diff --git a/docs/spec.rst b/docs/spec.rst
index b1733e4..30e398d 100644
--- a/docs/spec.rst
+++ b/docs/spec.rst
@@ -2,3 +2,43 @@
 =================
 
 TBD
+
+Terminology
+-----------
+
++-----------------+------------------------------------------------------------------------------------------+
+| Term            |  Description                                                                             |
++=================+==========================================================================================+
+| KEK             |  Key Encryption Key (RSA public key)                                                     |
++-----------------+------------------------------------------------------------------------------------------+
+| KDK             |  Key Decryption Key (RSA private key)                                                    |
++-----------------+------------------------------------------------------------------------------------------+
+| CK              |  Content Key (AES symmetric key)                                                         |
++-----------------+------------------------------------------------------------------------------------------+
+| CK data         |  Data packet carrying a KDK-encrypted CK as payoad                                       |
++-----------------+------------------------------------------------------------------------------------------+
+| Access Manager  |  (Data Owner) Entity that control access to the data associated with the namespace       |
++-----------------+------------------------------------------------------------------------------------------+
+| Encryptor       |  (Producer) Entity that encrypts data based on namespace association                     |
++-----------------+------------------------------------------------------------------------------------------+
+| Decryptor       |  (Consumer) Entity that decrypts data based on namespace association                     |
++-----------------+------------------------------------------------------------------------------------------+
+
+EncryptedContent
+-----------------
+
+The ``EncryptedContent`` element contains encrypted blob, optional Initial Vector (for AES CBC encryption),
+optional EncryptedPayloadKey, and Name elements.
+
+::
+
+     EncryptedContent ::= ENCRYPTED-CONTENT-TYPE TLV-LENGTH
+                            EncryptedPayload
+                            InitialVector
+                            EncryptedPayloadKey
+                            Name
+
+     InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+     EncryptedPayload ::= ENCRYPTED-PAYLOAD-TYPE TLV-LENGTH(=N) BYTE{N}
+     EncryptedPayloadKey ::= ENCRYPTED-PAYLOAD-KEY-TYPE TLV-LENGTH(=N) BYTE{N}
+     InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
diff --git a/src/encrypted-content.cpp b/src/encrypted-content.cpp
new file mode 100644
index 0000000..a2ca2a4
--- /dev/null
+++ b/src/encrypted-content.cpp
@@ -0,0 +1,230 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * NAC library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of NAC library authors and contributors.
+ */
+
+#include "encrypted-content.hpp"
+
+#include <ndn-cxx/encoding/block-helpers.hpp>
+#include <ndn-cxx/util/concepts.hpp>
+
+namespace ndn {
+namespace nac {
+
+BOOST_CONCEPT_ASSERT((boost::EqualityComparable<EncryptedContent>));
+BOOST_CONCEPT_ASSERT((WireEncodable<EncryptedContent>));
+BOOST_CONCEPT_ASSERT((WireDecodable<EncryptedContent>));
+static_assert(std::is_base_of<ndn::tlv::Error, EncryptedContent::Error>::value,
+              "EncryptedContent::Error must inherit from tlv::Error");
+
+EncryptedContent::EncryptedContent(const Block& block)
+{
+  wireDecode(block);
+}
+
+EncryptedContent&
+EncryptedContent::setPayload(Block payload)
+{
+  m_wire.reset();
+  if (payload.type() != tlv::EncryptedPayload) {
+    m_payload = Block(tlv::EncryptedPayload, std::move(payload));
+  }
+  else {
+    m_payload = std::move(payload);
+  }
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayload(ConstBufferPtr payload)
