diff --git a/src/addcontactpanel.cpp b/src/addcontactpanel.cpp
index 8b9d66b..012ae4f 100644
--- a/src/addcontactpanel.cpp
+++ b/src/addcontactpanel.cpp
@@ -11,10 +11,11 @@
 #include "addcontactpanel.h"
 #include "ui_addcontactpanel.h"
 
-AddContactPanel::AddContactPanel(QWidget *parent) 
+AddContactPanel::AddContactPanel(ndn::Ptr<ContactManager> contactManager,
+                                 QWidget *parent) 
   : QDialog(parent)
   , ui(new Ui::AddContactPanel)
-  , m_selfEndorseCertificate(NULL)
+  , m_contactManager(contactManager)
 {
   ui->setupUi(this);
 
diff --git a/src/addcontactpanel.h b/src/addcontactpanel.h
index 9a5fe75..1da3788 100644
--- a/src/addcontactpanel.h
+++ b/src/addcontactpanel.h
@@ -15,6 +15,7 @@
 
 #ifndef Q_MOC_RUN
 #include "endorse-certificate.h"
+#include "contact-manager.h"
 #endif
 
 namespace Ui {
@@ -23,11 +24,13 @@
 
 class AddContactPanel : public QDialog
 {
-    Q_OBJECT
+  Q_OBJECT
 
 public:
-    explicit AddContactPanel(QWidget *parent = 0);
-    ~AddContactPanel();
+  explicit AddContactPanel(ndn::Ptr<ContactManager> contactManager,
+                           QWidget *parent = 0);
+
+  ~AddContactPanel();
 
 private slots:
   void
@@ -41,7 +44,7 @@
 
 private:
   Ui::AddContactPanel *ui;
-  ndn::Ptr<EndorseCertificate> m_selfEndorseCertificate;
+  ndn::Ptr<ContactManager> m_contactManager;
 };
 
