diff --git a/daemon/mgmt/command-authenticator.cpp b/daemon/mgmt/command-authenticator.cpp
index cd45b84..50e4434 100644
--- a/daemon/mgmt/command-authenticator.cpp
+++ b/daemon/mgmt/command-authenticator.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -26,7 +26,7 @@
 #include "command-authenticator.hpp"
 #include "core/logger.hpp"
 
-#include <ndn-cxx/security/identity-certificate.hpp>
+#include <ndn-cxx/security/v1/identity-certificate.hpp>
 #include <ndn-cxx/security/validator-null.hpp>
 #include <ndn-cxx/util/io.hpp>
 
@@ -38,6 +38,8 @@
 // INFO: configuration change, etc
 // DEBUG: per authentication request result
 
+using ndn::security::v1::IdentityCertificate;
+
 shared_ptr<CommandAuthenticator>
 CommandAuthenticator::create()
 {
@@ -89,7 +91,7 @@
     }
 
     bool isAny = false;
-    shared_ptr<ndn::IdentityCertificate> cert;
+    shared_ptr<IdentityCertificate> cert;
     if (certfile == "any") {
       isAny = true;
       NFD_LOG_WARN("'certfile any' is intended for demo purposes only and "
@@ -98,7 +100,7 @@
     else {
       using namespace boost::filesystem;
       path certfilePath = absolute(certfile, path(filename).parent_path());
-      cert = ndn::io::load<ndn::IdentityCertificate>(certfilePath.string());
+      cert = ndn::io::load<IdentityCertificate>(certfilePath.string());
       if (cert == nullptr) {
         BOOST_THROW_EXCEPTION(ConfigFile::Error(
           "cannot load certfile " + certfilePath.string() +
@@ -202,13 +204,13 @@
 CommandAuthenticator::extractKeyName(const Interest& interest)
 {
   const Name& name = interest.getName();
-  if (name.size() < ndn::signed_interest::MIN_LENGTH) {
+  if (name.size() < ndn::command_interest::MIN_SIZE) {
     return {false, Name()};
   }
 
   ndn::SignatureInfo sig;
   try {
-    sig.wireDecode(name[ndn::signed_interest::POS_SIG_INFO].blockFromValue());
+    sig.wireDecode(name[ndn::command_interest::POS_SIG_INFO].blockFromValue());
   }
   catch (const tlv::Error&) {
     return {false, Name()};
@@ -224,9 +226,9 @@
   }
 
   try {
-    return {true, ndn::IdentityCertificate::certificateNameToPublicKeyName(keyLocator.getName())};
+    return {true, IdentityCertificate::certificateNameToPublicKeyName(keyLocator.getName())};
   }
-  catch (const ndn::IdentityCertificate::Error&) {
+  catch (const IdentityCertificate::Error&) {
     return {false, Name()};
   }
 }
diff --git a/daemon/mgmt/command-authenticator.hpp b/daemon/mgmt/command-authenticator.hpp
index 69d0ec9..fe2e0b9 100644
--- a/daemon/mgmt/command-authenticator.hpp
+++ b/daemon/mgmt/command-authenticator.hpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2016,  Regents of the University of California,
+ * Copyright (c) 2014-2017,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -29,7 +29,7 @@
 #include "core/config-file.hpp"
 #include <ndn-cxx/mgmt/dispatcher.hpp>
 #include <ndn-cxx/security/command-interest-validator.hpp>
-#include <ndn-cxx/security/public-key.hpp>
+#include <ndn-cxx/security/v1/public-key.hpp>
 
 namespace nfd {
 
@@ -68,7 +68,7 @@
   struct AuthorizedCerts
   {
     bool allowAny = false;
-    std::unordered_map<Name, ndn::PublicKey> certs; ///< keyName => publicKey
+    std::unordered_map<Name, ndn::security::v1::PublicKey> certs; ///< keyName => publicKey
   };
   std::unordered_map<std::string, AuthorizedCerts> m_moduleAuth; ///< module => certs
 
diff --git a/daemon/mgmt/face-manager.cpp b/daemon/mgmt/face-manager.cpp
index b66a939..9be7c94 100644
--- a/daemon/mgmt/face-manager.cpp
+++ b/daemon/mgmt/face-manager.cpp
@@ -51,12 +51,6 @@
   registerCommandHandler<ndn::nfd::FaceDestroyCommand>("destroy",
     bind(&FaceManager::destroyFace, this, _2, _3, _4, _5));
 
