeliveryMethods.None, "method");
-			Requires.InRange((method & HttpDeliveryMethods.HttpVerbMask) != 0, "method", MessagingStrings.GetOrPostFlagsRequired);
+			Requires.Range(method != HttpDeliveryMethods.None, "method");
+			Requires.Range((method & HttpDeliveryMethods.HttpVerbMask) != 0, "method", MessagingStrings.GetOrPostFlagsRequired);
 
 			this.Location = location;
 			this.AllowedMethods = method;
diff --git a/src/DotNetOpenAuth.Core/Messaging/MessageSerializer.cs b/src/DotNetOpenAuth.Core/Messaging/MessageSerializer.cs
index 7391867..1b30748 100644
--- a/src/DotNetOpenAuth.Core/Messaging/MessageSerializer.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/MessageSerializer.cs
@@ -14,11 +14,11 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Reflection;
 	using System.Xml;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// Serializes/deserializes OAuth messages for/from transit.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class MessageSerializer {
 		/// <summary>
 		/// The specific <see cref="IMessage"/>-derived type
@@ -31,10 +31,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="messageType">The specific <see cref="IMessage"/>-derived type
 		/// that will be serialized and deserialized using this class.</param>
-		[ContractVerification(false)] // bugs/limitations in CC static analysis
 		private MessageSerializer(Type messageType) {
-			Requires.NotNullSubtype<IMessage>(messageType, "messageType");
-			Contract.Ensures(this.messageType != null);
+			RequiresEx.NotNullSubtype<IMessage>(messageType, "messageType");
 			this.messageType = messageType;
 		}
 
@@ -43,9 +41,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="messageType">The type of message that will be serialized/deserialized.</param>
 		/// <returns>A message serializer for the given message type.</returns>
-		[ContractVerification(false)] // bugs/limitations in CC static analysis
-		internal static MessageSerializer Get(Type messageType) {
-			Requires.NotNullSubtype<IMessage>(messageType, "messageType");
+			internal static MessageSerializer Get(Type messageType) {
+			RequiresEx.NotNullSubtype<IMessage>(messageType, "messageType");
 
 			return new MessageSerializer(messageType);
 		}
@@ -94,7 +91,7 @@ namespace DotNetOpenAuth.Messaging {
 				string type = "string";
 				MessagePart partDescription;
 				if (messageDictionary.Description.Mapping.TryGetValue(pair.Key, out partDescription)) {
-					Contract.Assume(partDescription != null);
+					Assumes.True(partDescription != null);
 					if (partDescription.IsRequired || partDescription.IsNondefaultValueSet(messageDictionary.Message)) {
 						include = true;
 						Type formattingType = partDescription.PreferredFormattingType;
@@ -150,7 +147,6 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Parallel design with Deserialize method.")]
 		internal IDictionary<string, string> Serialize(MessageDictionary messageDictionary) {
 			Requires.NotNull(messageDictionary, "messageDictionary");
-			Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
 
 			// Rather than hand back the whole message dictionary (which 
 			// includes keys with blank values), create a new dictionary
@@ -160,7 +156,7 @@ namespace DotNetOpenAuth.Messaging {
 			foreach (var pair in messageDictionary) {
 				MessagePart partDescription;
 				if (messageDictionary.Description.Mapping.TryGetValue(pair.Key, out partDescription)) {
-					Contract.Assume(partDescription != null);
+					Assumes.True(partDescription != null);
 					if (partDescription.IsRequired || partDescription.IsNondefaultValueSet(messageDictionary.Message)) {
 						result.Add(pair.Key, pair.Value);
 					}
diff --git a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
index e859162..fffb855 100644
--- a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.IO.Compression;
@@ -29,6 +28,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Xml;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A grab-bag of utility methods useful for the channel stack of the protocol.
@@ -198,7 +198,7 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "The Uri merging requires use of a string value.")]
 		[SuppressMessage("Microsoft.Design", "CA1024:UsePropertiesWhereAppropriate", Justification = "Expensive call should not be a property.")]
 		public static Uri GetRequestUrlFromContext() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 			return new HttpRequestWrapper(HttpContext.Current.Request).GetPublicFacingUrl();
 		}
 
@@ -589,7 +589,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>A sequence of key=value pairs discovered in the header.  Never null, but may be empty.</returns>
 		internal static IEnumerable<KeyValuePair<string, string>> ParseAuthorizationHeader(string scheme, string authorizationHeader) {
 			Requires.NotNullOrEmpty(scheme, "scheme");
-			Contract.Ensures(Contract.Result<IEnumerable<KeyValuePair<string, string>>>() != null);
 
 			string prefix = scheme + " ";
 			if (authorizationHeader != null) {
@@ -621,7 +620,6 @@ namespace DotNetOpenAuth.Messaging {
 		internal static string CombineKeyHandleAndPayload(string handle, string payload) {
 			Requires.NotNullOrEmpty(handle, "handle");
 			Requires.NotNullOrEmpty(payload, "payload");
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
 
 			return handle + "!" + payload;
 		}
@@ -695,8 +693,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="allowableCharacters">The allowable characters.</param>
 		/// <returns>A random string.</returns>
 		internal static string GetRandomString(int length, string allowableCharacters) {
-			Requires.InRange(length >= 0, "length");
-			Requires.True(allowableCharacters != null && allowableCharacters.Length >= 2, "allowableCharacters");
+			Requires.Range(length >= 0, "length");
+			Requires.That(allowableCharacters != null && allowableCharacters.Length >= 2, "allowableCharacters", "At least two allowable characters required.");
 
 			char[] randomString = new char[length];
 			var random = NonCryptoRandomDataGenerator;
@@ -717,7 +715,6 @@ namespace DotNetOpenAuth.Messaging {
 		internal static string ComputeHash(this HashAlgorithm algorithm, string value, Encoding encoding = null) {
 			Requires.NotNull(algorithm, "algorithm");
 			Requires.NotNull(value, "value");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			encoding = encoding ?? Encoding.UTF8;
 			byte[] bytesToHash = encoding.GetBytes(value);
@@ -736,7 +733,6 @@ namespace DotNetOpenAuth.Messaging {
 		internal static string ComputeHash(this HashAlgorithm algorithm, IDictionary<string, string> data, Encoding encoding = null) {
 			Requires.NotNull(algorithm, "algorithm");
 			Requires.NotNull(data, "data");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			// Assemble the dictionary to sign, taking care to remove the signature itself
 			// in order to accurately reproduce the original signature (which of course didn't include
@@ -757,7 +753,6 @@ namespace DotNetOpenAuth.Messaging {
 		internal static string ComputeHash(this HashAlgorithm algorithm, IEnumerable<KeyValuePair<string, string>> sortedData, Encoding encoding = null) {
 			Requires.NotNull(algorithm, "algorithm");
 			Requires.NotNull(sortedData, "sortedData");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			return ComputeHash(algorithm, CreateQueryString(sortedData), encoding);
 		}
@@ -936,7 +931,7 @@ namespace DotNetOpenAuth.Messaging {
 		internal static KeyValuePair<string, CryptoKey> GetCurrentKey(this ICryptoKeyStore cryptoKeyStore, string bucket, TimeSpan minimumRemainingLife, int keySize = 256) {
 			Requires.NotNull(cryptoKeyStore, "cryptoKeyStore");
 			Requires.NotNullOrEmpty(bucket, "bucket");
-			Requires.True(keySize % 8 == 0, "keySize");
+			Requires.That(keySize % 8 == 0, "keySize", "Key size must be a multiple of 8.");
 
 			var cryptoKeyPair = cryptoKeyStore.GetKeys(bucket).FirstOrDefault(pair => pair.Value.Key.Length == keySize / 8);
 			if (cryptoKeyPair.Value == null || cryptoKeyPair.Value.ExpiresUtc < DateTime.UtcNow + minimumRemainingLife) {
@@ -979,7 +974,6 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "No apparent problem.  False positive?")]
 		internal static byte[] Compress(byte[] buffer, CompressionMethod method = CompressionMethod.Deflate) {
 			Requires.NotNull(buffer, "buffer");
-			Contract.Ensures(Contract.Result<byte[]>() != null);
 
 			using (var ms = new MemoryStream()) {
 				Stream compressingStream = null;
@@ -992,7 +986,7 @@ namespace DotNetOpenAuth.Messaging {
 							compressingStream = new GZipStream(ms, CompressionMode.Compress, true);
 							break;
 						default:
-							Requires.InRange(false, "method");
+							Requires.Range(false, "method");
 							break;
 					}
 
@@ -1016,7 +1010,6 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "This Dispose is safe.")]
 		internal static byte[] Decompress(byte[] buffer, CompressionMethod method = CompressionMethod.Deflate) {
 			Requires.NotNull(buffer, "buffer");
-			Contract.Ensures(Contract.Result<byte[]>() != null);
 
 			using (var compressedDataStream = new MemoryStream(buffer)) {
 				using (var decompressedDataStream = new MemoryStream()) {
@@ -1030,7 +1023,7 @@ namespace DotNetOpenAuth.Messaging {
 								decompressingStream = new GZipStream(compressedDataStream, CompressionMode.Decompress, true);
 								break;
 							default:
-								Requires.InRange(false, "method");
+								Requires.Range(false, "method");
 								break;
 						}
 
@@ -1070,7 +1063,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>A data buffer.</returns>
 		internal static byte[] FromBase64WebSafeString(string base64WebSafe) {
 			Requires.NotNullOrEmpty(base64WebSafe, "base64WebSafe");
-			Contract.Ensures(Contract.Result<byte[]>() != null);
 
 			// Restore the padding characters and original URL-unsafe characters.
 			int missingPaddingCharacters;
@@ -1158,8 +1150,8 @@ namespace DotNetOpenAuth.Messaging {
 		internal static int CopyTo(this Stream copyFrom, Stream copyTo) {
 			Requires.NotNull(copyFrom, "copyFrom");
 			Requires.NotNull(copyTo, "copyTo");
-			Requires.True(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
-			Requires.True(copyTo.CanWrite, "copyTo", MessagingStrings.StreamUnwritable);
+			Requires.That(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
+			Requires.That(copyTo.CanWrite, "copyTo", MessagingStrings.StreamUnwritable);
 			return CopyUpTo(copyFrom, copyTo, int.MaxValue);
 		}
 #endif
@@ -1178,8 +1170,8 @@ namespace DotNetOpenAuth.Messaging {
 		internal static int CopyUpTo(this Stream copyFrom, Stream copyTo, int maximumBytesToCopy) {
 			Requires.NotNull(copyFrom, "copyFrom");
 			Requires.NotNull(copyTo, "copyTo");
-			Requires.True(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
-			Requires.True(copyTo.CanWrite, "copyTo", MessagingStrings.StreamUnwritable);
+			Requires.That(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
+			Requires.That(copyTo.CanWrite, "copyTo", MessagingStrings.StreamUnwritable);
 
 			byte[] buffer = new byte[1024];
 			int readBytes;
@@ -1201,7 +1193,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>A seekable stream with the same contents as the original.</returns>
 		internal static Stream CreateSnapshot(this Stream copyFrom) {
 			Requires.NotNull(copyFrom, "copyFrom");
-			Requires.True(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
+			Requires.That(copyFrom.CanRead, "copyFrom", MessagingStrings.StreamUnreadable);
 
 			MemoryStream copyTo = new MemoryStream(copyFrom.CanSeek ? (int)copyFrom.Length : 4 * 1024);
 			try {
@@ -1221,7 +1213,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The newly created instance.</returns>
 		internal static HttpWebRequest Clone(this HttpWebRequest request) {
 			Requires.NotNull(request, "request");
-			Requires.True(request.RequestUri != null, "request");
+			Requires.That(request.RequestUri != null, "request", "request.RequestUri cannot be null.");
 			return Clone(request, request.RequestUri);
 		}
 
@@ -1434,7 +1426,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The formulated querystring style string.</returns>
 		internal static string CreateQueryString(IEnumerable<KeyValuePair<string, string>> args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			if (!args.Any()) {
 				return string.Empty;
@@ -1638,7 +1629,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <c>Dictionary&lt;string, string&gt;</c> does not allow null keys.
 		/// </remarks>
 		internal static Dictionary<string, string> ToDictionary(this NameValueCollection nvc) {
-			Contract.Ensures((nvc != null && Contract.Result<Dictionary<string, string>>() != null) || (nvc == null && Contract.Result<Dictionary<string, string>>() == null));
 			return ToDictionary(nvc, false);
 		}
 
@@ -1654,7 +1644,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The generated dictionary, or null if <paramref name="nvc"/> is null.</returns>
 		/// <exception cref="ArgumentException">Thrown if <paramref name="throwOnNullKey"/> is <c>true</c> and a null key is encountered.</exception>
 		internal static Dictionary<string, string> ToDictionary(this NameValueCollection nvc, bool throwOnNullKey) {
-			Contract.Ensures((nvc != null && Contract.Result<Dictionary<string, string>>() != null) || (nvc == null && Contract.Result<Dictionary<string, string>>() == null));
 			if (nvc == null) {
 				return null;
 			}
@@ -1708,7 +1697,6 @@ namespace DotNetOpenAuth.Messaging {
 			Requires.NotNull(source, "source");
 			Requires.NotNull(comparer, "comparer");
 			Requires.NotNull(keySelector, "keySelector");
-			Contract.Ensures(Contract.Result<IOrderedEnumerable<TSource>>() != null);
 			return System.Linq.Enumerable.OrderBy<TSource, TKey>(source, keySelector, new ComparisonHelper<TKey>(comparer));
 		}
 
@@ -1771,7 +1759,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The read buffer.</returns>
 		internal static byte[] ReadBuffer(this BinaryReader reader, int maxBufferSize) {
 			Requires.NotNull(reader, "reader");
-			Requires.InRange(maxBufferSize > 0 && maxBufferSize < 1024 * 1024, "maxBufferSize");
+			Requires.Range(maxBufferSize > 0 && maxBufferSize < 1024 * 1024, "maxBufferSize");
 			int length = reader.ReadInt32();
 			ErrorUtilities.VerifyProtocol(length <= maxBufferSize, MessagingStrings.DataCorruptionDetected);
 			byte[] buffer = new byte[length];
diff --git a/src/DotNetOpenAuth.Core/Messaging/MultipartPostPart.cs b/src/DotNetOpenAuth.Core/Messaging/MultipartPostPart.cs
index 055e4b9..b4a0968 100644
--- a/src/DotNetOpenAuth.Core/Messaging/MultipartPostPart.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/MultipartPostPart.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Represents a single part in a HTTP multipart POST request.
diff --git a/src/DotNetOpenAuth.Core/Messaging/NetworkDirectWebResponse.cs b/src/DotNetOpenAuth.Core/Messaging/NetworkDirectWebResponse.cs
index 2c3ddac..754d71d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/NetworkDirectWebResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/NetworkDirectWebResponse.cs
@@ -7,16 +7,15 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// A live network HTTP response
 	/// </summary>
 	[DebuggerDisplay("{Status} {ContentType.MediaType}")]
-	[ContractVerification(true)]
 	internal class NetworkDirectWebResponse : IncomingWebResponse, IDisposable {
 		/// <summary>
 		/// The network response object, used to initialize this instance, that still needs 
diff --git a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponse.cs b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponse.cs
index e1e9d53..be7774f 100644
--- a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponse.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponse.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Net.Mime;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Text;
 	using System.Threading;
 	using System.Web;
+	using Validation;
 
 	/// <summary>
 	/// A protocol message (request or response) that passes from this
@@ -136,7 +136,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		[EditorBrowsable(EditorBrowsableState.Never)]
 		public virtual void Send() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
 			this.Send(HttpContext.Current);
 		}
@@ -178,7 +178,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// Use the <see cref="Send()"/> method instead for web forms.
 		/// </remarks>
 		public virtual void Respond() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
 			this.Respond(HttpContext.Current);
 		}
diff --git a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
index 7691cc4..bc2f985 100644
--- a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
@@ -6,9 +6,9 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Web.Mvc;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An ASP.NET MVC structure to represent the response to send
diff --git a/src/DotNetOpenAuth.Core/Messaging/ProtocolException.cs b/src/DotNetOpenAuth.Core/Messaging/ProtocolException.cs
index 982e1c0..4bc3590 100644
--- a/src/DotNetOpenAuth.Core/Messaging/ProtocolException.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/ProtocolException.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Security;
 	using System.Security.Permissions;
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/ProtocolFaultResponseException.cs b/src/DotNetOpenAuth.Core/Messaging/ProtocolFaultResponseException.cs
index c2dc34e..4d5c418 100644
--- a/src/DotNetOpenAuth.Core/Messaging/ProtocolFaultResponseException.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/ProtocolFaultResponseException.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Collections.Generic;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// An exception to represent errors in the local or remote implementation of the protocol
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/DefaultEncoderAttribute.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/DefaultEncoderAttribute.cs
index d827972..adf0f33 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/DefaultEncoderAttribute.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/DefaultEncoderAttribute.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	using System.Collections.Generic;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Allows a custom class or struct to be serializable between itself and a string representation.
@@ -21,7 +22,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="converterType">The <see cref="IMessagePartEncoder"/> implementing type to use for serializing this type.</param>
 		public DefaultEncoderAttribute(Type converterType) {
 			Requires.NotNull(converterType, "converterType");
-			Requires.True(typeof(IMessagePartEncoder).IsAssignableFrom(converterType), "Argument must be a type that implements {0}.", typeof(IMessagePartEncoder).Name);
+			Requires.That(typeof(IMessagePartEncoder).IsAssignableFrom(converterType), "Argument must be a type that implements {0}.", typeof(IMessagePartEncoder).Name);
 			this.Encoder = (IMessagePartEncoder)Activator.CreateInstance(converterType);
 		}
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/IMessagePartEncoder.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/IMessagePartEncoder.cs
index 6186cd7..017c7d7 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/IMessagePartEncoder.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/IMessagePartEncoder.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.Messaging.Reflection {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// An interface describing how various objects can be serialized and deserialized between their object and string forms.
@@ -17,7 +17,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	/// <remarks>
 	/// Implementations of this interface must include a default constructor and must be thread-safe.
 	/// </remarks>
-	[ContractClass(typeof(IMessagePartEncoderContract))]
 	public interface IMessagePartEncoder {
 		/// <summary>
 		/// Encodes the specified value.
@@ -34,45 +33,4 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <exception cref="FormatException">Thrown when the string value given cannot be decoded into the required object type.</exception>
 		object Decode(string value);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IMessagePartEncoder"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IMessagePartEncoder))]
-	internal abstract class IMessagePartEncoderContract : IMessagePartEncoder {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="IMessagePartEncoderContract"/> class.
-		/// </summary>
-		protected IMessagePartEncoderContract() {
-		}
-
-		#region IMessagePartEncoder Members
-
-		/// <summary>
-		/// Encodes the specified value.
-		/// </summary>
-		/// <param name="value">The value.  Guaranteed to never be null.</param>
-		/// <returns>
-		/// The <paramref name="value"/> in string form, ready for message transport.
-		/// </returns>
-		string IMessagePartEncoder.Encode(object value) {
-			Requires.NotNull(value, "value");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Decodes the specified value.
-		/// </summary>
-		/// <param name="value">The string value carried by the transport.  Guaranteed to never be null, although it may be empty.</param>
-		/// <returns>
-		/// The deserialized form of the given string.
-		/// </returns>
-		/// <exception cref="FormatException">Thrown when the string value given cannot be decoded into the required object type.</exception>
-		object IMessagePartEncoder.Decode(string value) {
-			Requires.NotNull(value, "value");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescription.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescription.cs
index 7e67842..cd04e1d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescription.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescription.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	using System.Globalization;
 	using System.Linq;
 	using System.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A mapping between serialized key names and <see cref="MessagePart"/> instances describing
@@ -30,7 +31,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="messageType">Type of the message.</param>
 		/// <param name="messageVersion">The message version.</param>
 		internal MessageDescription(Type messageType, Version messageVersion) {
-			Requires.NotNullSubtype<IMessage>(messageType, "messageType");
+			RequiresEx.NotNullSubtype<IMessage>(messageType, "messageType");
 			Requires.NotNull(messageVersion, "messageVersion");
 
 			this.MessageType = messageType;
@@ -80,7 +81,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[Pure]
 		internal MessageDictionary GetDictionary(IMessage message) {
 			Requires.NotNull(message, "message");
-			Contract.Ensures(Contract.Result<MessageDictionary>() != null);
 			return this.GetDictionary(message, false);
 		}
 
@@ -93,7 +93,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[Pure]
 		internal MessageDictionary GetDictionary(IMessage message, bool getOriginalValues) {
 			Requires.NotNull(message, "message");
-			Contract.Ensures(Contract.Result<MessageDictionary>() != null);
 			return new MessageDictionary(message, this, getOriginalValues);
 		}
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescriptionCollection.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescriptionCollection.cs
index 3517abc..f27a7af 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescriptionCollection.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDescriptionCollection.cs
@@ -10,11 +10,11 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	using System.Diagnostics.CodeAnalysis;
 	using System.Diagnostics.Contracts;
 	using System.Linq;
+	using Validation;
 
 	/// <summary>
 	/// A cache of <see cref="MessageDescription"/> instances.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class MessageDescriptionCollection : IEnumerable<MessageDescription> {
 		/// <summary>
 		/// A dictionary of reflected message types and the generated reflection information.
@@ -68,9 +68,8 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "System.Diagnostics.Contracts.__ContractsRuntime.Assume(System.Boolean,System.String,System.String)", Justification = "No localization required.")]
 		[Pure]
 		internal MessageDescription Get(Type messageType, Version messageVersion) {
-			Requires.NotNullSubtype<IMessage>(messageType, "messageType");
+			RequiresEx.NotNullSubtype<IMessage>(messageType, "messageType");
 			Requires.NotNull(messageVersion, "messageVersion");
-			Contract.Ensures(Contract.Result<MessageDescription>() != null);
 
 			MessageTypeAndVersion key = new MessageTypeAndVersion(messageType, messageVersion);
 
@@ -106,7 +105,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[Pure]
 		internal MessageDescription Get(IMessage message) {
 			Requires.NotNull(message, "message");
-			Contract.Ensures(Contract.Result<MessageDescription>() != null);
 			return this.Get(message.GetType(), message.Version);
 		}
 
@@ -136,8 +134,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <summary>
 		/// A struct used as the key to bundle message type and version.
 		/// </summary>
-		[ContractVerification(true)]
-		private struct MessageTypeAndVersion {
+			private struct MessageTypeAndVersion {
 			/// <summary>
 			/// Backing store for the <see cref="Type"/> property.
 			/// </summary>
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDictionary.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDictionary.cs
index cf44863..a2dddb2 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDictionary.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessageDictionary.cs
@@ -11,13 +11,13 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
 	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Wraps an <see cref="IMessage"/> instance in a dictionary that
 	/// provides access to both well-defined message properties and "extra" 
 	/// name/value pairs that have no properties associated with them.
 	/// </summary>
-	[ContractVerification(false)]
 	internal class MessageDictionary : IDictionary<string, string> {
 		/// <summary>
 		/// The <see cref="IMessage"/> instance manipulated by this dictionary.
@@ -55,7 +55,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// </summary>
 		public IMessage Message {
 			get {
-				Contract.Ensures(Contract.Result<IMessage>() != null);
 				return this.message;
 			}
 		}
@@ -65,7 +64,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// </summary>
 		public MessageDescription Description {
 			get {
-				Contract.Ensures(Contract.Result<MessageDescription>() != null);
 				return this.description;
 			}
 		}
@@ -380,7 +378,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <returns>The generated dictionary.</returns>
 		[Pure]
 		public IDictionary<string, string> Serialize() {
-			Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
 			return this.Serializer.Serialize(this);
 		}
 
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessagePart.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessagePart.cs
index a6e8da2..add4beb 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/MessagePart.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/MessagePart.cs
@@ -9,18 +9,17 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net.Security;
 	using System.Reflection;
 	using System.Xml;
 	using DotNetOpenAuth.Configuration;
+	using Validation;
 
 	/// <summary>
 	/// Describes an individual member of a message and assists in its serialization.
 	/// </summary>
-	[ContractVerification(true)]
 	[DebuggerDisplay("MessagePart {Name}")]
 	internal class MessagePart {
 		/// <summary>
@@ -66,20 +65,20 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[SuppressMessage("Microsoft.Performance", "CA1810:InitializeReferenceTypeStaticFieldsInline", Justification = "Much more efficient initialization when we can call methods.")]
 		static MessagePart() {
 			Func<string, Uri> safeUri = str => {
-				Contract.Assume(str != null);
+				Assumes.True(str != null);
 				return new Uri(str);
 			};
 			Func<string, bool> safeBool = str => {
-				Contract.Assume(str != null);
+				Assumes.True(str != null);
 				return bool.Parse(str);
 			};
 
 			Func<byte[], string> safeFromByteArray = bytes => {
-				Contract.Assume(bytes != null);
+				Assumes.True(bytes != null);
 				return Convert.ToBase64String(bytes);
 			};
 			Func<string, byte[]> safeToByteArray = str => {
-				Contract.Assume(str != null);
+				Assumes.True(str != null);
 				return Convert.FromBase64String(str);
 			};
 			Map<Uri>(uri => uri.AbsoluteUri, uri => uri.OriginalString, safeUri);
@@ -106,7 +105,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[SuppressMessage("Microsoft.Maintainability", "CA1502:AvoidExcessiveComplexity", Justification = "Unavoidable"), SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code contracts requires it.")]
 		internal MessagePart(MemberInfo member, MessagePartAttribute attribute) {
 			Requires.NotNull(member, "member");
-			Requires.True(member is FieldInfo || member is PropertyInfo, "member");
+			Requires.That(member is FieldInfo || member is PropertyInfo, "member", "Member must be a property or field.");
 			Requires.NotNull(attribute, "attribute");
 
 			this.field = member as FieldInfo;
@@ -119,7 +118,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 			this.memberDeclaredType = (this.field != null) ? this.field.FieldType : this.property.PropertyType;
 			this.defaultMemberValue = DeriveDefaultValue(this.memberDeclaredType);
 
-			Contract.Assume(this.memberDeclaredType != null); // CC missing PropertyInfo.PropertyType ensures result != null
+			Assumes.True(this.memberDeclaredType != null); // CC missing PropertyInfo.PropertyType ensures result != null
 			if (attribute.Encoder == null) {
 				if (!converters.TryGetValue(this.memberDeclaredType, out this.converter)) {
 					if (this.memberDeclaredType.IsGenericType &&
@@ -203,7 +202,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// </summary>
 		internal string StaticConstantValue {
 			get {
-				Requires.ValidState(this.IsConstantValueAvailableStatically);
+				RequiresEx.ValidState(this.IsConstantValueAvailableStatically);
 				return this.ToString(this.field.GetValue(null), false);
 			}
 		}
@@ -394,7 +393,6 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <returns>An instance of the desired encoder.</returns>
 		private static IMessagePartEncoder GetEncoder(Type messagePartEncoder) {
 			Requires.NotNull(messagePartEncoder, "messagePartEncoder");
-			Contract.Ensures(Contract.Result<IMessagePartEncoder>() != null);
 
 			IMessagePartEncoder encoder;
 			lock (encoders) {
diff --git a/src/DotNetOpenAuth.Core/Messaging/Reflection/ValueMapping.cs b/src/DotNetOpenAuth.Core/Messaging/Reflection/ValueMapping.cs
index 4139f52..c45eb5d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Reflection/ValueMapping.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Reflection/ValueMapping.cs
@@ -6,12 +6,11 @@
 
 namespace DotNetOpenAuth.Messaging.Reflection {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A pair of conversion functions to map some type to a string and back again.
 	/// </summary>
-	[ContractVerification(true)]
 	internal struct ValueMapping {
 		/// <summary>
 		/// The mapping function that converts some custom type to a string.
diff --git a/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactory.cs b/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactory.cs
index 762b54b..fd35e5f 100644
--- a/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactory.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactory.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Reflection;
 	using System.Text;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A message factory that automatically selects the message type based on the incoming data.
@@ -42,7 +42,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="messageTypes">The message types that this factory may instantiate.</param>
 		public virtual void AddMessageTypes(IEnumerable<MessageDescription> messageTypes) {
 			Requires.NotNull(messageTypes, "messageTypes");
-			Requires.True(messageTypes.All(msg => msg != null), "messageTypes");
+			Requires.NullOrNotNullElements(messageTypes, "messageTypes");
 
 			var unsupportedMessageTypes = new List<MessageDescription>(0);
 			foreach (MessageDescription messageDescription in messageTypes) {
@@ -208,7 +208,6 @@ namespace DotNetOpenAuth.Messaging {
 		protected virtual IDirectedProtocolMessage InstantiateAsRequest(MessageDescription messageDescription, MessageReceivingEndpoint recipient) {
 			Requires.NotNull(messageDescription, "messageDescription");
 			Requires.NotNull(recipient, "recipient");
-			Contract.Ensures(Contract.Result<IDirectedProtocolMessage>() != null);
 
 			ConstructorInfo ctor = this.requestMessageTypes[messageDescription];
 			return (IDirectedProtocolMessage)ctor.Invoke(new object[] { recipient.Location, messageDescription.MessageVersion });
@@ -223,7 +222,6 @@ namespace DotNetOpenAuth.Messaging {
 		protected virtual IDirectResponseProtocolMessage InstantiateAsResponse(MessageDescription messageDescription, IDirectedProtocolMessage request) {
 			Requires.NotNull(messageDescription, "messageDescription");
 			Requires.NotNull(request, "request");
-			Contract.Ensures(Contract.Result<IDirectResponseProtocolMessage>() != null);
 
 			Type requestType = request.GetType();
 			var ctors = this.FindMatchingResponseConstructors(messageDescription, requestType);
@@ -249,7 +247,7 @@ namespace DotNetOpenAuth.Messaging {
 		private static int GetDerivationDistance(Type assignableType, Type derivedType) {
 			Requires.NotNull(assignableType, "assignableType");
 			Requires.NotNull(derivedType, "derivedType");
-			Requires.True(assignableType.IsAssignableFrom(derivedType), "assignableType");
+			Requires.That(assignableType.IsAssignableFrom(derivedType), "assignableType", "Types are not related as required.");
 
 			// If this is the two types are equivalent...
 			if (derivedType.IsAssignableFrom(assignableType))
@@ -277,7 +275,6 @@ namespace DotNetOpenAuth.Messaging {
 		private static int CountInCommon(ICollection<string> collection1, ICollection<string> collection2, StringComparison comparison = StringComparison.Ordinal) {
 			Requires.NotNull(collection1, "collection1");
 			Requires.NotNull(collection2, "collection2");
-			Contract.Ensures(Contract.Result<int>() >= 0 && Contract.Result<int>() <= Math.Min(collection1.Count, collection2.Count));
 
 			return collection1.Count(value1 => collection2.Any(value2 => string.Equals(value1, value2, comparison)));
 		}
diff --git a/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactoryChannel.cs b/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactoryChannel.cs
index 7ca5d45..9cb80b0 100644
--- a/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactoryChannel.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/StandardMessageFactoryChannel.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A channel that uses the standard message factory.
@@ -98,7 +98,6 @@ namespace DotNetOpenAuth.Messaging {
 		{
 			Requires.NotNull(messageTypes, "messageTypes");
 			Requires.NotNull(descriptionsCache, "descriptionsCache");
-			Contract.Ensures(Contract.Result<IEnumerable<MessageDescription>>() != null);
 
 			// Get all the MessageDescription objects through the standard cache,
 			// so that perhaps it will be a quick lookup, or at least it will be
diff --git a/src/DotNetOpenAuth.Core/Messaging/StandardWebRequestHandler.cs b/src/DotNetOpenAuth.Core/Messaging/StandardWebRequestHandler.cs
index adca925..2383a5b 100644
--- a/src/DotNetOpenAuth.Core/Messaging/StandardWebRequestHandler.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/StandardWebRequestHandler.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Net.Sockets;
 	using System.Reflection;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The default handler for transmitting <see cref="HttpWebRequest"/> instances
diff --git a/src/DotNetOpenAuth.Core/Messaging/UntrustedWebRequestHandler.cs b/src/DotNetOpenAuth.Core/Messaging/UntrustedWebRequestHandler.cs
index 25a7bbb..be0182d 100644
--- a/src/DotNetOpenAuth.Core/Messaging/UntrustedWebRequestHandler.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/UntrustedWebRequestHandler.cs
@@ -17,6 +17,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Text.RegularExpressions;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A paranoid HTTP get/post request engine.  It helps to protect against attacks from remote
@@ -112,7 +113,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				Requires.InRange(value >= 2048, "value");
+				Requires.Range(value >= 2048, "value");
 				this.maximumBytesToRead = value;
 			}
 		}
@@ -127,7 +128,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				Requires.InRange(value >= 0, "value");
+				Requires.Range(value >= 0, "value");
 				this.maximumRedirections = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth.Core/Messaging/UriStyleMessageFormatter.cs b/src/DotNetOpenAuth.Core/Messaging/UriStyleMessageFormatter.cs
index 242175e..1d7c424 100644
--- a/src/DotNetOpenAuth.Core/Messaging/UriStyleMessageFormatter.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/UriStyleMessageFormatter.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
@@ -15,6 +14,7 @@ namespace DotNetOpenAuth.Messaging {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A serializer for <see cref="DataBag"/>-derived types
@@ -46,7 +46,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="decodeOnceOnly">The nonce store to use to ensure that this instance is only decoded once.</param>
 		protected internal UriStyleMessageFormatter(ICryptoKeyStore cryptoKeyStore = null, string bucket = null, bool signed = false, bool encrypted = false, bool compressed = false, TimeSpan? minimumAge = null, TimeSpan? maximumAge = null, INonceStore decodeOnceOnly = null)
 			: base(cryptoKeyStore, bucket, signed, encrypted, compressed, minimumAge, maximumAge, decodeOnceOnly) {
-			Requires.True((cryptoKeyStore != null && !string.IsNullOrEmpty(bucket)) || (!signed && !encrypted), null);
+			Requires.That((cryptoKeyStore != null && !string.IsNullOrEmpty(bucket)) || (!signed && !encrypted), null, "Signing or encryption requires a cryptoKeyStore and bucket.");
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Core/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.Core/Properties/AssemblyInfo.cs
index 21cbb94..7f8a591 100644
--- a/src/DotNetOpenAuth.Core/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.Core/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.Core/PureAttribute.cs b/src/DotNetOpenAuth.Core/PureAttribute.cs
new file mode 100644
index 0000000..04f7ead
--- /dev/null
+++ b/src/DotNetOpenAuth.Core/PureAttribute.cs
@@ -0,0 +1,22 @@
+//-----------------------------------------------------------------------
+// <copyright file="PureAttribute.cs" company="Andrew Arnott">
+//     Copyright (c) Andrew Arnott. All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.Diagnostics.Contracts {
+	using System;
+	using System.Collections.Generic;
+	using System.Linq;
+	using System.Text;
+
+#if !CLR4
+	/// <summary>
+	/// Designates a type or member as one that does not mutate any objects that were allocated
+	/// before the invocation of the member.
+	/// </summary>
+	[AttributeUsage(AttributeTargets.All, Inherited = false, AllowMultiple = false)]
+	internal sealed class PureAttribute : Attribute {
+	}
+#endif
+}
diff --git a/src/DotNetOpenAuth.Core/Reporting.cs b/src/DotNetOpenAuth.Core/Reporting.cs
index 80a3374..f902fd6 100644
--- a/src/DotNetOpenAuth.Core/Reporting.cs
+++ b/src/DotNetOpenAuth.Core/Reporting.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.IO.IsolatedStorage;
@@ -23,6 +22,7 @@ namespace DotNetOpenAuth {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// The statistical reporting mechanism used so this library's project authors
@@ -170,7 +170,7 @@ namespace DotNetOpenAuth {
 		/// <param name="category">The category within the event.  Null and empty strings are allowed, but considered the same.</param>
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "PersistentCounter instances are stored in a table for later use.")]
 		internal static void RecordEventOccurrence(string eventName, string category) {
-			Contract.Requires(!string.IsNullOrEmpty(eventName));
+			Requires.NotNullOrEmpty(eventName, "eventName");
 
 			// In release builds, just quietly return.
 			if (string.IsNullOrEmpty(eventName)) {
@@ -196,7 +196,7 @@ namespace DotNetOpenAuth {
 		/// <param name="eventNameByObjectType">The object whose type name is the event name to record.</param>
 		/// <param name="category">The category within the event.  Null and empty strings are allowed, but considered the same.</param>
 		internal static void RecordEventOccurrence(object eventNameByObjectType, string category) {
-			Contract.Requires(eventNameByObjectType != null);
+			Requires.NotNull(eventNameByObjectType, "eventNameByObjectType");
 
 			// In release builds, just quietly return.
 			if (eventNameByObjectType == null) {
@@ -213,7 +213,7 @@ namespace DotNetOpenAuth {
 		/// </summary>
 		/// <param name="feature">The feature.</param>
 		internal static void RecordFeatureUse(string feature) {
-			Contract.Requires(!string.IsNullOrEmpty(feature));
+			Requires.NotNullOrEmpty(feature, "feature");
 
 			// In release builds, just quietly return.
 			if (string.IsNullOrEmpty(feature)) {
@@ -231,7 +231,7 @@ namespace DotNetOpenAuth {
 		/// </summary>
 		/// <param name="value">The object whose type is the feature to set as used.</param>
 		internal static void RecordFeatureUse(object value) {
-			Contract.Requires(value != null);
+			Requires.NotNull(value, "value");
 
 			// In release builds, just quietly return.
 			if (value == null) {
@@ -250,7 +250,7 @@ namespace DotNetOpenAuth {
 		/// <param name="value">The object whose type is the feature to set as used.</param>
 		/// <param name="dependency1">Some dependency used by <paramref name="value"/>.</param>
 		internal static void RecordFeatureAndDependencyUse(object value, object dependency1) {
-			Contract.Requires(value != null);
+			Requires.NotNull(value, "value");
 
 			// In release builds, just quietly return.
 			if (value == null) {
@@ -274,7 +274,7 @@ namespace DotNetOpenAuth {
 		/// <param name="dependency1">Some dependency used by <paramref name="value"/>.</param>
 		/// <param name="dependency2">Some dependency used by <paramref name="value"/>.</param>
 		internal static void RecordFeatureAndDependencyUse(object value, object dependency1, object dependency2) {
-			Contract.Requires(value != null);
+			Requires.NotNull(value, "value");
 
 			// In release builds, just quietly return.
 			if (value == null) {
@@ -298,7 +298,7 @@ namespace DotNetOpenAuth {
 		/// </summary>
 		/// <param name="request">The request.</param>
 		internal static void RecordRequestStatistics(HttpRequestBase request) {
-			Contract.Requires(request != null);
+			Requires.NotNull(request, "request");
 
 			// In release builds, just quietly return.
 			if (request == null) {
@@ -534,8 +534,6 @@ namespace DotNetOpenAuth {
 		/// </summary>
 		/// <returns>An isolated storage location appropriate for our host.</returns>
 		private static IsolatedStorageFile GetIsolatedStorage() {
-			Contract.Ensures(Contract.Result<IsolatedStorageFile>() != null);
-
 			IsolatedStorageFile result = null;
 
 			// We'll try for whatever storage location we can get,
@@ -567,8 +565,7 @@ namespace DotNetOpenAuth {
 		/// </remarks>
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "No apparent problem.  False positive?")]
 		private static Guid GetOrCreateOriginIdentity() {
-			Requires.ValidState(file != null);
-			Contract.Ensures(Contract.Result<Guid>() != Guid.Empty);
+			RequiresEx.ValidState(file != null, "file not set.");
 
 			Guid identityGuid = Guid.Empty;
 			const int GuidLength = 16;
diff --git a/src/DotNetOpenAuth.Core/Requires.cs b/src/DotNetOpenAuth.Core/Requires.cs
deleted file mode 100644
index 7d4d5be..0000000
--- a/src/DotNetOpenAuth.Core/Requires.cs
+++ /dev/null
@@ -1,255 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="Requires.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
-	using System.Globalization;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-
-	/// <summary>
-	/// Argument validation checks that throw some kind of ArgumentException when they fail (unless otherwise noted).
-	/// </summary>
-	internal static class Requires {
-		/// <summary>
-		/// Validates that a given parameter is not null.
-		/// </summary>
-		/// <typeparam name="T">The type of the parameter</typeparam>
-		/// <param name="value">The value.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <returns>The tested value, guaranteed to not be null.</returns>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static T NotNull<T>(T value, string parameterName) where T : class {
-			if (value == null) {
-				throw new ArgumentNullException(parameterName);
-			}
-
-			Contract.EndContractBlock();
-			return value;
-		}
-
-		/// <summary>
-		/// Validates that a parameter is not null or empty.
-		/// </summary>
-		/// <param name="value">The value.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <returns>The validated value.</returns>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static string NotNullOrEmpty(string value, string parameterName) {
-			NotNull(value, parameterName);
-			True(value.Length > 0, parameterName, Strings.EmptyStringNotAllowed);
-			Contract.Ensures(Contract.Result<string>() == value);
-			Contract.EndContractBlock();
-			return value;
-		}
-
-		/// <summary>
-		/// Validates that an array is not null or empty.
-		/// </summary>
-		/// <typeparam name="T">The type of the elements in the sequence.</typeparam>
-		/// <param name="value">The value.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void NotNullOrEmpty<T>(IEnumerable<T> value, string parameterName) {
-			NotNull(value, parameterName);
-			True(value.Any(), parameterName, Strings.InvalidArgument);
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates that an argument is either null or is a sequence with no null elements.
-		/// </summary>
-		/// <typeparam name="T">The type of elements in the sequence.</typeparam>
-		/// <param name="sequence">The sequence.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void NullOrWithNoNullElements<T>(IEnumerable<T> sequence, string parameterName) where T : class {
-			if (sequence != null) {
-				if (sequence.Any(e => e == null)) {
-					throw new ArgumentException(MessagingStrings.SequenceContainsNullElement, parameterName);
-				}
-			}
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable range for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="ArgumentOutOfRangeException"/>.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <param name="message">The message to include with the exception.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void InRange(bool condition, string parameterName, string message = null) {
-			if (!condition) {
-				throw new ArgumentOutOfRangeException(parameterName, message);
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="ArgumentException"/>.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <param name="message">The message to include with the exception.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void True(bool condition, string parameterName = null, string message = null) {
-			if (!condition) {
-				throw new ArgumentException(message ?? Strings.InvalidArgument, parameterName);
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="ArgumentException"/>.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <param name="unformattedMessage">The unformatted message.</param>
-		/// <param name="args">Formatting arguments.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void True(bool condition, string parameterName, string unformattedMessage, params object[] args) {
-			if (!condition) {
-				throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, unformattedMessage, args), parameterName);
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void ValidState(bool condition) {
-			if (!condition) {
-				throw new InvalidOperationException();
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
-		/// <param name="message">The message to include with the exception.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void ValidState(bool condition, string message) {
-			if (!condition) {
-				throw new InvalidOperationException(message);
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
-		/// <param name="unformattedMessage">The unformatted message.</param>
-		/// <param name="args">Formatting arguments.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void ValidState(bool condition, string unformattedMessage, params object[] args) {
-			if (!condition) {
-				throw new InvalidOperationException(string.Format(CultureInfo.CurrentCulture, unformattedMessage, args));
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates that some argument describes a type that is or derives from a required type.
-		/// </summary>
-		/// <typeparam name="T">The type that the argument must be or derive from.</typeparam>
-		/// <param name="type">The type given in the argument.</param>
-		/// <param name="parameterName">Name of the parameter.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void NotNullSubtype<T>(Type type, string parameterName) {
-			NotNull(type, parameterName);
-			True(typeof(T).IsAssignableFrom(type), parameterName, MessagingStrings.UnexpectedType, typeof(T).FullName, type.FullName);
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="FormatException"/>.</param>
-		/// <param name="message">The message.</param>
-#if !CLR4
-		[ContractArgumentValidator]
-#endif
-		[Pure, DebuggerStepThrough]
-		internal static void Format(bool condition, string message) {
-			if (!condition) {
-				throw new FormatException(message);
-			}
-
-			Contract.EndContractBlock();
-		}
-
-		/// <summary>
-		/// Throws an <see cref="NotSupportedException"/> if a condition does not evaluate to <c>true</c>.
-		/// </summary>
-		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="NotSupportedException"/>.</param>
-		/// <param name="message">The message.</param>
-		[Pure, DebuggerStepThrough]
-		internal static void Support(bool condition, string message) {
-			if (!condition) {
-				throw new NotSupportedException(message);
-			}
-		}
-
-		/// <summary>
-		/// Throws an <see cref="ArgumentException"/>
-		/// </summary>
-		/// <param name="parameterName">Name of the parameter.</param>
-		/// <param name="message">The message.</param>
-		[Pure, DebuggerStepThrough]
-		internal static void Fail(string parameterName, string message) {
-			throw new ArgumentException(message, parameterName);
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.Core/RequiresEx.cs b/src/DotNetOpenAuth.Core/RequiresEx.cs
new file mode 100644
index 0000000..1a077c4
--- /dev/null
+++ b/src/DotNetOpenAuth.Core/RequiresEx.cs
@@ -0,0 +1,94 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequiresEx.cs" company="Outercurve Foundation">
+//     Copyright (c) Outercurve Foundation. All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace DotNetOpenAuth {
+	using System;
+	using System.Collections.Generic;
+	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
+	using System.Globalization;
+	using System.Linq;
+	using System.Text;
+	using DotNetOpenAuth.Messaging;
+	using Validation;
+
+	/// <summary>
+	/// Argument validation checks that throw some kind of ArgumentException when they fail (unless otherwise noted).
+	/// </summary>
+	internal static class RequiresEx {
+		/// <summary>
+		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
+		/// </summary>
+		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void ValidState(bool condition) {
+			if (!condition) {
+				throw new InvalidOperationException();
+			}
+		}
+
+		/// <summary>
+		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
+		/// </summary>
+		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
+		/// <param name="message">The message to include with the exception.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void ValidState(bool condition, string message) {
+			if (!condition) {
+				throw new InvalidOperationException(message);
+			}
+		}
+
+		/// <summary>
+		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
+		/// </summary>
+		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="InvalidOperationException"/>.</param>
+		/// <param name="unformattedMessage">The unformatted message.</param>
+		/// <param name="args">Formatting arguments.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void ValidState(bool condition, string unformattedMessage, params object[] args) {
+			if (!condition) {
+				throw new InvalidOperationException(string.Format(CultureInfo.CurrentCulture, unformattedMessage, args));
+			}
+		}
+
+		/// <summary>
+		/// Validates that some argument describes a type that is or derives from a required type.
+		/// </summary>
+		/// <typeparam name="T">The type that the argument must be or derive from.</typeparam>
+		/// <param name="type">The type given in the argument.</param>
+		/// <param name="parameterName">Name of the parameter.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void NotNullSubtype<T>(Type type, string parameterName) {
+			Requires.NotNull(type, parameterName);
+			Requires.That(typeof(T).IsAssignableFrom(type), parameterName, MessagingStrings.UnexpectedType, typeof(T).FullName, type.FullName);
+		}
+
+		/// <summary>
+		/// Validates some expression describing the acceptable condition for an argument evaluates to true.
+		/// </summary>
+		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="FormatException"/>.</param>
+		/// <param name="message">The message.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void Format(bool condition, string message) {
+			if (!condition) {
+				throw new FormatException(message);
+			}
+		}
+
+		/// <summary>
+		/// Throws an <see cref="NotSupportedException"/> if a condition does not evaluate to <c>true</c>.
+		/// </summary>
+		/// <param name="condition">The expression that must evaluate to true to avoid an <see cref="NotSupportedException"/>.</param>
+		/// <param name="message">The message.</param>
+		[Pure, DebuggerStepThrough]
+		internal static void Support(bool condition, string message) {
+			if (!condition) {
+				throw new NotSupportedException(message);
+			}
+		}
+	}
+}
diff --git a/src/DotNetOpenAuth.Core/UriUtil.cs b/src/DotNetOpenAuth.Core/UriUtil.cs
index c52e1bb..25b92a2 100644
--- a/src/DotNetOpenAuth.Core/UriUtil.cs
+++ b/src/DotNetOpenAuth.Core/UriUtil.cs
@@ -8,17 +8,16 @@ namespace DotNetOpenAuth {
 	using System;
 	using System.Collections.Specialized;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text.RegularExpressions;
 	using System.Web;
 	using System.Web.UI;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for working with URIs.
 	/// </summary>
-	[ContractVerification(true)]
 	internal static class UriUtil {
 		/// <summary>
 		/// Tests a URI for the presence of an OAuth payload.
@@ -28,15 +27,14 @@ namespace DotNetOpenAuth {
 		/// <returns>
 		/// True if the URI contains an OAuth message.
 		/// </returns>
-		[ContractVerification(false)] // bugs/limitations in CC static analysis
-		internal static bool QueryStringContainPrefixedParameters(this Uri uri, string prefix) {
+			internal static bool QueryStringContainPrefixedParameters(this Uri uri, string prefix) {
 			Requires.NotNullOrEmpty(prefix, "prefix");
 			if (uri == null) {
 				return false;
 			}
 