+{
+  m_wire.reset();
+  m_payload = Block(tlv::EncryptedPayload, std::move(payload));
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setIv(Block iv)
+{
+  m_wire.reset();
+  if (iv.type() != tlv::InitialVector) {
+    m_iv = Block(tlv::InitialVector, std::move(iv));
+  }
+  else {
+    m_iv = std::move(iv);
+  }
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setIv(ConstBufferPtr iv)
+{
+  m_wire.reset();
+  m_iv = Block(tlv::InitialVector, iv);
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetIv()
+{
+  m_wire.reset();
+  m_iv = Block();
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayloadKey(Block key)
+{
+  m_wire.reset();
+  if (key.type() != tlv::EncryptedPayloadKey) {
+    m_payloadKey = Block(tlv::EncryptedPayloadKey, std::move(key));
+  }
+  else {
+    m_payloadKey = std::move(key);
+  }
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setPayloadKey(ConstBufferPtr key)
+{
+  m_wire.reset();
+  m_payloadKey = Block(tlv::EncryptedPayloadKey, std::move(key));
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetPayloadKey()
+{
+  m_wire.reset();
+  m_payloadKey = Block();
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::setKeyLocator(Name keyLocator)
+{
+  m_wire.reset();
+  m_keyLocator = std::move(keyLocator);
+  return *this;
+}
+
+EncryptedContent&
+EncryptedContent::unsetKeyLocator()
+{
+  m_wire.reset();
+  m_keyLocator = Name();
+  return *this;
+}
+
+template<encoding::Tag TAG>
+size_t
+EncryptedContent::wireEncode(EncodingImpl<TAG>& block) const
+{
+  size_t totalLength = 0;
+
+  if (!m_keyLocator.empty()) {
+    totalLength += m_keyLocator.wireEncode(block);
+  }
+
+  if (!m_payloadKey.empty()) {
+    totalLength += block.prependBlock(m_payloadKey);
+  }
+
+  if (!m_iv.empty()) {
+    totalLength += block.prependBlock(m_iv);
+  }
+
+  if (!m_payload.empty()) {
+    totalLength += block.prependBlock(m_payload);
+  }
+  else {
+    BOOST_THROW_EXCEPTION(Error("Required EncryptedPayload is not set on EncryptedContent"));
+  }
+
+  totalLength += block.prependVarNumber(totalLength);
+  totalLength += block.prependVarNumber(tlv::EncryptedContent);
+  return totalLength;
+}
+
+const Block&
+EncryptedContent::wireEncode() const
+{
+  if (m_wire.hasWire())
+    return m_wire;
+
+  EncodingEstimator estimator;
+  size_t estimatedSize = wireEncode(estimator);
+
+  EncodingBuffer buffer(estimatedSize, 0);
+  wireEncode(buffer);
+
+  m_wire = buffer.block();
+  return m_wire;
+}
+
+void
+EncryptedContent::wireDecode(const Block& wire)
+{
+  if (!wire.hasWire()) {
+    BOOST_THROW_EXCEPTION(Error("The supplied block does not contain wire format"));
+  }
+
+  m_payload.reset();
+  m_iv.reset();
+  m_payloadKey.reset();
+
+  m_wire = wire;
+  m_wire.parse();
+
+  if (m_wire.type() != tlv::EncryptedContent) {
+    BOOST_THROW_EXCEPTION(Error("Unexpected TLV type (expecting EncryptedContent, got" +
+                                ndn::to_string(m_wire.type()) + ")"));
+  }
+
+  auto block = m_wire.find(tlv::EncryptedPayload);
+  if (block != m_wire.elements_end()) {
+    m_payload = *block;
+  }
+  else {
+    BOOST_THROW_EXCEPTION(Error("Required EncryptedPayload not found in EncryptedContent"));
+  }
+
+  block = m_wire.find(tlv::InitialVector);
+  if (block != m_wire.elements_end()) {
+    m_iv = *block;
+  }
+
+  block = m_wire.find(tlv::EncryptedPayloadKey);
+  if (block != m_wire.elements_end()) {
+    m_payloadKey = *block;
+  }
+
+  block = m_wire.find(tlv::Name);
+  if (block != m_wire.elements_end()) {
+    m_keyLocator.wireDecode(*block);
+  }
+}
+
+bool
+EncryptedContent::operator==(const EncryptedContent& rhs) const
+{
+  return (wireEncode() == rhs.wireEncode());
+}
+
+} // namespace nac
+} // namespace ndn
diff --git a/src/encrypted-content.hpp b/src/encrypted-content.hpp
new file mode 100644
index 0000000..e14db62
--- /dev/null
+++ b/src/encrypted-content.hpp
@@ -0,0 +1,166 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * NAC library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of NAC library authors and contributors.
