Switched almost entirely over to Code Contracts across the entire library.

But some unit tests still fail, and there are other issues.

138 files changed, 1084 insertions, 708 deletions

diff --git a/src/DotNetOpenAuth.Test/AssemblyTesting.cs b/src/DotNetOpenAuth.Test/AssemblyTesting.cs
index d0868d2..83e2242 100644
--- a/src/DotNetOpenAuth.Test/AssemblyTesting.cs
+++ b/src/DotNetOpenAuth.Test/AssemblyTesting.cs
@@ -14,10 +14,7 @@ namespace DotNetOpenAuth.Test {
 		public static void AssemblyInitialize(TestContext tc) {
 			// Make contract failures become test failures.
 			Contract.ContractFailed += (sender, e) => {
-				if (e.FailureKind == ContractFailureKind.Precondition) {
-					// Currently we ignore these so that the regular ErrorUtilities can kick in.
-					e.SetHandled();
-				} else {
+				if (e.FailureKind != ContractFailureKind.Precondition) {
 					e.SetHandled();
 					Assert.Fail(e.FailureKind.ToString() + ": " + e.Message);
 				}
diff --git a/src/DotNetOpenAuth.Test/CoordinatorBase.cs b/src/DotNetOpenAuth.Test/CoordinatorBase.cs
index d1bf27c..458ec5e 100644
--- a/src/DotNetOpenAuth.Test/CoordinatorBase.cs
+++ b/src/DotNetOpenAuth.Test/CoordinatorBase.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Test {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.RelyingParty;
@@ -17,8 +18,8 @@ namespace DotNetOpenAuth.Test {
 		private Action<T2> party2Action;
 
 		protected CoordinatorBase(Action<T1> party1Action, Action<T2> party2Action) {
-			ErrorUtilities.VerifyArgumentNotNull(party1Action, "party1Action");
-			ErrorUtilities.VerifyArgumentNotNull(party2Action, "party2Action");
+			Contract.Requires<ArgumentNullException>(party1Action != null);
+			Contract.Requires<ArgumentNullException>(party2Action != null);
 
 			this.party1Action = party1Action;
 			this.party2Action = party2Action;
diff --git a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
index 32e0acc..49e9b9e 100644
--- a/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
+++ b/src/DotNetOpenAuth.Test/DotNetOpenAuth.Test.csproj
@@ -21,12 +21,12 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
+    <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
     <CodeContractsCustomRewriterAssembly>
     </CodeContractsCustomRewriterAssembly>
     <CodeContractsCustomRewriterClass>
     </CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
+    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
     <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
     <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
     <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
@@ -44,6 +44,8 @@
     <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
     <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
     <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>
@@ -52,6 +54,31 @@
     <DefineConstants>TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
+    <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
+    <CodeContractsCustomRewriterAssembly>
+    </CodeContractsCustomRewriterAssembly>
+    <CodeContractsCustomRewriterClass>
+    </CodeContractsCustomRewriterClass>
+    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
+    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
+    <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
+    <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
+    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
+    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
+    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
+    <CodeContractsLibPaths>
+    </CodeContractsLibPaths>
+    <CodeContractsPlatformPath>
+    </CodeContractsPlatformPath>
+    <CodeContractsExtraAnalysisOptions>
+    </CodeContractsExtraAnalysisOptions>
+    <CodeContractsBaseLineFile>
+    </CodeContractsBaseLineFile>
+    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
+    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
+    <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Sign)' == 'true' ">
     <SignAssembly>true</SignAssembly>
@@ -71,7 +98,7 @@
     </CodeContractsCustomRewriterAssembly>
     <CodeContractsCustomRewriterClass>
     </CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
+    <CodeContractsRuntimeCheckingLevel>None</CodeContractsRuntimeCheckingLevel>
     <CodeContractsRunCodeAnalysis>True</CodeContractsRunCodeAnalysis>
     <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
     <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
@@ -87,6 +114,10 @@
     <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
     <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
     <CodeContractsShowSquigglies>True</CodeContractsShowSquigglies>
+    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
+    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="log4net, Version=1.2.10.0, Culture=neutral, PublicKeyToken=1b44e1d426115821, processorArchitecture=MSIL">
diff --git a/src/DotNetOpenAuth.Test/Messaging/Bindings/StandardReplayProtectionBindingElementTests.cs b/src/DotNetOpenAuth.Test/Messaging/Bindings/StandardReplayProtectionBindingElementTests.cs
index 26ce01c..14651bc 100644
--- a/src/DotNetOpenAuth.Test/Messaging/Bindings/StandardReplayProtectionBindingElementTests.cs
+++ b/src/DotNetOpenAuth.Test/Messaging/Bindings/StandardReplayProtectionBindingElementTests.cs
@@ -31,6 +31,7 @@ namespace DotNetOpenAuth.Test.Messaging.Bindings {
 			this.protocol = Protocol.Default;
 			this.nonceStore = new NonceMemoryStore(TimeSpan.FromHours(3));
 			this.nonceElement = new StandardReplayProtectionBindingElement(this.nonceStore);
+			this.nonceElement.Channel = new Mocks.TestChannel();
 			this.message = new TestReplayProtectedMessage();
 			this.message.UtcCreationDate = DateTime.UtcNow;
 		}
diff --git a/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs b/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
index f9e569a..db136f5 100644
--- a/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
+++ b/src/DotNetOpenAuth.Test/Messaging/CollectionAssert.cs
@@ -5,16 +5,18 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Test.Messaging {
+	using System;
 	using System.Collections;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using Microsoft.VisualStudio.TestTools.UnitTesting;
 
 	internal class CollectionAssert<T> {
 		internal static void AreEquivalent(ICollection<T> expected, ICollection<T> actual) {
-			ErrorUtilities.VerifyArgumentNotNull(expected, "expected");
-			ErrorUtilities.VerifyArgumentNotNull(actual, "actual");
+			Contract.Requires<ArgumentNullException>(expected != null);
+			Contract.Requires<ArgumentNullException>(actual != null);
 
 			ICollection expectedNonGeneric = new List<T>(expected);
 			ICollection actualNonGeneric = new List<T>(actual);
@@ -22,8 +24,8 @@ namespace DotNetOpenAuth.Test.Messaging {
 		}
 
 		internal static void AreEquivalentByEquality(ICollection<T> expected, ICollection<T> actual) {
-			ErrorUtilities.VerifyArgumentNotNull(expected, "expected");
-			ErrorUtilities.VerifyArgumentNotNull(actual, "actual");
+			Contract.Requires<ArgumentNullException>(expected != null);
+			Contract.Requires<ArgumentNullException>(actual != null);
 
 			Assert.AreEqual(expected.Count, actual.Count);
 			foreach (T value in expected) {
@@ -32,7 +34,7 @@ namespace DotNetOpenAuth.Test.Messaging {
 		}
 
 		internal static void Contains(IEnumerable<T> sequence, T element) {
-			ErrorUtilities.VerifyArgumentNotNull(sequence, "sequence");
+			Contract.Requires<ArgumentNullException>(sequence != null);
 
 			if (!sequence.Contains(element)) {
 				Assert.Fail("Sequence did not include expected element '{0}'.", element);
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
index 3bbe6e3..16386de 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingChannel.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using System.Threading;
@@ -84,7 +85,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		/// <param name="outgoingMessageFilter">The outgoing message filter.  May be null.</param>
 		internal CoordinatingChannel(Channel wrappedChannel, Action<IProtocolMessage> incomingMessageFilter, Action<IProtocolMessage> outgoingMessageFilter)
 			: base(GetMessageFactory(wrappedChannel), wrappedChannel.BindingElements.ToArray()) {
-			ErrorUtilities.VerifyArgumentNotNull(wrappedChannel, "wrappedChannel");
+			Contract.Requires<ArgumentNullException>(wrappedChannel != null);
 
 			this.wrappedChannel = wrappedChannel;
 			this.incomingMessageFilter = incomingMessageFilter;
@@ -220,7 +221,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		/// channel since their message factory is not used.
 		/// </remarks>
 		protected virtual T CloneSerializedParts<T>(T message) where T : class, IProtocolMessage {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			IProtocolMessage clonedMessage;
 			var messageAccessor = this.MessageDescriptions.GetAccessor(message);
@@ -251,7 +252,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		private static IMessageFactory GetMessageFactory(Channel channel) {
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			Channel_Accessor accessor = Channel_Accessor.AttachShadow(channel);
 			return accessor.MessageFactory;
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthChannel.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthChannel.cs
index 2d14bc8..2e4ccad 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthChannel.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOAuthChannel.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.Threading;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
@@ -134,7 +135,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		private T CloneSerializedParts<T>(T message, HttpRequestInfo requestInfo) where T : class, IProtocolMessage {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			IProtocolMessage clonedMessage;
 			var messageAccessor = this.MessageDescriptions.GetAccessor(message);
diff --git a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
index 07f9bc9..62ea871 100644
--- a/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/CoordinatingOutgoingWebResponse.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -20,8 +21,8 @@ namespace DotNetOpenAuth.Test.Mocks {
 		/// <param name="message">The direct response message to send to the remote channel.  This message will be cloned.</param>
 		/// <param name="receivingChannel">The receiving channel.</param>
 		internal CoordinatingOutgoingWebResponse(IProtocolMessage message, CoordinatingChannel receivingChannel) {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
-			ErrorUtilities.VerifyArgumentNotNull(receivingChannel, "receivingChannel");
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentNullException>(receivingChannel != null);
 
 			this.receivingChannel = receivingChannel;
 			this.OriginalMessage = message;
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs b/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
index 66f258d..0213a33 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockHttpRequest.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Net;
@@ -22,7 +23,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		private readonly Dictionary<Uri, IncomingWebResponse> registeredMockResponses = new Dictionary<Uri, IncomingWebResponse>();
 
 		private MockHttpRequest(IDirectWebRequestHandler mockHandler) {
-			ErrorUtilities.VerifyArgumentNotNull(mockHandler, "mockHandler");
+			Contract.Requires<ArgumentNullException>(mockHandler != null);
 			this.MockWebRequestHandler = mockHandler;
 		}
 
@@ -41,7 +42,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		internal void RegisterMockResponse(IncomingWebResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			if (this.registeredMockResponses.ContainsKey(response.RequestUri)) {
 				Logger.Http.WarnFormat("Mock HTTP response already registered for {0}.", response.RequestUri);
 			} else {
@@ -58,9 +59,9 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		internal void RegisterMockResponse(Uri requestUri, Uri responseUri, string contentType, WebHeaderCollection headers, string responseBody) {
-			ErrorUtilities.VerifyArgumentNotNull(requestUri, "requestUri");
-			ErrorUtilities.VerifyArgumentNotNull(responseUri, "responseUri");
-			ErrorUtilities.VerifyNonZeroLength(contentType, "contentType");
+			Contract.Requires<ArgumentNullException>(requestUri != null);
+			Contract.Requires<ArgumentNullException>(responseUri != null);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(contentType));
 
 			// Set up the redirect if appropriate
 			if (requestUri != responseUri) {
@@ -83,7 +84,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		internal void RegisterMockXrdsResponse(ServiceEndpoint endpoint) {
-			ErrorUtilities.VerifyArgumentNotNull(endpoint, "endpoint");
+			Contract.Requires<ArgumentNullException>(endpoint != null);
 
 			string identityUri;
 			if (endpoint.ClaimedIdentifier == endpoint.Protocol.ClaimedIdentifierForOPIdentifier) {
@@ -95,7 +96,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		}
 
 		internal void RegisterMockXrdsResponse(Uri respondingUri, IEnumerable<ServiceEndpoint> endpoints) {
-			ErrorUtilities.VerifyArgumentNotNull(endpoints, "endpoints");
+			Contract.Requires<ArgumentNullException>(endpoints != null);
 
 			StringBuilder xrds = new StringBuilder();
 			xrds.AppendLine(@"<xrds:XRDS xmlns:xrds='xri://$xrds' xmlns:openid='http://openid.net/xmlns/1.0' xmlns='xri://$xrd*($v*2.0)'>
diff --git a/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs b/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
index 669e4d3..2788435 100644
--- a/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/MockIdentifier.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
 	using DotNetOpenAuth.OpenId.RelyingParty;
@@ -25,9 +26,9 @@ namespace DotNetOpenAuth.Test.Mocks {
 
 		public MockIdentifier(Identifier wrappedIdentifier, MockHttpRequest mockHttpRequest, IEnumerable<ServiceEndpoint> endpoints)
 			: base(false) {
-			ErrorUtilities.VerifyArgumentNotNull(wrappedIdentifier, "wrappedIdentifier");
-			ErrorUtilities.VerifyArgumentNotNull(mockHttpRequest, "mockHttpRequest");
-			ErrorUtilities.VerifyArgumentNotNull(endpoints, "endpoints");
+			Contract.Requires<ArgumentNullException>(wrappedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(mockHttpRequest != null);
+			Contract.Requires<ArgumentNullException>(endpoints != null);
 
 			this.wrappedIdentifier = wrappedIdentifier;
 			this.endpoints = endpoints;
diff --git a/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs b/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
index ffb117c..7b13175 100644
--- a/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/TestMessageFactory.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.Mocks {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -32,8 +33,6 @@ namespace DotNetOpenAuth.Test.Mocks {
 		#region IMessageFactory Members
 
 		public IDirectedProtocolMessage GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			if (fields.ContainsKey("age")) {
 				if (this.signedMessages) {
 					if (this.expiringMessages) {
diff --git a/src/DotNetOpenAuth.Test/Mocks/TestWebRequestHandler.cs b/src/DotNetOpenAuth.Test/Mocks/TestWebRequestHandler.cs
index b74c0f0..03dbd6b 100644
--- a/src/DotNetOpenAuth.Test/Mocks/TestWebRequestHandler.cs
+++ b/src/DotNetOpenAuth.Test/Mocks/TestWebRequestHandler.cs
@@ -56,7 +56,7 @@ namespace DotNetOpenAuth.Test.Mocks {
 		#region IWebRequestHandler Members
 
 		public bool CanSupport(DirectWebRequestOptions options) {
-			return options == DirectWebRequestOptions.None;
+			return true;
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
index 449a033..923e6c1 100644
--- a/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
+++ b/src/DotNetOpenAuth.Test/OAuth/ChannelElements/OAuthChannelTests.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.Test.ChannelElements {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.Specialized;
+	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Text;
@@ -243,7 +244,7 @@ namespace DotNetOpenAuth.Test.ChannelElements {
 		}
 
 		private static string CreateAuthorizationHeader(IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
+			Contract.Requires<ArgumentNullException>(fields != null);
 
 			StringBuilder authorization = new StringBuilder();
 			authorization.Append("OAuth ");
diff --git a/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs b/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
index e04edeb..4373402 100644
--- a/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
+++ b/src/DotNetOpenAuth.Test/OAuth/OAuthCoordinator.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Test {
 	using System;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.ChannelElements;
@@ -25,8 +26,8 @@ namespace DotNetOpenAuth.Test {
 		/// <param name="serviceProviderAction">The code path of the Service Provider.</param>
 		internal OAuthCoordinator(ConsumerDescription consumerDescription, ServiceProviderDescription serviceDescription, Action<WebConsumer> consumerAction, Action<ServiceProvider> serviceProviderAction)
 			: base(consumerAction, serviceProviderAction) {
-			ErrorUtilities.VerifyArgumentNotNull(consumerDescription, "consumerDescription");
-			ErrorUtilities.VerifyArgumentNotNull(serviceDescription, "serviceDescription");
+			Contract.Requires<ArgumentNullException>(consumerDescription != null);
+			Contract.Requires<ArgumentNullException>(serviceDescription != null);
 
 			this.consumerDescription = consumerDescription;
 			this.serviceDescription = serviceDescription;
diff --git a/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs b/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
index 4ebdf74..7de2a8b 100644
--- a/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/AuthenticationTests.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Test.OpenId {
 	using System;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId;
@@ -135,8 +136,8 @@ namespace DotNetOpenAuth.Test.OpenId {
 		}
 
 		private void ParameterizedAuthenticationTest(Protocol protocol, bool statelessRP, bool sharedAssociation, bool positive, bool immediate, bool tamper) {
-			ErrorUtilities.VerifyArgument(!statelessRP || !sharedAssociation, "The RP cannot be stateless while sharing an association with the OP.");
-			ErrorUtilities.VerifyArgument(positive || !tamper, "Cannot tamper with a negative response.");
+			Contract.Requires<ArgumentException>(!statelessRP || !sharedAssociation, "The RP cannot be stateless while sharing an association with the OP.");
+			Contract.Requires<ArgumentException>(positive || !tamper, "Cannot tamper with a negative response.");
 			ProviderSecuritySettings securitySettings = new ProviderSecuritySettings();
 			Association association = sharedAssociation ? HmacShaAssociation.Create(protocol, protocol.Args.SignatureAlgorithm.Best, AssociationRelyingPartyType.Smart, securitySettings) : null;
 			var coordinator = new OpenIdCoordinator(
diff --git a/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs b/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
index 12f6e7a..08432ff 100644
--- a/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/ChannelElements/ExtensionsBindingElementTests.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Test.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text.RegularExpressions;
 	using DotNetOpenAuth.Messaging;
@@ -167,7 +168,7 @@ namespace DotNetOpenAuth.Test.OpenId.ChannelElements {
 		}
 
 		private static void RegisterMockExtension(Channel channel) {
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			ExtensionTestUtilities.RegisterExtension(channel, MockOpenIdExtension.Factory);
 		}
@@ -178,7 +179,7 @@ namespace DotNetOpenAuth.Test.OpenId.ChannelElements {
 		/// <param name="protocol">The protocol to construct the message with.</param>
 		/// <returns>The message ready to send from OP to RP.</returns>
 		private IndirectSignedResponse CreateResponseWithExtensions(Protocol protocol) {
-			ErrorUtilities.VerifyArgumentNotNull(protocol, "protocol");
+			Contract.Requires<ArgumentNullException>(protocol != null);
 
 			IndirectSignedResponse response = new IndirectSignedResponse(protocol.Version, RPUri);
 			response.ProviderEndpoint = OPUri;
diff --git a/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeRequestTests.cs b/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeRequestTests.cs
index 228bda3..48b5727 100644
--- a/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeRequestTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeRequestTests.cs
@@ -25,7 +25,7 @@ namespace DotNetOpenAuth.Test.OpenId.Extensions {
 			new AttributeRequest(string.Empty);
 		}
 
-		[TestMethod, ExpectedException(typeof(ArgumentNullException))]
+		[TestMethod, ExpectedException(typeof(ArgumentException))]
 		public void CtorNullTypeUri() {
 			new AttributeRequest(null);
 		}
diff --git a/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs b/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
index 47c8ec4..334fc93 100644
--- a/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/Extensions/ExtensionTestUtilities.cs
@@ -5,7 +5,9 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Test.OpenId.Extensions {
+	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId;
@@ -71,7 +73,7 @@ namespace DotNetOpenAuth.Test.OpenId.Extensions {
 		}
 
 		internal static void RegisterExtension(Channel channel, StandardOpenIdExtensionFactory.CreateDelegate extensionFactory) {
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			var factory = (OpenIdExtensionFactoryAggregator)channel.BindingElements.OfType<ExtensionsBindingElement>().Single().ExtensionFactory;
 			factory.Factories.OfType<StandardOpenIdExtensionFactory>().Single().RegisterExtension(extensionFactory);
diff --git a/src/DotNetOpenAuth.Test/OpenId/IdentifierTests.cs b/src/DotNetOpenAuth.Test/OpenId/IdentifierTests.cs
index 3e599e9..cc02265 100644
--- a/src/DotNetOpenAuth.Test/OpenId/IdentifierTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/IdentifierTests.cs
@@ -75,7 +75,7 @@ namespace DotNetOpenAuth.Test.OpenId {
 			Assert.AreEqual(this.uri, ((UriIdentifier)id).Uri.AbsoluteUri);
 		}
 
-		[TestMethod, ExpectedException(typeof(ArgumentNullException))]
+		[TestMethod, ExpectedException(typeof(ArgumentException))]
 		public void ParseNull() {
 			Identifier.Parse(null);
 		}
diff --git a/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs b/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
index af9c5db..0f9d472 100644
--- a/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/OpenIdCoordinator.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Test.OpenId {
 	using System;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Bindings;
 	using DotNetOpenAuth.OpenId;
@@ -36,7 +37,7 @@ namespace DotNetOpenAuth.Test.OpenId {
 		}
 
 		private static Action<OpenIdRelyingParty> WrapAction(Action<OpenIdRelyingParty> action) {
-			ErrorUtilities.VerifyArgumentNotNull(action, "action");
+			Contract.Requires<ArgumentNullException>(action != null);
 
 			return rp => {
 				action(rp);
@@ -45,7 +46,7 @@ namespace DotNetOpenAuth.Test.OpenId {
 		}
 
 		private static Action<OpenIdProvider> WrapAction(Action<OpenIdProvider> action) {
-			ErrorUtilities.VerifyArgumentNotNull(action, "action");
+			Contract.Requires<ArgumentNullException>(action != null);
 
 			return op => {
 				action(op);
diff --git a/src/DotNetOpenAuth.Test/OpenId/UriIdentifierTests.cs b/src/DotNetOpenAuth.Test/OpenId/UriIdentifierTests.cs
index 3b3f985..92379da 100644
--- a/src/DotNetOpenAuth.Test/OpenId/UriIdentifierTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/UriIdentifierTests.cs
@@ -31,7 +31,7 @@ namespace DotNetOpenAuth.Test.OpenId {
 			new UriIdentifier((Uri)null);
 		}
 
-		[TestMethod, ExpectedException(typeof(ArgumentNullException))]
+		[TestMethod, ExpectedException(typeof(ArgumentException))]
 		public void CtorNullString() {
 			new UriIdentifier((string)null);
 		}
diff --git a/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
index d6fd020..4744bfe 100644
--- a/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth.Test/Properties/AssemblyInfo.cs
@@ -29,4 +29,4 @@ using System.Runtime.InteropServices;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("aef0bb13-b79c-4854-a69a-de58b8feb5d1")]
 
-[assembly: ContractVerification(false)]
\ No newline at end of file
+[assembly: ContractVerification(true)]
\ No newline at end of file
diff --git a/src/DotNetOpenAuth.vsmdi b/src/DotNetOpenAuth.vsmdi
index cf17701..d19f6ea 100644
--- a/src/DotNetOpenAuth.vsmdi
+++ b/src/DotNetOpenAuth.vsmdi
@@ -33,7 +33,7 @@
       <TestLink id="ca9f3da7-e19f-b58b-54fe-54fa56ab9556" name="AddByKeyAndValue" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="d766edce-59de-a03d-830a-0f0477521cff" name="ApplyHeadersToResponseNullAspNetResponse" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="84e718d7-bb82-e7d1-31be-471e2c154053" name="Item" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="a1ff4ada-fe5d-d2f3-b7fb-8e72db02b3c3" name="Full" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="889ba616-43dc-8a7f-ee13-46288969d617" name="ParameterNames" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="fdf5b3df-239b-26fd-c1a2-152057195b7e" name="ReadFromRequestForm" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="149a95cf-a538-f853-e11b-3133c15579c5" name="RequestTokenUriTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="f3cbbcda-49ff-fc43-140b-f362081654c3" name="CtorNullTypeUri" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -71,6 +71,7 @@
       <TestLink id="2d0ee03a-f082-768c-a0db-574ac8efeffb" name="Valid" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="6c20a52a-bab7-e84e-faca-fd79ec5303d9" name="CtorCountZero" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="7fb8d29c-c8ea-7f88-ed42-ae7368d6a429" name="CtorNullStore" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="ab653060-5bec-3dc6-78ee-a5ef7d393b1d" name="AddPolicyMultipleTimes" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="50986611-9de6-a112-2fe8-691210989f45" name="IsTypeUriPresent" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="14ce54ee-5507-ac70-5514-99b7b83ba3d6" name="ExtensionFactories" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="b4b00582-dcc9-7672-0c02-52432b074a92" name="GetNullType" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -79,16 +80,17 @@
       <TestLink id="507cd1b6-1010-0bca-cf7f-f96e3f4f6c6c" name="QueryBeforeSettingUrl" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="1dcbaac6-0b11-8d8f-50d7-237574abbab1" name="ToDictionaryWithSkippedNullKey" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="715dcbdd-28f5-3c33-7d88-e0a1b648d89a" name="CreateRequestDumbMode" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="a1ff4ada-fe5d-d2f3-b7fb-8e72db02b3c3" name="Full" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="85a71d28-5f2f-75ce-9008-94982438bb5f" name="EqualityTests" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="f17424d2-ed4b-1ea0-a339-733f5092d9d0" name="MaximumAuthenticationAgeTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="889ba616-43dc-8a7f-ee13-46288969d617" name="ParameterNames" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="7debb527-142a-6ca6-3b9b-1e131c18e801" name="AccessTokenUriTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="98e7a0f9-ab6c-7ff1-3a2c-00d8244e1bec" name="CommonMethods" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="44afc59c-60fc-3179-b5a6-1e58e7752d54" name="ApplyHeadersToResponseNullHeaders" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="af7cb01c-950e-23d7-0f32-082b7af8b382" name="CtorNullToObject" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="a260d196-066f-b0ae-a40e-fb9d962b28a4" name="XrdsDirectDiscovery_20" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="13acd546-c82e-324c-220d-34f42a6d705e" name="DeserializeSimple" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="b56cdf04-0d29-8b13-468c-fb4b4258c619" name="CtorNull" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="2c2b48d0-8009-e7e0-9ff4-34f9973f59da" name="EqualsTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="d474830d-3636-522c-1564-1b83e7a844d3" name="EmptyLine" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="63e5025b-5ccf-5f13-6e05-d1e44502a6e9" name="RequestBadPreferredScheme" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="f20bd439-e277-dc27-4ec4-5d5949d1c6bf" name="RequestUsingAuthorizationHeaderScattered" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="3fc3ac8d-7772-b620-0927-f4bd3a24ce2f" name="SendNull" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -115,10 +117,10 @@
       <TestLink id="0d99e0a9-295e-08a6-bc31-2abb79c00ff8" name="IsReturnUrlDiscoverableRequireSsl" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="38239ff0-1dfd-1116-55df-2790243dc768" name="IsValid" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="04be6602-31a2-f4ae-8fdb-b9ad2ac370be" name="PrepareMessageForReceiving" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="2c2b48d0-8009-e7e0-9ff4-34f9973f59da" name="EqualsTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="5dd2e6c9-ff0f-48de-3a1a-cbab61370843" name="SetCountNegative" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="182203f3-5a16-b736-ea8c-b59f6bf7df66" name="InvalidRealmTwoWildcards2" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="4fd5baa2-8f39-8bf6-db8f-aa92592bfc06" name="CtorRequest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="d474830d-3636-522c-1564-1b83e7a844d3" name="EmptyLine" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="385c302d-b546-c164-2a59-2e35f75d7d60" name="RemoveStructDeclaredProperty" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="870cce9d-5b17-953c-028f-827ec8b56da2" name="GetInvalidMessageType" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="97f0277a-86e6-5b5a-8419-c5253cabf2e0" name="UserAuthorizationUriTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -159,7 +161,6 @@
       <TestLink id="b2e1bba0-ab24-cdd5-906c-a3655814ab2d" name="SendSetsTimestamp" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="2f1a3fc4-77ec-2ae3-668c-9e18f9ab0ebe" name="SendIndirectMessage301Get" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="e4403d9e-73c1-967d-345c-4a2c83880d4e" name="EqualsTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="7debb527-142a-6ca6-3b9b-1e131c18e801" name="AccessTokenUriTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="a145f430-8062-5ad7-0cf5-b51eba0f8de7" name="HttpsSignatureGeneration" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="066ce22f-103c-56ee-0250-d9e28d43ffcd" name="Values" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="bb542259-4c10-4b88-1b3c-f842b0bb49a9" name="ImmediateVsSetupModes" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -260,7 +261,7 @@
       <TestLink id="a4aa113a-57b5-a52c-c4e3-f70d6702badb" name="Default" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="1da7c479-bf01-2d12-8645-b4f7007dcfec" name="LanguagePreferenceEncoding" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="547cfee6-bbb4-6138-a114-fc0eb6cc94f6" name="PrivateAssociationTampered" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="cbdfd707-7ba8-4b8f-9d58-17b125aa4cd4" name="SendIndirectMessage301GetNullMessage" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="5803e93d-e256-86ba-e10e-499d2f813c6d" name="Trivial" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="beb086e9-5eb7-fb8f-480a-70ede9efd70d" name="CreateRequests" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="78f622a3-750c-12c5-afc6-470c1bf71d85" name="ProtocolDetectionWithoutClues" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="0c1a0323-092a-34b3-1601-1f941569efab" name="CtorGoodXri" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -284,7 +285,6 @@
       <TestLink id="b9cda1a0-83cd-cf4b-b61f-4faa75fa37ba" name="ReceivedReplayProtectedMessageTwice" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="7f9c4a9e-de7a-555c-543d-db89b757588e" name="AppendQueryArgs" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="e9cceef5-383d-92f0-a8bb-f3e207582836" name="RealmReturnToMismatchV2" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="32e95494-d0bb-cfc7-a8d6-652f8816c6b4" name="ReadFromResponse" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="d6b120b7-fc16-6815-927e-af382cd44bbd" name="ReceivedInvalidSignature" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="b71d12f6-58a1-cf82-d06e-e57c0a3ea55c" name="RPRejectsUnencryptedSuggestion" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="77e5af06-b02d-692e-b32f-40ea39e77fbd" name="FriendlyIdentifierForDisplay" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -431,7 +431,7 @@
       <TestLink id="c4001e1c-75ad-236b-284f-318905d2bc3a" name="CreateRequestOnNonOpenID" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="b58e4791-68c0-1bc0-2e48-e1351459ee46" name="UserSetupUrlSetForV1Immediate" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="30f3c12b-e510-de63-5acd-ae8e32866592" name="CreateQueryString" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="ab653060-5bec-3dc6-78ee-a5ef7d393b1d" name="AddPolicyMultipleTimes" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="32e95494-d0bb-cfc7-a8d6-652f8816c6b4" name="ReadFromResponse" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="f967c0af-c04c-d156-4faf-8978bfcab5d7" name="RequiredNullableStruct" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="248f0afc-979f-a86f-e7de-fdeb4f9dd3ea" name="CtorBadUri" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="fa2e5bbd-4c41-f2b1-e875-38c6ef011fa1" name="RandomCharactersTest" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
@@ -464,7 +464,7 @@
       <TestLink id="534bee09-36e1-c3e0-f6af-bc191b10aa48" name="CtorNullSigner" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="9986fea9-8d64-9ada-60cb-ab95adb50fb7" name="ToStringDeferredEmptyMultiLine" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="de1cdd00-a226-0d43-62b6-0c1ad325be8c" name="RequiredMinAndMaxVersions" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
-      <TestLink id="5803e93d-e256-86ba-e10e-499d2f813c6d" name="Trivial" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
+      <TestLink id="cbdfd707-7ba8-4b8f-9d58-17b125aa4cd4" name="SendIndirectMessage301GetNullMessage" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="5aa4dfa9-9691-bfe0-7d81-587cfa519a55" name="DirectResponsesReceivedAsKeyValueForm" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="8fd673c8-977a-7b66-72cb-38c7054796c7" name="DiscoverRequireSslWithSecureRedirects" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
       <TestLink id="5271f941-565f-5977-6884-82cef09161db" name="ParseEndUserSuppliedXriIdentifer" storage="..\bin\debug\dotnetopenauth.test.dll" type="Microsoft.VisualStudio.TestTools.TestTypes.Unit.UnitTestElement, Microsoft.VisualStudio.QualityTools.Tips.UnitTest.ObjectModel,   PublicKeyToken=b03f5f7f11d50a3a" />
diff --git a/src/DotNetOpenAuth/Configuration/TypeConfigurationCollection.cs b/src/DotNetOpenAuth/Configuration/TypeConfigurationCollection.cs
index fa3518b..db1e02f 100644
--- a/src/DotNetOpenAuth/Configuration/TypeConfigurationCollection.cs
+++ b/src/DotNetOpenAuth/Configuration/TypeConfigurationCollection.cs
@@ -31,7 +31,7 @@ namespace DotNetOpenAuth.Configuration {
 		/// </summary>
 		/// <param name="elements">The elements that should be added to the collection initially.</param>
 		internal TypeConfigurationCollection(IEnumerable<Type> elements) {
-			Contract.Requires(elements != null);
+			Contract.Requires<ArgumentNullException>(elements != null);
 			ErrorUtilities.VerifyArgumentNotNull(elements, "elements");
 