 			NameValueCollection nvc = HttpUtility.ParseQueryString(uri.Query);
-			Contract.Assume(nvc != null); // BCL
+			Assumes.True(nvc != null); // BCL
 			return nvc.Keys.OfType<string>().Any(key => key.StartsWith(prefix, StringComparison.Ordinal));
 		}
 
@@ -60,7 +58,6 @@ namespace DotNetOpenAuth {
 		/// <returns>The string version of the Uri.</returns>
 		internal static string ToStringWithImpliedPorts(this UriBuilder builder) {
 			Requires.NotNull(builder, "builder");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			// We only check for implied ports on HTTP and HTTPS schemes since those
 			// are the only ones supported by OpenID anyway.
@@ -73,7 +70,7 @@ namespace DotNetOpenAuth {
 				// we're removing only the port (and not something in the query string that 
 				// looks like a port.
 				string result = Regex.Replace(url, @"^(https?://[^:]+):\d+", m => m.Groups[1].Value, RegexOptions.IgnoreCase);
-				Contract.Assume(result != null); // Regex.Replace never returns null
+				Assumes.True(result != null); // Regex.Replace never returns null
 				return result;
 			} else {
 				// The port must be explicitly given anyway.
@@ -95,12 +92,12 @@ namespace DotNetOpenAuth {
 			}
 
 			if (page != null && !designMode) {
-				Contract.Assume(page.Request != null);
+				Assumes.True(page.Request != null);
 
 				// Validate new value by trying to construct a Realm object based on it.
 				string relativeUrl = page.ResolveUrl(value);
-				Contract.Assume(page.Request.Url != null);
-				Contract.Assume(relativeUrl != null);
+				Assumes.True(page.Request.Url != null);
+				Assumes.True(relativeUrl != null);
 				new Uri(page.Request.Url, relativeUrl); // throws an exception on failure.
 			} else {
 				// We can't fully test it, but it should start with either ~/ or a protocol.
diff --git a/src/DotNetOpenAuth.Core/Util.cs b/src/DotNetOpenAuth.Core/Util.cs
index 3babba5..ec28c50 100644
--- a/src/DotNetOpenAuth.Core/Util.cs
+++ b/src/DotNetOpenAuth.Core/Util.cs
@@ -6,7 +6,6 @@
 namespace DotNetOpenAuth {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Net;
 	using System.Reflection;
@@ -17,11 +16,11 @@ namespace DotNetOpenAuth {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A grab-bag utility class.
 	/// </summary>
-	[ContractVerification(true)]
 	internal static class Util {
 		/// <summary>
 		/// The base namespace for this library from which all other namespaces derive.
@@ -103,8 +102,7 @@ namespace DotNetOpenAuth {
 			return new DelayedToString<IEnumerable<KeyValuePair<K, V>>>(
 				pairs,
 				p => {
-					////Contract.Requires(pairs != null); // CC: anonymous method can't handle it
-					ErrorUtilities.VerifyArgumentNotNull(pairs, "pairs");
+					Requires.NotNull(pairs, "pairs");
 					var dictionary = pairs as IDictionary<K, V>;
 					var messageDictionary = pairs as MessageDictionary;
 					StringBuilder sb = new StringBuilder(dictionary != null ? dictionary.Count * 40 : 200);
@@ -139,7 +137,6 @@ namespace DotNetOpenAuth {
 		/// <param name="list">The list of elements.</param>
 		/// <param name="multiLineElements">if set to <c>true</c>, special formatting will be applied to the output to make it clear where one element ends and the next begins.</param>
 		/// <returns>An object whose ToString method will perform the actual work of generating the string.</returns>
-		[ContractVerification(false)]
 		internal static object ToStringDeferred<T>(this IEnumerable<T> list, bool multiLineElements) {
 			return new DelayedToString<IEnumerable<T>>(
 				list,
@@ -148,7 +145,7 @@ namespace DotNetOpenAuth {
 					ErrorUtilities.VerifyArgumentNotNull(l, "l");
 
 					string newLine = Environment.NewLine;
-					////Contract.Assume(newLine != null && newLine.Length > 0);
+					////Assumes.True(newLine != null && newLine.Length > 0);
 					StringBuilder sb = new StringBuilder();
 					if (multiLineElements) {
 						sb.AppendLine("[{");
diff --git a/src/DotNetOpenAuth.Core/packages.config b/src/DotNetOpenAuth.Core/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.Core/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.InfoCard.UI/DotNetOpenAuth.InfoCard.UI.csproj b/src/DotNetOpenAuth.InfoCard.UI/DotNetOpenAuth.InfoCard.UI.csproj
index f1aac54..40fa674 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/DotNetOpenAuth.InfoCard.UI.csproj
+++ b/src/DotNetOpenAuth.InfoCard.UI/DotNetOpenAuth.InfoCard.UI.csproj
@@ -62,6 +62,15 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ClaimType.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ClaimType.cs
index 831e38d..53898ba 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ClaimType.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ClaimType.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.IdentityModel.Claims;
 	using System.Web.UI;
 
@@ -16,7 +15,6 @@ namespace DotNetOpenAuth.InfoCard {
 	/// </summary>
 	[PersistChildren(false)]
 	[Serializable]
-	[ContractVerification(true)]
 	public class ClaimType {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="ClaimType"/> class.
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardImage.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardImage.cs
index 821ea1b..cdb0562 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardImage.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardImage.cs
@@ -23,7 +23,6 @@
 namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 
 	/// <summary>
@@ -130,7 +129,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The manifest resource stream name.</returns>
 		internal static string GetImageManifestResourceStreamName(InfoCardImageSize size) {
 			string imageSize = size.ToString();
-			Contract.Assume(imageSize.Length >= 6);
+			Assumes.True(imageSize.Length >= 6);
 			imageSize = imageSize.Substring(4);
 			return string.Format(CultureInfo.InvariantCulture, UrlFormatString, imageSize);
 		}
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardSelector.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardSelector.cs
index 3862e39..3b6b368 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardSelector.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/InfoCardSelector.cs
@@ -24,6 +24,7 @@ namespace DotNetOpenAuth.InfoCard {
 	using System.Web.UI.WebControls;
 	using System.Xml;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The style to use for NOT displaying a hidden region.
@@ -47,7 +48,6 @@ namespace DotNetOpenAuth.InfoCard {
 	[PersistChildren(false)]
 	[DefaultEvent("ReceivedToken")]
 	[ToolboxData("<{0}:InfoCardSelector runat=\"server\"><ClaimsRequested><{0}:ClaimType Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier\" /></ClaimsRequested><UnsupportedTemplate><p>Your browser does not support Information Cards.</p></UnsupportedTemplate></{0}:InfoCardSelector>")]
-	[ContractVerification(true)]
 	public class InfoCardSelector : CompositeControl, IPostBackEventHandler {
 		/// <summary>
 		/// The resource name for getting at the SupportingScript.js embedded manifest stream.
@@ -229,7 +229,6 @@ namespace DotNetOpenAuth.InfoCard {
 		[PersistenceMode(PersistenceMode.InnerProperty), Category(InfoCardCategory)]
 		public Collection<ClaimType> ClaimsRequested {
 			get {
-				Contract.Ensures(Contract.Result<Collection<ClaimType>>() != null);
 				if (this.ViewState[ClaimsRequestedViewStateKey] == null) {
 					var claims = new Collection<ClaimType>();
 					this.ViewState[ClaimsRequestedViewStateKey] = claims;
@@ -547,7 +546,6 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="value">The parameter value.</param>
 		/// <returns>The control that renders to the Param tag.</returns>
 		private static string CreateParamJs(string name, string value) {
-			Contract.Ensures(Contract.Result<string>() != null);
 			string scriptFormat = @"	objp = document.createElement('param');
 	objp.name = {0};
 	objp.value = {1};
@@ -567,8 +565,6 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The Panel control</returns>
 		[Pure]
 		private Panel CreateInfoCardSupportedPanel() {
-			Contract.Ensures(Contract.Result<Panel>() != null);
-
 			Panel supportedPanel = new Panel();
 
 			try {
@@ -626,8 +622,6 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The Panel control.</returns>
 		[Pure]
 		private Panel CreateInfoCardUnsupportedPanel() {
-			Contract.Ensures(Contract.Result<Panel>() != null);
-
 			Panel unsupportedPanel = new Panel();
 			try {
 				if (this.UnsupportedTemplate != null) {
@@ -724,9 +718,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="optional">A space-delimited list of claim type URIs for claims that may optionally be included in a submitted Information Card.</param>
 		[Pure]
 		private void GetRequestedClaims(out string required, out string optional) {
-			Requires.ValidState(this.ClaimsRequested != null);
-			Contract.Ensures(Contract.ValueAtReturn<string>(out required) != null);
-			Contract.Ensures(Contract.ValueAtReturn<string>(out optional) != null);
+			RequiresEx.ValidState(this.ClaimsRequested != null);
 
 			var nonEmptyClaimTypes = this.ClaimsRequested.Where(c => c.Name != null);
 
@@ -741,8 +733,8 @@ namespace DotNetOpenAuth.InfoCard {
 			string[] optionalClaimsArray = optionalClaims.ToArray();
 			required = string.Join(" ", requiredClaimsArray);
 			optional = string.Join(" ", optionalClaimsArray);
-			Contract.Assume(required != null);
-			Contract.Assume(optional != null);
+			Assumes.True(required != null);
+			Assumes.True(optional != null);
 		}
 
 		/// <summary>
@@ -750,7 +742,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// or to downgrade gracefully if the user agent lacks an Information Card selector.
 		/// </summary>
 		private void RenderSupportingScript() {
-			Requires.ValidState(this.infoCardSupportedPanel != null);
+			RequiresEx.ValidState(this.infoCardSupportedPanel != null);
 
 			this.Page.ClientScript.RegisterClientScriptResource(typeof(InfoCardSelector), ScriptResourceName);
 
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivedTokenEventArgs.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivedTokenEventArgs.cs
index 94d3d63..2ec124b 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivedTokenEventArgs.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivedTokenEventArgs.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Xml.XPath;
 
 	/// <summary>
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivingTokenEventArgs.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivingTokenEventArgs.cs
index 3d7e3d3..6de2ef0 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivingTokenEventArgs.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/ReceivingTokenEventArgs.cs
@@ -8,9 +8,9 @@ namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IdentityModel.Tokens;
 	using System.Security.Cryptography.X509Certificates;
+	using Validation;
 
 	/// <summary>
 	/// Arguments for the <see cref="InfoCardSelector.ReceivingToken"/> event.
@@ -74,7 +74,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "False positive")]
 		public void AddDecryptingToken(X509Certificate2 certificate) {
 			Requires.NotNull(certificate, "certificate");
-			Requires.True(certificate.HasPrivateKey, "certificate");
+			Requires.That(certificate.HasPrivateKey, "certificate", "requires private key");
 			var cert = new X509SecurityToken(certificate);
 			try {
 				this.AddDecryptingToken(cert);
diff --git a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/TokenProcessingErrorEventArgs.cs b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/TokenProcessingErrorEventArgs.cs
index d9c38f6..104df15 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/InfoCard/TokenProcessingErrorEventArgs.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/InfoCard/TokenProcessingErrorEventArgs.cs
@@ -6,7 +6,7 @@
 namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Arguments for the <see cref="InfoCardSelector.TokenProcessingError"/> event.
diff --git a/src/DotNetOpenAuth.InfoCard.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.InfoCard.UI/Properties/AssemblyInfo.cs
index 69b7345..bc8a8cc 100644
--- a/src/DotNetOpenAuth.InfoCard.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.InfoCard.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.InfoCard.UI/packages.config b/src/DotNetOpenAuth.InfoCard.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.InfoCard.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.InfoCard/DotNetOpenAuth.InfoCard.csproj b/src/DotNetOpenAuth.InfoCard/DotNetOpenAuth.InfoCard.csproj
index 09371f1..ee0899b 100644
--- a/src/DotNetOpenAuth.InfoCard/DotNetOpenAuth.InfoCard.csproj
+++ b/src/DotNetOpenAuth.InfoCard/DotNetOpenAuth.InfoCard.csproj
@@ -46,6 +46,15 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs
index 0660ec7..2ac1788 100644
--- a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs
+++ b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs
@@ -18,11 +18,11 @@ namespace DotNetOpenAuth.InfoCard {
 	using System.Xml;
 	using System.Xml.XPath;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The decrypted token that was submitted as an Information Card.
 	/// </summary>
-	[ContractVerification(true)]
 	public class Token {
 		/// <summary>
 		/// Backing field for the <see cref="Claims"/> property.
@@ -44,8 +44,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "Not a problem for this type."), SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "False positive")]
 		private Token(string tokenXml, Uri audience, TokenDecryptor decryptor) {
 			Requires.NotNullOrEmpty(tokenXml, "tokenXml");
-			Requires.True(decryptor != null || !IsEncrypted(tokenXml), null);
-			Contract.Ensures(this.AuthorizationContext != null);
+			Requires.That(decryptor != null || !IsEncrypted(tokenXml), "decryptor", "Required when tokenXml is encrypted.");
 
 			byte[] decryptedBytes;
 			string decryptedString;
@@ -53,12 +52,12 @@ namespace DotNetOpenAuth.InfoCard {
 			using (StringReader xmlReader = new StringReader(tokenXml)) {
 				var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings();
 				using (XmlReader tokenReader = XmlReader.Create(xmlReader, readerSettings)) {
-					Contract.Assume(tokenReader != null); // BCL contract should say XmlReader.Create result != null
+					Assumes.True(tokenReader != null); // BCL contract should say XmlReader.Create result != null
 					if (IsEncrypted(tokenReader)) {
 						Logger.InfoCard.DebugFormat("Incoming SAML token, before decryption: {0}", tokenXml);
 						decryptedBytes = decryptor.DecryptToken(tokenReader);
 						decryptedString = Encoding.UTF8.GetString(decryptedBytes);
-						Contract.Assume(decryptedString != null); // BCL contracts should be enhanced here
+						Assumes.True(decryptedString != null); // BCL contracts should be enhanced here
 					} else {
 						decryptedBytes = Encoding.UTF8.GetBytes(tokenXml);
 						decryptedString = tokenXml;
@@ -118,7 +117,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </summary>
 		public string SiteSpecificId {
 			get {
-				Requires.ValidState(this.Claims.ContainsKey(ClaimTypes.PPID) && !string.IsNullOrEmpty(this.Claims[ClaimTypes.PPID]));
+				RequiresEx.ValidState(this.Claims.ContainsKey(ClaimTypes.PPID) && !string.IsNullOrEmpty(this.Claims[ClaimTypes.PPID]));
 				string ppidValue;
 				ErrorUtilities.VerifyOperation(this.Claims.TryGetValue(ClaimTypes.PPID, out ppidValue) && ppidValue != null, InfoCardStrings.PpidClaimRequired);
 				return TokenUtility.CalculateSiteSpecificID(ppidValue);
@@ -181,7 +180,6 @@ namespace DotNetOpenAuth.InfoCard {
 		public static Token Read(string tokenXml, Uri audience, IEnumerable<SecurityToken> decryptionTokens) {
 			Requires.NotNullOrEmpty(tokenXml, "tokenXml");
 			Requires.NotNull(decryptionTokens, "decryptionTokens");
-			Contract.Ensures(Contract.Result<Token>() != null);
 
 			TokenDecryptor decryptor = null;
 
@@ -215,7 +213,7 @@ namespace DotNetOpenAuth.InfoCard {
 			}
 
 			try {
-				Contract.Assume(tokenReader != null); // CC missing for XmlReader.Create
+				Assumes.True(tokenReader != null); // CC missing for XmlReader.Create
 				return IsEncrypted(tokenReader);
 			} catch {
 				IDisposable disposableReader = tokenReader;
diff --git a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenDecryptor.cs b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenDecryptor.cs
index e9199c7..fab5148 100644
--- a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenDecryptor.cs
+++ b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenDecryptor.cs
@@ -13,7 +13,6 @@ namespace DotNetOpenAuth.InfoCard {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IdentityModel.Selectors;
 	using System.IdentityModel.Tokens;
 	using System.Linq;
@@ -22,6 +21,7 @@ namespace DotNetOpenAuth.InfoCard {
 	using System.ServiceModel.Security;
 	using System.Xml;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A utility class for decrypting InfoCard tokens.
@@ -90,7 +90,6 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>A byte array of the contents of the encrypted token</returns>
 		internal byte[] DecryptToken(XmlReader reader) {
 			Requires.NotNull(reader, "reader");
-			Contract.Ensures(Contract.Result<byte[]>() != null);
 
 			byte[] securityTokenData;
 			string encryptionAlgorithm;
diff --git a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenUtility.cs b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenUtility.cs
index 8b9eef8..616cb9f 100644
--- a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenUtility.cs
+++ b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/TokenUtility.cs
@@ -13,7 +13,6 @@ namespace DotNetOpenAuth.InfoCard {
 	using System.Collections.Generic;
 	using System.Configuration;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IdentityModel.Claims;
 	using System.IdentityModel.Policy;
 	using System.IdentityModel.Selectors;
@@ -27,6 +26,7 @@ namespace DotNetOpenAuth.InfoCard {
 	using System.Text;
 	using System.Xml;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Tools for reading InfoCard tokens.
@@ -49,8 +49,6 @@ namespace DotNetOpenAuth.InfoCard {
 		/// The authorization context carried by the token.
 		/// </returns>
 		internal static AuthorizationContext AuthenticateToken(XmlReader reader, Uri audience) {
-			Contract.Ensures(Contract.Result<AuthorizationContext>() != null);
-
 			// Extensibility Point:
 			// in order to accept different token types, you would need to add additional 
 			// code to create an authenticationcontext from the security token. 
@@ -227,7 +225,6 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "False positive.")]
 		internal static string CalculateSiteSpecificID(string ppid) {
 			Requires.NotNull(ppid, "ppid");
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
 
 			int callSignChars = 10;
 			char[] charMap = "QL23456789ABCDEFGHJKMNPRSTUVWXYZ".ToCharArray();
@@ -281,7 +278,6 @@ namespace DotNetOpenAuth.InfoCard {
 		private static string ComputeCombinedId(RSA issuerKey, string claimValue) {
 			Requires.NotNull(issuerKey, "issuerKey");
 			Requires.NotNull(claimValue, "claimValue");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			int nameLength = Encoding.UTF8.GetByteCount(claimValue);
 			RSAParameters rsaParams = issuerKey.ExportParameters(false);
diff --git a/src/DotNetOpenAuth.InfoCard/InfoCardErrorUtilities.cs b/src/DotNetOpenAuth.InfoCard/InfoCardErrorUtilities.cs
index cfde838..aaff82b 100644
--- a/src/DotNetOpenAuth.InfoCard/InfoCardErrorUtilities.cs
+++ b/src/DotNetOpenAuth.InfoCard/InfoCardErrorUtilities.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth {
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Error reporting methods specific to InfoCard validation.
@@ -27,9 +28,7 @@ namespace DotNetOpenAuth {
 		[Pure]
 		internal static void VerifyInfoCard(bool condition, string errorMessage, params object[] args) {
 			Requires.NotNull(args, "args");
-			Contract.Ensures(condition);
-			Contract.EnsuresOnThrow<InfoCard.InformationCardException>(!condition);
-			Contract.Assume(errorMessage != null);
+			Assumes.True(errorMessage != null);
 			if (!condition) {
 				errorMessage = string.Format(CultureInfo.CurrentCulture, errorMessage, args);
 				throw new InfoCard.InformationCardException(errorMessage);
diff --git a/src/DotNetOpenAuth.InfoCard/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.InfoCard/Properties/AssemblyInfo.cs
index e9f2c20..1288eb4 100644
--- a/src/DotNetOpenAuth.InfoCard/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.InfoCard/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.InfoCard/packages.config b/src/DotNetOpenAuth.InfoCard/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.InfoCard/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth.Common/DotNetOpenAuth.OAuth.Common.csproj b/src/DotNetOpenAuth.OAuth.Common/DotNetOpenAuth.OAuth.Common.csproj
index 0e3743f..6e69173 100644
--- a/src/DotNetOpenAuth.OAuth.Common/DotNetOpenAuth.OAuth.Common.csproj
+++ b/src/DotNetOpenAuth.OAuth.Common/DotNetOpenAuth.OAuth.Common.csproj
@@ -30,6 +30,15 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthIdentity.cs b/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthIdentity.cs
index 1f9fbbc..28e0333 100644
--- a/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthIdentity.cs
+++ b/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthIdentity.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Runtime.InteropServices;
 	using System.Security.Principal;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Represents an OAuth consumer that is impersonating a known user on the system.
diff --git a/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthPrincipal.cs b/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthPrincipal.cs
index c23939a..65d7042 100644
--- a/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthPrincipal.cs
+++ b/src/DotNetOpenAuth.OAuth.Common/OAuth/ChannelElements/OAuthPrincipal.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Runtime.InteropServices;
 	using System.Security.Principal;
diff --git a/src/DotNetOpenAuth.OAuth.Common/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth.Common/Properties/AssemblyInfo.cs
index 759bd3f..a3afcd7 100644
--- a/src/DotNetOpenAuth.OAuth.Common/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth.Common/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -30,7 +29,6 @@ using System.Web.UI;
 
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("F9AFC069-8291-497F-B2A1-3E4D1646C572")]
-[assembly: ContractVerification(true)]
 
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
diff --git a/src/DotNetOpenAuth.OAuth.Common/packages.config b/src/DotNetOpenAuth.OAuth.Common/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth.Common/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/DotNetOpenAuth.OAuth.Consumer.csproj b/src/DotNetOpenAuth.OAuth.Consumer/DotNetOpenAuth.OAuth.Consumer.csproj
index cb4aea3..031277a 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/DotNetOpenAuth.OAuth.Consumer.csproj
+++ b/src/DotNetOpenAuth.OAuth.Consumer/DotNetOpenAuth.OAuth.Consumer.csproj
@@ -40,6 +40,15 @@
       <Name>DotNetOpenAuth.OAuth</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerChannel.cs b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerChannel.cs
index 673c23f..89ce187 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerChannel.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerChannel.cs
@@ -8,11 +8,11 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// The messaging channel for OAuth 1.0(a) Consumers.
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
index f9cf1fe..e79749f 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.Messages;
 
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/RsaSha1ConsumerSigningBindingElement.cs b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/RsaSha1ConsumerSigningBindingElement.cs
index 03e1b8e..d492e33 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/RsaSha1ConsumerSigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ChannelElements/RsaSha1ConsumerSigningBindingElement.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Security.Cryptography.X509Certificates;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A binding element that signs outgoing messages and verifies the signature on incoming messages.
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ConsumerBase.cs b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ConsumerBase.cs
index 10f2c54..0d2da87 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ConsumerBase.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/ConsumerBase.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OAuth {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 	using DotNetOpenAuth.Configuration;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OAuth {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Base class for <see cref="WebConsumer"/> and <see cref="DesktopConsumer"/> types.
@@ -278,7 +278,6 @@ namespace DotNetOpenAuth.OAuth {
 		/// </returns>
 		protected AuthorizedTokenResponse ProcessUserAuthorization(string requestToken, string verifier) {
 			Requires.NotNullOrEmpty(requestToken, "requestToken");
-			Contract.Ensures(Contract.Result<AuthorizedTokenResponse>() != null);
 
 			var requestAccess = new AuthorizedTokenRequest(this.ServiceProvider.AccessTokenEndpoint, this.ServiceProvider.Version) {
 				RequestToken = requestToken,
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/WebConsumer.cs b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/WebConsumer.cs
index 086ff7a..4d4e67c 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/OAuth/WebConsumer.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/OAuth/WebConsumer.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A website or application that uses OAuth to access the Service Provider on behalf of the User.
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth.Consumer/Properties/AssemblyInfo.cs
index 6c9e910..95b169d 100644
--- a/src/DotNetOpenAuth.OAuth.Consumer/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth.Consumer/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth.Consumer/packages.config b/src/DotNetOpenAuth.OAuth.Consumer/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth.Consumer/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/DotNetOpenAuth.OAuth.ServiceProvider.csproj b/src/DotNetOpenAuth.OAuth.ServiceProvider/DotNetOpenAuth.OAuth.ServiceProvider.csproj
index 689d08a..5708136 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/DotNetOpenAuth.OAuth.ServiceProvider.csproj
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/DotNetOpenAuth.OAuth.ServiceProvider.csproj
@@ -50,6 +50,15 @@
       <Name>DotNetOpenAuth.OAuth</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/IServiceProviderTokenManager.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/IServiceProviderTokenManager.cs
index 2d47d00..1c413a3 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/IServiceProviderTokenManager.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/IServiceProviderTokenManager.cs
@@ -7,15 +7,14 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// A token manager for use by a web site in its role as a
 	/// service provider.
 	/// </summary>
-	[ContractClass(typeof(IServiceProviderTokenManagerContract))]
 	public interface IServiceProviderTokenManager : ITokenManager {
 		/// <summary>
 		/// Gets the Consumer description for a given a Consumer Key.
@@ -79,173 +78,4 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// </remarks>
 		void UpdateToken(IServiceProviderRequestToken token);
 	}
-
-	/// <summary>
-	/// Code contract class for the <see cref="IServiceProviderTokenManager"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IServiceProviderTokenManager))]
-	internal abstract class IServiceProviderTokenManagerContract : IServiceProviderTokenManager {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IServiceProviderTokenManagerContract"/> class from being created.
-		/// </summary>
-		private IServiceProviderTokenManagerContract() {
-		}
-
-		#region IServiceProviderTokenManager Members
-
-		/// <summary>
-		/// Gets the Consumer description for a given a Consumer Key.
-		/// </summary>
-		/// <param name="consumerKey">The Consumer Key.</param>
-		/// <returns>
-		/// A description of the consumer.  Never null.
-		/// </returns>
-		/// <exception cref="KeyNotFoundException">Thrown if the consumer key cannot be found.</exception>
-		IConsumerDescription IServiceProviderTokenManager.GetConsumer(string consumerKey) {
-			Requires.NotNullOrEmpty(consumerKey, "consumerKey");
-			Contract.Ensures(Contract.Result<IConsumerDescription>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Checks whether a given request token has already been authorized
-		/// by some user for use by the Consumer that requested it.
-		/// </summary>
-		/// <param name="requestToken">The Consumer's request token.</param>
-		/// <returns>
-		/// True if the request token has already been fully authorized by the user
-		/// who owns the relevant protected resources.  False if the token has not yet
-		/// been authorized, has expired or does not exist.
-		/// </returns>
-		bool IServiceProviderTokenManager.IsRequestTokenAuthorized(string requestToken) {
-			Requires.NotNullOrEmpty(requestToken, "requestToken");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets details on the named request token.
-		/// </summary>
-		/// <param name="token">The request token.</param>
-		/// <returns>A description of the token.  Never null.</returns>
-		/// <exception cref="KeyNotFoundException">Thrown if the token cannot be found.</exception>
-		/// <remarks>
-		/// It is acceptable for implementations to find the token, see that it has expired,
-		/// delete it from the database and then throw <see cref="KeyNotFoundException"/>,
-		/// or alternatively it can return the expired token anyway and the OAuth channel will
-		/// log and throw the appropriate error.
-		/// </remarks>
-		IServiceProviderRequestToken IServiceProviderTokenManager.GetRequestToken(string token) {
-			Requires.NotNullOrEmpty(token, "token");
-			Contract.Ensures(Contract.Result<IServiceProviderRequestToken>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets details on the named access token.
-		/// </summary>
-		/// <param name="token">The access token.</param>
-		/// <returns>A description of the token.  Never null.</returns>
-		/// <exception cref="KeyNotFoundException">Thrown if the token cannot be found.</exception>
-		/// <remarks>
-		/// It is acceptable for implementations to find the token, see that it has expired,
-		/// delete it from the database and then throw <see cref="KeyNotFoundException"/>,
-		/// or alternatively it can return the expired token anyway and the OAuth channel will
-		/// log and throw the appropriate error.
-		/// </remarks>
-		IServiceProviderAccessToken IServiceProviderTokenManager.GetAccessToken(string token) {
-			Requires.NotNullOrEmpty(token, "token");
-			Contract.Ensures(Contract.Result<IServiceProviderAccessToken>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Persists any changes made to the token.
-		/// </summary>
-		/// <param name="token">The token whose properties have been changed.</param>
-		/// <remarks>
-		/// This library will invoke this method after making a set
-		/// of changes to the token as part of a web request to give the host
-		/// the opportunity to persist those changes to a database.
-		/// Depending on the object persistence framework the host site uses,
-		/// this method MAY not need to do anything (if changes made to the token
-		/// will automatically be saved without any extra handling).
-		/// </remarks>
-		void IServiceProviderTokenManager.UpdateToken(IServiceProviderRequestToken token) {
-			Requires.NotNull(token, "token");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-
-		#region ITokenManager Members
-
-		/// <summary>
-		/// Gets the Token Secret given a request or access token.
-		/// </summary>
-		/// <param name="token">The request or access token.</param>
-		/// <returns>
-		/// The secret associated with the given token.
-		/// </returns>
-		/// <exception cref="ArgumentException">Thrown if the secret cannot be found for the given token.</exception>
-		string ITokenManager.GetTokenSecret(string token) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Stores a newly generated unauthorized request token, secret, and optional
-		/// application-specific parameters for later recall.
-		/// </summary>
-		/// <param name="request">The request message that resulted in the generation of a new unauthorized request token.</param>
-		/// <param name="response">The response message that includes the unauthorized request token.</param>
-		/// <exception cref="ArgumentException">Thrown if the consumer key is not registered, or a required parameter was not found in the parameters collection.</exception>
-		/// <remarks>
-		/// Request tokens stored by this method SHOULD NOT associate any user account with this token.
-		/// It usually opens up security holes in your application to do so.  Instead, you associate a user
-		/// account with access tokens (not request tokens) in the <see cref="ITokenManager.ExpireRequestTokenAndStoreNewAccessToken"/>
-		/// method.
-		/// </remarks>
-		void ITokenManager.StoreNewRequestToken(DotNetOpenAuth.OAuth.Messages.UnauthorizedTokenRequest request, DotNetOpenAuth.OAuth.Messages.ITokenSecretContainingMessage response) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Deletes a request token and its associated secret and stores a new access token and secret.
-		/// </summary>
-		/// <param name="consumerKey">The Consumer that is exchanging its request token for an access token.</param>
-		/// <param name="requestToken">The Consumer's request token that should be deleted/expired.</param>
-		/// <param name="accessToken">The new access token that is being issued to the Consumer.</param>
-		/// <param name="accessTokenSecret">The secret associated with the newly issued access token.</param>
-		/// <remarks>
-		/// 	<para>
-		/// Any scope of granted privileges associated with the request token from the
-		/// original call to <see cref="ITokenManager.StoreNewRequestToken"/> should be carried over
-		/// to the new Access Token.
-		/// </para>
-		/// 	<para>
-		/// To associate a user account with the new access token,
-		/// <see cref="System.Web.HttpContext.User">HttpContext.Current.User</see> may be
-		/// useful in an ASP.NET web application within the implementation of this method.
-		/// Alternatively you may store the access token here without associating with a user account,
-		/// and wait until WebConsumer.ProcessUserAuthorization or
-		/// DesktopConsumer.ProcessUserAuthorization return the access
-		/// token to associate the access token with a user account at that point.
-		/// </para>
-		/// </remarks>
-		void ITokenManager.ExpireRequestTokenAndStoreNewAccessToken(string consumerKey, string requestToken, string accessToken, string accessTokenSecret) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Classifies a token as a request token or an access token.
-		/// </summary>
-		/// <param name="token">The token to classify.</param>
-		/// <returns>
-		/// Request or Access token, or invalid if the token is not recognized.
-		/// </returns>
-		TokenType ITokenManager.GetTokenType(string token) {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuth1Principal.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuth1Principal.cs
index 03f8030..ff44a45 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuth1Principal.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuth1Principal.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System.Linq;
 	using System.Runtime.InteropServices;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Represents an OAuth consumer that is impersonating a known user on the system.
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderChannel.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderChannel.cs
index 0d6450f..62019d8 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderChannel.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderChannel.cs
@@ -8,11 +8,11 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// The messaging channel for OAuth 1.0(a) Service Providers.
@@ -59,7 +59,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// An array of binding elements used to initialize the channel.
 		/// </returns>
 		private static IChannelBindingElement[] InitializeBindingElements(ITamperProtectionChannelBindingElement signingBindingElement, INonceStore store, ITokenManager tokenManager, SecuritySettings securitySettings) {
-			Contract.Requires(securitySettings != null);
+			Requires.NotNull(securitySettings, "securitySettings");
 
 			var bindingElements = OAuthChannel.InitializeBindingElements(signingBindingElement, store);
 
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
index 3dcee04..38a1f56 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An OAuth-protocol specific implementation of the <see cref="IMessageFactory"/>
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/RsaSha1ServiceProviderSigningBindingElement.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/RsaSha1ServiceProviderSigningBindingElement.cs
index d1324d4..fd0d3ad 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/RsaSha1ServiceProviderSigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/RsaSha1ServiceProviderSigningBindingElement.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Security.Cryptography.X509Certificates;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A binding element that signs outgoing messages and verifies the signature on incoming messages.
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/TokenHandlingBindingElement.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/TokenHandlingBindingElement.cs
index e37cc2f..22c254f 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/TokenHandlingBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ChannelElements/TokenHandlingBindingElement.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A binding element for Service Providers to manage the 
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ServiceProvider.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ServiceProvider.cs
index ecfd191..d2152ea 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ServiceProvider.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ServiceProvider.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OAuth {
 	using System.Collections.Generic;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Security.Principal;
 	using System.ServiceModel.Channels;
@@ -19,6 +18,7 @@ namespace DotNetOpenAuth.OAuth {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A web application that allows access via OAuth.
@@ -109,8 +109,6 @@ namespace DotNetOpenAuth.OAuth {
 		[EditorBrowsable(EditorBrowsableState.Advanced)]
 		public static INonceStore HttpApplicationStore {
 			get {
-				Contract.Ensures(Contract.Result<INonceStore>() != null);
-
 				HttpContext context = HttpContext.Current;
 				ErrorUtilities.VerifyOperation(context != null, Strings.StoreRequiredWhenNoHttpContextAvailable, typeof(INonceStore).Name);
 				var store = (INonceStore)context.Application[ApplicationStoreKey];
@@ -182,7 +180,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// length of the final string.</param>
 		/// <returns>The verification code.</returns>
 		public static string CreateVerificationCode(VerificationCodeFormat format, int length) {
-			Requires.InRange(length >= 0, "length");
+			Requires.Range(length >= 0, "length");
 
 			switch (format) {
 				case VerificationCodeFormat.IncludedInCallback:
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth.ServiceProvider/Properties/AssemblyInfo.cs
index aa99a01..63af312 100644
--- a/src/DotNetOpenAuth.OAuth.ServiceProvider/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth.ServiceProvider/packages.config b/src/DotNetOpenAuth.OAuth.ServiceProvider/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth.ServiceProvider/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth/Configuration/OAuthElement.cs b/src/DotNetOpenAuth.OAuth/Configuration/OAuthElement.cs
index 3972e6f..8b34e49 100644
--- a/src/DotNetOpenAuth.OAuth/Configuration/OAuthElement.cs
+++ b/src/DotNetOpenAuth.OAuth/Configuration/OAuthElement.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents the &lt;oauth&gt; element in the host's .config file.
@@ -38,7 +37,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		public static OAuthElement Configuration {
 			get {
-				Contract.Ensures(Contract.Result<OAuthElement>() != null);
 				return (OAuthElement)ConfigurationManager.GetSection(SectionName) ?? new OAuthElement();
 			}
 		}
diff --git a/src/DotNetOpenAuth.OAuth/DotNetOpenAuth.OAuth.csproj b/src/DotNetOpenAuth.OAuth/DotNetOpenAuth.OAuth.csproj
index 1720648..d9d61ff 100644
--- a/src/DotNetOpenAuth.OAuth/DotNetOpenAuth.OAuth.csproj
+++ b/src/DotNetOpenAuth.OAuth/DotNetOpenAuth.OAuth.csproj
@@ -29,7 +29,6 @@
     <Compile Include="OAuth\ChannelElements\OAuthHttpMethodBindingElement.cs" />
     <Compile Include="OAuth\ChannelElements\PlaintextSigningBindingElement.cs" />
     <Compile Include="OAuth\ChannelElements\HmacSha1SigningBindingElement.cs" />
-    <Compile Include="OAuth\ChannelElements\SigningBindingElementBaseContract.cs" />
     <Compile Include="OAuth\ChannelElements\SigningBindingElementChain.cs" />
     <Compile Include="OAuth\ChannelElements\TokenType.cs" />
     <Compile Include="OAuth\ChannelElements\UriOrOobEncoding.cs" />
@@ -66,6 +65,7 @@
   <ItemGroup>
     <None Include="OAuth\ClassDiagram.cd" />
     <None Include="OAuth\Messages\OAuth Messages.cd" />
+    <None Include="packages.config" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="OAuth\OAuthStrings.resx">
@@ -82,6 +82,12 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth/Messaging/ITamperProtectionChannelBindingElement.cs b/src/DotNetOpenAuth.OAuth/Messaging/ITamperProtectionChannelBindingElement.cs
index 66b82d4..1251472 100644
--- a/src/DotNetOpenAuth.OAuth/Messaging/ITamperProtectionChannelBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth/Messaging/ITamperProtectionChannelBindingElement.cs
@@ -6,14 +6,12 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 
 	/// <summary>
 	/// An interface that must be implemented by message transforms/validators in order
 	/// to be included in the channel stack.
 	/// </summary>
-	[ContractClass(typeof(ITamperProtectionChannelBindingElementContract))]
 	public interface ITamperProtectionChannelBindingElement : IChannelBindingElement {
 		/// <summary>
 		/// Gets or sets the delegate that will initialize the non-serialized properties necessary on a
@@ -27,98 +25,4 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The cloned instance.</returns>
 		ITamperProtectionChannelBindingElement Clone();
 	}
-
-	/// <summary>
-	/// Contract class for the <see cref="ITamperProtectionChannelBindingElement"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(ITamperProtectionChannelBindingElement))]
-	internal abstract class ITamperProtectionChannelBindingElementContract : ITamperProtectionChannelBindingElement {
-		#region ITamperProtectionChannelBindingElement Properties
-
-		/// <summary>
-		/// Gets or sets the delegate that will initialize the non-serialized properties necessary on a
-		/// signable message so that its signature can be correctly calculated or verified.
-		/// </summary>
-		Action<ITamperResistantOAuthMessage> ITamperProtectionChannelBindingElement.SignatureCallback {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IChannelBindingElement Members
-
-		/// <summary>
-		/// Gets or sets the channel that this binding element belongs to.
-		/// </summary>
-		/// <remarks>
-		/// This property is set by the channel when it is first constructed.
-		/// </remarks>
-		Channel IChannelBindingElement.Channel {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the protection commonly offered (if any) by this binding element.
-		/// </summary>
-		/// <remarks>
-		/// This value is used to assist in sorting binding elements in the channel stack.
-		/// </remarks>
-		MessageProtections IChannelBindingElement.Protection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Prepares a message for sending based on the rules of this channel binding element.
-		/// </summary>
-		/// <param name="message">The message to prepare for sending.</param>
-		/// <returns>
-		/// The protections (if any) that this binding element applied to the message.
-		/// Null if this binding element did not even apply to this binding element.
-		/// </returns>
-		/// <remarks>
-		/// Implementations that provide message protection must honor the
-		/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
-		/// </remarks>
-		MessageProtections? IChannelBindingElement.ProcessOutgoingMessage(IProtocolMessage message) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Performs any transformation on an incoming message that may be necessary and/or
-		/// validates an incoming message based on the rules of this channel binding element.
-		/// </summary>
-		/// <param name="message">The incoming message to process.</param>
-		/// <returns>
-		/// The protections (if any) that this binding element applied to the message.
-		/// Null if this binding element did not even apply to this binding element.
-		/// </returns>
-		/// <exception cref="ProtocolException">
-		/// Thrown when the binding element rules indicate that this message is invalid and should
-		/// NOT be processed.
-		/// </exception>
-		/// <remarks>
-		/// Implementations that provide message protection must honor the
-		/// <see cref="MessagePartAttribute.RequiredProtection"/> properties where applicable.
-		/// </remarks>
-		MessageProtections? IChannelBindingElement.ProcessIncomingMessage(IProtocolMessage message) {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-
-		#region ITamperProtectionChannelBindingElement Methods
-
-		/// <summary>
-		/// Clones this instance.
-		/// </summary>
-		/// <returns>The cloned instance.</returns>
-		ITamperProtectionChannelBindingElement ITamperProtectionChannelBindingElement.Clone() {
-			Contract.Ensures(Contract.Result<ITamperProtectionChannelBindingElement>() != null);
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/HmacSha1SigningBindingElement.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/HmacSha1SigningBindingElement.cs
index ee05614..60fbdb9 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/HmacSha1SigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/HmacSha1SigningBindingElement.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/ITokenManager.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/ITokenManager.cs
index aa969f2..3749920 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/ITokenManager.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/ITokenManager.cs
@@ -7,17 +7,16 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An interface OAuth hosts must implement for persistent storage
 	/// and recall of tokens and secrets for an individual OAuth consumer
 	/// or service provider.
 	/// </summary>
-	[ContractClass(typeof(ITokenManagerContract))]
 	public interface ITokenManager {
 		/// <summary>
 		/// Gets the Token Secret given a request or access token.
@@ -74,96 +73,4 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// <returns>Request or Access token, or invalid if the token is not recognized.</returns>
 		TokenType GetTokenType(string token);
 	}
-
-	/// <summary>
-	/// The code contract class for the <see cref="ITokenManager"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(ITokenManager))]
-	internal abstract class ITokenManagerContract : ITokenManager {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="ITokenManagerContract"/> class from being created.
-		/// </summary>
-		private ITokenManagerContract() {
-		}
-
-		#region ITokenManager Members
-
-		/// <summary>
-		/// Gets the Token Secret given a request or access token.
-		/// </summary>
-		/// <param name="token">The request or access token.</param>
-		/// <returns>
-		/// The secret associated with the given token.
-		/// </returns>
-		/// <exception cref="ArgumentException">Thrown if the secret cannot be found for the given token.</exception>
-		string ITokenManager.GetTokenSecret(string token) {
-			Requires.NotNullOrEmpty(token, "token");
-			Contract.Ensures(Contract.Result<string>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Stores a newly generated unauthorized request token, secret, and optional
-		/// application-specific parameters for later recall.
-		/// </summary>
-		/// <param name="request">The request message that resulted in the generation of a new unauthorized request token.</param>
-		/// <param name="response">The response message that includes the unauthorized request token.</param>
-		/// <exception cref="ArgumentException">Thrown if the consumer key is not registered, or a required parameter was not found in the parameters collection.</exception>
-		/// <remarks>
-		/// Request tokens stored by this method SHOULD NOT associate any user account with this token.
-		/// It usually opens up security holes in your application to do so.  Instead, you associate a user
-		/// account with access tokens (not request tokens) in the <see cref="ITokenManager.ExpireRequestTokenAndStoreNewAccessToken"/>
-		/// method.
-		/// </remarks>
-		void ITokenManager.StoreNewRequestToken(UnauthorizedTokenRequest request, ITokenSecretContainingMessage response) {
-			Requires.NotNull(request, "request");
-			Requires.NotNull(response, "response");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Deletes a request token and its associated secret and stores a new access token and secret.
-		/// </summary>
-		/// <param name="consumerKey">The Consumer that is exchanging its request token for an access token.</param>
-		/// <param name="requestToken">The Consumer's request token that should be deleted/expired.</param>
-		/// <param name="accessToken">The new access token that is being issued to the Consumer.</param>
-		/// <param name="accessTokenSecret">The secret associated with the newly issued access token.</param>
-		/// <remarks>
-		/// 	<para>
-		/// Any scope of granted privileges associated with the request token from the
-		/// original call to <see cref="ITokenManager.StoreNewRequestToken"/> should be carried over
-		/// to the new Access Token.
-		/// </para>
-		/// 	<para>
-		/// To associate a user account with the new access token,
-		/// <see cref="System.Web.HttpContext.User">HttpContext.Current.User</see> may be
-		/// useful in an ASP.NET web application within the implementation of this method.
-		/// Alternatively you may store the access token here without associating with a user account,
-		/// and wait until WebConsumer.ProcessUserAuthorization or
-		/// DesktopConsumer.ProcessUserAuthorization return the access
-		/// token to associate the access token with a user account at that point.
-		/// </para>
-		/// </remarks>
-		void ITokenManager.ExpireRequestTokenAndStoreNewAccessToken(string consumerKey, string requestToken, string accessToken, string accessTokenSecret) {
-			Requires.NotNullOrEmpty(consumerKey, "consumerKey");
-			Requires.NotNullOrEmpty(requestToken, "requestToken");
-			Requires.NotNullOrEmpty(accessToken, "accessToken");
-			Requires.NotNull(accessTokenSecret, "accessTokenSecret");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Classifies a token as a request token or an access token.
-		/// </summary>
-		/// <param name="token">The token to classify.</param>
-		/// <returns>
-		/// Request or Access token, or invalid if the token is not recognized.
-		/// </returns>
-		TokenType ITokenManager.GetTokenType(string token) {
-			Requires.NotNullOrEmpty(token, "token");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/OAuthChannel.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/OAuthChannel.cs
index db131a9..1362ca9 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/OAuthChannel.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/OAuthChannel.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -21,6 +20,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An OAuth-specific implementation of the <see cref="Channel"/> class.
@@ -42,7 +42,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 			Requires.NotNull(tokenManager, "tokenManager");
 			Requires.NotNull(securitySettings, "securitySettings");
 			Requires.NotNull(signingBindingElement, "signingBindingElement");
-			Requires.True(signingBindingElement.SignatureCallback == null, "signingBindingElement", OAuthStrings.SigningElementAlreadyAssociatedWithChannel);
+			Requires.That(signingBindingElement.SignatureCallback == null, "signingBindingElement", OAuthStrings.SigningElementAlreadyAssociatedWithChannel);
 			Requires.NotNull(bindingElements, "bindingElements");
 