+ */
+
+#ifndef NDN_NAC_ENCRYPTED_CONTENT_HPP
+#define NDN_NAC_ENCRYPTED_CONTENT_HPP
+
+#include "common.hpp"
+
+#include <ndn-cxx/encoding/tlv.hpp>
+
+namespace ndn {
+namespace nac {
+
+/**
+ * @brief Encrypted content
+ *
+ * <code>
+ *     EncryptedContent ::= ENCRYPTED-CONTENT-TYPE TLV-LENGTH
+ *                            InitialVector
+ *                            EncryptedPayload
+ *                            EncryptedPayloadKey
+ *                            Name
+ *
+ *     InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+ *     EncryptedPayload ::= ENCRYPTED-PAYLOAD-TYPE TLV-LENGTH(=N) BYTE{N}
+ *     EncryptedPayloadKey ::= ENCRYPTED-PAYLOAD-KEY-TYPE TLV-LENGTH(=N) BYTE{N}
+ *     InitialVector ::= INITIAL-VECTOR-TYPE TLV-LENGTH(=N) BYTE{N}
+ * </code>
+ */
+class EncryptedContent
+{
+public:
+  class Error : public ndn::tlv::Error
+  {
+  public:
+    using ndn::tlv::Error::Error;
+  };
+
+public:
+  EncryptedContent() = default;
+
+  explicit
+  EncryptedContent(const Block& block);
+
+  const Block&
+  getPayload() const
+  {
+    return m_payload;
+  }
+
+  EncryptedContent&
+  setPayload(Block payload);
+
+  EncryptedContent&
+  setPayload(ConstBufferPtr payload);
+
+  bool
+  hasIv() const
+  {
+    return !m_iv.empty();
+  }
+
+  const Block&
+  getIv() const
+  {
+    return m_iv;
+  }
+
+  EncryptedContent&
+  unsetIv();
+
+  EncryptedContent&
+  setIv(Block iv);
+
+  EncryptedContent&
+  setIv(ConstBufferPtr iv);
+
+  bool
+  hasPayloadKey() const
+  {
+    return !m_payloadKey.empty();
+  }
+
+  const Block&
+  getPayloadKey() const
+  {
+    return m_payloadKey;
+  }
+
+  EncryptedContent&
+  setPayloadKey(Block key);
+
+  EncryptedContent&
+  setPayloadKey(ConstBufferPtr key);
+
+  EncryptedContent&
+  unsetPayloadKey();
+
+  bool
+  hasKeyLocator() const
+  {
+    return !m_keyLocator.empty();
+  }
+
+  const Name&
+  getKeyLocator() const
+  {
+    return m_keyLocator;
+  }
+
+  EncryptedContent&
+  setKeyLocator(Name keyLocator);
+
+  EncryptedContent&
+  unsetKeyLocator();
+
+  template<encoding::Tag TAG>
+  size_t
+  wireEncode(EncodingImpl<TAG>& block) const;
+
+  const Block&
+  wireEncode() const;
+
+  void
+  wireDecode(const Block& wire);
+
+public:
+  bool
+  operator==(const EncryptedContent& rhs) const;
+
+  bool
+  operator!=(const EncryptedContent& rhs) const
+  {
+    return !(*this == rhs);
+  }
+
+private:
+  Block m_iv;
+  Block m_payload;
+  Block m_payloadKey; ///< for public key encryption, public key encodes a random key that is used
+                      ///< for symmetric encryption of the content
+  Name m_keyLocator;
+
+  mutable Block m_wire;
+};
+
+} // namespace nac
+} // namespace ndn
+
+#endif // NDN_NAC_ENCRYPTED_CONTENT_HPP
diff --git a/tests/tests/encrypted-content.t.cpp b/tests/tests/encrypted-content.t.cpp
new file mode 100644
index 0000000..afa03da
--- /dev/null
+++ b/tests/tests/encrypted-content.t.cpp
@@ -0,0 +1,165 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2014-2018, Regents of the University of California
+ *
+ * This file is part of NAC (Name-Based Access Control for NDN).
+ * See AUTHORS.md for complete list of NAC authors and contributors.
+ *
+ * NAC is free software: you can redistribute it and/or modify it under the terms
+ * of the GNU General Public License as published by the Free Software Foundation,
+ * either version 3 of the License, or (at your option) any later version.