 			foreach (Type element in elements) {
@@ -70,7 +70,7 @@ namespace DotNetOpenAuth.Configuration {
 		/// </returns>
 		protected override object GetElementKey(ConfigurationElement element) {
 			Contract.Assume(element != null); // this should be Contract.Requires in base class.
-			return ((TypeConfigurationElement<T>)element).TypeName;
+			return ((TypeConfigurationElement<T>)element).TypeName ?? string.Empty;
 		}
 	}
 }
diff --git a/src/DotNetOpenAuth/Configuration/TypeConfigurationElement.cs b/src/DotNetOpenAuth/Configuration/TypeConfigurationElement.cs
index 20cd332..59e10cd 100644
--- a/src/DotNetOpenAuth/Configuration/TypeConfigurationElement.cs
+++ b/src/DotNetOpenAuth/Configuration/TypeConfigurationElement.cs
@@ -7,9 +7,9 @@
 namespace DotNetOpenAuth.Configuration {
 	using System;
 	using System.Configuration;
+	using System.Diagnostics.Contracts;
 	using System.Reflection;
 	using DotNetOpenAuth.Messaging;
-	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// Represents an element in a .config file that allows the user to provide a @type attribute specifying
diff --git a/src/DotNetOpenAuth/ContractRuntimeFailureMethods.cs b/src/DotNetOpenAuth/ContractRuntimeFailureMethods.cs
index 5a6c465..7d7f301 100644
--- a/src/DotNetOpenAuth/ContractRuntimeFailureMethods.cs
+++ b/src/DotNetOpenAuth/ContractRuntimeFailureMethods.cs
@@ -8,6 +8,7 @@
 namespace DotNetOpenAuth {
 	using System;
 	using System.Diagnostics;
+	using System.Diagnostics.CodeAnalysis;
 	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 
@@ -20,9 +21,14 @@ namespace DotNetOpenAuth {
 	/// to redirect to this class.
 	/// </remarks>
 	internal static class ContractRuntimeFailureMethods {
+		[SuppressMessage("Microsoft.Usage", "CA1801:ReviewUnusedParameters", MessageId = "failureKind", Justification = "Code Contracts signature.")]
 		[DebuggerStepThrough]
 		internal static void ReportFailure(ContractFailureKind failureKind, string userProvidedMessage, string condition, Exception originalException) {
-			ErrorUtilities.ThrowInternal(userProvidedMessage ?? condition);
+			if (failureKind == ContractFailureKind.Precondition) {
+				throw new ArgumentException(userProvidedMessage ?? condition, originalException);
+			} else {
+				throw new InternalErrorException(userProvidedMessage ?? condition, originalException);
+			}
 		}
 	}
 }
diff --git a/src/DotNetOpenAuth/DotNetOpenAuth.csproj b/src/DotNetOpenAuth/DotNetOpenAuth.csproj
index c91e1f9..766e60a 100644
--- a/src/DotNetOpenAuth/DotNetOpenAuth.csproj
+++ b/src/DotNetOpenAuth/DotNetOpenAuth.csproj
@@ -25,11 +25,9 @@
     <DocumentationFile>..\..\bin\Debug\DotNetOpenAuth.xml</DocumentationFile>
     <RunCodeAnalysis>false</RunCodeAnalysis>
     <CodeAnalysisRules>-Microsoft.Design#CA1054;-Microsoft.Design#CA1056;-Microsoft.Design#CA1055</CodeAnalysisRules>
-    <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
+    <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
+    <CodeContractsCustomRewriterAssembly>DotNetOpenAuth</CodeContractsCustomRewriterAssembly>
+    <CodeContractsCustomRewriterClass>DotNetOpenAuth.ContractRuntimeFailureMethods</CodeContractsCustomRewriterClass>
     <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
     <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
     <CodeContractsBuildReferenceAssembly>True</CodeContractsBuildReferenceAssembly>
@@ -48,6 +46,8 @@
     <CodeContractsShowSquigglies>True</CodeContractsShowSquigglies>
     <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
     <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>
@@ -63,7 +63,7 @@
     <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
     <CodeContractsCustomRewriterAssembly>DotNetOpenAuth</CodeContractsCustomRewriterAssembly>
     <CodeContractsCustomRewriterClass>DotNetOpenAuth.ContractRuntimeFailureMethods</CodeContractsCustomRewriterClass>
-    <CodeContractsRuntimeCheckingLevel>RequiresAlways</CodeContractsRuntimeCheckingLevel>
+    <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
     <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
     <CodeContractsBuildReferenceAssembly>True</CodeContractsBuildReferenceAssembly>
     <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
@@ -80,6 +80,9 @@
     <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
     <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
     <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
+    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Sign)' == 'true' ">
     <SignAssembly>true</SignAssembly>
@@ -98,10 +101,8 @@
     <CodeAnalysisModuleSuppressionsFile>GlobalSuppressions.cs</CodeAnalysisModuleSuppressionsFile>
     <ErrorReport>prompt</ErrorReport>
     <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
-    <CodeContractsCustomRewriterAssembly>
-    </CodeContractsCustomRewriterAssembly>
-    <CodeContractsCustomRewriterClass>
-    </CodeContractsCustomRewriterClass>
+    <CodeContractsCustomRewriterAssembly>DotNetOpenAuth</CodeContractsCustomRewriterAssembly>
+    <CodeContractsCustomRewriterClass>DotNetOpenAuth.ContractRuntimeFailureMethods</CodeContractsCustomRewriterClass>
     <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
     <CodeContractsRunCodeAnalysis>True</CodeContractsRunCodeAnalysis>
     <CodeContractsBuildReferenceAssembly>False</CodeContractsBuildReferenceAssembly>
@@ -111,7 +112,8 @@
     </CodeContractsLibPaths>
     <CodeContractsPlatformPath>
     </CodeContractsPlatformPath>
-    <CodeContractsExtraAnalysisOptions>-maxpathsize 15</CodeContractsExtraAnalysisOptions>
+    <CodeContractsExtraAnalysisOptions>
+    </CodeContractsExtraAnalysisOptions>
     <CodeContractsBaseLineFile>
     </CodeContractsBaseLineFile>
     <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
@@ -119,6 +121,9 @@
     <CodeContractsShowSquigglies>True</CodeContractsShowSquigglies>
     <RunCodeAnalysis>true</RunCodeAnalysis>
     <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
+    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="log4net, Version=1.2.10.0, Culture=neutral, PublicKeyToken=1b44e1d426115821, processorArchitecture=MSIL">
@@ -366,6 +371,7 @@
     <Compile Include="OpenId\Messages\CheckAuthenticationRequest.cs" />
     <Compile Include="OpenId\Messages\CheckAuthenticationResponse.cs" />
     <Compile Include="OpenId\Messages\CheckIdRequest.cs" />
+    <Compile Include="OpenId\Messages\AssociateSuccessfulResponseContract.cs" />
     <Compile Include="OpenId\Messages\IErrorMessage.cs" />
     <Compile Include="OpenId\Messages\IndirectResponseBase.cs" />
     <Compile Include="OpenId\Messages\IndirectSignedResponse.cs" />
@@ -425,6 +431,8 @@
     <Compile Include="OpenId\RelyingParty\AssociationPreference.cs" />
     <Compile Include="OpenId\RelyingParty\AuthenticationRequest.cs" />
     <Compile Include="OpenId\RelyingParty\AuthenticationRequestMode.cs" />
+    <Compile Include="OpenId\RelyingParty\IXrdsProviderEndpointContract.cs" />
+    <Compile Include="OpenId\RelyingParty\IAuthenticationRequestContract.cs" />
     <Compile Include="OpenId\RelyingParty\NegativeAuthenticationResponse.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdAjaxTextBox.cs" />
     <Compile Include="OpenId\RelyingParty\OpenIdEventArgs.cs" />
@@ -554,4 +562,4 @@
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="..\..\tools\DotNetOpenAuth.Versioning.targets" />
-</Project>
+</Project>
\ No newline at end of file
diff --git a/src/DotNetOpenAuth/InfoCard/InfoCardSelector.cs b/src/DotNetOpenAuth/InfoCard/InfoCardSelector.cs
index 3c50ae7..351cca4 100644
--- a/src/DotNetOpenAuth/InfoCard/InfoCardSelector.cs
+++ b/src/DotNetOpenAuth/InfoCard/InfoCardSelector.cs
@@ -409,8 +409,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The event arguments sent to the event handlers.</returns>
 		[SuppressMessage("Microsoft.Naming", "CA1704:IdentifiersShouldBeSpelledCorrectly", MessageId = "decryptor", Justification = "By design")]
 		protected virtual ReceivingTokenEventArgs OnReceivingToken(string tokenXml) {
-			Contract.Requires(tokenXml != null);
-			ErrorUtilities.VerifyArgumentNotNull(tokenXml, "tokenXml");
+			Contract.Requires<ArgumentNullException>(tokenXml != null);
 
 			var args = new ReceivingTokenEventArgs(tokenXml);
 			var receivingToken = this.ReceivingToken;
@@ -426,8 +425,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </summary>
 		/// <param name="token">The token, if it was decrypted.</param>
 		protected virtual void OnReceivedToken(Token token) {
-			Contract.Requires(token != null);
-			ErrorUtilities.VerifyArgumentNotNull(token, "token");
+			Contract.Requires<ArgumentNullException>(token != null);
 
 			var receivedInfoCard = this.ReceivedToken;
 			if (receivedInfoCard != null) {
@@ -441,8 +439,8 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="unprocessedToken">The unprocessed token.</param>
 		/// <param name="ex">The exception generated while processing the token.</param>
 		protected virtual void OnTokenProcessingError(string unprocessedToken, Exception ex) {
-			Contract.Requires(unprocessedToken != null);
-			Contract.Requires(ex != null);
+			Contract.Requires<ArgumentNullException>(unprocessedToken != null);
+			Contract.Requires<ArgumentNullException>(ex != null);
 
 			var tokenProcessingError = this.TokenProcessingError;
 			if (tokenProcessingError != null) {
diff --git a/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs b/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
index 1511e2d..6c6a5af 100644
--- a/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
@@ -31,6 +31,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs b/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
index f3722d7..0cc28c3 100644
--- a/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
@@ -21,7 +21,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </summary>
 		/// <param name="tokenXml">The raw token XML, prior to any decryption.</param>
 		internal ReceivingTokenEventArgs(string tokenXml) {
-			Contract.Requires(tokenXml != null);
+			Contract.Requires<ArgumentNullException>(tokenXml != null);
 
 			this.TokenXml = tokenXml;
 			this.IsEncrypted = Token.IsEncrypted(this.TokenXml);
@@ -63,7 +63,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </summary>
 		/// <param name="securityToken">The security token.</param>
 		public void AddDecryptingToken(SecurityToken securityToken) {
-			Contract.Requires(securityToken != null);
+			Contract.Requires<ArgumentNullException>(securityToken != null);
 			this.DecryptingTokens.Add(securityToken);
 		}
 
@@ -72,7 +72,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </summary>
 		/// <param name="certificate">The certificate.</param>
 		public void AddDecryptingToken(X509Certificate2 certificate) {
-			Contract.Requires(certificate != null);
+			Contract.Requires<ArgumentNullException>(certificate != null);
 			Contract.Requires(certificate.HasPrivateKey);
 			this.AddDecryptingToken(new X509SecurityToken(certificate));
 		}
@@ -81,6 +81,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/InfoCard/Token/Token.cs b/src/DotNetOpenAuth/InfoCard/Token/Token.cs
index 3e51047..bae58c7 100644
--- a/src/DotNetOpenAuth/InfoCard/Token/Token.cs
+++ b/src/DotNetOpenAuth/InfoCard/Token/Token.cs
@@ -53,7 +53,6 @@ namespace DotNetOpenAuth.InfoCard {
 				Contract.Assume(tokenReader != null); // BCL contract should say XmlReader.Create result != null
 				if (IsEncrypted(tokenReader)) {
 					Logger.InfoCard.DebugFormat("Incoming SAML token, before decryption: {0}", tokenXml);
-					ErrorUtilities.VerifyArgumentNotNull(decryptor, "decryptor");
 					decryptedBytes = decryptor.DecryptToken(tokenReader);
 					decryptedString = Encoding.UTF8.GetString(decryptedBytes);
 					Contract.Assume(decryptedString != null); // BCL contracts should be enhanced here
@@ -157,7 +156,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The deserialized token.</returns>
 		public static Token Read(string tokenXml, IEnumerable<SecurityToken> decryptionTokens) {
 			Contract.Requires(!String.IsNullOrEmpty(tokenXml));
-			Contract.Requires(decryptionTokens != null);
+			Contract.Requires<ArgumentNullException>(decryptionTokens != null);
 			return Read(tokenXml, null, decryptionTokens);
 		}
 
@@ -170,7 +169,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <returns>The deserialized token.</returns>
 		public static Token Read(string tokenXml, Uri audience, IEnumerable<SecurityToken> decryptionTokens) {
 			Contract.Requires(!String.IsNullOrEmpty(tokenXml));
-			Contract.Requires(decryptionTokens != null);
+			Contract.Requires<ArgumentNullException>(decryptionTokens != null);
 			Contract.Ensures(Contract.Result<Token>() != null);
 
 			TokenDecryptor decryptor = null;
@@ -192,8 +191,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// </returns>
 		[Pure]
 		internal static bool IsEncrypted(string tokenXml) {
-			Contract.Requires(tokenXml != null);
-			ErrorUtilities.VerifyArgumentNotNull(tokenXml, "tokenXml");
+			Contract.Requires<ArgumentNullException>(tokenXml != null);
 
 			using (XmlReader tokenReader = XmlReader.Create(new StringReader(tokenXml))) {
 				return IsEncrypted(tokenReader);
@@ -204,6 +202,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant()
@@ -220,8 +219,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// 	<c>true</c> if the specified token XML is encrypted; otherwise, <c>false</c>.
 		/// </returns>
 		private static bool IsEncrypted(XmlReader tokenXmlReader) {
-			Contract.Requires(tokenXmlReader != null);
-			ErrorUtilities.VerifyArgumentNotNull(tokenXmlReader, "tokenXmlReader");
+			Contract.Requires<ArgumentNullException>(tokenXmlReader != null);
 			return tokenXmlReader.IsStartElement(TokenDecryptor.XmlEncryptionStrings.EncryptedData, TokenDecryptor.XmlEncryptionStrings.Namespace);
 		}
 
diff --git a/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs b/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
index 1038ad7..2257f15 100644
--- a/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
+++ b/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
@@ -89,9 +89,8 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="reader">The encrypted token XML reader.</param>
 		/// <returns>A byte array of the contents of the encrypted token</returns>
 		internal byte[] DecryptToken(XmlReader reader) {
-			Contract.Requires(reader != null);
+			Contract.Requires<ArgumentNullException>(reader != null);
 			Contract.Ensures(Contract.Result<byte[]>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(reader, "reader");
 
 			byte[] securityTokenData;
 			string encryptionAlgorithm;
@@ -148,6 +147,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/InfoCard/Token/TokenUtility.cs b/src/DotNetOpenAuth/InfoCard/Token/TokenUtility.cs
index e58f051..d5cde7a 100644
--- a/src/DotNetOpenAuth/InfoCard/Token/TokenUtility.cs
+++ b/src/DotNetOpenAuth/InfoCard/Token/TokenUtility.cs
@@ -162,8 +162,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="authzContext">The Authorization Context</param>
 		/// <returns>A unique ID for this user at this web site.</returns>
 		internal static string GetUniqueName(AuthorizationContext authzContext) {
-			Contract.Requires(authzContext != null);
-			ErrorUtilities.VerifyArgumentNotNull(authzContext, "authzContext");
+			Contract.Requires<ArgumentNullException>(authzContext != null);
 
 			Claim uniqueIssuerClaim = null;
 			Claim uniqueUserClaim = null;
@@ -219,7 +218,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="ppid">The personal private identifier.</param>
 		/// <returns>A string containing the XXX-XXXX-XXX cosmetic value.</returns>
 		internal static string CalculateSiteSpecificID(string ppid) {
-			Contract.Requires(ppid != null);
+			Contract.Requires<ArgumentNullException>(ppid != null);
 			Contract.Ensures(Contract.Result<string>() != null && Contract.Result<string>().Length > 0);
 
 			int callSignChars = 10;
@@ -247,8 +246,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="cs">the claimset which contains the claim</param>
 		/// <returns>a RSA claim</returns>
 		private static Claim GetUniqueRsaClaim(ClaimSet cs) {
-			Contract.Requires(cs != null);
-			ErrorUtilities.VerifyArgumentNotNull(cs, "cs");
+			Contract.Requires<ArgumentNullException>(cs != null);
 
 			Claim rsa = null;
 
@@ -270,11 +268,9 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="claimValue">the claim value to hash with.</param>
 		/// <returns>A base64 representation of the combined ID.</returns>
 		private static string ComputeCombinedId(RSA issuerKey, string claimValue) {
-			Contract.Requires(issuerKey != null);
-			Contract.Requires(claimValue != null);
+			Contract.Requires<ArgumentNullException>(issuerKey != null);
+			Contract.Requires<ArgumentNullException>(claimValue != null);
 			Contract.Ensures(Contract.Result<string>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(issuerKey, "issuerKey");
-			ErrorUtilities.VerifyArgumentNotNull(claimValue, "claimValue");
 
 			int nameLength = Encoding.UTF8.GetByteCount(claimValue);
 			RSAParameters rsaParams = issuerKey.ExportParameters(false);
diff --git a/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs b/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
index 1132ac0..1b4a62d 100644
--- a/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
@@ -18,8 +18,8 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <param name="tokenXml">The token XML.</param>
 		/// <param name="exception">The exception.</param>
 		internal TokenProcessingErrorEventArgs(string tokenXml, Exception exception) {
-			Contract.Requires(tokenXml != null);
-			Contract.Requires(exception != null);
+			Contract.Requires<ArgumentNullException>(tokenXml != null);
+			Contract.Requires<ArgumentNullException>(exception != null);
 			this.TokenXml = tokenXml;
 			this.Exception = exception;
 		}
@@ -38,6 +38,7 @@ namespace DotNetOpenAuth.InfoCard {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/Logger.cs b/src/DotNetOpenAuth/Logger.cs
index 6015df5..ede8172 100644
--- a/src/DotNetOpenAuth/Logger.cs
+++ b/src/DotNetOpenAuth/Logger.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using DotNetOpenAuth.Loggers;
 	using DotNetOpenAuth.Messaging;
@@ -131,7 +132,7 @@ namespace DotNetOpenAuth {
 		/// <param name="name">A name that will be included in the log file.</param>
 		/// <returns>The <see cref="ILog"/> instance created with the given name.</returns>
 		internal static ILog Create(string name) {
-			ErrorUtilities.VerifyNonZeroLength(name, "name");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(name));
 			return InitializeFacade(name);
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/Bindings/StandardReplayProtectionBindingElement.cs b/src/DotNetOpenAuth/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
index bb2b28a..3347ba4 100644
--- a/src/DotNetOpenAuth/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
+++ b/src/DotNetOpenAuth/Messaging/Bindings/StandardReplayProtectionBindingElement.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Messaging.Bindings {
 	using System;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// A binding element that checks/verifies a nonce message part.
@@ -46,7 +47,7 @@ namespace DotNetOpenAuth.Messaging.Bindings {
 		/// <param name="nonceStore">The store where nonces will be persisted and checked.</param>
 		/// <param name="allowEmptyNonces">A value indicating whether zero-length nonces will be allowed.</param>
 		internal StandardReplayProtectionBindingElement(INonceStore nonceStore, bool allowEmptyNonces) {
-			ErrorUtilities.VerifyArgumentNotNull(nonceStore, "nonceStore");
+			Contract.Requires<ArgumentNullException>(nonceStore != null);
 
 			this.nonceStore = nonceStore;
 			this.AllowZeroLengthNonce = allowEmptyNonces;
diff --git a/src/DotNetOpenAuth/Messaging/CachedDirectWebResponse.cs b/src/DotNetOpenAuth/Messaging/CachedDirectWebResponse.cs
index e586ca8..b37c93a 100644
--- a/src/DotNetOpenAuth/Messaging/CachedDirectWebResponse.cs
+++ b/src/DotNetOpenAuth/Messaging/CachedDirectWebResponse.cs
@@ -37,8 +37,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="maximumBytesToRead">The maximum bytes to read.</param>
 		internal CachedDirectWebResponse(Uri requestUri, HttpWebResponse response, int maximumBytesToRead)
 			: base(requestUri, response) {
-			Contract.RequiresAlways(requestUri != null);
-			Contract.RequiresAlways(response != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 			this.responseStream = CacheNetworkStreamAndClose(response, maximumBytesToRead);
 
 			// BUGBUG: if the response was exactly maximumBytesToRead, we'll incorrectly believe it was truncated.
@@ -57,8 +57,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="responseStream">The response stream.</param>
 		internal CachedDirectWebResponse(Uri requestUri, Uri responseUri, WebHeaderCollection headers, HttpStatusCode statusCode, string contentType, string contentEncoding, MemoryStream responseStream)
 			: base(requestUri, responseUri, headers, statusCode, contentType, contentEncoding) {
-			Contract.RequiresAlways(requestUri != null);
-			Contract.Requires(responseStream != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
+			Contract.Requires<ArgumentNullException>(responseStream != null);
 			this.responseStream = responseStream;
 		}
 
@@ -152,7 +152,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="maximumBytesToRead">The maximum bytes to cache.</param>
 		/// <returns>The seekable Stream instance that contains a copy of what was returned in the HTTP response.</returns>
 		private static MemoryStream CacheNetworkStreamAndClose(HttpWebResponse response, int maximumBytesToRead) {
-			Contract.Requires(response != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			// Now read and cache the network stream
 			Stream networkStream = response.GetResponseStream();
diff --git a/src/DotNetOpenAuth/Messaging/Channel.cs b/src/DotNetOpenAuth/Messaging/Channel.cs
index 226483f..7a7bebc 100644
--- a/src/DotNetOpenAuth/Messaging/Channel.cs
+++ b/src/DotNetOpenAuth/Messaging/Channel.cs
@@ -104,8 +104,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </param>
 		/// <param name="bindingElements">The binding elements to use in sending and receiving messages.</param>
 		protected Channel(IMessageFactory messageTypeProvider, params IChannelBindingElement[] bindingElements) {
-			Contract.Requires(messageTypeProvider != null);
-			ErrorUtilities.VerifyArgumentNotNull(messageTypeProvider, "messageTypeProvider");
+			Contract.Requires<ArgumentNullException>(messageTypeProvider != null);
 
 			this.messageTypeProvider = messageTypeProvider;
 			this.WebRequestHandler = new StandardWebRequestHandler();
@@ -138,13 +137,11 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		internal MessageDescriptionCollection MessageDescriptions {
 			get {
-				Contract.Ensures(Contract.Result<MessageDescriptionCollection>() != null);
 				return this.messageDescriptions;
 			}
 
 			set {
-				Contract.Requires(value != null);
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.messageDescriptions = value;
 			}
 		}
@@ -172,7 +169,11 @@ namespace DotNetOpenAuth.Messaging {
 		/// Gets the binding elements used by this channel, in the order applied to incoming messages.
 		/// </summary>
 		protected internal ReadOnlyCollection<IChannelBindingElement> IncomingBindingElements {
-			get { return this.incomingBindingElements.AsReadOnly(); }
+			get {
+				Contract.Ensures(Contract.Result<ReadOnlyCollection<IChannelBindingElement>>().All(be => be.Channel != null));
+				Contract.Ensures(Contract.Result<ReadOnlyCollection<IChannelBindingElement>>().All(be => be != null));
+				return this.incomingBindingElements.AsReadOnly();
+			}
 		}
 
 		/// <summary>
@@ -201,8 +202,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				Contract.Requires(value != null);
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.cachePolicy = value;
 			}
 		}
@@ -218,8 +218,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// Requires an HttpContext.Current context.
 		/// </remarks>
 		public void Send(IProtocolMessage message) {
-			Contract.Requires(HttpContext.Current != null);
-			Contract.Requires(message != null);
+			Contract.Requires<InvalidOperationException>(HttpContext.Current != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			this.PrepareResponse(message).Send();
 		}
 
@@ -230,9 +230,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="message">The one-way message to send</param>
 		/// <returns>The pending user agent redirect based message to be sent as an HttpResponse.</returns>
 		public OutgoingWebResponse PrepareResponse(IProtocolMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
 
 			this.ProcessOutgoingMessage(message);
 			Logger.Channel.DebugFormat("Sending message: {0}", message.GetType().Name);
@@ -301,7 +300,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ProtocolException">Thrown when a request message of an unexpected type is received.</exception>
 		public bool TryReadFromRequest<TRequest>(HttpRequestInfo httpRequest, out TRequest request)
 			where TRequest : class, IProtocolMessage {
-			Contract.Requires(httpRequest != null);
+			Contract.Requires<ArgumentNullException>(httpRequest != null);
 			Contract.Ensures(Contract.Result<bool>() == (Contract.ValueAtReturn<TRequest>(out request) != null));
 
 			IProtocolMessage untypedRequest = this.ReadFromRequest(httpRequest);
@@ -342,7 +341,7 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Design", "CA1004:GenericMethodsShouldProvideTypeParameter", Justification = "This returns and verifies the appropriate message type.")]
 		public TRequest ReadFromRequest<TRequest>(HttpRequestInfo httpRequest)
 			where TRequest : class, IProtocolMessage {
-			Contract.Requires(httpRequest != null);
+			Contract.Requires<ArgumentNullException>(httpRequest != null);
 			TRequest request;
 			if (this.TryReadFromRequest<TRequest>(httpRequest, out request)) {
 				return request;
@@ -357,8 +356,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="httpRequest">The request to search for an embedded message.</param>
 		/// <returns>The deserialized message, if one is found.  Null otherwise.</returns>
 		public IDirectedProtocolMessage ReadFromRequest(HttpRequestInfo httpRequest) {
-			Contract.Requires(httpRequest != null);
-			ErrorUtilities.VerifyArgumentNotNull(httpRequest, "httpRequest");
+			Contract.Requires<ArgumentNullException>(httpRequest != null);
 
 			if (Logger.Channel.IsInfoEnabled && httpRequest.UrlBeforeRewriting != null) {
 				Logger.Channel.InfoFormat("Scanning incoming request for messages: {0}", httpRequest.UrlBeforeRewriting.AbsoluteUri);
@@ -385,7 +383,7 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Design", "CA1004:GenericMethodsShouldProvideTypeParameter", Justification = "This returns and verifies the appropriate message type.")]
 		public TResponse Request<TResponse>(IDirectedProtocolMessage requestMessage)
 			where TResponse : class, IProtocolMessage {
-			Contract.Requires(requestMessage != null);
+			Contract.Requires<ArgumentNullException>(requestMessage != null);
 			Contract.Ensures(Contract.Result<TResponse>() != null);
 
 			IProtocolMessage response = this.Request(requestMessage);
@@ -404,8 +402,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The remote party's response.  Guaranteed to never be null.</returns>
 		/// <exception cref="ProtocolException">Thrown if the response does not include a protocol message.</exception>
 		public IProtocolMessage Request(IDirectedProtocolMessage requestMessage) {
-			Contract.Requires(requestMessage != null);
-			ErrorUtilities.VerifyArgumentNotNull(requestMessage, "requestMessage");
+			Contract.Requires<ArgumentNullException>(requestMessage != null);
 
 			this.ProcessOutgoingMessage(requestMessage);
 			Logger.Channel.DebugFormat("Sending {0} request.", requestMessage.GetType().Name);
@@ -490,8 +487,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="message">The message about to be encoded and sent.</param>
 		protected virtual void OnSending(IProtocolMessage message) {
-			Contract.Requires(message != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			var sending = this.Sending;
 			if (sending != null) {
@@ -506,8 +502,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The response to the web request.</returns>
 		/// <exception cref="ProtocolException">Thrown on network or protocol errors.</exception>
 		protected virtual IncomingWebResponse GetDirectResponse(HttpWebRequest webRequest) {
-			Contract.Requires(webRequest != null);
-			ErrorUtilities.VerifyArgumentNotNull(webRequest, "webRequest");
+			Contract.Requires<ArgumentNullException>(webRequest != null);
 			return this.WebRequestHandler.GetResponse(webRequest);
 		}
 
@@ -522,7 +517,9 @@ namespace DotNetOpenAuth.Messaging {
 		/// this method to eliminate all use of an HTTP transport.
 		/// </remarks>
 		protected virtual IProtocolMessage RequestCore(IDirectedProtocolMessage request) {
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentException>(request.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
+
 			HttpWebRequest webRequest = this.CreateHttpRequest(request);
 			IDictionary<string, string> responseFields;
 			IDirectResponseProtocolMessage responseMessage;
@@ -565,8 +562,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The request to search for an embedded message.</param>
 		/// <returns>The deserialized message, if one is found.  Null otherwise.</returns>
 		protected virtual IDirectedProtocolMessage ReadFromRequestCore(HttpRequestInfo request) {
-			Contract.Requires(request != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			Logger.Channel.DebugFormat("Incoming HTTP request: {0}", request.Url.AbsoluteUri);
 
@@ -587,8 +583,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="recipient">Information about where the message was directed.  Null for direct response messages.</param>
 		/// <returns>The deserialized message, or null if no message could be recognized in the provided data.</returns>
 		protected virtual IProtocolMessage Receive(Dictionary<string, string> fields, MessageReceivingEndpoint recipient) {
-			Contract.Requires(fields != null);
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
+			Contract.Requires<ArgumentNullException>(fields != null);
 
 			IProtocolMessage message = this.MessageFactory.GetNewRequestMessage(recipient, fields);
 
@@ -614,9 +609,9 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="message">The message to send.</param>
 		/// <returns>The pending user agent redirect based message to be sent as an HttpResponse.</returns>
 		protected virtual OutgoingWebResponse PrepareIndirectResponse(IDirectedProtocolMessage message) {
-			Contract.Requires(message != null && message.Recipient != null);
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentException>(message.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
 			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
 
 			Contract.Assert(message != null && message.Recipient != null);
 			var messageAccessor = this.MessageDescriptions.GetAccessor(message);
@@ -640,15 +635,13 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="message">The message to forward.</param>
 		/// <param name="fields">The pre-serialized fields from the message.</param>
 		/// <returns>The encoded HTTP response.</returns>
+		[Pure]
 		protected virtual OutgoingWebResponse Create301RedirectResponse(IDirectedProtocolMessage message, IDictionary<string, string> fields) {
-			Contract.Requires(message != null && message.Recipient != null);
-			Contract.Requires(fields != null);
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentException>(message.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
+			Contract.Requires<ArgumentNullException>(fields != null);
 			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
-			ErrorUtilities.VerifyArgumentNamed(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			WebHeaderCollection headers = new WebHeaderCollection();
 			UriBuilder builder = new UriBuilder(message.Recipient);
 			MessagingUtilities.AppendQueryArgs(builder, fields);
@@ -672,12 +665,10 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="fields">The pre-serialized fields from the message.</param>
 		/// <returns>The encoded HTTP response.</returns>
 		protected virtual OutgoingWebResponse CreateFormPostResponse(IDirectedProtocolMessage message, IDictionary<string, string> fields) {
-			Contract.Requires(message != null && message.Recipient != null);
-			Contract.Requires(fields != null);
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentException>(message.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
+			Contract.Requires<ArgumentNullException>(fields != null);
 			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
-			ErrorUtilities.VerifyArgumentNamed(message.Recipient != null, "message", MessagingStrings.DirectedMessageMissingRecipient);
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
 
 			WebHeaderCollection headers = new WebHeaderCollection();
 			StringWriter bodyWriter = new StringWriter(CultureInfo.InvariantCulture);
@@ -721,7 +712,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// is overridden and does not require this method.
 		/// </remarks>
 		protected virtual HttpWebRequest CreateHttpRequest(IDirectedProtocolMessage request) {
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentException>(request.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
 			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
 			throw new NotImplementedException();
 		}
@@ -746,8 +738,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// except when sending ONE WAY request messages.
 		/// </remarks>
 		protected void ProcessOutgoingMessage(IProtocolMessage message) {
-			Contract.Requires(message != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			Logger.Channel.DebugFormat("Preparing to send {0} ({1}) message.", message.GetType().Name, message.Version);
 			this.OnSending(message);
@@ -806,8 +797,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// This method satisfies OAuth 1.0 section 5.2, item #3.
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsGet(IDirectedProtocolMessage requestMessage) {
-			Contract.Requires(requestMessage != null);
-			Contract.Requires(requestMessage.Recipient != null);
+			Contract.Requires<ArgumentNullException>(requestMessage != null);
+			Contract.Requires<ArgumentException>(requestMessage.Recipient != null, MessagingStrings.DirectedMessageMissingRecipient);
 
 			var messageAccessor = this.MessageDescriptions.GetAccessor(requestMessage);
 			var fields = messageAccessor.Serialize();
@@ -830,9 +821,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// This method satisfies OAuth 1.0 section 5.2, item #2 and OpenID 2.0 section 4.1.2.
 		/// </remarks>
 		protected virtual HttpWebRequest InitializeRequestAsPost(IDirectedProtocolMessage requestMessage) {
-			Contract.Requires(requestMessage != null);
+			Contract.Requires<ArgumentNullException>(requestMessage != null);
 			Contract.Ensures(Contract.Result<HttpWebRequest>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(requestMessage, "requestMessage");
 
 			var messageAccessor = this.MessageDescriptions.GetAccessor(requestMessage);
 			var fields = messageAccessor.Serialize();
@@ -855,10 +845,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// the request stream, but does not call <see cref="HttpWebRequest.GetResponse"/>.
 		/// </remarks>
 		protected void SendParametersInEntity(HttpWebRequest httpRequest, IDictionary<string, string> fields) {
-			Contract.Requires(httpRequest != null);
-			Contract.Requires(fields != null);
-			ErrorUtilities.VerifyArgumentNotNull(httpRequest, "httpRequest");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
+			Contract.Requires<ArgumentNullException>(httpRequest != null);
+			Contract.Requires<ArgumentNullException>(fields != null);
 
 			httpRequest.ContentType = "application/x-www-form-urlencoded";
 