 			this.TokenManager = tokenManager;
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/RsaSha1SigningBindingElement.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/RsaSha1SigningBindingElement.cs
index 01a5c53..55ce981 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/RsaSha1SigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/RsaSha1SigningBindingElement.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Security.Cryptography.X509Certificates;
 	using System.Text;
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBase.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
index 58e4ada..780afdc 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
@@ -17,11 +16,11 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// A binding element that signs outgoing messages and verifies the signature on incoming messages.
 	/// </summary>
-	[ContractClass(typeof(SigningBindingElementBaseContract))]
 	public abstract class SigningBindingElementBase : ITamperProtectionChannelBindingElement {
 		/// <summary>
 		/// The signature method this binding element uses.
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBaseContract.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBaseContract.cs
deleted file mode 100644
index f608e52..0000000
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementBaseContract.cs
+++ /dev/null
@@ -1,47 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="SigningBindingElementBaseContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OAuth.ChannelElements {
-	using System;
-	using System.Diagnostics.Contracts;
-	using DotNetOpenAuth.Messaging;
-
-	/// <summary>
-	/// Code Contract for the <see cref="SigningBindingElementBase"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(SigningBindingElementBase))]
-	internal abstract class SigningBindingElementBaseContract : SigningBindingElementBase {
-		/// <summary>
-		/// Prevents a default instance of the SigningBindingElementBaseContract class from being created.
-		/// </summary>
-		private SigningBindingElementBaseContract()
-			: base(string.Empty) {
-		}
-
-		/// <summary>
-		/// Clones this instance.
-		/// </summary>
-		/// <returns>A new instance of the binding element.</returns>
-		/// <remarks>
-		/// Implementations of this method need not clone the SignatureVerificationCallback member, as the
-		/// <see cref="SigningBindingElementBase"/> class does this.
-		/// </remarks>
-		protected override ITamperProtectionChannelBindingElement Clone() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Calculates a signature for a given message.
-		/// </summary>
-		/// <param name="message">The message to sign.</param>
-		/// <returns>The signature for the message.</returns>
-		protected override string GetSignature(ITamperResistantOAuthMessage message) {
-			Requires.NotNull(message, "message");
-			Requires.ValidState(this.Channel != null);
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementChain.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementChain.cs
index 7155df8..2b25566 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementChain.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/SigningBindingElementChain.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A tamper protection applying binding element that can use any of several given
@@ -31,8 +31,8 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// </param>
 		internal SigningBindingElementChain(ITamperProtectionChannelBindingElement[] signers) {
 			Requires.NotNullOrEmpty(signers, "signers");
-			Requires.NullOrWithNoNullElements(signers, "signers");
-			Requires.True(signers.Select(s => s.Protection).Distinct().Count() == 1, "signers", OAuthStrings.SigningElementsMustShareSameProtection);
+			Requires.NullOrNotNullElements(signers, "signers");
+			Requires.That(signers.Select(s => s.Protection).Distinct().Count() == 1, "signers", OAuthStrings.SigningElementsMustShareSameProtection);
 
 			this.signers = signers;
 		}
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/UriOrOobEncoding.cs b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/UriOrOobEncoding.cs
index 639310d..60ec6c8 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/UriOrOobEncoding.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ChannelElements/UriOrOobEncoding.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/Messages/MessageBase.cs b/src/DotNetOpenAuth.OAuth/OAuth/Messages/MessageBase.cs
index 98e19f0..f2f087d 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/Messages/MessageBase.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/Messages/MessageBase.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OAuth.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// A base class for all OAuth messages.
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/Messages/UnauthorizedTokenResponse.cs b/src/DotNetOpenAuth.OAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
index adfed6a..9e879cd 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
@@ -8,8 +8,8 @@ namespace DotNetOpenAuth.OAuth.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A direct message sent from Service Provider to Consumer in response to 
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/Protocol.cs b/src/DotNetOpenAuth.OAuth/OAuth/Protocol.cs
index ee5c421..72f0ff4 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/Protocol.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/Protocol.cs
@@ -9,10 +9,10 @@ namespace DotNetOpenAuth.OAuth {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An enumeration of the OAuth protocol versions supported by this library.
@@ -141,7 +141,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// <returns>A matching <see cref="Protocol"/> instance.</returns>
 		internal static Protocol Lookup(Version version) {
 			Requires.NotNull(version, "version");
-			Requires.InRange(AllVersions.Any(p => p.Version == version), "version");
+			Requires.Range(AllVersions.Any(p => p.Version == version), "version");
 			return AllVersions.First(p => p.Version == version);
 		}
 	}
diff --git a/src/DotNetOpenAuth.OAuth/OAuth/ServiceProviderDescription.cs b/src/DotNetOpenAuth.OAuth/OAuth/ServiceProviderDescription.cs
index 3f553a9..6dbe6ea 100644
--- a/src/DotNetOpenAuth.OAuth/OAuth/ServiceProviderDescription.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuth/ServiceProviderDescription.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OAuth {
 	using System;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.ChannelElements;
@@ -95,7 +94,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </summary>
 		/// <returns>The created signing element.</returns>
 		internal ITamperProtectionChannelBindingElement CreateTamperProtectionElement() {
-			Contract.Requires(this.TamperProtectionElements != null);
+			RequiresEx.ValidState(this.TamperProtectionElements != null);
 			return new SigningBindingElementChain(this.TamperProtectionElements.Select(el => (ITamperProtectionChannelBindingElement)el.Clone()).ToArray());
 		}
 	}
diff --git a/src/DotNetOpenAuth.OAuth/OAuthReporting.cs b/src/DotNetOpenAuth.OAuth/OAuthReporting.cs
index 29a9adc..e2c0aab 100644
--- a/src/DotNetOpenAuth.OAuth/OAuthReporting.cs
+++ b/src/DotNetOpenAuth.OAuth/OAuthReporting.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods specific to OAuth feature reporting.
@@ -26,9 +26,9 @@ namespace DotNetOpenAuth {
 		/// <param name="tokenManager">The token manager.</param>
 		/// <param name="nonceStore">The nonce store.</param>
 		internal static void RecordFeatureAndDependencyUse(object value, ServiceProviderDescription service, ITokenManager tokenManager, INonceStore nonceStore) {
-			Contract.Requires(value != null);
-			Contract.Requires(service != null);
-			Contract.Requires(tokenManager != null);
+			Requires.NotNull(value, "value");
+			Requires.NotNull(service, "service");
+			Requires.NotNull(tokenManager, "tokenManager");
 
 			// In release builds, just quietly return.
 			if (value == null || service == null || tokenManager == null) {
diff --git a/src/DotNetOpenAuth.OAuth/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth/Properties/AssemblyInfo.cs
index 465f646..85b5275 100644
--- a/src/DotNetOpenAuth.OAuth/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth/packages.config b/src/DotNetOpenAuth.OAuth/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Configuration/OAuth2AuthorizationServerSection.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Configuration/OAuth2AuthorizationServerSection.cs
index 6511a11..a06555d 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Configuration/OAuth2AuthorizationServerSection.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Configuration/OAuth2AuthorizationServerSection.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
 
@@ -42,7 +41,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		internal static OAuth2AuthorizationServerSection Configuration {
 			get {
-				Contract.Ensures(Contract.Result<OAuth2AuthorizationServerSection>() != null);
 				return (OAuth2AuthorizationServerSection)ConfigurationManager.GetSection(SectionName) ?? new OAuth2AuthorizationServerSection();
 			}
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/DotNetOpenAuth.OAuth2.AuthorizationServer.csproj b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/DotNetOpenAuth.OAuth2.AuthorizationServer.csproj
index 73c563b..497405a 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/DotNetOpenAuth.OAuth2.AuthorizationServer.csproj
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/DotNetOpenAuth.OAuth2.AuthorizationServer.csproj
@@ -70,6 +70,15 @@
       <LastGenOutput>AuthServerStrings.Designer.cs</LastGenOutput>
     </EmbeddedResource>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthServerUtilities.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthServerUtilities.cs
index b8a1071..b6aa75d 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthServerUtilities.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthServerUtilities.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for authorization servers.
@@ -27,7 +27,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>The client information.  Never null.</returns>
 		internal static IClientDescription GetClientOrThrow(this IAuthorizationServerHost authorizationServer, string clientIdentifier) {
 			Requires.NotNullOrEmpty(clientIdentifier, "clientIdentifier");
-			Contract.Ensures(Contract.Result<IClientDescription>() != null);
 
 			try {
 				var result = authorizationServer.GetClient(clientIdentifier);
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServer.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServer.cs
index 050a4ab..5b47d0a 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServer.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServer.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 #if CLR4
 	using System.Net.Http;
@@ -20,6 +19,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Authorization Server supporting the web server flow.
@@ -194,7 +194,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>The authorization response message to send to the Client.</returns>
 		public EndUserAuthorizationFailedResponse PrepareRejectAuthorizationRequest(EndUserAuthorizationRequest authorizationRequest, Uri callback = null) {
 			Requires.NotNull(authorizationRequest, "authorizationRequest");
-			Contract.Ensures(Contract.Result<EndUserAuthorizationFailedResponse>() != null);
 
 			if (callback == null) {
 				callback = this.GetCallback(authorizationRequest);
@@ -215,7 +214,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		public EndUserAuthorizationSuccessResponseBase PrepareApproveAuthorizationRequest(EndUserAuthorizationRequest authorizationRequest, string userName, IEnumerable<string> scopes = null, Uri callback = null) {
 			Requires.NotNull(authorizationRequest, "authorizationRequest");
 			Requires.NotNullOrEmpty(userName, "userName");
-			Contract.Ensures(Contract.Result<EndUserAuthorizationSuccessResponseBase>() != null);
 
 			if (callback == null) {
 				callback = this.GetCallback(authorizationRequest);
@@ -291,7 +289,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <exception cref="ProtocolException">Thrown if no callback URL could be determined.</exception>
 		protected Uri GetCallback(EndUserAuthorizationRequest authorizationRequest) {
 			Requires.NotNull(authorizationRequest, "authorizationRequest");
-			Contract.Ensures(Contract.Result<Uri>() != null);
 
 			var client = this.AuthorizationServerServices.GetClientOrThrow(authorizationRequest.ClientIdentifier);
 
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServerAccessToken.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServerAccessToken.cs
index a127166..7c9f808 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServerAccessToken.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AuthorizationServerAccessToken.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedAuthorizationCheckResponse.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedAuthorizationCheckResponse.cs
index 0179d05..f644f09 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedAuthorizationCheckResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedAuthorizationCheckResponse.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Describes the result of an automated authorization check, such as for client credential or resource owner password grants.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedUserAuthorizationCheckResponse.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedUserAuthorizationCheckResponse.cs
index b62807c..ac15af3 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedUserAuthorizationCheckResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/AutomatedUserAuthorizationCheckResponse.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Text;
 
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Describes the result of an automated authorization check for resource owner grants.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AggregatingClientCredentialReader.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AggregatingClientCredentialReader.cs
index ace95b3..8f39e9f 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AggregatingClientCredentialReader.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AggregatingClientCredentialReader.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Applies OAuth 2 spec policy for supporting multiple methods of client authentication.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AuthorizationCode.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AuthorizationCode.cs
index 08da8d2..75744d4 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AuthorizationCode.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/AuthorizationCode.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Represents the authorization code created when a user approves authorization that
@@ -67,7 +67,6 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 		/// <returns>A DataBag formatter.</returns>
 		internal static IDataBagFormatter<AuthorizationCode> CreateFormatter(IAuthorizationServerHost authorizationServer) {
 			Requires.NotNull(authorizationServer, "authorizationServer");
-			Contract.Ensures(Contract.Result<IDataBagFormatter<AuthorizationCode>>() != null);
 
 			var cryptoStore = authorizationServer.CryptoKeyStore;
 			ErrorUtilities.VerifyHost(cryptoStore != null, OAuthStrings.ResultShouldNotBeNull, authorizationServer.GetType(), "CryptoKeyStore");
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientAuthenticationModule.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientAuthenticationModule.cs
index 027929a..2ab3c1e 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientAuthenticationModule.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientAuthenticationModule.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A base class for extensions that can read incoming messages and extract the client identifier and
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialHttpBasicReader.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialHttpBasicReader.cs
index 6f0bbc4..dba1278 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialHttpBasicReader.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialHttpBasicReader.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Reads client authentication information from the HTTP Authorization header via Basic authentication.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialMessagePartReader.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialMessagePartReader.cs
index 2afd06e..de18d8e 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialMessagePartReader.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/ClientCredentialMessagePartReader.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System.Text;
 	using System.Web;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Reads client authentication information from the message payload itself (POST entity as a URI-encoded parameter).
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs
index 500b91d..6d4220b 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/MessageValidationBindingElement.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OAuth2.Messages;
 	using Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A guard for all messages to or from an Authorization Server to ensure that they are well formed,
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/OAuth2AuthorizationServerChannel.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/OAuth2AuthorizationServerChannel.cs
index 7ca4538..249f5e7 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/OAuth2AuthorizationServerChannel.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/OAuth2AuthorizationServerChannel.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Net.Mime;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.AuthServer.Messages;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The channel for the OAuth protocol.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/RefreshToken.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/RefreshToken.cs
index 993583c..eb40617 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/RefreshToken.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ChannelElements/RefreshToken.cs
@@ -6,9 +6,9 @@
 
 namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// The refresh token issued to a client by an authorization server that allows the client
@@ -48,7 +48,6 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 		/// </returns>
 		internal static IDataBagFormatter<RefreshToken> CreateFormatter(ICryptoKeyStore cryptoKeyStore) {
 			Requires.NotNull(cryptoKeyStore, "cryptoKeyStore");
-			Contract.Ensures(Contract.Result<IDataBagFormatter<RefreshToken>>() != null);
 
 			return new UriStyleMessageFormatter<RefreshToken>(cryptoKeyStore, RefreshTokenKeyBucket, signed: true, encrypted: true);
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ClientDescription.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ClientDescription.cs
index 3384183..a10e1aa 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ClientDescription.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/ClientDescription.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A default implementation of the <see cref="IClientDescription"/> interface.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/IAuthorizationServerHost.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/IAuthorizationServerHost.cs
index b9b5725..6465307 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/IAuthorizationServerHost.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/IAuthorizationServerHost.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
@@ -15,11 +14,11 @@ namespace DotNetOpenAuth.OAuth2 {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Provides host-specific authorization server services needed by this library.
 	/// </summary>
-	[ContractClass(typeof(IAuthorizationServerHostContract))]
 	public interface IAuthorizationServerHost {
 		/// <summary>
 		/// Gets the store for storing crypto keys used to symmetrically encrypt and sign authorization codes and refresh tokens.
@@ -112,134 +111,4 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </exception>
 		AutomatedAuthorizationCheckResponse CheckAuthorizeClientCredentialsGrant(IAccessTokenRequest accessRequest);
 	}
-
-	/// <summary>
-	/// Code Contract for the <see cref="IAuthorizationServerHost" /> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IAuthorizationServerHost))]
-	internal abstract class IAuthorizationServerHostContract : IAuthorizationServerHost {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IAuthorizationServerHostContract"/> class from being created.
-		/// </summary>
-		private IAuthorizationServerHostContract() {
-		}
-
-		/// <summary>
-		/// Gets the store for storeing crypto keys used to symmetrically encrypt and sign authorization codes and refresh tokens.
-		/// </summary>
-		ICryptoKeyStore IAuthorizationServerHost.CryptoKeyStore {
-			get {
-				Contract.Ensures(Contract.Result<ICryptoKeyStore>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the authorization code nonce store to use to ensure that authorization codes can only be used once.
-		/// </summary>
-		/// <value>The authorization code nonce store.</value>
-		INonceStore IAuthorizationServerHost.NonceStore {
-			get {
-				Contract.Ensures(Contract.Result<INonceStore>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the client with a given identifier.
-		/// </summary>
-		/// <param name="clientIdentifier">The client identifier.</param>
-		/// <returns>The client registration.  Never null.</returns>
-		/// <exception cref="ArgumentException">Thrown when no client with the given identifier is registered with this authorization server.</exception>
-		IClientDescription IAuthorizationServerHost.GetClient(string clientIdentifier) {
-			Requires.NotNullOrEmpty(clientIdentifier, "clientIdentifier");
-			Contract.Ensures(Contract.Result<IClientDescription>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Determines whether a described authorization is (still) valid.
-		/// </summary>
-		/// <param name="authorization">The authorization.</param>
-		/// <returns>
-		/// 	<c>true</c> if the original authorization is still valid; otherwise, <c>false</c>.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>When establishing that an authorization is still valid,
-		/// it's very important to only match on recorded authorizations that
-		/// meet these criteria:</para>
-		/// 1) The client identifier matches.
-		/// 2) The user account matches.
-		/// 3) The scope on the recorded authorization must include all scopes in the given authorization.
-		/// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued.
-		/// <para>One possible scenario is where the user authorized a client, later revoked authorization,
-		/// and even later reinstated authorization.  This subsequent recorded authorization
-		/// would not satisfy requirement #4 in the above list.  This is important because the revocation
-		/// the user went through should invalidate all previously issued tokens as a matter of
-		/// security in the event the user was revoking access in order to sever authorization on a stolen
-		/// account or piece of hardware in which the tokens were stored. </para>
-		/// </remarks>
-		bool IAuthorizationServerHost.IsAuthorizationValid(IAuthorizationDescription authorization) {
-			Requires.NotNull(authorization, "authorization");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Determines whether a given set of resource owner credentials is valid based on the authorization server's user database
-		/// and if so records an authorization entry such that subsequent calls to <see cref="IAuthorizationServerHost.IsAuthorizationValid"/> would
-		/// return <c>true</c>.
-		/// </summary>
-		/// <param name="userName">Username on the account.</param>
-		/// <param name="password">The user's password.</param>
-		/// <param name="accessRequest">
-		/// The access request the credentials came with.
-		/// This may be useful if the authorization server wishes to apply some policy based on the client that is making the request.
-		/// </param>
-		/// <returns>
-		/// A value that describes the result of the authorization check.
-		/// </returns>
-		/// <exception cref="NotSupportedException">
-		/// May be thrown if the authorization server does not support the resource owner password credential grant type.
-		/// </exception>
-		AutomatedUserAuthorizationCheckResponse IAuthorizationServerHost.CheckAuthorizeResourceOwnerCredentialGrant(string userName, string password, IAccessTokenRequest accessRequest) {
-			Contract.Requires(!string.IsNullOrEmpty(userName));
-			Contract.Requires(password != null);
-			Contract.Requires(accessRequest != null);
-			Contract.Ensures(Contract.Result<AutomatedUserAuthorizationCheckResponse>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Determines whether an access token request given a client credential grant should be authorized
-		/// and if so records an authorization entry such that subsequent calls to <see cref="IAuthorizationServerHost.IsAuthorizationValid" /> would
-		/// return <c>true</c>.
-		/// </summary>
-		/// <param name="accessRequest">The access request the credentials came with.
-		/// This may be useful if the authorization server wishes to apply some policy based on the client that is making the request.</param>
-		/// <returns>
-		/// A value that describes the result of the authorization check.
-		/// </returns>
-		/// <exception cref="NotSupportedException">May be thrown if the authorization server does not support the client credential grant type.</exception>
-		AutomatedAuthorizationCheckResponse IAuthorizationServerHost.CheckAuthorizeClientCredentialsGrant(IAccessTokenRequest accessRequest) {
-			Contract.Requires(accessRequest != null);
-			Contract.Ensures(Contract.Result<AutomatedAuthorizationCheckResponse>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Obtains parameters to go into the formulation of an access token.
-		/// </summary>
-		/// <param name="accessTokenRequestMessage">Details regarding the resources that the access token will grant access to, and the identity of the client
-		/// that will receive that access.
-		/// Based on this information the receiving resource server can be determined and the lifetime of the access
-		/// token can be set based on the sensitivity of the resources.</param>
-		/// <returns>
-		/// A non-null parameters instance that DotNetOpenAuth will dispose after it has been used.
-		/// </returns>
-		AccessTokenResult IAuthorizationServerHost.CreateAccessToken(IAccessTokenRequest accessTokenRequestMessage) {
-			Contract.Requires(accessTokenRequestMessage != null);
-			Contract.Ensures(Contract.Result<AccessTokenResult>() != null);
-			throw new NotImplementedException();
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/AccessTokenResult.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/AccessTokenResult.cs
index 4297165..3663018 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/AccessTokenResult.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/AccessTokenResult.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Describes the parameters to be fed into creating a response to an access token request.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponseAS.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponseAS.cs
index 25f5dc8..c479f58 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponseAS.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponseAS.cs
@@ -10,6 +10,7 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// The message sent by the Authorization Server to the Client via the user agent
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Properties/AssemblyInfo.cs
index 397b35d..29900ab 100644
--- a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2.AuthorizationServer/packages.config b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2.AuthorizationServer/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2.Client.UI/DotNetOpenAuth.OAuth2.Client.UI.csproj b/src/DotNetOpenAuth.OAuth2.Client.UI/DotNetOpenAuth.OAuth2.Client.UI.csproj
index 373baab..19161f4 100644
--- a/src/DotNetOpenAuth.OAuth2.Client.UI/DotNetOpenAuth.OAuth2.Client.UI.csproj
+++ b/src/DotNetOpenAuth.OAuth2.Client.UI/DotNetOpenAuth.OAuth2.Client.UI.csproj
@@ -46,6 +46,15 @@
       <DependentUpon>ClientAuthorizationView.cs</DependentUpon>
     </EmbeddedResource>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationCompleteEventArgs.cs b/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationCompleteEventArgs.cs
index a57034b..d7a080c 100644
--- a/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationCompleteEventArgs.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationCompleteEventArgs.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Collections.Generic;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// Describes the results of a completed authorization flow.
diff --git a/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationView.cs b/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationView.cs
index a0204fa..2c90c99 100644
--- a/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationView.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client.UI/OAuth2/ClientAuthorizationView.cs
@@ -10,7 +10,6 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.ComponentModel;
 	using System.Data;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Drawing;
 	using System.Linq;
 	using System.Text;
diff --git a/src/DotNetOpenAuth.OAuth2.Client.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2.Client.UI/Properties/AssemblyInfo.cs
index 397b35d..29900ab 100644
--- a/src/DotNetOpenAuth.OAuth2.Client.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2.Client.UI/packages.config b/src/DotNetOpenAuth.OAuth2.Client.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2.Client.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2.Client/Configuration/OAuth2ClientSection.cs b/src/DotNetOpenAuth.OAuth2.Client/Configuration/OAuth2ClientSection.cs
index 3bb6ffc..d0c27c9 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/Configuration/OAuth2ClientSection.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/Configuration/OAuth2ClientSection.cs
@@ -7,7 +7,7 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Represents the &lt;oauth2/client&gt; section in the host's .config file.
@@ -34,7 +34,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		internal static OAuth2ClientSection Configuration {
 			get {
-				Contract.Ensures(Contract.Result<OAuth2ClientSection>() != null);
 				return (OAuth2ClientSection)ConfigurationManager.GetSection(SectionName) ?? new OAuth2ClientSection();
 			}
 		}
@@ -46,14 +45,13 @@ namespace DotNetOpenAuth.Configuration {
 		[PositiveTimeSpanValidator]
 		internal TimeSpan MaxAuthorizationTime {
 			get {
-				Contract.Ensures(Contract.Result<TimeSpan>() > TimeSpan.Zero);
 				TimeSpan result = (TimeSpan)this[MaxAuthorizationTimePropertyName];
-				Contract.Assume(result > TimeSpan.Zero); // our PositiveTimeSpanValidator should take care of this
+				Assumes.True(result > TimeSpan.Zero); // our PositiveTimeSpanValidator should take care of this
 				return result;
 			}
 
 			set {
-				Requires.InRange(value > TimeSpan.Zero, "value");
+				Requires.Range(value > TimeSpan.Zero, "value");
 				this[MaxAuthorizationTimePropertyName] = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.Client/DotNetOpenAuth.OAuth2.Client.csproj b/src/DotNetOpenAuth.OAuth2.Client/DotNetOpenAuth.OAuth2.Client.csproj
index e595df2..475ed3f 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/DotNetOpenAuth.OAuth2.Client.csproj
+++ b/src/DotNetOpenAuth.OAuth2.Client/DotNetOpenAuth.OAuth2.Client.csproj
@@ -61,6 +61,15 @@
       <LastGenOutput>ClientStrings.Designer.cs</LastGenOutput>
     </EmbeddedResource>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/BearerTokenHttpMessageHandler.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/BearerTokenHttpMessageHandler.cs
index 6b2e937..8c802ff 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/BearerTokenHttpMessageHandler.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/BearerTokenHttpMessageHandler.cs
@@ -15,6 +15,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Threading;
 	using System.Threading.Tasks;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An <see cref="HttpMessageHandler"/> that applies a bearer token to each outbound HTTP request.
@@ -41,7 +42,7 @@ namespace DotNetOpenAuth.OAuth2 {
 			: base(innerHandler) {
 			Requires.NotNull(client, "client");
 			Requires.NotNull(authorization, "authorization");
-			Requires.True(!string.IsNullOrEmpty(authorization.AccessToken), "authorization.AccessToken");
+			Requires.That(!string.IsNullOrEmpty(authorization.AccessToken), "authorization.AccessToken", "AccessToken must be non-empty");
 			this.Client = client;
 			this.Authorization = authorization;
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ChannelElements/OAuth2ClientChannel.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ChannelElements/OAuth2ClientChannel.cs
index b0cdb4b..cf57618 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ChannelElements/OAuth2ClientChannel.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ChannelElements/OAuth2ClientChannel.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
-	using System.Diagnostics.Contracts;
 	using System.Net;
 	using System.Web;
 	using System.Xml;
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientBase.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientBase.cs
index e9c952d..b2178e9 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientBase.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientBase.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net;
@@ -21,6 +20,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A base class for common OAuth Client behaviors.
@@ -134,7 +134,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		public void AuthorizeRequest(WebHeaderCollection requestHeaders, IAuthorizationState authorization) {
 			Requires.NotNull(requestHeaders, "requestHeaders");
 			Requires.NotNull(authorization, "authorization");
-			Requires.True(!string.IsNullOrEmpty(authorization.AccessToken), "authorization");
+			Requires.That(!string.IsNullOrEmpty(authorization.AccessToken), "authorization", "AccessToken required.");
 			ErrorUtilities.VerifyProtocol(!authorization.AccessTokenExpirationUtc.HasValue || authorization.AccessTokenExpirationUtc >= DateTime.UtcNow || authorization.RefreshToken != null, ClientStrings.AuthorizationExpired);
 
 			if (authorization.AccessTokenExpirationUtc.HasValue && authorization.AccessTokenExpirationUtc.Value < DateTime.UtcNow) {
@@ -186,7 +186,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </remarks>
 		public bool RefreshAuthorization(IAuthorizationState authorization, TimeSpan? skipIfUsefulLifeExceeds = null) {
 			Requires.NotNull(authorization, "authorization");
-			Requires.True(!string.IsNullOrEmpty(authorization.RefreshToken), "authorization");
+			Requires.That(!string.IsNullOrEmpty(authorization.RefreshToken), "authorization", "RefreshToken required.");
 
 			if (skipIfUsefulLifeExceeds.HasValue && authorization.AccessTokenExpirationUtc.HasValue) {
 				TimeSpan usefulLifeRemaining = authorization.AccessTokenExpirationUtc.Value - DateTime.UtcNow;
@@ -223,7 +223,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		public IAuthorizationState GetScopedAccessToken(string refreshToken, HashSet<string> scope) {
 			Requires.NotNullOrEmpty(refreshToken, "refreshToken");
 			Requires.NotNull(scope, "scope");
-			Contract.Ensures(Contract.Result<IAuthorizationState>() != null);
 
 			var request = new AccessTokenRefreshRequestC(this.AuthorizationServer) {
 				ClientIdentifier = this.ClientIdentifier,
@@ -377,8 +376,8 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>A fractional number no greater than 1.  Could be negative if the access token has already expired.</returns>
 		private static double ProportionalLifeRemaining(IAuthorizationState authorization) {
 			Requires.NotNull(authorization, "authorization");
-			Requires.True(authorization.AccessTokenIssueDateUtc.HasValue, "authorization");
-			Requires.True(authorization.AccessTokenExpirationUtc.HasValue, "authorization");
+			Requires.That(authorization.AccessTokenIssueDateUtc.HasValue, "authorization", "AccessTokenIssueDateUtc required");
+			Requires.That(authorization.AccessTokenExpirationUtc.HasValue, "authorization", "AccessTokenExpirationUtc required");
 
 			// Calculate what % of the total life this access token has left.
 			TimeSpan totalLifetime = authorization.AccessTokenExpirationUtc.Value - authorization.AccessTokenIssueDateUtc.Value;
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
index 0677f5a..39ba1cb 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/ClientCredentialApplicator.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A base class for extensions that apply client authentication to messages for the authorization server in specific ways.
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/IClientAuthorizationTracker.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/IClientAuthorizationTracker.cs
index 73b7a44..d42248a 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/IClientAuthorizationTracker.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/IClientAuthorizationTracker.cs
@@ -6,12 +6,11 @@
 
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// A token manager implemented by some clients to assist in tracking authorization state.
 	/// </summary>
-	[ContractClass(typeof(IClientAuthorizationTrackerContract))]
 	public interface IClientAuthorizationTracker {
 		/// <summary>
 		/// Gets the state of the authorization for a given callback URL and client state.
@@ -21,33 +20,4 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>The authorization state; may be <c>null</c> if no authorization state matches.</returns>
 		IAuthorizationState GetAuthorizationState(Uri callbackUrl, string clientState);
 	}
-
-	/// <summary>
-	/// Contract class for the <see cref="IClientAuthorizationTracker"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IClientAuthorizationTracker))]
-	internal abstract class IClientAuthorizationTrackerContract : IClientAuthorizationTracker {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IClientAuthorizationTrackerContract"/> class from being created.
-		/// </summary>
-		private IClientAuthorizationTrackerContract() {
-		}
-
-		#region IClientTokenManager Members
-
-		/// <summary>
-		/// Gets the state of the authorization for a given callback URL and client state.
-		/// </summary>
-		/// <param name="callbackUrl">The callback URL.</param>
-		/// <param name="clientState">State of the client stored at the beginning of an authorization request.</param>
-		/// <returns>
-		/// The authorization state; may be <c>null</c> if no authorization state matches.
-		/// </returns>
-		IAuthorizationState IClientAuthorizationTracker.GetAuthorizationState(Uri callbackUrl, string clientState) {
-			Requires.NotNull(callbackUrl, "callbackUrl");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/AccessTokenAuthorizationCodeRequestC.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/AccessTokenAuthorizationCodeRequestC.cs
index ebfb2e8..861c8cd 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/AccessTokenAuthorizationCodeRequestC.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/AccessTokenAuthorizationCodeRequestC.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System.Collections.Generic;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// A request from a Client to an Authorization Server to exchange an authorization code for an access token,
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/EndUserAuthorizationRequestC.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/EndUserAuthorizationRequestC.cs
index 7c06897..b388f0c 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/EndUserAuthorizationRequestC.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/Messages/EndUserAuthorizationRequestC.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System.Collections.Generic;
 	using System.Linq;
 	using System.Text;
+	using Validation;
 
 	/// <summary>
 	/// A message sent by a web application Client to the AuthorizationServer
@@ -24,8 +25,8 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 		internal EndUserAuthorizationRequestC(AuthorizationServerDescription authorizationServer)
 			: base(authorizationServer.AuthorizationEndpoint, authorizationServer.Version) {
 			Requires.NotNull(authorizationServer, "authorizationServer");
-			Requires.True(authorizationServer.Version != null, "authorizationServer");
-			Requires.True(authorizationServer.AuthorizationEndpoint != null, "authorizationServer");
+			Requires.That(authorizationServer.Version != null, "authorizationServer", "requires Version");
+			Requires.That(authorizationServer.AuthorizationEndpoint != null, "authorizationServer", "requires AuthorizationEndpoint");
 		}
 	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/UserAgentClient.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/UserAgentClient.cs
index edde2a9..dcb3826 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/UserAgentClient.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/UserAgentClient.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using System.Web;
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The OAuth client for the user-agent flow, providing services for installed apps
@@ -103,7 +103,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </returns>
 		public Uri RequestUserAuthorization(IAuthorizationState authorization, bool implicitResponseType = false, string state = null) {
 			Requires.NotNull(authorization, "authorization");
-			Requires.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier));
+			RequiresEx.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier));
 
 			var request = this.PrepareRequestUserAuthorization(authorization, implicitResponseType, state);
 			return this.Channel.PrepareResponse(request).GetDirectUriRequest(this.Channel);
@@ -172,7 +172,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </returns>
 		internal EndUserAuthorizationRequest PrepareRequestUserAuthorization(IAuthorizationState authorization, bool implicitResponseType = false, string state = null) {
 			Requires.NotNull(authorization, "authorization");
-			Requires.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier));
+			RequiresEx.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier));
 
 			if (authorization.Callback == null) {
 				authorization.Callback = new Uri("http://localhost/");
diff --git a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
index 879e4e3..63d96e1 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/OAuth2/WebServerClient.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An OAuth 2.0 consumer designed for web applications.
@@ -89,9 +89,8 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <returns>The authorization request.</returns>
 		public OutgoingWebResponse PrepareRequestUserAuthorization(IAuthorizationState authorization) {
 			Requires.NotNull(authorization, "authorization");
-			Requires.ValidState(authorization.Callback != null || (HttpContext.Current != null && HttpContext.Current.Request != null), MessagingStrings.HttpContextRequired);
-			Requires.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier), Strings.RequiredPropertyNotYetPreset, "ClientIdentifier");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
+			RequiresEx.ValidState(authorization.Callback != null || (HttpContext.Current != null && HttpContext.Current.Request != null), MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier), Strings.RequiredPropertyNotYetPreset, "ClientIdentifier");
 
 			if (authorization.Callback == null) {
 				authorization.Callback = this.Channel.GetRequestFromContext().GetPublicFacingUrl()
@@ -136,8 +135,8 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <param name="request">The incoming HTTP request that may carry an authorization response.</param>
 		/// <returns>The authorization state that contains the details of the authorization.</returns>
 		public IAuthorizationState ProcessUserAuthorization(HttpRequestBase request = null) {
-			Requires.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier), Strings.RequiredPropertyNotYetPreset, "ClientIdentifier");
-			Requires.ValidState(this.ClientCredentialApplicator != null, Strings.RequiredPropertyNotYetPreset, "ClientCredentialApplicator");
+			RequiresEx.ValidState(!string.IsNullOrEmpty(this.ClientIdentifier), Strings.RequiredPropertyNotYetPreset, "ClientIdentifier");
+			RequiresEx.ValidState(this.ClientCredentialApplicator != null, Strings.RequiredPropertyNotYetPreset, "ClientCredentialApplicator");
 
 			if (request == null) {
 				request = this.Channel.GetRequestFromContext();
diff --git a/src/DotNetOpenAuth.OAuth2.Client/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2.Client/Properties/AssemblyInfo.cs
index 397b35d..29900ab 100644
--- a/src/DotNetOpenAuth.OAuth2.Client/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2.Client/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2.Client/packages.config b/src/DotNetOpenAuth.OAuth2.Client/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2.Client/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/DotNetOpenAuth.OAuth2.ClientAuthorization.csproj b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/DotNetOpenAuth.OAuth2.ClientAuthorization.csproj
index c3ed569..032fd28 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/DotNetOpenAuth.OAuth2.ClientAuthorization.csproj
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/DotNetOpenAuth.OAuth2.ClientAuthorization.csproj
@@ -71,6 +71,13 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="OAuth2\Messages\Access Token Request Messages.cd" />
+    <None Include="packages.config" />
+  </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/ChannelElements/OAuth2ChannelBase.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/ChannelElements/OAuth2ChannelBase.cs
index f2f674e..e6be1c4 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/ChannelElements/OAuth2ChannelBase.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/ChannelElements/OAuth2ChannelBase.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The base messaging channel used by OAuth 2.0 parties.
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/IClientDescription.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/IClientDescription.cs
index b4bc689..fe05f25 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/IClientDescription.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/IClientDescription.cs
@@ -7,13 +7,12 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A description of a client from an Authorization Server's point of view.
 	/// </summary>
-	[ContractClass(typeof(IClientDescriptionContract))]
 	public interface IClientDescription {
 		/// <summary>
 		/// Gets the callback to use when an individual authorization request
@@ -69,70 +68,4 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </remarks>
 		bool IsValidClientSecret(string secret);
 	}
-
-	/// <summary>
-	/// Contract class for the <see cref="IClientDescription"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IClientDescription))]
-	internal abstract class IClientDescriptionContract : IClientDescription {
-		#region IClientDescription Members
-
-		/// <summary>
-		/// Gets the type of the client.
-		/// </summary>
-		ClientType IClientDescription.ClientType {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the callback to use when an individual authorization request
-		/// does not include an explicit callback URI.
-		/// </summary>
-		/// <value>
-		/// An absolute URL; or <c>null</c> if none is registered.
-		/// </value>
-		Uri IClientDescription.DefaultCallback {
-			get {
-				Contract.Ensures(Contract.Result<Uri>() == null || Contract.Result<Uri>().IsAbsoluteUri);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether a non-empty secret is registered for this client.
-		/// </summary>
-		bool IClientDescription.HasNonEmptySecret {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Determines whether a callback URI included in a client's authorization request
-		/// is among those allowed callbacks for the registered client.
-		/// </summary>
-		/// <param name="callback">The requested callback URI.</param>
-		/// <returns>
-		///   <c>true</c> if the callback is allowed; otherwise, <c>false</c>.
-		/// </returns>
-		bool IClientDescription.IsCallbackAllowed(Uri callback) {
-			Requires.NotNull(callback, "callback");
-			Requires.True(callback.IsAbsoluteUri, "callback");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Checks whether the specified client secret is correct.
-		/// </summary>
-		/// <param name="secret">The secret obtained from the client.</param>
-		/// <returns><c>true</c> if the secret matches the one in the authorization server's record for the client; <c>false</c> otherwise.</returns>
-		/// <remarks>
-		/// All string equality checks, whether checking secrets or their hashes,
-		/// should be done using <see cref="MessagingUtilities.EqualsConstantTime"/> to mitigate timing attacks.
-		/// </remarks>
-		bool IClientDescription.IsValidClientSecret(string secret) {
-			Requires.NotNullOrEmpty(secret, "secret");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/AccessTokenAuthorizationCodeRequest.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/AccessTokenAuthorizationCodeRequest.cs
index b8c9ede..bf06627 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/AccessTokenAuthorizationCodeRequest.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/AccessTokenAuthorizationCodeRequest.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationFailedResponse.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationFailedResponse.cs
index 7cc8e82..cb1c5d4 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationFailedResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationFailedResponse.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Runtime.Remoting.Messaging;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The message that an Authorization Server responds to a Client with when the user denies a user authorization request.
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationRequest.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationRequest.cs
index f229cf9..9da2c03 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationRequest.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationRequest.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// A message sent by a web application Client to the AuthorizationServer
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAccessTokenResponse.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAccessTokenResponse.cs
index 7a79e46..a776459 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAccessTokenResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAccessTokenResponse.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// The message sent by the Authorization Server to the Client via the user agent
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponse.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponse.cs
index 9d6b015..9f7c4b1 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessAuthCodeResponse.cs
@@ -6,10 +6,10 @@
 
 namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
-	using System.Diagnostics.Contracts;
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// The message sent by the Authorization Server to the Client via the user agent
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessResponseBase.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessResponseBase.cs
index ef0010e..bf385f9 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessResponseBase.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/Messages/EndUserAuthorizationSuccessResponseBase.cs
@@ -8,11 +8,11 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// The message sent by the Authorization Server to the Client via the user agent
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/TokenEndpointProtocolException.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/TokenEndpointProtocolException.cs
index e86c27e..d18e788 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/TokenEndpointProtocolException.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/OAuth2/TokenEndpointProtocolException.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.OAuth2 {
 