+ *
+ * NAC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+ * without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * NAC, e.g., in COPYING.md file.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "encrypted-content.hpp"
+
+#include "tests-common.hpp"
+
+#include <iostream>
+
+namespace ndn {
+namespace nac {
+namespace tests {
+
+class EncryptedContentFixture
+{
+public:
+  EncryptedContentFixture()
+  {
+    BOOST_CHECK_EQUAL(randomBlock.value_size(), 3);
+    BOOST_CHECK_EQUAL(randomBuffer->size(), 10);
+  }
+
+public:
+  EncryptedContent content;
+  Block randomBlock = "01 03 000000"_block;
+  ConstBufferPtr randomBuffer = make_shared<Buffer>(10);
+};
+
+BOOST_FIXTURE_TEST_SUITE(TestEncryptedContent, EncryptedContentFixture)
+
+BOOST_AUTO_TEST_CASE(Constructor)
+{
+  BOOST_CHECK_THROW(content.wireEncode(), tlv::Error);
+  content.setPayload(randomBlock);
+
+  BOOST_CHECK(!content.hasIv());
+  BOOST_CHECK(!content.hasPayloadKey());
+  BOOST_CHECK(!content.hasKeyLocator());
+
+  BOOST_CHECK_EQUAL(content.wireEncode(), "82 07 84050103000000"_block);
+
+  content.setIv(randomBlock);
+  BOOST_CHECK_EQUAL(content.wireEncode(), "82[0E]=8405010300000085050103000000"_block);
+
+  content.setKeyLocator("/random/name");
+  BOOST_CHECK_EQUAL(content.wireEncode(), "82[1E]=8405010300000085050103000000070E080672616E646F6D08046E616D65"_block);
+
+  content = EncryptedContent("82 07 84050103000000"_block);
+  BOOST_CHECK(!content.hasIv());
+  BOOST_CHECK(!content.hasPayloadKey());
+  BOOST_CHECK(!content.hasKeyLocator());
+
+  content = EncryptedContent("82 1E 8505010300000084050103000000070E080672616E646F6D08046E616D65"_block);
+  BOOST_CHECK(content.hasIv());
+  BOOST_CHECK(!content.hasPayloadKey());
+  BOOST_CHECK(content.hasKeyLocator());
+}
+
+BOOST_AUTO_TEST_SUITE(SetterGetter)
+
+BOOST_AUTO_TEST_CASE(Iv)
+{
+  content.setPayload(randomBlock);
+
+  content.setIv(randomBlock);
+  BOOST_REQUIRE(content.hasIv());
+  BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+  BOOST_CHECK_EQUAL(content.getIv().blockFromValue(), randomBlock);
+
+  content.unsetIv();
+  BOOST_CHECK(!content.hasIv());
+
+  content.setIv(randomBuffer);
+  BOOST_REQUIRE(content.hasIv());
+  BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+  BOOST_CHECK_THROW(content.getIv().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getIv().value_size(), randomBuffer->size());
+
+  content = EncryptedContent("82[13]=84050103000000850A00000000000000000000"_block);
+  BOOST_REQUIRE(content.hasIv());
+  BOOST_CHECK_EQUAL(content.getIv().type(), tlv::InitialVector);
+  BOOST_CHECK_THROW(content.getIv().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getIv().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(Payload)
+{
+  content.setPayload(randomBlock);
+  BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+  BOOST_CHECK_EQUAL(content.getPayload().blockFromValue(), randomBlock);
+
+  content.setPayload(randomBuffer);
+  BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+  BOOST_CHECK_THROW(content.getPayload().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getPayload().value_size(), randomBuffer->size());
+
+  content = EncryptedContent("82[0C]=840A00000000000000000000"_block);
+  BOOST_CHECK_EQUAL(content.getPayload().type(), tlv::EncryptedPayload);
+  BOOST_CHECK_THROW(content.getPayload().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getPayload().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(PayloadKey)
+{
+  content.setPayload(randomBlock);
+
+  content.setPayloadKey(randomBlock);
+  BOOST_REQUIRE(content.hasPayloadKey());
+  BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+  BOOST_CHECK_EQUAL(content.getPayloadKey().blockFromValue(), randomBlock);
+
+  content.unsetPayloadKey();
+  BOOST_CHECK(!content.hasPayloadKey());
+
+  content.setPayloadKey(randomBuffer);
+  BOOST_REQUIRE(content.hasPayloadKey());
+  BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+  BOOST_CHECK_THROW(content.getPayloadKey().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getPayloadKey().value_size(), randomBuffer->size());
+
+  content = EncryptedContent("82[13]=84050103000000860A00000000000000000000"_block);
+  BOOST_CHECK_EQUAL(content.getPayloadKey().type(), tlv::EncryptedPayloadKey);
+  BOOST_CHECK_THROW(content.getPayloadKey().blockFromValue(), tlv::Error);
+  BOOST_CHECK_EQUAL(content.getPayloadKey().value_size(), randomBuffer->size());
+}
+
+BOOST_AUTO_TEST_CASE(KeyLocator)
+{
+  content.setPayload(randomBlock);
+
+  content.setKeyLocator("/random/name");
+  BOOST_REQUIRE(content.hasKeyLocator());
+  BOOST_CHECK_EQUAL(content.getKeyLocator(), "/random/name");
+
+  content.unsetPayloadKey();
+  BOOST_CHECK(!content.hasPayloadKey());
+
+  content = EncryptedContent("82[17]=84050103000000070E080672616E646F6D08046E616D65"_block);
+  BOOST_REQUIRE(content.hasKeyLocator());
+  BOOST_CHECK_EQUAL(content.getKeyLocator(), "/random/name");
+}
+
+BOOST_AUTO_TEST_SUITE_END() // SetterGetter
+
+BOOST_AUTO_TEST_SUITE_END()
+
+} // namespace tests
+} // namespace nac
+} // namespace ndn