@@ -892,7 +880,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// This can be due to tampering, replay attack or expiration, among other things.
 		/// </exception>
 		protected virtual void ProcessIncomingMessage(IProtocolMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			if (Logger.Channel.IsInfoEnabled) {
 				var messageAccessor = this.MessageDescriptions.GetAccessor(message);
@@ -905,7 +893,8 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			MessageProtections appliedProtection = MessageProtections.None;
-			foreach (IChannelBindingElement bindingElement in this.incomingBindingElements) {
+			foreach (IChannelBindingElement bindingElement in this.IncomingBindingElements) {
+				Contract.Assume(bindingElement.Channel != null); // CC bug: this.IncomingBindingElements ensures this... why must we assume it here?
 				MessageProtections? elementProtection = bindingElement.ProcessIncomingMessage(message);
 				if (elementProtection.HasValue) {
 					Logger.Bindings.DebugFormat("Binding element {0} applied to message.", bindingElement.GetType().FullName);
@@ -966,10 +955,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		/// <exception cref="ArgumentException">Thrown if a binding element is new or missing in one of the ordered lists.</exception>
 		protected void CustomizeBindingElementOrder(IEnumerable<IChannelBindingElement> outgoingOrder, IEnumerable<IChannelBindingElement> incomingOrder) {
-			Contract.Requires(outgoingOrder != null);
-			Contract.Requires(incomingOrder != null);
-			ErrorUtilities.VerifyArgumentNotNull(outgoingOrder, "outgoingOrder");
-			ErrorUtilities.VerifyArgumentNotNull(incomingOrder, "incomingOrder");
+			Contract.Requires<ArgumentNullException>(outgoingOrder != null);
+			Contract.Requires<ArgumentNullException>(incomingOrder != null);
 			ErrorUtilities.VerifyArgument(this.IsBindingElementOrderValid(outgoingOrder), MessagingStrings.InvalidCustomBindingElementOrder);
 			ErrorUtilities.VerifyArgument(this.IsBindingElementOrderValid(incomingOrder), MessagingStrings.InvalidCustomBindingElementOrder);
 
@@ -979,6 +966,18 @@ namespace DotNetOpenAuth.Messaging {
 			this.incomingBindingElements.AddRange(incomingOrder);
 		}
 
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		protected void ObjectInvariant() {
+			Contract.Invariant(this.MessageDescriptions != null);
+		}
+#endif
+
 		/// <summary>
 		/// Ensures a consistent and secure set of binding elements and 
 		/// sorts them as necessary for a valid sequence of operations.
@@ -987,7 +986,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The properly ordered list of elements.</returns>
 		/// <exception cref="ProtocolException">Thrown when the binding elements are incomplete or inconsistent with each other.</exception>
 		private static IEnumerable<IChannelBindingElement> ValidateAndPrepareBindingElements(IEnumerable<IChannelBindingElement> elements) {
-			Contract.Requires(elements == null || elements.All(e => e != null));
+			Contract.Requires<ArgumentNullException>(elements == null || elements.All(e => e != null));
 			Contract.Ensures(Contract.Result<IEnumerable<IChannelBindingElement>>() != null);
 			if (elements == null) {
 				return new IChannelBindingElement[0];
@@ -1050,7 +1049,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// Thrown when any required message part does not have a value.
 		/// </exception>
 		private void EnsureValidMessageParts(IProtocolMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			MessageDictionary dictionary = this.MessageDescriptions.GetAccessor(message);
 			MessageDescription description = this.MessageDescriptions.Get(message);
 			description.EnsureMessagePartsPassBasicValidation(dictionary);
@@ -1066,8 +1065,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </returns>
 		[Pure]
 		private bool IsBindingElementOrderValid(IEnumerable<IChannelBindingElement> order) {
-			Contract.Requires(order != null);
-			ErrorUtilities.VerifyArgumentNotNull(order, "order");
+			Contract.Requires<ArgumentNullException>(order != null);
 
 			// Check that the same number of binding elements are defined.
 			if (order.Count() != this.OutgoingBindingElements.Count) {
diff --git a/src/DotNetOpenAuth/Messaging/ChannelContract.cs b/src/DotNetOpenAuth/Messaging/ChannelContract.cs
index 551d7c4..9b85d28 100644
--- a/src/DotNetOpenAuth/Messaging/ChannelContract.cs
+++ b/src/DotNetOpenAuth/Messaging/ChannelContract.cs
@@ -30,7 +30,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </returns>
 		/// <exception cref="ProtocolException">Thrown when the response is not valid.</exception>
 		protected override IDictionary<string, string> ReadFromResponseCore(IncomingWebResponse response) {
-			Contract.Requires(response != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 			throw new NotImplementedException();
 		}
 
@@ -46,7 +46,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// This method implements spec V1.0 section 5.3.
 		/// </remarks>
 		protected override OutgoingWebResponse PrepareDirectResponse(IProtocolMessage response) {
-			Contract.Requires(response != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 			Contract.Ensures(Contract.Result<OutgoingWebResponse>() != null);
 			throw new NotImplementedException();
 		}
diff --git a/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs b/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
index 9f2a514..50cd118 100644
--- a/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
+++ b/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
@@ -26,7 +26,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>The newly constructed (unthrown) exception.</returns>
 		[Pure]
 		internal static Exception Wrap(Exception inner, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Assume(errorMessage != null);
 			return new ProtocolException(string.Format(CultureInfo.CurrentCulture, errorMessage, args), inner);
 		}
@@ -72,7 +72,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InternalErrorException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyInternal(bool condition, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<InternalErrorException>(!condition);
 			Contract.Assume(errorMessage != null);
@@ -121,7 +121,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="NotSupportedException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifySupported(bool condition, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<NotSupportedException>(!condition);
 			Contract.Assume(errorMessage != null);
@@ -139,7 +139,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InvalidOperationException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyOperation(bool condition, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<InvalidOperationException>(!condition);
 			Contract.Assume(errorMessage != null);
@@ -159,7 +159,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="InfoCard.InformationCardException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyInfoCard(bool condition, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<InfoCard.InformationCardException>(!condition);
 			Contract.Assume(errorMessage != null);
@@ -179,7 +179,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ProtocolException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyProtocol(bool condition, IProtocolMessage faultedMessage, string errorMessage, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
+			Contract.Requires<ArgumentNullException>(faultedMessage != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<ProtocolException>(!condition);
 			Contract.Assume(errorMessage != null);
@@ -197,7 +198,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ProtocolException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyProtocol(bool condition, string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<ProtocolException>(!condition);
 			Contract.Assume(message != null);
@@ -219,7 +220,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ProtocolException">Always thrown.</exception>
 		[Pure]
 		internal static Exception ThrowProtocol(string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Assume(message != null);
 			VerifyProtocol(false, message, args);
 
@@ -235,7 +236,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>Nothing.  It's just here so the caller can throw this method for C# compilation check.</returns>
 		[Pure]
 		internal static Exception ThrowFormat(string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Assume(message != null);
 			throw new FormatException(string.Format(CultureInfo.CurrentCulture, message, args));
 		}
@@ -249,7 +250,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="FormatException">Thrown when <paramref name="condition"/> is <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyFormat(bool condition, string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<FormatException>(!condition);
 			Contract.Assume(message != null);
@@ -267,7 +268,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ArgumentException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyArgument(bool condition, string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<ArgumentException>(!condition);
 			Contract.Assume(message != null);
@@ -301,7 +302,7 @@ namespace DotNetOpenAuth.Messaging {
 		[Pure]
 		internal static void VerifyArgumentInRange(bool condition, string parameterName, string message, params object[] args) {
 			Contract.Requires(condition);
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Assume(message != null);
 			if (!condition) {
 				throw new ArgumentOutOfRangeException(parameterName, string.Format(CultureInfo.CurrentCulture, message, args));
@@ -318,7 +319,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ArgumentException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static Exception ThrowArgumentNamed(string parameterName, string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Assume(message != null);
 			throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, message, args), parameterName);
 		}
@@ -333,7 +334,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <exception cref="ArgumentException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifyArgumentNamed(bool condition, string parameterName, string message, params object[] args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(condition);
 			Contract.EnsuresOnThrow<ArgumentException>(!condition);
 			Contract.Assume(message != null);
diff --git a/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs b/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
index 4ffb5ec..815de68 100644
--- a/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
+++ b/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
@@ -50,7 +50,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="request">The ASP.NET structure to copy from.</param>
 		public HttpRequestInfo(HttpRequest request) {
-			Contract.RequiresAlways(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 			Contract.Ensures(this.HttpMethod == request.HttpMethod);
 			Contract.Ensures(this.Url == request.Url);
 			Contract.Ensures(this.RawUrl == request.RawUrl);
@@ -60,8 +60,6 @@ namespace DotNetOpenAuth.Messaging {
 			Contract.Ensures(this.form == request.Form);
 			Contract.Ensures(this.queryString == request.QueryString);
 
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-
 			this.HttpMethod = request.HttpMethod;
 			this.Url = GetPublicFacingUrl(request);
 			this.RawUrl = request.RawUrl;
@@ -86,10 +84,10 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="headers">Headers in the HTTP request.</param>
 		/// <param name="inputStream">The entity stream, if any.  (POST requests typically have these).  Use <c>null</c> for GET requests.</param>
 		public HttpRequestInfo(string httpMethod, Uri requestUrl, string rawUrl, WebHeaderCollection headers, Stream inputStream) {
-			Contract.RequiresAlways(!string.IsNullOrEmpty(httpMethod));
-			Contract.RequiresAlways(requestUrl != null);
-			Contract.RequiresAlways(rawUrl != null);
-			Contract.RequiresAlways(headers != null);
+			Contract.Requires<ArgumentNullException>(!string.IsNullOrEmpty(httpMethod));
+			Contract.Requires<ArgumentNullException>(requestUrl != null);
+			Contract.Requires<ArgumentNullException>(rawUrl != null);
+			Contract.Requires<ArgumentNullException>(headers != null);
 
 			this.HttpMethod = httpMethod;
 			this.Url = requestUrl;
@@ -103,7 +101,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="listenerRequest">Details on the incoming HTTP request.</param>
 		public HttpRequestInfo(HttpListenerRequest listenerRequest) {
-			Contract.RequiresAlways(listenerRequest != null);
+			Contract.Requires<ArgumentNullException>(listenerRequest != null);
 
 			this.HttpMethod = listenerRequest.HttpMethod;
 			this.Url = listenerRequest.Url;
@@ -122,8 +120,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The WCF incoming request structure to get the HTTP information from.</param>
 		/// <param name="requestUri">The URI of the service endpoint.</param>
 		public HttpRequestInfo(HttpRequestMessageProperty request, Uri requestUri) {
-			Contract.RequiresAlways(request != null);
-			Contract.RequiresAlways(requestUri != null);
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
 
 			this.HttpMethod = request.Method;
 			this.Headers = request.Headers;
@@ -147,7 +145,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="request">The HttpWebRequest (that was never used) to copy from.</param>
 		internal HttpRequestInfo(WebRequest request) {
-			Contract.RequiresAlways(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			this.HttpMethod = request.Method;
 			this.Url = request.RequestUri;
@@ -326,6 +324,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
@@ -338,8 +337,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The request.</param>
 		/// <returns>The URI that the outside world used to create this request.</returns>
 		private static Uri GetPublicFacingUrl(HttpRequest request) {
-			Contract.Requires(request != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			// Due to URL rewriting, cloud computing (i.e. Azure)
 			// and web farms, etc., we have to be VERY careful about what
@@ -371,7 +369,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="url">A full URL.</param>
 		/// <returns>A raw URL that might have come in on the HTTP verb.</returns>
 		private static string MakeUpRawUrlFromUrl(Uri url) {
-			Contract.Requires(url != null);
+			Contract.Requires<ArgumentNullException>(url != null);
 			return url.AbsolutePath + url.Query + url.Fragment;
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/IChannelBindingElement.cs b/src/DotNetOpenAuth/Messaging/IChannelBindingElement.cs
index 5ae07c3..b2d3d68 100644
--- a/src/DotNetOpenAuth/Messaging/IChannelBindingElement.cs
+++ b/src/DotNetOpenAuth/Messaging/IChannelBindingElement.cs
@@ -108,7 +108,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		MessageProtections? IChannelBindingElement.ProcessOutgoingMessage(IProtocolMessage message) {
 			Contract.Requires(((IChannelBindingElement)this).Channel != null);
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			throw new NotImplementedException();
 		}
 
@@ -131,7 +131,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		MessageProtections? IChannelBindingElement.ProcessIncomingMessage(IProtocolMessage message) {
 			Contract.Requires(((IChannelBindingElement)this).Channel != null);
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			throw new NotImplementedException();
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/IDirectWebRequestHandler.cs b/src/DotNetOpenAuth/Messaging/IDirectWebRequestHandler.cs
index 380e2d5..a0ebff2 100644
--- a/src/DotNetOpenAuth/Messaging/IDirectWebRequestHandler.cs
+++ b/src/DotNetOpenAuth/Messaging/IDirectWebRequestHandler.cs
@@ -5,7 +5,9 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Messaging {
+	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using DotNetOpenAuth.Messaging;
@@ -16,6 +18,7 @@ namespace DotNetOpenAuth.Messaging {
 	/// <remarks>
 	/// Implementations of this interface must be thread safe.
 	/// </remarks>
+	[ContractClass(typeof(IDirectWebRequestHandlerContract))]
 	public interface IDirectWebRequestHandler {
 		/// <summary>
 		/// Determines whether this instance can support the specified options.
@@ -24,6 +27,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>
 		/// 	<c>true</c> if this instance can support the specified options; otherwise, <c>false</c>.
 		/// </returns>
+		[Pure]
 		bool CanSupport(DirectWebRequestOptions options);
 
 		/// <summary>
@@ -98,4 +102,115 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		IncomingWebResponse GetResponse(HttpWebRequest request, DirectWebRequestOptions options);
 	}
+
+	/// <summary>
+	/// Code contract for the <see cref="IDirectWebRequestHandler"/> type.
+	/// </summary>
+	[ContractClassFor(typeof(IDirectWebRequestHandler))]
+	internal abstract class IDirectWebRequestHandlerContract : IDirectWebRequestHandler {
+		#region IDirectWebRequestHandler Members
+
+		/// <summary>
+		/// Determines whether this instance can support the specified options.
+		/// </summary>
+		/// <param name="options">The set of options that might be given in a subsequent web request.</param>
+		/// <returns>
+		/// 	<c>true</c> if this instance can support the specified options; otherwise, <c>false</c>.
+		/// </returns>
+		bool IDirectWebRequestHandler.CanSupport(DirectWebRequestOptions options) {
+			throw new System.NotImplementedException();
+		}
+
+		/// <summary>
+		/// Prepares an <see cref="HttpWebRequest"/> that contains an POST entity for sending the entity.
+		/// </summary>
+		/// <param name="request">The <see cref="HttpWebRequest"/> that should contain the entity.</param>
+		/// <returns>
+		/// The stream the caller should write out the entity data to.
+		/// </returns>
+		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
+		/// <remarks>
+		/// 	<para>The caller should have set the <see cref="HttpWebRequest.ContentLength"/>
+		/// and any other appropriate properties <i>before</i> calling this method.
+		/// Callers <i>must</i> close and dispose of the request stream when they are done
+		/// writing to it to avoid taking up the connection too long and causing long waits on
+		/// subsequent requests.</para>
+		/// 	<para>Implementations should catch <see cref="WebException"/> and wrap it in a
+		/// <see cref="ProtocolException"/> to abstract away the transport and provide
+		/// a single exception type for hosts to catch.</para>
+		/// </remarks>
+		Stream IDirectWebRequestHandler.GetRequestStream(HttpWebRequest request) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			throw new System.NotImplementedException();
+		}
+
+		/// <summary>
+		/// Prepares an <see cref="HttpWebRequest"/> that contains an POST entity for sending the entity.
+		/// </summary>
+		/// <param name="request">The <see cref="HttpWebRequest"/> that should contain the entity.</param>
+		/// <param name="options">The options to apply to this web request.</param>
+		/// <returns>
+		/// The stream the caller should write out the entity data to.
+		/// </returns>
+		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
+		/// <remarks>
+		/// 	<para>The caller should have set the <see cref="HttpWebRequest.ContentLength"/>
+		/// and any other appropriate properties <i>before</i> calling this method.
+		/// Callers <i>must</i> close and dispose of the request stream when they are done
+		/// writing to it to avoid taking up the connection too long and causing long waits on
+		/// subsequent requests.</para>
+		/// 	<para>Implementations should catch <see cref="WebException"/> and wrap it in a
+		/// <see cref="ProtocolException"/> to abstract away the transport and provide
+		/// a single exception type for hosts to catch.</para>
+		/// </remarks>
+		Stream IDirectWebRequestHandler.GetRequestStream(HttpWebRequest request, DirectWebRequestOptions options) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<NotSupportedException>(((IDirectWebRequestHandler)this).CanSupport(options), string.Format(MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name));
+			throw new System.NotImplementedException();
+		}
+
+		/// <summary>
+		/// Processes an <see cref="HttpWebRequest"/> and converts the
+		/// <see cref="HttpWebResponse"/> to a <see cref="IncomingWebResponse"/> instance.
+		/// </summary>
+		/// <param name="request">The <see cref="HttpWebRequest"/> to handle.</param>
+		/// <returns>
+		/// An instance of <see cref="IncomingWebResponse"/> describing the response.
+		/// </returns>
+		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
+		/// <remarks>
+		/// Implementations should catch <see cref="WebException"/> and wrap it in a
+		/// <see cref="ProtocolException"/> to abstract away the transport and provide
+		/// a single exception type for hosts to catch.  The <see cref="WebException.Response"/>
+		/// value, if set, shoud be Closed before throwing.
+		/// </remarks>
+		IncomingWebResponse IDirectWebRequestHandler.GetResponse(HttpWebRequest request) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			throw new System.NotImplementedException();
+		}
+
+		/// <summary>
+		/// Processes an <see cref="HttpWebRequest"/> and converts the
+		/// <see cref="HttpWebResponse"/> to a <see cref="IncomingWebResponse"/> instance.
+		/// </summary>
+		/// <param name="request">The <see cref="HttpWebRequest"/> to handle.</param>
+		/// <param name="options">The options to apply to this web request.</param>
+		/// <returns>
+		/// An instance of <see cref="IncomingWebResponse"/> describing the response.
+		/// </returns>
+		/// <exception cref="ProtocolException">Thrown for any network error.</exception>
+		/// <remarks>
+		/// Implementations should catch <see cref="WebException"/> and wrap it in a
+		/// <see cref="ProtocolException"/> to abstract away the transport and provide
+		/// a single exception type for hosts to catch.  The <see cref="WebException.Response"/>
+		/// value, if set, shoud be Closed before throwing.
+		/// </remarks>
+		IncomingWebResponse IDirectWebRequestHandler.GetResponse(HttpWebRequest request, DirectWebRequestOptions options) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<NotSupportedException>(((IDirectWebRequestHandler)this).CanSupport(options), string.Format(MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name));
+			throw new System.NotImplementedException();
+		}
+
+		#endregion
+	}
 }
diff --git a/src/DotNetOpenAuth/Messaging/IMessageFactory.cs b/src/DotNetOpenAuth/Messaging/IMessageFactory.cs
index 23c291a..3718545 100644
--- a/src/DotNetOpenAuth/Messaging/IMessageFactory.cs
+++ b/src/DotNetOpenAuth/Messaging/IMessageFactory.cs
@@ -60,7 +60,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
 		/// </returns>
 		IDirectedProtocolMessage IMessageFactory.GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			Contract.Requires(fields != null);
+			Contract.Requires<ArgumentNullException>(recipient != null);
+			Contract.Requires<ArgumentNullException>(fields != null);
 
 			throw new NotImplementedException();
 		}
@@ -76,7 +77,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
 		/// </returns>
 		IDirectResponseProtocolMessage IMessageFactory.GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields) {
-			Contract.Requires(fields != null);
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentNullException>(fields != null);
 			throw new NotImplementedException();
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/IncomingWebResponse.cs b/src/DotNetOpenAuth/Messaging/IncomingWebResponse.cs
index 8f169c3..9ad228e 100644
--- a/src/DotNetOpenAuth/Messaging/IncomingWebResponse.cs
+++ b/src/DotNetOpenAuth/Messaging/IncomingWebResponse.cs
@@ -39,8 +39,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="requestUri">The original request URI.</param>
 		/// <param name="response">The response to initialize from.  The network stream is used by this class directly.</param>
 		protected IncomingWebResponse(Uri requestUri, HttpWebResponse response) {
-			Contract.RequiresAlways(requestUri != null);
-			Contract.RequiresAlways(response != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.RequestUri = requestUri;
 			if (!string.IsNullOrEmpty(response.ContentType)) {
@@ -66,7 +66,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="contentType">Type of the content.</param>
 		/// <param name="contentEncoding">The content encoding.</param>
 		protected IncomingWebResponse(Uri requestUri, Uri responseUri, WebHeaderCollection headers, HttpStatusCode statusCode, string contentType, string contentEncoding) {
-			Contract.RequiresAlways(requestUri != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
 
 			this.RequestUri = requestUri;
 			this.Status = statusCode;
diff --git a/src/DotNetOpenAuth/Messaging/IncomingWebResponseContract.cs b/src/DotNetOpenAuth/Messaging/IncomingWebResponseContract.cs
index 04d3b38..295c005 100644
--- a/src/DotNetOpenAuth/Messaging/IncomingWebResponseContract.cs
+++ b/src/DotNetOpenAuth/Messaging/IncomingWebResponseContract.cs
@@ -46,7 +46,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		internal override CachedDirectWebResponse GetSnapshot(int maximumBytesToCache) {
 			Contract.Requires(maximumBytesToCache >= 0);
-			Contract.Requires(this.RequestUri != null);
+			Contract.Requires<InvalidOperationException>(this.RequestUri != null);
 			Contract.Ensures(Contract.Result<CachedDirectWebResponse>() != null);
 			throw new NotImplementedException();
 		}
diff --git a/src/DotNetOpenAuth/Messaging/KeyedCollectionDelegate.cs b/src/DotNetOpenAuth/Messaging/KeyedCollectionDelegate.cs
index 16786e3..5555f9c 100644
--- a/src/DotNetOpenAuth/Messaging/KeyedCollectionDelegate.cs
+++ b/src/DotNetOpenAuth/Messaging/KeyedCollectionDelegate.cs
@@ -27,8 +27,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="getKeyForItemDelegate">The delegate that gets the key for a given item.</param>
 		internal KeyedCollectionDelegate(Func<TItem, TKey> getKeyForItemDelegate) {
-			Contract.Requires(getKeyForItemDelegate != null);
-			ErrorUtilities.VerifyArgumentNotNull(getKeyForItemDelegate, "getKeyForItemDelegate");
+			Contract.Requires<ArgumentNullException>(getKeyForItemDelegate != null);
 
 			this.getKeyForItemDelegate = getKeyForItemDelegate;
 		}
@@ -39,7 +38,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="item">The element from which to extract the key.</param>
 		/// <returns>The key for the specified element.</returns>
 		protected override TKey GetKeyForItem(TItem item) {
-			ErrorUtilities.VerifyArgumentNotNull(item, "item");
+			ErrorUtilities.VerifyArgumentNotNull(item, "item"); // null items not supported.
 			return this.getKeyForItemDelegate(item);
 		}
 	}
diff --git a/src/DotNetOpenAuth/Messaging/MessageReceivingEndpoint.cs b/src/DotNetOpenAuth/Messaging/MessageReceivingEndpoint.cs
index e532e99..ddf3664 100644
--- a/src/DotNetOpenAuth/Messaging/MessageReceivingEndpoint.cs
+++ b/src/DotNetOpenAuth/Messaging/MessageReceivingEndpoint.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// An immutable description of a URL that receives messages.
@@ -27,9 +28,9 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="location">The URL of this endpoint.</param>
 		/// <param name="method">The HTTP method(s) allowed.</param>
 		public MessageReceivingEndpoint(Uri location, HttpDeliveryMethods method) {
-			ErrorUtilities.VerifyArgumentNotNull(location, "location");
-			ErrorUtilities.VerifyArgumentInRange(method != HttpDeliveryMethods.None, "method");
-			ErrorUtilities.VerifyArgumentInRange((method & (HttpDeliveryMethods.PostRequest | HttpDeliveryMethods.GetRequest)) != 0, "method", MessagingStrings.GetOrPostFlagsRequired);
+			Contract.Requires<ArgumentNullException>(location != null);
+			Contract.Requires<ArgumentOutOfRangeException>(method != HttpDeliveryMethods.None, "method");
+			Contract.Requires<ArgumentOutOfRangeException>((method & (HttpDeliveryMethods.PostRequest | HttpDeliveryMethods.GetRequest)) != 0, MessagingStrings.GetOrPostFlagsRequired);
 
 			this.Location = location;
 			this.AllowedMethods = method;
diff --git a/src/DotNetOpenAuth/Messaging/MessageSerializer.cs b/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
index 1aafc11..0f100c9 100644
--- a/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
+++ b/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
@@ -33,7 +33,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// that will be serialized and deserialized using this class.</param>
 		[ContractVerification(false)] // bugs/limitations in CC static analysis
 		private MessageSerializer(Type messageType) {
-			Contract.Requires(messageType != null);
+			Contract.Requires<ArgumentNullException>(messageType != null);
 			Contract.Requires(typeof(IMessage).IsAssignableFrom(messageType));
 			Contract.Ensures(this.messageType != null);
 
@@ -54,9 +54,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>A message serializer for the given message type.</returns>
 		[ContractVerification(false)] // bugs/limitations in CC static analysis
 		internal static MessageSerializer Get(Type messageType) {
-			Contract.Requires(messageType != null);
-			Contract.Requires(typeof(IMessage).IsAssignableFrom(messageType));
-			ErrorUtilities.VerifyArgumentNotNull(messageType, "messageType");
+			Contract.Requires<ArgumentNullException>(messageType != null);
+			Contract.Requires<ArgumentException>(typeof(IMessage).IsAssignableFrom(messageType));
 
 			return new MessageSerializer(messageType);
 		}
@@ -66,11 +65,11 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="messageDictionary">The message to be serialized.</param>
 		/// <returns>The dictionary of values to send for the message.</returns>
+		[Pure]
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Parallel design with Deserialize method.")]
 		internal IDictionary<string, string> Serialize(MessageDictionary messageDictionary) {
-			Contract.Requires(messageDictionary != null);
+			Contract.Requires<ArgumentNullException>(messageDictionary != null);
 			Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(messageDictionary, "messageDictionary");
 
 			// Rather than hand back the whole message dictionary (which 
 			// includes keys with blank values), create a new dictionary
@@ -100,10 +99,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="messageDictionary">The message to deserialize into.</param>
 		/// <exception cref="ProtocolException">Thrown when protocol rules are broken by the incoming message.</exception>
 		internal void Deserialize(IDictionary<string, string> fields, MessageDictionary messageDictionary) {
-			Contract.Requires(fields != null);
-			Contract.Requires(messageDictionary != null);
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-			ErrorUtilities.VerifyArgumentNotNull(messageDictionary, "messageDictionary");
+			Contract.Requires<ArgumentNullException>(fields != null);
+			Contract.Requires<ArgumentNullException>(messageDictionary != null);
 
 			var messageDescription = messageDictionary.Description;
 
@@ -124,6 +121,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/Messaging/MessagingUtilities.cs b/src/DotNetOpenAuth/Messaging/MessagingUtilities.cs
index 624520b..c8c4817 100644
--- a/src/DotNetOpenAuth/Messaging/MessagingUtilities.cs
+++ b/src/DotNetOpenAuth/Messaging/MessagingUtilities.cs
@@ -64,8 +64,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="response">The response to send to the uesr agent.</param>
 		/// <returns>The <see cref="ActionResult"/> instance to be returned by the Controller's action method.</returns>
 		public static ActionResult AsActionResult(this OutgoingWebResponse response) {
-			Contract.Requires(response != null);
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			return new OutgoingWebResponseActionResult(response);
 		}
 
@@ -97,8 +96,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="prefix">The prefix for parameters to remove.  A period is NOT automatically appended.</param>
 		/// <returns>Either a new Uri with the parameters removed if there were any to remove, or the same Uri instance if no parameters needed to be removed.</returns>
 		public static Uri StripQueryArgumentsWithPrefix(this Uri uri, string prefix) {
-			ErrorUtilities.VerifyArgumentNotNull(uri, "uri");
-			ErrorUtilities.VerifyNonZeroLength(prefix, "prefix");
+			Contract.Requires<ArgumentNullException>(uri != null);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(prefix));
 
 			NameValueCollection queryArgs = HttpUtility.ParseQueryString(uri.Query);
 			var matchingKeys = queryArgs.Keys.OfType<string>().Where(key => key.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)).ToList();
@@ -170,8 +169,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="headers">The headers to add.</param>
 		/// <param name="response">The <see cref="HttpResponse"/> instance to set the appropriate values to.</param>
 		internal static void ApplyHeadersToResponse(WebHeaderCollection headers, HttpResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(headers, "headers");
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(headers != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			foreach (string headerName in headers) {
 				switch (headerName) {
@@ -195,8 +194,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="headers">The headers to add.</param>
 		/// <param name="response">The <see cref="HttpListenerResponse"/> instance to set the appropriate values to.</param>
 		internal static void ApplyHeadersToResponse(WebHeaderCollection headers, HttpListenerResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(headers, "headers");
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(headers != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			foreach (string headerName in headers) {
 				switch (headerName) {
@@ -238,8 +237,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// The positions are NOT reset after copying is complete.
 		/// </remarks>
 		internal static int CopyTo(this Stream copyFrom, Stream copyTo, int maximumBytesToCopy) {
-			ErrorUtilities.VerifyArgumentNotNull(copyFrom, "copyFrom");
-			ErrorUtilities.VerifyArgumentNotNull(copyTo, "copyTo");
+			Contract.Requires<ArgumentNullException>(copyFrom != null);
+			Contract.Requires<ArgumentNullException>(copyTo != null);
 			ErrorUtilities.VerifyArgument(copyFrom.CanRead, MessagingStrings.StreamUnreadable);
 			ErrorUtilities.VerifyArgument(copyTo.CanWrite, MessagingStrings.StreamUnwritable, "copyTo");
 
@@ -262,7 +261,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="copyFrom">The stream to copy bytes from.</param>
 		/// <returns>A seekable stream with the same contents as the original.</returns>
 		internal static Stream CreateSnapshot(this Stream copyFrom) {
-			ErrorUtilities.VerifyArgumentNotNull(copyFrom, "copyFrom");
+			Contract.Requires<ArgumentNullException>(copyFrom != null);
 
 			MemoryStream copyTo = new MemoryStream(copyFrom.CanSeek ? (int)copyFrom.Length : 4 * 1024);
 			copyFrom.CopyTo(copyTo);
@@ -276,7 +275,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The request to clone.</param>
 		/// <returns>The newly created instance.</returns>
 		internal static HttpWebRequest Clone(this HttpWebRequest request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 			return Clone(request, request.RequestUri);
 		}
 
@@ -287,8 +286,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="newRequestUri">The new recipient of the request.</param>
 		/// <returns>The newly created instance.</returns>
 		internal static HttpWebRequest Clone(this HttpWebRequest request, Uri newRequestUri) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNotNull(newRequestUri, "newRequestUri");
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentNullException>(newRequestUri != null);
 
 			var newRequest = (HttpWebRequest)WebRequest.Create(newRequestUri);
 