-  registerCommandHandler<ndn::nfd::FaceEnableLocalControlCommand>("enable-local-control",
-    bind(&FaceManager::enableLocalControl, this, _2, _3, _4, _5));
-
-  registerCommandHandler<ndn::nfd::FaceDisableLocalControlCommand>("disable-local-control",
-    bind(&FaceManager::disableLocalControl, this, _2, _3, _4, _5));
-
   // register handlers for StatusDataset
   registerStatusDatasetHandler("list", bind(&FaceManager::listFaces, this, _1, _2, _3));
   registerStatusDatasetHandler("channels", bind(&FaceManager::listChannels, this, _1, _2, _3));
@@ -240,81 +234,6 @@
 }
 
 void
-FaceManager::enableLocalControl(const Name& topPrefix, const Interest& interest,
-                                const ControlParameters& parameters,
-                                const ndn::mgmt::CommandContinuation& done)
-{
-  Face* face = findFaceForLocalControl(interest, parameters, done);
-  if (!face) {
-    return;
-  }
-
-  // enable-local-control will enable all local fields in GenericLinkService
-  auto service = dynamic_cast<face::GenericLinkService*>(face->getLinkService());
-  if (service == nullptr) {
-    return done(ControlResponse(503, "LinkService type not supported"));
-  }
-
-  face::GenericLinkService::Options options = service->getOptions();
-  options.allowLocalFields = true;
-  service->setOptions(options);
-
-  return done(ControlResponse(200, "OK: enable all local fields on GenericLinkService")
-              .setBody(parameters.wireEncode()));
-}
-
-void
-FaceManager::disableLocalControl(const Name& topPrefix, const Interest& interest,
-                                 const ControlParameters& parameters,
-                                 const ndn::mgmt::CommandContinuation& done)
-{
-  Face* face = findFaceForLocalControl(interest, parameters, done);
-  if (!face) {
-    return;
-  }
-
-  // disable-local-control will disable all local fields in GenericLinkService
-  auto service = dynamic_cast<face::GenericLinkService*>(face->getLinkService());
-  if (service == nullptr) {
-    return done(ControlResponse(503, "LinkService type not supported"));
-  }
-
-  face::GenericLinkService::Options options = service->getOptions();
-  options.allowLocalFields = false;
-  service->setOptions(options);
-
-  return done(ControlResponse(200, "OK: disable all local fields on GenericLinkService")
-              .setBody(parameters.wireEncode()));
-}
-
-Face*
-FaceManager::findFaceForLocalControl(const Interest& request,
-                                     const ControlParameters& parameters,
-                                     const ndn::mgmt::CommandContinuation& done)
-{
-  shared_ptr<lp::IncomingFaceIdTag> incomingFaceIdTag = request.getTag<lp::IncomingFaceIdTag>();
-  // NDNLPv2 says "application MUST be prepared to receive a packet without IncomingFaceId field",
-  // but it's fine to assert IncomingFaceId is available, because InternalFace lives inside NFD
-  // and is initialized synchronously with IncomingFaceId field enabled.
-  BOOST_ASSERT(incomingFaceIdTag != nullptr);
-
-  Face* face = m_faceTable.get(*incomingFaceIdTag);
-  if (face == nullptr) {
-    NFD_LOG_DEBUG("FaceId " << *incomingFaceIdTag << " not found");
-    done(ControlResponse(410, "Face not found"));
-    return nullptr;
-  }
-
-  if (face->getScope() == ndn::nfd::FACE_SCOPE_NON_LOCAL) {
-    NFD_LOG_DEBUG("Cannot enable local control on non-local FaceId " << face->getId());
-    done(ControlResponse(412, "Face is non-local"));
-    return nullptr;
-  }
-
-  return face;
-}
-
-void
 FaceManager::setLinkServiceOptions(Face& face,
                                    const ControlParameters& parameters,
                                    ControlParameters& response)
diff --git a/daemon/mgmt/face-manager.hpp b/daemon/mgmt/face-manager.hpp
index b7991b8..77e820c 100644
--- a/daemon/mgmt/face-manager.hpp
+++ b/daemon/mgmt/face-manager.hpp
@@ -36,7 +36,7 @@
 
 /**
  * @brief implement the Face Management of NFD Management Protocol.
- * @sa http://redmine.named-data.net/projects/nfd/wiki/FaceMgmt
+ * @sa https://redmine.named-data.net/projects/nfd/wiki/FaceMgmt
  */
 class FaceManager : public NfdManagerBase
 {
@@ -66,22 +66,6 @@
               const ControlParameters& parameters,
               const ndn::mgmt::CommandContinuation& done);
 
-  /**
-   * \deprecated use Flags+Mask in faces/update instead
-   */
-  void
-  enableLocalControl(const Name& topPrefix, const Interest& interest,
-                     const ControlParameters& parameters,
-                     const ndn::mgmt::CommandContinuation& done);
-
-  /**
-   * \deprecated use Flags+Mask in faces/update instead
-   */
-  void
-  disableLocalControl(const Name& topPrefix, const Interest& interest,
-                      const ControlParameters& parameters,
-                      const ndn::mgmt::CommandContinuation& done);
-
 PUBLIC_WITH_TESTS_ELSE_PRIVATE: // helpers for ControlCommand
   void
   afterCreateFaceSuccess(const ControlParameters& parameters,
@@ -93,11 +77,6 @@
                          const std::string& reason,
                          const ndn::mgmt::CommandContinuation& done);
 
-  Face*
-  findFaceForLocalControl(const Interest& request,
-                          const ControlParameters& parameters,
-                          const ndn::mgmt::CommandContinuation& done);
-
   static void
   setLinkServiceOptions(Face& face,
                         const ControlParameters& parameters,