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Describes an error generated by an Authorization Server's token endpoint.
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/Properties/AssemblyInfo.cs
index 3d9e231..f4a2303 100644
--- a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2.ClientAuthorization/packages.config b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2.ClientAuthorization/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/Configuration/OAuth2ResourceServerSection.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/Configuration/OAuth2ResourceServerSection.cs
index 3e37018..5f6cc3c 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/Configuration/OAuth2ResourceServerSection.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/Configuration/OAuth2ResourceServerSection.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents the &lt;oauth2/resourceServer&gt; section in the host's .config file.
@@ -28,7 +27,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		internal static OAuth2ResourceServerSection Configuration {
 			get {
-				Contract.Ensures(Contract.Result<OAuth2ResourceServerSection>() != null);
 				return (OAuth2ResourceServerSection)ConfigurationManager.GetSection(SectionName) ?? new OAuth2ResourceServerSection();
 			}
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/DotNetOpenAuth.OAuth2.ResourceServer.csproj b/src/DotNetOpenAuth.OAuth2.ResourceServer/DotNetOpenAuth.OAuth2.ResourceServer.csproj
index eb54fee..c36a789 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/DotNetOpenAuth.OAuth2.ResourceServer.csproj
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/DotNetOpenAuth.OAuth2.ResourceServer.csproj
@@ -50,6 +50,12 @@
       <LastGenOutput>ResourceServerStrings.Designer.cs</LastGenOutput>
     </EmbeddedResource>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ChannelElements/OAuth2ResourceServerChannel.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ChannelElements/OAuth2ResourceServerChannel.cs
index e9d596a..8cf7eeb 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ChannelElements/OAuth2ResourceServerChannel.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ChannelElements/OAuth2ResourceServerChannel.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 	using System.Net.Mime;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OAuth2.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The channel for the OAuth protocol.
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/IAccessTokenAnalyzer.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/IAccessTokenAnalyzer.cs
index 5c5a526..a86b26d 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/IAccessTokenAnalyzer.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/IAccessTokenAnalyzer.cs
@@ -8,16 +8,15 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An interface that resource server hosts should implement if they accept access tokens
 	/// issued by non-DotNetOpenAuth authorization servers.
 	/// </summary>
-	[ContractClass((typeof(IAccessTokenAnalyzerContract)))]
 	public interface IAccessTokenAnalyzer {
 		/// <summary>
 		/// Reads an access token to find out what data it authorizes access to.
@@ -28,30 +27,4 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <exception cref="ProtocolException">Thrown if the access token is expired, invalid, or from an untrusted authorization server.</exception>
 		AccessToken DeserializeAccessToken(IDirectedProtocolMessage message, string accessToken);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IAccessTokenAnalyzer"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IAccessTokenAnalyzer))]
-	internal abstract class IAccessTokenAnalyzerContract : IAccessTokenAnalyzer {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IAccessTokenAnalyzerContract"/> class from being created.
-		/// </summary>
-		private IAccessTokenAnalyzerContract() {
-		}
-
-		/// <summary>
-		/// Reads an access token to find out what data it authorizes access to.
-		/// </summary>
-		/// <param name="message">The message carrying the access token.</param>
-		/// <param name="accessToken">The access token's serialized representation.</param>
-		/// <returns>The deserialized, validated token.</returns>
-		/// <exception cref="ProtocolException">Thrown if the access token is expired, invalid, or from an untrusted authorization server.</exception>
-		AccessToken IAccessTokenAnalyzer.DeserializeAccessToken(IDirectedProtocolMessage message, string accessToken) {
-			Requires.NotNull(message, "message");
-			Requires.NotNullOrEmpty(accessToken, "accessToken");
-			Contract.Ensures(Contract.Result<AccessToken>() != null);
-			throw new NotImplementedException();
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ResourceServer.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ResourceServer.cs
index 896588f..540773f 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ResourceServer.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/ResourceServer.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 #if CLR4
@@ -23,6 +22,7 @@ namespace DotNetOpenAuth.OAuth2 {
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using Messages;
 	using Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Provides services for validating OAuth access tokens.
@@ -90,7 +90,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </exception>
 		public virtual AccessToken GetAccessToken(HttpRequestBase httpRequestInfo = null, params string[] requiredScopes) {
 			Requires.NotNull(requiredScopes, "requiredScopes");
-			Requires.ValidState(this.ScopeSatisfiedCheck != null, Strings.RequiredPropertyNotYetPreset);
+			RequiresEx.ValidState(this.ScopeSatisfiedCheck != null, Strings.RequiredPropertyNotYetPreset);
 			if (httpRequestInfo == null) {
 				httpRequestInfo = this.Channel.GetRequestFromContext();
 			}
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
index 62436ec..32f10ba 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/OAuth2/StandardAccessTokenAnalyzer.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// An access token reader that understands DotNetOpenAuth authorization server issued tokens.
@@ -24,7 +24,7 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <param name="resourceServerPrivateEncryptionKey">The crypto service provider with the resource server private encryption key.</param>
 		public StandardAccessTokenAnalyzer(RSACryptoServiceProvider authorizationServerPublicSigningKey, RSACryptoServiceProvider resourceServerPrivateEncryptionKey) {
 			Requires.NotNull(authorizationServerPublicSigningKey, "authorizationServerPublicSigningKey");
-			Requires.True(resourceServerPrivateEncryptionKey == null || !resourceServerPrivateEncryptionKey.PublicOnly, "resourceServerPrivateEncryptionKey");
+			Requires.That(resourceServerPrivateEncryptionKey == null || !resourceServerPrivateEncryptionKey.PublicOnly, "resourceServerPrivateEncryptionKey", "Private key required when encrypting.");
 			this.AuthorizationServerPublicSigningKey = authorizationServerPublicSigningKey;
 			this.ResourceServerPrivateEncryptionKey = resourceServerPrivateEncryptionKey;
 		}
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2.ResourceServer/Properties/AssemblyInfo.cs
index 397b35d..29900ab 100644
--- a/src/DotNetOpenAuth.OAuth2.ResourceServer/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2.ResourceServer/packages.config b/src/DotNetOpenAuth.OAuth2.ResourceServer/packages.config
new file mode 100644
index 0000000..67054af
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2.ResourceServer/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Microsoft.IdentityModel" version="6.1.7600.16394" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OAuth2/Configuration/OAuth2SectionGroup.cs b/src/DotNetOpenAuth.OAuth2/Configuration/OAuth2SectionGroup.cs
index 112e756..09eef2c 100644
--- a/src/DotNetOpenAuth.OAuth2/Configuration/OAuth2SectionGroup.cs
+++ b/src/DotNetOpenAuth.OAuth2/Configuration/OAuth2SectionGroup.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents the &lt;oauth&gt; element in the host's .config file.
diff --git a/src/DotNetOpenAuth.OAuth2/DotNetOpenAuth.OAuth2.csproj b/src/DotNetOpenAuth.OAuth2/DotNetOpenAuth.OAuth2.csproj
index 696d8a9..b1b1d7f 100644
--- a/src/DotNetOpenAuth.OAuth2/DotNetOpenAuth.OAuth2.csproj
+++ b/src/DotNetOpenAuth.OAuth2/DotNetOpenAuth.OAuth2.csproj
@@ -43,6 +43,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="OAuth2\OAuth 2 client facades.cd" />
+    <None Include="packages.config" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="OAuth2\OAuthStrings.resx">
@@ -56,6 +57,12 @@
       <Name>DotNetOpenAuth.Core</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/AccessToken.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/AccessToken.cs
index 5890d93..449b3ca 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/AccessToken.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/AccessToken.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// A short-lived token that accompanies HTTP requests to protected data to authorize the request.
@@ -51,9 +51,8 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// <param name="encryptingKey">The crypto service provider with the resource server's public key used to encrypt the access token.</param>
 		/// <returns>An access token serializer.</returns>
 		internal static IDataBagFormatter<AccessToken> CreateFormatter(RSACryptoServiceProvider signingKey, RSACryptoServiceProvider encryptingKey) {
-			Contract.Requires(signingKey != null || !signingKey.PublicOnly);
-			Contract.Requires(encryptingKey != null);
-			Contract.Ensures(Contract.Result<IDataBagFormatter<AccessToken>>() != null);
+			Requires.That(signingKey == null || !signingKey.PublicOnly, "signingKey", "requires private key");
+			Requires.NotNull(encryptingKey, "encryptingKey");
 
 			return new UriStyleMessageFormatter<AccessToken>(signingKey, encryptingKey);
 		}
@@ -94,7 +93,6 @@ namespace DotNetOpenAuth.OAuth2 {
 		/// </summary>
 		/// <returns>A non-empty string.</returns>
 		protected internal virtual string Serialize() {
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
 			throw new NotSupportedException();
 		}
 
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/ChannelElements/IAuthorizationDescription.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/ChannelElements/IAuthorizationDescription.cs
index 1ad0422..949fc94 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/ChannelElements/IAuthorizationDescription.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/ChannelElements/IAuthorizationDescription.cs
@@ -7,14 +7,12 @@
 namespace DotNetOpenAuth.OAuth2.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
 	/// <summary>
 	/// Describes a delegated authorization between a resource server, a client, and a user.
 	/// </summary>
-	[ContractClass(typeof(IAuthorizationDescriptionContract))]
 	public interface IAuthorizationDescription {
 		/// <summary>
 		/// Gets the identifier of the client authorized to access protected data.
@@ -37,56 +35,4 @@ namespace DotNetOpenAuth.OAuth2.ChannelElements {
 		/// </summary>
 		HashSet<string> Scope { get; }
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IAuthorizationDescription"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IAuthorizationDescription))]
-	internal abstract class IAuthorizationDescriptionContract : IAuthorizationDescription {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IAuthorizationDescriptionContract"/> class from being created.
-		/// </summary>
-		private IAuthorizationDescriptionContract() {
-		}
-
-		/// <summary>
-		/// Gets the identifier of the client authorized to access protected data.
-		/// </summary>
-		string IAuthorizationDescription.ClientIdentifier {
-			get {
-				Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the date this authorization was established or the token was issued.
-		/// </summary>
-		/// <value>A date/time expressed in UTC.</value>
-		DateTime IAuthorizationDescription.UtcIssued {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the name on the account whose data on the resource server is accessible using this authorization, if applicable.
-		/// </summary>
-		/// <value>A username, or <c>null</c> if the authorization is to access the client's own data (not a distinct resource owner's data).</value>
-		string IAuthorizationDescription.User {
-			get {
-				// Null and non-empty are allowed, but not empty.
-				Contract.Ensures(Contract.Result<string>() != string.Empty);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the scope of operations the client is allowed to invoke.
-		/// </summary>
-		HashSet<string> IAuthorizationDescription.Scope {
-			get {
-				Contract.Ensures(Contract.Result<HashSet<string>>() != null);
-				throw new NotImplementedException();
-			}
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/MessageBase.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/MessageBase.cs
index e966376..272b690 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/MessageBase.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/MessageBase.cs
@@ -8,8 +8,8 @@ namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A common message base class for OAuth messages.
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/UnauthorizedResponse.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/UnauthorizedResponse.cs
index e4a8a48..d90d1b5 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/UnauthorizedResponse.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/Messages/UnauthorizedResponse.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth2.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Net;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth2.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// A direct response sent in response to a rejected Bearer access token.
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/OAuthUtilities.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/OAuthUtilities.cs
index f28518f..f2acf79 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/OAuthUtilities.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/OAuthUtilities.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OAuth2 {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Some common utility methods for OAuth 2.0.
diff --git a/src/DotNetOpenAuth.OAuth2/OAuth2/StandardScopeSatisfiedCheck.cs b/src/DotNetOpenAuth.OAuth2/OAuth2/StandardScopeSatisfiedCheck.cs
index 684e4a8..5fe0226 100644
--- a/src/DotNetOpenAuth.OAuth2/OAuth2/StandardScopeSatisfiedCheck.cs
+++ b/src/DotNetOpenAuth.OAuth2/OAuth2/StandardScopeSatisfiedCheck.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.OAuth2 {
 	using System.Collections.Generic;
+	using Validation;
 
 	/// <summary>
 	/// The default scope superset checker, which assumes that no scopes overlap.
diff --git a/src/DotNetOpenAuth.OAuth2/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OAuth2/Properties/AssemblyInfo.cs
index d89d8c1..df59ca5 100644
--- a/src/DotNetOpenAuth.OAuth2/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OAuth2/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OAuth2/packages.config b/src/DotNetOpenAuth.OAuth2/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OAuth2/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId.Provider.UI/DotNetOpenAuth.OpenId.Provider.UI.csproj b/src/DotNetOpenAuth.OpenId.Provider.UI/DotNetOpenAuth.OpenId.Provider.UI.csproj
index aede485..4bac4bb 100644
--- a/src/DotNetOpenAuth.OpenId.Provider.UI/DotNetOpenAuth.OpenId.Provider.UI.csproj
+++ b/src/DotNetOpenAuth.OpenId.Provider.UI/DotNetOpenAuth.OpenId.Provider.UI.csproj
@@ -51,8 +51,14 @@
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System" />
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
   </ItemGroup>
-  <ItemGroup />
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/AnonymousRequestEventArgs.cs b/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/AnonymousRequestEventArgs.cs
index 8b59912..dbee07a 100644
--- a/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/AnonymousRequestEventArgs.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/AnonymousRequestEventArgs.cs
@@ -6,8 +6,8 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The event arguments that include details of the incoming request.
diff --git a/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/ProviderEndpoint.cs b/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/ProviderEndpoint.cs
index bff8097..a29f6e3 100644
--- a/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/ProviderEndpoint.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider.UI/OpenId/Provider/ProviderEndpoint.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 	using System.Web;
 	using System.Web.UI;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An OpenID Provider control that automatically responds to certain
@@ -69,7 +69,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <value>The default value is an <see cref="OpenIdProvider"/> instance initialized according to the web.config file.</value>
 		public static OpenIdProvider Provider {
 			get {
-				Contract.Ensures(Contract.Result<OpenIdProvider>() != null);
 				if (provider == null) {
 					lock (providerInitializerLock) {
 						if (provider == null) {
@@ -98,15 +97,14 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </remarks>
 		public static IAuthenticationRequest PendingAuthenticationRequest {
 			get {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
-				Contract.Ensures(Contract.Result<IAuthenticationRequest>() == null || PendingRequest != null);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				return HttpContext.Current.Session[PendingRequestKey] as IAuthenticationRequest;
 			}
 
 			set {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				HttpContext.Current.Session[PendingRequestKey] = value;
 			}
 		}
@@ -122,15 +120,14 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </remarks>
 		public static IAnonymousRequest PendingAnonymousRequest {
 			get {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
-				Contract.Ensures(Contract.Result<IAnonymousRequest>() == null || PendingRequest != null);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				return HttpContext.Current.Session[PendingRequestKey] as IAnonymousRequest;
 			}
 
 			set {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				HttpContext.Current.Session[PendingRequestKey] = value;
 			}
 		}
@@ -146,14 +143,14 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </remarks>
 		public static IHostProcessedRequest PendingRequest {
 			get {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				return HttpContext.Current.Session[PendingRequestKey] as IHostProcessedRequest;
 			}
 
 			set {
-				Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
-				Requires.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
+				RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+				RequiresEx.ValidState(HttpContext.Current.Session != null, MessagingStrings.SessionRequired);
 				HttpContext.Current.Session[PendingRequestKey] = value;
 			}
 		}
@@ -260,7 +257,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <returns>The new instance of OpenIdProvider.</returns>
 		private static OpenIdProvider CreateProvider() {
-			Contract.Ensures(Contract.Result<OpenIdProvider>() != null);
 			return new OpenIdProvider(OpenIdElement.Configuration.Provider.ApplicationStore.CreateInstance(OpenIdProvider.HttpApplicationStore));
 		}
 	}
diff --git a/src/DotNetOpenAuth.OpenId.Provider.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId.Provider.UI/Properties/AssemblyInfo.cs
index f05fec0..c7df904 100644
--- a/src/DotNetOpenAuth.OpenId.Provider.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId.Provider.UI/packages.config b/src/DotNetOpenAuth.OpenId.Provider.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId.Provider.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId.Provider/DotNetOpenAuth.OpenId.Provider.csproj b/src/DotNetOpenAuth.OpenId.Provider/DotNetOpenAuth.OpenId.Provider.csproj
index 524415f..d9fd749 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/DotNetOpenAuth.OpenId.Provider.csproj
+++ b/src/DotNetOpenAuth.OpenId.Provider/DotNetOpenAuth.OpenId.Provider.csproj
@@ -35,7 +35,6 @@
     <Compile Include="OpenId\Messages\IAssociateRequestProvider.cs" />
     <Compile Include="OpenId\Messages\AssociateRequestProviderTools.cs" />
     <Compile Include="OpenId\Messages\IAssociateSuccessfulResponseProvider.cs" />
-    <Compile Include="OpenId\Messages\IAssociateSuccessfulResponseProviderContract.cs" />
     <Compile Include="OpenId\Messages\AssociateUnencryptedResponseProvider.cs" />
     <Compile Include="OpenId\Messages\CheckAuthenticationResponseProvider.cs" />
     <Compile Include="OpenId\Provider\OpenIdProviderUtilities.cs" />
@@ -53,7 +52,6 @@
     <Compile Include="OpenId\Provider\IDirectedIdentityIdentifierProvider.cs" />
     <Compile Include="OpenId\Provider\IErrorReporting.cs" />
     <Compile Include="OpenId\Provider\Request.cs" />
-    <Compile Include="OpenId\Provider\RequestContract.cs" />
     <Compile Include="OpenId\Provider\StandardProviderApplicationStore.cs" />
     <Compile Include="OpenId\Provider\OpenIdProvider.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
@@ -67,17 +65,24 @@
       <Project>{3896A32A-E876-4C23-B9B8-78E17D134CD3}</Project>
       <Name>DotNetOpenAuth.OpenId</Name>
     </ProjectReference>
-    <ProjectReference Include="..\Org.Mentalis.Security.Cryptography\Org.Mentalis.Security.Cryptography.csproj" >
+    <ProjectReference Include="..\Org.Mentalis.Security.Cryptography\Org.Mentalis.Security.Cryptography.csproj">
       <Project>{26DC877F-5987-48DD-9DDB-E62F2DE0E150}</Project>
       <Name>Org.Mentalis.Security.Cryptography</Name>
     </ProjectReference>
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System" />
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <Folder Include="Configuration\" />
   </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/OpenIdProviderChannel.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/OpenIdProviderChannel.cs
index c18bcac..45a69a5 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/OpenIdProviderChannel.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/OpenIdProviderChannel.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// The messaging channel for OpenID Providers.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/ProviderSigningBindingElement.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/ProviderSigningBindingElement.cs
index 93d86d2..fbbf37a 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/ProviderSigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/ChannelElements/ProviderSigningBindingElement.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using System.Web;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// The signing binding element for OpenID Providers.
@@ -217,7 +217,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// the inclusion and order of message parts that will be signed.
 		/// </returns>
 		private string GetSignedParameterOrder(ITamperResistantOpenIdMessage signedMessage) {
-			Requires.ValidState(this.Channel != null);
+			RequiresEx.ValidState(this.Channel != null);
 			Requires.NotNull(signedMessage, "signedMessage");
 
 			Protocol protocol = Protocol.Lookup(signedMessage.Version);
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateDiffieHellmanProviderResponse.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateDiffieHellmanProviderResponse.cs
index c7e0ad9..ebcb534 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateDiffieHellmanProviderResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateDiffieHellmanProviderResponse.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateRequestProviderTools.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateRequestProviderTools.cs
index 0fb5e98..a03c93f 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateRequestProviderTools.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/AssociateRequestProviderTools.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// OpenID Provider tools for receiving association requests.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/CheckAuthenticationResponseProvider.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/CheckAuthenticationResponseProvider.cs
index c187d5e..f69de5e 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/CheckAuthenticationResponseProvider.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/CheckAuthenticationResponseProvider.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// The check_auth response message, as it is seen by the OpenID Provider.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProvider.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProvider.cs
index 070f235..df02a2c 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProvider.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProvider.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -16,7 +15,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	/// <summary>
 	/// An outgoing successful association response from the OpenID Provider.
 	/// </summary>
-	[ContractClass(typeof(IAssociateSuccessfulResponseProviderContract))]
 	internal interface IAssociateSuccessfulResponseProvider : IProtocolMessage {
 		/// <summary>
 		/// Gets or sets the expires in.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProviderContract.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProviderContract.cs
deleted file mode 100644
index 6788a84..0000000
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Messages/IAssociateSuccessfulResponseProviderContract.cs
+++ /dev/null
@@ -1,96 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IAssociateSuccessfulResponseProviderContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId.Messages {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-	using DotNetOpenAuth.OpenId.Provider;
-
-	/// <summary>
-	/// Code contract for the <see cref="IAssociateSuccessfulResponseProvider"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IAssociateSuccessfulResponseProvider))]
-	internal abstract class IAssociateSuccessfulResponseProviderContract : IAssociateSuccessfulResponseProvider {
-		/// <summary>
-		/// Gets or sets the expires in.
-		/// </summary>
-		/// <value>
-		/// The expires in.
-		/// </value>
-		long IAssociateSuccessfulResponseProvider.ExpiresIn {
-			get { throw new NotImplementedException();  }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets or sets the association handle.
-		/// </summary>
-		/// <value>
-		/// The association handle.
-		/// </value>
-		string IAssociateSuccessfulResponseProvider.AssociationHandle {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the level of protection this message requires.
-		/// </summary>
-		Messaging.MessageProtections Messaging.IProtocolMessage.RequiredProtection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether this is a direct or indirect message.
-		/// </summary>
-		Messaging.MessageTransport Messaging.IProtocolMessage.Transport {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		Version Messaging.IMessage.Version {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		IDictionary<string, string> Messaging.IMessage.ExtraData {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Called to create the Association based on a request previously given by the Relying Party.
-		/// </summary>
-		/// <param name="request">The prior request for an association.</param>
-		/// <param name="associationStore">The Provider's association store.</param>
-		/// <param name="securitySettings">The security settings of the Provider.</param>
-		/// <returns>
-		/// The created association.
-		/// </returns>
-		Association IAssociateSuccessfulResponseProvider.CreateAssociationAtProvider(AssociateRequest request, IProviderAssociationStore associationStore, ProviderSecuritySettings securitySettings) {
-			Requires.NotNull(request, "request");
-			Requires.NotNull(associationStore, "associationStore");
-			Requires.NotNull(securitySettings, "securitySettings");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void Messaging.IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AnonymousRequest.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AnonymousRequest.cs
index f156b9a..9d73d9a 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AnonymousRequest.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AnonymousRequest.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Provides access to a host Provider to read an incoming extension-only checkid request message,
@@ -31,7 +31,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		internal AnonymousRequest(OpenIdProvider provider, SignedResponseRequest request)
 			: base(provider, request) {
 			Requires.NotNull(provider, "provider");
-			Requires.True(!(request is CheckIdRequest), "request");
+			Requires.That(!(request is CheckIdRequest), "request", "request cannot be CheckIdRequest");
 
 			this.positiveResponse = new IndirectSignedResponse(request);
 		}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AssociationDataBag.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AssociationDataBag.cs
index f619b76..350ed5f 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AssociationDataBag.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AssociationDataBag.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// A signed and encrypted serialization of an association.
@@ -58,6 +58,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="stream">The stream.</param>
 		public void Serialize(Stream stream) {
+			Requires.NotNull(stream, "stream");
+			Requires.That(stream.CanWrite, "stream", "requires stream.CanWrite");
+
 			var writer = new BinaryWriter(stream);
 			writer.Write(this.IsPrivateAssociation);
 			writer.WriteBuffer(this.Secret);
@@ -70,6 +73,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="stream">The stream.</param>
 		public void Deserialize(Stream stream) {
+			Requires.NotNull(stream, "stream");
+			Requires.That(stream.CanRead, "stream", "requires stream.CanRead");
+
 			var reader = new BinaryReader(stream);
 			this.IsPrivateAssociation = reader.ReadBoolean();
 			this.Secret = reader.ReadBuffer(256);
@@ -88,7 +94,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		internal static IDataBagFormatter<AssociationDataBag> CreateFormatter(ICryptoKeyStore cryptoKeyStore, string bucket, TimeSpan? minimumAge = null) {
 			Requires.NotNull(cryptoKeyStore, "cryptoKeyStore");
 			Requires.NotNullOrEmpty(bucket, "bucket");
-			Contract.Ensures(Contract.Result<IDataBagFormatter<AssociationDataBag>>() != null);
 			return new BinaryDataBagFormatter<AssociationDataBag>(cryptoKeyStore, bucket, signed: true, encrypted: true, minimumAge: minimumAge);
 		}
 	}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AuthenticationRequest.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AuthenticationRequest.cs
index e88af8a..0167580 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AuthenticationRequest.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AuthenticationRequest.cs
@@ -6,9 +6,9 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Implements the <see cref="IAuthenticationRequest"/> interface
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AutoResponsiveRequest.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AutoResponsiveRequest.cs
index 661d719..91bb6f3 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AutoResponsiveRequest.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/AutoResponsiveRequest.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Handles messages coming into an OpenID Provider for which the entire
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/GsaIcamProfile.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/GsaIcamProfile.cs
index feb56eb..e12ca39 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/GsaIcamProfile.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/GsaIcamProfile.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Provider.Behaviors {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
@@ -17,6 +16,7 @@ namespace DotNetOpenAuth.OpenId.Provider.Behaviors {
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.Provider;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Implements the Identity, Credential, &amp; Access Management (ICAM) OpenID 2.0 Profile
@@ -182,8 +182,8 @@ namespace DotNetOpenAuth.OpenId.Provider.Behaviors {
 		/// <param name="maximumLifetime">The maximum lifetime.</param>
 		/// <param name="securitySettings">The security settings to adjust.</param>
 		private static void SetMaximumAssociationLifetimeToNotExceed(string associationType, TimeSpan maximumLifetime, ProviderSecuritySettings securitySettings) {
-			Contract.Requires(!string.IsNullOrEmpty(associationType));
-			Contract.Requires(maximumLifetime.TotalSeconds > 0);
+			Requires.NotNullOrEmpty(associationType, "associationType");
+			Requires.That(maximumLifetime.TotalSeconds > 0, "maximumLifetime", "requires positive timespan");
 			if (!securitySettings.AssociationLifetimes.ContainsKey(associationType) ||
 				securitySettings.AssociationLifetimes[associationType] > maximumLifetime) {
 				securitySettings.AssociationLifetimes[associationType] = maximumLifetime;
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/PpidGeneration.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/PpidGeneration.cs
index 9b914d0..c8bdd93 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/PpidGeneration.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Behaviors/PpidGeneration.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Provider.Behaviors {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Behaviors;
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/ExtensionsInteropHelper.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/ExtensionsInteropHelper.cs
index 946d354..d4332d2 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/ExtensionsInteropHelper.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/ExtensionsInteropHelper.cs
@@ -8,13 +8,13 @@ namespace DotNetOpenAuth.OpenId.Provider.Extensions {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Extensions.AttributeExchange;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A set of methods designed to assist in improving interop across different
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/UI/UIRequestTools.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/UI/UIRequestTools.cs
index c5ede8c..278ad6c 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/UI/UIRequestTools.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Extensions/UI/UIRequestTools.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Provider.Extensions.UI {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OpenId.Provider.Extensions.UI {
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.Provider;
 	using DotNetOpenAuth.Xrds;
+	using Validation;
 
 	/// <summary>
 	/// OpenID User Interface extension 1.0 request message.
@@ -52,8 +52,8 @@ namespace DotNetOpenAuth.OpenId.Provider.Extensions.UI {
 		/// </example>
 		/// </remarks>
 		public static IEnumerable<Uri> GetRelyingPartyIconUrls(Realm realm, IDirectWebRequestHandler webRequestHandler) {
-			Contract.Requires(realm != null);
-			Contract.Requires(webRequestHandler != null);
+			Requires.NotNull(realm, "realm");
+			Requires.NotNull(webRequestHandler, "webRequestHandler");
 			ErrorUtilities.VerifyArgumentNotNull(realm, "realm");
 			ErrorUtilities.VerifyArgumentNotNull(webRequestHandler, "webRequestHandler");
 
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HmacShaAssociationProvider.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HmacShaAssociationProvider.cs
index bdf3e9b..8c4011b 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HmacShaAssociationProvider.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HmacShaAssociationProvider.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// OpenID Provider utility methods for HMAC-SHA* associations.
@@ -43,7 +43,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 			Requires.NotNullOrEmpty(associationType, "associationType");
 			Requires.NotNull(associationStore, "associationStore");
 			Requires.NotNull(securitySettings, "securitySettings");
-			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 
 			int secretLength = HmacShaAssociation.GetSecretLength(protocol, associationType);
 
@@ -61,9 +60,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 
 			string handle = associationStore.Serialize(secret, DateTime.UtcNow + lifetime, associationUse == AssociationRelyingPartyType.Dumb);
 
-			Contract.Assert(protocol != null); // All the way up to the method call, the condition holds, yet we get a Requires failure next
-			Contract.Assert(secret != null);
-			Contract.Assert(!string.IsNullOrEmpty(associationType));
+			Assumes.True(protocol != null); // All the way up to the method call, the condition holds, yet we get a Requires failure next
+			Assumes.True(secret != null);
+			Assumes.True(!string.IsNullOrEmpty(associationType));
 			var result = HmacShaAssociation.Create(protocol, associationType, handle, secret, lifetime);
 			return result;
 		}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HostProcessedRequest.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HostProcessedRequest.cs
index 67ecdb2..9c5004c 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HostProcessedRequest.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/HostProcessedRequest.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A base class from which identity and non-identity RP requests can derive.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IDirectedIdentityIdentifierProvider.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IDirectedIdentityIdentifierProvider.cs
index 86c7e7c..550033b 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IDirectedIdentityIdentifierProvider.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IDirectedIdentityIdentifierProvider.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// An interface to provide custom identifiers for users logging into specific relying parties.
@@ -16,7 +17,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	/// allowing the users to log into RPs without leaving any clue as to their true identity,
 	/// and preventing multiple RPs from colluding to track user activity across realms.
 	/// </remarks>
-	[ContractClass(typeof(IDirectedIdentityIdentifierProviderContract))]
 	public interface IDirectedIdentityIdentifierProvider {
 		/// <summary>
 		/// Gets the Identifier to use for the Claimed Identifier and Local Identifier of
@@ -40,44 +40,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		[Pure]
 		bool IsUserLocalIdentifier(Identifier identifier);
 	}
-
-	/// <summary>
-	/// Contract class for the <see cref="IDirectedIdentityIdentifierProvider"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IDirectedIdentityIdentifierProvider))]
-	internal abstract class IDirectedIdentityIdentifierProviderContract : IDirectedIdentityIdentifierProvider {
-		#region IDirectedIdentityIdentifierProvider Members
-
-		/// <summary>
-		/// Gets the Identifier to use for the Claimed Identifier and Local Identifier of
-		/// an outgoing positive assertion.
-		/// </summary>
-		/// <param name="localIdentifier">The OP local identifier for the authenticating user.</param>
-		/// <param name="relyingPartyRealm">The realm of the relying party receiving the assertion.</param>
-		/// <returns>
-		/// A valid, discoverable OpenID Identifier that should be used as the value for the
-		/// openid.claimed_id and openid.local_id parameters.  Must not be null.
-		/// </returns>
-		Uri IDirectedIdentityIdentifierProvider.GetIdentifier(Identifier localIdentifier, Realm relyingPartyRealm) {
-			Requires.NotNull(localIdentifier, "localIdentifier");
-			Requires.NotNull(relyingPartyRealm, "relyingPartyRealm");
-			Requires.True(((IDirectedIdentityIdentifierProvider)this).IsUserLocalIdentifier(localIdentifier), "localIdentifier", OpenIdStrings.ArgumentIsPpidIdentifier);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Determines whether a given identifier is the primary (non-PPID) local identifier for some user.
-		/// </summary>
-		/// <param name="identifier">The identifier in question.</param>
-		/// <returns>
-		/// 	<c>true</c> if the given identifier is the valid, unique identifier for some uesr (and NOT a PPID); otherwise, <c>false</c>.
-		/// </returns>
-		bool IDirectedIdentityIdentifierProvider.IsUserLocalIdentifier(Identifier identifier) {
-			Requires.NotNull(identifier, "identifier");
-
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IProviderAssociationStore.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IProviderAssociationStore.cs
index 930abcd..e0f84b9 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IProviderAssociationStore.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/IProviderAssociationStore.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Provides association serialization and deserialization.
@@ -24,7 +24,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	/// to avoid disclosing the secret to anyone who sees the association handle, which itself isn't considered to
 	/// be confidential.
 	/// </remarks>
-	[ContractClass(typeof(IProviderAssociationStoreContract))]
 	internal interface IProviderAssociationStore {
 		/// <summary>
 		/// Stores an association and returns a handle for it.
@@ -49,42 +48,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <exception cref="ProtocolException">Thrown if the association is not of the expected type.</exception>
 		Association Deserialize(IProtocolMessage containingMessage, bool privateAssociation, string handle);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IProviderAssociationStore"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IProviderAssociationStore))]
-	internal abstract class IProviderAssociationStoreContract : IProviderAssociationStore {
-		/// <summary>
-		/// Stores an association and returns a handle for it.
-		/// </summary>
-		/// <param name="secret">The association secret.</param>
-		/// <param name="expiresUtc">The expires UTC.</param>
-		/// <param name="privateAssociation">A value indicating whether this is a private association.</param>
-		/// <returns>
-		/// The association handle that represents this association.
-		/// </returns>
-		string IProviderAssociationStore.Serialize(byte[] secret, DateTime expiresUtc, bool privateAssociation) {
-			Requires.NotNull(secret, "secret");
-			Requires.True(expiresUtc.Kind == DateTimeKind.Utc, "expiresUtc");
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Retrieves an association given an association handle.
-		/// </summary>
-		/// <param name="containingMessage">The OpenID message that referenced this association handle.</param>
-		/// <param name="privateAssociation">A value indicating whether a private association is expected.</param>
-		/// <param name="handle">The association handle.</param>
-		/// <returns>
-		/// An association instance, or <c>null</c> if the association has expired or the signature is incorrect (which may be because the OP's symmetric key has changed).
-		/// </returns>
-		/// <exception cref="ProtocolException">Thrown if the association is not of the expected type.</exception>
-		Association IProviderAssociationStore.Deserialize(IProtocolMessage containingMessage, bool privateAssociation, string handle) {
-			Requires.NotNull(containingMessage, "containingMessage");
-			Requires.NotNullOrEmpty(handle, "handle");
-			throw new NotImplementedException();
-		}
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProvider.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProvider.cs
index 05a33bc..d96e5c9 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProvider.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProvider.cs
@@ -11,7 +11,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using System.Collections.Specialized;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Threading;
 	using System.Web;
@@ -20,13 +19,13 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 	using RP = DotNetOpenAuth.OpenId.RelyingParty;
 
 	/// <summary>
 	/// Offers services for a web page that is acting as an OpenID identity server.
 	/// </summary>
 	[SuppressMessage("Microsoft.Maintainability", "CA1506:AvoidExcessiveClassCoupling", Justification = "By design")]
-	[ContractVerification(true)]
 	public sealed class OpenIdProvider : IDisposable, IOpenIdHost {
 		/// <summary>
 		/// The name of the key to use in the HttpApplication cache to store the
@@ -55,8 +54,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		public OpenIdProvider()
 			: this(OpenIdElement.Configuration.Provider.ApplicationStore.CreateInstance(HttpApplicationStore)) {
-			Contract.Ensures(this.SecuritySettings != null);
-			Contract.Ensures(this.Channel != null);
 		}
 
 		/// <summary>
@@ -66,8 +63,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		public OpenIdProvider(IOpenIdApplicationStore applicationStore)
 			: this((INonceStore)applicationStore, (ICryptoKeyStore)applicationStore) {
 			Requires.NotNull(applicationStore, "applicationStore");
-			Contract.Ensures(this.SecuritySettings != null);
-			Contract.Ensures(this.Channel != null);
 		}
 
 		/// <summary>
@@ -78,8 +73,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		private OpenIdProvider(INonceStore nonceStore, ICryptoKeyStore cryptoKeyStore) {
 			Requires.NotNull(nonceStore, "nonceStore");
 			Requires.NotNull(cryptoKeyStore, "cryptoKeyStore");
-			Contract.Ensures(this.SecuritySettings != null);
-			Contract.Ensures(this.Channel != null);
 
 			this.SecuritySettings = OpenIdElement.Configuration.Provider.SecuritySettings.CreateSecuritySettings();
 			this.behaviors.CollectionChanged += this.OnBehaviorsChanged;
@@ -102,8 +95,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		[EditorBrowsable(EditorBrowsableState.Advanced)]
 		public static IOpenIdApplicationStore HttpApplicationStore {
 			get {
-				Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
-				Contract.Ensures(Contract.Result<IOpenIdApplicationStore>() != null);
+				RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 				HttpContext context = HttpContext.Current;
 				var store = (IOpenIdApplicationStore)context.Application[ApplicationStoreKey];
 				if (store == null) {
@@ -131,8 +123,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		public ProviderSecuritySettings SecuritySettings {
 			get {
-				Contract.Ensures(Contract.Result<ProviderSecuritySettings>() != null);
-				Contract.Assume(this.securitySettings != null);
+				Assumes.True(this.securitySettings != null);
 				return this.securitySettings;
 			}
 
@@ -325,9 +316,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code Contract requires that we cast early.")]
 		[EditorBrowsable(EditorBrowsableState.Never)]
 		public void SendResponse(IRequest request) {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
 			Requires.NotNull(request, "request");
-			Requires.True(request.IsResponseReady, "request");
+			Requires.That(request.IsResponseReady, "request", OpenIdStrings.ResponseNotReady);
 
 			this.ApplyBehaviorsToResponse(request);
 			Request requestInternal = (Request)request;
@@ -346,9 +337,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="IRequest.IsResponseReady"/> is <c>false</c>.</exception>
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code Contract requires that we cast early.")]
 		public void Respond(IRequest request) {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.CurrentHttpContextRequired);
 			Requires.NotNull(request, "request");
-			Requires.True(request.IsResponseReady, "request");
+			Requires.That(request.IsResponseReady, "request", OpenIdStrings.ResponseNotReady);
 
 			this.ApplyBehaviorsToResponse(request);
 			Request requestInternal = (Request)request;
@@ -364,7 +355,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code Contract requires that we cast early.")]
 		public OutgoingWebResponse PrepareResponse(IRequest request) {
 			Requires.NotNull(request, "request");
-			Requires.True(request.IsResponseReady, "request");
+			Requires.That(request.IsResponseReady, "request", OpenIdStrings.ResponseNotReady);
 
 			this.ApplyBehaviorsToResponse(request);
 			Request requestInternal = (Request)request;
@@ -387,9 +378,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// be the same as <paramref name="claimedIdentifier"/>.</param>
 		/// <param name="extensions">The extensions.</param>
 		public void SendUnsolicitedAssertion(Uri providerEndpoint, Realm relyingPartyRealm, Identifier claimedIdentifier, Identifier localIdentifier, params IExtensionMessage[] extensions) {
-			Requires.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null, MessagingStrings.HttpContextRequired);
 			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Requires.True(providerEndpoint.IsAbsoluteUri, "providerEndpoint");
+			Requires.That(providerEndpoint.IsAbsoluteUri, "providerEndpoint", OpenIdStrings.AbsoluteUriRequired);
 			Requires.NotNull(relyingPartyRealm, "relyingPartyRealm");
 			Requires.NotNull(claimedIdentifier, "claimedIdentifier");
 			Requires.NotNull(localIdentifier, "localIdentifier");
@@ -418,11 +409,11 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </returns>
 		public OutgoingWebResponse PrepareUnsolicitedAssertion(Uri providerEndpoint, Realm relyingPartyRealm, Identifier claimedIdentifier, Identifier localIdentifier, params IExtensionMessage[] extensions) {
 			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Requires.True(providerEndpoint.IsAbsoluteUri, "providerEndpoint");
+			Requires.That(providerEndpoint.IsAbsoluteUri, "providerEndpoint", OpenIdStrings.AbsoluteUriRequired);
 			Requires.NotNull(relyingPartyRealm, "relyingPartyRealm");
 			Requires.NotNull(claimedIdentifier, "claimedIdentifier");
 			Requires.NotNull(localIdentifier, "localIdentifier");
-			Requires.ValidState(this.Channel.WebRequestHandler != null);
+			RequiresEx.ValidState(this.Channel.WebRequestHandler != null);
 
 			// Although the RP should do their due diligence to make sure that this OP
 			// is authorized to send an assertion for the given claimed identifier,
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProviderUtilities.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProviderUtilities.cs
index ae7dede..9e46168 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProviderUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/OpenIdProviderUtilities.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for OpenID Providers.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
index aaffa4c..2650e44 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Provides standard PPID Identifiers to users to protect their identity from individual relying parties
@@ -102,7 +102,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 			}
 
 			set {
-				Requires.InRange(value > 0, "value");
+				Requires.Range(value > 0, "value");
 				this.newSaltLength = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationHandleEncoder.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationHandleEncoder.cs
index 897b4f8..240e450 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationHandleEncoder.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationHandleEncoder.cs
@@ -6,11 +6,11 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// Provides association storage in the association handle itself, but embedding signed and encrypted association
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationKeyStorage.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationKeyStorage.cs
index 0786828..8eaae09 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationKeyStorage.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/ProviderAssociationKeyStorage.cs
@@ -6,9 +6,9 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// An association storage mechanism that stores the association secrets in a private store,
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Request.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Request.cs
index 21c1b51..ceabab3 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Request.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/Request.cs
@@ -7,19 +7,17 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Implements the <see cref="IRequest"/> interface for all incoming
 	/// request messages to an OpenID Provider.
 	/// </summary>
 	[Serializable]
-	[ContractClass(typeof(RequestContract))]
-	[ContractVerification(true)]
 	internal abstract class Request : IRequest {
 		/// <summary>
 		/// The incoming request message.
@@ -99,8 +97,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="IsResponseReady"/> is <c>false</c>.</exception>
 		internal IProtocolMessage Response {
 			get {
-				Requires.ValidState(this.IsResponseReady, OpenIdStrings.ResponseNotReady);
-				Contract.Ensures(Contract.Result<IProtocolMessage>() != null);
+				RequiresEx.ValidState(this.IsResponseReady, OpenIdStrings.ResponseNotReady);
 
 				if (this.responseExtensions.Count > 0) {
 					var extensibleResponse = this.ResponseMessage as IProtocolMessageWithExtensions;
diff --git a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/RequestContract.cs b/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/RequestContract.cs
deleted file mode 100644
index aa692d3..0000000
--- a/src/DotNetOpenAuth.OpenId.Provider/OpenId/Provider/RequestContract.cs
+++ /dev/null
@@ -1,48 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="RequestContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId.Provider {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-
-	/// <summary>
-	/// Code contract for the <see cref="Request"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(Request))]
-	internal abstract class RequestContract : Request {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="RequestContract"/> class from being created.
-		/// </summary>
-		private RequestContract() : base((Version)null, null) {
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the response is ready to be sent to the user agent.
-		/// </summary>
-		/// <remarks>
-		/// This property returns false if there are properties that must be set on this
-		/// request instance before the response can be sent.
-		/// </remarks>
-		public override bool IsResponseReady {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the response message, once <see cref="IsResponseReady"/> is <c>true</c>.
-		/// </summary>
-		protected override IProtocolMessage ResponseMessage {
-			get {
-				Requires.ValidState(this.IsResponseReady);
-				Contract.Ensures(Contract.Result<IProtocolMessage>() != null);
-				throw new NotImplementedException();
-			}
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId.Provider/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId.Provider/Properties/AssemblyInfo.cs
index 397b35d..29900ab 100644
--- a/src/DotNetOpenAuth.OpenId.Provider/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId.Provider/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId.Provider/packages.config b/src/DotNetOpenAuth.OpenId.Provider/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId.Provider/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/DotNetOpenAuth.OpenId.RelyingParty.UI.csproj b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/DotNetOpenAuth.OpenId.RelyingParty.UI.csproj
index 4d376bf..3d2661f 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/DotNetOpenAuth.OpenId.RelyingParty.UI.csproj
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/DotNetOpenAuth.OpenId.RelyingParty.UI.csproj
@@ -28,14 +28,13 @@
     <Compile Include="OpenId\RelyingParty\OpenIdButton.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdEventArgs.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdLogin.cs" />
-    <Compile Include="OpenId\RelyingParty\OpenIdMobileTextBox.cs" Condition=" '$(ClrVersion)' != '4' "/>
+    <Compile Include="OpenId\RelyingParty\OpenIdMobileTextBox.cs" Condition=" '$(ClrVersion)' != '4' " />
     <Compile Include="OpenId\RelyingParty\OpenIdRelyingPartyAjaxControlBase.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdRelyingPartyControlBase.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdSelector.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdTextBox.cs" />
     <Compile Include="OpenId\RelyingParty\PopupBehavior.cs" />
     <Compile Include="OpenId\RelyingParty\SelectorButton.cs" />
-    <Compile Include="OpenId\RelyingParty\SelectorButtonContract.cs" />
     <Compile Include="OpenId\RelyingParty\SelectorOpenIdButton.cs" />
     <Compile Include="OpenId\RelyingParty\SelectorProviderButton.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
@@ -64,6 +63,10 @@
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System" />
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="OpenId\RelyingParty\login_failure.png" />
@@ -80,6 +83,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="OpenId\RelyingParty\Controls.cd" />
+    <None Include="packages.config" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/Mvc/OpenIdHelper.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/Mvc/OpenIdHelper.cs
index 0573e0a..c78c6a7 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/Mvc/OpenIdHelper.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/Mvc/OpenIdHelper.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Mvc {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -21,6 +20,7 @@ namespace DotNetOpenAuth.Mvc {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Methods that generate HTML or Javascript for hosting AJAX OpenID "controls" on
@@ -35,7 +35,6 @@ namespace DotNetOpenAuth.Mvc {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "False positive.")]
 		public static string OpenIdSelectorStyles(this HtmlHelper html) {
 			Requires.NotNull(html, "html");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			using (var result = new StringWriter(CultureInfo.CurrentCulture)) {
 				result.WriteStylesheetLink(OpenId.RelyingParty.OpenIdSelector.EmbeddedStylesheetResourceName);
@@ -65,7 +64,6 @@ namespace DotNetOpenAuth.Mvc {
 		[SuppressMessage("Microsoft.Reliability", "CA2000:Dispose objects before losing scope", Justification = "False positive")]
 		public static string OpenIdSelectorScripts(this HtmlHelper html, OpenIdSelector selectorOptions, OpenIdAjaxOptions additionalOptions) {
 			Requires.NotNull(html, "html");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			bool selectorOptionsOwned = false;
 			if (selectorOptions == null) {
@@ -211,7 +209,6 @@ window.openid_trace = {1}; // causes lots of messages";
 			Requires.NotNull(html, "html");
 			Requires.NotNull(providerIdentifier, "providerIdentifier");
 			Requires.NotNullOrEmpty(imageUrl, "imageUrl");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			return OpenIdSelectorButton(html, providerIdentifier, "OPButton", imageUrl);
 		}
@@ -228,7 +225,6 @@ window.openid_trace = {1}; // causes lots of messages";
 		public static string OpenIdSelectorOpenIdButton(this HtmlHelper html, string imageUrl) {
 			Requires.NotNull(html, "html");
 			Requires.NotNullOrEmpty(imageUrl, "imageUrl");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			return OpenIdSelectorButton(html, "OpenIDButton", "OpenIDButton", imageUrl);
 		}
@@ -246,7 +242,6 @@ window.openid_trace = {1}; // causes lots of messages";
 		public static string OpenIdSelector(this HtmlHelper html, params SelectorButton[] buttons) {
 			Requires.NotNull(html, "html");
 			Requires.NotNull(buttons, "buttons");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			using (var writer = new StringWriter(CultureInfo.CurrentCulture)) {
 				using (var h = new HtmlTextWriter(writer)) {
@@ -313,7 +308,6 @@ window.openid_trace = {1}; // causes lots of messages";
 			Requires.NotNull(html, "html");
 			Requires.NotNull(id, "id");
 			Requires.NotNullOrEmpty(imageUrl, "imageUrl");
-			Contract.Ensures(Contract.Result<string>() != null);
 
 			using (var writer = new StringWriter(CultureInfo.CurrentCulture)) {
 				using (var h = new HtmlTextWriter(writer)) {
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxRelyingParty.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxRelyingParty.cs
index ef6894b..918efdf 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxRelyingParty.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net;
@@ -21,6 +20,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Extensions.UI;
+	using Validation;
 