@@ -354,8 +353,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="second">The second array in the comparison. May not be null.</param>
 		/// <returns>True if the arrays equal; false otherwise.</returns>
 		internal static bool AreEquivalent<T>(T[] first, T[] second) {
-			ErrorUtilities.VerifyArgumentNotNull(first, "first");
-			ErrorUtilities.VerifyArgumentNotNull(second, "second");
+			Contract.Requires<ArgumentNullException>(first != null);
+			Contract.Requires<ArgumentNullException>(second != null);
 			if (first.Length != second.Length) {
 				return false;
 			}
@@ -455,9 +454,9 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="args">The dictionary of key/values to read from.</param>
 		/// <returns>The formulated querystring style string.</returns>
 		internal static string CreateQueryString(IEnumerable<KeyValuePair<string, string>> args) {
-			Contract.Requires(args != null);
+			Contract.Requires<ArgumentNullException>(args != null);
 			Contract.Ensures(Contract.Result<string>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(args, "args");
+
 			if (args.Count() == 0) {
 				return string.Empty;
 			}
@@ -491,7 +490,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// in the query string, the existing ones are <i>not</i> replaced.
 		/// </remarks>
 		internal static void AppendQueryArgs(this UriBuilder builder, IEnumerable<KeyValuePair<string, string>> args) {
-			ErrorUtilities.VerifyArgumentNotNull(builder, "builder");
+			Contract.Requires<ArgumentNullException>(builder != null);
 
 			if (args != null && args.Count() > 0) {
 				StringBuilder sb = new StringBuilder(50 + (args.Count() * 10));
@@ -515,7 +514,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// If null, <paramref name="builder"/> is not changed.
 		/// </param>
 		internal static void AppendAndReplaceQueryArgs(this UriBuilder builder, IEnumerable<KeyValuePair<string, string>> args) {
-			ErrorUtilities.VerifyArgumentNotNull(builder, "builder");
+			Contract.Requires<ArgumentNullException>(builder != null);
 
 			if (args != null && args.Count() > 0) {
 				NameValueCollection aggregatedArgs = HttpUtility.ParseQueryString(builder.Query);
@@ -626,7 +625,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// if their <see cref="IDirectedProtocolMessage.Recipient"/> property is non-null.
 		/// </remarks>
 		internal static bool IsRequest(this IDirectedProtocolMessage message) {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 			return message.Recipient != null;
 		}
 
@@ -644,7 +643,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <see cref="IDirectResponseProtocolMessage.OriginatingRequest"/> property is non-null.
 		/// </remarks>
 		internal static bool IsDirectResponse(this IDirectResponseProtocolMessage message) {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 			return message.OriginatingRequest != null;
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/NetworkDirectWebResponse.cs b/src/DotNetOpenAuth/Messaging/NetworkDirectWebResponse.cs
index fd6e3ab..643cf81 100644
--- a/src/DotNetOpenAuth/Messaging/NetworkDirectWebResponse.cs
+++ b/src/DotNetOpenAuth/Messaging/NetworkDirectWebResponse.cs
@@ -42,8 +42,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="response">The response.</param>
 		internal NetworkDirectWebResponse(Uri requestUri, HttpWebResponse response)
 			: base(requestUri, response) {
-			Contract.RequiresAlways(requestUri != null);
-			Contract.RequiresAlways(response != null);
+			Contract.Requires<ArgumentNullException>(requestUri != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 			this.httpWebResponse = response;
 			this.responseStream = response.GetResponseStream();
 		}
@@ -86,7 +86,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		internal override CachedDirectWebResponse GetSnapshot(int maximumBytesToCache) {
 			ErrorUtilities.VerifyOperation(!this.streamReadBegun, "Network stream reading has already begun.");
-			ErrorUtilities.VerifyOperation(this.RequestUri != null, "RequestUri != null");
 			ErrorUtilities.VerifyOperation(this.httpWebResponse != null, "httpWebResponse != null");
 
 			this.streamReadBegun = true;
diff --git a/src/DotNetOpenAuth/Messaging/OutgoingWebResponse.cs b/src/DotNetOpenAuth/Messaging/OutgoingWebResponse.cs
index bad582c..5ce1f85 100644
--- a/src/DotNetOpenAuth/Messaging/OutgoingWebResponse.cs
+++ b/src/DotNetOpenAuth/Messaging/OutgoingWebResponse.cs
@@ -44,7 +44,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="response">The <see cref="HttpWebResponse"/> to clone.</param>
 		/// <param name="maximumBytesToRead">The maximum bytes to read from the response stream.</param>
 		protected internal OutgoingWebResponse(HttpWebResponse response, int maximumBytesToRead) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.Status = response.StatusCode;
 			this.Headers = response.Headers;
@@ -134,8 +134,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// Typically this is <see cref="HttpContext.Current"/>.</param>
 		/// <exception cref="ThreadAbortException">Thrown by ASP.NET in order to prevent additional data from the page being sent to the client and corrupting the response.</exception>
 		public virtual void Send(HttpContext context) {
-			Contract.Requires(context != null);
-			ErrorUtilities.VerifyArgumentNotNull(context, "context");
+			Contract.Requires<ArgumentNullException>(context != null);
 
 			context.Response.Clear();
 			context.Response.StatusCode = (int)this.Status;
@@ -162,8 +161,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="response">The response to set to this message.</param>
 		public virtual void Send(HttpListenerResponse response) {
-			Contract.Requires(response != null);
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			response.StatusCode = (int)this.Status;
 			MessagingUtilities.ApplyHeadersToResponse(this.Headers, response);
@@ -186,8 +184,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// rather than cause a redirect.
 		/// </remarks>
 		internal Uri GetDirectUriRequest(Channel channel) {
-			Contract.Requires(channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			var message = this.OriginalMessage as IDirectedProtocolMessage;
 			if (message == null) {
diff --git a/src/DotNetOpenAuth/Messaging/OutgoingWebResponseActionResult.cs b/src/DotNetOpenAuth/Messaging/OutgoingWebResponseActionResult.cs
index 2da1ebf..1cfc638 100644
--- a/src/DotNetOpenAuth/Messaging/OutgoingWebResponseActionResult.cs
+++ b/src/DotNetOpenAuth/Messaging/OutgoingWebResponseActionResult.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Messaging {
+	using System;
 	using System.Diagnostics.Contracts;
 	using System.Web.Mvc;
 	using DotNetOpenAuth.Messaging;
@@ -24,8 +25,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		internal OutgoingWebResponseActionResult(OutgoingWebResponse response) {
-			Contract.Requires(response != null);
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			this.response = response;
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/ProtocolException.cs b/src/DotNetOpenAuth/Messaging/ProtocolException.cs
index daf13d7..25f8eee 100644
--- a/src/DotNetOpenAuth/Messaging/ProtocolException.cs
+++ b/src/DotNetOpenAuth/Messaging/ProtocolException.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.Messaging {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Security.Permissions;
 
 	/// <summary>
@@ -43,7 +44,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="faultedMessage">The message that was the cause of the exception.  Must not be null.</param>
 		protected internal ProtocolException(string message, IProtocolMessage faultedMessage)
 			: base(message) {
-			ErrorUtilities.VerifyArgumentNotNull(faultedMessage, "faultedMessage");
+			Contract.Requires<ArgumentNullException>(faultedMessage != null);
 			this.FaultedMessage = faultedMessage;
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
index 60ce7fa..f250a57 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
@@ -40,10 +40,9 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="messageType">Type of the message.</param>
 		/// <param name="messageVersion">The message version.</param>
 		internal MessageDescription(Type messageType, Version messageVersion) {
-			Contract.Requires(messageType != null && typeof(IMessage).IsAssignableFrom(messageType));
-			Contract.Requires(messageVersion != null);
-			ErrorUtilities.VerifyArgumentNotNull(messageType, "messageType");
-			ErrorUtilities.VerifyArgumentNotNull(messageVersion, "messageVersion");
+			Contract.Requires<ArgumentNullException>(messageType != null);
+			Contract.Requires<ArgumentException>(typeof(IMessage).IsAssignableFrom(messageType));
+			Contract.Requires<ArgumentNullException>(messageVersion != null);
 			if (!typeof(IMessage).IsAssignableFrom(messageType)) {
 				throw new ArgumentException(string.Format(
 					CultureInfo.CurrentCulture,
@@ -72,9 +71,8 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <returns>The dictionary accessor to the message</returns>
 		[Pure]
 		internal MessageDictionary GetDictionary(IMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			Contract.Ensures(Contract.Result<MessageDictionary>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
 			return new MessageDictionary(message, this);
 		}
 
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescriptionCollection.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescriptionCollection.cs
index e8f4645..b01b03e 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescriptionCollection.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescriptionCollection.cs
@@ -35,11 +35,10 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <returns>A <see cref="MessageDescription"/> instance.</returns>
 		[Pure]
 		internal MessageDescription Get(Type messageType, Version messageVersion) {
-			Contract.Requires(messageType != null && typeof(IMessage).IsAssignableFrom(messageType));
-			Contract.Requires(messageVersion != null);
+			Contract.Requires<ArgumentNullException>(messageType != null);
+			Contract.Requires<ArgumentException>(typeof(IMessage).IsAssignableFrom(messageType));
+			Contract.Requires<ArgumentNullException>(messageVersion != null);
 			Contract.Ensures(Contract.Result<MessageDescription>() != null);
-			ErrorUtilities.VerifyArgumentNotNull(messageType, "messageType");
-			ErrorUtilities.VerifyArgumentNotNull(messageVersion, "messageVersion");
 
 			MessageTypeAndVersion key = new MessageTypeAndVersion(messageType, messageVersion);
 
@@ -66,7 +65,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// </returns>
 		[Pure]
 		internal MessageDescription Get(IMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			Contract.Ensures(Contract.Result<MessageDescription>() != null);
 			return this.Get(message.GetType(), message.Version);
 		}
@@ -78,7 +77,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <returns>The dictionary.</returns>
 		[Pure]
 		internal MessageDictionary GetAccessor(IMessage message) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 			ErrorUtilities.VerifyArgumentNotNull(message, "message");
 			return this.Get(message).GetDictionary(message);
 		}
@@ -104,10 +103,8 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 			/// <param name="messageType">Type of the message.</param>
 			/// <param name="messageVersion">The message version.</param>
 			internal MessageTypeAndVersion(Type messageType, Version messageVersion) {
-				Contract.Requires(messageType != null);
-				Contract.Requires(messageVersion != null);
-				ErrorUtilities.VerifyArgumentNotNull(messageType, "messageType");
-				ErrorUtilities.VerifyArgumentNotNull(messageVersion, "messageVersion");
+				Contract.Requires<ArgumentNullException>(messageType != null);
+				Contract.Requires<ArgumentNullException>(messageVersion != null);
 
 				this.type = messageType;
 				this.version = messageVersion;
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
index 641ed3a..3d2b5ae 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
@@ -36,8 +36,8 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="description">The message description.</param>
 		[Pure]
 		internal MessageDictionary(IMessage message, MessageDescription description) {
-			Contract.Requires(message != null);
-			Contract.Requires(description != null);
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentNullException>(description != null);
 
 			this.message = message;
 			this.description = description;
@@ -370,6 +370,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// Saves the data in a message to a standard dictionary.
 		/// </summary>
 		/// <returns>The generated dictionary.</returns>
+		[Pure]
 		public IDictionary<string, string> Serialize() {
 			Contract.Ensures(Contract.Result<IDictionary<string, string>>() != null);
 			return this.Serializer.Serialize(this);
@@ -380,7 +381,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// </summary>
 		/// <param name="fields">The data to load into the message.</param>
 		public void Deserialize(IDictionary<string, string> fields) {
-			Contract.Requires(fields != null);
+			Contract.Requires<ArgumentNullException>(fields != null);
 			this.Serializer.Deserialize(fields, this);
 		}
 
@@ -388,6 +389,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessagePart.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessagePart.cs
index 875d7b4..32409bc 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessagePart.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessagePart.cs
@@ -75,10 +75,22 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 				ErrorUtilities.VerifyFormat(str.Length > 0, MessagingStrings.NonEmptyStringExpected);
 				return Identifier.Parse(str);
 			};
+			Func<byte[], string> safeFromByteArray = bytes => {
+				Contract.Assume(bytes != null);
+				return Convert.ToBase64String(bytes);
+			};
+			Func<string, byte[]> safeToByteArray = str => {
+				Contract.Assume(str != null);
+				return Convert.FromBase64String(str);
+			};
+			Func<string, Realm> safeRealm = str => {
+				Contract.Assume(str != null);
+				return new Realm(str);
+			};
 			Map<Uri>(uri => uri.AbsoluteUri, safeUri);
 			Map<DateTime>(dt => XmlConvert.ToString(dt, XmlDateTimeSerializationMode.Utc), str => XmlConvert.ToDateTime(str, XmlDateTimeSerializationMode.Utc));
-			Map<byte[]>(bytes => Convert.ToBase64String(bytes), str => Convert.FromBase64String(str));
-			Map<Realm>(realm => realm.ToString(), str => new Realm(str));
+			Map<byte[]>(safeFromByteArray, safeToByteArray);
+			Map<Realm>(realm => realm.ToString(), safeRealm);
 			Map<Identifier>(id => id.ToString(), safeIdentfier);
 			Map<bool>(value => value.ToString().ToLowerInvariant(), safeBool);
 			Map<CultureInfo>(c => c.Name, str => new CultureInfo(str));
@@ -95,10 +107,11 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// The attribute discovered on <paramref name="member"/> that describes the
 		/// serialization requirements of the message part.
 		/// </param>
+		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code contracts requires it.")]
 		internal MessagePart(MemberInfo member, MessagePartAttribute attribute) {
-			Contract.Requires(member != null);
-			Contract.Requires(member is FieldInfo || member is PropertyInfo);
-			Contract.Requires(attribute != null);
+			Contract.Requires<ArgumentNullException>(member != null);
+			Contract.Requires<ArgumentException>(member is FieldInfo || member is PropertyInfo);
+			Contract.Requires<ArgumentNullException>(attribute != null);
 
 			this.field = member as FieldInfo;
 			this.property = member as PropertyInfo;
@@ -109,6 +122,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 			this.memberDeclaredType = (this.field != null) ? this.field.FieldType : this.property.PropertyType;
 			this.defaultMemberValue = DeriveDefaultValue(this.memberDeclaredType);
 
+			Contract.Assume(this.memberDeclaredType != null); // CC missing PropertyInfo.PropertyType ensures result != null
 			if (attribute.Encoder == null) {
 				if (!converters.TryGetValue(this.memberDeclaredType, out this.converter)) {
 					this.converter = new ValueMapping(
@@ -169,7 +183,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="message">The message instance containing the member whose value should be set.</param>
 		/// <param name="value">The string representation of the value to set.</param>
 		internal void SetValue(IMessage message, string value) {
-			Contract.Requires(message != null);
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			try {
 				if (this.IsConstantValue) {
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/ValueMapping.cs b/src/DotNetOpenAuth/Messaging/Reflection/ValueMapping.cs
index b31e4d8..4d23c95 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/ValueMapping.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/ValueMapping.cs
@@ -29,8 +29,8 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="toString">The mapping function that converts some custom type to a string.</param>
 		/// <param name="toValue">The mapping function that converts a string to some custom type.</param>
 		internal ValueMapping(Func<object, string> toString, Func<string, object> toValue) {
-			Contract.Requires(toString != null);
-			Contract.Requires(toValue != null);
+			Contract.Requires<ArgumentNullException>(toString != null);
+			Contract.Requires<ArgumentNullException>(toValue != null);
 
 			this.ValueToString = toString;
 			this.StringToValue = toValue;
diff --git a/src/DotNetOpenAuth/Messaging/StandardWebRequestHandler.cs b/src/DotNetOpenAuth/Messaging/StandardWebRequestHandler.cs
index e8d8fe1..bafda84 100644
--- a/src/DotNetOpenAuth/Messaging/StandardWebRequestHandler.cs
+++ b/src/DotNetOpenAuth/Messaging/StandardWebRequestHandler.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Messaging {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Net.Sockets;
@@ -36,6 +37,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>
 		/// 	<c>true</c> if this instance can support the specified options; otherwise, <c>false</c>.
 		/// </returns>
+		[Pure]
 		public bool CanSupport(DirectWebRequestOptions options) {
 			return (options & ~SupportedOptions) == 0;
 		}
@@ -76,9 +78,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// a single exception type for hosts to catch.</para>
 		/// </remarks>
 		public Stream GetRequestStream(HttpWebRequest request, DirectWebRequestOptions options) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifySupported(this.CanSupport(options), MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name);
-
 			return GetRequestStreamCore(request);
 		}
 
@@ -118,9 +117,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// value, if set, shoud be Closed before throwing.</para>
 		/// </remarks>
 		public IncomingWebResponse GetResponse(HttpWebRequest request, DirectWebRequestOptions options) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifySupported(this.CanSupport(options), MessagingStrings.DirectWebRequestOptionsNotSupported, options, this.GetType().Name);
-
 			// This request MAY have already been prepared by GetRequestStream, but
 			// we have no guarantee, so do it just to be safe.
 			PrepareRequest(request, false);
@@ -203,7 +199,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The request.</param>
 		/// <param name="preparingPost"><c>true</c> if this is a POST request whose headers have not yet been sent out; <c>false</c> otherwise.</param>
 		private static void PrepareRequest(HttpWebRequest request, bool preparingPost) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			// Be careful to not try to change the HTTP headers that have already gone out.
 			if (preparingPost || request.Method == "GET") {
diff --git a/src/DotNetOpenAuth/Messaging/UntrustedWebRequestHandler.cs b/src/DotNetOpenAuth/Messaging/UntrustedWebRequestHandler.cs
index 733b698..a5cbdab 100644
--- a/src/DotNetOpenAuth/Messaging/UntrustedWebRequestHandler.cs
+++ b/src/DotNetOpenAuth/Messaging/UntrustedWebRequestHandler.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.Messaging {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Net;
@@ -87,7 +88,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="chainedWebRequestHandler">The chained web request handler.</param>
 		public UntrustedWebRequestHandler(IDirectWebRequestHandler chainedWebRequestHandler) {
-			ErrorUtilities.VerifyArgumentNotNull(chainedWebRequestHandler, "chainedWebRequestHandler");
+			Contract.Requires<ArgumentNullException>(chainedWebRequestHandler != null);
 
 			this.chainedWebRequestHandler = chainedWebRequestHandler;
 			if (Debugger.IsAttached) {
@@ -111,7 +112,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value >= 2048, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value >= 2048);
 				this.maximumBytesToRead = value;
 			}
 		}
@@ -126,7 +127,7 @@ namespace DotNetOpenAuth.Messaging {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value >= 0, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value >= 0);
 				this.maximumRedirections = value;
 			}
 		}
@@ -185,6 +186,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <returns>
 		/// 	<c>true</c> if this instance can support the specified options; otherwise, <c>false</c>.
 		/// </returns>
+		[Pure]
 		public bool CanSupport(DirectWebRequestOptions options) {
 			// We support whatever our chained handler supports, plus RequireSsl.
 			return this.chainedWebRequestHandler.CanSupport(options & ~DirectWebRequestOptions.RequireSsl);
@@ -207,7 +209,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// a single exception type for hosts to catch.</para>
 		/// </remarks>
 		public Stream GetRequestStream(HttpWebRequest request, DirectWebRequestOptions options) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 			this.EnsureAllowableRequestUri(request.RequestUri, (options & DirectWebRequestOptions.RequireSsl) != 0);
 
 			this.PrepareRequest(request, true);
@@ -234,8 +235,6 @@ namespace DotNetOpenAuth.Messaging {
 		/// </remarks>
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Uri(Uri, string) accepts second arguments that Uri(Uri, new Uri(string)) does not that we must support.")]
 		public IncomingWebResponse GetResponse(HttpWebRequest request, DirectWebRequestOptions options) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-
 			// This request MAY have already been prepared by GetRequestStream, but
 			// we have no guarantee, so do it just to be safe.
 			this.PrepareRequest(request, false);
@@ -306,7 +305,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// 	<c>true</c> if this is a loopback IP address; <c>false</c> otherwise.
 		/// </returns>
 		private static bool IsIPv6Loopback(IPAddress ip) {
-			ErrorUtilities.VerifyArgumentNotNull(ip, "ip");
+			Contract.Requires<ArgumentNullException>(ip != null);
 			byte[] addressBytes = ip.GetAddressBytes();
 			for (int i = 0; i < addressBytes.Length - 1; i++) {
 				if (addressBytes[i] != 0) {
@@ -329,9 +328,9 @@ namespace DotNetOpenAuth.Messaging {
 		/// 	<c>true</c> if the specified host falls within at least one of the given lists; otherwise, <c>false</c>.
 		/// </returns>
 		private static bool IsHostInList(string host, ICollection<string> stringList, ICollection<Regex> regexList) {
-			ErrorUtilities.VerifyNonZeroLength(host, "host");
-			ErrorUtilities.VerifyArgumentNotNull(stringList, "stringList");
-			ErrorUtilities.VerifyArgumentNotNull(regexList, "regexList");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(host));
+			Contract.Requires<ArgumentNullException>(stringList != null);
+			Contract.Requires<ArgumentNullException>(regexList != null);
 			foreach (string testHost in stringList) {
 				if (string.Equals(host, testHost, StringComparison.OrdinalIgnoreCase)) {
 					return true;
@@ -387,7 +386,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// 	<c>true</c> if [is URI allowable] [the specified URI]; otherwise, <c>false</c>.
 		/// </returns>
 		private bool IsUriAllowable(Uri uri) {
-			ErrorUtilities.VerifyArgumentNotNull(uri, "uri");
+			Contract.Requires<ArgumentNullException>(uri != null);
 			if (!this.allowableSchemes.Contains(uri.Scheme)) {
 				Logger.Http.WarnFormat("Rejecting URL {0} because it uses a disallowed scheme.", uri);
 				return false;
@@ -447,7 +446,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="request">The request to prepare.</param>
 		/// <param name="preparingPost"><c>true</c> if this is a POST request whose headers have not yet been sent out; <c>false</c> otherwise.</param>
 		private void PrepareRequest(HttpWebRequest request, bool preparingPost) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			// Be careful to not try to change the HTTP headers that have already gone out.
 			if (preparingPost || request.Method == "GET") {
diff --git a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthChannel.cs b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthChannel.cs
index dcd4494..cd34f6f 100644
--- a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthChannel.cs
+++ b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthChannel.cs
@@ -64,7 +64,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// </param>
 		internal OAuthChannel(ITamperProtectionChannelBindingElement signingBindingElement, INonceStore store, ITokenManager tokenManager, IMessageFactory messageTypeProvider)
 			: base(messageTypeProvider, new OAuthHttpMethodBindingElement(), signingBindingElement, new StandardExpirationBindingElement(), new StandardReplayProtectionBindingElement(store)) {
-			ErrorUtilities.VerifyArgumentNotNull(tokenManager, "tokenManager");
+			Contract.Requires<ArgumentNullException>(tokenManager != null);
 
 			this.TokenManager = tokenManager;
 			ErrorUtilities.VerifyArgumentNamed(signingBindingElement.SignatureCallback == null, "signingBindingElement", OAuthStrings.SigningElementAlreadyAssociatedWithChannel);
@@ -101,7 +101,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// <param name="request">The message to attach.</param>
 		/// <returns>The initialized web request.</returns>
 		internal HttpWebRequest InitializeRequest(IDirectedProtocolMessage request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			ProcessOutgoingMessage(request);
 			return this.CreateHttpRequest(request);
@@ -114,8 +114,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// <param name="request">The HTTP request to search.</param>
 		/// <returns>The deserialized message, if one is found.  Null otherwise.</returns>
 		protected override IDirectedProtocolMessage ReadFromRequestCore(HttpRequestInfo request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-
 			var fields = new Dictionary<string, string>();
 
 			// First search the Authorization header.
@@ -172,8 +170,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// The deserialized message parts, if found.  Null otherwise.
 		/// </returns>
 		protected override IDictionary<string, string> ReadFromResponseCore(IncomingWebResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
-
 			string body = response.GetResponseReader().ReadToEnd();
 			return HttpUtility.ParseQueryString(body).ToDictionary();
 		}
@@ -186,9 +182,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// The <see cref="HttpRequest"/> prepared to send the request.
 		/// </returns>
 		protected override HttpWebRequest CreateHttpRequest(IDirectedProtocolMessage request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNamed(request.Recipient != null, "request", MessagingStrings.DirectedMessageMissingRecipient);
-
 			IDirectedProtocolMessage oauthRequest = request as IDirectedProtocolMessage;
 			ErrorUtilities.VerifyArgument(oauthRequest != null, MessagingStrings.UnexpectedType, typeof(IDirectedProtocolMessage), request.GetType());
 
@@ -217,8 +210,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// This method implements spec V1.0 section 5.3.
 		/// </remarks>
 		protected override OutgoingWebResponse PrepareDirectResponse(IProtocolMessage response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
-
 			var messageAccessor = this.MessageDescriptions.GetAccessor(response);
 			var fields = messageAccessor.Serialize();
 			string responseBody = MessagingUtilities.CreateQueryString(fields);
@@ -244,8 +235,8 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// <param name="source">The dictionary with names and values to encode.</param>
 		/// <param name="destination">The dictionary to add the encoded pairs to.</param>
 		private static void UriEscapeParameters(IDictionary<string, string> source, IDictionary<string, string> destination) {
-			ErrorUtilities.VerifyArgumentNotNull(source, "source");
-			ErrorUtilities.VerifyArgumentNotNull(destination, "destination");
+			Contract.Requires<ArgumentNullException>(source != null);
+			Contract.Requires<ArgumentNullException>(destination != null);
 
 			foreach (var pair in source) {
 				var key = MessagingUtilities.EscapeUriDataStringRfc3986(pair.Key);
@@ -260,8 +251,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// <param name="message">The message.</param>
 		/// <returns>"POST", "GET" or some other similar http verb.</returns>
 		private static string GetHttpMethod(IDirectedProtocolMessage message) {
-			Contract.Requires(message != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 
 			var signedMessage = message as ITamperResistantOAuthMessage;
 			if (signedMessage != null) {
diff --git a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
index fce351b..5d76afc 100644
--- a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
+++ b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthConsumerMessageFactory.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.Messages;
 
@@ -38,9 +39,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// UserAuthorizationResponse
 		/// </remarks>
 		public virtual IDirectedProtocolMessage GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(recipient, "recipient");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			MessageBase message = null;
 
 			if (fields.ContainsKey("oauth_token")) {
@@ -73,9 +71,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// AuthorizedTokenResponse
 		/// </remarks>
 		public virtual IDirectResponseProtocolMessage GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			MessageBase message = null;
 
 			// All response messages have the oauth_token field.
diff --git a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
index 1aaea7f..767a0b9 100644
--- a/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
+++ b/src/DotNetOpenAuth/OAuth/ChannelElements/OAuthServiceProviderMessageFactory.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OAuth.ChannelElements {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth.Messages;
 
@@ -25,7 +26,7 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// </summary>
 		/// <param name="tokenManager">The token manager instance to use.</param>
 		protected internal OAuthServiceProviderMessageFactory(IServiceProviderTokenManager tokenManager) {
-			ErrorUtilities.VerifyArgumentNotNull(tokenManager, "tokenManager");
+			Contract.Requires<ArgumentNullException>(tokenManager != null);
 
 			this.tokenManager = tokenManager;
 		}
@@ -50,9 +51,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// AccessProtectedResourceRequest
 		/// </remarks>
 		public virtual IDirectedProtocolMessage GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(recipient, "recipient");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			MessageBase message = null;
 
 			if (fields.ContainsKey("oauth_consumer_key") &&
@@ -97,9 +95,6 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// None.
 		/// </remarks>
 		public virtual IDirectResponseProtocolMessage GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			Logger.OAuth.Error("Service Providers are not expected to ever receive responses.");
 			return null;
 		}
diff --git a/src/DotNetOpenAuth/OAuth/ChannelElements/SigningBindingElementBase.cs b/src/DotNetOpenAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
index 6991818..672769b 100644
--- a/src/DotNetOpenAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
+++ b/src/DotNetOpenAuth/OAuth/ChannelElements/SigningBindingElementBase.cs
@@ -148,8 +148,8 @@ namespace DotNetOpenAuth.OAuth.ChannelElements {
 		/// This method implements OAuth 1.0 section 9.1.
 		/// </remarks>
 		internal static string ConstructSignatureBaseString(ITamperResistantOAuthMessage message, MessageDictionary messageDictionary) {
-			Contract.Requires(message != null);
-			Contract.Requires(messageDictionary != null);
+			Contract.Requires<ArgumentNullException>(message != null);
+			Contract.Requires<ArgumentNullException>(messageDictionary != null);
 			Contract.Requires(messageDictionary.Message == message);
 
 			if (String.IsNullOrEmpty(message.HttpMethod)) {
diff --git a/src/DotNetOpenAuth/OAuth/ConsumerBase.cs b/src/DotNetOpenAuth/OAuth/ConsumerBase.cs
index 3abb794..32d7f58 100644
--- a/src/DotNetOpenAuth/OAuth/ConsumerBase.cs
+++ b/src/DotNetOpenAuth/OAuth/ConsumerBase.cs
@@ -25,8 +25,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="serviceDescription">The endpoints and behavior of the Service Provider.</param>
 		/// <param name="tokenManager">The host's method of storing and recalling tokens and secrets.</param>
 		protected ConsumerBase(ServiceProviderDescription serviceDescription, IConsumerTokenManager tokenManager) {
-			ErrorUtilities.VerifyArgumentNotNull(serviceDescription, "serviceDescription");
-			ErrorUtilities.VerifyArgumentNotNull(tokenManager, "tokenManager");
+			Contract.Requires<ArgumentNullException>(serviceDescription != null);
+			Contract.Requires<ArgumentNullException>(tokenManager != null);
 
 			ITamperProtectionChannelBindingElement signingElement = serviceDescription.CreateTamperProtectionElement();
 			INonceStore store = new NonceMemoryStore(StandardExpirationBindingElement.DefaultMaximumMessageAge);
@@ -73,10 +73,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="accessToken">The access token that permits access to the protected resource.</param>
 		/// <returns>The initialized WebRequest object.</returns>
 		public HttpWebRequest PrepareAuthorizedRequest(MessageReceivingEndpoint endpoint, string accessToken) {
-			Contract.Requires(endpoint != null);
-			Contract.Requires(!String.IsNullOrEmpty(accessToken));
-			ErrorUtilities.VerifyArgumentNotNull(endpoint, "endpoint");
-			ErrorUtilities.VerifyNonZeroLength(accessToken, "accessToken");
+			Contract.Requires<ArgumentNullException>(endpoint != null);
+			Contract.Requires<ArgumentNullException>(!String.IsNullOrEmpty(accessToken));
 
 			return this.PrepareAuthorizedRequest(endpoint, accessToken, EmptyDictionary<string, string>.Instance);
 		}
@@ -90,12 +88,9 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="extraData">Extra parameters to include in the message.  Must not be null, but may be empty.</param>
 		/// <returns>The initialized WebRequest object.</returns>
 		public HttpWebRequest PrepareAuthorizedRequest(MessageReceivingEndpoint endpoint, string accessToken, IDictionary<string, string> extraData) {
-			Contract.Requires(endpoint != null);
-			Contract.Requires(!String.IsNullOrEmpty(accessToken));
-			Contract.Requires(extraData != null);
-			ErrorUtilities.VerifyArgumentNotNull(endpoint, "endpoint");
-			ErrorUtilities.VerifyNonZeroLength(accessToken, "accessToken");
-			ErrorUtilities.VerifyArgumentNotNull(extraData, "extraData");
+			Contract.Requires<ArgumentNullException>(endpoint != null);
+			Contract.Requires<ArgumentNullException>(!String.IsNullOrEmpty(accessToken));
+			Contract.Requires<ArgumentNullException>(extraData != null);
 
 			IDirectedProtocolMessage message = this.CreateAuthorizingMessage(endpoint, accessToken);
 			foreach (var pair in extraData) {
@@ -123,8 +118,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </remarks>
 		[SuppressMessage("Microsoft.Design", "CA1011:ConsiderPassingBaseTypesAsParameters", Justification = "Type of parameter forces the method to apply only to specific scenario.")]
 		public HttpWebRequest PrepareAuthorizedRequest(AccessProtectedResourceRequest message) {
-			Contract.Requires(message != null);
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 			return this.OAuthChannel.InitializeRequest(message);
 		}
 
@@ -162,10 +156,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="accessToken">The access token that permits access to the protected resource.</param>
 		/// <returns>The initialized WebRequest object.</returns>
 		protected internal AccessProtectedResourceRequest CreateAuthorizingMessage(MessageReceivingEndpoint endpoint, string accessToken) {
-			Contract.Requires(endpoint != null);
-			Contract.Requires(!String.IsNullOrEmpty(accessToken));
-			ErrorUtilities.VerifyArgumentNotNull(endpoint, "endpoint");
-			ErrorUtilities.VerifyNonZeroLength(accessToken, "accessToken");
+			Contract.Requires<ArgumentNullException>(endpoint != null);
+			Contract.Requires<ArgumentNullException>(!String.IsNullOrEmpty(accessToken));
 