 #endif // ADDCONTACTPANEL_H
diff --git a/src/contact-manager.cpp b/src/contact-manager.cpp
new file mode 100644
index 0000000..0ebd2e3
--- /dev/null
+++ b/src/contact-manager.cpp
@@ -0,0 +1,74 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
+/*
+ * Copyright (c) 2013, Regents of the University of California
+ *                     Yingdi Yu
+ *
+ * BSD license, See the LICENSE file for more information
+ *
+ * Author: Yingdi Yu <yingdi@cs.ucla.edu>
+ */
+
+#include "contact-manager.h"
+
+#include <ndn.cxx/wrapper/wrapper.h>
+#include <ndn.cxx/security/keychain.h>
+#include <ndn.cxx/security/identity/basic-identity-storage.h>
+#include <ndn.cxx/security/identity/osx-privatekey-storage.h>
+#include <ndn.cxx/security/policy/simple-policy-manager.h>
+#include <ndn.cxx/security/policy/identity-policy-rule.h>
+#include <ndn.cxx/security/cache/ttl-certificate-cache.h>
+#include <ndn.cxx/security/encryption/basic-encryption-manager.h>
+
+#include <fstream>
+
+using namespace ndn;
+using namespace ndn::security;
+
+ContactManager::ContactManager(Ptr<ContactStorage> contactStorage)
+  : m_contactStorage(contactStorage)
+{
+  
+  m_wrapper = Ptr<Wrapper>(new Wrapper(setKeychain()));
+}
+
+ContactManager::~ContactManager()
+{
+}
+
+Ptr<Keychain>
+ContactManager::setKeychain()
+{
+  Ptr<OSXPrivatekeyStorage> privateStorage = Ptr<OSXPrivatekeyStorage>::Create();
+  Ptr<IdentityManager> identityManager = Ptr<IdentityManager>(new IdentityManager(Ptr<BasicIdentityStorage>::Create(), privateStorage));
+  Ptr<TTLCertificateCache> certificateCache = Ptr<TTLCertificateCache>(new TTLCertificateCache());
+  Ptr<SimplePolicyManager> policyManager = Ptr<SimplePolicyManager>(new SimplePolicyManager(10, certificateCache));
+  Ptr<EncryptionManager> encryptionManager = Ptr<EncryptionManager>(new BasicEncryptionManager(privateStorage, "/tmp/encryption.db"));
+  Ptr<Keychain> keychain = Ptr<Keychain>(new Keychain(identityManager, policyManager, encryptionManager));
+
+  policyManager->addVerificationPolicyRule(Ptr<IdentityPolicyRule>(new IdentityPolicyRule("^([^<PROFILE-CERT>]*)<PROFILE-CERT>",
+											  "^([^<KEY>]*)<KEY>(<>*<KSK-.*>)<ID-CERT>", 
+											  "==", "\\1", "\\1\\2", false)));
+  policyManager->addVerificationPolicyRule(Ptr<IdentityPolicyRule>(new IdentityPolicyRule("^([^<KEY>]*)<KEY>(<>*)<KSK-.*><ID-CERT>",
+											  "^([^<KEY>]*)<KEY><DSK-.*><ID-CERT>",
+											  ">", "\\1\\2", "\\1", false)));
+  policyManager->addVerificationPolicyRule(Ptr<IdentityPolicyRule>(new IdentityPolicyRule("^([^<KEY>]*)<KEY><DSK-.*><ID-CERT>",
+											  "^([^<KEY>]*)<KEY>(<>*)<KSK-.*><ID-CERT>",
+											  "==", "\\1", "\\1\\2", false)));
+
+  ifstream is ("trust-anchor.data", ios::binary);
+  is.seekg (0, ios::end);
+  ifstream::pos_type size = is.tellg();
+  char * memblock = new char [size];    
+  is.seekg (0, ios::beg);
+  is.read (memblock, size);
+  is.close();
+
+  Ptr<Blob> readBlob = Ptr<Blob>(new Blob(memblock, size));
+  Ptr<Data> readData = Data::decodeFromWire (readBlob);
+  Ptr<IdentityCertificate> anchor = Ptr<IdentityCertificate>(new IdentityCertificate(*readData));   
+  policyManager->addTrustAnchor(anchor);  
+  
+  delete memblock;
+
+  return keychain;
+}
diff --git a/src/contact-manager.h b/src/contact-manager.h
new file mode 100644
index 0000000..ddf8489
--- /dev/null
+++ b/src/contact-manager.h
@@ -0,0 +1,41 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
+/*
+ * Copyright (c) 2013, Regents of the University of California
+ *                     Yingdi Yu
+ *
+ * BSD license, See the LICENSE file for more information
+ *
+ * Author: Yingdi Yu <yingdi@cs.ucla.edu>
+ */
+
+#ifndef LINKNDN_CONTACT_MANAGER_H
+#define LINKNDN_CONTACT_MANAGER_H
+
+#include "contact-storage.h"
+#include "ndn.cxx/wrapper/wrapper.h"
+
+class ContactManager
+{
+public:
+  ContactManager(ndn::Ptr<ContactStorage> contactStorage);
+
+  ~ContactManager();
+
+  inline ndn::Ptr<ContactStorage>
+  getContactStorage()
+  { return m_contactStorage; }
+
+  inline ndn::Ptr<ndn::Wrapper>
+  getWrapper()
+  { return m_wrapper; }
+
+private:
+  ndn::Ptr<ndn::security::Keychain>
+  setKeychain();
+  
+private:
+  ndn::Ptr<ContactStorage> m_contactStorage;
+  ndn::Ptr<ndn::Wrapper> m_wrapper;
+};
+
+#endif
diff --git a/src/contact-storage.cpp b/src/contact-storage.cpp
index 21fcf51..3197d9c 100644
--- a/src/contact-storage.cpp
+++ b/src/contact-storage.cpp
@@ -454,6 +454,7 @@
 