 	/// <summary>
 	/// Provides the programmatic facilities to act as an AJAX-enabled OpenID relying party.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxTextBox.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
index d00f920..b5b6162 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
@@ -19,13 +19,13 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.ComponentModel;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Globalization;
 	using System.Text;
 	using System.Web.UI;
 	using System.Web.UI.HtmlControls;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An ASP.NET control that provides a minimal text box that is OpenID-aware and uses AJAX for
@@ -382,7 +382,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				Requires.InRange(value >= 0, "value");
+				Requires.Range(value >= 0, "value");
 				this.ViewState[ColumnsViewStateKey] = value;
 			}
 		}
@@ -446,7 +446,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				Requires.InRange(value.TotalMilliseconds > 0, "value");
+				Requires.Range(value.TotalMilliseconds > 0, "value");
 				this.ViewState[TimeoutViewStateKey] = value;
 			}
 		}
@@ -462,7 +462,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				Requires.InRange(value > 0, "value");
+				Requires.Range(value > 0, "value");
 				this.ViewState[ThrottleViewStateKey] = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdEventArgs.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdEventArgs.cs
index 8b91b14..66d6df6 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdEventArgs.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdEventArgs.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The event details passed to event handlers.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdLogin.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdLogin.cs
index ffb619a..16f9462 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdLogin.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdLogin.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Web.UI;
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdMobileTextBox.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdMobileTextBox.cs
index b3d208a..0c159a1 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdMobileTextBox.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdMobileTextBox.cs
@@ -11,7 +11,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.ComponentModel;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text.RegularExpressions;
 	using System.Web.Security;
@@ -20,6 +19,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
+	using Validation;
 
 	/// <summary>
 	/// An ASP.NET control for mobile devices that provides a minimal text box that is OpenID-aware.
@@ -583,8 +583,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Uri(Uri, string) accepts second arguments that Uri(Uri, new Uri(string)) does not that we must support.")]
 		public IAuthenticationRequest CreateRequest() {
-			Requires.ValidState(this.Request == null, OpenIdStrings.CreateRequestAlreadyCalled);
-			Requires.ValidState(!string.IsNullOrEmpty(this.Text), OpenIdStrings.OpenIdTextBoxEmpty);
+			RequiresEx.ValidState(this.Request == null, OpenIdStrings.CreateRequestAlreadyCalled);
+			RequiresEx.ValidState(!string.IsNullOrEmpty(this.Text), OpenIdStrings.OpenIdTextBoxEmpty);
 
 			try {
 				// Resolve the trust root, and swap out the scheme and port if necessary to match the
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyAjaxControlBase.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyAjaxControlBase.cs
index 34c4df4..9b4d271 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyAjaxControlBase.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyAjaxControlBase.cs
@@ -11,7 +11,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.Generic;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
@@ -21,6 +20,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions;
+	using Validation;
 
 	/// <summary>
 	/// A common base class for OpenID Relying Party controls.
@@ -395,7 +395,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="writer">The <see cref="T:System.Web.UI.HtmlTextWriter"/> object that receives the server control content.</param>
 		protected override void Render(HtmlTextWriter writer) {
-			Contract.Assume(writer != null, "Missing contract.");
+			Assumes.True(writer != null, "Missing contract.");
 			base.Render(writer);
 
 			// Emit a hidden field to let the javascript on the user agent know if an
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
index c730dea..7d616d2 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
@@ -12,7 +12,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.ObjectModel;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Globalization;
 	using System.Linq;
@@ -27,6 +26,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Extensions.UI;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Methods of indicating to the rest of the web site that the user has logged in.
@@ -604,7 +604,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// used to determine the user's control of the <see cref="IAuthenticationRequest.ClaimedIdentifier"/>.
 		/// </returns>
 		protected IEnumerable<IAuthenticationRequest> CreateRequests() {
-			Requires.ValidState(this.Identifier != null, OpenIdStrings.NoIdentifierSet);
+			RequiresEx.ValidState(this.Identifier != null, OpenIdStrings.NoIdentifierSet);
 			return this.CreateRequests(this.Identifier);
 		}
 
@@ -715,7 +715,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="response">The response.</param>
 		protected virtual void OnLoggedIn(IAuthenticationResponse response) {
 			Requires.NotNull(response, "response");
-			Requires.True(response.Status == AuthenticationStatus.Authenticated, "response");
+			Requires.That(response.Status == AuthenticationStatus.Authenticated, "response", "response not authenticatedl");
 
 			var loggedIn = this.LoggedIn;
 			OpenIdEventArgs args = new OpenIdEventArgs(response);
@@ -765,7 +765,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="response">The response.</param>
 		protected virtual void OnCanceled(IAuthenticationResponse response) {
 			Requires.NotNull(response, "response");
-			Requires.True(response.Status == AuthenticationStatus.Canceled, "response");
+			Requires.That(response.Status == AuthenticationStatus.Canceled, "response", "response not canceled");
 
 			var canceled = this.Canceled;
 			if (canceled != null) {
@@ -779,7 +779,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="response">The response.</param>
 		protected virtual void OnFailed(IAuthenticationResponse response) {
 			Requires.NotNull(response, "response");
-			Requires.True(response.Status == AuthenticationStatus.Failed, "response");
+			Requires.That(response.Status == AuthenticationStatus.Failed, "response", "response not failed");
 
 			var failed = this.Failed;
 			if (failed != null) {
@@ -1016,7 +1016,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="request">The request.</param>
 		private void ScriptPopupWindow(IAuthenticationRequest request) {
 			Requires.NotNull(request, "request");
-			Requires.ValidState(this.RelyingParty != null);
+			RequiresEx.ValidState(this.RelyingParty != null);
 
 			StringBuilder startupScript = new StringBuilder();
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdSelector.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdSelector.cs
index 91ff8c8..7881a8b 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdSelector.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdSelector.cs
@@ -12,7 +12,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IdentityModel.Claims;
 	using System.Linq;
@@ -327,7 +326,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="writer">The <see cref="T:System.Web.UI.HtmlTextWriter"/> object that receives the server control content.</param>
 		protected override void Render(HtmlTextWriter writer) {
-			Contract.Assume(writer != null, "Missing contract");
+			Assumes.True(writer != null, "Missing contract");
 			writer.AddAttribute(HtmlTextWriterAttribute.Class, "OpenIdProviders");
 			writer.RenderBeginTag(HtmlTextWriterTag.Ul);
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdTextBox.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdTextBox.cs
index 8ba689f..7474854 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdTextBox.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/OpenIdTextBox.cs
@@ -15,7 +15,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.ComponentModel;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Globalization;
 	using System.Net;
@@ -29,6 +28,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.Extensions.UI;
+	using Validation;
 
 	/// <summary>
 	/// An ASP.NET control that provides a minimal text box that is OpenID-aware.
@@ -584,7 +584,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="writer">The <see cref="T:System.Web.UI.HtmlTextWriter"/> object that receives the server control content.</param>
 		protected override void Render(HtmlTextWriter writer) {
-			Contract.Assume(writer != null, "Missing contract.");
+			Assumes.True(writer != null, "Missing contract.");
 
 			if (this.ShowLogo) {
 				string logoUrl = Page.ClientScript.GetWebResourceUrl(
@@ -627,7 +627,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// true if the server control's state changes as a result of the postback; otherwise, false.
 		/// </returns>
 		protected virtual bool LoadPostData(string postDataKey, NameValueCollection postCollection) {
-			Contract.Assume(postCollection != null, "Missing contract");
+			Assumes.True(postCollection != null, "Missing contract");
 
 			// If the control was temporarily hidden, it won't be in the Form data,
 			// and we'll just implicitly keep the last Text setting.
@@ -666,7 +666,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// used to determine the user's control of the <see cref="IAuthenticationRequest.ClaimedIdentifier"/>.
 		/// </returns>
 		private IEnumerable<IAuthenticationRequest> CreateRequestsCore(IEnumerable<IAuthenticationRequest> requests) {
-			Contract.Requires(requests != null);
+			Requires.NotNull(requests, "requests");
 
 			foreach (var request in requests) {
 				if (this.EnableRequestProfile) {
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButton.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButton.cs
index 670189c..82fd96b 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButton.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButton.cs
@@ -6,13 +6,11 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Web.UI;
 
 	/// <summary>
 	/// A button that would appear in the <see cref="OpenIdSelector"/> control via its <see cref="OpenIdSelector.Buttons"/> collection.
 	/// </summary>
-	[ContractClass(typeof(SelectorButtonContract))]
 	[Serializable]
 	public abstract class SelectorButton {
 		/// <summary>
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButtonContract.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButtonContract.cs
deleted file mode 100644
index b57b73b..0000000
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorButtonContract.cs
+++ /dev/null
@@ -1,46 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="SelectorButtonContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId.RelyingParty {
-	using System;
-	using System.Diagnostics.Contracts;
-	using System.Web.UI;
-
-	/// <summary>
-	/// The contract class for the <see cref="SelectorButton"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(SelectorButton))]
-	internal abstract class SelectorButtonContract : SelectorButton {
-		/// <summary>
-		/// Ensures that this button has been initialized to a valid state.
-		/// </summary>
-		/// <remarks>
-		/// This is "internal" -- NOT "protected internal" deliberately.  It makes it impossible
-		/// to derive from this class outside the assembly, which suits our purposes since the
-		/// <see cref="OpenIdSelector"/> control is not designed for an extensible set of button types.
-		/// </remarks>
-		internal override void EnsureValid() {
-		}
-
-		/// <summary>
-		/// Renders the leading attributes for the LI tag.
-		/// </summary>
-		/// <param name="writer">The writer.</param>
-		protected internal override void RenderLeadingAttributes(HtmlTextWriter writer) {
-			Requires.NotNull(writer, "writer");
-		}
-
-		/// <summary>
-		/// Renders the content of the button.
-		/// </summary>
-		/// <param name="writer">The writer.</param>
-		/// <param name="selector">The containing selector control.</param>
-		protected internal override void RenderButtonContent(HtmlTextWriter writer, OpenIdSelector selector) {
-			Requires.NotNull(writer, "writer");
-			Requires.NotNull(selector, "selector");
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorOpenIdButton.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorOpenIdButton.cs
index 0041ad7..2ede5d6 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorOpenIdButton.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorOpenIdButton.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Web.UI;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A button that appears in the <see cref="OpenIdSelector"/> control that
@@ -47,8 +47,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Ensures that this button has been initialized to a valid state.
 		/// </summary>
 		internal override void EnsureValid() {
-			Contract.Ensures(!string.IsNullOrEmpty(this.Image));
-
 			// Every button must have an image.
 			ErrorUtilities.VerifyOperation(!string.IsNullOrEmpty(this.Image), OpenIdStrings.PropertyNotSet, "SelectorButton.Image");
 		}
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorProviderButton.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorProviderButton.cs
index 7c71a37..e60d95d 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorProviderButton.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/OpenId/RelyingParty/SelectorProviderButton.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Web.UI;
 	using DotNetOpenAuth.ComponentModel;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A button that appears in the <see cref="OpenIdSelector"/> control that
@@ -69,9 +69,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Ensures that this button has been initialized to a valid state.
 		/// </summary>
 		internal override void EnsureValid() {
-			Contract.Ensures(!string.IsNullOrEmpty(this.Image));
-			Contract.Ensures(this.OPIdentifier != null);
-
 			// Every button must have an image.
 			ErrorUtilities.VerifyOperation(!string.IsNullOrEmpty(this.Image), OpenIdStrings.PropertyNotSet, "SelectorButton.Image");
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/Properties/AssemblyInfo.cs
index 5ea4ad7..0b03770 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty.UI/packages.config b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/DotNetOpenAuth.OpenId.RelyingParty.csproj b/src/DotNetOpenAuth.OpenId.RelyingParty/DotNetOpenAuth.OpenId.RelyingParty.csproj
index 3ebd698..309ecb3 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/DotNetOpenAuth.OpenId.RelyingParty.csproj
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/DotNetOpenAuth.OpenId.RelyingParty.csproj
@@ -36,7 +36,6 @@
     <Compile Include="OpenId\Interop\OpenIdRelyingPartyShim.cs" />
     <Compile Include="OpenId\Messages\AssociateDiffieHellmanRelyingPartyResponse.cs" />
     <Compile Include="OpenId\Messages\AssociateRequestRelyingParty.cs" />
-    <Compile Include="OpenId\Messages\IAssociateSuccessfulResponseRelyingPartyContract.cs" />
     <Compile Include="OpenId\Messages\IAssociateSuccessfulResponseRelyingParty.cs" />
     <Compile Include="OpenId\Messages\AssociateUnencryptedResponseRelyingParty.cs" />
     <Compile Include="OpenId\RelyingParty\CryptoKeyStoreAsRelyingPartyAssociationStore.cs" />
@@ -61,6 +60,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="OpenId\RelyingParty\OpenIdRelyingParty.cd" />
+    <None Include="packages.config" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\DotNetOpenAuth.Core\DotNetOpenAuth.Core.csproj">
@@ -78,6 +78,10 @@
   </ItemGroup>
   <ItemGroup>
     <Reference Include="System" />
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <Folder Include="ComponentModel\" />
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ExtensionsBindingElementRelyingParty.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ExtensionsBindingElementRelyingParty.cs
index fca62f8..be98d29 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ExtensionsBindingElementRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ExtensionsBindingElementRelyingParty.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// The OpenID binding element responsible for reading/writing OpenID extensions
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/OpenIdRelyingPartyChannel.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/OpenIdRelyingPartyChannel.cs
index e18a103..e65409a 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/OpenIdRelyingPartyChannel.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/OpenIdRelyingPartyChannel.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// The messaging channel for OpenID relying parties.
@@ -42,7 +42,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 			base(messageTypeProvider, InitializeBindingElements(cryptoKeyStore, nonceStore, securitySettings, nonVerifying)) {
 			Requires.NotNull(messageTypeProvider, "messageTypeProvider");
 			Requires.NotNull(securitySettings, "securitySettings");
-			Requires.True(!nonVerifying || securitySettings is RelyingPartySecuritySettings);
+			Assumes.True(!nonVerifying || securitySettings is RelyingPartySecuritySettings);
 		}
 
 		/// <summary>
@@ -58,8 +58,6 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// messages, and will validate them later.</para>
 		/// </remarks>
 		internal static OpenIdChannel CreateNonVerifyingChannel() {
-			Contract.Ensures(Contract.Result<OpenIdChannel>() != null);
-
 			return new OpenIdRelyingPartyChannel(null, null, new OpenIdRelyingPartyMessageFactory(), new RelyingPartySecuritySettings(), true);
 		}
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/RelyingPartySigningBindingElement.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/RelyingPartySigningBindingElement.cs
index 81ce4e4..3ec2eee 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/RelyingPartySigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/RelyingPartySigningBindingElement.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ReturnToNonceBindingElement.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
index 2aa735a..c459487 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// This binding element adds a nonce to a Relying Party's outgoing 
@@ -261,7 +261,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 				Requires.NotNullOrEmpty(value, "value");
 
 				byte[] nonce = MessagingUtilities.FromBase64WebSafeString(value);
-				Contract.Assume(nonce != null);
+				Assumes.True(nonce != null);
 				DateTime creationDateUtc = new DateTime(BitConverter.ToInt64(nonce, 0), DateTimeKind.Utc);
 				byte[] randomPart = new byte[NonceByteLength];
 				Array.Copy(nonce, sizeof(long), randomPart, 0, NonceByteLength);
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs
index 7336275..1871f19 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -27,6 +26,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Xrds;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	/// <summary>
 	/// The discovery service to support host-meta based discovery, such as Google Apps for Domains.
@@ -167,7 +167,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A sequence of services.</returns>
 		private static IEnumerable<ServiceElement> GetDescribedByServices(IEnumerable<XrdElement> xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<ServiceElement>>() != null);
 
 			var describedBy = from xrd in xrds
 							  from service in xrd.SearchForServiceTypeUris(p => "http://www.iana.org/assignments/relation/describedby")
@@ -186,7 +185,6 @@ namespace DotNetOpenAuth.OpenId {
 			Requires.NotNull(xrds, "xrds");
 			Requires.NotNull(identifier, "identifier");
 			Requires.NotNull(requestHandler, "requestHandler");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 
 			var results = new List<IdentifierDiscoveryResult>();
 			foreach (var serviceElement in GetDescribedByServices(xrds)) {
@@ -298,7 +296,6 @@ namespace DotNetOpenAuth.OpenId {
 			Requires.NotNull(identifier, "identifier");
 			Requires.NotNull(requestHandler, "requestHandler");
 			Requires.NotNull(xrdsLocation, "xrdsLocation");
-			Contract.Ensures(Contract.Result<IncomingWebResponse>() != null);
 
 			var request = (HttpWebRequest)WebRequest.Create(xrdsLocation);
 			request.CachePolicy = Yadis.IdentifierDiscoveryCachePolicy;
@@ -317,8 +314,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		/// <param name="certificates">The chain of certificates to verify.</param>
 		private static void VerifyCertificateChain(IList<X509Certificate2> certificates) {
-			Contract.Requires(certificates.Count > 0);
-			Contract.Requires(certificates.All(c => c != null));
+			Requires.NotNullEmptyOrNullElements(certificates, "certificates");
 
 			// Before calling into the OS to validate the certificate, since that can for some bizzare reason hang for 5 seconds
 			// on some systems, check a cache of previously verified certificates first.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/AuthenticationResponseShim.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/AuthenticationResponseShim.cs
index e6d6609..d871645 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/AuthenticationResponseShim.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/AuthenticationResponseShim.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OpenId.Interop {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Runtime.InteropServices;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// The COM type used to provide details of an authentication result to a relying party COM client.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/ClaimsResponseShim.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/ClaimsResponseShim.cs
index 2569395..cad4504 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/ClaimsResponseShim.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Interop/ClaimsResponseShim.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Interop {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Runtime.InteropServices;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
+	using Validation;
 
 	/// <summary>
 	/// A struct storing Simple Registration field values describing an
@@ -18,7 +18,6 @@ namespace DotNetOpenAuth.OpenId.Interop {
 	/// </summary>
 	[SuppressMessage("Microsoft.Interoperability", "CA1409:ComVisibleTypesShouldBeCreatable", Justification = "It's only creatable on the inside.  It must be ComVisible for ASP to see it.")]
 	[ComVisible(true), Obsolete("This class acts as a COM Server and should not be called directly from .NET code.")]
-	[ContractVerification(true)]
 	public sealed class ClaimsResponseShim {
 		/// <summary>
 		/// The Simple Registration claims response message that this shim wraps.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateDiffieHellmanRelyingPartyResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateDiffieHellmanRelyingPartyResponse.cs
index 9464582..64e1b30 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateDiffieHellmanRelyingPartyResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateDiffieHellmanRelyingPartyResponse.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateRequestRelyingParty.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateRequestRelyingParty.cs
index 1ac8488..3555dfb 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateRequestRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/AssociateRequestRelyingParty.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for requesting associations from the relying party.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingParty.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingParty.cs
index 0c81550..a76d59c 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingParty.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -15,7 +14,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	/// <summary>
 	/// A successful association response as it is received by the relying party.
 	/// </summary>
-	[ContractClass(typeof(IAssociateSuccessfulResponseRelyingPartyContract))]
 	internal interface IAssociateSuccessfulResponseRelyingParty : IProtocolMessage {
 		/// <summary>
 		/// Called to create the Association based on a request previously given by the Relying Party.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingPartyContract.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingPartyContract.cs
deleted file mode 100644
index e870c33..0000000
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/Messages/IAssociateSuccessfulResponseRelyingPartyContract.cs
+++ /dev/null
@@ -1,79 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IAssociateSuccessfulResponseRelyingPartyContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-	using DotNetOpenAuth.OpenId;
-	using DotNetOpenAuth.OpenId.Messages;
-
-	/// <summary>
-	/// Code contract for the <see cref="IAssociateSuccessfulResponseRelyingParty"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IAssociateSuccessfulResponseRelyingParty))]
-	internal abstract class IAssociateSuccessfulResponseRelyingPartyContract : IAssociateSuccessfulResponseRelyingParty {
-		#region IProtocolMessage Members
-
-		/// <summary>
-		/// Gets the level of protection this message requires.
-		/// </summary>
-		Messaging.MessageProtections Messaging.IProtocolMessage.RequiredProtection {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether this is a direct or indirect message.
-		/// </summary>
-		Messaging.MessageTransport Messaging.IProtocolMessage.Transport {
-			get { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IMessage members
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		Version Messaging.IMessage.Version {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		IDictionary<string, string> Messaging.IMessage.ExtraData {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void Messaging.IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-
-		/// <summary>
-		/// Called to create the Association based on a request previously given by the Relying Party.
-		/// </summary>
-		/// <param name="request">The prior request for an association.</param>
-		/// <returns>
-		/// The created association.
-		/// </returns>
-		Association IAssociateSuccessfulResponseRelyingParty.CreateAssociationAtRelyingParty(AssociateRequest request) {
-			Requires.NotNull(request, "request");
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AssociationManager.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AssociationManager.cs
index e6feac1..dfb307b 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AssociationManager.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AssociationManager.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 	using System.Security;
@@ -15,6 +14,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Manages the establishment, storage and retrieval of associations at the relying party.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Associations.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Associations.cs
index f315bf0..44d7d07 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Associations.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Associations.cs
@@ -13,6 +13,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A dictionary of handle/Association pairs.
@@ -23,7 +24,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// can break if the collection is changed by another thread during enumeration.
 	/// </remarks>
 	[DebuggerDisplay("Count = {assocs.Count}")]
-	[ContractVerification(true)]
 	internal class Associations {
 		/// <summary>
 		/// The lookup table where keys are the association handles and values are the associations themselves.
@@ -47,8 +47,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		public IEnumerable<Association> Best {
 			get {
-				Contract.Ensures(Contract.Result<IEnumerable<Association>>() != null);
-
 				lock (this.associations) {
 					return this.associations.OrderByDescending(assoc => assoc.Issued);
 				}
@@ -61,13 +59,12 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="association">The association to add to the collection.</param>
 		public void Set(Association association) {
 			Requires.NotNull(association, "association");
-			Contract.Ensures(this.Get(association.Handle) == association);
 			lock (this.associations) {
 				this.associations.Remove(association.Handle); // just in case one already exists.
 				this.associations.Add(association);
 			}
 
-			Contract.Assume(this.Get(association.Handle) == association);
+			Assumes.True(this.Get(association.Handle) == association);
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AuthenticationRequest.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AuthenticationRequest.cs
index 8af817e..92af297 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AuthenticationRequest.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/AuthenticationRequest.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using System.Threading;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Facilitates customization and creation and an authentication request
@@ -322,7 +322,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Requires.NotNull(relyingParty, "relyingParty");
 			Requires.NotNull(realm, "realm");
-			Contract.Ensures(Contract.Result<IEnumerable<AuthenticationRequest>>() != null);
 
 			// Normalize the portion of the return_to path that correlates to the realm for capitalization.
 			// (so that if a web app base path is /MyApp/, but the URL of this request happens to be
@@ -430,8 +429,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			ErrorUtilities.VerifyArgumentNotNull(relyingParty, "relyingParty");
 			ErrorUtilities.VerifyArgumentNotNull(realm, "realm");
 			ErrorUtilities.VerifyArgumentNotNull(serviceEndpoints, "serviceEndpoints");
-			////Contract.Ensures(Contract.Result<IEnumerable<AuthenticationRequest>>() != null);
-
+			////
 			// If shared associations are required, then we had better have an association store.
 			ErrorUtilities.VerifyOperation(!relyingParty.SecuritySettings.RequireAssociation || relyingParty.AssociationManager.HasAssociationStore, OpenIdStrings.AssociationStoreRequired);
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Behaviors/GsaIcamProfile.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Behaviors/GsaIcamProfile.cs
index f05d354..8deed09 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Behaviors/GsaIcamProfile.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Behaviors/GsaIcamProfile.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty.Behaviors {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/CryptoKeyStoreAsRelyingPartyAssociationStore.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/CryptoKeyStoreAsRelyingPartyAssociationStore.cs
index 7ad1346..ba69838 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/CryptoKeyStoreAsRelyingPartyAssociationStore.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/CryptoKeyStoreAsRelyingPartyAssociationStore.cs
@@ -6,9 +6,9 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging.Bindings;
+	using Validation;
 
 	/// <summary>
 	/// Wraps a standard <see cref="ICryptoKeyStore"/> so that it behaves as an association store.
@@ -25,7 +25,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="keyStore">The key store.</param>
 		internal CryptoKeyStoreAsRelyingPartyAssociationStore(ICryptoKeyStore keyStore) {
 			Requires.NotNull(keyStore, "keyStore");
-			Contract.Ensures(this.keyStore == keyStore);
 			this.keyStore = keyStore;
 		}
 
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/ExtensionsInteropHelper.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/ExtensionsInteropHelper.cs
index d57fede..fde1462 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/ExtensionsInteropHelper.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/ExtensionsInteropHelper.cs
@@ -8,13 +8,13 @@ namespace DotNetOpenAuth.OpenId.RelyingParty.Extensions {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Extensions.AttributeExchange;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A set of methods designed to assist in improving interop across different
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/UIUtilities.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/UIUtilities.cs
index 049430a..a5de08b 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/UIUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/Extensions/UIUtilities.cs
@@ -6,10 +6,10 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty.Extensions.UI {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Constants used in implementing support for the UI extension.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/FailedAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/FailedAuthenticationResponse.cs
index 764062e..ef50d10 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/FailedAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/FailedAuthenticationResponse.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using System.Web;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Wraps a failed authentication response in an <see cref="IAuthenticationResponse"/> instance
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/IRelyingPartyAssociationStore.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/IRelyingPartyAssociationStore.cs
index a97449e..96f613c 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/IRelyingPartyAssociationStore.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/IRelyingPartyAssociationStore.cs
@@ -6,7 +6,7 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Stores <see cref="Association"/>s for lookup by their handle, keeping
@@ -18,7 +18,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// to not be a performance drain.  Because this balance can vary by host, it is the
 	/// responsibility of the host to initiate this cleaning.
 	/// </remarks>
-	[ContractClass(typeof(IRelyingPartyAssociationStoreContract))]
 	public interface IRelyingPartyAssociationStore {
 		/// <summary>
 		/// Saves an <see cref="Association"/> for later recall.
@@ -71,83 +70,4 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		bool RemoveAssociation(Uri providerEndpoint, string handle);
 	}
-
-	/// <summary>
-	/// Code Contract for the <see cref="IRelyingPartyAssociationStore"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(IRelyingPartyAssociationStore))]
-	internal abstract class IRelyingPartyAssociationStoreContract : IRelyingPartyAssociationStore {
-		#region IAssociationStore Members
-
-		/// <summary>
-		/// Saves an <see cref="Association"/> for later recall.
-		/// </summary>
-		/// <param name="providerEndpoint">The Uri (for relying parties) or Smart/Dumb (for providers).</param>
-		/// <param name="association">The association to store.</param>
-		/// <remarks>
-		/// TODO: what should implementations do on association handle conflict?
-		/// </remarks>
-		void IRelyingPartyAssociationStore.StoreAssociation(Uri providerEndpoint, Association association) {
-			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Requires.NotNull(association, "association");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets the best association (the one with the longest remaining life) for a given key.
-		/// </summary>
-		/// <param name="providerEndpoint">The Uri (for relying parties) or Smart/Dumb (for Providers).</param>
-		/// <param name="securityRequirements">The security requirements that the returned association must meet.</param>
-		/// <returns>
-		/// The requested association, or null if no unexpired <see cref="Association"/>s exist for the given key.
-		/// </returns>
-		/// <remarks>
-		/// In the event that multiple associations exist for the given
-		/// <paramref name="providerEndpoint"/>, it is important for the
-		/// implementation for this method to use the <paramref name="securityRequirements"/>
-		/// to pick the best (highest grade or longest living as the host's policy may dictate)
-		/// association that fits the security requirements.
-		/// Associations that are returned that do not meet the security requirements will be
-		/// ignored and a new association created.
-		/// </remarks>
-		Association IRelyingPartyAssociationStore.GetAssociation(Uri providerEndpoint, SecuritySettings securityRequirements) {
-			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Requires.NotNull(securityRequirements, "securityRequirements");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets the association for a given key and handle.
-		/// </summary>
-		/// <param name="providerEndpoint">The Uri (for relying parties) or Smart/Dumb (for Providers).</param>
-		/// <param name="handle">The handle of the specific association that must be recalled.</param>
-		/// <returns>
-		/// The requested association, or null if no unexpired <see cref="Association"/>s exist for the given key and handle.
-		/// </returns>
-		Association IRelyingPartyAssociationStore.GetAssociation(Uri providerEndpoint, string handle) {
-			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Contract.Requires(!string.IsNullOrEmpty(handle));
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Removes a specified handle that may exist in the store.
-		/// </summary>
-		/// <param name="providerEndpoint">The Uri (for relying parties) or Smart/Dumb (for Providers).</param>
-		/// <param name="handle">The handle of the specific association that must be deleted.</param>
-		/// <returns>
-		/// True if the association existed in this store previous to this call.
-		/// </returns>
-		/// <remarks>
-		/// No exception should be thrown if the association does not exist in the store
-		/// before this call.
-		/// </remarks>
-		bool IRelyingPartyAssociationStore.RemoveAssociation(Uri providerEndpoint, string handle) {
-			Requires.NotNull(providerEndpoint, "providerEndpoint");
-			Contract.Requires(!string.IsNullOrEmpty(handle));
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/ISetupRequiredAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/ISetupRequiredAuthenticationResponse.cs
index 2d23cfc..4fc459f 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/ISetupRequiredAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/ISetupRequiredAuthenticationResponse.cs
@@ -6,14 +6,12 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// An interface to expose useful properties and functionality for handling
 	/// authentication responses that are returned from Immediate authentication
 	/// requests that require a subsequent request to be made in non-immediate mode.
 	/// </summary>
-	[ContractClass(typeof(ISetupRequiredAuthenticationResponseContract))]
 	public interface ISetupRequiredAuthenticationResponse {
 		/// <summary>
 		/// Gets the <see cref="Identifier"/> to pass to <see cref="OpenIdRelyingParty.CreateRequest(Identifier)"/>
@@ -21,31 +19,4 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		Identifier UserSuppliedIdentifier { get; }
 	}
-
-	/// <summary>
-	/// Code contract class for the <see cref="ISetupRequiredAuthenticationResponse"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(ISetupRequiredAuthenticationResponse))]
-	internal abstract class ISetupRequiredAuthenticationResponseContract : ISetupRequiredAuthenticationResponse {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="ISetupRequiredAuthenticationResponseContract"/> class.
-		/// </summary>
-		protected ISetupRequiredAuthenticationResponseContract() {
-		}
-
-		#region ISetupRequiredAuthenticationResponse Members
-
-		/// <summary>
-		/// Gets the <see cref="Identifier"/> to pass to <see cref="OpenIdRelyingParty.CreateRequest(Identifier)"/>
-		/// in a subsequent authentication attempt.
-		/// </summary>
-		Identifier ISetupRequiredAuthenticationResponse.UserSuppliedIdentifier {
-			get {
-				Requires.ValidState(((IAuthenticationResponse)this).Status == AuthenticationStatus.SetupRequired, OpenIdStrings.OperationOnlyValidForSetupRequiredState);
-				throw new System.NotImplementedException();
-			}
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/NegativeAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/NegativeAuthenticationResponse.cs
index 5837449..bf52060 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/NegativeAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/NegativeAuthenticationResponse.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Wraps a negative assertion response in an <see cref="IAuthenticationResponse"/> instance
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/OpenIdRelyingParty.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/OpenIdRelyingParty.cs
index 6264041..2177591 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/OpenIdRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/OpenIdRelyingParty.cs
@@ -11,7 +11,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.Specialized;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net;
@@ -24,6 +23,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A delegate that decides whether a given OpenID Provider endpoint may be
@@ -40,7 +40,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// Provides the programmatic facilities to act as an OpenID relying party.
 	/// </summary>
 	[SuppressMessage("Microsoft.Maintainability", "CA1506:AvoidExcessiveClassCoupling", Justification = "Unavoidable")]
-	[ContractVerification(true)]
 	public class OpenIdRelyingParty : IDisposable, IOpenIdHost {
 		/// <summary>
 		/// The name of the key to use in the HttpApplication cache to store the
@@ -114,7 +113,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			// If we are a smart-mode RP (supporting associations), then we MUST also be 
 			// capable of storing nonces to prevent replay attacks.
 			// If we're a dumb-mode RP, then 2.0 OPs are responsible for preventing replays.
-			Requires.True(cryptoKeyStore == null || nonceStore != null, null, OpenIdStrings.AssociationStoreRequiresNonceStore);
+			Requires.That(cryptoKeyStore == null || nonceStore != null, null, OpenIdStrings.AssociationStoreRequiresNonceStore);
 
 			this.securitySettings = OpenIdElement.Configuration.RelyingParty.SecuritySettings.CreateSecuritySettings();
 
@@ -160,8 +159,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		[EditorBrowsable(EditorBrowsableState.Advanced)]
 		public static IOpenIdApplicationStore HttpApplicationStore {
 			get {
-				Contract.Ensures(Contract.Result<IOpenIdApplicationStore>() != null);
-
 				HttpContext context = HttpContext.Current;
 				ErrorUtilities.VerifyOperation(context != null, Strings.StoreRequiredWhenNoHttpContextAvailable, typeof(IOpenIdApplicationStore).Name);
 				var store = (IOpenIdApplicationStore)context.Application[ApplicationStoreKey];
@@ -200,7 +197,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		public RelyingPartySecuritySettings SecuritySettings {
 			get {
-				Contract.Ensures(Contract.Result<RelyingPartySecuritySettings>() != null);
 				return this.securitySettings;
 			}
 
@@ -347,7 +343,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Requires.NotNull(realm, "realm");
 			Requires.NotNull(returnToUrl, "returnToUrl");
-			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				return this.CreateRequests(userSuppliedIdentifier, realm, returnToUrl).First();
 			} catch (InvalidOperationException ex) {
@@ -379,10 +374,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		public IAuthenticationRequest CreateRequest(Identifier userSuppliedIdentifier, Realm realm) {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Requires.NotNull(realm, "realm");
-			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				var result = this.CreateRequests(userSuppliedIdentifier, realm).First();
-				Contract.Assume(result != null);
+				Assumes.True(result != null);
 				return result;
 			} catch (InvalidOperationException ex) {
 				throw ErrorUtilities.Wrap(ex, OpenIdStrings.OpenIdEndpointNotFound);
@@ -407,7 +401,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IAuthenticationRequest CreateRequest(Identifier userSuppliedIdentifier) {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
-			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				return this.CreateRequests(userSuppliedIdentifier).First();
 			} catch (InvalidOperationException ex) {
@@ -446,7 +439,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Requires.NotNull(realm, "realm");
 			Requires.NotNull(returnToUrl, "returnToUrl");
-			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
 
 			return AuthenticationRequest.Create(userSuppliedIdentifier, this, realm, returnToUrl, true).Cast<IAuthenticationRequest>().CacheGeneratedResults();
 		}
@@ -477,15 +469,13 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IEnumerable<IAuthenticationRequest> CreateRequests(Identifier userSuppliedIdentifier, Realm realm) {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Requires.NotNull(realm, "realm");
-			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
 
 			// This next code contract is a BAD idea, because it causes each authentication request to be generated
 			// at least an extra time.
-			////Contract.Ensures(Contract.ForAll(Contract.Result<IEnumerable<IAuthenticationRequest>>(), el => el != null));
-
+			////
 			// Build the return_to URL
 			UriBuilder returnTo = new UriBuilder(this.Channel.GetRequestFromContext().GetPublicFacingUrl());
 
@@ -526,8 +516,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IEnumerable<IAuthenticationRequest> CreateRequests(Identifier userSuppliedIdentifier) {
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
-			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
 			return this.CreateRequests(userSuppliedIdentifier, Realm.AutoDetect);
 		}
@@ -540,7 +529,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
 		/// </remarks>
 		public IAuthenticationResponse GetResponse() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 			return this.GetResponse(this.Channel.GetRequestFromContext());
 		}
 
@@ -593,8 +582,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <para>Requires an <see cref="HttpContext.Current">HttpContext.Current</see> context.</para>
 		/// </remarks>
 		public OutgoingWebResponse ProcessResponseFromPopup() {
-			Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
+			RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
 			return this.ProcessResponseFromPopup(this.Channel.GetRequestFromContext());
 		}
@@ -606,7 +594,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <returns>The HTTP response to send to this HTTP request.</returns>
 		public OutgoingWebResponse ProcessResponseFromPopup(HttpRequestBase request) {
 			Requires.NotNull(request, "request");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
 			return this.ProcessResponseFromPopup(request, null);
 		}
@@ -693,7 +680,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		[SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "OpenID", Justification = "real word"), SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "iframe", Justification = "Code contracts")]
 		internal OutgoingWebResponse ProcessResponseFromPopup(HttpRequestBase request, Action<AuthenticationStatus> callback) {
 			Requires.NotNull(request, "request");
-			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
 			string extensionsJson = null;
 			var authResponse = this.NonVerifyingRelyingParty.GetResponse();
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAnonymousResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAnonymousResponse.cs
index 3f4692a..6ec7d04 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAnonymousResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAnonymousResponse.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Wraps an extension-only response from the OP in an <see cref="IAuthenticationResponse"/> instance
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
index 2a06c9b..509eb60 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Wraps a positive assertion response in an <see cref="IAuthenticationResponse"/> instance
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponseSnapshot.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponseSnapshot.cs
index f5cf8ad..0e10087 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponseSnapshot.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/RelyingParty/PositiveAuthenticationResponseSnapshot.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 	using System.Web;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A serializable snapshot of a verified authentication message.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/Properties/AssemblyInfo.cs
index 4d35e76..e3bbc74 100644
--- a/src/DotNetOpenAuth.OpenId.RelyingParty/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/packages.config b/src/DotNetOpenAuth.OpenId.RelyingParty/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId.RelyingParty/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId.UI/DotNetOpenAuth.OpenId.UI.csproj b/src/DotNetOpenAuth.OpenId.UI/DotNetOpenAuth.OpenId.UI.csproj
index f2a1cf5..86658bd 100644
--- a/src/DotNetOpenAuth.OpenId.UI/DotNetOpenAuth.OpenId.UI.csproj
+++ b/src/DotNetOpenAuth.OpenId.UI/DotNetOpenAuth.OpenId.UI.csproj
@@ -37,6 +37,15 @@
       <Name>Org.Mentalis.Security.Cryptography</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenId.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId.UI/Properties/AssemblyInfo.cs
index a488d1d..5a3a8a4 100644
--- a/src/DotNetOpenAuth.OpenId.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -33,8 +32,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId.UI/XrdsPublisher.cs b/src/DotNetOpenAuth.OpenId.UI/XrdsPublisher.cs
index 87e3a8b..640bee7 100644
--- a/src/DotNetOpenAuth.OpenId.UI/XrdsPublisher.cs
+++ b/src/DotNetOpenAuth.OpenId.UI/XrdsPublisher.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth {
 	using System.Collections.Generic;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Text;
 	using System.Web;
@@ -211,7 +210,7 @@ namespace DotNetOpenAuth {
 		/// <param name="writer">The <see cref="T:System.Web.UI.HtmlTextWriter"/> object that receives the server control content.</param>
 		[SuppressMessage("Microsoft.Globalization", "CA1303:Do not pass literals as localized parameters", MessageId = "System.Diagnostics.Contracts.__ContractsRuntime.Assume(System.Boolean,System.String,System.String)", Justification = "Code contracts"), SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Uri(Uri, string) accepts second arguments that Uri(Uri, new Uri(string)) does not that we must support.")]
 		protected override void Render(HtmlTextWriter writer) {
-			Contract.Assume(writer != null, "Missing contract.");
+			Assumes.True(writer != null, "Missing contract.");
 			if (this.Enabled && this.Visible && !string.IsNullOrEmpty(this.XrdsUrl)) {
 				Uri xrdsAddress = new Uri(MessagingUtilities.GetRequestUrlFromContext(), Page.Response.ApplyAppPathModifier(this.XrdsUrl));
 				if ((this.XrdsAdvertisement & XrdsUrlLocations.HttpHeader) != 0) {
diff --git a/src/DotNetOpenAuth.OpenId.UI/packages.config b/src/DotNetOpenAuth.OpenId.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeCollection.cs b/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeCollection.cs
index 419a76a..384497c 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeCollection.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeCollection.cs
@@ -7,12 +7,10 @@
 namespace DotNetOpenAuth.Configuration {
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Describes a collection of association type sub-elements in a .config file.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class AssociationTypeCollection : ConfigurationElementCollection, IEnumerable<AssociationTypeElement> {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="AssociationTypeCollection"/> class.
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeElement.cs
index 32c1cc9..c64913d 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/AssociationTypeElement.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 
@@ -16,7 +15,6 @@ namespace DotNetOpenAuth.Configuration {
 	/// Describes an association type and its maximum lifetime as an element
 	/// in a .config file.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class AssociationTypeElement : ConfigurationElement {
 		/// <summary>
 		/// The name of the attribute that stores the association type.
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdElement.cs
index c43a3ad..6c6ad10 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdElement.cs
@@ -8,14 +8,13 @@ namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Collections.Generic;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Represents the &lt;openid&gt; element in the host's .config file.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class OpenIdElement : ConfigurationSection {
 		/// <summary>
 		/// The name of the section under which this library's settings must be found.
@@ -63,7 +62,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		public static OpenIdElement Configuration {
 			get {
-				Contract.Ensures(Contract.Result<OpenIdElement>() != null);
 				return (OpenIdElement)ConfigurationManager.GetSection(SectionName) ?? new OpenIdElement();
 			}
 		}
@@ -80,14 +78,13 @@ namespace DotNetOpenAuth.Configuration {
 		[PositiveTimeSpanValidator]
 		internal TimeSpan MaxAuthenticationTime {
 			get {
-				Contract.Ensures(Contract.Result<TimeSpan>() > TimeSpan.Zero);
 				TimeSpan result = (TimeSpan)this[MaxAuthenticationTimePropertyName];
-				Contract.Assume(result > TimeSpan.Zero); // our PositiveTimeSpanValidator should take care of this
+				Assumes.True(result > TimeSpan.Zero); // our PositiveTimeSpanValidator should take care of this
 				return result;
 			}
 
 			set {
-				Requires.InRange(value > TimeSpan.Zero, "value");
+				Requires.Range(value > TimeSpan.Zero, "value");
 				this[MaxAuthenticationTimePropertyName] = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderElement.cs
index df93d3b..dfa5a86 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderElement.cs
@@ -6,14 +6,12 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.Provider;
 
 	/// <summary>
 	/// The section in the .config file that allows customization of OpenID Provider behaviors.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class OpenIdProviderElement : ConfigurationElement {
 		/// <summary>
 		/// The name of the &lt;provider&gt; sub-element.
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderSecuritySettingsElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderSecuritySettingsElement.cs
index f003900..3579faa 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderSecuritySettingsElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdProviderSecuritySettingsElement.cs
@@ -6,14 +6,12 @@
 
 namespace DotNetOpenAuth.Configuration {
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.Provider;
 
 	/// <summary>
 	/// Represents the .config file element that allows for setting the security policies of the Provider.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class OpenIdProviderSecuritySettingsElement : ConfigurationElement {
 		/// <summary>
 		/// Gets the name of the @protectDownlevelReplayAttacks attribute.
@@ -111,7 +109,6 @@ namespace DotNetOpenAuth.Configuration {
 		[ConfigurationCollection(typeof(AssociationTypeCollection))]
 		public AssociationTypeCollection AssociationLifetimes {
 			get {
-				Contract.Ensures(Contract.Result<AssociationTypeCollection>() != null);
 				return (AssociationTypeCollection)this[AssociationsConfigName] ?? new AssociationTypeCollection();
 			}
 