 			AccessProtectedResourceRequest message = new AccessProtectedResourceRequest(endpoint) {
 				AccessToken = accessToken,
@@ -215,9 +207,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="requestToken">The request token that the user has authorized.</param>
 		/// <returns>The access token assigned by the Service Provider.</returns>
 		protected AuthorizedTokenResponse ProcessUserAuthorization(string requestToken) {
-			Contract.Requires(!String.IsNullOrEmpty(requestToken));
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(requestToken));
 			Contract.Ensures(Contract.Result<AuthorizedTokenResponse>() != null);
-			ErrorUtilities.VerifyNonZeroLength(requestToken, "requestToken");
 
 			var requestAccess = new AuthorizedTokenRequest(this.ServiceProvider.AccessTokenEndpoint) {
 				RequestToken = requestToken,
diff --git a/src/DotNetOpenAuth/OAuth/Messages/MessageBase.cs b/src/DotNetOpenAuth/OAuth/Messages/MessageBase.cs
index e0269db..d5af466 100644
--- a/src/DotNetOpenAuth/OAuth/Messages/MessageBase.cs
+++ b/src/DotNetOpenAuth/OAuth/Messages/MessageBase.cs
@@ -63,7 +63,7 @@ namespace DotNetOpenAuth.OAuth.Messages {
 		/// <param name="protectionRequired">The level of protection the message requires.</param>
 		/// <param name="originatingRequest">The request that asked for this direct response.</param>
 		protected MessageBase(MessageProtections protectionRequired, IDirectedProtocolMessage originatingRequest) {
-			ErrorUtilities.VerifyArgumentNotNull(originatingRequest, "originatingRequest");
+			Contract.Requires<ArgumentNullException>(originatingRequest != null);
 
 			this.protectionRequired = protectionRequired;
 			this.transport = MessageTransport.Direct;
@@ -239,8 +239,7 @@ namespace DotNetOpenAuth.OAuth.Messages {
 		/// The string representation of this object.
 		/// </returns>
 		internal virtual string ToString(Channel channel) {
-			Contract.Requires(channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			StringBuilder builder = new StringBuilder();
 			builder.AppendFormat(CultureInfo.InvariantCulture, "{0} message", GetType().Name);
diff --git a/src/DotNetOpenAuth/OAuth/Messages/UnauthorizedTokenResponse.cs b/src/DotNetOpenAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
index 285dec7..0a12706 100644
--- a/src/DotNetOpenAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
+++ b/src/DotNetOpenAuth/OAuth/Messages/UnauthorizedTokenResponse.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OAuth.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 
 	/// <summary>
@@ -26,8 +27,8 @@ namespace DotNetOpenAuth.OAuth.Messages {
 		/// </remarks>
 		protected internal UnauthorizedTokenResponse(UnauthorizedTokenRequest requestMessage, string requestToken, string tokenSecret)
 			: this(requestMessage) {
-			ErrorUtilities.VerifyArgumentNotNull(requestToken, "requestToken");
-			ErrorUtilities.VerifyArgumentNotNull(tokenSecret, "tokenSecret");
+			Contract.Requires<ArgumentNullException>(requestToken != null);
+			Contract.Requires<ArgumentNullException>(tokenSecret != null);
 
 			this.RequestToken = requestToken;
 			this.TokenSecret = tokenSecret;
diff --git a/src/DotNetOpenAuth/OAuth/ServiceProvider.cs b/src/DotNetOpenAuth/OAuth/ServiceProvider.cs
index 886e5b3..c59c1ed 100644
--- a/src/DotNetOpenAuth/OAuth/ServiceProvider.cs
+++ b/src/DotNetOpenAuth/OAuth/ServiceProvider.cs
@@ -53,9 +53,9 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="tokenManager">The host's method of storing and recalling tokens and secrets.</param>
 		/// <param name="messageTypeProvider">An object that can figure out what type of message is being received for deserialization.</param>
 		public ServiceProvider(ServiceProviderDescription serviceDescription, ITokenManager tokenManager, OAuthServiceProviderMessageFactory messageTypeProvider) {
-			ErrorUtilities.VerifyArgumentNotNull(serviceDescription, "serviceDescription");
-			ErrorUtilities.VerifyArgumentNotNull(tokenManager, "tokenManager");
-			ErrorUtilities.VerifyArgumentNotNull(messageTypeProvider, "messageTypeProvider");
+			Contract.Requires<ArgumentNullException>(serviceDescription != null);
+			Contract.Requires<ArgumentNullException>(tokenManager != null);
+			Contract.Requires<ArgumentNullException>(messageTypeProvider != null);
 
 			var signingElement = serviceDescription.CreateTamperProtectionElement();
 			INonceStore store = new NonceMemoryStore(StandardExpirationBindingElement.DefaultMaximumMessageAge);
@@ -211,9 +211,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// security measures that are required are taken.</para>
 		/// </remarks>
 		public AuthorizationRequest ReadAuthorizationRequest(IHostProcessedRequest openIdRequest) {
-			Contract.Requires(openIdRequest != null);
+			Contract.Requires<ArgumentNullException>(openIdRequest != null);
 			Contract.Requires(this.TokenManager is ICombinedOpenIdProviderTokenManager);
-			ErrorUtilities.VerifyArgumentNotNull(openIdRequest, "openIdAuthenticationRequest");
 			var openidTokenManager = this.TokenManager as ICombinedOpenIdProviderTokenManager;
 			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);
 
@@ -241,10 +240,9 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="scope">The approved access scope.  Use <c>null</c> to indicate no access was granted.  The empty string will be interpreted as some default level of access is granted.</param>
 		[SuppressMessage("Microsoft.Design", "CA1011:ConsiderPassingBaseTypesAsParameters", Justification = "We want to take IAuthenticationRequest because that's the only supported use case.")]
 		public void AttachAuthorizationResponse(IAuthenticationRequest openIdAuthenticationRequest, string consumerKey, string scope) {
-			Contract.Requires(openIdAuthenticationRequest != null);
+			Contract.Requires<ArgumentNullException>(openIdAuthenticationRequest != null);
 			Contract.Requires((consumerKey == null) == (scope == null));
 			Contract.Requires(this.TokenManager is IOpenIdOAuthTokenManager);
-			ErrorUtilities.VerifyArgumentNotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");
 			var openidTokenManager = this.TokenManager as IOpenIdOAuthTokenManager;
 			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);
 
@@ -275,7 +273,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </returns>
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Consistent user experience with instance.")]
 		public UserAuthorizationResponse PrepareAuthorizationResponse(UserAuthorizationRequest request) {
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 
 			if (request.Callback != null) {
@@ -297,10 +295,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// </returns>
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Consistent user experience with instance.")]
 		public UserAuthorizationResponse PrepareAuthorizationResponse(UserAuthorizationRequest request, Uri callback) {
-			Contract.Requires(request != null);
-			Contract.Requires(callback != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNotNull(callback, "callback");
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentNullException>(callback != null);
 
 			var authorization = new UserAuthorizationResponse(request.Callback) {
 				RequestToken = request.RequestToken,
@@ -403,7 +399,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// </remarks>
 		/// <exception cref="ProtocolException">Thrown if an unexpected message is attached to the request.</exception>
 		public AccessProtectedResourceRequest ReadProtectedResourceAuthorization(HttpRequestInfo request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			AccessProtectedResourceRequest accessMessage;
 			if (this.Channel.TryReadFromRequest<AccessProtectedResourceRequest>(request, out accessMessage)) {
diff --git a/src/DotNetOpenAuth/OAuth/WebConsumer.cs b/src/DotNetOpenAuth/OAuth/WebConsumer.cs
index 689a795..4cf8b99 100644
--- a/src/DotNetOpenAuth/OAuth/WebConsumer.cs
+++ b/src/DotNetOpenAuth/OAuth/WebConsumer.cs
@@ -79,7 +79,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="openIdAuthenticationRequest">The OpenID authentication request.</param>
 		/// <param name="scope">The scope of access that is requested of the service provider.</param>
 		public void AttachAuthorizationRequest(IAuthenticationRequest openIdAuthenticationRequest, string scope) {
-			Contract.Requires(openIdAuthenticationRequest != null);
+			Contract.Requires<ArgumentNullException>(openIdAuthenticationRequest != null);
 			ErrorUtilities.VerifyArgumentNotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");
 
 			var authorizationRequest = new AuthorizationRequest {
@@ -102,9 +102,8 @@ namespace DotNetOpenAuth.OAuth {
 		/// The token manager instance must implement <see cref="IOpenIdOAuthTokenManager"/>.
 		/// </remarks>
 		public AuthorizedTokenResponse ProcessUserAuthorization(IAuthenticationResponse openIdAuthenticationResponse) {
-			Contract.Requires(openIdAuthenticationResponse != null);
+			Contract.Requires<ArgumentNullException>(openIdAuthenticationResponse != null);
 			Contract.Requires(this.TokenManager is IOpenIdOAuthTokenManager);
-			ErrorUtilities.VerifyArgumentNotNull(openIdAuthenticationResponse, "openIdAuthenticationResponse");
 			var openidTokenManager = this.TokenManager as IOpenIdOAuthTokenManager;
 			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);
 
@@ -141,8 +140,7 @@ namespace DotNetOpenAuth.OAuth {
 		/// <param name="request">The incoming HTTP request.</param>
 		/// <returns>The access token, or null if no incoming authorization message was recognized.</returns>
 		public AuthorizedTokenResponse ProcessUserAuthorization(HttpRequestInfo request) {
-			Contract.Requires(request != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			UserAuthorizationResponse authorizationMessage;
 			if (this.Channel.TryReadFromRequest<UserAuthorizationResponse>(request, out authorizationMessage)) {
diff --git a/src/DotNetOpenAuth/OpenId/Association.cs b/src/DotNetOpenAuth/OpenId/Association.cs
index 82890c9..c65bdd6 100644
--- a/src/DotNetOpenAuth/OpenId/Association.cs
+++ b/src/DotNetOpenAuth/OpenId/Association.cs
@@ -35,11 +35,12 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="totalLifeLength">How long the association will be useful.</param>
 		/// <param name="issued">The UTC time of when this association was originally issued by the Provider.</param>
 		protected Association(string handle, byte[] secret, TimeSpan totalLifeLength, DateTime issued) {
-			Contract.RequiresAlways(!string.IsNullOrEmpty(handle));
-			Contract.RequiresAlways(secret != null);
-			Contract.RequiresAlways(totalLifeLength > TimeSpan.Zero);
-			Contract.RequiresAlways(issued.Kind == DateTimeKind.Utc);
-			Contract.RequiresAlways(issued <= DateTime.UtcNow);
+			Contract.Requires<ArgumentNullException>(!string.IsNullOrEmpty(handle));
+			Contract.Requires<ArgumentNullException>(secret != null);
+			Contract.Requires<ArgumentOutOfRangeException>(totalLifeLength > TimeSpan.Zero);
+			Contract.Requires<ArgumentException>(issued.Kind == DateTimeKind.Utc);
+			Contract.Requires<ArgumentOutOfRangeException>(issued <= DateTime.UtcNow);
+			Contract.Ensures(this.TotalLifeLength == totalLifeLength);
 
 			this.Handle = handle;
 			this.SecretKey = secret;
@@ -158,8 +159,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <see cref="IAssociationStore&lt;TKey&gt;.GetAssociation(TKey, SecuritySettings)"/> method.
 		/// </returns>
 		public static Association Deserialize(string handle, DateTime expires, byte[] privateData) {
-			Contract.RequiresAlways(!String.IsNullOrEmpty(handle));
-			Contract.RequiresAlways(privateData != null);
+			Contract.Requires<ArgumentNullException>(!String.IsNullOrEmpty(handle));
+			Contract.Requires<ArgumentNullException>(privateData != null);
 			Contract.Ensures(Contract.Result<Association>() != null);
 
 			expires = expires.ToUniversalTime();
@@ -270,7 +271,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="data">The data to sign.  This data will not be changed (the signature is the return value).</param>
 		/// <returns>The calculated signature of the data.</returns>
 		protected internal byte[] Sign(byte[] data) {
-			Contract.Requires(data != null);
+			Contract.Requires<ArgumentNullException>(data != null);
 			using (HashAlgorithm hasher = this.CreateHasher()) {
 				return hasher.ComputeHash(data);
 			}
@@ -286,11 +287,13 @@ namespace DotNetOpenAuth.OpenId {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
 			Contract.Invariant(!string.IsNullOrEmpty(this.Handle));
 			Contract.Invariant(this.TotalLifeLength > TimeSpan.Zero);
+			Contract.Invariant(this.SecretKey != null);
 		}
 #endif
 	}
diff --git a/src/DotNetOpenAuth/OpenId/AssociationContract.cs b/src/DotNetOpenAuth/OpenId/AssociationContract.cs
index 7a8398e..57f4fd9 100644
--- a/src/DotNetOpenAuth/OpenId/AssociationContract.cs
+++ b/src/DotNetOpenAuth/OpenId/AssociationContract.cs
@@ -46,7 +46,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// </returns>
 		[Pure]
 		internal override string GetAssociationType(Protocol protocol) {
-			Contract.Requires(protocol != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
 			throw new NotImplementedException();
 		}
 
diff --git a/src/DotNetOpenAuth/OpenId/Associations.cs b/src/DotNetOpenAuth/OpenId/Associations.cs
index 9f8c1d4..454e44b 100644
--- a/src/DotNetOpenAuth/OpenId/Associations.cs
+++ b/src/DotNetOpenAuth/OpenId/Associations.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId {
+	using System;
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics;
@@ -59,13 +60,14 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		/// <param name="association">The association to add to the collection.</param>
 		public void Set(Association association) {
-			Contract.Requires(association != null);
+			Contract.Requires<ArgumentNullException>(association != null);
 			Contract.Ensures(this.Get(association.Handle) == association);
-			ErrorUtilities.VerifyArgumentNotNull(association, "association");
 			lock (this.associations) {
 				this.associations.Remove(association.Handle); // just in case one already exists.
 				this.associations.Add(association);
 			}
+
+			Contract.Assume(this.Get(association.Handle) == association);
 		}
 
 		/// <summary>
@@ -114,6 +116,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		protected void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdChannel.cs b/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdChannel.cs
index 2719276..8379521 100644
--- a/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdChannel.cs
+++ b/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdChannel.cs
@@ -51,7 +51,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="securitySettings">The security settings to apply.</param>
 		internal OpenIdChannel(IAssociationStore<Uri> associationStore, INonceStore nonceStore, RelyingPartySecuritySettings securitySettings)
 			: this(associationStore, nonceStore, new OpenIdMessageFactory(), securitySettings, false) {
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 		}
 
 		/// <summary>
@@ -63,7 +63,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="securitySettings">The security settings.</param>
 		internal OpenIdChannel(IAssociationStore<AssociationRelyingPartyType> associationStore, INonceStore nonceStore, ProviderSecuritySettings securitySettings)
 			: this(associationStore, nonceStore, new OpenIdMessageFactory(), securitySettings) {
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 		}
 
 		/// <summary>
@@ -77,8 +77,9 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="nonVerifying">A value indicating whether the channel is set up with no functional security binding elements.</param>
 		private OpenIdChannel(IAssociationStore<Uri> associationStore, INonceStore nonceStore, IMessageFactory messageTypeProvider, RelyingPartySecuritySettings securitySettings, bool nonVerifying) :
 			this(messageTypeProvider, InitializeBindingElements(associationStore, nonceStore, securitySettings, nonVerifying)) {
-			Contract.Requires(messageTypeProvider != null);
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(messageTypeProvider != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
+			Contract.Requires<ArgumentException>(!nonVerifying || securitySettings is RelyingPartySecuritySettings);
 		}
 
 		/// <summary>
@@ -91,8 +92,8 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="securitySettings">The security settings.</param>
 		private OpenIdChannel(IAssociationStore<AssociationRelyingPartyType> associationStore, INonceStore nonceStore, IMessageFactory messageTypeProvider, ProviderSecuritySettings securitySettings) :
 			this(messageTypeProvider, InitializeBindingElements(associationStore, nonceStore, securitySettings, false)) {
-			Contract.Requires(messageTypeProvider != null);
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(messageTypeProvider != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 		}
 
 		/// <summary>
@@ -103,7 +104,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="bindingElements">The binding elements to use in sending and receiving messages.</param>
 		private OpenIdChannel(IMessageFactory messageTypeProvider, IChannelBindingElement[] bindingElements)
 			: base(messageTypeProvider, bindingElements) {
-			Contract.Requires(messageTypeProvider != null);
+			Contract.Requires<ArgumentNullException>(messageTypeProvider != null);
 
 			// Customize the binding element order, since we play some tricks for higher
 			// security and backward compatibility with older OpenID versions.
@@ -317,9 +318,8 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// </returns>
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Needed for code contracts.")]
 		private static IChannelBindingElement[] InitializeBindingElements<T>(IAssociationStore<T> associationStore, INonceStore nonceStore, SecuritySettings securitySettings, bool nonVerifying) {
-			Contract.Requires(securitySettings != null);
-			Contract.Requires(!nonVerifying || securitySettings is RelyingPartySecuritySettings);
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
+			Contract.Requires<ArgumentException>(!nonVerifying || securitySettings is RelyingPartySecuritySettings);
 
 			var rpSecuritySettings = securitySettings as RelyingPartySecuritySettings;
 			var opSecuritySettings = securitySettings as ProviderSecuritySettings;
diff --git a/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdMessageFactory.cs b/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdMessageFactory.cs
index 31a2da5..1e5ea4c 100644
--- a/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdMessageFactory.cs
+++ b/src/DotNetOpenAuth/OpenId/ChannelElements/OpenIdMessageFactory.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.ChannelElements {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -30,9 +31,6 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
 		/// </returns>
 		public IDirectedProtocolMessage GetNewRequestMessage(MessageReceivingEndpoint recipient, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(recipient, "recipient");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			RequestBase message = null;
 
 			// Discern the OpenID version of the message.
@@ -97,9 +95,6 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// deserialize to.  Null if the request isn't recognized as a valid protocol message.
 		/// </returns>
 		public IDirectResponseProtocolMessage GetNewResponseMessage(IDirectedProtocolMessage request, IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-
 			DirectResponseBase message = null;
 
 			// Discern the OpenID version of the message.
diff --git a/src/DotNetOpenAuth/OpenId/ChannelElements/ReturnToNonceBindingElement.cs b/src/DotNetOpenAuth/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
index 9c4c46d..514423c 100644
--- a/src/DotNetOpenAuth/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
+++ b/src/DotNetOpenAuth/OpenId/ChannelElements/ReturnToNonceBindingElement.cs
@@ -78,8 +78,8 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="nonceStore">The nonce store to use.</param>
 		/// <param name="securitySettings">The security settings of the RP.</param>
 		internal ReturnToNonceBindingElement(INonceStore nonceStore, RelyingPartySecuritySettings securitySettings) {
-			Contract.Requires(nonceStore != null);
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(nonceStore != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 			ErrorUtilities.VerifyArgumentNotNull(nonceStore, "nonceStore");
 			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
 
@@ -254,7 +254,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 			/// <param name="value">The base64-encoded value of the nonce.</param>
 			/// <returns>The instantiated and initialized nonce.</returns>
 			internal static CustomNonce Deserialize(string value) {
-				ErrorUtilities.VerifyNonZeroLength(value, "value");
+				Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(value));
 
 				byte[] nonce = Convert.FromBase64String(value);
 				Contract.Assume(nonce != null);
diff --git a/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs b/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
index 6544d49..2338572 100644
--- a/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
+++ b/src/DotNetOpenAuth/OpenId/ChannelElements/SigningBindingElement.cs
@@ -55,8 +55,8 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="associationStore">The association store used to look up the secrets needed for signing.</param>
 		/// <param name="securitySettings">The security settings.</param>
 		internal SigningBindingElement(IAssociationStore<AssociationRelyingPartyType> associationStore, ProviderSecuritySettings securitySettings) {
-			ErrorUtilities.VerifyArgumentNotNull(associationStore, "associationStore");
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			Contract.Requires<ArgumentNullException>(associationStore != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 
 			this.opAssociations = associationStore;
 			this.opSecuritySettings = securitySettings;
@@ -190,7 +190,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// 	<c>true</c> if the relying party is vulnerable; otherwise, <c>false</c>.
 		/// </returns>
 		private static bool IsRelyingPartyVulnerableToReplays(SignedResponseRequest request, IndirectSignedResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			// OpenID 2.0 includes replay protection as part of the protocol.
 			if (response.Version.Major >= 2) {
@@ -250,9 +250,9 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="association">The association to use to sign the message.</param>
 		/// <returns>The calculated signature of the method.</returns>
 		private string GetSignature(ITamperResistantOpenIdMessage signedMessage, Association association) {
-			ErrorUtilities.VerifyArgumentNotNull(signedMessage, "signedMessage");
-			ErrorUtilities.VerifyNonZeroLength(signedMessage.SignedParameterOrder, "signedMessage.SignedParameterOrder");
-			ErrorUtilities.VerifyArgumentNotNull(association, "association");
+			Contract.Requires<ArgumentNullException>(signedMessage != null);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(signedMessage.SignedParameterOrder));
+			Contract.Requires<ArgumentNullException>(association != null);
 
 			// Prepare the parts to sign, taking care to replace an openid.mode value
 			// of check_authentication with its original id_res so the signature matches.
@@ -286,7 +286,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// </returns>
 		private string GetSignedParameterOrder(ITamperResistantOpenIdMessage signedMessage) {
 			Contract.Requires(this.Channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(signedMessage, "signedMessage");
+			Contract.Requires<ArgumentNullException>(signedMessage != null);
 			ErrorUtilities.VerifyOperation(this.Channel != null, "Channel property has not been set.");
 
 			Protocol protocol = Protocol.Lookup(signedMessage.Version);
@@ -323,7 +323,7 @@ namespace DotNetOpenAuth.OpenId.ChannelElements {
 		/// <param name="signedMessage">The message to sign or verify.</param>
 		/// <returns>The association to use to sign or verify the message.</returns>
 		private Association GetAssociation(ITamperResistantOpenIdMessage signedMessage) {
-			Contract.Requires(signedMessage != null);
+			Contract.Requires<ArgumentNullException>(signedMessage != null);
 
 			if (this.IsOnProvider) {
 				// We're on a Provider to either sign (smart/dumb) or verify a dumb signature.
diff --git a/src/DotNetOpenAuth/OpenId/DiffieHellmanUtilities.cs b/src/DotNetOpenAuth/OpenId/DiffieHellmanUtilities.cs
index a93c824..ef59fed 100644
--- a/src/DotNetOpenAuth/OpenId/DiffieHellmanUtilities.cs
+++ b/src/DotNetOpenAuth/OpenId/DiffieHellmanUtilities.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Security.Cryptography;
@@ -36,8 +37,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The hashing algorithm to use.</returns>
 		/// <exception cref="ProtocolException">Thrown if no match could be found for the given <paramref name="sessionType"/>.</exception>
 		public static HashAlgorithm Lookup(Protocol protocol, string sessionType) {
-			ErrorUtilities.VerifyArgumentNotNull(protocol, "protocol");
-			ErrorUtilities.VerifyArgumentNotNull(sessionType, "sessionType");
+			Contract.Requires<ArgumentNullException>(protocol != null);
+			Contract.Requires<ArgumentNullException>(sessionType != null);
 
 			// We COULD use just First instead of FirstOrDefault, but we want to throw ProtocolException instead of InvalidOperationException.
 			DHSha match = diffieHellmanSessionTypes.FirstOrDefault(dhsha => String.Equals(dhsha.GetName(protocol), sessionType, StringComparison.Ordinal));
@@ -52,7 +53,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="hashSizeInBits">The hash size (in bits) that the DH session must have.</param>
 		/// <returns>The value to be used for the openid.session_type parameter, or null if no match was found.</returns>
 		internal static string GetNameForSize(Protocol protocol, int hashSizeInBits) {
-			ErrorUtilities.VerifyArgumentNotNull(protocol, "protocol");
+			Contract.Requires<ArgumentNullException>(protocol != null);
 			DHSha match = diffieHellmanSessionTypes.FirstOrDefault(dhsha => dhsha.Algorithm.HashSize == hashSizeInBits);
 			return match != null ? match.GetName(protocol) : null;
 		}
@@ -72,10 +73,10 @@ namespace DotNetOpenAuth.OpenId {
 		/// The secret itself if the encrypted version of the secret was given in <paramref name="remotePublicKey"/>.
 		/// </returns>
 		internal static byte[] SHAHashXorSecret(HashAlgorithm hasher, DiffieHellman dh, byte[] remotePublicKey, byte[] plainOrEncryptedSecret) {
-			ErrorUtilities.VerifyArgumentNotNull(hasher, "hasher");
-			ErrorUtilities.VerifyArgumentNotNull(dh, "dh");
-			ErrorUtilities.VerifyArgumentNotNull(remotePublicKey, "remotePublicKey");
-			ErrorUtilities.VerifyArgumentNotNull(plainOrEncryptedSecret, "plainOrEncryptedSecret");
+			Contract.Requires<ArgumentNullException>(hasher != null);
+			Contract.Requires<ArgumentNullException>(dh != null);
+			Contract.Requires<ArgumentNullException>(remotePublicKey != null);
+			Contract.Requires<ArgumentNullException>(plainOrEncryptedSecret != null);
 
 			byte[] sharedBlock = dh.DecryptKeyExchange(remotePublicKey);
 			byte[] sharedBlockHash = hasher.ComputeHash(EnsurePositive(sharedBlock));
@@ -101,7 +102,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// This is to be consistent with OpenID spec section 4.2.
 		/// </remarks>
 		internal static byte[] EnsurePositive(byte[] inputBytes) {
-			ErrorUtilities.VerifyArgumentNotNull(inputBytes, "inputBytes");
+			Contract.Requires<ArgumentNullException>(inputBytes != null);
 			if (inputBytes.Length == 0) {
 				throw new ArgumentException(MessagingStrings.UnexpectedEmptyArray, "inputBytes");
 			}
@@ -127,8 +128,8 @@ namespace DotNetOpenAuth.OpenId {
 			/// <param name="algorithm">The hashing algorithm used in this particular Diffie-Hellman session type.</param>
 			/// <param name="getName">A function that will return the value of the openid.session_type parameter for a given version of OpenID.</param>
 			public DHSha(HashAlgorithm algorithm, Func<Protocol, string> getName) {
-				ErrorUtilities.VerifyArgumentNotNull(algorithm, "algorithm");
-				ErrorUtilities.VerifyArgumentNotNull(getName, "getName");
+				Contract.Requires<ArgumentNullException>(algorithm != null);
+				Contract.Requires<ArgumentNullException>(getName != null);
 
 				this.GetName = getName;
 				this.Algorithm = algorithm;
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/AliasManager.cs b/src/DotNetOpenAuth/OpenId/Extensions/AliasManager.cs
index e16f9a4..13f9907 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/AliasManager.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/AliasManager.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -44,7 +45,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="typeUri">The type URI.</param>
 		/// <returns>The alias assigned to this type URI.  Never null.</returns>
 		public string GetAlias(string typeUri) {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 			string alias;
 			return this.typeUriToAliasMap.TryGetValue(typeUri, out alias) ? alias : this.AssignNewAlias(typeUri);
 		}
@@ -55,8 +56,8 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="alias">The alias.</param>
 		/// <param name="typeUri">The type URI.</param>
 		public void SetAlias(string alias, string typeUri) {
-			ErrorUtilities.VerifyNonZeroLength(alias, "alias");
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(alias));
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 			this.aliasToTypeUriMap.Add(alias, typeUri);
 			this.typeUriToAliasMap.Add(typeUri, alias);
 		}
@@ -100,7 +101,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// </summary>
 		/// <param name="preferredTypeUriToAliases">A dictionary of type URI keys and alias values.</param>
 		public void SetPreferredAliasesWhereNotSet(IDictionary<string, string> preferredTypeUriToAliases) {
-			ErrorUtilities.VerifyArgumentNotNull(preferredTypeUriToAliases, "preferredTypeUriToAliases");
+			Contract.Requires<ArgumentNullException>(preferredTypeUriToAliases != null);
 
 			foreach (var pair in preferredTypeUriToAliases) {
 				if (this.typeUriToAliasMap.ContainsKey(pair.Key)) {
@@ -138,7 +139,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="alias">The alias.</param>
 		/// <returns>The Type URI for the given alias, or null if none for that alias exist.</returns>
 		public string TryResolveAlias(string alias) {
-			ErrorUtilities.VerifyNonZeroLength(alias, "alias");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(alias));
 			string typeUri = null;
 			this.aliasToTypeUriMap.TryGetValue(alias, out typeUri);
 			return typeUri;
@@ -150,7 +151,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="alias">The alias in question.</param>
 		/// <returns>True if the alias has already been assigned.  False otherwise.</returns>
 		public bool IsAliasUsed(string alias) {
-			ErrorUtilities.VerifyNonZeroLength(alias, "alias");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(alias));
 			return this.aliasToTypeUriMap.ContainsKey(alias);
 		}
 
@@ -162,7 +163,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// 	<c>true</c> if the given type URI already has an alias assigned; <c>false</c> otherwise.
 		/// </returns>
 		public bool IsAliasAssignedTo(string typeUri) {
-			ErrorUtilities.VerifyArgumentNotNull(typeUri, "typeUri");
+			Contract.Requires<ArgumentNullException>(typeUri != null);
 			return this.typeUriToAliasMap.ContainsKey(typeUri);
 		}
 
@@ -172,7 +173,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <param name="typeUri">The type URI to assign a new alias to.</param>
 		/// <returns>The newly generated alias.</returns>
 		private string AssignNewAlias(string typeUri) {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 			ErrorUtilities.VerifyInternal(!this.typeUriToAliasMap.ContainsKey(typeUri), "Oops!  This type URI already has an alias!");
 			string alias = string.Format(CultureInfo.InvariantCulture, this.aliasFormat, this.typeUriToAliasMap.Count + 1);
 			this.typeUriToAliasMap.Add(typeUri, alias);
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AXUtilities.cs b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AXUtilities.cs
index 9729333..9845833 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AXUtilities.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AXUtilities.cs
@@ -21,7 +21,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="collection">The attribute request collection.</param>
 		/// <param name="typeUri">The type URI of the required attribute.</param>
 		public static void AddRequired(this ICollection<AttributeRequest> collection, string typeUri) {
-			ErrorUtilities.VerifyArgumentNotNull(collection, "collection");
+			Contract.Requires<ArgumentNullException>(collection != null);
 			collection.Add(new AttributeRequest(typeUri, true));
 		}
 
@@ -31,7 +31,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="collection">The attribute request collection.</param>
 		/// <param name="typeUri">The type URI of the requested attribute.</param>
 		public static void AddOptional(this ICollection<AttributeRequest> collection, string typeUri) {
-			ErrorUtilities.VerifyArgumentNotNull(collection, "collection");
+			Contract.Requires<ArgumentNullException>(collection != null);
 			collection.Add(new AttributeRequest(typeUri, false));
 		}
 
@@ -43,8 +43,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="typeUri">The type URI of the attribute.</param>
 		/// <param name="values">The attribute values.</param>
 		public static void Add(this ICollection<AttributeValues> collection, string typeUri, params string[] values) {
-			Contract.Requires(collection != null);
-			ErrorUtilities.VerifyArgumentNotNull(collection, "collection");
+			Contract.Requires<ArgumentNullException>(collection != null);
 			collection.Add(new AttributeValues(typeUri, values));
 		}
 
@@ -54,8 +53,8 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="fields">The dictionary to fill with serialized attributes.</param>
 		/// <param name="attributes">The attributes.</param>
 		internal static void SerializeAttributes(IDictionary<string, string> fields, IEnumerable<AttributeValues> attributes) {
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
-			ErrorUtilities.VerifyArgumentNotNull(attributes, "attributes");
+			Contract.Requires<ArgumentNullException>(fields != null);
+			Contract.Requires<ArgumentNullException>(attributes != null);
 
 			AliasManager aliasManager = new AliasManager();
 			foreach (var att in attributes) {
@@ -124,7 +123,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="fields">The data included in the extension message.</param>
 		/// <returns>The alias manager that provides lookup between aliases and type URIs.</returns>
 		private static AliasManager ParseAliases(IDictionary<string, string> fields) {
-			ErrorUtilities.VerifyArgumentNotNull(fields, "fields");
+			Contract.Requires<ArgumentNullException>(fields != null);
 
 			AliasManager aliasManager = new AliasManager();
 			const string TypePrefix = "type.";
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeRequest.cs b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
index e508233..b5188af 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeRequest.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 
 	/// <summary>
@@ -34,7 +35,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// </summary>
 		/// <param name="typeUri">The unique TypeURI for that describes the attribute being sought.</param>
 		public AttributeRequest(string typeUri) {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 			this.TypeUri = typeUri;
 		}
 
