diff --git a/tools/ndnsec/cert-dump.hpp b/tools/ndnsec/cert-dump.cpp
similarity index 90%
rename from tools/ndnsec/cert-dump.hpp
rename to tools/ndnsec/cert-dump.cpp
index 2cfc661..83c34a3 100644
--- a/tools/ndnsec/cert-dump.hpp
+++ b/tools/ndnsec/cert-dump.cpp
@@ -17,20 +17,17 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_CERT_DUMP_HPP
-#define NDN_TOOLS_NDNSEC_CERT_DUMP_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_cert_dump(int argc, char** argv)
 {
-  using namespace ndn;
-  using namespace ndn::security;
   namespace po = boost::program_options;
 
   std::string name;
@@ -74,8 +71,7 @@
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-              vm);
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
@@ -128,9 +124,9 @@
     return 1;
   }
 
-  shared_ptr<v1::IdentityCertificate> certificate;
+  shared_ptr<security::v1::IdentityCertificate> certificate;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   if (isIdentityName || isKeyName || isCertName) {
     if (isIdentityName) {
@@ -144,18 +140,17 @@
     else
       certificate = keyChain.getCertificate(name);
 
-    if (!static_cast<bool>(certificate)) {
+    if (certificate == nullptr) {
       std::cerr << "No certificate found!" << std::endl;
       return 1;
     }
   }
   else {
     certificate = getIdentityCertificate(name);
-    if (!static_cast<bool>(certificate))
-      {
-        std::cerr << "No certificate read!" << std::endl;
-        return 1;
-      }
+    if (certificate == nullptr) {
+      std::cerr << "No certificate read!" << std::endl;
+      return 1;
+    }
   }
 