@@ -144,7 +141,7 @@ namespace DotNetOpenAuth.Configuration {
 			settings.UnsolicitedAssertionVerification = this.UnsolicitedAssertionVerification;
 			settings.EncodeAssociationSecretsInHandles = this.EncodeAssociationSecretsInHandles;
 			foreach (AssociationTypeElement element in this.AssociationLifetimes) {
-				Contract.Assume(element != null);
+				Assumes.True(element != null);
 				settings.AssociationLifetimes.Add(element.AssociationType, element.MaximumLifetime);
 			}
 
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartyElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartyElement.cs
index 8af1129..681ba38 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartyElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartyElement.cs
@@ -7,14 +7,12 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 
 	/// <summary>
 	/// The section in the .config file that allows customization of OpenID Relying Party behaviors.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class OpenIdRelyingPartyElement : ConfigurationElement {
 		/// <summary>
 		/// The name of the custom store sub-element.
diff --git a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs
index f0d8942..a2e2c34 100644
--- a/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Configuration/OpenIdRelyingPartySecuritySettingsElement.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 
@@ -238,8 +237,6 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		/// <returns>The newly created security settings object.</returns>
 		public RelyingPartySecuritySettings CreateSecuritySettings() {
-			Contract.Ensures(Contract.Result<RelyingPartySecuritySettings>() != null);
-
 			RelyingPartySecuritySettings settings = new RelyingPartySecuritySettings();
 			settings.RequireSsl = this.RequireSsl;
 			settings.RequireDirectedIdentity = this.RequireDirectedIdentity;
diff --git a/src/DotNetOpenAuth.OpenId/DotNetOpenAuth.OpenId.csproj b/src/DotNetOpenAuth.OpenId/DotNetOpenAuth.OpenId.csproj
index 75bd113..09beb3f 100644
--- a/src/DotNetOpenAuth.OpenId/DotNetOpenAuth.OpenId.csproj
+++ b/src/DotNetOpenAuth.OpenId/DotNetOpenAuth.OpenId.csproj
@@ -40,7 +40,6 @@
     </Compile>
     <Compile Include="OpenId\Behaviors\GsaIcamProfileBase.cs" />
     <Compile Include="OpenId\ChannelElements\BackwardCompatibilityBindingElement.cs" />
-    <Compile Include="OpenId\ChannelElements\SigningBindingElementContract.cs" />
     <Compile Include="OpenId\ChannelElements\ExtensionsBindingElement.cs" />
     <Compile Include="OpenId\ChannelElements\IOpenIdExtensionFactory.cs" />
     <Compile Include="OpenId\ChannelElements\ITamperResistantOpenIdMessage.cs" />
@@ -50,7 +49,6 @@
     <Compile Include="OpenId\ChannelElements\OpenIdChannel.cs" />
     <Compile Include="OpenId\ChannelElements\ReturnToSignatureBindingElement.cs" />
     <Compile Include="OpenId\ChannelElements\SkipSecurityBindingElement.cs" />
-    <Compile Include="OpenId\AssociationContract.cs" />
     <Compile Include="OpenId\Extensions\AliasManager.cs" />
     <Compile Include="OpenId\Extensions\AttributeExchange\AttributeRequest.cs" />
     <Compile Include="OpenId\Extensions\AttributeExchange\AttributeValues.cs" />
@@ -89,7 +87,6 @@
     <Compile Include="OpenId\Extensions\UI\UIRequest.cs" />
     <Compile Include="OpenId\Extensions\UI\UIUtilities.cs" />
     <Compile Include="OpenId\Identifier.cs" />
-    <Compile Include="OpenId\IdentifierContract.cs" />
     <Compile Include="OpenId\Extensions\OpenIdExtensionsInteropHelper.cs" />
     <Compile Include="OpenId\IdentifierDiscoveryResult.cs" />
     <Compile Include="OpenId\IIdentifierDiscoveryService.cs" />
@@ -104,13 +101,11 @@
     <Compile Include="OpenId\Provider\RelyingPartyDiscoveryResult.cs" />
     <Compile Include="OpenId\RelyingParty\AuthenticationStatus.cs" />
     <Compile Include="OpenId\RelyingParty\IAuthenticationRequest.cs" />
-    <Compile Include="OpenId\RelyingParty\IAuthenticationRequestContract.cs" />
     <Compile Include="OpenId\RelyingParty\IAuthenticationResponse.cs" />
     <Compile Include="OpenId\RelyingParty\IRelyingPartyBehavior.cs" />
     <Compile Include="OpenId\Messages\CheckAuthenticationRequest.cs" />
     <Compile Include="OpenId\Messages\CheckAuthenticationResponse.cs" />
     <Compile Include="OpenId\Messages\CheckIdRequest.cs" />
-    <Compile Include="OpenId\Messages\AssociateSuccessfulResponseContract.cs" />
     <Compile Include="OpenId\Messages\IErrorMessage.cs" />
     <Compile Include="OpenId\Messages\IndirectResponseBase.cs" />
     <Compile Include="OpenId\Messages\IndirectSignedResponse.cs" />
@@ -186,6 +181,15 @@
       <Name>Org.Mentalis.Security.Cryptography</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Association.cs b/src/DotNetOpenAuth.OpenId/OpenId/Association.cs
index a0f5bae..502afb3 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Association.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Association.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Stores a secret used in signing and verifying messages.
@@ -24,8 +24,6 @@ namespace DotNetOpenAuth.OpenId {
 	/// (dumb associations).
 	/// </remarks>
 	[DebuggerDisplay("Handle = {Handle}, Expires = {Expires}")]
-	[ContractVerification(true)]
-	[ContractClass(typeof(AssociationContract))]
 	public abstract class Association {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="Association"/> class.
@@ -37,10 +35,9 @@ namespace DotNetOpenAuth.OpenId {
 		protected Association(string handle, byte[] secret, TimeSpan totalLifeLength, DateTime issued) {
 			Requires.NotNullOrEmpty(handle, "handle");
 			Requires.NotNull(secret, "secret");
-			Requires.InRange(totalLifeLength > TimeSpan.Zero, "totalLifeLength");
-			Requires.True(issued.Kind == DateTimeKind.Utc, "issued");
-			Requires.InRange(issued <= DateTime.UtcNow, "issued");
-			Contract.Ensures(this.TotalLifeLength == totalLifeLength);
+			Requires.Range(totalLifeLength > TimeSpan.Zero, "totalLifeLength");
+			Requires.That(issued.Kind == DateTimeKind.Utc, "issued", "UTC time required.");
+			Requires.Range(issued <= DateTime.UtcNow, "issued");
 
 			this.Handle = handle;
 			this.SecretKey = secret;
@@ -93,7 +90,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		protected internal static TimeSpan DumbSecretLifetime {
 			get {
-				Contract.Ensures(Contract.Result<TimeSpan>() > TimeSpan.Zero);
 				return OpenIdElement.Configuration.MaxAuthenticationTime;
 			}
 		}
@@ -104,7 +100,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		protected internal long SecondsTillExpiration {
 			get {
-				Contract.Ensures(Contract.Result<long>() >= 0);
 				return Math.Max(0, (long)this.TimeTillExpiration.TotalSeconds);
 			}
 		}
@@ -130,7 +125,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </remarks>
 		private static TimeSpan MinimumUsefulAssociationLifetime {
 			get {
-				Contract.Ensures(Contract.Result<TimeSpan>() > TimeSpan.Zero);
 				return OpenIdElement.Configuration.MaxAuthenticationTime;
 			}
 		}
@@ -164,7 +158,6 @@ namespace DotNetOpenAuth.OpenId {
 		public static Association Deserialize(string handle, DateTime expiresUtc, byte[] privateData) {
 			Requires.NotNullOrEmpty(handle, "handle");
 			Requires.NotNull(privateData, "privateData");
-			Contract.Ensures(Contract.Result<Association>() != null);
 
 			expiresUtc = expiresUtc.ToUniversalTimeSafe();
 			TimeSpan remainingLifeLength = expiresUtc - DateTime.UtcNow;
@@ -191,8 +184,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// in this byte array, as they are useful for fast database lookup and are persisted separately.
 		/// </remarks>
 		public byte[] SerializePrivateData() {
-			Contract.Ensures(Contract.Result<byte[]>() != null);
-
 			// We may want to encrypt this secret using the machine.config private key,
 			// and add data regarding which Association derivative will need to be
 			// re-instantiated on deserialization.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/AssociationContract.cs b/src/DotNetOpenAuth.OpenId/OpenId/AssociationContract.cs
deleted file mode 100644
index e04a332..0000000
--- a/src/DotNetOpenAuth.OpenId/OpenId/AssociationContract.cs
+++ /dev/null
@@ -1,65 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="AssociationContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId {
-	using System;
-	using System.Diagnostics;
-	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
-	using System.IO;
-	using System.Security.Cryptography;
-	using System.Text;
-	using DotNetOpenAuth.Configuration;
-	using DotNetOpenAuth.Messaging;
-
-	/// <summary>
-	/// Code contract for the <see cref="Association"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(Association))]
-	internal abstract class AssociationContract : Association {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="AssociationContract"/> class from being created.
-		/// </summary>
-		private AssociationContract()
-			: base(null, null, TimeSpan.Zero, DateTime.Now) {
-		}
-
-		/// <summary>
-		/// Gets the length (in bits) of the hash this association creates when signing.
-		/// </summary>
-		public override int HashBitLength {
-			get {
-				Contract.Ensures(Contract.Result<int>() > 0);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// The string to pass as the assoc_type value in the OpenID protocol.
-		/// </summary>
-		/// <param name="protocol">The protocol version of the message that the assoc_type value will be included in.</param>
-		/// <returns>
-		/// The value that should be used for  the openid.assoc_type parameter.
-		/// </returns>
-		[Pure]
-		internal override string GetAssociationType(Protocol protocol) {
-			Requires.NotNull(protocol, "protocol");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Returns the specific hash algorithm used for message signing.
-		/// </summary>
-		/// <returns>
-		/// The hash algorithm used for message signing.
-		/// </returns>
-		[Pure]
-		protected override HashAlgorithm CreateHasher() {
-			Contract.Ensures(Contract.Result<HashAlgorithm>() != null);
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Behaviors/GsaIcamProfileBase.cs b/src/DotNetOpenAuth.OpenId/OpenId/Behaviors/GsaIcamProfileBase.cs
index c7352c8..a51e844 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Behaviors/GsaIcamProfileBase.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Behaviors/GsaIcamProfileBase.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Behaviors {
 	using System;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ExtensionsBindingElement.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ExtensionsBindingElement.cs
index 46d08a3..f24c8b4 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ExtensionsBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ExtensionsBindingElement.cs
@@ -8,13 +8,13 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The binding element that serializes/deserializes OpenID extensions to/from
@@ -238,7 +238,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// A dictionary of message parts, including only signed parts when appropriate.
 		/// </returns>
 		private IDictionary<string, string> GetExtensionsDictionary(IProtocolMessage message, bool ignoreUnsigned) {
-			Requires.ValidState(this.Channel != null);
+			RequiresEx.ValidState(this.Channel != null);
 
 			IndirectSignedResponse signedResponse = message as IndirectSignedResponse;
 			if (signedResponse != null && ignoreUnsigned) {
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/KeyValueFormEncoding.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/KeyValueFormEncoding.cs
index cdd1085..6ad66c0 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/KeyValueFormEncoding.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/KeyValueFormEncoding.cs
@@ -8,11 +8,11 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Indicates the level of strictness to require when decoding a
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/OpenIdChannel.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/OpenIdChannel.cs
index 6b88b3f..5a6b8bb 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/OpenIdChannel.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/OpenIdChannel.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -18,11 +17,11 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A channel that knows how to send and receive OpenID messages.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class OpenIdChannel : Channel {
 		/// <summary>
 		/// The HTTP Content-Type to use in Key-Value Form responses.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ReturnToSignatureBindingElement.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ReturnToSignatureBindingElement.cs
index 912a322..726c01f 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ReturnToSignatureBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/ReturnToSignatureBindingElement.cs
@@ -8,13 +8,13 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using System.Web;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// This binding element signs a Relying Party's openid.return_to parameter
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElement.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElement.cs
index 363ff28..584b0e9 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElement.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElement.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net.Security;
@@ -18,11 +17,11 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Signs and verifies authentication assertions.
 	/// </summary>
-	[ContractClass(typeof(SigningBindingElementContract))]
 	internal abstract class SigningBindingElement : IChannelBindingElement {
 		#region IChannelBindingElement Properties
 
@@ -121,7 +120,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <returns>The calculated signature of the method.</returns>
 		protected string GetSignature(ITamperResistantOpenIdMessage signedMessage, Association association) {
 			Requires.NotNull(signedMessage, "signedMessage");
-			Requires.True(!string.IsNullOrEmpty(signedMessage.SignedParameterOrder), "signedMessage");
+			Requires.That(!string.IsNullOrEmpty(signedMessage.SignedParameterOrder), "signedMessage", "SignedParameterOrder must not be null or empty.");
 			Requires.NotNull(association, "association");
 
 			// Prepare the parts to sign, taking care to replace an openid.mode value
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElementContract.cs b/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElementContract.cs
deleted file mode 100644
index bacbb29..0000000
--- a/src/DotNetOpenAuth.OpenId/OpenId/ChannelElements/SigningBindingElementContract.cs
+++ /dev/null
@@ -1,64 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="SigningBindingElementContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId.ChannelElements {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
-	using System.Globalization;
-	using System.Linq;
-	using System.Net.Security;
-	using System.Web;
-	using DotNetOpenAuth.Loggers;
-	using DotNetOpenAuth.Messaging;
-	using DotNetOpenAuth.Messaging.Bindings;
-	using DotNetOpenAuth.Messaging.Reflection;
-	using DotNetOpenAuth.OpenId.Messages;
-
-	/// <summary>
-	/// Code contract for the <see cref="SigningBindingElement"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(SigningBindingElement))]
-	internal abstract class SigningBindingElementContract : SigningBindingElement {
-		/// <summary>
-		/// Verifies the signature by unrecognized handle.
-		/// </summary>
-		/// <param name="message">The message.</param>
-		/// <param name="signedMessage">The signed message.</param>
-		/// <param name="protectionsApplied">The protections applied.</param>
-		/// <returns>
-		/// The applied protections.
-		/// </returns>
-		protected override MessageProtections VerifySignatureByUnrecognizedHandle(IProtocolMessage message, ITamperResistantOpenIdMessage signedMessage, MessageProtections protectionsApplied) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets the association to use to sign or verify a message.
-		/// </summary>
-		/// <param name="signedMessage">The message to sign or verify.</param>
-		/// <returns>
-		/// The association to use to sign or verify the message.
-		/// </returns>
-		protected override Association GetAssociation(ITamperResistantOpenIdMessage signedMessage) {
-			Requires.NotNull(signedMessage, "signedMessage");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets a specific association referenced in a given message's association handle.
-		/// </summary>
-		/// <param name="signedMessage">The signed message whose association handle should be used to lookup the association to return.</param>
-		/// <returns>
-		/// The referenced association; or <c>null</c> if such an association cannot be found.
-		/// </returns>
-		protected override Association GetSpecificAssociation(ITamperResistantOpenIdMessage signedMessage) {
-			Requires.NotNull(signedMessage, "signedMessage");
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/DiffieHellmanUtilities.cs b/src/DotNetOpenAuth.OpenId/OpenId/DiffieHellmanUtilities.cs
index e15bd6e..6f7fc31 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/DiffieHellmanUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/DiffieHellmanUtilities.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Security.Cryptography;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using Org.Mentalis.Security.Cryptography;
+	using Validation;
 
 	/// <summary>
 	/// Diffie-Hellman encryption methods used by both the relying party and provider.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AliasManager.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AliasManager.cs
index ff3d3f3..94f7762 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AliasManager.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AliasManager.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Manages a fast, two-way mapping between type URIs and their aliases.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AXUtilities.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AXUtilities.cs
index 20b8a79..539e570 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AXUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AXUtilities.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Helper methods shared by multiple messages in the Attribute Exchange extension.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
index 6590cd1..06ddb45 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
@@ -7,8 +7,8 @@
 namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An individual attribute to be requested of the OpenID Provider using
@@ -84,7 +84,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 			}
 
 			set {
-				Requires.InRange(value > 0, "value");
+				Requires.Range(value > 0, "value");
 				this.count = value;
 			}
 		}
@@ -100,7 +100,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// </returns>
 		public AttributeValues Respond(params string[] values) {
 			Requires.NotNull(values, "values");
-			Requires.True(values.Length <= this.Count, "values");
+			Requires.That(values.Length <= this.Count, "values", "requires values.Length <= this.Count");
 			return new AttributeValues(this.TypeUri, values);
 		}
 
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeValues.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeValues.cs
index 44aad04..2aea683 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeValues.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/AttributeValues.cs
@@ -8,8 +8,8 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An individual attribute's value(s) as supplied by an OpenID Provider
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchRequest.cs
index ff47ee6..083d19c 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchRequest.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
@@ -69,7 +68,6 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// is all the attribute request details.</value>
 		public KeyedCollection<string, AttributeRequest> Attributes {
 			get {
-				Contract.Ensures(Contract.Result<KeyedCollection<string, AttributeRequest>>() != null);
 				return this.attributes;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchResponse.cs
index d5633c3..425b5e2 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/AttributeExchange/FetchResponse.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Collections.ObjectModel;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
@@ -54,7 +53,6 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// </summary>
 		public KeyedCollection<string, AttributeValues> Attributes {
 			get {
-				Contract.Ensures(Contract.Result<KeyedCollection<string, AttributeValues>>() != null);
 				return this.attributesProvided;
 			}
 		}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ExtensionArgumentsManager.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ExtensionArgumentsManager.cs
index 1d795da..f3fa7f2 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ExtensionArgumentsManager.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ExtensionArgumentsManager.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Manages the processing and construction of OpenID extensions parts.
@@ -134,7 +134,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="extensionTypeUri">The extension type URI.</param>
 		/// <param name="arguments">The arguments for this extension to add to the message.</param>
 		public void AddExtensionArguments(string extensionTypeUri, IDictionary<string, string> arguments) {
-			Requires.ValidState(!this.ReadMode);
+			RequiresEx.ValidState(!this.ReadMode);
 			Requires.NotNullOrEmpty(extensionTypeUri, "extensionTypeUri");
 			Requires.NotNull(arguments, "arguments");
 			if (arguments.Count == 0) {
@@ -162,7 +162,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// </param>
 		/// <returns>A dictionary of key=value pairs to add to the message to carry the extension.</returns>
 		internal IDictionary<string, string> GetArgumentsToSend(bool includeOpenIdPrefix) {
-			Requires.ValidState(!this.ReadMode);
+			RequiresEx.ValidState(!this.ReadMode);
 			Dictionary<string, string> args = new Dictionary<string, string>();
 			foreach (var typeUriAndExtension in this.extensions) {
 				string typeUri = typeUriAndExtension.Key;
@@ -196,7 +196,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// </returns>
 		internal IDictionary<string, string> GetExtensionArguments(string extensionTypeUri) {
 			Requires.NotNullOrEmpty(extensionTypeUri, "extensionTypeUri");
-			Requires.ValidState(this.ReadMode);
+			RequiresEx.ValidState(this.ReadMode);
 
 			IDictionary<string, string> extensionArgs;
 			this.extensions.TryGetValue(extensionTypeUri, out extensionArgs);
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionFactoryAggregator.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionFactoryAggregator.cs
index 2b851dd..ddd60f3 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionFactoryAggregator.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionFactoryAggregator.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OpenId.Extensions {
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Messages;
@@ -70,7 +69,6 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// </summary>
 		/// <returns>A new instance of <see cref="OpenIdExtensionFactoryAggregator"/>.</returns>
 		internal static OpenIdExtensionFactoryAggregator LoadFromConfiguration() {
-			Contract.Ensures(Contract.Result<OpenIdExtensionFactoryAggregator>() != null);
 			var factoriesElement = DotNetOpenAuth.Configuration.OpenIdElement.Configuration.ExtensionFactories;
 			var aggregator = new OpenIdExtensionFactoryAggregator();
 			aggregator.Factories.Add(new StandardOpenIdExtensionFactory());
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionsInteropHelper.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionsInteropHelper.cs
index f9d3062..d90dd2a 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionsInteropHelper.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/OpenIdExtensionsInteropHelper.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Extensions.AttributeExchange;
 	using DotNetOpenAuth.OpenId.Extensions.SimpleRegistration;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A set of methods designed to assist in improving interop across different
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
index f017031..e9e8e95 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId.Extensions.ProviderAuthenticationPolicy {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for use by the PAPE extension.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PolicyResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PolicyResponse.cs
index 880a25e..d764118 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PolicyResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/ProviderAuthenticationPolicy/PolicyResponse.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OpenId.Extensions.ProviderAuthenticationPolicy {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// The PAPE response part of an OpenID Authentication response message.
@@ -83,7 +83,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.ProviderAuthenticationPolicy {
 			}
 
 			set {
-				Requires.True(!value.HasValue || value.Value.Kind != DateTimeKind.Unspecified, "value", OpenIdStrings.UnspecifiedDateTimeKindNotAllowed);
+				Requires.That(!value.HasValue || value.Value.Kind != DateTimeKind.Unspecified, "value", OpenIdStrings.UnspecifiedDateTimeKindNotAllowed);
 
 				// Make sure that whatever is set here, it becomes UTC time.
 				if (value.HasValue) {
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
index ab08cbb..f6fd620 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
@@ -9,11 +9,11 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Carries the request/require/none demand state of the simple registration fields.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
index af60596..361910d 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Net.Mail;
 	using System.Text;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 	using System.Xml.Serialization;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A struct storing Simple Registration field values describing an
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIRequest.cs
index 0902a00..731ca1c 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIRequest.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Extensions.UI {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIUtilities.cs b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIUtilities.cs
index 19e333d..1f48ce3 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Extensions/UI/UIUtilities.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OpenId.Extensions.UI {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/HmacShaAssociation.cs b/src/DotNetOpenAuth.OpenId/OpenId/HmacShaAssociation.cs
index bf0111d..2eaa8cf 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/HmacShaAssociation.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/HmacShaAssociation.cs
@@ -15,11 +15,11 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An association that uses the HMAC-SHA family of algorithms for message signing.
 	/// </summary>
-	[ContractVerification(true)]
 	internal class HmacShaAssociation : Association {
 		/// <summary>
 		/// A list of HMAC-SHA algorithms in order of decreasing bit lengths.
@@ -43,8 +43,7 @@ namespace DotNetOpenAuth.OpenId {
 			Requires.NotNull(typeIdentity, "typeIdentity");
 			Requires.NotNullOrEmpty(handle, "handle");
 			Requires.NotNull(secret, "secret");
-			Requires.InRange(totalLifeLength > TimeSpan.Zero, "totalLifeLength");
-			Contract.Ensures(this.TotalLifeLength == totalLifeLength);
+			Requires.Range(totalLifeLength > TimeSpan.Zero, "totalLifeLength");
 			ErrorUtilities.VerifyProtocol(secret.Length == typeIdentity.SecretLength, OpenIdStrings.AssociationSecretAndTypeLengthMismatch, secret.Length, typeIdentity.GetAssociationType(Protocol.Default));
 
 			this.typeIdentity = typeIdentity;
@@ -73,7 +72,6 @@ namespace DotNetOpenAuth.OpenId {
 			Requires.NotNull(protocol, "protocol");
 			Requires.NotNullOrEmpty(associationType, "associationType");
 			Requires.NotNull(secret, "secret");
-			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 			HmacSha match = hmacShaAssociationTypes.FirstOrDefault(sha => string.Equals(sha.GetAssociationType(protocol), associationType, StringComparison.Ordinal));
 			ErrorUtilities.VerifyProtocol(match != null, OpenIdStrings.NoAssociationTypeFoundByName, associationType);
 			return new HmacShaAssociation(match, handle, secret, totalLifeLength);
@@ -89,7 +87,6 @@ namespace DotNetOpenAuth.OpenId {
 		public static HmacShaAssociation Create(string handle, byte[] secret, TimeSpan totalLifeLength) {
 			Requires.NotNullOrEmpty(handle, "handle");
 			Requires.NotNull(secret, "secret");
-			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 
 			HmacSha shaType = hmacShaAssociationTypes.FirstOrDefault(sha => sha.SecretLength == secret.Length);
 			ErrorUtilities.VerifyProtocol(shaType != null, OpenIdStrings.NoAssociationTypeFoundByLength, secret.Length);
@@ -211,7 +208,7 @@ namespace DotNetOpenAuth.OpenId {
 		[Pure]
 		protected override HashAlgorithm CreateHasher() {
 			var result = this.typeIdentity.CreateHasher(SecretKey);
-			Contract.Assume(result != null);
+			Assumes.True(result != null);
 			return result;
 		}
 
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/IIdentifierDiscoveryService.cs b/src/DotNetOpenAuth.OpenId/OpenId/IIdentifierDiscoveryService.cs
index 63c3895..20b8f1c 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/IIdentifierDiscoveryService.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/IIdentifierDiscoveryService.cs
@@ -13,11 +13,11 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// A module that provides discovery services for OpenID identifiers.
 	/// </summary>
-	[ContractClass(typeof(IIdentifierDiscoveryServiceContract))]
 	public interface IIdentifierDiscoveryService {
 		/// <summary>
 		/// Performs discovery on the specified identifier.
@@ -32,36 +32,4 @@ namespace DotNetOpenAuth.OpenId {
 		[Pure]
 		IEnumerable<IdentifierDiscoveryResult> Discover(Identifier identifier, IDirectWebRequestHandler requestHandler, out bool abortDiscoveryChain);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IIdentifierDiscoveryService"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IIdentifierDiscoveryService))]
-	internal abstract class IIdentifierDiscoveryServiceContract : IIdentifierDiscoveryService {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IIdentifierDiscoveryServiceContract"/> class from being created.
-		/// </summary>
-		private IIdentifierDiscoveryServiceContract() {
-		}
-
-		#region IDiscoveryService Members
-
-		/// <summary>
-		/// Performs discovery on the specified identifier.
-		/// </summary>
-		/// <param name="identifier">The identifier to perform discovery on.</param>
-		/// <param name="requestHandler">The means to place outgoing HTTP requests.</param>
-		/// <param name="abortDiscoveryChain">if set to <c>true</c>, no further discovery services will be called for this identifier.</param>
-		/// <returns>
-		/// A sequence of service endpoints yielded by discovery.  Must not be null, but may be empty.
-		/// </returns>
-		IEnumerable<IdentifierDiscoveryResult> IIdentifierDiscoveryService.Discover(Identifier identifier, IDirectWebRequestHandler requestHandler, out bool abortDiscoveryChain) {
-			Requires.NotNull(identifier, "identifier");
-			Requires.NotNull(requestHandler, "requestHandler");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/IProviderEndpoint.cs b/src/DotNetOpenAuth.OpenId/OpenId/IProviderEndpoint.cs
index b2b231a..b5c1c03 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/IProviderEndpoint.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/IProviderEndpoint.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
@@ -21,7 +20,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// Because information provided by this interface is suppplied by a 
 	/// user's individually published documents, it may be incomplete or inaccurate.
 	/// </remarks>
-	[ContractClass(typeof(IProviderEndpointContract))]
 	public interface IProviderEndpoint {
 		/// <summary>
 		/// Gets the detected version of OpenID implemented by the Provider.
@@ -67,77 +65,4 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		[Obsolete("Use IAuthenticationRequest.DiscoveryResult.IsExtensionSupported instead.")]
 		bool IsExtensionSupported(Type extensionType);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IProviderEndpoint"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IProviderEndpoint))]
-	internal abstract class IProviderEndpointContract : IProviderEndpoint {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IProviderEndpointContract"/> class from being created.
-		/// </summary>
-		private IProviderEndpointContract() {
-		}
-
-		#region IProviderEndpoint Members
-
-		/// <summary>
-		/// Gets the detected version of OpenID implemented by the Provider.
-		/// </summary>
-		Version IProviderEndpoint.Version {
-			get {
-				Contract.Ensures(Contract.Result<Version>() != null);
-				throw new System.NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the URL that the OpenID Provider receives authentication requests at.
-		/// </summary>
-		Uri IProviderEndpoint.Uri {
-			get {
-				Contract.Ensures(Contract.Result<Uri>() != null);
-				throw new System.NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Checks whether the OpenId Identifier claims support for a given extension.
-		/// </summary>
-		/// <typeparam name="T">The extension whose support is being queried.</typeparam>
-		/// <returns>
-		/// True if support for the extension is advertised.  False otherwise.
-		/// </returns>
-		/// <remarks>
-		/// Note that a true or false return value is no guarantee of a Provider's
-		/// support for or lack of support for an extension.  The return value is
-		/// determined by how the authenticating user filled out his/her XRDS document only.
-		/// The only way to be sure of support for a given extension is to include
-		/// the extension in the request and see if a response comes back for that extension.
-		/// </remarks>
-		bool IProviderEndpoint.IsExtensionSupported<T>() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Checks whether the OpenId Identifier claims support for a given extension.
-		/// </summary>
-		/// <param name="extensionType">The extension whose support is being queried.</param>
-		/// <returns>
-		/// True if support for the extension is advertised.  False otherwise.
-		/// </returns>
-		/// <remarks>
-		/// Note that a true or false return value is no guarantee of a Provider's
-		/// support for or lack of support for an extension.  The return value is
-		/// determined by how the authenticating user filled out his/her XRDS document only.
-		/// The only way to be sure of support for a given extension is to include
-		/// the extension in the request and see if a response comes back for that extension.
-		/// </remarks>
-		bool IProviderEndpoint.IsExtensionSupported(Type extensionType) {
-			Requires.NotNullSubtype<IOpenIdMessageExtension>(extensionType, "extensionType");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Identifier.cs b/src/DotNetOpenAuth.OpenId/OpenId/Identifier.cs
index 3cdd0f3..310ebd2 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Identifier.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Identifier.cs
@@ -12,14 +12,13 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
+	using Validation;
 
 	/// <summary>
 	/// An Identifier is either a "http" or "https" URI, or an XRI.
 	/// </summary>
 	[Serializable]
-	[ContractVerification(true)]
 	[Pure]
-	[ContractClass(typeof(IdentifierContract))]
 	[DefaultEncoder(typeof(IdentifierEncoder))]
 	public abstract class Identifier {
 		/// <summary>
@@ -92,8 +91,7 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2225:OperatorOverloadsHaveNamedAlternates", Justification = "Our named alternate is Parse.")]
 		[DebuggerStepThrough]
 		public static implicit operator Identifier(string identifier) {
-			Requires.True(identifier == null || identifier.Length > 0, "identifier");
-			Contract.Ensures((identifier == null) == (Contract.Result<Identifier>() == null));
+			Requires.That(identifier == null || identifier.Length > 0, "identifier", "Empty string cannot be translated to an identifier.");
 
 			if (identifier == null) {
 				return null;
@@ -109,7 +107,6 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2225:OperatorOverloadsHaveNamedAlternates", Justification = "We have a Parse function.")]
 		[DebuggerStepThrough]
 		public static implicit operator Identifier(Uri identifier) {
-			Contract.Ensures((identifier == null) == (Contract.Result<Identifier>() == null));
 			if (identifier == null) {
 				return null;
 			}
@@ -125,7 +122,6 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2225:OperatorOverloadsHaveNamedAlternates", Justification = "We have a Parse function.")]
 		[DebuggerStepThrough]
 		public static implicit operator string(Identifier identifier) {
-			Contract.Ensures((identifier == null) == (Contract.Result<string>() == null));
 			if (identifier == null) {
 				return null;
 			}
@@ -141,7 +137,6 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Some of these identifiers are not properly formatted to be Uris at this stage.")]
 		public static Identifier Parse(string identifier) {
 			Requires.NotNullOrEmpty(identifier, "identifier");
-			Contract.Ensures(Contract.Result<Identifier>() != null);
 
 			return Parse(identifier, false);
 		}
@@ -158,7 +153,6 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Some of these identifiers are not properly formatted to be Uris at this stage.")]
 		public static Identifier Parse(string identifier, bool serializeExactValue) {
 			Requires.NotNullOrEmpty(identifier, "identifier");
-			Contract.Ensures(Contract.Result<Identifier>() != null);
 
 			Identifier id;
 			if (XriIdentifier.IsValidXri(identifier)) {
@@ -265,7 +259,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>Either <see cref="XriIdentifier"/> or <see cref="UriIdentifier"/>.</returns>
 		internal static Identifier Reparse(Identifier identifier) {
 			Requires.NotNull(identifier, "identifier");
-			Contract.Ensures(Contract.Result<Identifier>() != null);
 
 			return Parse(identifier, identifier.IsDeserializedInstance);
 		}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierContract.cs b/src/DotNetOpenAuth.OpenId/OpenId/IdentifierContract.cs
deleted file mode 100644
index 0156d12..0000000
--- a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierContract.cs
+++ /dev/null
@@ -1,56 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="IdentifierContract.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.OpenId {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using DotNetOpenAuth.Messaging;
-
-	/// <summary>
-	/// Code Contract for the <see cref="Identifier"/> class.
-	/// </summary>
-	[ContractClassFor(typeof(Identifier))]
-	internal abstract class IdentifierContract : Identifier {
-		/// <summary>
-		/// Prevents a default instance of the IdentifierContract class from being created.
-		/// </summary>
-		private IdentifierContract()
-			: base(null, false) {
-		}
-
-		/// <summary>
-		/// Returns an <see cref="Identifier"/> that has no URI fragment.
-		/// Quietly returns the original <see cref="Identifier"/> if it is not
-		/// a <see cref="UriIdentifier"/> or no fragment exists.
-		/// </summary>
-		/// <returns>
-		/// A new <see cref="Identifier"/> instance if there was a
-		/// fragment to remove, otherwise this same instance..
-		/// </returns>
-		internal override Identifier TrimFragment() {
-			Contract.Ensures(Contract.Result<Identifier>() != null);
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Converts a given identifier to its secure equivalent.
-		/// UriIdentifiers originally created with an implied HTTP scheme change to HTTPS.
-		/// Discovery is made to require SSL for the entire resolution process.
-		/// </summary>
-		/// <param name="secureIdentifier">The newly created secure identifier.
-		/// If the conversion fails, <paramref name="secureIdentifier"/> retains
-		/// <i>this</i> identifiers identity, but will never discover any endpoints.</param>
-		/// <returns>
-		/// True if the secure conversion was successful.
-		/// False if the Identifier was originally created with an explicit HTTP scheme.
-		/// </returns>
-		internal override bool TryRequireSsl(out Identifier secureIdentifier) {
-			Contract.Ensures(Contract.ValueAtReturn(out secureIdentifier) != null);
-			throw new NotImplementedException();
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryResult.cs b/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryResult.cs
index ab69bf6..c7eabf0 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryResult.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryResult.cs
@@ -10,7 +10,6 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Collections.ObjectModel;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Represents a single OP endpoint from discovery on some OpenID Identifier.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryServices.cs b/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryServices.cs
index 6a3cfaa..1b20d4e 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryServices.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/IdentifierDiscoveryServices.cs
@@ -6,10 +6,10 @@
 
 namespace DotNetOpenAuth.OpenId {
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A service that can perform discovery on OpenID identifiers.
@@ -50,7 +50,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A non-null sequence of services discovered for the identifier.</returns>
 		public IEnumerable<IdentifierDiscoveryResult> Discover(Identifier identifier) {
 			Requires.NotNull(identifier, "identifier");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 
 			IEnumerable<IdentifierDiscoveryResult> results = Enumerable.Empty<IdentifierDiscoveryResult>();
 			foreach (var discoverer in this.DiscoveryServices) {
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateDiffieHellmanResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateDiffieHellmanResponse.cs
index 3860565..1510e97 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateDiffieHellmanResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateDiffieHellmanResponse.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateRequest.cs
index 1e716e2..1eaf7b6 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateRequest.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponse.cs
index 6605530..8daafbd 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponse.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -20,7 +19,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	/// Association response messages are described in OpenID 2.0 section 8.2.  This type covers section 8.2.1.
 	/// </remarks>
 	[DebuggerDisplay("OpenID {Version} associate response {AssociationHandle} {AssociationType} {SessionType}")]
-	[ContractClass(typeof(AssociateSuccessfulResponseContract))]
 	internal abstract class AssociateSuccessfulResponse : DirectResponseBase {
 		/// <summary>
 		/// Initializes a new instance of the <see cref="AssociateSuccessfulResponse"/> class.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponseContract.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponseContract.cs
deleted file mode 100644
index 39a79a4..0000000
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/AssociateSuccessfulResponseContract.cs
+++ /dev/null
@@ -1,17 +0,0 @@
-// <auto-generated />
-
-namespace DotNetOpenAuth.OpenId.Messages {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-
-	[ContractClassFor(typeof(AssociateSuccessfulResponse))]
-	internal abstract class AssociateSuccessfulResponseContract : AssociateSuccessfulResponse {
-		protected AssociateSuccessfulResponseContract() : base(null, null) {
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationRequest.cs
index 0c46411..93cf9d7 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationRequest.cs
@@ -7,12 +7,12 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OpenId.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// A message a Relying Party sends to a Provider to confirm the validity
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationResponse.cs
index 9c31ea5..ee9a0b0 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/CheckAuthenticationResponse.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/DirectResponseBase.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/DirectResponseBase.cs
index 787c920..a081159 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/DirectResponseBase.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/DirectResponseBase.cs
@@ -9,8 +9,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A common base class for OpenID direct message responses.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IOpenIdMessageExtension.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IOpenIdMessageExtension.cs
index dabb752..a7e2268 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IOpenIdMessageExtension.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IOpenIdMessageExtension.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -20,7 +19,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	/// [<see cref="SerializableAttribute"/>] to allow serializing state servers
 	/// to cache messages, particularly responses.
 	/// </remarks>
-	[ContractClass(typeof(IOpenIdMessageExtensionContract))]
 	public interface IOpenIdMessageExtension : IExtensionMessage {
 		/// <summary>
 		/// Gets the TypeURI the extension uses in the OpenID protocol and in XRDS advertisements.
@@ -53,108 +51,4 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// </value>
 		bool IsSignedByRemoteParty { get; set; }
 	}
-
-	/// <summary>
-	/// Code contract class for the IOpenIdMessageExtension interface.
-	/// </summary>
-	[ContractClassFor(typeof(IOpenIdMessageExtension))]
-	internal abstract class IOpenIdMessageExtensionContract : IOpenIdMessageExtension {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IOpenIdMessageExtensionContract"/> class from being created.
-		/// </summary>
-		private IOpenIdMessageExtensionContract() {
-		}
-
-		#region IOpenIdMessageExtension Members
-
-		/// <summary>
-		/// Gets the TypeURI the extension uses in the OpenID protocol and in XRDS advertisements.
-		/// </summary>
-		string IOpenIdMessageExtension.TypeUri {
-			get {
-				Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the additional TypeURIs that are supported by this extension, in preferred order.
-		/// May be empty if none other than <see cref="IOpenIdMessageExtension.TypeUri"/> is supported, but
-		/// should not be null.
-		/// </summary>
-		/// <remarks>
-		/// Useful for reading in messages with an older version of an extension.
-		/// The value in the <see cref="IOpenIdMessageExtension.TypeUri"/> property is always checked before
-		/// trying this list.
-		/// If you do support multiple versions of an extension using this method,
-		/// consider adding a CreateResponse method to your request extension class
-		/// so that the response can have the context it needs to remain compatible
-		/// given the version of the extension in the request message.
-		/// The <see cref="Extensions.SimpleRegistration.ClaimsRequest.CreateResponse"/> for an example.
-		/// </remarks>
-		IEnumerable<string> IOpenIdMessageExtension.AdditionalSupportedTypeUris {
-			get {
-				Contract.Ensures(Contract.Result<IEnumerable<string>>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets or sets a value indicating whether this extension was
-		/// signed by the sender.
-		/// </summary>
-		/// <value>
-		/// 	<c>true</c> if this instance is signed by the sender; otherwise, <c>false</c>.
-		/// </value>
-		bool IOpenIdMessageExtension.IsSignedByRemoteParty {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		#endregion
-
-		#region IMessage Members
-
-		/// <summary>
-		/// Gets the version of the protocol or extension this message is prepared to implement.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		Version IMessage.Version {
-			get {
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets the extra, non-standard Protocol parameters included in the message.
-		/// </summary>
-		/// <remarks>
-		/// Implementations of this interface should ensure that this property never returns null.
-		/// </remarks>
-		IDictionary<string, string> IMessage.ExtraData {
-			get {
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Checks the message state for conformity to the protocol specification
-		/// and throws an exception if the message is invalid.
-		/// </summary>
-		/// <remarks>
-		/// 	<para>Some messages have required fields, or combinations of fields that must relate to each other
-		/// in specialized ways.  After deserializing a message, this method checks the state of the
-		/// message to see if it conforms to the protocol.</para>
-		/// 	<para>Note that this property should <i>not</i> check signatures or perform any state checks
-		/// outside this scope of this particular message.</para>
-		/// </remarks>
-		/// <exception cref="ProtocolException">Thrown if the message is invalid.</exception>
-		void IMessage.EnsureValidMessage() {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectResponseBase.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectResponseBase.cs
index ae0217d..cd56175 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectResponseBase.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectResponseBase.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A common base class from which indirect response messages should derive.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectSignedResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectSignedResponse.cs
index 8bceb68..51d6805 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectSignedResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/IndirectSignedResponse.cs
@@ -10,7 +10,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System.Collections.Specialized;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Net.Security;
@@ -19,6 +18,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OpenId.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// An indirect message from a Provider to a Relying Party where at least part of the
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/NegativeAssertionResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/NegativeAssertionResponse.cs
index 43fd6f5..9aac107 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/NegativeAssertionResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/NegativeAssertionResponse.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// The message OpenID Providers send back to Relying Parties to refuse
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/RequestBase.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/RequestBase.cs
index 678dcee..f91dc96 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/RequestBase.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/RequestBase.cs
@@ -9,8 +9,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A common base class for OpenID request messages and indirect responses (since they are ultimately requests).
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Messages/SignedResponseRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Messages/SignedResponseRequest.cs
index a2ebb64..688bb40 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Messages/SignedResponseRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Messages/SignedResponseRequest.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An indirect request from a Relying Party to a Provider where the response
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/NoDiscoveryIdentifier.cs b/src/DotNetOpenAuth.OpenId/OpenId/NoDiscoveryIdentifier.cs
index c439f1f..aa12067 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/NoDiscoveryIdentifier.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/NoDiscoveryIdentifier.cs
@@ -10,11 +10,11 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Wraps an existing Identifier and prevents it from performing discovery.
 	/// </summary>
-	[ContractVerification(true)]
 	[Pure]
 	internal class NoDiscoveryIdentifier : Identifier {
 		/// <summary>
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/OpenIdUtilities.cs b/src/DotNetOpenAuth.OpenId/OpenId/OpenIdUtilities.cs
index a5202de..e04a633 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/OpenIdUtilities.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/OpenIdUtilities.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -19,6 +18,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using Org.Mentalis.Security.Cryptography;
+	using Validation;
 
 	/// <summary>
 	/// A set of utilities especially useful to OpenID.
@@ -69,8 +69,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		/// <returns>The association handle.</returns>
 		public static string GenerateRandomAssociationHandle() {
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
-
 			// Generate the handle.  It must be unique, and preferably unpredictable,
 			// so we use a time element and a random data element to generate it.
 			string uniq = MessagingUtilities.GetCryptoRandomDataAsBase64(4);
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/OpenIdXrdsHelper.cs b/src/DotNetOpenAuth.OpenId/OpenId/OpenIdXrdsHelper.cs
index 284f8db..4fca2af 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/OpenIdXrdsHelper.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/OpenIdXrdsHelper.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Xrds;
+	using Validation;
 
 	/// <summary>
 	/// Utility methods for working with XRDS documents.
@@ -27,7 +27,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </remarks>
 		internal static IEnumerable<RelyingPartyEndpointDescription> FindRelyingPartyReceivingEndpoints(this XrdsDocument xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<RelyingPartyEndpointDescription>>() != null);
 
 			return from service in xrds.FindReturnToServices()
 				   from uri in service.UriElements
@@ -42,7 +41,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A sequence of the icon URLs in preferred order.</returns>
 		internal static IEnumerable<Uri> FindRelyingPartyIcons(this XrdsDocument xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<Uri>>() != null);
 
 			return from xrd in xrds.XrdElements
 				   from service in xrd.OpenIdRelyingPartyIcons
@@ -58,7 +56,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A sequence of service elements.</returns>
 		private static IEnumerable<ServiceElement> FindReturnToServices(this XrdsDocument xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<ServiceElement>>() != null);
 
 			return from xrd in xrds.XrdElements
 				   from service in xrd.OpenIdRelyingPartyReturnToServices
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Protocol.cs b/src/DotNetOpenAuth.OpenId/OpenId/Protocol.cs
index 22f5b9c..7ef3ab5 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Protocol.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Protocol.cs
@@ -11,8 +11,8 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging;
 	using System.Globalization;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Diagnostics;
+	using Validation;
 