@@ -82,7 +83,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value > 0, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value > 0);
 				this.count = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeValues.cs b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeValues.cs
index e87e188..6466cda 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeValues.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/AttributeExchange/AttributeValues.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 
 	/// <summary>
@@ -22,7 +23,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// <param name="typeUri">The TypeURI that uniquely identifies the attribute.</param>
 		/// <param name="values">The values for the attribute.</param>
 		public AttributeValues(string typeUri, params string[] values) {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 
 			this.TypeUri = typeUri;
 			this.Values = (IList<string>)values ?? EmptyList<string>.Instance;
@@ -44,7 +45,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.AttributeExchange {
 		/// </summary>
 		/// <param name="typeUri">The TypeURI of the attribute whose values are being provided.</param>
 		internal AttributeValues(string typeUri) {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 
 			this.TypeUri = typeUri;
 			this.Values = new List<string>(1);
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/ExtensionArgumentsManager.cs b/src/DotNetOpenAuth/OpenId/Extensions/ExtensionArgumentsManager.cs
index 5c4e978..27099e0 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/ExtensionArgumentsManager.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/ExtensionArgumentsManager.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Extensions {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -51,12 +52,19 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		private ExtensionArgumentsManager() { }
 
 		/// <summary>
+		/// Gets a value indicating whether the extensions are being read (as opposed to written).
+		/// </summary>
+		internal bool ReadMode {
+			get { return this.isReadMode; }
+		}
+
+		/// <summary>
 		/// Creates a <see cref="ExtensionArgumentsManager"/> instance to process incoming extensions.
 		/// </summary>
 		/// <param name="query">The parameters in the OpenID message.</param>
 		/// <returns>The newly created instance of <see cref="ExtensionArgumentsManager"/>.</returns>
 		public static ExtensionArgumentsManager CreateIncomingExtensions(IDictionary<string, string> query) {
-			ErrorUtilities.VerifyArgumentNotNull(query, "query");
+			Contract.Requires<ArgumentNullException>(query != null);
 			var mgr = new ExtensionArgumentsManager();
 			mgr.protocol = Protocol.Detect(query);
 			mgr.isReadMode = true;
@@ -118,6 +126,31 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		}
 
 		/// <summary>
+		/// Adds query parameters for OpenID extensions to the request directed
+		/// at the OpenID provider.
+		/// </summary>
+		/// <param name="extensionTypeUri">The extension type URI.</param>
+		/// <param name="arguments">The arguments for this extension to add to the message.</param>
+		public void AddExtensionArguments(string extensionTypeUri, IDictionary<string, string> arguments) {
+			Contract.Requires<InvalidOperationException>(!this.ReadMode);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(extensionTypeUri));
+			Contract.Requires<ArgumentNullException>(arguments != null);
+			if (arguments.Count == 0) {
+				return;
+			}
+
+			IDictionary<string, string> extensionArgs;
+			if (!this.extensions.TryGetValue(extensionTypeUri, out extensionArgs)) {
+				this.extensions.Add(extensionTypeUri, extensionArgs = new Dictionary<string, string>(arguments.Count));
+			}
+
+			ErrorUtilities.VerifyProtocol(extensionArgs.Count == 0, OpenIdStrings.ExtensionAlreadyAddedWithSameTypeURI, extensionTypeUri);
+			foreach (var pair in arguments) {
+				extensionArgs.Add(pair.Key, pair.Value);
+			}
+		}
+
+		/// <summary>
 		/// Gets the actual arguments to add to a querystring or other response,
 		/// where type URI, alias, and actual key/values are all defined.
 		/// </summary>
@@ -126,10 +159,8 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// This should be <c>true</c> for all but direct response messages.
 		/// </param>
 		/// <returns>A dictionary of key=value pairs to add to the message to carry the extension.</returns>
-		public IDictionary<string, string> GetArgumentsToSend(bool includeOpenIdPrefix) {
-			if (this.isReadMode) {
-				throw new InvalidOperationException();
-			}
+		internal IDictionary<string, string> GetArgumentsToSend(bool includeOpenIdPrefix) {
+			Contract.Requires<InvalidOperationException>(!this.ReadMode);
 			Dictionary<string, string> args = new Dictionary<string, string>();
 			foreach (var typeUriAndExtension in this.extensions) {
 				string typeUri = typeUriAndExtension.Key;
@@ -155,44 +186,15 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		}
 
 		/// <summary>
-		/// Adds query parameters for OpenID extensions to the request directed
-		/// at the OpenID provider.
-		/// </summary>
-		/// <param name="extensionTypeUri">The extension type URI.</param>
-		/// <param name="arguments">The arguments for this extension to add to the message.</param>
-		public void AddExtensionArguments(string extensionTypeUri, IDictionary<string, string> arguments) {
-			if (this.isReadMode) {
-				throw new InvalidOperationException();
-			}
-			ErrorUtilities.VerifyNonZeroLength(extensionTypeUri, "extensionTypeUri");
-			ErrorUtilities.VerifyArgumentNotNull(arguments, "arguments");
-			if (arguments.Count == 0) {
-				return;
-			}
-
-			IDictionary<string, string> extensionArgs;
-			if (!this.extensions.TryGetValue(extensionTypeUri, out extensionArgs)) {
-				this.extensions.Add(extensionTypeUri, extensionArgs = new Dictionary<string, string>(arguments.Count));
-			}
-
-			ErrorUtilities.VerifyProtocol(extensionArgs.Count == 0, OpenIdStrings.ExtensionAlreadyAddedWithSameTypeURI, extensionTypeUri);
-			foreach (var pair in arguments) {
-				extensionArgs.Add(pair.Key, pair.Value);
-			}
-		}
-
-		/// <summary>
 		/// Gets the fields carried by a given OpenId extension.
 		/// </summary>
 		/// <param name="extensionTypeUri">The type URI of the extension whose fields are being queried for.</param>
 		/// <returns>
 		/// The fields included in the given extension, or null if the extension is not present.
 		/// </returns>
-		public IDictionary<string, string> GetExtensionArguments(string extensionTypeUri) {
-			ErrorUtilities.VerifyNonZeroLength(extensionTypeUri, "extensionTypeUri");
-			if (!this.isReadMode) {
-				throw new InvalidOperationException();
-			}
+		internal IDictionary<string, string> GetExtensionArguments(string extensionTypeUri) {
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(extensionTypeUri));
+			Contract.Requires<InvalidOperationException>(this.ReadMode);
 
 			IDictionary<string, string> extensionArgs;
 			this.extensions.TryGetValue(extensionTypeUri, out extensionArgs);
@@ -204,7 +206,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// </summary>
 		/// <param name="extensionTypeUri">The extension Type URI in question.</param>
 		/// <returns><c>true</c> if this extension is present; <c>false</c> otherwise.</returns>
-		public bool ContainsExtension(string extensionTypeUri) {
+		internal bool ContainsExtension(string extensionTypeUri) {
 			return this.extensions.ContainsKey(extensionTypeUri);
 		}
 
@@ -212,7 +214,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// Gets the type URIs of all discovered extensions in the message.
 		/// </summary>
 		/// <returns>A sequence of the type URIs.</returns>
-		public IEnumerable<string> GetExtensionTypeUris() {
+		internal IEnumerable<string> GetExtensionTypeUris() {
 			return this.extensions.Keys;
 		}
 	}
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs b/src/DotNetOpenAuth/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
index 0f365ac..eeaea31 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/ProviderAuthenticationPolicy/PapeUtilities.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Extensions.ProviderAuthenticationPolicy {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Linq;
 	using System.Text;
@@ -45,7 +46,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.ProviderAuthenticationPolicy {
 		/// <returns>The concatenated string of elements.</returns>
 		/// <exception cref="FormatException">Thrown if any element in the sequence includes a space.</exception>
 		internal static string ConcatenateListOfElements(IEnumerable<string> values) {
-			ErrorUtilities.VerifyArgumentNotNull(values, "values");
+			Contract.Requires<ArgumentNullException>(values != null);
 
 			StringBuilder valuesList = new StringBuilder();
 			foreach (string value in values.Distinct()) {
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs b/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
index 800a2ff..a9adb4f 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsRequest.cs
@@ -9,6 +9,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -58,7 +59,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 		/// <param name="typeUri">The type URI this extension was recognized by in the OpenID message.</param>
 		internal ClaimsRequest(string typeUri)
 			: this() {
-			ErrorUtilities.VerifyNonZeroLength(typeUri, "typeUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUri));
 
 			this.typeUriDeserializedFrom = typeUri;
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs b/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
index a58c754..932c44a 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/SimpleRegistration/ClaimsResponse.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.Net.Mail;
 	using System.Text;
@@ -69,7 +70,7 @@ namespace DotNetOpenAuth.OpenId.Extensions.SimpleRegistration {
 		/// </param>
 		internal ClaimsResponse(string typeUriToUse)
 			: base(new Version(1, 0), typeUriToUse, EmptyList<string>.Instance) {
-			ErrorUtilities.VerifyNonZeroLength(typeUriToUse, "typeUriToUse");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(typeUriToUse));
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/UI/UIUtilities.cs b/src/DotNetOpenAuth/OpenId/Extensions/UI/UIUtilities.cs
index 088404b..da6e089 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/UI/UIUtilities.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/UI/UIUtilities.cs
@@ -34,8 +34,8 @@ namespace DotNetOpenAuth.OpenId.Extensions.UI {
 		/// <param name="windowName">The name to assign to the popup window.</param>
 		/// <returns>A string starting with 'window.open' and forming just that one method call.</returns>
 		internal static string GetWindowPopupScript(OpenIdRelyingParty relyingParty, IAuthenticationRequest request, string windowName) {
-			Contract.Requires(relyingParty != null);
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 			Contract.Requires(!string.IsNullOrEmpty(windowName));
 
 			Uri popupUrl = request.RedirectingResponse.GetDirectUriRequest(relyingParty.Channel);
diff --git a/src/DotNetOpenAuth/OpenId/HmacShaAssociation.cs b/src/DotNetOpenAuth/OpenId/HmacShaAssociation.cs
index b2c88b7..c1b8b27 100644
--- a/src/DotNetOpenAuth/OpenId/HmacShaAssociation.cs
+++ b/src/DotNetOpenAuth/OpenId/HmacShaAssociation.cs
@@ -68,9 +68,11 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="totalLifeLength">The time duration the association will be good for.</param>
 		private HmacShaAssociation(HmacSha typeIdentity, string handle, byte[] secret, TimeSpan totalLifeLength)
 			: base(handle, secret, totalLifeLength, DateTime.UtcNow) {
-			Contract.Requires(typeIdentity != null);
+			Contract.Requires<ArgumentNullException>(typeIdentity != null);
 			Contract.Requires(!String.IsNullOrEmpty(handle));
-			Contract.Requires(secret != null);
+			Contract.Requires<ArgumentNullException>(secret != null);
+			Contract.Requires<ArgumentOutOfRangeException>(totalLifeLength > TimeSpan.Zero);
+			Contract.Ensures(this.TotalLifeLength == totalLifeLength);
 			ErrorUtilities.VerifyProtocol(secret.Length == typeIdentity.SecretLength, OpenIdStrings.AssociationSecretAndTypeLengthMismatch, secret.Length, typeIdentity.GetAssociationType(Protocol.Default));
 
 			this.typeIdentity = typeIdentity;
@@ -96,9 +98,9 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="totalLifeLength">How long the association will be good for.</param>
 		/// <returns>The newly created association.</returns>
 		public static HmacShaAssociation Create(Protocol protocol, string associationType, string handle, byte[] secret, TimeSpan totalLifeLength) {
-			Contract.Requires(protocol != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
 			Contract.Requires(!String.IsNullOrEmpty(associationType));
-			Contract.Requires(secret != null);
+			Contract.Requires<ArgumentNullException>(secret != null);
 			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 
 			HmacSha match = hmacShaAssociationTypes.FirstOrDefault(sha => String.Equals(sha.GetAssociationType(protocol), associationType, StringComparison.Ordinal));
@@ -115,7 +117,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The newly created association.</returns>
 		public static HmacShaAssociation Create(string handle, byte[] secret, TimeSpan totalLifeLength) {
 			Contract.Requires(!String.IsNullOrEmpty(handle));
-			Contract.Requires(secret != null);
+			Contract.Requires<ArgumentNullException>(secret != null);
 			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 
 			HmacSha shaType = hmacShaAssociationTypes.FirstOrDefault(sha => sha.SecretLength == secret.Length);
@@ -149,9 +151,9 @@ namespace DotNetOpenAuth.OpenId {
 		/// The new association is NOT automatically put into an association store.  This must be done by the caller.
 		/// </remarks>
 		internal static HmacShaAssociation Create(Protocol protocol, string associationType, AssociationRelyingPartyType associationUse, ProviderSecuritySettings securitySettings) {
-			Contract.Requires(protocol != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
 			Contract.Requires(!String.IsNullOrEmpty(associationType));
-			Contract.Requires(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 			Contract.Ensures(Contract.Result<HmacShaAssociation>() != null);
 
 			int secretLength = GetSecretLength(protocol, associationType);
@@ -199,8 +201,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// True if a qualifying association could be found; false otherwise.
 		/// </returns>
 		internal static bool TryFindBestAssociation(Protocol protocol, bool highSecurityIsBetter, SecuritySettings securityRequirements, bool requireMatchingDHSessionType, out string associationType, out string sessionType) {
-			Contract.Requires(protocol != null);
-			Contract.Requires(securityRequirements != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
+			Contract.Requires<ArgumentNullException>(securityRequirements != null);
 
 			associationType = null;
 			sessionType = null;
@@ -240,9 +242,9 @@ namespace DotNetOpenAuth.OpenId {
 		/// 	<c>true</c> if the named association and session types are compatible; otherwise, <c>false</c>.
 		/// </returns>
 		internal static bool IsDHSessionCompatible(Protocol protocol, string associationType, string sessionType) {
-			Contract.Requires(protocol != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
 			Contract.Requires(!String.IsNullOrEmpty(associationType));
-			Contract.Requires(sessionType != null);
+			Contract.Requires<ArgumentNullException>(sessionType != null);
 
 			// All association types can work when no DH session is used at all.
 			if (string.Equals(sessionType, protocol.Args.SessionType.NoEncryption, StringComparison.Ordinal)) {
diff --git a/src/DotNetOpenAuth/OpenId/IAssociationStore.cs b/src/DotNetOpenAuth/OpenId/IAssociationStore.cs
index 927fb25..71d8652 100644
--- a/src/DotNetOpenAuth/OpenId/IAssociationStore.cs
+++ b/src/DotNetOpenAuth/OpenId/IAssociationStore.cs
@@ -116,8 +116,8 @@ namespace DotNetOpenAuth.OpenId {
 	////    /// TODO: what should implementations do on association handle conflict?
 	////    /// </remarks>
 	////    void IAssociationStore<TKey>.StoreAssociation(TKey distinguishingFactor, Association association) {
-	////        Contract.Requires(distinguishingFactor != null);
-	////        Contract.Requires(association != null);
+	////        Contract.Requires<ArgumentNullException>(distinguishingFactor != null);
+	////        Contract.Requires<ArgumentNullException>(association != null);
 	////        throw new NotImplementedException();
 	////    }
 
@@ -139,8 +139,8 @@ namespace DotNetOpenAuth.OpenId {
 	////    /// ignored and a new association created.
 	////    /// </remarks>
 	////    Association IAssociationStore<TKey>.GetAssociation(TKey distinguishingFactor, SecuritySettings securityRequirements) {
-	////        Contract.Requires(distinguishingFactor != null);
-	////        Contract.Requires(securityRequirements != null);
+	////        Contract.Requires<ArgumentNullException>(distinguishingFactor != null);
+	////        Contract.Requires<ArgumentNullException>(securityRequirements != null);
 	////        throw new NotImplementedException();
 	////    }
 
@@ -153,7 +153,7 @@ namespace DotNetOpenAuth.OpenId {
 	////    /// The requested association, or null if no unexpired <see cref="Association"/>s exist for the given key and handle.
 	////    /// </returns>
 	////    Association IAssociationStore<TKey>.GetAssociation(TKey distinguishingFactor, string handle) {
-	////        Contract.Requires(distinguishingFactor != null);
+	////        Contract.Requires<ArgumentNullException>(distinguishingFactor != null);
 	////        Contract.Requires(!String.IsNullOrEmpty(handle));
 	////        throw new NotImplementedException();
 	////    }
@@ -171,7 +171,7 @@ namespace DotNetOpenAuth.OpenId {
 	////    /// before this call.
 	////    /// </remarks>
 	////    bool IAssociationStore<TKey>.RemoveAssociation(TKey distinguishingFactor, string handle) {
-	////        Contract.Requires(distinguishingFactor != null);
+	////        Contract.Requires<ArgumentNullException>(distinguishingFactor != null);
 	////        Contract.Requires(!String.IsNullOrEmpty(handle));
 	////        throw new NotImplementedException();
 	////    }
diff --git a/src/DotNetOpenAuth/OpenId/Identifier.cs b/src/DotNetOpenAuth/OpenId/Identifier.cs
index 20a0143..ee08f9f 100644
--- a/src/DotNetOpenAuth/OpenId/Identifier.cs
+++ b/src/DotNetOpenAuth/OpenId/Identifier.cs
@@ -96,8 +96,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>An <see cref="Identifier"/> instance for the given value.</returns>
 		[SuppressMessage("Microsoft.Usage", "CA2234:PassSystemUriObjectsInsteadOfStrings", Justification = "Some of these identifiers are not properly formatted to be Uris at this stage.")]
 		public static Identifier Parse(string identifier) {
-			Contract.Requires((identifier != null && identifier.Length > 0) || !string.IsNullOrEmpty(identifier));
-			ErrorUtilities.VerifyArgumentNotNull(identifier, "identifier");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(identifier));
 			if (XriIdentifier.IsValidXri(identifier)) {
 				return new XriIdentifier(identifier);
 			} else {
diff --git a/src/DotNetOpenAuth/OpenId/IdentifierContract.cs b/src/DotNetOpenAuth/OpenId/IdentifierContract.cs
index 1758f06..79518a6 100644
--- a/src/DotNetOpenAuth/OpenId/IdentifierContract.cs
+++ b/src/DotNetOpenAuth/OpenId/IdentifierContract.cs
@@ -31,7 +31,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// An initialized structure containing the discovered provider endpoint information.
 		/// </returns>
 		internal override IEnumerable<ServiceEndpoint> Discover(IDirectWebRequestHandler requestHandler) {
-			Contract.Requires(requestHandler != null);
+			Contract.Requires<ArgumentNullException>(requestHandler != null);
 			Contract.Ensures(Contract.Result<IEnumerable<ServiceEndpoint>>() != null);
 			throw new NotImplementedException();
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Interop/AuthenticationResponseShim.cs b/src/DotNetOpenAuth/OpenId/Interop/AuthenticationResponseShim.cs
index a5926d9..6319c02 100644
--- a/src/DotNetOpenAuth/OpenId/Interop/AuthenticationResponseShim.cs
+++ b/src/DotNetOpenAuth/OpenId/Interop/AuthenticationResponseShim.cs
@@ -30,8 +30,7 @@ namespace DotNetOpenAuth.OpenId.Interop {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		internal AuthenticationResponseShim(IAuthenticationResponse response) {
-			Contract.Requires(response != null);
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.response = response;
 			var claimsResponse = this.response.GetExtension<ClaimsResponse>();
diff --git a/src/DotNetOpenAuth/OpenId/Interop/ClaimsResponseShim.cs b/src/DotNetOpenAuth/OpenId/Interop/ClaimsResponseShim.cs
index ef5e79d..689777b 100644
--- a/src/DotNetOpenAuth/OpenId/Interop/ClaimsResponseShim.cs
+++ b/src/DotNetOpenAuth/OpenId/Interop/ClaimsResponseShim.cs
@@ -31,8 +31,7 @@ namespace DotNetOpenAuth.OpenId.Interop {
 		/// <param name="response">The Simple Registration response to wrap.</param>
 		internal ClaimsResponseShim(ClaimsResponse response)
 		{
-			Contract.Requires(response != null);
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.response = response;
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Messages/AssociateDiffieHellmanResponse.cs b/src/DotNetOpenAuth/OpenId/Messages/AssociateDiffieHellmanResponse.cs
index 99e413d..ccfb1b8 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/AssociateDiffieHellmanResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/AssociateDiffieHellmanResponse.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.Security.Cryptography;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.Messaging.Reflection;
@@ -51,7 +52,6 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// The resulting association is <i>not</i> added to the association store and must be done by the caller.
 		/// </remarks>
 		protected override Association CreateAssociationAtRelyingParty(AssociateRequest request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 			var diffieHellmanRequest = request as AssociateDiffieHellmanRequest;
 			ErrorUtilities.VerifyArgument(diffieHellmanRequest != null, "request");
 
@@ -73,10 +73,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// but the resulting association is <i>not</i> added to the association store and must be done by the caller.
 		/// </remarks>
 		protected override Association CreateAssociationAtProvider(AssociateRequest request, ProviderSecuritySettings securitySettings) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 			var diffieHellmanRequest = request as AssociateDiffieHellmanRequest;
-			ErrorUtilities.VerifyArgument(diffieHellmanRequest != null, "request");
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			ErrorUtilities.VerifyInternal(diffieHellmanRequest != null, "Expected a DH request type.");
 
 			this.SessionType = this.SessionType ?? request.SessionType;
 
diff --git a/src/DotNetOpenAuth/OpenId/Messages/AssociateRequest.cs b/src/DotNetOpenAuth/OpenId/Messages/AssociateRequest.cs
index 6a5c0a8..5215022 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/AssociateRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/AssociateRequest.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -76,8 +77,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// and the provider OpenID version.
 		/// </returns>
 		internal static AssociateRequest Create(SecuritySettings securityRequirements, ProviderEndpointDescription provider) {
-			ErrorUtilities.VerifyArgumentNotNull(securityRequirements, "securityRequirements");
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
+			Contract.Requires<ArgumentNullException>(securityRequirements != null);
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			// Apply our knowledge of the endpoint's transport, OpenID version, and
 			// security requirements to decide the best association.
@@ -106,10 +107,10 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// and the provider OpenID version.
 		/// </returns>
 		internal static AssociateRequest Create(SecuritySettings securityRequirements, ProviderEndpointDescription provider, string associationType, string sessionType) {
-			ErrorUtilities.VerifyArgumentNotNull(securityRequirements, "securityRequirements");
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
-			ErrorUtilities.VerifyNonZeroLength(associationType, "associationType");
-			ErrorUtilities.VerifyArgumentNotNull(sessionType, "sessionType");
+			Contract.Requires<ArgumentNullException>(securityRequirements != null);
+			Contract.Requires<ArgumentNullException>(provider != null);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(associationType));
+			Contract.Requires<ArgumentNullException>(sessionType != null);
 
 			bool unencryptedAllowed = provider.Endpoint.IsTransportSecure();
 			if (unencryptedAllowed) {
@@ -140,8 +141,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// Failed association response messages will derive from <see cref="AssociateUnsuccessfulResponse"/>.</para>
 		/// </remarks>
 		internal IProtocolMessage CreateResponse(IAssociationStore<AssociationRelyingPartyType> associationStore, ProviderSecuritySettings securitySettings) {
-			ErrorUtilities.VerifyArgumentNotNull(associationStore, "associationStore");
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			Contract.Requires<ArgumentNullException>(associationStore != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 
 			IProtocolMessage response;
 			if (securitySettings.IsAssociationInPermittedRange(Protocol, this.AssociationType) &&
@@ -184,7 +185,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// <param name="securitySettings">The security settings that apply to this Provider.</param>
 		/// <returns>The response to send to the Relying Party.</returns>
 		private AssociateUnsuccessfulResponse CreateUnsuccessfulResponse(ProviderSecuritySettings securitySettings) {
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 
 			var unsuccessfulResponse = new AssociateUnsuccessfulResponse(this.Version, this);
 
diff --git a/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponse.cs b/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponse.cs
index d2ca70a..0b6c9fc 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponse.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -20,6 +21,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	/// Association response messages are described in OpenID 2.0 section 8.2.  This type covers section 8.2.1.
 	/// </remarks>
 	[DebuggerDisplay("OpenID {Version} associate response {AssociationHandle} {AssociationType} {SessionType}")]
+	[ContractClass(typeof(AssociateSuccessfulResponseContract))]
 	internal abstract class AssociateSuccessfulResponse : DirectResponseBase {
 		/// <summary>
 		/// A flag indicating whether an association has already been created.
diff --git a/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponseContract.cs b/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponseContract.cs
new file mode 100644
index 0000000..dd37da6
--- /dev/null
+++ b/src/DotNetOpenAuth/OpenId/Messages/AssociateSuccessfulResponseContract.cs
@@ -0,0 +1,29 @@
+// <auto-generated />
+
+namespace DotNetOpenAuth.OpenId.Messages {
+	using System;
+	using System.Collections.Generic;
+	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
+	using System.Linq;
+	using System.Text;
+	using DotNetOpenAuth.Messaging;
+	using DotNetOpenAuth.OpenId.Provider;
+
+	[ContractClassFor(typeof(AssociateSuccessfulResponse))]
+	internal abstract class AssociateSuccessfulResponseContract : AssociateSuccessfulResponse {
+		protected AssociateSuccessfulResponseContract() : base(null, null) {
+		}
+
+		protected override Association CreateAssociationAtProvider(AssociateRequest request, ProviderSecuritySettings securitySettings) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
+			throw new NotImplementedException();
+		}
+
+		protected override Association CreateAssociationAtRelyingParty(AssociateRequest request) {
+			Contract.Requires<ArgumentNullException>(request != null);
+			throw new NotImplementedException();
+		}
+	}
+}
diff --git a/src/DotNetOpenAuth/OpenId/Messages/CheckAuthenticationRequest.cs b/src/DotNetOpenAuth/OpenId/Messages/CheckAuthenticationRequest.cs
index a10f073..6579325 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/CheckAuthenticationRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/CheckAuthenticationRequest.cs
@@ -41,7 +41,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// <param name="channel">The channel.  This is used only within the constructor and is not stored in a field.</param>
 		internal CheckAuthenticationRequest(IndirectSignedResponse message, Channel channel)
 			: base(message.Version, message.ProviderEndpoint, GetProtocolConstant(message.Version, p => p.Args.Mode.check_authentication), MessageTransport.Direct) {
-			Contract.Requires(channel != null);
+			Contract.Requires<ArgumentNullException>(channel != null);
 			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
 
 			// Copy all message parts from the id_res message into this one,
diff --git a/src/DotNetOpenAuth/OpenId/Messages/IndirectSignedResponse.cs b/src/DotNetOpenAuth/OpenId/Messages/IndirectSignedResponse.cs
index 0d105ad..4ea9995 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/IndirectSignedResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/IndirectSignedResponse.cs
@@ -62,7 +62,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// </param>
 		internal IndirectSignedResponse(SignedResponseRequest request)
 			: base(request, Protocol.Lookup(GetVersion(request)).Args.Mode.id_res) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			this.ReturnTo = request.ReturnTo;
 			this.ProviderEndpoint = request.Recipient.StripQueryArgumentsWithPrefix(Protocol.openid.Prefix);
@@ -77,8 +77,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// <param name="channel">The channel.  This is used only within the constructor and is not stored in a field.</param>
 		internal IndirectSignedResponse(CheckAuthenticationRequest previouslySignedMessage, Channel channel)
 			: base(GetVersion(previouslySignedMessage), previouslySignedMessage.ReturnTo, Protocol.Lookup(GetVersion(previouslySignedMessage)).Args.Mode.id_res) {
-			Contract.Requires(channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			// Copy all message parts from the check_authentication message into this one,
 			// except for the openid.mode parameter.
@@ -332,7 +331,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// cannot verify the private signature made by the relying party.
 		/// </remarks>
 		internal string GetReturnToArgument(string key) {
-			ErrorUtilities.VerifyNonZeroLength(key, "key");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(key));
 			ErrorUtilities.VerifyInternal(this.ReturnTo != null, "ReturnTo was expected to be required but is null.");
 
 			string value;
@@ -358,8 +357,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// A dictionary of the signed message parts.
 		/// </returns>
 		internal IDictionary<string, string> GetSignedMessageParts(Channel channel) {
-			Contract.Requires(channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			ITamperResistantOpenIdMessage signedSelf = this;
 			if (signedSelf.SignedParameterOrder == null) {
diff --git a/src/DotNetOpenAuth/OpenId/Messages/NegativeAssertionResponse.cs b/src/DotNetOpenAuth/OpenId/Messages/NegativeAssertionResponse.cs
index 99a7c5a..52ff884 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/NegativeAssertionResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/NegativeAssertionResponse.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -114,8 +115,8 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// <param name="channel">The channel to use to simulate construction of the message.</param>
 		/// <returns>The value to use for the user_setup_url parameter.</returns>
 		private static Uri ConstructUserSetupUrl(CheckIdRequest immediateRequest, Channel channel) {
-			ErrorUtilities.VerifyArgumentNotNull(immediateRequest, "immediateRequest");
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(immediateRequest != null);
+			Contract.Requires<ArgumentNullException>(channel != null);
 			ErrorUtilities.VerifyInternal(immediateRequest.Immediate, "Only immediate requests should be sent here.");
 
 			var setupRequest = new CheckIdRequest(immediateRequest.Version, immediateRequest.Recipient, AuthenticationRequestMode.Setup);
@@ -132,7 +133,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// <param name="request">The request that we're responding to.</param>
 		/// <returns>The value of the openid.mode parameter to use.</returns>
 		private static string GetMode(SignedResponseRequest request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			Protocol protocol = Protocol.Lookup(request.Version);
 			return request.Immediate ? protocol.Args.Mode.setup_needed : protocol.Args.Mode.cancel;
diff --git a/src/DotNetOpenAuth/OpenId/Messages/SignedResponseRequest.cs b/src/DotNetOpenAuth/OpenId/Messages/SignedResponseRequest.cs
index 1096468..b31b760 100644
--- a/src/DotNetOpenAuth/OpenId/Messages/SignedResponseRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Messages/SignedResponseRequest.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -139,7 +140,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// when and if a positive assertion comes back from the Provider.
 		/// </remarks>
 		internal void AddReturnToArguments(IEnumerable<KeyValuePair<string, string>> keysValues) {
-			ErrorUtilities.VerifyArgumentNotNull(keysValues, "keysValues");
+			Contract.Requires<ArgumentNullException>(keysValues != null);
 			ErrorUtilities.VerifyOperation(this.ReturnTo != null, OpenIdStrings.ReturnToRequiredForOperation);
 			UriBuilder returnToBuilder = new UriBuilder(this.ReturnTo);
 			returnToBuilder.AppendAndReplaceQueryArgs(keysValues);
@@ -170,7 +171,7 @@ namespace DotNetOpenAuth.OpenId.Messages {
 		/// </param>
 		/// <returns>checkid_immediate or checkid_setup</returns>
 		private static string GetMode(Version version, AuthenticationRequestMode mode) {
-			ErrorUtilities.VerifyArgumentNotNull(version, "version");
+			Contract.Requires<ArgumentNullException>(version != null);
 
 			Protocol protocol = Protocol.Lookup(version);
 			return mode == AuthenticationRequestMode.Immediate ? protocol.Args.Mode.checkid_immediate : protocol.Args.Mode.checkid_setup;
diff --git a/src/DotNetOpenAuth/OpenId/NoDiscoveryIdentifier.cs b/src/DotNetOpenAuth/OpenId/NoDiscoveryIdentifier.cs
index 2c8e865..eb8e606 100644
--- a/src/DotNetOpenAuth/OpenId/NoDiscoveryIdentifier.cs
+++ b/src/DotNetOpenAuth/OpenId/NoDiscoveryIdentifier.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId {
+	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.Contracts;
 	using System.Linq;
@@ -29,7 +30,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="claimSsl">Whether this Identifier should claim to be SSL-secure, although no discovery will never generate service endpoints anyway.</param>
 		internal NoDiscoveryIdentifier(Identifier wrappedIdentifier, bool claimSsl)
 			: base(claimSsl) {
-			Contract.Requires(wrappedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(wrappedIdentifier != null);
 			ErrorUtilities.VerifyArgumentNotNull(wrappedIdentifier, "wrappedIdentifier");
 
 			this.wrappedIdentifier = wrappedIdentifier;
diff --git a/src/DotNetOpenAuth/OpenId/OpenIdUtilities.cs b/src/DotNetOpenAuth/OpenId/OpenIdUtilities.cs
index 3cee968..3e75e61 100644
--- a/src/DotNetOpenAuth/OpenId/OpenIdUtilities.cs
+++ b/src/DotNetOpenAuth/OpenId/OpenIdUtilities.cs
@@ -34,7 +34,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="message">The message.</param>
 		/// <returns>The OpenID protocol instance.</returns>
 		internal static Protocol GetProtocol(this IProtocolMessage message) {
-			ErrorUtilities.VerifyArgumentNotNull(message, "message");
+			Contract.Requires<ArgumentNullException>(message != null);
 			return Protocol.Lookup(message.Version);
 		}
 
@@ -103,10 +103,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The fully-qualified realm.</returns>
 		[SuppressMessage("Microsoft.Usage", "CA1806:DoNotIgnoreMethodResults", MessageId = "DotNetOpenAuth.OpenId.Realm", Justification = "Using ctor for validation.")]
 		internal static UriBuilder GetResolvedRealm(Page page, string realm, HttpRequestInfo requestContext) {
-			Contract.Requires(page != null);
-			Contract.Requires(requestContext != null);
-			ErrorUtilities.VerifyArgumentNotNull(page, "page");
-			ErrorUtilities.VerifyArgumentNotNull(requestContext, "requestContext");
+			Contract.Requires<ArgumentNullException>(page != null);
+			Contract.Requires<ArgumentNullException>(requestContext != null);
 
 			// Allow for *. realm notation, as well as ASP.NET ~/ shortcuts.
 