   if (isPretty) {
@@ -184,4 +179,5 @@
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_CERT_DUMP_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/cert-gen.cpp b/tools/ndnsec/cert-gen.cpp
new file mode 100644
index 0000000..f1b2512
--- /dev/null
+++ b/tools/ndnsec/cert-gen.cpp
@@ -0,0 +1,214 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "ndnsec.hpp"
+#include "util.hpp"
+
+namespace ndn {
+namespace ndnsec {
+
+int
+ndnsec_cert_gen(int argc, char** argv)
+{
+  using boost::tokenizer;
+  using boost::escaped_list_separator;
+
+  namespace po = boost::program_options;
+
+  security::v1::KeyChain keyChain;
+
+  std::string notBeforeStr;
+  std::string notAfterStr;
+  std::string subjectName;
+  std::string requestFile("-");
+  Name signId;
+  std::string subjectInfo;
+  std::vector<std::string> signedInfo;
+  Name certPrefix = security::v1::KeyChain::DEFAULT_PREFIX; // to avoid displaying the default value
+
+  po::options_description description(
+    "General Usage\n"
+    "  ndnsec cert-gen [-h] [-S date] [-E date] [-N subject-name] [-I subject-info] "
+        "[-s sign-id] [-p cert-prefix] request\n"
+    "General options");
+
+  description.add_options()
+    ("help,h", "produce help message")
+    ("not-before,S",   po::value<std::string>(&notBeforeStr),
+                       "certificate starting date, YYYYMMDDhhmmss (default: now)")
+    ("not-after,E",    po::value<std::string>(&notAfterStr),
+                       "certificate ending date, YYYYMMDDhhmmss (default: now + 365 days)")
+    ("subject-name,N", po::value<std::string>(&subjectName),
+                       "subject name")
+    ("subject-info,I", po::value<std::string>(&subjectInfo),
+                       "(deprecated, uses 'signed-info') subject info, pairs of OID and string "
+                       " description: \"2.5.4.10 'University of California, Los Angeles'\"")
+    ("signed-info",    po::value<std::vector<std::string> >(&signedInfo),
+                       "a pair of OID and string (must be separated by a single space), e.g., "
+                       "\"2.5.4.10 University of California, Los Angeles\". "
+                       "May be repeated multiple times")
+    ("sign-id,s",      po::value<Name>(&signId)->default_value(keyChain.getDefaultIdentity()),
+                       "signing identity")
+    ("cert-prefix,p",  po::value<Name>(&certPrefix),
+                       "cert prefix, which is the part of certificate name before "
+                       "KEY component")
+    ("request,r",      po::value<std::string>(&requestFile)->default_value("-"),
+                       "request file name, - for stdin")
+    ;
+
+  po::positional_options_description p;
+  p.add("request", 1);
+
+  po::variables_map vm;
+  try {
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    return 1;
+  }
+
+  if (vm.count("help") != 0) {
+    std::cout << description << std::endl;
+    return 0;
+  }
+
+  if (vm.count("subject-name") == 0) {
+    std::cerr << "ERROR: subject name must be specified" << std::endl
+              << std::endl
+              << description << std::endl;
+    return 1;
+  }
+
+  std::vector<security::v1::CertificateSubjectDescription> subjectDescription;
+  subjectDescription.push_back(security::v1::CertificateSubjectDescription(oid::ATTRIBUTE_NAME, subjectName));
+
+  // 'subjectInfo' is deprecated and the following block will be removed eventually
+  tokenizer<escaped_list_separator<char>> subjectInfoItems(subjectInfo,
+                                                           escaped_list_separator<char>("\\", " \t",
+                                                                                        "'\""));
+
+  tokenizer<escaped_list_separator<char>>::iterator it = subjectInfoItems.begin();
+
+  while (it != subjectInfoItems.end()) {
+    std::string oid = *it;
+
+    it++;
+    if (it == subjectInfoItems.end()) {
+      std::cerr << "ERROR: unmatched info for oid [" << oid << "]" << std::endl;
+      return 1;
+    }
+
+    std::string value = *it;
+
+    subjectDescription.push_back(security::v1::CertificateSubjectDescription(Oid(oid), value));
+
+    it++;
+  }
+
+  // new 'signedInfo' processing
+  for (std::vector<std::string>::const_iterator info = signedInfo.begin(); info != signedInfo.end();
+       ++info) {
+    size_t pos = info->find(" ");
+    if (pos == std::string::npos) {
+      std::cerr << "ERROR: incorrectly formatted signed info block [" << *info << "]" << std::endl;
+      return 1;
+    }
+    Oid oid(info->substr(0, pos));
+    std::string value = info->substr(pos + 1);
+
+    subjectDescription.push_back(security::v1::CertificateSubjectDescription(oid, value));
+  }
+
+  time::system_clock::TimePoint notBefore;
+  time::system_clock::TimePoint notAfter;
+
+  if (vm.count("not-before") == 0) {
+    notBefore = time::system_clock::now();
+  }
+  else {
+    notBefore = time::fromIsoString(notBeforeStr.substr(0, 8) + "T" + notBeforeStr.substr(8, 6));
+  }
+
+  if (vm.count("not-after") == 0) {
+    notAfter = notBefore + time::days(365);
+  }
+  else {