   Ptr<security::IdentityCertificate> dskCert = m_identityManager->getCertificate(certificateName);
   Ptr<const signature::Sha256WithRsa> dskCertSig = boost::dynamic_pointer_cast<const signature::Sha256WithRsa>(dskCert->getSignature());
+  // HACK! KSK certificate should be retrieved from network.
   Ptr<security::IdentityCertificate> kskCert = m_identityManager->getCertificate(dskCertSig->getKeyLocator().getKeyName());
 
   vector<string> endorseList;
diff --git a/src/contactpanel.cpp b/src/contactpanel.cpp
index 985d0a8..37cd13e 100644
--- a/src/contactpanel.cpp
+++ b/src/contactpanel.cpp
@@ -28,12 +28,12 @@
 
 INIT_LOGGER("ContactPanel");
 
-ContactPanel::ContactPanel(Ptr<ContactStorage> contactStorage, QWidget *parent) 
+ContactPanel::ContactPanel(Ptr<ContactManager> contactManager, QWidget *parent) 
     : QDialog(parent)
     , ui(new Ui::ContactPanel)
-    , m_contactStorage(contactStorage)
+    , m_contactManager(contactManager)
     , m_contactListModel(new QStringListModel)
-    , m_addContactPanel(new AddContactPanel())
+    , m_addContactPanel(new AddContactPanel(contactManager))
 {
   
     ui->setupUi(this);
@@ -44,7 +44,7 @@
     db.setDatabaseName(path);
     bool ok = db.open();
 
-    m_profileEditor = new ProfileEditor(m_contactStorage);
+    m_profileEditor = new ProfileEditor(m_contactManager->getContactStorage());
 
     QStringList contactNameList;
     contactNameList << "Alex" << "Wentao" << "Yingdi";
diff --git a/src/contactpanel.h b/src/contactpanel.h
index 4dd78d3..5e20ee5 100644
--- a/src/contactpanel.h
+++ b/src/contactpanel.h
@@ -19,7 +19,7 @@
 #include "addcontactpanel.h"
 
 #ifndef Q_MOC_RUN
-#include "contact-storage.h"
+#include "contact-manager.h"
 #endif
 
 namespace Ui {
@@ -31,7 +31,7 @@
     Q_OBJECT
 
 public:
-  explicit ContactPanel(ndn::Ptr<ContactStorage> contactStorage, QWidget *parent = 0);
+  explicit ContactPanel(ndn::Ptr<ContactManager> contactManager, QWidget *parent = 0);
   ~ContactPanel();
 
 private slots:
@@ -47,7 +47,7 @@
 
 private:
   Ui::ContactPanel *ui;
-  ndn::Ptr<ContactStorage> m_contactStorage;
+  ndn::Ptr<ContactManager> m_contactManager;
   QStringListModel* m_contactListModel;
   ProfileEditor* m_profileEditor;
   AddContactPanel* m_addContactPanel;
diff --git a/src/main.cpp b/src/main.cpp
index 7e60c8a..dbf3747 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -14,6 +14,7 @@
 #include "chronochat.h"
 #include "contactpanel.h"
 #include "contact-storage.h"
+#include "contact-manager.h"
 #include <ndn.cxx/security/identity/identity-manager.h>
 #include <ndn.cxx/security/identity/osx-privatekey-storage.h>
 #include <ndn.cxx/security/identity/basic-identity-storage.h>
@@ -34,7 +35,9 @@
   Ptr<security::OSXPrivatekeyStorage> privateStorage = Ptr<security::OSXPrivatekeyStorage>::Create();
   Ptr<security::IdentityManager> identityManager = Ptr<security::IdentityManager>(new security::IdentityManager(publicStorage, privateStorage));
   Ptr<ContactStorage> contactStorage = Ptr<ContactStorage>(new ContactStorage(identityManager));
-  ContactPanel contactPanel(contactStorage);
+  Ptr<ContactManager> contactManager = Ptr<ContactManager>(new ContactManager(contactStorage));
+  ContactPanel contactPanel(contactManager);
+
 
   contactPanel.show ();
   contactPanel.activateWindow ();