@@ -148,8 +146,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// can plug in.
 		/// </remarks>
 		internal static IList<IOpenIdExtensionFactory> GetExtensionFactories(this Channel channel) {
-			Contract.Requires(channel != null);
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
+			Contract.Requires<ArgumentNullException>(channel != null);
 
 			var extensionsBindingElement = channel.BindingElements.OfType<ExtensionsBindingElement>().SingleOrDefault();
 			ErrorUtilities.VerifyOperation(extensionsBindingElement != null, OpenIdStrings.UnsupportedChannelConfiguration);
diff --git a/src/DotNetOpenAuth/OpenId/OpenIdXrdsHelper.cs b/src/DotNetOpenAuth/OpenId/OpenIdXrdsHelper.cs
index 2433df2..85743d6 100644
--- a/src/DotNetOpenAuth/OpenId/OpenIdXrdsHelper.cs
+++ b/src/DotNetOpenAuth/OpenId/OpenIdXrdsHelper.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId {
+	using System;
 	using System.Collections.Generic;
 	using System.Diagnostics.Contracts;
 	using System.Linq;
@@ -63,8 +64,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="userSuppliedIdentifier">The user-supplied i-name that was used to discover this XRDS document.</param>
 		/// <returns>A sequence of OpenID Providers that can assert ownership of the canonical ID given in this document.</returns>
 		internal static IEnumerable<ServiceEndpoint> CreateServiceEndpoints(this XrdsDocument xrds, XriIdentifier userSuppliedIdentifier) {
-			Contract.Requires(xrds != null);
-			Contract.Requires(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(xrds != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
 			Contract.Ensures(Contract.Result<IEnumerable<ServiceEndpoint>>() != null);
 			var endpoints = new List<ServiceEndpoint>();
 			endpoints.AddRange(xrds.GenerateOPIdentifierServiceEndpoints(userSuppliedIdentifier));
@@ -86,8 +87,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="opIdentifier">The OP Identifier entered (and resolved) by the user.</param>
 		/// <returns>A sequence of the providers that can offer directed identity services.</returns>
 		private static IEnumerable<ServiceEndpoint> GenerateOPIdentifierServiceEndpoints(this XrdsDocument xrds, Identifier opIdentifier) {
-			Contract.Requires(xrds != null);
-			Contract.Requires(opIdentifier != null);
+			Contract.Requires<ArgumentNullException>(xrds != null);
+			Contract.Requires<ArgumentNullException>(opIdentifier != null);
 			Contract.Ensures(Contract.Result<IEnumerable<ServiceEndpoint>>() != null);
 			return from service in xrds.FindOPIdentifierServices()
 				   from uri in service.UriElements
diff --git a/src/DotNetOpenAuth/OpenId/Protocol.cs b/src/DotNetOpenAuth/OpenId/Protocol.cs
index f38d8a0..c3ac090 100644
--- a/src/DotNetOpenAuth/OpenId/Protocol.cs
+++ b/src/DotNetOpenAuth/OpenId/Protocol.cs
@@ -323,6 +323,7 @@ namespace DotNetOpenAuth.OpenId {
 			/// <summary>
 			/// Verifies conditions that should be true for any valid state of this object.
 			/// </summary>
+			[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 			[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 			[ContractInvariantMethod]
 			private void ObjectInvariant() {
@@ -330,6 +331,7 @@ namespace DotNetOpenAuth.OpenId {
 			}
 #endif
 		}
+
 		internal sealed class QueryArguments {
 			public ErrorCodes ErrorCode = new ErrorCodes();
 			public SessionTypes SessionType = new SessionTypes();
diff --git a/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequest.cs
index 546db9f..ac39356 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequest.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId.Provider {
+	using System;
 	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
@@ -26,9 +27,8 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="request">The incoming authentication request message.</param>
 		internal AnonymousRequest(OpenIdProvider provider, SignedResponseRequest request)
 			: base(provider, request) {
-			Contract.Requires(provider != null);
+			Contract.Requires<ArgumentNullException>(provider != null);
 			Contract.Requires(!(request is CheckIdRequest), "Instantiate " + typeof(AuthenticationRequest).Name + " to handle this kind of message.");
-			ErrorUtilities.VerifyInternal(!(request is CheckIdRequest), "Instantiate {0} to handle this kind of message.", typeof(AuthenticationRequest).Name);
 
 			this.positiveResponse = new IndirectSignedResponse(request);
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequestEventArgs.cs b/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequestEventArgs.cs
index cdd5311..9ffaa55 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequestEventArgs.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/AnonymousRequestEventArgs.cs
@@ -18,8 +18,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="request">The incoming OpenID request.</param>
 		internal AnonymousRequestEventArgs(IAnonymousRequest request) {
-			Contract.Requires(request != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			this.Request = request;
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Provider/AuthenticationRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/AuthenticationRequest.cs
index 7a547dd..81beb01 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/AuthenticationRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/AuthenticationRequest.cs
@@ -29,8 +29,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="request">The incoming authentication request message.</param>
 		internal AuthenticationRequest(OpenIdProvider provider, CheckIdRequest request)
 			: base(provider, request) {
-			Contract.Requires(provider != null);
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			this.positiveResponse = new PositiveAssertionResponse(request);
 
diff --git a/src/DotNetOpenAuth/OpenId/Provider/AutoResponsiveRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/AutoResponsiveRequest.cs
index 344c72f..67c0d99 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/AutoResponsiveRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/AutoResponsiveRequest.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -30,7 +31,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="response">The response that is ready for transmittal.</param>
 		internal AutoResponsiveRequest(IDirectedProtocolMessage request, IProtocolMessage response)
 			: base(request) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.response = response;
 		}
@@ -42,7 +43,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="response">The response that is ready for transmittal.</param>
 		internal AutoResponsiveRequest(IProtocolMessage response)
 			: base(IndirectResponseBase.GetVersion(response)) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.response = response;
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Provider/HostProcessedRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/HostProcessedRequest.cs
index 05caaa3..94b63df 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/HostProcessedRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/HostProcessedRequest.cs
@@ -30,7 +30,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="request">The incoming request message.</param>
 		protected HostProcessedRequest(OpenIdProvider provider, SignedResponseRequest request)
 			: base(request) {
-			Contract.Requires(provider != null);
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			this.negativeResponse = new NegativeAssertionResponse(request, provider.Channel);
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Provider/IHostProcessedRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/IHostProcessedRequest.cs
index 17dc8f5..458d256 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/IHostProcessedRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/IHostProcessedRequest.cs
@@ -5,8 +5,10 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId.Provider {
+	using System;
 	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Messaging;
+	using DotNetOpenAuth.OpenId.Messages;
 
 	/// <summary>
 	/// Interface exposing incoming messages to the OpenID Provider that
@@ -45,6 +47,9 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		RelyingPartyDiscoveryResult IsReturnUrlDiscoverable(OpenIdProvider provider);
 	}
 
+	/// <summary>
+	/// Code contract for the <see cref="IHostProcessedRequest"/> type.
+	/// </summary>
 	[ContractClassFor(typeof(IHostProcessedRequest))]
 	internal abstract class IHostProcessedRequestContract : IHostProcessedRequest {
 		/// <summary>
@@ -53,46 +58,100 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		protected IHostProcessedRequestContract() {
 		}
 
-		#region IHostProcessedRequest Members
+		#region IHostProcessedRequest Properties
 
+		/// <summary>
+		/// Gets the version of OpenID being used by the relying party that sent the request.
+		/// </summary>
 		ProtocolVersion IHostProcessedRequest.RelyingPartyVersion {
 			get { throw new System.NotImplementedException(); }
 		}
 
+		/// <summary>
+		/// Gets the URL the consumer site claims to use as its 'base' address.
+		/// </summary>
 		Realm IHostProcessedRequest.Realm {
 			get { throw new System.NotImplementedException(); }
 		}
 
+		/// <summary>
+		/// Gets a value indicating whether the consumer demands an immediate response.
+		/// If false, the consumer is willing to wait for the identity provider
+		/// to authenticate the user.
+		/// </summary>
 		bool IHostProcessedRequest.Immediate {
 			get { throw new System.NotImplementedException(); }
 		}
 
-		RelyingPartyDiscoveryResult IHostProcessedRequest.IsReturnUrlDiscoverable(OpenIdProvider provider) {
-			Contract.Requires(provider != null);
-			throw new System.NotImplementedException();
-		}
-
 		#endregion
 
-		#region IRequest Members
+		#region IRequest Properties
 
+		/// <summary>
+		/// Gets a value indicating whether the response is ready to be sent to the user agent.
+		/// </summary>
+		/// <remarks>
+		/// This property returns false if there are properties that must be set on this
+		/// request instance before the response can be sent.
+		/// </remarks>
 		bool IRequest.IsResponseReady {
 			get { throw new System.NotImplementedException(); }
 		}
 
+		#endregion
+
+		#region IHostProcessedRequest Methods
+
+		/// <summary>
+		/// Attempts to perform relying party discovery of the return URL claimed by the Relying Party.
+		/// </summary>
+		/// <param name="provider">The OpenIdProvider that is performing the RP discovery.</param>
+		/// <returns>
+		/// The details of how successful the relying party discovery was.
+		/// </returns>
+		/// <remarks>
+		/// 	<para>Return URL verification is only attempted if this method is called.</para>
+		/// 	<para>See OpenID Authentication 2.0 spec section 9.2.1.</para>
+		/// </remarks>
+		RelyingPartyDiscoveryResult IHostProcessedRequest.IsReturnUrlDiscoverable(OpenIdProvider provider) {
+			Contract.Requires<ArgumentNullException>(provider != null);
+			throw new System.NotImplementedException();
+		}
+
+		#endregion
+
+		#region IRequest Methods
+
+		/// <summary>
+		/// Adds an extension to the response to send to the relying party.
+		/// </summary>
+		/// <param name="extension">The extension to add to the response message.</param>
 		void IRequest.AddResponseExtension(DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension extension) {
 			throw new System.NotImplementedException();
 		}
 
+		/// <summary>
+		/// Gets an extension sent from the relying party.
+		/// </summary>
+		/// <typeparam name="T">The type of the extension.</typeparam>
+		/// <returns>
+		/// An instance of the extension initialized with values passed in with the request.
+		/// </returns>
 		T IRequest.GetExtension<T>() {
 			throw new System.NotImplementedException();
 		}
 
-		DotNetOpenAuth.OpenId.Messages.IOpenIdMessageExtension IRequest.GetExtension(System.Type extensionType) {
+		/// <summary>
+		/// Gets an extension sent from the relying party.
+		/// </summary>
+		/// <param name="extensionType">The type of the extension.</param>
+		/// <returns>
+		/// An instance of the extension initialized with values passed in with the request.
+		/// </returns>
+		IOpenIdMessageExtension IRequest.GetExtension(System.Type extensionType) {
 			throw new System.NotImplementedException();
 		}
 
 		#endregion
 	}
-
 }
diff --git a/src/DotNetOpenAuth/OpenId/Provider/IRequest.cs b/src/DotNetOpenAuth/OpenId/Provider/IRequest.cs
index 9f0f633..d2a2e0c 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/IRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/IRequest.cs
@@ -58,7 +58,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	/// Code contract for the <see cref="IRequest"/> interface.
 	/// </summary>
 	[ContractClassFor(typeof(IRequest))]
-	internal class IRequestContract : IRequest {
+	internal abstract class IRequestContract : IRequest {
 		/// <summary>
 		/// Prevents a default instance of the <see cref="IRequestContract"/> class from being created.
 		/// </summary>
@@ -70,7 +70,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <summary>
 		/// Gets a value indicating whether the response is ready to be sent to the user agent.
 		/// </summary>
-		/// <value></value>
 		/// <remarks>
 		/// This property returns false if there are properties that must be set on this
 		/// request instance before the response can be sent.
@@ -84,7 +83,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="extension">The extension to add to the response message.</param>
 		void IRequest.AddResponseExtension(IOpenIdMessageExtension extension) {
-			Contract.Requires(extension != null);
+			Contract.Requires<ArgumentNullException>(extension != null);
 			throw new NotImplementedException();
 		}
 
@@ -107,7 +106,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// An instance of the extension initialized with values passed in with the request.
 		/// </returns>
 		IOpenIdMessageExtension IRequest.GetExtension(Type extensionType) {
-			Contract.Requires(extensionType != null);
+			Contract.Requires<ArgumentNullException>(extensionType != null);
 			throw new NotImplementedException();
 		}
 
diff --git a/src/DotNetOpenAuth/OpenId/Provider/OpenIdProvider.cs b/src/DotNetOpenAuth/OpenId/Provider/OpenIdProvider.cs
index 68c2ab9..9645509 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/OpenIdProvider.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/OpenIdProvider.cs
@@ -51,7 +51,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="applicationStore">The application store to use.  Cannot be null.</param>
 		public OpenIdProvider(IProviderApplicationStore applicationStore)
 			: this(applicationStore, applicationStore) {
-			Contract.Requires(applicationStore != null);
+			Contract.Requires<ArgumentNullException>(applicationStore != null);
 			Contract.Ensures(this.AssociationStore == applicationStore);
 			Contract.Ensures(this.SecuritySettings != null);
 			Contract.Ensures(this.Channel != null);
@@ -63,8 +63,8 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="associationStore">The association store to use.  Cannot be null.</param>
 		/// <param name="nonceStore">The nonce store to use.  Cannot be null.</param>
 		private OpenIdProvider(IAssociationStore<AssociationRelyingPartyType> associationStore, INonceStore nonceStore) {
-			Contract.Requires(associationStore != null);
-			Contract.Requires(nonceStore != null);
+			Contract.Requires<ArgumentNullException>(associationStore != null);
+			Contract.Requires<ArgumentNullException>(nonceStore != null);
 			Contract.Ensures(this.AssociationStore == associationStore);
 			Contract.Ensures(this.SecuritySettings != null);
 			Contract.Ensures(this.Channel != null);
@@ -118,8 +118,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 			}
 
 			internal set {
-				Contract.Requires(value != null);
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.securitySettings = value;
 			}
 		}
@@ -182,7 +181,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <exception cref="ProtocolException">Thrown if the incoming message is recognized
 		/// but deviates from the protocol specification irrecoverably.</exception>
 		public IRequest GetRequest(HttpRequestInfo httpRequestInfo) {
-			Contract.Requires(httpRequestInfo != null);
+			Contract.Requires<ArgumentNullException>(httpRequestInfo != null);
 			ErrorUtilities.VerifyArgumentNotNull(httpRequestInfo, "httpRequestInfo");
 			IDirectedProtocolMessage incomingMessage = null;
 
@@ -244,9 +243,8 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code Contract requires that we cast early.")]
 		public void SendResponse(IRequest request) {
 			Contract.Requires(HttpContext.Current != null);
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 			Contract.Requires(((Request)request).IsResponseReady);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 
 			Request requestInternal = (Request)request;
 			this.Channel.Send(requestInternal.Response);
@@ -260,9 +258,8 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="IRequest.IsResponseReady"/> is <c>false</c>.</exception>
 		[SuppressMessage("Microsoft.Performance", "CA1800:DoNotCastUnnecessarily", Justification = "Code Contract requires that we cast early.")]
 		public OutgoingWebResponse PrepareResponse(IRequest request) {
-			Contract.Requires(request != null);
+			Contract.Requires<ArgumentNullException>(request != null);
 			Contract.Requires(((Request)request).IsResponseReady);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
 
 			Request requestInternal = (Request)request;
 			return this.Channel.PrepareResponse(requestInternal.Response);
@@ -285,11 +282,11 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// <param name="extensions">The extensions.</param>
 		public void SendUnsolicitedAssertion(Uri providerEndpoint, Realm relyingParty, Identifier claimedIdentifier, Identifier localIdentifier, params IExtensionMessage[] extensions) {
 			Contract.Requires(HttpContext.Current != null);
-			Contract.Requires(providerEndpoint != null);
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
 			Contract.Requires(providerEndpoint.IsAbsoluteUri);
-			Contract.Requires(relyingParty != null);
-			Contract.Requires(claimedIdentifier != null);
-			Contract.Requires(localIdentifier != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
+			Contract.Requires<ArgumentNullException>(claimedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(localIdentifier != null);
 
 			this.PrepareUnsolicitedAssertion(providerEndpoint, relyingParty, claimedIdentifier, localIdentifier, extensions).Send();
 		}
@@ -314,12 +311,12 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// the user agent to allow the redirect with assertion to happen.
 		/// </returns>
 		public OutgoingWebResponse PrepareUnsolicitedAssertion(Uri providerEndpoint, Realm relyingParty, Identifier claimedIdentifier, Identifier localIdentifier, params IExtensionMessage[] extensions) {
-			Contract.RequiresAlways(providerEndpoint != null);
-			Contract.RequiresAlways(providerEndpoint.IsAbsoluteUri);
-			Contract.RequiresAlways(relyingParty != null);
-			Contract.RequiresAlways(claimedIdentifier != null);
-			Contract.RequiresAlways(localIdentifier != null);
-			Contract.RequiresAlways(this.WebRequestHandler != null);
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
+			Contract.Requires<ArgumentException>(providerEndpoint.IsAbsoluteUri);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
+			Contract.Requires<ArgumentNullException>(claimedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(localIdentifier != null);
+			Contract.Requires<InvalidOperationException>(this.Channel.WebRequestHandler != null);
 
 			// Although the RP should do their due diligence to make sure that this OP
 			// is authorized to send an assertion for the given claimed identifier,
@@ -396,8 +393,8 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// Either the <see cref="IRequest"/> to return to the host site or null to indicate no response could be reasonably created and that the caller should rethrow the exception.
 		/// </returns>
 		private IRequest GetErrorResponse(ProtocolException ex, HttpRequestInfo httpRequestInfo, IDirectedProtocolMessage incomingMessage) {
-			Contract.Requires(ex != null);
-			Contract.Requires(httpRequestInfo != null);
+			Contract.Requires<ArgumentNullException>(ex != null);
+			Contract.Requires<ArgumentNullException>(httpRequestInfo != null);
 			ErrorUtilities.VerifyArgumentNotNull(ex, "ex");
 			ErrorUtilities.VerifyArgumentNotNull(httpRequestInfo, "httpRequestInfo");
 
diff --git a/src/DotNetOpenAuth/OpenId/Provider/ProviderEndpoint.cs b/src/DotNetOpenAuth/OpenId/Provider/ProviderEndpoint.cs
index 91f10e6..b2adafc 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/ProviderEndpoint.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/ProviderEndpoint.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 	using System;
 	using System.Collections.Generic;
 	using System.ComponentModel;
+	using System.Diagnostics.Contracts;
 	using System.Text;
 	using System.Web;
 	using System.Web.UI;
@@ -67,7 +68,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				provider = value;
 			}
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Provider/Request.cs b/src/DotNetOpenAuth/OpenId/Provider/Request.cs
index 1c5ad02..50b9f54 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/Request.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/Request.cs
@@ -53,8 +53,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="request">The incoming request message.</param>
 		protected Request(IDirectedProtocolMessage request) {
-			Contract.Requires(request != null);
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			this.request = request;
 			this.protocolVersion = this.request.Version;
@@ -66,8 +65,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="version">The version.</param>
 		protected Request(Version version) {
-			Contract.Requires(version != null);
-			ErrorUtilities.VerifyArgumentNotNull(version, "version");
+			Contract.Requires<ArgumentNullException>(version != null);
 
 			this.protocolVersion = version;
 		}
@@ -148,8 +146,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		/// <param name="extension">The extension to add to the response message.</param>
 		public void AddResponseExtension(IOpenIdMessageExtension extension) {
-			ErrorUtilities.VerifyArgumentNotNull(extension, "extension");
-
 			// Because the derived AuthenticationRequest class can swap out
 			// one response message for another (auth vs. no-auth), and because
 			// some response messages support extensions while others don't,
@@ -181,7 +177,6 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// An instance of the extension initialized with values passed in with the request.
 		/// </returns>
 		public IOpenIdMessageExtension GetExtension(Type extensionType) {
-			ErrorUtilities.VerifyArgumentNotNull(extensionType, "extensionType");
 			if (this.extensibleMessage != null) {
 				return this.extensibleMessage.Extensions.OfType<IOpenIdMessageExtension>().Where(ext => extensionType.IsInstanceOfType(ext)).SingleOrDefault();
 			} else {
diff --git a/src/DotNetOpenAuth/OpenId/ProviderEndpointDescription.cs b/src/DotNetOpenAuth/OpenId/ProviderEndpointDescription.cs
index 29d04ba..fdf6b24 100644
--- a/src/DotNetOpenAuth/OpenId/ProviderEndpointDescription.cs
+++ b/src/DotNetOpenAuth/OpenId/ProviderEndpointDescription.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId {
 	using System;
 	using System.Collections.Generic;
 	using System.Collections.ObjectModel;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using DotNetOpenAuth.Messaging;
 
@@ -24,8 +25,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="providerEndpoint">The OpenID Provider endpoint URL.</param>
 		/// <param name="openIdVersion">The OpenID version supported by this particular endpoint.</param>
 		internal ProviderEndpointDescription(Uri providerEndpoint, Version openIdVersion) {
-			ErrorUtilities.VerifyArgumentNotNull(providerEndpoint, "providerEndpoint");
-			ErrorUtilities.VerifyArgumentNotNull(openIdVersion, "version");
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
+			Contract.Requires<ArgumentNullException>(openIdVersion != null);
 
 			this.Endpoint = providerEndpoint;
 			this.ProtocolVersion = openIdVersion;
@@ -37,8 +38,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="providerEndpoint">The URI the provider listens on for OpenID requests.</param>
 		/// <param name="serviceTypeURIs">The set of services offered by this endpoint.</param>
 		internal ProviderEndpointDescription(Uri providerEndpoint, IEnumerable<string> serviceTypeURIs) {
-			ErrorUtilities.VerifyArgumentNotNull(providerEndpoint, "providerEndpoint");
-			ErrorUtilities.VerifyArgumentNotNull(serviceTypeURIs, "serviceTypeURIs");
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
+			Contract.Requires<ArgumentNullException>(serviceTypeURIs != null);
 
 			this.Endpoint = providerEndpoint;
 			this.Capabilities = new ReadOnlyCollection<string>(serviceTypeURIs.ToList());
diff --git a/src/DotNetOpenAuth/OpenId/Realm.cs b/src/DotNetOpenAuth/OpenId/Realm.cs
index 7f0acdb..78662ce 100644
--- a/src/DotNetOpenAuth/OpenId/Realm.cs
+++ b/src/DotNetOpenAuth/OpenId/Realm.cs
@@ -62,7 +62,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="realmUrl">The realm URL to use in the new instance.</param>
 		[SuppressMessage("Microsoft.Design", "CA1057:StringUriOverloadsCallSystemUriOverloads", Justification = "Not all realms are valid URLs (because of wildcards).")]
 		public Realm(string realmUrl) {
-			ErrorUtilities.VerifyArgumentNotNull(realmUrl, "realmUrl"); // not non-zero check so we throw UriFormatException later
+			Contract.Requires<ArgumentNullException>(realmUrl != null); // not non-zero check so we throw UriFormatException later
 			this.DomainWildcard = Regex.IsMatch(realmUrl, WildcardDetectionPattern);
 			this.uri = new Uri(Regex.Replace(realmUrl, WildcardDetectionPattern, m => m.Groups[1].Value));
 			if (!this.uri.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase) &&
@@ -77,7 +77,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// </summary>
 		/// <param name="realmUrl">The realm URL of the Relying Party.</param>
 		public Realm(Uri realmUrl) {
-			ErrorUtilities.VerifyArgumentNotNull(realmUrl, "realmUrl");
+			Contract.Requires<ArgumentNullException>(realmUrl != null);
 			this.uri = realmUrl;
 			if (!this.uri.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase) &&
 				!this.uri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase)) {
@@ -413,7 +413,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// when we should be throwing an <see cref="ArgumentNullException"/>.
 		/// </remarks>
 		private static string SafeUriBuilderToString(UriBuilder realmUriBuilder) {
-			ErrorUtilities.VerifyArgumentNotNull(realmUriBuilder, "realmUriBuilder");
+			Contract.Requires<ArgumentNullException>(realmUriBuilder != null);
 
 			// Note: we MUST use ToString.  Uri property throws if wildcard is present.
 			// Note that Uri.ToString() should generally be avoided, but UriBuilder.ToString()
@@ -425,6 +425,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		private void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/AssociationManager.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/AssociationManager.cs
index a37c8c7..0bdc474 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/AssociationManager.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/AssociationManager.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -39,8 +40,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="associationStore">The association store.  May be null for dumb mode relying parties.</param>
 		/// <param name="securitySettings">The security settings.</param>
 		internal AssociationManager(Channel channel, IAssociationStore<Uri> associationStore, RelyingPartySecuritySettings securitySettings) {
-			ErrorUtilities.VerifyArgumentNotNull(channel, "channel");
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
+			Contract.Requires<ArgumentNullException>(channel != null);
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
 
 			this.channel = channel;
 			this.associationStore = associationStore;
@@ -57,7 +58,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.channel = value;
 			}
 		}
@@ -71,7 +72,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.securitySettings = value;
 			}
 		}
@@ -94,7 +95,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="provider">The provider to create an association with.</param>
 		/// <returns>The association if one exists and has useful life remaining.  Otherwise <c>null</c>.</returns>
 		internal Association GetExistingAssociation(ProviderEndpointDescription provider) {
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			// If the RP has no application store for associations, there's no point in creating one.
 			if (this.associationStore == null) {
@@ -139,7 +140,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Any new association is automatically added to the <see cref="associationStore"/>.
 		/// </remarks>
 		private Association CreateNewAssociation(ProviderEndpointDescription provider) {
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			// If there is no association store, there is no point in creating an association.
 			if (this.associationStore == null) {
@@ -163,7 +164,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// the given Provider given the current security settings.
 		/// </returns>
 		private Association CreateNewAssociation(ProviderEndpointDescription provider, AssociateRequest associateRequest, int retriesRemaining) {
-			ErrorUtilities.VerifyArgumentNotNull(provider, "provider");
+			Contract.Requires<ArgumentNullException>(provider != null);
 
 			if (associateRequest == null || retriesRemaining < 0) {
 				// this can happen if security requirements and protocol conflict
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs
index 5b8a865..c65e681 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/AuthenticationRequest.cs
@@ -62,10 +62,10 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="returnToUrl">The base return_to URL that the Provider should return the user to to complete authentication.  This should not include callback parameters as these should be added using the <see cref="AddCallbackArguments(string, string)"/> method.</param>
 		/// <param name="relyingParty">The relying party that created this instance.</param>
 		private AuthenticationRequest(ServiceEndpoint endpoint, Realm realm, Uri returnToUrl, OpenIdRelyingParty relyingParty) {
-			ErrorUtilities.VerifyArgumentNotNull(endpoint, "endpoint");
-			ErrorUtilities.VerifyArgumentNotNull(realm, "realm");
-			ErrorUtilities.VerifyArgumentNotNull(returnToUrl, "returnToUrl");
-			ErrorUtilities.VerifyArgumentNotNull(relyingParty, "relyingParty");
+			Contract.Requires<ArgumentNullException>(endpoint != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
+			Contract.Requires<ArgumentNullException>(returnToUrl != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
 
 			this.endpoint = endpoint;
 			this.RelyingParty = relyingParty;
@@ -178,7 +178,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// small to ensure successful authentication.  About 1.5KB is about all that should be stored.</para>
 		/// </remarks>
 		public void AddCallbackArguments(IDictionary<string, string> arguments) {
-			ErrorUtilities.VerifyArgumentNotNull(arguments, "arguments");
 			ErrorUtilities.VerifyOperation(this.RelyingParty.CanSignCallbackArguments, OpenIdStrings.CallbackArgumentsRequireSecretStore, typeof(IAssociationStore<Uri>).Name, typeof(OpenIdRelyingParty).Name);
 
 			foreach (var pair in arguments) {
@@ -204,8 +203,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// small to ensure successful authentication.  About 1.5KB is about all that should be stored.</para>
 		/// </remarks>
 		public void AddCallbackArguments(string key, string value) {
-			ErrorUtilities.VerifyNonZeroLength(key, "key");
-			ErrorUtilities.VerifyArgumentNotNull(value, "value");
 			ErrorUtilities.VerifyOperation(this.RelyingParty.CanSignCallbackArguments, OpenIdStrings.CallbackArgumentsRequireSecretStore, typeof(IAssociationStore<Uri>).Name, typeof(OpenIdRelyingParty).Name);
 
 			this.returnToArgs.Add(key, value);
@@ -216,7 +213,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="extension">The initialized extension to add to the request.</param>
 		public void AddExtension(IOpenIdMessageExtension extension) {
-			ErrorUtilities.VerifyArgumentNotNull(extension, "extension");
 			this.extensions.Add(extension);
 		}
 
@@ -247,9 +243,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Never null, but may be empty.
 		/// </returns>
 		internal static IEnumerable<AuthenticationRequest> Create(Identifier userSuppliedIdentifier, OpenIdRelyingParty relyingParty, Realm realm, Uri returnToUrl, bool createNewAssociationsAsNeeded) {
-			Contract.Requires(userSuppliedIdentifier != null);
-			Contract.Requires(relyingParty != null);
-			Contract.Requires(realm != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
 			Contract.Ensures(Contract.Result<IEnumerable<AuthenticationRequest>>() != null);
 
 			// Normalize the portion of the return_to path that correlates to the realm for capitalization.
@@ -381,8 +377,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="relyingParty">The relying party.</param>
 		/// <returns>A filtered and sorted list of endpoints; may be empty if the input was empty or the filter removed all endpoints.</returns>
 		private static List<ServiceEndpoint> FilterAndSortEndpoints(IEnumerable<ServiceEndpoint> endpoints, OpenIdRelyingParty relyingParty) {
-			ErrorUtilities.VerifyArgumentNotNull(endpoints, "endpoints");
-			ErrorUtilities.VerifyArgumentNotNull(relyingParty, "relyingParty");
+			Contract.Requires<ArgumentNullException>(endpoints != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
 