+    notAfter = time::fromIsoString(notAfterStr.substr(0, 8) + "T" + notAfterStr.substr(8, 6));
+
+    if (notAfter < notBefore) {
+      std::cerr << "ERROR: not-before cannot be later than not-after" << std::endl
+                << std::endl
+                << description << std::endl;
+      return 1;
+    }
+  }
+
+  if (vm.count("request") == 0) {
+    std::cerr << "ERROR: request file must be specified" << std::endl
+              << std::endl
+              << description << std::endl;
+    return 1;
+  }
+
+  shared_ptr<security::v1::IdentityCertificate> selfSignedCertificate = getIdentityCertificate(requestFile);
+
+  if (selfSignedCertificate == nullptr) {
+    std::cerr << "ERROR: input error" << std::endl;
+    return 1;
+  }
+
+  Name keyName = selfSignedCertificate->getPublicKeyName();
+
+  shared_ptr<security::v1::IdentityCertificate> certificate =
+    keyChain.prepareUnsignedIdentityCertificate(keyName, selfSignedCertificate->getPublicKeyInfo(),
+                                                signId, notBefore, notAfter, subjectDescription,
+                                                certPrefix);
+
+  if (certificate == nullptr) {
+    std::cerr << "ERROR: key name is not formated correctly or does not match certificate name"
+              << std::endl;
+    return 1;
+  }
+
+  keyChain.createIdentity(signId);
+  Name signingCertificateName = keyChain.getDefaultCertificateNameForIdentity(signId);
+  keyChain.sign(*certificate,
+                security::SigningInfo(security::SigningInfo::SIGNER_TYPE_CERT,
+                                      signingCertificateName));
+
+  Block wire = certificate->wireEncode();
+
+  namespace t = security::transform;
+  try {
+    t::bufferSource(wire.wire(), wire.size()) >> t::base64Encode(true) >> t::streamSink(std::cout);
+  }
+  catch (const security::transform::Error& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    return 1;
+  }
+
+  return 0;
+}
+
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/cert-gen.hpp b/tools/ndnsec/cert-gen.hpp
deleted file mode 100644
index 4be98a1..0000000
--- a/tools/ndnsec/cert-gen.hpp
+++ /dev/null
@@ -1,234 +0,0 @@
-/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2013-2017 Regents of the University of California.
- *
- * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
- *
- * ndn-cxx library is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Lesser General Public License as published by the Free Software
- * Foundation, either version 3 of the License, or (at your option) any later version.
- *
- * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
- * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
- * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
- *
- * You should have received copies of the GNU General Public License and GNU Lesser
- * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
- */
-
-#ifndef NDN_TOOLS_NDNSEC_CERT_GEN_HPP
-#define NDN_TOOLS_NDNSEC_CERT_GEN_HPP
-
-#include "util.hpp"
-
-int
-ndnsec_cert_gen(int argc, char** argv)
-{
-  using boost::tokenizer;
-  using boost::escaped_list_separator;
-
-  using namespace ndn;
-  using namespace ndn::time;
-  using namespace ndn::security;
-  namespace po = boost::program_options;
-
-  ndn::security::v1::KeyChain keyChain;
-
-  std::string notBeforeStr;
-  std::string notAfterStr;
-  std::string subjectName;
-  std::string requestFile("-");
-  Name signId;
-  std::string subjectInfo;
-  std::vector<std::string> signedInfo;
-  Name certPrefix = ndn::security::v1::KeyChain::DEFAULT_PREFIX; // to avoid displaying the default value
-
-  po::options_description description(
-    "General Usage\n"
-    "  ndnsec cert-gen [-h] [-S date] [-E date] [-N subject-name] [-I subject-info] "
-        "[-s sign-id] [-p cert-prefix] request\n"
-    "General options");
-
-  description.add_options()
-    ("help,h", "produce help message")
-    ("not-before,S",   po::value<std::string>(&notBeforeStr),
-                       "certificate starting date, YYYYMMDDhhmmss (default: now)")
-    ("not-after,E",    po::value<std::string>(&notAfterStr),
-                       "certificate ending date, YYYYMMDDhhmmss (default: now + 365 days)")
-    ("subject-name,N", po::value<std::string>(&subjectName),
-                       "subject name")
-    ("subject-info,I", po::value<std::string>(&subjectInfo),
-                       "(deprecated, uses 'signed-info') subject info, pairs of OID and string "
-                       " description: \"2.5.4.10 'University of California, Los Angeles'\"")
-    ("signed-info",    po::value<std::vector<std::string> >(&signedInfo),
-                       "a pair of OID and string (must be separated by a single space), e.g., "
-                       "\"2.5.4.10 University of California, Los Angeles\". "
-                       "May be repeated multiple times")
-    ("sign-id,s",      po::value<Name>(&signId)->default_value(keyChain.getDefaultIdentity()),
-                       "signing identity")
-    ("cert-prefix,p",  po::value<Name>(&certPrefix),
-                       "cert prefix, which is the part of certificate name before "