 	/// <summary>
 	/// An enumeration of the OpenID protocol versions supported by this library.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IAuthenticationRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IAuthenticationRequest.cs
index 5e8efa5..0b121b7 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IAuthenticationRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IAuthenticationRequest.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 
@@ -16,7 +15,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	/// This interface provides the details of the request and allows setting
 	/// the response.
 	/// </summary>
-	[ContractClass(typeof(IAuthenticationRequestContract))]
 	public interface IAuthenticationRequest : IHostProcessedRequest {
 		/// <summary>
 		/// Gets a value indicating whether the Provider should help the user 
@@ -95,273 +93,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </exception>
 		void SetClaimedIdentifierFragment(string fragment);
 	}
-
-	/// <summary>
-	/// Code contract class for the <see cref="IAuthenticationRequest"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IAuthenticationRequest))]
-	internal abstract class IAuthenticationRequestContract : IAuthenticationRequest {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="IAuthenticationRequestContract"/> class.
-		/// </summary>
-		protected IAuthenticationRequestContract() {
-		}
-
-		#region IAuthenticationRequest Properties
-
-		/// <summary>
-		/// Gets a value indicating whether the Provider should help the user
-		/// select a Claimed Identifier to send back to the relying party.
-		/// </summary>
-		bool IAuthenticationRequest.IsDirectedIdentity {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the requesting Relying Party is using a delegated URL.
-		/// </summary>
-		/// <remarks>
-		/// When delegated identifiers are used, the <see cref="IAuthenticationRequest.ClaimedIdentifier"/> should not
-		/// be changed at the Provider during authentication.
-		/// Delegation is only detectable on requests originating from OpenID 2.0 relying parties.
-		/// A relying party implementing only OpenID 1.x may use delegation and this property will
-		/// return false anyway.
-		/// </remarks>
-		bool IAuthenticationRequest.IsDelegatedIdentifier {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets or sets the Local Identifier to this OpenID Provider of the user attempting
-		/// to authenticate.  Check <see cref="IAuthenticationRequest.IsDirectedIdentity"/> to see if
-		/// this value is valid.
-		/// </summary>
-		/// <remarks>
-		/// This may or may not be the same as the Claimed Identifier that the user agent
-		/// originally supplied to the relying party.  The Claimed Identifier
-		/// endpoint may be delegating authentication to this provider using
-		/// this provider's local id, which is what this property contains.
-		/// Use this identifier when looking up this user in the provider's user account
-		/// list.
-		/// </remarks>
-		Identifier IAuthenticationRequest.LocalIdentifier {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		/// <summary>
-		/// Gets or sets the identifier that the user agent is claiming at the relying party site.
-		/// Check <see cref="IAuthenticationRequest.IsDirectedIdentity"/> to see if this value is valid.
-		/// </summary>
-		/// <remarks>
-		/// 	<para>This property can only be set if <see cref="IAuthenticationRequest.IsDelegatedIdentifier"/> is
-		/// false, to prevent breaking URL delegation.</para>
-		/// 	<para>This will not be the same as this provider's local identifier for the user
-		/// if the user has set up his/her own identity page that points to this
-		/// provider for authentication.</para>
-		/// 	<para>The provider may use this identifier for displaying to the user when
-		/// asking for the user's permission to authenticate to the relying party.</para>
-		/// </remarks>
-		/// <exception cref="InvalidOperationException">Thrown from the setter
-		/// if <see cref="IAuthenticationRequest.IsDelegatedIdentifier"/> is true.</exception>
-		Identifier IAuthenticationRequest.ClaimedIdentifier {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				IAuthenticationRequest req = this;
-				Requires.ValidState(!req.IsDelegatedIdentifier, OpenIdStrings.ClaimedIdentifierCannotBeSetOnDelegatedAuthentication);
-				Requires.ValidState(!req.IsDirectedIdentity || !(req.LocalIdentifier != null && req.LocalIdentifier != value), OpenIdStrings.IdentifierSelectRequiresMatchingIdentifiers);
-			}
-		}
-
-		/// <summary>
-		/// Gets or sets a value indicating whether the provider has determined that the
-		/// <see cref="IAuthenticationRequest.ClaimedIdentifier"/> belongs to the currently logged in user
-		/// and wishes to share this information with the consumer.
-		/// </summary>
-		bool? IAuthenticationRequest.IsAuthenticated {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IHostProcessedRequest Properties
-
-		/// <summary>
-		/// Gets the version of OpenID being used by the relying party that sent the request.
-		/// </summary>
-		ProtocolVersion IHostProcessedRequest.RelyingPartyVersion {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the URL the consumer site claims to use as its 'base' address.
-		/// </summary>
-		Realm IHostProcessedRequest.Realm {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the consumer demands an immediate response.
-		/// If false, the consumer is willing to wait for the identity provider
-		/// to authenticate the user.
-		/// </summary>
-		bool IHostProcessedRequest.Immediate {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets or sets the provider endpoint claimed in the positive assertion.
-		/// </summary>
-		/// <value>
-		/// The default value is the URL that the request came in on from the relying party.
-		/// This value MUST match the value for the OP Endpoint in the discovery results for the
-		/// claimed identifier being asserted in a positive response.
-		/// </value>
-		Uri IHostProcessedRequest.ProviderEndpoint {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IRequest Properties
-
-		/// <summary>
-		/// Gets a value indicating whether the response is ready to be sent to the user agent.
-		/// </summary>
-		/// <remarks>
-		/// This property returns false if there are properties that must be set on this
-		/// request instance before the response can be sent.
-		/// </remarks>
-		bool IRequest.IsResponseReady {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets or sets the security settings that apply to this request.
-		/// </summary>
-		/// <value>
-		/// Defaults to the OpenIdProvider.SecuritySettings on the OpenIdProvider.
-		/// </value>
-		ProviderSecuritySettings IRequest.SecuritySettings {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IAuthenticationRequest Methods
-
-		/// <summary>
-		/// Adds an optional fragment (#fragment) portion to the ClaimedIdentifier.
-		/// Useful for identifier recycling.
-		/// </summary>
-		/// <param name="fragment">Should not include the # prefix character as that will be added internally.
-		/// May be null or the empty string to clear a previously set fragment.</param>
-		/// <remarks>
-		/// 	<para>Unlike the <see cref="IAuthenticationRequest.ClaimedIdentifier"/> property, which can only be set if
-		/// using directed identity, this method can be called on any URI claimed identifier.</para>
-		/// 	<para>Because XRI claimed identifiers (the canonical IDs) are never recycled,
-		/// this method should<i>not</i> be called for XRIs.</para>
-		/// </remarks>
-		/// <exception cref="InvalidOperationException">
-		/// Thrown when this method is called on an XRI, or on a directed identity
-		/// request before the <see cref="IAuthenticationRequest.ClaimedIdentifier"/> property is set.
-		/// </exception>
-		void IAuthenticationRequest.SetClaimedIdentifierFragment(string fragment) {
-			Requires.ValidState(!(((IAuthenticationRequest)this).IsDirectedIdentity && ((IAuthenticationRequest)this).ClaimedIdentifier == null), OpenIdStrings.ClaimedIdentifierMustBeSetFirst);
-			Requires.ValidState(!(((IAuthenticationRequest)this).ClaimedIdentifier is XriIdentifier), OpenIdStrings.FragmentNotAllowedOnXRIs);
-
-			throw new NotImplementedException();
-		}
-
-		#endregion
-
-		#region IHostProcessedRequest Methods
-
-		/// <summary>
-		/// Attempts to perform relying party discovery of the return URL claimed by the Relying Party.
-		/// </summary>
-		/// <param name="webRequestHandler">The web request handler to use for the RP discovery request.</param>
-		/// <returns>
-		/// The details of how successful the relying party discovery was.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>Return URL verification is only attempted if this method is called.</para>
-		/// 	<para>See OpenID Authentication 2.0 spec section 9.2.1.</para>
-		/// </remarks>
-		RelyingPartyDiscoveryResult IHostProcessedRequest.IsReturnUrlDiscoverable(IDirectWebRequestHandler webRequestHandler) {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-
-		#region IRequest Methods
-
-		/// <summary>
-		/// Adds an extension to the response to send to the relying party.
-		/// </summary>
-		/// <param name="extension">The extension to add to the response message.</param>
-		void IRequest.AddResponseExtension(DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension extension) {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Removes any response extensions previously added using <see cref="IRequest.AddResponseExtension"/>.
-		/// </summary>
-		/// <remarks>
-		/// This should be called before sending a negative response back to the relying party
-		/// if extensions were already added, since negative responses cannot carry extensions.
-		/// </remarks>
-		void IRequest.ClearResponseExtensions() {
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <typeparam name="T">The type of the extension.</typeparam>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		T IRequest.GetExtension<T>() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <param name="extensionType">The type of the extension.</param>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension IRequest.GetExtension(Type extensionType) {
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IHostProcessedRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IHostProcessedRequest.cs
index 236f4a8..4a464b9 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IHostProcessedRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IHostProcessedRequest.cs
@@ -6,15 +6,14 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Interface exposing incoming messages to the OpenID Provider that
 	/// require interaction with the host site.
 	/// </summary>
-	[ContractClass(typeof(IHostProcessedRequestContract))]
 	public interface IHostProcessedRequest : IRequest {
 		/// <summary>
 		/// Gets the version of OpenID being used by the relying party that sent the request.
@@ -56,147 +55,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </remarks>
 		RelyingPartyDiscoveryResult IsReturnUrlDiscoverable(IDirectWebRequestHandler webRequestHandler);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IHostProcessedRequest"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IHostProcessedRequest))]
-	internal abstract class IHostProcessedRequestContract : IHostProcessedRequest {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="IHostProcessedRequestContract"/> class.
-		/// </summary>
-		protected IHostProcessedRequestContract() {
-		}
-
-		#region IHostProcessedRequest Properties
-
-		/// <summary>
-		/// Gets the version of OpenID being used by the relying party that sent the request.
-		/// </summary>
-		ProtocolVersion IHostProcessedRequest.RelyingPartyVersion {
-			get { throw new System.NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the URL the consumer site claims to use as its 'base' address.
-		/// </summary>
-		Realm IHostProcessedRequest.Realm {
-			get { throw new System.NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the consumer demands an immediate response.
-		/// If false, the consumer is willing to wait for the identity provider
-		/// to authenticate the user.
-		/// </summary>
-		bool IHostProcessedRequest.Immediate {
-			get { throw new System.NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets or sets the provider endpoint.
-		/// </summary>
-		/// <value>
-		/// The default value is the URL that the request came in on from the relying party.
-		/// </value>
-		Uri IHostProcessedRequest.ProviderEndpoint {
-			get {
-				Contract.Ensures(Contract.Result<Uri>() != null);
-				throw new NotImplementedException();
-			}
-
-			set {
-				Contract.Requires(value != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		#endregion
-
-		#region IRequest Members
-
-		/// <summary>
-		/// Gets or sets the security settings that apply to this request.
-		/// </summary>
-		/// <value>
-		/// Defaults to the OpenIdProvider.SecuritySettings on the OpenIdProvider.
-		/// </value>
-		ProviderSecuritySettings IRequest.SecuritySettings {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the response is ready to be sent to the user agent.
-		/// </summary>
-		/// <remarks>
-		/// This property returns false if there are properties that must be set on this
-		/// request instance before the response can be sent.
-		/// </remarks>
-		bool IRequest.IsResponseReady {
-			get { throw new System.NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Adds an extension to the response to send to the relying party.
-		/// </summary>
-		/// <param name="extension">The extension to add to the response message.</param>
-		void IRequest.AddResponseExtension(DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension extension) {
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Removes any response extensions previously added using <see cref="IRequest.AddResponseExtension"/>.
-		/// </summary>
-		/// <remarks>
-		/// This should be called before sending a negative response back to the relying party
-		/// if extensions were already added, since negative responses cannot carry extensions.
-		/// </remarks>
-		void IRequest.ClearResponseExtensions() {
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <typeparam name="T">The type of the extension.</typeparam>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		T IRequest.GetExtension<T>() {
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <param name="extensionType">The type of the extension.</param>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension IRequest.GetExtension(System.Type extensionType) {
-			throw new System.NotImplementedException();
-		}
-
-		#endregion
-
-		#region IHostProcessedRequest Methods
-
-		/// <summary>
-		/// Attempts to perform relying party discovery of the return URL claimed by the Relying Party.
-		/// </summary>
-		/// <param name="webRequestHandler">The web request handler.</param>
-		/// <returns>
-		/// The details of how successful the relying party discovery was.
-		/// </returns>
-		/// <remarks>
-		///   <para>Return URL verification is only attempted if this method is called.</para>
-		///   <para>See OpenID Authentication 2.0 spec section 9.2.1.</para>
-		/// </remarks>
-		RelyingPartyDiscoveryResult IHostProcessedRequest.IsReturnUrlDiscoverable(IDirectWebRequestHandler webRequestHandler) {
-			Requires.NotNull(webRequestHandler, "webRequestHandler");
-			throw new System.NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IProviderBehavior.cs b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IProviderBehavior.cs
index 840fe3a..57fe66b 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IProviderBehavior.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IProviderBehavior.cs
@@ -6,13 +6,12 @@
 
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.OpenId.ChannelElements;
+	using Validation;
 
 	/// <summary>
 	/// Applies a custom security policy to certain OpenID security settings and behaviors.
 	/// </summary>
-	[ContractClass(typeof(IProviderBehaviorContract))]
 	public interface IProviderBehavior {
 		/// <summary>
 		/// Applies a well known set of security requirements to a default set of security settings.
@@ -50,65 +49,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </returns>
 		bool OnOutgoingResponse(IAuthenticationRequest request);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IProviderBehavior"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IProviderBehavior))]
-	internal abstract class IProviderBehaviorContract : IProviderBehavior {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="IProviderBehaviorContract"/> class.
-		/// </summary>
-		protected IProviderBehaviorContract() {
-		}
-
-		#region IProviderBehavior Members
-
-		/// <summary>
-		/// Applies a well known set of security requirements to a default set of security settings.
-		/// </summary>
-		/// <param name="securitySettings">The security settings to enhance with the requirements of this profile.</param>
-		/// <remarks>
-		/// Care should be taken to never decrease security when applying a profile.
-		/// Profiles should only enhance security requirements to avoid being
-		/// incompatible with each other.
-		/// </remarks>
-		void IProviderBehavior.ApplySecuritySettings(ProviderSecuritySettings securitySettings) {
-			Requires.NotNull(securitySettings, "securitySettings");
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Called when a request is received by the Provider.
-		/// </summary>
-		/// <param name="request">The incoming request.</param>
-		/// <returns>
-		/// 	<c>true</c> if this behavior owns this request and wants to stop other behaviors
-		/// from handling it; <c>false</c> to allow other behaviors to process this request.
-		/// </returns>
-		/// <remarks>
-		/// Implementations may set a new value to <see cref="IRequest.SecuritySettings"/> but
-		/// should not change the properties on the instance of <see cref="ProviderSecuritySettings"/>
-		/// itself as that instance may be shared across many requests.
-		/// </remarks>
-		bool IProviderBehavior.OnIncomingRequest(IRequest request) {
-			Requires.NotNull(request, "request");
-			throw new System.NotImplementedException();
-		}
-
-		/// <summary>
-		/// Called when the Provider is preparing to send a response to an authentication request.
-		/// </summary>
-		/// <param name="request">The request that is configured to generate the outgoing response.</param>
-		/// <returns>
-		/// 	<c>true</c> if this behavior owns this request and wants to stop other behaviors
-		/// from handling it; <c>false</c> to allow other behaviors to process this request.
-		/// </returns>
-		bool IProviderBehavior.OnOutgoingResponse(IAuthenticationRequest request) {
-			Requires.NotNull(request, "request");
-			throw new System.NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IRequest.cs
index 0e29792..791237f 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Provider/IRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Provider/IRequest.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// Represents an incoming OpenId authentication request.
@@ -21,7 +21,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	/// be authentication requests where the Provider site has to make decisions based
 	/// on its own user database and policies.
 	/// </remarks>
-	[ContractClass(typeof(IRequestContract))]
 	public interface IRequest {
 		/// <summary>
 		/// Gets a value indicating whether the response is ready to be sent to the user agent.
@@ -68,82 +67,4 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <returns>An instance of the extension initialized with values passed in with the request.</returns>
 		IOpenIdMessageExtension GetExtension(Type extensionType);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IRequest"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IRequest))]
-	internal abstract class IRequestContract : IRequest {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IRequestContract"/> class from being created.
-		/// </summary>
-		private IRequestContract() {
-		}
-
-		#region IRequest Members
-
-		/// <summary>
-		/// Gets or sets the security settings that apply to this request.
-		/// </summary>
-		/// <value>Defaults to the OpenIdProvider.SecuritySettings on the OpenIdProvider.</value>
-		ProviderSecuritySettings IRequest.SecuritySettings {
-			get { throw new NotImplementedException(); }
-			set { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a value indicating whether the response is ready to be sent to the user agent.
-		/// </summary>
-		/// <remarks>
-		/// This property returns false if there are properties that must be set on this
-		/// request instance before the response can be sent.
-		/// </remarks>
-		bool IRequest.IsResponseReady {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Adds an extension to the response to send to the relying party.
-		/// </summary>
-		/// <param name="extension">The extension to add to the response message.</param>
-		void IRequest.AddResponseExtension(IOpenIdMessageExtension extension) {
-			Requires.NotNull(extension, "extension");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Removes any response extensions previously added using <see cref="IRequest.AddResponseExtension"/>.
-		/// </summary>
-		/// <remarks>
-		/// This should be called before sending a negative response back to the relying party
-		/// if extensions were already added, since negative responses cannot carry extensions.
-		/// </remarks>
-		void IRequest.ClearResponseExtensions() {
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <typeparam name="T">The type of the extension.</typeparam>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		T IRequest.GetExtension<T>() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets an extension sent from the relying party.
-		/// </summary>
-		/// <param name="extensionType">The type of the extension.</param>
-		/// <returns>
-		/// An instance of the extension initialized with values passed in with the request.
-		/// </returns>
-		IOpenIdMessageExtension IRequest.GetExtension(Type extensionType) {
-			Requires.NotNull(extensionType, "extensionType");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/ProviderEndpointDescription.cs b/src/DotNetOpenAuth.OpenId/OpenId/ProviderEndpointDescription.cs
index 7cac8c6..ff87795 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/ProviderEndpointDescription.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/ProviderEndpointDescription.cs
@@ -9,11 +9,11 @@ namespace DotNetOpenAuth.OpenId {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Describes some OpenID Provider endpoint and its capabilities.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/Realm.cs b/src/DotNetOpenAuth.OpenId/OpenId/Realm.cs
index 8f1baed..c1a959e 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/Realm.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/Realm.cs
@@ -19,6 +19,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.Xrds;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	/// <summary>
 	/// A trust root to validate requests and match return URLs against.
@@ -113,8 +114,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// </remarks>
 		public static Realm AutoDetect {
 			get {
-				Requires.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
-				Contract.Ensures(Contract.Result<Realm>() != null);
+				RequiresEx.ValidState(HttpContext.Current != null && HttpContext.Current.Request != null, MessagingStrings.HttpContextRequired);
 
 				var realmUrl = new UriBuilder(MessagingUtilities.GetWebRoot());
 
@@ -260,7 +260,6 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Not all Realms are valid URLs.")]
 		[DebuggerStepThrough]
 		public static implicit operator Realm(string uri) {
-			Contract.Ensures((Contract.Result<Realm>() != null) == (uri != null));
 			return uri != null ? new Realm(uri) : null;
 		}
 
@@ -271,7 +270,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The result of the conversion.</returns>
 		[DebuggerStepThrough]
 		public static implicit operator Realm(Uri uri) {
-			Contract.Ensures((Contract.Result<Realm>() != null) == (uri != null));
 			return uri != null ? new Realm(uri) : null;
 		}
 
@@ -282,7 +280,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The result of the conversion.</returns>
 		[DebuggerStepThrough]
 		public static implicit operator string(Realm realm) {
-			Contract.Ensures((Contract.Result<string>() != null) == (realm != null));
 			return realm != null ? realm.ToString() : null;
 		}
 
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequest.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequest.cs
index 92e3233..886029c 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequest.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequest.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -18,7 +17,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// requests that may be queried/modified in specific ways before being
 	/// routed to the OpenID Provider.
 	/// </summary>
-	[ContractClass(typeof(IAuthenticationRequestContract))]
 	public interface IAuthenticationRequest {
 		/// <summary>
 		/// Gets or sets the mode the Provider should use during authentication.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequestContract.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequestContract.cs
deleted file mode 100644
index 4ddc6ae..0000000
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationRequestContract.cs
+++ /dev/null
@@ -1,111 +0,0 @@
-// <auto-generated />
-
-namespace DotNetOpenAuth.OpenId.RelyingParty {
-	using System;
-	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
-	using System.Linq;
-	using System.Text;
-	using DotNetOpenAuth.Messaging;
-	using DotNetOpenAuth.OpenId.Messages;
-
-	[ContractClassFor(typeof(IAuthenticationRequest))]
-	internal abstract class IAuthenticationRequestContract : IAuthenticationRequest {
-		#region IAuthenticationRequest Members
-
-		AuthenticationRequestMode IAuthenticationRequest.Mode {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		OutgoingWebResponse IAuthenticationRequest.RedirectingResponse {
-			get { throw new NotImplementedException(); }
-		}
-
-		Uri IAuthenticationRequest.ReturnToUrl {
-			get { throw new NotImplementedException(); }
-		}
-
-		Realm IAuthenticationRequest.Realm {
-			get {
-				Contract.Ensures(Contract.Result<Realm>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		Identifier IAuthenticationRequest.ClaimedIdentifier {
-			get {
-				throw new NotImplementedException();
-			}
-		}
-
-		bool IAuthenticationRequest.IsDirectedIdentity {
-			get { throw new NotImplementedException(); }
-		}
-
-		bool IAuthenticationRequest.IsExtensionOnly {
-			get {
-				throw new NotImplementedException();
-			}
-
-			set {
-				throw new NotImplementedException();
-			}
-		}
-
-		IProviderEndpoint IAuthenticationRequest.Provider {
-			get {
-				Contract.Ensures(Contract.Result<IProviderEndpoint>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		IdentifierDiscoveryResult IAuthenticationRequest.DiscoveryResult {
-			get {
-				Contract.Ensures(Contract.Result<IdentifierDiscoveryResult>() != null);
-				throw new NotImplementedException();
-			}
-		}
-
-		void IAuthenticationRequest.AddCallbackArguments(IDictionary<string, string> arguments) {
-			Requires.NotNull(arguments, "arguments");
-			Requires.True(arguments.Keys.All(k => !string.IsNullOrEmpty(k)), "arguments");
-			Requires.True(arguments.Values.All(v => v != null), "arguments");
-			throw new NotImplementedException();
-		}
-
-		void IAuthenticationRequest.AddCallbackArguments(string key, string value) {
-			Requires.NotNullOrEmpty(key, "key");
-			Requires.NotNull(value, "value");
-			throw new NotImplementedException();
-		}
-
-		void IAuthenticationRequest.SetCallbackArgument(string key, string value) {
-			Requires.NotNullOrEmpty(key, "key");
-			Requires.NotNull(value, "value");
-			throw new NotImplementedException();
-		}
-
-		void IAuthenticationRequest.AddExtension(IOpenIdMessageExtension extension) {
-			Requires.NotNull(extension, "extension");
-			throw new NotImplementedException();
-		}
-
-		void IAuthenticationRequest.RedirectToProvider() {
-			throw new NotImplementedException();
-		}
-
-		void IAuthenticationRequest.SetUntrustedCallbackArgument(string key, string value) {
-			Requires.NotNullOrEmpty(key, "key");
-			Requires.NotNull(value, "value");
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
-}
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationResponse.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationResponse.cs
index 10e99e4..bfdc65d 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IAuthenticationResponse.cs
@@ -8,12 +8,12 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using System.Web;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Messages;
+	using Validation;
 
 	/// <summary>
 	/// An instance of this interface represents an identity assertion 
@@ -26,7 +26,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// assertions.  This interface does not offer a way to discern between
 	/// solicited and unsolicited assertions as they should be treated equally.
 	/// </remarks>
-	[ContractClass(typeof(IAuthenticationResponseContract))]
 	public interface IAuthenticationResponse {
 		/// <summary>
 		/// Gets the Identifier that the end user claims to own.  For use with user database storage and lookup.
@@ -254,277 +253,4 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		IOpenIdMessageExtension GetUntrustedExtension(Type extensionType);
 	}
-
-	/// <summary>
-	/// Code contract for the <see cref="IAuthenticationResponse"/> type.
-	/// </summary>
-	[ContractClassFor(typeof(IAuthenticationResponse))]
-	internal abstract class IAuthenticationResponseContract : IAuthenticationResponse {
-		/// <summary>
-		/// Initializes a new instance of the <see cref="IAuthenticationResponseContract"/> class.
-		/// </summary>
-		protected IAuthenticationResponseContract() {
-		}
-
-		#region IAuthenticationResponse Members
-
-		/// <summary>
-		/// Gets the Identifier that the end user claims to own.  For use with user database storage and lookup.
-		/// May be null for some failed authentications (i.e. failed directed identity authentications).
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// 	<para>
-		/// This is the secure identifier that should be used for database storage and lookup.
-		/// It is not always friendly (i.e. =Arnott becomes =!9B72.7DD1.50A9.5CCD), but it protects
-		/// user identities against spoofing and other attacks.
-		/// </para>
-		/// 	<para>
-		/// For user-friendly identifiers to display, use the
-		/// <see cref="IAuthenticationResponse.FriendlyIdentifierForDisplay"/> property.
-		/// </para>
-		/// </remarks>
-		Identifier IAuthenticationResponse.ClaimedIdentifier {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a user-friendly OpenID Identifier for display purposes ONLY.
-		/// </summary>
-		/// <value></value>
-		/// <remarks>
-		/// 	<para>
-		/// This <i>should</i> be put through <see cref="HttpUtility.HtmlEncode(string)"/> before
-		/// sending to a browser to secure against javascript injection attacks.
-		/// </para>
-		/// 	<para>
-		/// This property retains some aspects of the user-supplied identifier that get lost
-		/// in the <see cref="IAuthenticationResponse.ClaimedIdentifier"/>.  For example, XRIs used as user-supplied
-		/// identifiers (i.e. =Arnott) become unfriendly unique strings (i.e. =!9B72.7DD1.50A9.5CCD).
-		/// For display purposes, such as text on a web page that says "You're logged in as ...",
-		/// this property serves to provide the =Arnott string, or whatever else is the most friendly
-		/// string close to what the user originally typed in.
-		/// </para>
-		/// 	<para>
-		/// If the user-supplied identifier is a URI, this property will be the URI after all
-		/// redirects, and with the protocol and fragment trimmed off.
-		/// If the user-supplied identifier is an XRI, this property will be the original XRI.
-		/// If the user-supplied identifier is an OpenID Provider identifier (i.e. yahoo.com),
-		/// this property will be the Claimed Identifier, with the protocol stripped if it is a URI.
-		/// </para>
-		/// 	<para>
-		/// It is <b>very</b> important that this property <i>never</i> be used for database storage
-		/// or lookup to avoid identity spoofing and other security risks.  For database storage
-		/// and lookup please use the <see cref="IAuthenticationResponse.ClaimedIdentifier"/> property.
-		/// </para>
-		/// </remarks>
-		string IAuthenticationResponse.FriendlyIdentifierForDisplay {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the detailed success or failure status of the authentication attempt.
-		/// </summary>
-		/// <value></value>
-		AuthenticationStatus IAuthenticationResponse.Status {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets information about the OpenId Provider, as advertised by the
-		/// OpenID discovery documents found at the <see cref="IAuthenticationResponse.ClaimedIdentifier"/>
-		/// location, if available.
-		/// </summary>
-		/// <value>
-		/// The Provider endpoint that issued the positive assertion;
-		/// or <c>null</c> if information about the Provider is unavailable.
-		/// </value>
-		IProviderEndpoint IAuthenticationResponse.Provider {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets the details regarding a failed authentication attempt, if available.
-		/// This will be set if and only if <see cref="IAuthenticationResponse.Status"/> is <see cref="AuthenticationStatus.Failed"/>.
-		/// </summary>
-		/// <value></value>
-		Exception IAuthenticationResponse.Exception {
-			get { throw new NotImplementedException(); }
-		}
-
-		/// <summary>
-		/// Gets a callback argument's value that was previously added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/>.
-		/// </summary>
-		/// <param name="key">The name of the parameter whose value is sought.</param>
-		/// <returns>
-		/// The value of the argument, or null if the named parameter could not be found.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>This may return any argument on the querystring that came with the authentication response,
-		/// which may include parameters not explicitly added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/>.</para>
-		/// 	<para>Note that these values are NOT protected against tampering in transit.</para>
-		/// </remarks>
-		string IAuthenticationResponse.GetCallbackArgument(string key) {
-			Requires.NotNullOrEmpty(key, "key");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets all the callback arguments that were previously added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/> or as a natural part
-		/// of the return_to URL.
-		/// </summary>
-		/// <returns>A name-value dictionary.  Never null.</returns>
-		/// <remarks>
-		/// 	<para>This MAY return any argument on the querystring that came with the authentication response,
-		/// which may include parameters not explicitly added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/>.</para>
-		/// 	<para>Note that these values are NOT protected against tampering in transit.</para>
-		/// </remarks>
-		IDictionary<string, string> IAuthenticationResponse.GetCallbackArguments() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Tries to get an OpenID extension that may be present in the response.
-		/// </summary>
-		/// <typeparam name="T">The type of extension to look for in the response message.</typeparam>
-		/// <returns>
-		/// The extension, if it is found.  Null otherwise.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>Extensions are returned only if the Provider signed them.
-		/// Relying parties that do not care if the values were modified in
-		/// transit should use the <see cref="IAuthenticationResponse.GetUntrustedExtension&lt;T&gt;"/> method
-		/// in order to allow the Provider to not sign the extension. </para>
-		/// 	<para>Unsigned extensions are completely unreliable and should be
-		/// used only to prefill user forms since the user or any other third
-		/// party may have tampered with the data carried by the extension.</para>
-		/// 	<para>Signed extensions are only reliable if the relying party
-		/// trusts the OpenID Provider that signed them.  Signing does not mean
-		/// the relying party can trust the values -- it only means that the values
-		/// have not been tampered with since the Provider sent the message.</para>
-		/// </remarks>
-		T IAuthenticationResponse.GetExtension<T>() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Tries to get an OpenID extension that may be present in the response.
-		/// </summary>
-		/// <param name="extensionType">Type of the extension to look for in the response.</param>
-		/// <returns>
-		/// The extension, if it is found.  Null otherwise.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>Extensions are returned only if the Provider signed them.
-		/// Relying parties that do not care if the values were modified in
-		/// transit should use the <see cref="IAuthenticationResponse.GetUntrustedExtension"/> method
-		/// in order to allow the Provider to not sign the extension. </para>
-		/// 	<para>Unsigned extensions are completely unreliable and should be
-		/// used only to prefill user forms since the user or any other third
-		/// party may have tampered with the data carried by the extension.</para>
-		/// 	<para>Signed extensions are only reliable if the relying party
-		/// trusts the OpenID Provider that signed them.  Signing does not mean
-		/// the relying party can trust the values -- it only means that the values
-		/// have not been tampered with since the Provider sent the message.</para>
-		/// </remarks>
-		IOpenIdMessageExtension IAuthenticationResponse.GetExtension(Type extensionType) {
-			Requires.NotNullSubtype<IOpenIdMessageExtension>(extensionType, "extensionType");
-			////ErrorUtilities.VerifyArgument(typeof(IOpenIdMessageExtension).IsAssignableFrom(extensionType), string.Format(CultureInfo.CurrentCulture, OpenIdStrings.TypeMustImplementX, typeof(IOpenIdMessageExtension).FullName));
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Tries to get an OpenID extension that may be present in the response, without
-		/// requiring it to be signed by the Provider.
-		/// </summary>
-		/// <typeparam name="T">The type of extension to look for in the response message.</typeparam>
-		/// <returns>
-		/// The extension, if it is found.  Null otherwise.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>Extensions are returned whether they are signed or not.
-		/// Use the <see cref="IAuthenticationResponse.GetExtension&lt;T&gt;"/> method to retrieve
-		/// extension responses only if they are signed by the Provider to
-		/// protect against tampering. </para>
-		/// 	<para>Unsigned extensions are completely unreliable and should be
-		/// used only to prefill user forms since the user or any other third
-		/// party may have tampered with the data carried by the extension.</para>
-		/// 	<para>Signed extensions are only reliable if the relying party
-		/// trusts the OpenID Provider that signed them.  Signing does not mean
-		/// the relying party can trust the values -- it only means that the values
-		/// have not been tampered with since the Provider sent the message.</para>
-		/// </remarks>
-		T IAuthenticationResponse.GetUntrustedExtension<T>() {
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Tries to get an OpenID extension that may be present in the response, without
-		/// requiring it to be signed by the Provider.
-		/// </summary>
-		/// <param name="extensionType">Type of the extension to look for in the response.</param>
-		/// <returns>
-		/// The extension, if it is found.  Null otherwise.
-		/// </returns>
-		/// <remarks>
-		/// 	<para>Extensions are returned whether they are signed or not.
-		/// Use the <see cref="IAuthenticationResponse.GetExtension"/> method to retrieve
-		/// extension responses only if they are signed by the Provider to
-		/// protect against tampering. </para>
-		/// 	<para>Unsigned extensions are completely unreliable and should be
-		/// used only to prefill user forms since the user or any other third
-		/// party may have tampered with the data carried by the extension.</para>
-		/// 	<para>Signed extensions are only reliable if the relying party
-		/// trusts the OpenID Provider that signed them.  Signing does not mean
-		/// the relying party can trust the values -- it only means that the values
-		/// have not been tampered with since the Provider sent the message.</para>
-		/// </remarks>
-		IOpenIdMessageExtension IAuthenticationResponse.GetUntrustedExtension(Type extensionType) {
-			Requires.NotNullSubtype<IOpenIdMessageExtension>(extensionType, "extensionType");
-			////ErrorUtilities.VerifyArgument(typeof(IOpenIdMessageExtension).IsAssignableFrom(extensionType), string.Format(CultureInfo.CurrentCulture, OpenIdStrings.TypeMustImplementX, typeof(IOpenIdMessageExtension).FullName));
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets a callback argument's value that was previously added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/>.
-		/// </summary>
-		/// <param name="key">The name of the parameter whose value is sought.</param>
-		/// <returns>
-		/// The value of the argument, or null if the named parameter could not be found.
-		/// </returns>
-		/// <remarks>
-		/// Callback parameters are only available even if the RP is in stateless mode,
-		/// or the callback parameters are otherwise unverifiable as untampered with.
-		/// Therefore, use this method only when the callback argument is not to be
-		/// used to make a security-sensitive decision.
-		/// </remarks>
-		string IAuthenticationResponse.GetUntrustedCallbackArgument(string key) {
-			Requires.NotNullOrEmpty(key, "key");
-			throw new NotImplementedException();
-		}
-
-		/// <summary>
-		/// Gets all the callback arguments that were previously added using
-		/// <see cref="IAuthenticationRequest.AddCallbackArguments(string, string)"/> or as a natural part
-		/// of the return_to URL.
-		/// </summary>
-		/// <returns>A name-value dictionary.  Never null.</returns>
-		/// <remarks>
-		/// Callback parameters are only available even if the RP is in stateless mode,
-		/// or the callback parameters are otherwise unverifiable as untampered with.
-		/// Therefore, use this method only when the callback argument is not to be
-		/// used to make a security-sensitive decision.
-		/// </remarks>
-		IDictionary<string, string> IAuthenticationResponse.GetUntrustedCallbackArguments() {
-			Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
-			throw new NotImplementedException();
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IRelyingPartyBehavior.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IRelyingPartyBehavior.cs
index 0113f62..b056fcd 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IRelyingPartyBehavior.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/IRelyingPartyBehavior.cs
@@ -6,12 +6,11 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
-	using System.Diagnostics.Contracts;
+	using Validation;
 
 	/// <summary>
 	/// Applies a custom security policy to certain OpenID security settings and behaviors.
 	/// </summary>
-	[ContractClass(typeof(IRelyingPartyBehaviorContract))]
 	public interface IRelyingPartyBehavior {
 		/// <summary>
 		/// Applies a well known set of security requirements to a default set of security settings.
@@ -40,53 +39,4 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="assertion">The positive assertion.</param>
 		void OnIncomingPositiveAssertion(IAuthenticationResponse assertion);
 	}
-
-	/// <summary>
-	/// Contract class for the <see cref="IRelyingPartyBehavior"/> interface.
-	/// </summary>
-	[ContractClassFor(typeof(IRelyingPartyBehavior))]
-	internal abstract class IRelyingPartyBehaviorContract : IRelyingPartyBehavior {
-		/// <summary>
-		/// Prevents a default instance of the <see cref="IRelyingPartyBehaviorContract"/> class from being created.
-		/// </summary>
-		private IRelyingPartyBehaviorContract() {
-		}
-
-		#region IRelyingPartyBehavior Members
-
-		/// <summary>
-		/// Applies a well known set of security requirements to a default set of security settings.
-		/// </summary>
-		/// <param name="securitySettings">The security settings to enhance with the requirements of this profile.</param>
-		/// <remarks>
-		/// Care should be taken to never decrease security when applying a profile.
-		/// Profiles should only enhance security requirements to avoid being
-		/// incompatible with each other.
-		/// </remarks>
-		void IRelyingPartyBehavior.ApplySecuritySettings(RelyingPartySecuritySettings securitySettings) {
-			Requires.NotNull(securitySettings, "securitySettings");
-		}
-
-		/// <summary>
-		/// Called when an authentication request is about to be sent.
-		/// </summary>
-		/// <param name="request">The request.</param>
-		/// <remarks>
-		/// Implementations should be prepared to be called multiple times on the same outgoing message
-		/// without malfunctioning.
-		/// </remarks>
-		void IRelyingPartyBehavior.OnOutgoingAuthenticationRequest(IAuthenticationRequest request) {
-			Requires.NotNull(request, "request");
-		}
-
-		/// <summary>
-		/// Called when an incoming positive assertion is received.
-		/// </summary>
-		/// <param name="assertion">The positive assertion.</param>
-		void IRelyingPartyBehavior.OnIncomingPositiveAssertion(IAuthenticationResponse assertion) {
-			Requires.NotNull(assertion, "assertion");
-		}
-
-		#endregion
-	}
 }
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/RelyingPartySecuritySettings.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/RelyingPartySecuritySettings.cs
index 77ccbca..e866f24 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/RelyingPartySecuritySettings.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/RelyingParty/RelyingPartySecuritySettings.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/RelyingPartyEndpointDescription.cs b/src/DotNetOpenAuth.OpenId/OpenId/RelyingPartyEndpointDescription.cs
index f0d3b6a..d7ebd3a 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/RelyingPartyEndpointDescription.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/RelyingPartyEndpointDescription.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A description of some OpenID Relying Party endpoint.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/SecuritySettings.cs b/src/DotNetOpenAuth.OpenId/OpenId/SecuritySettings.cs
index 2035c9f..589f470 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/SecuritySettings.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/SecuritySettings.cs
@@ -8,8 +8,8 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// Security settings that may be applicable to both relying parties and providers.
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/UriIdentifier.cs b/src/DotNetOpenAuth.OpenId/OpenId/UriIdentifier.cs
index 631eab6..b9f6ebc 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/UriIdentifier.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/UriIdentifier.cs
@@ -19,6 +19,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Xrds;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	/// <summary>
 	/// A URI style of OpenID Identifier.
@@ -480,7 +481,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The non-compressing equivalent scheme or URL for the given value.</returns>
 		private static string NormalSchemeToSpecialRoundTrippingScheme(string normal) {
 			Requires.NotNullOrEmpty(normal, "normal");
-			Contract.Ensures(!string.IsNullOrEmpty(Contract.Result<string>()));
 			ErrorUtilities.VerifyInternal(schemeSubstitution, "Wrong schemeSubstitution value.");
 
 			int delimiterIndex = normal.IndexOf(Uri.SchemeDelimiter, StringComparison.Ordinal);
@@ -564,14 +564,14 @@ namespace DotNetOpenAuth.OpenId {
 
 				// Get the Path out ourselves, since the default Uri parser compresses it too much for OpenID.
 				int schemeLength = value.IndexOf(Uri.SchemeDelimiter, StringComparison.Ordinal);
-				Contract.Assume(schemeLength > 0);
+				Assumes.True(schemeLength > 0);
 				int hostStart = schemeLength + Uri.SchemeDelimiter.Length;
 				int hostFinish = value.IndexOf('/', hostStart);
 				if (hostFinish < 0) {
 					this.Path = "/";
 				} else {
 					int pathFinish = value.IndexOfAny(PathEndingCharacters, hostFinish);
-					Contract.Assume(pathFinish >= hostFinish || pathFinish < 0);
+					Assumes.True(pathFinish >= hostFinish || pathFinish < 0);
 					if (pathFinish < 0) {
 						this.Path = value.Substring(hostFinish);
 					} else {
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs b/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs
index 3189a5d..a3e8345 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Xrds;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	/// <summary>
 	/// The discovery service for XRI identifiers that uses an XRI proxy resolver for discovery.
@@ -74,7 +74,6 @@ namespace DotNetOpenAuth.OpenId {
 		private static XrdsDocument DownloadXrds(XriIdentifier identifier, IDirectWebRequestHandler requestHandler) {
 			Requires.NotNull(identifier, "identifier");
 			Requires.NotNull(requestHandler, "requestHandler");
-			Contract.Ensures(Contract.Result<XrdsDocument>() != null);
 			XrdsDocument doc;
 			using (var xrdsResponse = Yadis.Request(requestHandler, GetXrdsUrl(identifier), identifier.IsDiscoverySecureEndToEnd)) {
 				var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings();
diff --git a/src/DotNetOpenAuth.OpenId/OpenId/XriIdentifier.cs b/src/DotNetOpenAuth.OpenId/OpenId/XriIdentifier.cs
index f6a633f..4222726 100644
--- a/src/DotNetOpenAuth.OpenId/OpenId/XriIdentifier.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenId/XriIdentifier.cs
@@ -15,12 +15,12 @@ namespace DotNetOpenAuth.OpenId {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Xrds;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	/// <summary>
 	/// An XRI style of OpenID Identifier.
 	/// </summary>
 	[Serializable]
-	[ContractVerification(true)]
 	[Pure]
 	public sealed class XriIdentifier : Identifier {
 		/// <summary>
@@ -45,7 +45,7 @@ namespace DotNetOpenAuth.OpenId {
 		internal XriIdentifier(string xri)
 			: this(xri, false) {
 			Requires.NotNullOrEmpty(xri, "xri");
-			Requires.Format(IsValidXri(xri), OpenIdStrings.InvalidXri);
+			RequiresEx.Format(IsValidXri(xri), OpenIdStrings.InvalidXri);
 		}
 
 		/// <summary>
@@ -59,8 +59,8 @@ namespace DotNetOpenAuth.OpenId {
 		internal XriIdentifier(string xri, bool requireSsl)
 			: base(xri, requireSsl) {
 			Requires.NotNullOrEmpty(xri, "xri");
-			Requires.Format(IsValidXri(xri), OpenIdStrings.InvalidXri);
-			Contract.Assume(xri != null); // Proven by IsValidXri
+			RequiresEx.Format(IsValidXri(xri), OpenIdStrings.InvalidXri);
+			Assumes.True(xri != null); // Proven by IsValidXri
 			this.OriginalXri = xri;
 			this.canonicalXri = CanonicalizeXri(xri);
 		}
@@ -75,7 +75,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		internal string CanonicalXri {
 			get {
-				Contract.Ensures(Contract.Result<string>() != null);
 				return this.canonicalXri;
 			}
 		}
@@ -169,7 +168,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// True if the secure conversion was successful.
 		/// False if the Identifier was originally created with an explicit HTTP scheme.
 		/// </returns>
-		[ContractVerification(false)] // bugs/limitations in CC static analysis
 		internal override bool TryRequireSsl(out Identifier secureIdentifier) {
 			secureIdentifier = IsDiscoverySecureEndToEnd ? this : new XriIdentifier(this, true);
 			return true;
@@ -183,10 +181,9 @@ namespace DotNetOpenAuth.OpenId {
 		/// <remarks>The canonical form, per the OpenID spec, is no scheme and no whitespace on either end.</remarks>
 		private static string CanonicalizeXri(string xri) {
 			Requires.NotNull(xri, "xri");
-			Contract.Ensures(Contract.Result<string>() != null);
 			xri = xri.Trim();
 			if (xri.StartsWith(XriScheme, StringComparison.OrdinalIgnoreCase)) {
-				Contract.Assume(XriScheme.Length <= xri.Length); // should be implied by StartsWith
+				Assumes.True(XriScheme.Length <= xri.Length); // should be implied by StartsWith
 				xri = xri.Substring(XriScheme.Length);
 			}
 			return xri;
diff --git a/src/DotNetOpenAuth.OpenId/OpenIdXrdsHelperRelyingParty.cs b/src/DotNetOpenAuth.OpenId/OpenIdXrdsHelperRelyingParty.cs
index 4e3221f..885370c 100644
--- a/src/DotNetOpenAuth.OpenId/OpenIdXrdsHelperRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenId/OpenIdXrdsHelperRelyingParty.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Xrds;
+	using Validation;
 