 			// Construct the endpoints filters based on criteria given by the host web site.
 			EndpointSelector versionFilter = ep => ((ServiceEndpoint)ep).Protocol.Version >= Protocol.Lookup(relyingParty.SecuritySettings.MinimumRequiredOpenIdVersion).Version;
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequest.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequest.cs
index 0bfcaf5..65abf97 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequest.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequest.cs
@@ -7,6 +7,8 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
+	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OpenId.Messages;
@@ -16,6 +18,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	/// requests that may be queried/modified in specific ways before being
 	/// routed to the OpenID Provider.
 	/// </summary>
+	[ContractClass(typeof(IAuthenticationRequestContract))]
 	public interface IAuthenticationRequest {
 		/// <summary>
 		/// Gets or sets the mode the Provider should use during authentication.
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequestContract.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequestContract.cs
new file mode 100644
index 0000000..4d14067
--- /dev/null
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/IAuthenticationRequestContract.cs
@@ -0,0 +1,84 @@
+// <auto-generated />
+
+namespace DotNetOpenAuth.OpenId.RelyingParty {
+	using System;
+	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
+	using System.Linq;
+	using System.Text;
+	using DotNetOpenAuth.Messaging;
+	using DotNetOpenAuth.OpenId.Messages;
+
+	[ContractClassFor(typeof(IAuthenticationRequest))]
+	internal abstract class IAuthenticationRequestContract : IAuthenticationRequest {
+		#region IAuthenticationRequest Members
+
+		AuthenticationRequestMode IAuthenticationRequest.Mode {
+			get {
+				throw new NotImplementedException();
+			}
+
+			set {
+				throw new NotImplementedException();
+			}
+		}
+
+		OutgoingWebResponse IAuthenticationRequest.RedirectingResponse {
+			get { throw new NotImplementedException(); }
+		}
+
+		Uri IAuthenticationRequest.ReturnToUrl {
+			get { throw new NotImplementedException(); }
+		}
+
+		Realm IAuthenticationRequest.Realm {
+			get { throw new NotImplementedException(); }
+		}
+
+		Identifier IAuthenticationRequest.ClaimedIdentifier {
+			get { throw new NotImplementedException(); }
+		}
+
+		bool IAuthenticationRequest.IsDirectedIdentity {
+			get { throw new NotImplementedException(); }
+		}
+
+		bool IAuthenticationRequest.IsExtensionOnly {
+			get {
+				throw new NotImplementedException();
+			}
+
+			set {
+				throw new NotImplementedException();
+			}
+		}
+
+		IProviderEndpoint IAuthenticationRequest.Provider {
+			get { throw new NotImplementedException(); }
+		}
+
+		void IAuthenticationRequest.AddCallbackArguments(IDictionary<string, string> arguments) {
+			Contract.Requires<ArgumentNullException>(arguments != null);
+			Contract.Requires<ArgumentException>(arguments.Keys.All(k => !String.IsNullOrEmpty(k)));
+			Contract.Requires<ArgumentException>(arguments.Values.All(v => v != null));
+			throw new NotImplementedException();
+		}
+
+		void IAuthenticationRequest.AddCallbackArguments(string key, string value) {
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(key));
+			Contract.Requires<ArgumentNullException>(value != null);
+			throw new NotImplementedException();
+		}
+
+		void IAuthenticationRequest.AddExtension(IOpenIdMessageExtension extension) {
+			Contract.Requires<ArgumentNullException>(extension != null);
+			throw new NotImplementedException();
+		}
+
+		void IAuthenticationRequest.RedirectToProvider() {
+			throw new NotImplementedException();
+		}
+
+		#endregion
+	}
+}
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpoint.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpoint.cs
index ebd8518..89b4ef0 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpoint.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpoint.cs
@@ -5,13 +5,16 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
+	using System;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 
 	/// <summary>
 	/// An <see cref="IProviderEndpoint"/> interface with additional members for use
 	/// in sorting for most preferred endpoint.
 	/// </summary>
 	[SuppressMessage("Microsoft.Naming", "CA1704:IdentifiersShouldBeSpelledCorrectly", MessageId = "Xrds", Justification = "Xrds is an acronym.")]
+	[ContractClass(typeof(IXrdsProviderEndpointContract))]
 	public interface IXrdsProviderEndpoint : IProviderEndpoint {
 		/// <summary>
 		/// Gets the priority associated with this service that may have been given
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpointContract.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpointContract.cs
new file mode 100644
index 0000000..fd399f9
--- /dev/null
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/IXrdsProviderEndpointContract.cs
@@ -0,0 +1,58 @@
+// <auto-generated />
+
+namespace DotNetOpenAuth.OpenId.RelyingParty {
+	using System;
+	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
+	using System.Globalization;
+	using DotNetOpenAuth.OpenId.Messages;
+
+	[ContractClassFor(typeof(IXrdsProviderEndpoint))]
+	internal abstract class IXrdsProviderEndpointContract : IXrdsProviderEndpoint {
+		#region IXrdsProviderEndpoint Properties
+
+		int? IXrdsProviderEndpoint.ServicePriority {
+			get { throw new System.NotImplementedException(); }
+		}
+
+		int? IXrdsProviderEndpoint.UriPriority {
+			get { throw new System.NotImplementedException(); }
+		}
+
+		#endregion
+
+		#region IProviderEndpoint Properties
+
+		Version IProviderEndpoint.Version {
+			get { throw new System.NotImplementedException(); }
+		}
+
+		Uri IProviderEndpoint.Uri {
+			get { throw new System.NotImplementedException(); }
+		}
+
+		#endregion
+
+		#region IXrdsProviderEndpoint Methods
+
+		bool IXrdsProviderEndpoint.IsTypeUriPresent(string typeUri) {
+			throw new System.NotImplementedException();
+		}
+
+		#endregion
+
+		#region IProviderEndpoint Methods
+
+		bool IProviderEndpoint.IsExtensionSupported<T>() {
+			throw new System.NotImplementedException();
+		}
+
+		bool IProviderEndpoint.IsExtensionSupported(System.Type extensionType) {
+			Contract.Requires<ArgumentNullException>(extensionType != null);
+			Contract.Requires<ArgumentException>(typeof(IOpenIdMessageExtension).IsAssignableFrom(extensionType), string.Format(CultureInfo.CurrentCulture, OpenIdStrings.TypeMustImplementX, typeof(IOpenIdMessageExtension).FullName));
+			throw new System.NotImplementedException();
+		}
+
+		#endregion
+	}
+}
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
index 3da4e1b..3c95770 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
@@ -19,6 +19,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System.ComponentModel;
 	using System.Diagnostics;
 	using System.Diagnostics.CodeAnalysis;
+	using System.Diagnostics.Contracts;
 	using System.Drawing.Design;
 	using System.Globalization;
 	using System.Linq;
@@ -400,7 +401,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value >= 0, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value >= 0);
 				this.ViewState[ColumnsViewStateKey] = value;
 			}
 		}
@@ -426,7 +427,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyNonZeroLength(value, "value");
+				Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(value));
 				this.ViewState[NameViewStateKey] = value ?? string.Empty;
 			}
 		}
@@ -442,7 +443,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value.TotalMilliseconds > 0, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value.TotalMilliseconds > 0);
 				this.ViewState[TimeoutViewStateKey] = value;
 			}
 		}
@@ -458,7 +459,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyArgumentInRange(value > 0, "value");
+				Contract.Requires<ArgumentOutOfRangeException>(value > 0);
 				this.ViewState[ThrottleViewStateKey] = value;
 			}
 		}
@@ -474,7 +475,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyNonZeroLength(value, "value");
+				Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(value));
 				this.ViewState[LogOnTextViewStateKey] = value ?? string.Empty;
 			}
 		}
@@ -500,7 +501,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				ErrorUtilities.VerifyNonZeroLength(value, "value");
+				Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(value));
 				this.ViewState[RetryTextViewStateKey] = value ?? string.Empty;
 			}
 		}
@@ -861,7 +862,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		[SuppressMessage("Microsoft.Design", "CA1004:GenericMethodsShouldProvideTypeParameter", Justification = "By design")]
 		public void RegisterClientScriptExtension<T>(string propertyName) where T : IClientScriptExtensionResponse {
-			ErrorUtilities.VerifyNonZeroLength(propertyName, "propertyName");
+			Contract.Requires(!String.IsNullOrEmpty(propertyName));
 			ErrorUtilities.VerifyArgumentNamed(!this.clientScriptExtensions.ContainsValue(propertyName), "propertyName", OpenIdStrings.ClientScriptExtensionPropertyNameCollision, propertyName);
 			foreach (var ext in this.clientScriptExtensions.Keys) {
 				ErrorUtilities.VerifyArgument(ext != typeof(T), OpenIdStrings.ClientScriptExtensionTypeCollision, typeof(T).FullName);
@@ -887,9 +888,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="eventArgument">The identifier to perform discovery on.</param>
 		void ICallbackEventHandler.RaiseCallbackEvent(string eventArgument) {
+			ErrorUtilities.VerifyNonZeroLength(eventArgument, "eventArgument");
 			string userSuppliedIdentifier = eventArgument;
 
-			ErrorUtilities.VerifyNonZeroLength(userSuppliedIdentifier, "userSuppliedIdentifier");
 			Logger.OpenId.InfoFormat("AJAX discovery on {0} requested.", userSuppliedIdentifier);
 
 			// We prepare a JSON object with this interface:
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdEventArgs.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdEventArgs.cs
index 4d68fcc..5668cf4 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdEventArgs.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdEventArgs.cs
@@ -7,6 +7,7 @@
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.Generic;
+	using System.Diagnostics.Contracts;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Messaging;
@@ -21,7 +22,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="request">The outgoing authentication request.</param>
 		internal OpenIdEventArgs(IAuthenticationRequest request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			this.Request = request;
 			this.ClaimedIdentifier = request.ClaimedIdentifier;
@@ -35,7 +36,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The incoming authentication response.</param>
 		internal OpenIdEventArgs(IAuthenticationResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 
 			this.Response = response;
 			this.ClaimedIdentifier = response.ClaimedIdentifier;
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingParty.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingParty.cs
index 3effe7f..0327cba 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingParty.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingParty.cs
@@ -19,7 +19,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using DotNetOpenAuth.OpenId.ChannelElements;
 	using DotNetOpenAuth.OpenId.Extensions;
 	using DotNetOpenAuth.OpenId.Messages;
-	using System.Diagnostics.CodeAnalysis;
 
 	/// <summary>
 	/// A delegate that decides whether a given OpenID Provider endpoint may be
@@ -146,8 +145,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				Contract.RequiresAlways(value != null);
-				ErrorUtilities.VerifyArgumentNotNull(value, "value");
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.channel = value;
 				this.AssociationManager.Channel = value;
 			}
@@ -163,7 +161,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			internal set {
-				Contract.Requires(value != null);
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.securitySettings = value;
 				this.AssociationManager.SecuritySettings = value;
 			}
@@ -196,7 +194,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			}
 
 			set {
-				Contract.RequiresAlways(value != null);
+				Contract.Requires<ArgumentNullException>(value != null);
 				this.endpointOrder = value;
 			}
 		}
@@ -251,9 +249,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </returns>
 		/// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
 		public IAuthenticationRequest CreateRequest(Identifier userSuppliedIdentifier, Realm realm, Uri returnToUrl) {
-			Contract.Requires(userSuppliedIdentifier != null);
-			Contract.Requires(realm != null);
-			Contract.Requires(returnToUrl != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
+			Contract.Requires<ArgumentNullException>(returnToUrl != null);
 			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				return this.CreateRequests(userSuppliedIdentifier, realm, returnToUrl).First();
@@ -284,8 +282,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IAuthenticationRequest CreateRequest(Identifier userSuppliedIdentifier, Realm realm) {
-			Contract.Requires(userSuppliedIdentifier != null);
-			Contract.Requires(realm != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
 			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				var result = this.CreateRequests(userSuppliedIdentifier, realm).First();
@@ -313,7 +311,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <exception cref="ProtocolException">Thrown if no OpenID endpoint could be found.</exception>
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IAuthenticationRequest CreateRequest(Identifier userSuppliedIdentifier) {
-			Contract.Requires(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
 			Contract.Ensures(Contract.Result<IAuthenticationRequest>() != null);
 			try {
 				return this.CreateRequests(userSuppliedIdentifier).First();
@@ -350,9 +348,9 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// An empty enumerable is returned instead.</para>
 		/// </remarks>
 		public IEnumerable<IAuthenticationRequest> CreateRequests(Identifier userSuppliedIdentifier, Realm realm, Uri returnToUrl) {
-			Contract.Requires(userSuppliedIdentifier != null);
-			Contract.Requires(realm != null);
-			Contract.Requires(returnToUrl != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
+			Contract.Requires<ArgumentNullException>(returnToUrl != null);
 			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
 			ErrorUtilities.VerifyArgumentNotNull(realm, "realm");
 			ErrorUtilities.VerifyArgumentNotNull(returnToUrl, "returnToUrl");
@@ -386,8 +384,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IEnumerable<IAuthenticationRequest> CreateRequests(Identifier userSuppliedIdentifier, Realm realm) {
-			Contract.Requires(userSuppliedIdentifier != null);
-			Contract.Requires(realm != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(realm != null);
 			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
 			Contract.Ensures(Contract.ForAll(Contract.Result<IEnumerable<IAuthenticationRequest>>(), el => el != null));
 
@@ -432,7 +430,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </remarks>
 		/// <exception cref="InvalidOperationException">Thrown if <see cref="HttpContext.Current">HttpContext.Current</see> == <c>null</c>.</exception>
 		public IEnumerable<IAuthenticationRequest> CreateRequests(Identifier userSuppliedIdentifier) {
-			Contract.Requires(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
 			Contract.Ensures(Contract.Result<IEnumerable<IAuthenticationRequest>>() != null);
 			ErrorUtilities.VerifyHttpContext();
 
@@ -453,19 +451,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			return this.CreateRequests(userSuppliedIdentifier, new Realm(realmUrl.Uri));
 		}
 
-#if CONTRACTS_FULL
-		/// <summary>
-		/// Verifies conditions that should be true for any valid state of this object.
-		/// </summary>
-		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
-		[ContractInvariantMethod]
-		private void ObjectInvariant() {
-			Contract.Invariant(this.SecuritySettings != null);
-			Contract.Invariant(this.Channel != null);
-			Contract.Invariant(this.EndpointOrder != null);
-		}
-#endif
-	
 		/// <summary>
 		/// Gets an authentication response from a Provider.
 		/// </summary>
@@ -483,7 +468,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="httpRequestInfo">The HTTP request that may be carrying an authentication response from the Provider.</param>
 		/// <returns>The processed authentication response if there is any; <c>null</c> otherwise.</returns>
 		public IAuthenticationResponse GetResponse(HttpRequestInfo httpRequestInfo) {
-			Contract.Requires(httpRequestInfo != null);
+			Contract.Requires<ArgumentNullException>(httpRequestInfo != null);
 			try {
 				var message = this.Channel.ReadFromRequest(httpRequestInfo);
 				PositiveAssertionResponse positiveAssertion;
@@ -559,5 +544,19 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 				}
 			}
 		}
+
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		private void ObjectInvariant() {
+			Contract.Invariant(this.SecuritySettings != null);
+			Contract.Invariant(this.Channel != null);
+			Contract.Invariant(this.EndpointOrder != null);
+		}
+#endif
 	}
 }
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdTextBox.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdTextBox.cs
index 0c87b1f..22b740f 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdTextBox.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdTextBox.cs
@@ -1109,7 +1109,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		protected virtual void OnLoggedIn(IAuthenticationResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			ErrorUtilities.VerifyInternal(response.Status == AuthenticationStatus.Authenticated, "Firing OnLoggedIn event without an authenticated response.");
 
 			var loggedIn = this.LoggedIn;
@@ -1128,7 +1128,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		protected virtual void OnFailed(IAuthenticationResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			ErrorUtilities.VerifyInternal(response.Status == AuthenticationStatus.Failed, "Firing Failed event for the wrong response type.");
 
 			var failed = this.Failed;
@@ -1142,7 +1142,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		protected virtual void OnCanceled(IAuthenticationResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			ErrorUtilities.VerifyInternal(response.Status == AuthenticationStatus.Canceled, "Firing Canceled event for the wrong response type.");
 
 			var canceled = this.Canceled;
@@ -1156,7 +1156,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The response.</param>
 		protected virtual void OnSetupRequired(IAuthenticationResponse response) {
-			ErrorUtilities.VerifyArgumentNotNull(response, "response");
+			Contract.Requires<ArgumentNullException>(response != null);
 			ErrorUtilities.VerifyInternal(response.Status == AuthenticationStatus.SetupRequired, "Firing SetupRequired event for the wrong response type.");
 
 			// Why are we firing Failed when we're OnSetupRequired?  Backward compatibility.
@@ -1174,7 +1174,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="request">The authentication request to add the extensions to.</param>
 		private void AddProfileArgs(IAuthenticationRequest request) {
-			ErrorUtilities.VerifyArgumentNotNull(request, "request");
+			Contract.Requires<ArgumentNullException>(request != null);
 
 			request.AddExtension(new ClaimsRequest() {
 				Nickname = this.RequestNickname,
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAnonymousResponse.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAnonymousResponse.cs
index a28de12..cc81c99 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAnonymousResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAnonymousResponse.cs
@@ -28,7 +28,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// </summary>
 		/// <param name="response">The response message.</param>
 		protected internal PositiveAnonymousResponse(IndirectSignedResponse response) {
-			Contract.Requires(response != null);
+			Contract.Requires<ArgumentNullException>(response != null);
 			ErrorUtilities.VerifyArgumentNotNull(response, "response");
 
 			this.response = response;
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAuthenticationResponse.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
index e3740db..06e4d67 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/PositiveAuthenticationResponse.cs
@@ -5,6 +5,7 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
+	using System;
 	using System.Diagnostics;
 	using System.Diagnostics.Contracts;
 	using System.Linq;
@@ -36,7 +37,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="relyingParty">The relying party.</param>
 		internal PositiveAuthenticationResponse(PositiveAssertionResponse response, OpenIdRelyingParty relyingParty)
 			: base(response) {
-			Contract.Requires(relyingParty != null);
+			Contract.Requires<ArgumentNullException>(relyingParty != null);
 			ErrorUtilities.VerifyArgumentNotNull(relyingParty, "relyingParty");
 
 			this.endpoint = ServiceEndpoint.CreateForClaimedIdentifier(
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/PrivateSecretManager.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/PrivateSecretManager.cs
index 0895d77..6d55e39 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/PrivateSecretManager.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/PrivateSecretManager.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
+	using System.Diagnostics.Contracts;
 	using DotNetOpenAuth.Configuration;
 	using DotNetOpenAuth.Messaging;
 
@@ -43,8 +44,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="securitySettings">The security settings.</param>
 		/// <param name="store">The association store.</param>
 		internal PrivateSecretManager(RelyingPartySecuritySettings securitySettings, IAssociationStore<Uri> store) {
-			ErrorUtilities.VerifyArgumentNotNull(securitySettings, "securitySettings");
-			ErrorUtilities.VerifyArgumentNotNull(store, "store");
+			Contract.Requires<ArgumentNullException>(securitySettings != null);
+			Contract.Requires<ArgumentNullException>(store != null);
 
 			this.securitySettings = securitySettings;
 			this.store = store;
@@ -74,8 +75,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <exception cref="ProtocolException">Thrown when an association with the given handle could not be found.
 		/// This most likely happens if the association was near the end of its life and the user took too long to log in.</exception>
 		internal byte[] Sign(byte[] buffer, string handle) {
-			ErrorUtilities.VerifyArgumentNotNull(buffer, "buffer");
-			ErrorUtilities.VerifyNonZeroLength(handle, "handle");
+			Contract.Requires<ArgumentNullException>(buffer != null);
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(handle));
 
 			Association association = this.store.GetAssociation(SecretUri, handle);
 			ErrorUtilities.VerifyProtocol(association != null, OpenIdStrings.PrivateRPSecretNotFound, handle);
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/ServiceEndpoint.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/ServiceEndpoint.cs
index a56d4e7..8ddcf27 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/ServiceEndpoint.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/ServiceEndpoint.cs
@@ -8,6 +8,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 	using System;
 	using System.Collections.ObjectModel;
 	using System.Diagnostics;
+	using System.Diagnostics.Contracts;
 	using System.Globalization;
 	using System.IO;
 	using System.Linq;
@@ -57,8 +58,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="servicePriority">The service priority.</param>
 		/// <param name="uriPriority">The URI priority.</param>
 		private ServiceEndpoint(ProviderEndpointDescription providerEndpoint, Identifier claimedIdentifier, Identifier userSuppliedIdentifier, Identifier providerLocalIdentifier, int? servicePriority, int? uriPriority) {
-			ErrorUtilities.VerifyArgumentNotNull(claimedIdentifier, "claimedIdentifier");
-			ErrorUtilities.VerifyArgumentNotNull(providerEndpoint, "providerEndpoint");
+			Contract.Requires<ArgumentNullException>(claimedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
 			this.ProviderDescription = providerEndpoint;
 			this.ClaimedIdentifier = claimedIdentifier;
 			this.UserSuppliedIdentifier = userSuppliedIdentifier;
@@ -79,10 +80,10 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Used for deserializing <see cref="ServiceEndpoint"/> from authentication responses.
 		/// </remarks>
 		private ServiceEndpoint(Uri providerEndpoint, Identifier claimedIdentifier, Identifier userSuppliedIdentifier, Identifier providerLocalIdentifier, Protocol protocol) {
-			ErrorUtilities.VerifyArgumentNotNull(providerEndpoint, "providerEndpoint");
-			ErrorUtilities.VerifyArgumentNotNull(claimedIdentifier, "claimedIdentifier");
-			ErrorUtilities.VerifyArgumentNotNull(providerLocalIdentifier, "providerLocalIdentifier");
-			ErrorUtilities.VerifyArgumentNotNull(protocol, "protocol");
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
+			Contract.Requires<ArgumentNullException>(claimedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(providerLocalIdentifier != null);
+			Contract.Requires<ArgumentNullException>(protocol != null);
 
 			this.ClaimedIdentifier = claimedIdentifier;
 			this.UserSuppliedIdentifier = userSuppliedIdentifier;
@@ -329,7 +330,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// 	<c>true</c> if the extension is supported; otherwise, <c>false</c>.
 		/// </returns>
 		public bool IsExtensionSupported(string extensionUri) {
-			ErrorUtilities.VerifyNonZeroLength(extensionUri, "extensionUri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(extensionUri));
 
 			ErrorUtilities.VerifyOperation(this.ProviderSupportedServiceTypeUris != null, OpenIdStrings.ExtensionLookupSupportUnavailable);
 			return this.ProviderSupportedServiceTypeUris.Contains(extensionUri);
@@ -343,7 +344,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// 	<c>true</c> if the extension is supported by this endpoint; otherwise, <c>false</c>.
 		/// </returns>
 		public bool IsExtensionSupported(IOpenIdMessageExtension extension) {
-			ErrorUtilities.VerifyArgumentNotNull(extension, "extension");
+			Contract.Requires<ArgumentNullException>(extension != null);
 
 			// Consider the primary case.
 			if (this.IsExtensionSupported(extension.TypeUri)) {
@@ -380,8 +381,6 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// 	<c>true</c> if the extension is supported by this endpoint; otherwise, <c>false</c>.
 		/// </returns>
 		public bool IsExtensionSupported(Type extensionType) {
-			ErrorUtilities.VerifyArgumentNotNull(extensionType, "extensionType");
-			ErrorUtilities.VerifyArgument(typeof(IOpenIdMessageExtension).IsAssignableFrom(extensionType), OpenIdStrings.TypeMustImplementX, typeof(IOpenIdMessageExtension).FullName);
 			var extension = (IOpenIdMessageExtension)Activator.CreateInstance(extensionType);
 			return this.IsExtensionSupported(extension);
 		}
@@ -479,7 +478,7 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// <param name="uriPriority">The URI priority.</param>
 		/// <returns>The created <see cref="ServiceEndpoint"/> instance</returns>
 		internal static ServiceEndpoint CreateForProviderIdentifier(Identifier providerIdentifier, ProviderEndpointDescription providerEndpoint, int? servicePriority, int? uriPriority) {
-			ErrorUtilities.VerifyArgumentNotNull(providerEndpoint, "providerEndpoint");
+			Contract.Requires<ArgumentNullException>(providerEndpoint != null);
 
 			Protocol protocol = Protocol.Detect(providerEndpoint.Capabilities);
 
diff --git a/src/DotNetOpenAuth/OpenId/UriIdentifier.cs b/src/DotNetOpenAuth/OpenId/UriIdentifier.cs
index 615dc9c..5c6ec39 100644
--- a/src/DotNetOpenAuth/OpenId/UriIdentifier.cs
+++ b/src/DotNetOpenAuth/OpenId/UriIdentifier.cs
@@ -43,7 +43,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="requireSslDiscovery">if set to <c>true</c> [require SSL discovery].</param>
 		internal UriIdentifier(string uri, bool requireSslDiscovery)
 			: base(requireSslDiscovery) {
-			ErrorUtilities.VerifyNonZeroLength(uri, "uri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(uri));
 			Uri canonicalUri;
 			bool schemePrepended;
 			if (!TryCanonicalize(uri, out canonicalUri, requireSslDiscovery, out schemePrepended)) {
@@ -70,7 +70,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="requireSslDiscovery">if set to <c>true</c> [require SSL discovery].</param>
 		internal UriIdentifier(Uri uri, bool requireSslDiscovery)
 			: base(requireSslDiscovery) {
-			ErrorUtilities.VerifyArgumentNotNull(uri, "uri");
+			Contract.Requires<ArgumentNullException>(uri != null);
 			if (!TryCanonicalize(new UriBuilder(uri), out uri)) {
 				throw new UriFormatException();
 			}
@@ -409,7 +409,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// </remarks>
 		private static bool TryCanonicalize(string uri, out Uri canonicalUri, bool forceHttpsDefaultScheme, out bool schemePrepended) {
 			Contract.Requires(!string.IsNullOrEmpty(uri));
-			ErrorUtilities.VerifyNonZeroLength(uri, "uri");
+			Contract.Requires<ArgumentException>(!String.IsNullOrEmpty(uri));
 
 			uri = uri.Trim();
 			canonicalUri = null;
@@ -454,6 +454,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		private void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/OpenId/XriIdentifier.cs b/src/DotNetOpenAuth/OpenId/XriIdentifier.cs
index 43e17e5..a6e3dfa 100644
--- a/src/DotNetOpenAuth/OpenId/XriIdentifier.cs
+++ b/src/DotNetOpenAuth/OpenId/XriIdentifier.cs
@@ -192,8 +192,8 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="userSuppliedIdentifier">The user supplied identifier, which may differ from this XRI instance due to multiple discovery steps.</param>
 		/// <returns>A list of service endpoints offered for this identifier.</returns>
 		internal IEnumerable<ServiceEndpoint> Discover(IDirectWebRequestHandler requestHandler, XriIdentifier userSuppliedIdentifier) {
-			Contract.Requires(requestHandler != null);
-			Contract.Requires(userSuppliedIdentifier != null);
+			Contract.Requires<ArgumentNullException>(requestHandler != null);
+			Contract.Requires<ArgumentNullException>(userSuppliedIdentifier != null);
 			return this.DownloadXrds(requestHandler).CreateServiceEndpoints(userSuppliedIdentifier);
 		}
 
@@ -239,7 +239,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <returns>The canonicalized form of the XRI.</returns>
 		/// <remarks>The canonical form, per the OpenID spec, is no scheme and no whitespace on either end.</remarks>
 		private static string CanonicalizeXri(string xri) {
-			Contract.Requires(xri != null);
+			Contract.Requires<ArgumentNullException>(xri != null);
 			Contract.Ensures(Contract.Result<string>() != null);
 			xri = xri.Trim();
 			if (xri.StartsWith(XriScheme, StringComparison.OrdinalIgnoreCase)) {
@@ -255,7 +255,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <param name="requestHandler">The request handler.</param>
 		/// <returns>The XRDS document.</returns>
 		private XrdsDocument DownloadXrds(IDirectWebRequestHandler requestHandler) {
-			Contract.Requires(requestHandler != null);
+			Contract.Requires<ArgumentNullException>(requestHandler != null);
 			Contract.Ensures(Contract.Result<XrdsDocument>() != null);
 			XrdsDocument doc;
 			using (var xrdsResponse = Yadis.Request(requestHandler, this.XrdsUrl, this.IsDiscoverySecureEndToEnd)) {
@@ -269,6 +269,7 @@ namespace DotNetOpenAuth.OpenId {
 		/// <summary>
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
 		private void ObjectInvariant() {
diff --git a/src/DotNetOpenAuth/Properties/AssemblyInfo.cs b/src/DotNetOpenAuth/Properties/AssemblyInfo.cs
index 69d4dc4..51d146c 100644
--- a/src/DotNetOpenAuth/Properties/AssemblyInfo.cs
+++ b/src/DotNetOpenAuth/Properties/AssemblyInfo.cs
@@ -58,7 +58,7 @@ using System.Web.UI;
 // The following GUID is for the ID of the typelib if this project is exposed to COM
 [assembly: Guid("7d73990c-47c0-4256-9f20-a893add9e289")]
 
-[assembly: ContractVerification(false)]
+[assembly: ContractVerification(true)]
 
 #if StrongNameSigned
 // See comment at top of this file.  We need this so that strong-naming doesn't
diff --git a/src/DotNetOpenAuth/UriUtil.cs b/src/DotNetOpenAuth/UriUtil.cs
index 19a5380..22e5f18 100644
--- a/src/DotNetOpenAuth/UriUtil.cs
+++ b/src/DotNetOpenAuth/UriUtil.cs
@@ -48,7 +48,7 @@ namespace DotNetOpenAuth {
 		/// 	<c>true</c> if the URI represents an encrypted request; otherwise, <c>false</c>.
 		/// </returns>
 		internal static bool IsTransportSecure(this Uri uri) {
-			Contract.Requires(uri != null);
+			Contract.Requires<ArgumentNullException>(uri != null);
 			return string.Equals(uri.Scheme, "https", StringComparison.OrdinalIgnoreCase);
 		}
 
@@ -59,7 +59,7 @@ namespace DotNetOpenAuth {
 		/// <param name="builder">The UriBuilder to render as a string.</param>
 		/// <returns>The string version of the Uri.</returns>
 		internal static string ToStringWithImpliedPorts(this UriBuilder builder) {
-			Contract.Requires(builder != null);
+			Contract.Requires<ArgumentNullException>(builder != null);
 			Contract.Ensures(Contract.Result<string>() != null);
 
 			// We only check for implied ports on HTTP and HTTPS schemes since those
diff --git a/src/DotNetOpenAuth/Util.cs b/src/DotNetOpenAuth/Util.cs
index 4d0008c..603ed96 100644
--- a/src/DotNetOpenAuth/Util.cs
+++ b/src/DotNetOpenAuth/Util.cs
@@ -172,7 +172,7 @@ namespace DotNetOpenAuth {
 			/// <param name="obj">The object that may be serialized to string form.</param>
 			/// <param name="toString">The method that will serialize the object if called upon.</param>
 			public DelayedToString(T obj, Func<T, string> toString) {
-				Contract.Requires(toString != null);
+				Contract.Requires<ArgumentNullException>(toString != null);
 
 				this.obj = obj;
 				this.toString = toString;
diff --git a/src/DotNetOpenAuth/Xrds/XrdsNode.cs b/src/DotNetOpenAuth/Xrds/XrdsNode.cs
index e27a1b2..5e7d7e7 100644
--- a/src/DotNetOpenAuth/Xrds/XrdsNode.cs
+++ b/src/DotNetOpenAuth/Xrds/XrdsNode.cs
@@ -5,6 +5,8 @@
 //-----------------------------------------------------------------------
 
 namespace DotNetOpenAuth.Xrds {
+	using System;
+	using System.Diagnostics.Contracts;
 	using System.Xml;
 	using System.Xml.XPath;
 	using DotNetOpenAuth.Messaging;
@@ -29,8 +31,8 @@ namespace DotNetOpenAuth.Xrds {
 		/// <param name="node">The node represented by this instance.</param>
 		/// <param name="parentNode">The parent node.</param>
 		protected XrdsNode(XPathNavigator node, XrdsNode parentNode) {
-			ErrorUtilities.VerifyArgumentNotNull(node, "node");
-			ErrorUtilities.VerifyArgumentNotNull(parentNode, "parentNode");
+			Contract.Requires<ArgumentNullException>(node != null);
+			Contract.Requires<ArgumentNullException>(parentNode != null);
 
 			this.Node = node;
 			this.ParentNode = parentNode;
@@ -42,7 +44,7 @@ namespace DotNetOpenAuth.Xrds {
 		/// </summary>
 		/// <param name="document">The document's root node, which this instance represents.</param>
 		protected XrdsNode(XPathNavigator document) {
-			ErrorUtilities.VerifyArgumentNotNull(document, "document");
+			Contract.Requires<ArgumentNullException>(document != null);
 
 			this.Node = document;
 			this.XmlNamespaceResolver = new XmlNamespaceManager(document.NameTable);
diff --git a/src/DotNetOpenAuth/Yadis/Yadis.cs b/src/DotNetOpenAuth/Yadis/Yadis.cs
index 0caffb6..cce8836 100644
--- a/src/DotNetOpenAuth/Yadis/Yadis.cs
+++ b/src/DotNetOpenAuth/Yadis/Yadis.cs
@@ -6,6 +6,7 @@
 
 namespace DotNetOpenAuth.Yadis {
 	using System;
+	using System.Diagnostics.Contracts;
 	using System.IO;
 	using System.Net;
 	using System.Net.Cache;
@@ -131,8 +132,8 @@ namespace DotNetOpenAuth.Yadis {
 		/// <param name="acceptTypes">The value of the Accept HTTP header to include in the request.</param>
 		/// <returns>The HTTP response retrieved from the request.</returns>
 		internal static IncomingWebResponse Request(IDirectWebRequestHandler requestHandler, Uri uri, bool requireSsl, params string[] acceptTypes) {
-			ErrorUtilities.VerifyArgumentNotNull(requestHandler, "requestHandler");
-			ErrorUtilities.VerifyArgumentNotNull(uri, "uri");
+			Contract.Requires<ArgumentNullException>(requestHandler != null);
+			Contract.Requires<ArgumentNullException>(uri != null);
 
 			HttpWebRequest request = (HttpWebRequest)WebRequest.Create(uri);
 			request.CachePolicy = IdentifierDiscoveryCachePolicy;