-                       "KEY component")
-    ("request,r",      po::value<std::string>(&requestFile)->default_value("-"),
-                       "request file name, - for stdin")
-    ;
-
-  po::positional_options_description p;
-  p.add("request", 1);
-
-  po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      return 1;
-    }
-
-  if (vm.count("help") != 0)
-    {
-      std::cout << description << std::endl;
-      return 0;
-    }
-
-  if (vm.count("subject-name") == 0)
-    {
-      std::cerr << "ERROR: subject name must be specified" << std::endl
-                << std::endl
-                << description << std::endl;
-      return 1;
-    }
-
-  std::vector<v1::CertificateSubjectDescription> subjectDescription;
-  subjectDescription.push_back(v1::CertificateSubjectDescription(oid::ATTRIBUTE_NAME, subjectName));
-
-  // 'subjectInfo' is deprecated and the following block will be removed eventually
-  tokenizer<escaped_list_separator<char> > subjectInfoItems
-    (subjectInfo, escaped_list_separator<char>("\\", " \t", "'\""));
-
-  tokenizer<escaped_list_separator<char> >::iterator it =
-    subjectInfoItems.begin();
-
-  while (it != subjectInfoItems.end())
-    {
-      std::string oid = *it;
-
-      it++;
-      if (it == subjectInfoItems.end())
-        {
-          std::cerr << "ERROR: unmatched info for oid [" << oid << "]" << std::endl;
-          return 1;
-        }
-
-      std::string value = *it;
-
-      subjectDescription.push_back(v1::CertificateSubjectDescription(Oid(oid), value));
-
-      it++;
-    }
-
-  // new 'signedInfo' processing
-  for (std::vector<std::string>::const_iterator info = signedInfo.begin();
-       info != signedInfo.end(); ++info) {
-    size_t pos = info->find(" ");
-    if (pos == std::string::npos) {
-      std::cerr << "ERROR: incorrectly formatted signed info block [" << *info << "]" << std::endl;
-      return 1;
-    }
-    Oid oid(info->substr(0, pos));
-    std::string value = info->substr(pos + 1);
-
-    subjectDescription.push_back(v1::CertificateSubjectDescription(oid, value));
-  }
-
-  system_clock::TimePoint notBefore;
-  system_clock::TimePoint notAfter;
-
-  if (vm.count("not-before") == 0)
-    {
-      notBefore = system_clock::now();
-    }
-  else
-    {
-      notBefore = fromIsoString(notBeforeStr.substr(0, 8) + "T" +
-                                notBeforeStr.substr(8, 6));
-    }
-
-  if (vm.count("not-after") == 0)
-    {
-      notAfter = notBefore + days(365);
-    }
-  else
-    {
-      notAfter = fromIsoString(notAfterStr.substr(0, 8) + "T" +
-                               notAfterStr.substr(8, 6));
-
-      if (notAfter < notBefore)
-        {
-          std::cerr << "ERROR: not-before cannot be later than not-after" << std::endl
-                    << std::endl
-                    << description << std::endl;
-          return 1;
-        }
-    }
-
-  if (vm.count("request") == 0)
-    {
-      std::cerr << "ERROR: request file must be specified" << std::endl
-                << std::endl
-                << description << std::endl;
-      return 1;
-    }
-
-  shared_ptr<v1::IdentityCertificate> selfSignedCertificate
-    = getIdentityCertificate(requestFile);
-
-  if (!static_cast<bool>(selfSignedCertificate))
-    {
-      std::cerr << "ERROR: input error" << std::endl;
-      return 1;
-    }
-
-  Name keyName = selfSignedCertificate->getPublicKeyName();
-
-  shared_ptr<v1::IdentityCertificate> certificate =
-    keyChain.prepareUnsignedIdentityCertificate(keyName, selfSignedCertificate->getPublicKeyInfo(),
-                                                signId, notBefore, notAfter,
-                                                subjectDescription, certPrefix);
-
-  if (!static_cast<bool>(certificate))
-    {
-      std::cerr << "ERROR: key name is not formated correctly or does not match certificate name"
-                << std::endl;
-      return 1;
-    }
-
-  keyChain.createIdentity(signId);
-  Name signingCertificateName = keyChain.getDefaultCertificateNameForIdentity(signId);
-  keyChain.sign(*certificate,
-                security::SigningInfo(security::SigningInfo::SIGNER_TYPE_CERT,
-                                      signingCertificateName));
-
-  Block wire = certificate->wireEncode();
-
-  try {
-    transform::bufferSource(wire.wire(), wire.size()) >> transform::base64Encode(true) >> transform::streamSink(std::cout);
-  }
-  catch (const transform::Error& e) {
-    std::cerr << "ERROR: " << e.what() << std::endl;
-    return 1;
-  }
-
-  return 0;
-}
-
-#endif // NDN_TOOLS_NDNSEC_CERT_GEN_HPP
diff --git a/tools/ndnsec/cert-install.hpp b/tools/ndnsec/cert-install.cpp
similarity index 77%
rename from tools/ndnsec/cert-install.hpp
rename to tools/ndnsec/cert-install.cpp
index f37f04a..72a82bd 100644
--- a/tools/ndnsec/cert-install.hpp
+++ b/tools/ndnsec/cert-install.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_CERT_INSTALL_HPP
-#define NDN_TOOLS_NDNSEC_CERT_INSTALL_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 class HttpException : public std::runtime_error
 {
 public:
@@ -36,7 +35,7 @@
   }
 };
 