 	/// <summary>
 	/// Adds OpenID-specific extension methods to the XrdsDocument class.
@@ -31,7 +31,6 @@ namespace DotNetOpenAuth.OpenId {
 			Requires.NotNull(xrds, "xrds");
 			Requires.NotNull(claimedIdentifier, "claimedIdentifier");
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 
 			var endpoints = new List<IdentifierDiscoveryResult>();
 			endpoints.AddRange(xrds.GenerateOPIdentifierServiceEndpoints(userSuppliedIdentifier));
@@ -52,7 +51,6 @@ namespace DotNetOpenAuth.OpenId {
 		internal static IEnumerable<IdentifierDiscoveryResult> CreateServiceEndpoints(this IEnumerable<XrdElement> xrds, XriIdentifier userSuppliedIdentifier) {
 			Requires.NotNull(xrds, "xrds");
 			Requires.NotNull(userSuppliedIdentifier, "userSuppliedIdentifier");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 
 			var endpoints = new List<IdentifierDiscoveryResult>();
 			endpoints.AddRange(xrds.GenerateOPIdentifierServiceEndpoints(userSuppliedIdentifier));
@@ -71,7 +69,6 @@ namespace DotNetOpenAuth.OpenId {
 		private static IEnumerable<IdentifierDiscoveryResult> GenerateOPIdentifierServiceEndpoints(this IEnumerable<XrdElement> xrds, Identifier opIdentifier) {
 			Requires.NotNull(xrds, "xrds");
 			Requires.NotNull(opIdentifier, "opIdentifier");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 			return from service in xrds.FindOPIdentifierServices()
 				   from uri in service.UriElements
 				   let protocol = Protocol.FindBestVersion(p => p.OPIdentifierServiceTypeURI, service.TypeElementUris)
@@ -92,7 +89,6 @@ namespace DotNetOpenAuth.OpenId {
 		private static IEnumerable<IdentifierDiscoveryResult> GenerateClaimedIdentifierServiceEndpoints(this IEnumerable<XrdElement> xrds, UriIdentifier claimedIdentifier, UriIdentifier userSuppliedIdentifier) {
 			Requires.NotNull(xrds, "xrds");
 			Requires.NotNull(claimedIdentifier, "claimedIdentifier");
-			Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
 
 			return from service in xrds.FindClaimedIdentifierServices()
 				   from uri in service.UriElements
@@ -111,8 +107,7 @@ namespace DotNetOpenAuth.OpenId {
 		private static IEnumerable<IdentifierDiscoveryResult> GenerateClaimedIdentifierServiceEndpoints(this IEnumerable<XrdElement> xrds, XriIdentifier userSuppliedIdentifier) {
 			// Cannot use code contracts because this method uses yield return.
 			////Requires.NotNull(xrds, "xrds");
-			////Contract.Ensures(Contract.Result<IEnumerable<IdentifierDiscoveryResult>>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(xrds, "xrds");
+			////			ErrorUtilities.VerifyArgumentNotNull(xrds, "xrds");
 
 			foreach (var service in xrds.FindClaimedIdentifierServices()) {
 				foreach (var uri in service.UriElements) {
@@ -138,7 +133,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A sequence of service elements.</returns>
 		private static IEnumerable<ServiceElement> FindOPIdentifierServices(this IEnumerable<XrdElement> xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<ServiceElement>>() != null);
 
 			return from xrd in xrds
 				   from service in xrd.OpenIdProviderIdentifierServices
@@ -153,7 +147,6 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>A sequence of the services offered.</returns>
 		private static IEnumerable<ServiceElement> FindClaimedIdentifierServices(this IEnumerable<XrdElement> xrds) {
 			Requires.NotNull(xrds, "xrds");
-			Contract.Ensures(Contract.Result<IEnumerable<ServiceElement>>() != null);
 
 			return from xrd in xrds
 				   from service in xrd.OpenIdClaimedIdentifierServices
diff --git a/src/DotNetOpenAuth.OpenId/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenId/Properties/AssemblyInfo.cs
index 42aa959..ac795f5 100644
--- a/src/DotNetOpenAuth.OpenId/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenId/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenId/Xrds/TypeElement.cs b/src/DotNetOpenAuth.OpenId/Xrds/TypeElement.cs
index 717dfee..97f7ded 100644
--- a/src/DotNetOpenAuth.OpenId/Xrds/TypeElement.cs
+++ b/src/DotNetOpenAuth.OpenId/Xrds/TypeElement.cs
@@ -6,8 +6,8 @@
 
 namespace DotNetOpenAuth.Xrds {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Xml.XPath;
+	using Validation;
 
 	/// <summary>
 	/// The Type element in an XRDS document.
diff --git a/src/DotNetOpenAuth.OpenId/Xrds/XrdsNode.cs b/src/DotNetOpenAuth.OpenId/Xrds/XrdsNode.cs
index 3e163f7..91c59ba 100644
--- a/src/DotNetOpenAuth.OpenId/Xrds/XrdsNode.cs
+++ b/src/DotNetOpenAuth.OpenId/Xrds/XrdsNode.cs
@@ -6,10 +6,10 @@
 
 namespace DotNetOpenAuth.Xrds {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Xml;
 	using System.Xml.XPath;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// A node in an XRDS document.
@@ -45,7 +45,7 @@ namespace DotNetOpenAuth.Xrds {
 		/// <param name="document">The document's root node, which this instance represents.</param>
 		protected XrdsNode(XPathNavigator document) {
 			Requires.NotNull(document, "document");
-			Requires.True(document.NameTable != null, null);
+			Requires.That(document.NameTable != null, "document", "requires document.NameTable != null");
 
 			this.Node = document;
 			this.XmlNamespaceResolver = new XmlNamespaceManager(document.NameTable);
diff --git a/src/DotNetOpenAuth.OpenId/Yadis/HtmlParser.cs b/src/DotNetOpenAuth.OpenId/Yadis/HtmlParser.cs
index 481d6a7..36b7bf1 100644
--- a/src/DotNetOpenAuth.OpenId/Yadis/HtmlParser.cs
+++ b/src/DotNetOpenAuth.OpenId/Yadis/HtmlParser.cs
@@ -7,13 +7,13 @@
 namespace DotNetOpenAuth.Yadis {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
 	using System.Text.RegularExpressions;
 	using System.Web;
 	using System.Web.UI.HtmlControls;
+	using Validation;
 
 	/// <summary>
 	/// An HTML HEAD tag parser.
diff --git a/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs b/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs
index a23e019..4a06ea7 100644
--- a/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs
+++ b/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Yadis {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Net.Cache;
@@ -16,6 +15,7 @@ namespace DotNetOpenAuth.Yadis {
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.Xrds;
+	using Validation;
 
 	/// <summary>
 	/// YADIS discovery manager.
@@ -137,8 +137,6 @@ namespace DotNetOpenAuth.Yadis {
 		internal static IncomingWebResponse Request(IDirectWebRequestHandler requestHandler, Uri uri, bool requireSsl, params string[] acceptTypes) {
 			Requires.NotNull(requestHandler, "requestHandler");
 			Requires.NotNull(uri, "uri");
-			Contract.Ensures(Contract.Result<IncomingWebResponse>() != null);
-			Contract.Ensures(Contract.Result<IncomingWebResponse>().ResponseStream != null);
 
 			HttpWebRequest request = (HttpWebRequest)WebRequest.Create(uri);
 			request.CachePolicy = IdentifierDiscoveryCachePolicy;
diff --git a/src/DotNetOpenAuth.OpenId/packages.config b/src/DotNetOpenAuth.OpenId/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenId/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenIdInfoCard.UI/DotNetOpenAuth.OpenIdInfoCard.UI.csproj b/src/DotNetOpenAuth.OpenIdInfoCard.UI/DotNetOpenAuth.OpenIdInfoCard.UI.csproj
index e0a5267..f3c7f0a 100644
--- a/src/DotNetOpenAuth.OpenIdInfoCard.UI/DotNetOpenAuth.OpenIdInfoCard.UI.csproj
+++ b/src/DotNetOpenAuth.OpenIdInfoCard.UI/DotNetOpenAuth.OpenIdInfoCard.UI.csproj
@@ -62,6 +62,15 @@
       <Name>Org.Mentalis.Security.Cryptography</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/OpenIdInfoCardSelector.cs b/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/OpenIdInfoCardSelector.cs
index a68fd95..9470ef0 100644
--- a/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/OpenIdInfoCardSelector.cs
+++ b/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/OpenIdInfoCardSelector.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IdentityModel.Claims;
 	using System.Linq;
@@ -22,6 +21,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.InfoCard;
 	////using DotNetOpenAuth.InfoCard;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	/// <summary>
 	/// An ASP.NET control that provides a user-friendly way of logging into a web site using OpenID.
@@ -75,8 +75,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="e">The token, if it was decrypted.</param>
 		protected virtual void OnReceivedToken(ReceivedTokenEventArgs e) {
-			Contract.Requires(e != null);
-			ErrorUtilities.VerifyArgumentNotNull(e, "e");
+			Requires.NotNull(e, "paramName");
 
 			var receivedInfoCard = this.ReceivedToken;
 			if (receivedInfoCard != null) {
@@ -89,8 +88,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="e">The <see cref="DotNetOpenAuth.InfoCard.TokenProcessingErrorEventArgs"/> instance containing the event data.</param>
 		protected virtual void OnTokenProcessingError(TokenProcessingErrorEventArgs e) {
-			Contract.Requires(e != null);
-			ErrorUtilities.VerifyArgumentNotNull(e, "e");
+			Requires.NotNull(e, "paramName");
 
 			var tokenProcessingError = this.TokenProcessingError;
 			if (tokenProcessingError != null) {
diff --git a/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/SelectorInfoCardButton.cs b/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/SelectorInfoCardButton.cs
index 2a96d2b..cbb1011 100644
--- a/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/SelectorInfoCardButton.cs
+++ b/src/DotNetOpenAuth.OpenIdInfoCard.UI/OpenId/RelyingParty/SelectorInfoCardButton.cs
@@ -8,9 +8,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.ObjectModel;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Web.UI;
 	using DotNetOpenAuth.InfoCard;
+	using Validation;
 
 	/// <summary>
 	/// A button that appears in the <see cref="OpenIdSelector"/> control that
diff --git a/src/DotNetOpenAuth.OpenIdInfoCard.UI/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenIdInfoCard.UI/Properties/AssemblyInfo.cs
index 5c9dc63..16d6896 100644
--- a/src/DotNetOpenAuth.OpenIdInfoCard.UI/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenIdInfoCard.UI/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/DotNetOpenAuth.OpenIdInfoCard.UI/packages.config b/src/DotNetOpenAuth.OpenIdInfoCard.UI/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenIdInfoCard.UI/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.OpenIdOAuth/DotNetOpenAuth.OpenIdOAuth.csproj b/src/DotNetOpenAuth.OpenIdOAuth/DotNetOpenAuth.OpenIdOAuth.csproj
index 74719d4..0dc83c8 100644
--- a/src/DotNetOpenAuth.OpenIdOAuth/DotNetOpenAuth.OpenIdOAuth.csproj
+++ b/src/DotNetOpenAuth.OpenIdOAuth/DotNetOpenAuth.OpenIdOAuth.csproj
@@ -52,6 +52,15 @@
       <Name>DotNetOpenAuth.OpenId</Name>
     </ProjectReference>
   </ItemGroup>
+  <ItemGroup>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="packages.config" />
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))\EnlistmentInfo.targets" Condition=" '$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), EnlistmentInfo.targets))' != '' " />
diff --git a/src/DotNetOpenAuth.OpenIdOAuth/OAuth/ServiceProviderOpenIdProvider.cs b/src/DotNetOpenAuth.OpenIdOAuth/OAuth/ServiceProviderOpenIdProvider.cs
index b590a90..f827857 100644
--- a/src/DotNetOpenAuth.OpenIdOAuth/OAuth/ServiceProviderOpenIdProvider.cs
+++ b/src/DotNetOpenAuth.OpenIdOAuth/OAuth/ServiceProviderOpenIdProvider.cs
@@ -9,7 +9,6 @@ namespace DotNetOpenAuth.OAuth {
 	using System.Collections.Generic;
 	using System.ComponentModel;
 	using System.Diagnostics.CodeAnalysis;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Security.Principal;
 	using System.ServiceModel.Channels;
@@ -23,6 +22,7 @@ namespace DotNetOpenAuth.OAuth {
 	using DotNetOpenAuth.OpenId.Extensions.OAuth;
 	using DotNetOpenAuth.OpenId.Messages;
 	using DotNetOpenAuth.OpenId.Provider;
+	using Validation;
 
 	/// <summary>
 	/// A web application that allows access via OAuth and can respond to OpenID+OAuth requests.
@@ -92,7 +92,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </remarks>
 		public AuthorizationRequest ReadAuthorizationRequest(IHostProcessedRequest openIdRequest) {
 			Requires.NotNull(openIdRequest, "openIdRequest");
-			Requires.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
+			RequiresEx.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
 			var openidTokenManager = this.TokenManager as ICombinedOpenIdProviderTokenManager;
 			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);
 
@@ -122,8 +122,8 @@ namespace DotNetOpenAuth.OAuth {
 		[Obsolete("Call the overload that doesn't take a consumerKey instead.")]
 		public void AttachAuthorizationResponse(IHostProcessedRequest openIdAuthenticationRequest, string consumerKey, string scope) {
 			Requires.NotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");
-			Requires.True((consumerKey == null) == (scope == null), null);
-			Requires.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
+			Requires.That((consumerKey == null) == (scope == null), null, "consumerKey and scope must either be both provided or both omitted.");
+			RequiresEx.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
 			var openidTokenManager = (ICombinedOpenIdProviderTokenManager)this.TokenManager;
 			ErrorUtilities.VerifyArgument(consumerKey == null || consumerKey == openidTokenManager.GetConsumerKey(openIdAuthenticationRequest.Realm), OAuthStrings.OpenIdOAuthRealmConsumerKeyDoNotMatch);
 
@@ -138,7 +138,7 @@ namespace DotNetOpenAuth.OAuth {
 		[SuppressMessage("Microsoft.Design", "CA1011:ConsiderPassingBaseTypesAsParameters", Justification = "We want to take IAuthenticationRequest because that's the only supported use case.")]
 		public void AttachAuthorizationResponse(IHostProcessedRequest openIdAuthenticationRequest, string scope) {
 			Requires.NotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");
-			Requires.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
+			RequiresEx.ValidState(this.TokenManager is ICombinedOpenIdProviderTokenManager);
 
 			var openidTokenManager = this.TokenManager as ICombinedOpenIdProviderTokenManager;
 			IOpenIdMessageExtension response;
diff --git a/src/DotNetOpenAuth.OpenIdOAuth/OAuth/WebConsumerOpenIdRelyingParty.cs b/src/DotNetOpenAuth.OpenIdOAuth/OAuth/WebConsumerOpenIdRelyingParty.cs
index 0d1a602..7c77e4f 100644
--- a/src/DotNetOpenAuth.OpenIdOAuth/OAuth/WebConsumerOpenIdRelyingParty.cs
+++ b/src/DotNetOpenAuth.OpenIdOAuth/OAuth/WebConsumerOpenIdRelyingParty.cs
@@ -14,6 +14,7 @@ namespace DotNetOpenAuth.OAuth {
 	using DotNetOpenAuth.OAuth.Messages;
 	using DotNetOpenAuth.OpenId.Extensions.OAuth;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// A website or application that uses OAuth to access the Service Provider on behalf of the User
@@ -62,7 +63,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </remarks>
 		public AuthorizedTokenResponse ProcessUserAuthorization(IAuthenticationResponse openIdAuthenticationResponse) {
 			Requires.NotNull(openIdAuthenticationResponse, "openIdAuthenticationResponse");
-			Requires.ValidState(this.TokenManager is IOpenIdOAuthTokenManager);
+			RequiresEx.ValidState(this.TokenManager is IOpenIdOAuthTokenManager);
 			var openidTokenManager = this.TokenManager as IOpenIdOAuthTokenManager;
 			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);
 
diff --git a/src/DotNetOpenAuth.OpenIdOAuth/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.OpenIdOAuth/Properties/AssemblyInfo.cs
index 759bd3f..a3afcd7 100644
--- a/src/DotNetOpenAuth.OpenIdOAuth/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.OpenIdOAuth/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -30,7 +29,6 @@ using System.Web.UI;
 
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("F9AFC069-8291-497F-B2A1-3E4D1646C572")]
-[assembly: ContractVerification(true)]
 
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
diff --git a/src/DotNetOpenAuth.OpenIdOAuth/packages.config b/src/DotNetOpenAuth.OpenIdOAuth/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.OpenIdOAuth/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth.Test/AssemblyTesting.cs b/src/DotNetOpenAuth.Test/AssemblyTesting.cs
deleted file mode 100644
index dac5bea..0000000
--- a/src/DotNetOpenAuth.Test/AssemblyTesting.cs
+++ /dev/null
@@ -1,26 +0,0 @@
-//-----------------------------------------------------------------------
-// <copyright file="AssemblyTesting.cs" company="Outercurve Foundation">
-//     Copyright (c) Outercurve Foundation. All rights reserved.
-// </copyright>
-//-----------------------------------------------------------------------
-
-namespace DotNetOpenAuth.Test {
-	using System.Diagnostics.Contracts;
-	using NUnit.Framework;
-
-	[SetUpFixture]
-	public class AssemblyTesting {
-		[SetUp]
-		public static void AssemblyInitialize() {
-			// Make contract failures become test failures.
-			Contract.ContractFailed += (sender, e) => {
-				// For now, we have tests that verify that preconditions throw exceptions.
-				// So we don't want to fail a test just because a precondition check failed.
-				if (e.FailureKind != ContractFailureKind.Precondition) {
-					e.SetHandled();
-					Assert.Fail(e.FailureKind.ToString() + ": " + e.Message);
-				}
-			};
-		}
-	}
-}
diff --git a/src/DotNetOpenAuth.Test/CoordinatorBase.cs b/src/DotNetOpenAuth.Test/CoordinatorBase.cs
index 1b4a5cd..d1c6f85 100644
--- a/src/DotNetOpenAuth.Test/CoordinatorBase.cs
+++ b/src/DotNetOpenAuth.Test/CoordinatorBase.cs
@@ -6,12 +6,12 @@
 
 namespace DotNetOpenAuth.Test {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Test.Mocks;
 	using NUnit.Framework;
+	using Validation;
 
 	internal abstract class CoordinatorBase<T1, T2> {
 		private Action<T1> party1Action;
diff --git a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
index 189a569..1ecfa30 100644
--- a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
+++ b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
@@ -5,7 +5,6 @@
     <ProjectRoot Condition="'$(ProjectRoot)' == ''">$(MSBuildProjectDirectory)\..\..\</ProjectRoot>
     <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
     <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
-    <CodeContractsAssemblyMode>0</CodeContractsAssemblyMode>
   </PropertyGroup>
   <Import Project="$(ProjectRoot)tools\DotNetOpenAuth.props" />
   <PropertyGroup>
@@ -44,41 +43,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
-    <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
-    <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
-    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
-    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
-    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
-    <CodeContractsLibPaths>
-    </CodeContractsLibPaths>
-    <CodeContractsPlatformPath>
-    </CodeContractsPlatformPath>
-    <CodeContractsExtraAnalysisOptions>
-    </CodeContractsExtraAnalysisOptions>
-    <CodeContractsBaseLineFile>
-    </CodeContractsBaseLineFile>
-    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
-    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
-    <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
-    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
-    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
-    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
-    <CodeContractsRedundantAssumptions>False</CodeContractsRedundantAssumptions>
-    <CodeContractsEmitXMLDocs>False</CodeContractsEmitXMLDocs>
-    <CodeContractsExtraRewriteOptions />
-    <CodeContractsReferenceAssembly>%28none%29</CodeContractsReferenceAssembly>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <CodeContractsRuntimeSkipQuantifiers>False</CodeContractsRuntimeSkipQuantifiers>
-    <CodeContractsEnumObligations>False</CodeContractsEnumObligations>
-    <CodeContractsCacheAnalysisResults>False</CodeContractsCacheAnalysisResults>
-    <CodeContractsAnalysisWarningLevel>0</CodeContractsAnalysisWarningLevel>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>
@@ -86,41 +51,7 @@
     <DefineConstants>TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
-    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
-    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
-    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
-    <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
-    <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
-    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
-    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
-    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
-    <CodeContractsLibPaths>
-    </CodeContractsLibPaths>
-    <CodeContractsPlatformPath>
-    </CodeContractsPlatformPath>
-    <CodeContractsExtraAnalysisOptions>
-    </CodeContractsExtraAnalysisOptions>
-    <CodeContractsBaseLineFile>
-    </CodeContractsBaseLineFile>
-    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
-    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
-    <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
-    <CodeContractsRedundantAssumptions>False</CodeContractsRedundantAssumptions>
-    <CodeContractsEmitXMLDocs>False</CodeContractsEmitXMLDocs>
-    <CodeContractsExtraRewriteOptions />
-    <CodeContractsReferenceAssembly>%28none%29</CodeContractsReferenceAssembly>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <CodeContractsRuntimeSkipQuantifiers>False</CodeContractsRuntimeSkipQuantifiers>
-    <CodeContractsEnumObligations>False</CodeContractsEnumObligations>
-    <CodeContractsCacheAnalysisResults>False</CodeContractsCacheAnalysisResults>
-    <CodeContractsAnalysisWarningLevel>0</CodeContractsAnalysisWarningLevel>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'CodeAnalysis|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -130,36 +61,7 @@
     <CodeAnalysisUseTypeNameInSuppression>true</CodeAnalysisUseTypeNameInSuppression>
     <CodeAnalysisModuleSuppressionsFile>GlobalSuppressions.cs</CodeAnalysisModuleSuppressionsFile>
     <ErrorReport>prompt</ErrorReport>
-    <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
-    <CodeContractsRunCodeAnalysis>True</CodeContractsRunCodeAnalysis>
-    <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
-    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
-    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
-    <CodeContractsLibPaths>
-    </CodeContractsLibPaths>
-    <CodeContractsPlatformPath>
-    </CodeContractsPlatformPath>
-    <CodeContractsExtraAnalysisOptions>
-    </CodeContractsExtraAnalysisOptions>
-    <CodeContractsBaseLineFile>
-    </CodeContractsBaseLineFile>
-    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
-    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
-    <CodeContractsShowSquigglies>True</CodeContractsShowSquigglies>
-    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
-    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
-    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
-    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
     <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
-    <CodeContractsRedundantAssumptions>False</CodeContractsRedundantAssumptions>
-    <CodeContractsEmitXMLDocs>False</CodeContractsEmitXMLDocs>
-    <CodeContractsExtraRewriteOptions />
-    <CodeContractsReferenceAssembly>%28none%29</CodeContractsReferenceAssembly>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
   <ItemGroup>
@@ -189,9 +91,12 @@
     <Reference Include="System.Xml.Linq">
       <RequiredTargetFramework>3.5</RequiredTargetFramework>
     </Reference>
+    <Reference Include="Validation, Version=2.0.0.0, Culture=neutral, PublicKeyToken=2fc06f0d701809a7, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Validation.2.0.0.12319\lib\portable-windows8+net40+sl5+windowsphone8\Validation.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
-    <Compile Include="AssemblyTesting.cs" />
     <Compile Include="Configuration\SectionTests.cs" />
     <Compile Include="CoordinatorBase.cs" />
     <Compile Include="Hosting\AspNetHost.cs" />
@@ -373,6 +278,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="App.config" />
+    <None Include="packages.config" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="OpenId\Discovery\xrdsdiscovery\xrds20dual.xml" />
diff --git a/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs b/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
index 117cde2..40dcc09 100644
--- a/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
+++ b/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.Test.Messaging {
 	using System;
 	using System.Collections;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using NUnit.Framework;
+	using Validation;
 
 	internal class CollectionAssert<T> {
 		internal static void AreEquivalent(ICollection<T> expected, ICollection<T> actual) {
diff --git a/src/DotNetOpenAuth.Test/Messaging/MultipartPostPartTests.cs b/src/DotNetOpenAuth.Test/Messaging/MultipartPostPartTests.cs
index 39267ca..e9ac5aa 100644
--- a/src/DotNetOpenAuth.Test/Messaging/MultipartPostPartTests.cs
+++ b/src/DotNetOpenAuth.Test/Messaging/MultipartPostPartTests.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.Test.Messaging {
 	using System.CodeDom.Compiler;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using DotNetOpenAuth.Messaging;
 	using NUnit.Framework;
+	using Validation;
 
 	[TestFixture]
 	public class MultipartPostPartTests : TestBase {
@@ -77,7 +77,7 @@ namespace DotNetOpenAuth.Test.Messaging {
 		}
 
 		private static void VerifyLength(MultipartPostPart part) {
-			Contract.Requires(part != null);
+			Requires.NotNull(part, "part");
 
 			var expectedLength = part.Length;
 			var ms = new MemoryStream();
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
index 50eff97..475f4b5 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Net;
 	using System.Text;
@@ -17,6 +16,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.Test.OpenId;
 	using NUnit.Framework;
+	using Validation;
 
 	internal class CoordinatingChannel : Channel {
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingHttpRequestInfo.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingHttpRequestInfo.cs
index 2713765..497503c 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingHttpRequestInfo.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingHttpRequestInfo.cs
@@ -7,11 +7,11 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Net;
 	using System.Web;
 
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	internal class CoordinatingHttpRequestInfo : HttpRequestInfo {
 		private readonly Channel channel;
@@ -40,9 +40,9 @@ namespace DotNetOpenAuth.Test.Mocks {
 			MessageReceivingEndpoint recipient,
 			HttpCookieCollection cookies)
 			: this(recipient, cookies) {
-			Contract.Requires(channel != null);
-			Contract.Requires(messageFactory != null);
-			Contract.Requires(messageData != null);
+			Requires.NotNull(channel, "channel");
+			Requires.NotNull(messageFactory, "messageFactory");
+			Requires.NotNull(messageData, "messageData");
 			this.channel = channel;
 			this.messageData = messageData;
 			this.messageFactory = messageFactory;
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthConsumerChannel.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthConsumerChannel.cs
index e145952..9b552d3 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthConsumerChannel.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthConsumerChannel.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using System.Web;
 
@@ -14,6 +13,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
+	using Validation;
 
 	/// <summary>
 	/// A special channel used in test simulations to pass messages directly between two parties.
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthServiceProviderChannel.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthServiceProviderChannel.cs
index 012173c..a6f2a7f 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthServiceProviderChannel.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthServiceProviderChannel.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
-	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using System.Web;
 
@@ -15,6 +14,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
 	using NUnit.Framework;
+	using Validation;
 
 	/// <summary>
 	/// A special channel used in test simulations to pass messages directly between two parties.
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
index 90dbd7d..9df791c 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
@@ -8,10 +8,10 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
 	using System.ComponentModel;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
+	using Validation;
 
 	internal class CoordinatingOutgoingWebResponse : OutgoingWebResponse {
 		private CoordinatingChannel receivingChannel;
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockHttpMessageHandler.cs b/src/DotNetOpenAuth.Test/Mocks/MockHttpMessageHandler.cs
index fba107e..87e8196 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockHttpMessageHandler.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockHttpMessageHandler.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using System.Text;
 	using System.Threading;
 	using System.Threading.Tasks;
+	using Validation;
 
 	/// <summary>
 	/// An <see cref="HttpMessageHandler"/> that sends each request to the specified delegate.
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs b/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
index 88c0a55..d20671e 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Net;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Test.OpenId;
 	using DotNetOpenAuth.Yadis;
+	using Validation;
 
 	internal class MockHttpRequest {
 		private readonly Dictionary<Uri, IncomingWebResponse> registeredMockResponses = new Dictionary<Uri, IncomingWebResponse>();
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs b/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
index e10ba2b..f020923 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
@@ -7,10 +7,10 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
+	using Validation;
 
 	/// <summary>
 	/// Performs similar to an ordinary <see cref="Identifier"/>, but when called upon
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockRealm.cs b/src/DotNetOpenAuth.Test/Mocks/MockRealm.cs
index 1b66da6..8509c03 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockRealm.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockRealm.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
+	using Validation;
 
 	internal class MockRealm : Realm {
 		private RelyingPartyEndpointDescription[] relyingPartyDescriptions;
diff --git a/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs b/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
index 0ec4f46..5a47ab4 100644
--- a/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
diff --git a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
index f80935c..b081038 100644
--- a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
+++ b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
@@ -8,7 +8,6 @@ namespace DotNetOpenAuth.Test.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
-	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Text;
@@ -20,6 +19,7 @@ namespace DotNetOpenAuth.Test.OAuth.ChannelElements {
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.Test.Mocks;
 	using NUnit.Framework;
+	using Validation;
 
 	[TestFixture]
 	public class OAuthChannelTests : TestBase {
diff --git a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/SigningBindingElementBaseTests.cs b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/SigningBindingElementBaseTests.cs
index dffe6c1..490399c 100644
--- a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/SigningBindingElementBaseTests.cs
+++ b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/SigningBindingElementBaseTests.cs
@@ -6,13 +6,13 @@
 
 namespace DotNetOpenAuth.Test.OAuth.ChannelElements {
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
 	using NUnit.Framework;
+	using Validation;
 
 	[TestFixture]
 	public class SigningBindingElementBaseTests : MessagingTestBase {
@@ -125,7 +125,8 @@ namespace DotNetOpenAuth.Test.OAuth.ChannelElements {
 		}
 
 		internal AccessProtectedResourceRequest CreateResourceRequest(MessageReceivingEndpoint endpoint) {
-			Contract.Requires(endpoint != null);
+			Requires.NotNull(endpoint, "endpoint");
+
 			var message = new AccessProtectedResourceRequest(endpoint, Protocol.V10.Version);
 			return message;
 		}
diff --git a/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs b/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
index 24e512c..21c1775 100644
--- a/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
+++ b/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
@@ -6,12 +6,12 @@
 
 namespace DotNetOpenAuth.Test.OAuth {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.Test.Mocks;
+	using Validation;
 
 	/// <summary>
 	/// Runs a Consumer and Service Provider simultaneously so they can interact in a full simulation.
diff --git a/src/DotNetOpenAuth.Test/OAuth2/OAuth2Coordinator.cs b/src/DotNetOpenAuth.Test/OAuth2/OAuth2Coordinator.cs
index 6494585..eeda125 100644
--- a/src/DotNetOpenAuth.Test/OAuth2/OAuth2Coordinator.cs
+++ b/src/DotNetOpenAuth.Test/OAuth2/OAuth2Coordinator.cs
@@ -12,6 +12,7 @@ namespace DotNetOpenAuth.Test.OAuth2 {
 	using System.Text;
 	using DotNetOpenAuth.OAuth2;
 	using DotNetOpenAuth.Test.Mocks;
+	using Validation;
 
 	internal class OAuth2Coordinator<TClient> : CoordinatorBase<TClient, AuthorizationServer>
 		where TClient : ClientBase {
diff --git a/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs b/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
index 6129ee7..14bcaec 100644
--- a/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
@@ -6,7 +6,6 @@
 
 namespace DotNetOpenAuth.Test.OpenId {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId;
@@ -15,6 +14,7 @@ namespace DotNetOpenAuth.Test.OpenId {
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Test.Mocks;
 	using NUnit.Framework;
+	using Validation;
 
 	[TestFixture]
 	public class AuthenticationTests : OpenIdTestBase {
@@ -136,8 +136,8 @@ namespace DotNetOpenAuth.Test.OpenId {
 		}
 
 		private void ParameterizedAuthenticationTest(Protocol protocol, bool statelessRP, bool sharedAssociation, bool positive, bool immediate, bool tamper) {
-			Requires.True(!statelessRP || !sharedAssociation, null, "The RP cannot be stateless while sharing an association with the OP.");
-			Requires.True(positive || !tamper, null, "Cannot tamper with a negative response.");
+			Requires.That(!statelessRP || !sharedAssociation, null, "The RP cannot be stateless while sharing an association with the OP.");
+			Requires.That(positive || !tamper, null, "Cannot tamper with a negative response.");
 			var securitySettings = new ProviderSecuritySettings();
 			var cryptoKeyStore = new MemoryCryptoKeyStore();
 			var associationStore = new ProviderAssociationHandleEncoder(cryptoKeyStore);
diff --git a/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs b/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
index 849c796..dd47782 100644
--- a/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Test.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text.RegularExpressions;
 	using DotNetOpenAuth.Messaging;
@@ -19,6 +18,7 @@ namespace DotNetOpenAuth.Test.OpenId.ChannelElements {
 	using DotNetOpenAuth.Test.Mocks;
 	using DotNetOpenAuth.Test.OpenId.Extensions;
 	using NUnit.Framework;
+	using Validation;
 
 	[TestFixture]
 	public class ExtensionsBindingElementTests : OpenIdTestBase {
diff --git a/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs b/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
index fd5bba2..8d0e6ff 100644
--- a/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
@@ -7,7 +7,6 @@
 namespace DotNetOpenAuth.Test.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
-	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
@@ -18,6 +17,7 @@ namespace DotNetOpenAuth.Test.OpenId.Extensions {
 	using DotNetOpenAuth.OpenId.Provider;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Test.Messaging;
+	using Validation;
 
 	public static class ExtensionTestUtilities {
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs b/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
index 41528a7..5000833 100644
--- a/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
@@ -6,13 +6,13 @@
 
 namespace DotNetOpenAuth.Test.OpenId {
 	using System;
-	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.Provider;
 	using DotNetOpenAuth.OpenId.RelyingParty;
 	using DotNetOpenAuth.Test.Mocks;
+	using Validation;
 
 	internal class OpenIdCoordinator : CoordinatorBase<OpenIdRelyingParty, OpenIdProvider> {
 		internal OpenIdCoordinator(Action<OpenIdRelyingParty> rpAction, Action<OpenIdProvider> opAction)
diff --git a/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
index 2960d75..723aabf 100644
--- a/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
@@ -4,7 +4,6 @@
 // </copyright>
 //-----------------------------------------------------------------------
 
-using System.Diagnostics.Contracts;
 using System.Reflection;
 using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
@@ -21,5 +20,3 @@ using System.Runtime.InteropServices;
 
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("aef0bb13-b79c-4854-a69a-de58b8feb5d1")]
-
-[assembly: ContractVerification(true)]
-\ No newline at end of file
diff --git a/src/DotNetOpenAuth.Test/TestUtilities.cs b/src/DotNetOpenAuth.Test/TestUtilities.cs
index a526f7f..3d3e151 100644
--- a/src/DotNetOpenAuth.Test/TestUtilities.cs
+++ b/src/DotNetOpenAuth.Test/TestUtilities.cs
@@ -11,6 +11,7 @@ namespace DotNetOpenAuth.Test {
 	using System.Linq;
 	using System.Net;
 	using log4net;
+	using Validation;
 
 	/// <summary>
 	/// An assortment of methods useful for testing.
diff --git a/src/DotNetOpenAuth.Test/packages.config b/src/DotNetOpenAuth.Test/packages.config
new file mode 100644
index 0000000..10eec89
--- /dev/null
+++ b/src/DotNetOpenAuth.Test/packages.config
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Validation" version="2.0.0.12319" targetFramework="net40" />
+</packages>
+\ No newline at end of file
diff --git a/src/DotNetOpenAuth/DotNetOpenAuth.proj b/src/DotNetOpenAuth/DotNetOpenAuth.proj
index 8c9610d..342f65c 100644
--- a/src/DotNetOpenAuth/DotNetOpenAuth.proj
+++ b/src/DotNetOpenAuth/DotNetOpenAuth.proj
@@ -4,7 +4,6 @@
 
 	<PropertyGroup>
 		<SuppressBuildTarget>true</SuppressBuildTarget>
-		<AddContractsAssemblyForDelaySigning>false</AddContractsAssemblyForDelaySigning>
 	</PropertyGroup>
 
 	<Import Project="$(ProjectRoot)tools\DotNetOpenAuth.props" />
@@ -21,38 +20,15 @@
 			<PrimaryProductOutput Condition=" '%(MergeIntoUnifiedAssembly)' != 'false' ">true</PrimaryProductOutput>
 		</ProjectReference>
 		<SignDependsOn Include="BuildUnifiedProduct" />
-		<DelaySignedAssemblies Include="$(ILMergeOutputContractAssembly)"
-		                       Condition=" '$(BuildCodeContractsReferenceAssemblies)' == 'true' "/>
 	</ItemGroup>
 
 	<Target Name="BuildILMergeInputs" DependsOnTargets="ResolveReferences">
 		<ItemGroup>
 			<ILMergeProductInputAssemblies Include="@(ReferencePath)"
 			                               Condition=" '%(ReferencePath.PrimaryProductOutput)' == 'true' "/>
-			<ILMergeInputContractAssemblies Include="@(ILMergeProductInputAssemblies->'%(RootDir)%(Directory)CodeContracts\%(FileName).Contracts%(Extension)')"
-			                                Condition=" '%(FileName)' != 'Microsoft.Contracts' "/>
 		</ItemGroup>
 	</Target>
 
-	<Target Name="BuildUnifiedContractAssembly"	 DependsOnTargets="BuildILMergeInputs"
-					Condition=" '$(BuildCodeContractsReferenceAssemblies)' == 'true' "
-					Inputs="@(ILMergeInputContractAssemblies)" Outputs="$(ILMergeOutputContractAssembly)">
-
-		<MakeDir Directories="$(ILMergeOutputContractAssemblyDirectory)" />
-
-		<Message Text="Merging $(ILMergeOutputContractAssembly)" Importance="high" />
-		<ILMerge
-			ExcludeFile="$(ProjectRoot)ILMergeInternalizeExceptions.txt"
-			InputAssemblies="@(ILMergeInputContractAssemblies)"
-			OutputFile="$(ILMergeOutputContractAssembly)"
-			SearchDirectories="$(OutputPath);@(ILMergeSearchDirectories)"
-			KeyFile="$(PublicKeyFile)"
-			DelaySign="true"
-			ToolPath="$(ProjectRoot)tools\ILMerge"
-			TargetPlatformVersion="$(ClrVersion).0"
-			TargetPlatformDirectory="$(ILMergeTargetPlatformDirectory)" />
-	</Target>
-
 	<Target Name="BuildUnifiedProductAssembly" DependsOnTargets="BuildILMergeInputs"
 					Inputs="@(ILMergeProductInputAssemblies);@(ILMergeInputAssemblies)" Outputs="$(ILMergeOutputAssembly);$(ILMergeOutputXmlDocs)">
 		<MakeDir Directories="$(ILMergeOutputAssemblyDirectory)" />
@@ -83,7 +59,7 @@
 			TargetPlatformDirectory="$(ILMergeTargetPlatformDirectory)" />
 	</Target>
 
-	<Target Name="BuildUnifiedProduct" DependsOnTargets="BuildUnifiedProductAssembly;BuildUnifiedContractAssembly" />
+	<Target Name="BuildUnifiedProduct" DependsOnTargets="BuildUnifiedProductAssembly" />
 
 	<Import Project="$(MSBuildToolsPath)\Microsoft.Common.targets" />
 	<Import Project="$(ProjectRoot)tools\DotNetOpenAuth.targets" />
diff --git a/src/DotNetOpenAuth/Stub.csproj b/src/DotNetOpenAuth/Stub.csproj
index 713639e..5640261 100644
--- a/src/DotNetOpenAuth/Stub.csproj
+++ b/src/DotNetOpenAuth/Stub.csproj
@@ -4,7 +4,6 @@
 
 	<PropertyGroup>
 		<SuppressBuildTarget>true</SuppressBuildTarget>
-		<AddContractsAssemblyForDelaySigning>false</AddContractsAssemblyForDelaySigning>
 	</PropertyGroup>
 
 	<PropertyGroup>
@@ -18,7 +17,6 @@
 		<AppDesignerFolder>Properties</AppDesignerFolder>
 		<AssemblyName>DotNetOpenAuth</AssemblyName>
 		<OutputPath>$(IntermediatePath)\stub\</OutputPath>
-		<NoCodeContracts>true</NoCodeContracts>
 	</PropertyGroup>
 	<Import Project="$(ProjectRoot)tools\DotNetOpenAuth.Product.props" />
 	<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
diff --git a/src/Mono.Math/Properties/AssemblyInfo.cs b/src/Mono.Math/Properties/AssemblyInfo.cs
index 0e40bff..93e3a7f 100644
--- a/src/Mono.Math/Properties/AssemblyInfo.cs
+++ b/src/Mono.Math/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/Org.Mentalis.Security.Cryptography/Properties/AssemblyInfo.cs b/src/Org.Mentalis.Security.Cryptography/Properties/AssemblyInfo.cs
index 4a9e9b9..6b93f7f 100644
--- a/src/Org.Mentalis.Security.Cryptography/Properties/AssemblyInfo.cs
+++ b/src/Org.Mentalis.Security.Cryptography/Properties/AssemblyInfo.cs
@@ -7,7 +7,6 @@
 // We DON'T put an AssemblyVersionAttribute in here because it is generated in the build.
 
 using System;
-using System.Diagnostics.Contracts;
 using System.Net;
 using System.Reflection;
 using System.Resources;
@@ -31,8 +30,6 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(true)]
-
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
 // keep this assembly from being useful to shared host (medium trust) web sites.
diff --git a/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nupkg b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nupkg
new file mode 100644
index 0000000..acc6f4e
--- /dev/null
+++ b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nupkg
diff --git a/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nuspec b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nuspec
new file mode 100644
index 0000000..630c4b6
--- /dev/null
+++ b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/Microsoft.IdentityModel.6.1.7600.16394.nuspec
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
+  <metadata>
+    <id>Microsoft.IdentityModel</id>
+    <version>6.1.7600.16394</version>
+    <title>Windows Identity Foundation</title>
+    <authors>Microsoft</authors>
+    <owners>Microsoft</owners>
+    <licenseUrl>http://go.microsoft.com/fwlink/?LinkID=259741</licenseUrl>
+    <projectUrl>http://www.microsoft.com/wif</projectUrl>
+    <requireLicenseAcceptance>true</requireLicenseAcceptance>
+    <description>Windows Identity Foundation enables .NET developers to externalize identity logic from their application, improving developer productivity, enhancing application security, and enabling interoperable federation. Enjoy greater productivity, applying the same tools and programming model to build on-premises software as well as cloud services. Create more secure applications by reducing custom implementations and using a single simplified identity model based on claims. Enjoy greater flexibility in application deployment through interoperability based on industry standard protocols, allowing applications and identity infrastructure services to communicate via claims.</description>
+    <summary>Windows Identity Foundation enables .NET developers to externalize identity logic from their application, improving developer productivity, enhancing application security, and enabling interoperable federation. Enjoy greater productivity, applying the same tools and programming model to build on-premises software as well as cloud services. Create more secure applications by reducing custom implementations and using a single simplified identity model based on claims. Enjoy greater flexibility in application deployment through interoperability based on industry standard protocols, allowing applications and identity infrastructure services to communicate via claims.</summary>
+    <releaseNotes>WIF was integrated into .NET in version 4.5. WIF 3.5  is available for Windows Vista and Windows 7 as a standalone installer, as feature in Windows 8, or WebPI. WIF 3.5 works with .NET 3.5, 4.0 and 4.5.  Because many of the classes in WIF 3.5 and WIF 4.5 share the same names, when you are using both WIF 3.5 and WIF 4.5 together, be sure to either use fully qualified class names or use namespace aliases to distinguish between classes in WIF 3.5 and WIF 4.5.</releaseNotes>
+    <copyright>Copyright 2012</copyright>
+    <tags>authentication federation claims</tags>
+  </metadata>
+</package>
+\ No newline at end of file
diff --git a/src/packages/Microsoft.IdentityModel.6.1.7600.16394/lib/net35/Microsoft.IdentityModel.dll b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/lib/net35/Microsoft.IdentityModel.dll
new file mode 100644
index 0000000..5c1c205
--- /dev/null
+++ b/src/packages/Microsoft.IdentityModel.6.1.7600.16394/lib/net35/Microsoft.IdentityModel.dll
diff --git a/src/packages/repositories.config b/src/packages/repositories.config
new file mode 100644
index 0000000..0b7a47b
--- /dev/null
+++ b/src/packages/repositories.config
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<repositories>
+  <repository path="..\..\samples\OAuthConsumerWpf\packages.config" />
+  <repository path="..\..\samples\OpenIdOfflineProvider\packages.config" />
+  <repository path="..\DotNetOpenAuth.AspNet\packages.config" />
+  <repository path="..\DotNetOpenAuth.Core.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.Core\packages.config" />
+  <repository path="..\DotNetOpenAuth.InfoCard.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.InfoCard\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth.Common\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth.Consumer\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth.ServiceProvider\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2.AuthorizationServer\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2.Client.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2.Client\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2.ClientAuthorization\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2.ResourceServer\packages.config" />
+  <repository path="..\DotNetOpenAuth.OAuth2\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId.Provider.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId.Provider\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId.RelyingParty.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId.RelyingParty\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenId\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenIdInfoCard.UI\packages.config" />
+  <repository path="..\DotNetOpenAuth.OpenIdOAuth\packages.config" />
+  <repository path="..\DotNetOpenAuth.Test\packages.config" />
+</repositories>
+\ No newline at end of file
author	Andrew Arnott <andrewarnott@gmail.com>	2012-12-26 20:22:14 -0800
committer	Andrew Arnott <andrewarnott@gmail.com>	2012-12-26 20:22:14 -0800
commit	391397a341282d0c088bc9e9901ced9b19a62e5a (patch)
tree	bc1cc264acba9edc486eefbbfbb5fd4822111fb1 /src
parent	8f48e3f1daedb77e451f9fe8ac497741c6bb06f9 (diff)
parent	3475fab579db0f6a1454ebc83d2e8a9c271e4c18 (diff)
download	DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.zip DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.tar.gz DotNetOpenAuth-391397a341282d0c088bc9e9901ced9b19a62e5a.tar.bz2