-ndn::shared_ptr<ndn::security::v1::IdentityCertificate>
+shared_ptr<security::v1::IdentityCertificate>
 getCertificateHttp(const std::string& host, const std::string& port, const std::string& path)
 {
   using namespace boost::asio::ip;
@@ -45,8 +44,8 @@
   requestStream.expires_from_now(boost::posix_time::milliseconds(3000));
 
   requestStream.connect(host, port);
-  if (!static_cast<bool>(requestStream)) {
-    throw HttpException("HTTP connection error");
+  if (!requestStream) {
+    BOOST_THROW_EXCEPTION(HttpException("HTTP connection error"));
   }
   requestStream << "GET " << path << " HTTP/1.0\r\n";
   requestStream << "Host: " << host << "\r\n";
@@ -57,10 +56,9 @@
 
   std::string statusLine;
   std::getline(requestStream, statusLine);
-  if (!static_cast<bool>(requestStream))
-    {
-      throw HttpException("HTTP communication error");
-    }
+  if (!requestStream) {
+    BOOST_THROW_EXCEPTION(HttpException("HTTP communication error"));
+  }
 
   std::stringstream responseStream(statusLine);
   std::string httpVersion;
@@ -70,11 +68,11 @@
   std::string statusMessage;
 
   std::getline(responseStream, statusMessage);
-  if (!static_cast<bool>(requestStream) || httpVersion.substr(0, 5) != "HTTP/") {
-    throw HttpException("HTTP communication error");
+  if (!requestStream || httpVersion.substr(0, 5) != "HTTP/") {
+    BOOST_THROW_EXCEPTION(HttpException("HTTP communication error"));
   }
   if (statusCode != 200) {
-    throw HttpException("HTTP server error");
+    BOOST_THROW_EXCEPTION(HttpException("HTTP server error"));
   }
   std::string header;
   while (std::getline(requestStream, header) && header != "\r")
@@ -86,7 +84,7 @@
     streamSource(requestStream) >> base64Decode(true) >> streamSink(os);
   }
 
-  auto identityCertificate = std::make_shared<ndn::security::v1::IdentityCertificate>();
+  auto identityCertificate = std::make_shared<security::v1::IdentityCertificate>();
   identityCertificate->wireDecode(ndn::Block(os.buf()));
 
   return identityCertificate;
@@ -119,19 +117,18 @@
 
   po::variables_map vm;
   try {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
   catch (const std::exception& e) {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      return 1;
-    }
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    return 1;
+  }
 
   if (vm.count("help") != 0) {
-      std::cerr << description << std::endl;
-      return 0;
-    }
+    std::cerr << description << std::endl;
+    return 0;
+  }
 
   if (vm.count("cert-file") == 0) {
     std::cerr << "cert_file must be specified" << std::endl;
@@ -152,7 +149,7 @@
     isSystemDefault = false;
   }
 
-  shared_ptr<v1::IdentityCertificate> cert;
+  shared_ptr<security::v1::IdentityCertificate> cert;
 
   if (certFileName.find("http://") == 0) {
     std::string host;
@@ -163,7 +160,7 @@
     size_t posSlash = certFileName.find("/", pos);
 
     if (posSlash == std::string::npos)
-      throw HttpException("Request line is not correctly formatted");
+      BOOST_THROW_EXCEPTION(HttpException("Request line is not correctly formatted"));
 
     size_t posPort = certFileName.find(":", pos);
 
@@ -177,7 +174,7 @@
       host = certFileName.substr(pos, posSlash - pos);
     }
 
-    path = certFileName.substr(posSlash, certFileName.size () - posSlash);
+    path = certFileName.substr(posSlash, certFileName.size() - posSlash);
 
     cert = getCertificateHttp(host, port, path);
   }
@@ -185,15 +182,15 @@
     cert = getIdentityCertificate(certFileName);
   }
 
-  if (!static_cast<bool>(cert))
+  if (cert == nullptr)
     return 1;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   if (isSystemDefault) {
     keyChain.addCertificateAsIdentityDefault(*cert);
     Name keyName = cert->getPublicKeyName();
-    Name identity = keyName.getSubName(0, keyName.size()-1);
+    Name identity = keyName.getSubName(0, keyName.size() - 1);
     keyChain.setDefaultIdentity(identity);
   }
   else if (isIdentityDefault) {
@@ -206,12 +203,11 @@
     keyChain.addCertificate(*cert);
   }
 
-  std::cerr << "OK: certificate with name ["
-            << cert->getName().toUri()
-            << "] has been successfully installed"
-            << std::endl;
+  std::cerr << "OK: certificate with name [" << cert->getName().toUri()
+            << "] has been successfully installed" << std::endl;
 
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_CERT_INSTALL_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/cert-revoke.hpp b/tools/ndnsec/cert-revoke.cpp
similarity index 80%
rename from tools/ndnsec/cert-revoke.hpp
rename to tools/ndnsec/cert-revoke.cpp
index 6e948e0..f7de148 100644
--- a/tools/ndnsec/cert-revoke.hpp
+++ b/tools/ndnsec/cert-revoke.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_CERT_REVOKE_HPP
-#define NDN_TOOLS_NDNSEC_CERT_REVOKE_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_cert_revoke(int argc, char** argv)
 {
@@ -33,12 +32,12 @@
   using namespace ndn::security;
   namespace po = boost::program_options;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   std::string requestFile("-");
   Name signId = keyChain.getDefaultIdentity();
   bool hasSignId = false;
-  Name certPrefix = ndn::security::v1::KeyChain::DEFAULT_PREFIX;
+  Name certPrefix = security::v1::KeyChain::DEFAULT_PREFIX;
 
   po::options_description description("General Usage\n  ndnsec cert-revoke [-h] request\n"
                                       "General options");
@@ -58,8 +57,7 @@
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-              vm);
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
@@ -79,9 +77,9 @@
     return 1;
   }
 
-  shared_ptr<v1::IdentityCertificate> revokedCertificate = getIdentityCertificate(requestFile);
+  shared_ptr<security::v1::IdentityCertificate> revokedCertificate = getIdentityCertificate(requestFile);
 
-  if (!static_cast<bool>(revokedCertificate)) {
+  if (revokedCertificate == nullptr) {
     std::cerr << "ERROR: input error" << std::endl;
     return 1;
   }
@@ -97,18 +95,16 @@
     else {
       const Signature& signature = revokedCertificate->getSignature();
       if (!signature.hasKeyLocator() ||
-          signature.getKeyLocator().getType() != KeyLocator::KeyLocator_Name)
-        {
-          std::cerr << "ERROR: Invalid certificate to revoke" << std::endl;
-          return 1;
-        }
+          signature.getKeyLocator().getType() != KeyLocator::KeyLocator_Name) {
+        std::cerr << "ERROR: Invalid certificate to revoke" << std::endl;
+        return 1;
+      }
 
-      keyName = v1::IdentityCertificate::certificateNameToPublicKeyName(
-                  signature.getKeyLocator().getName());
+      keyName = security::v1::IdentityCertificate::certificateNameToPublicKeyName(signature.getKeyLocator().getName());
     }
 
     Name certName;
-    if (certPrefix == ndn::security::v1::KeyChain::DEFAULT_PREFIX) {
+    if (certPrefix == security::v1::KeyChain::DEFAULT_PREFIX) {
       certName = revokedCertificate->getName().getPrefix(-1);
     }
     else {
@@ -121,14 +117,11 @@
           .append("ID-CERT");
       }
       else {
-        std::cerr << "ERROR: certificate prefix does not match the revoked certificate"
-                  << std::endl;
+        std::cerr << "ERROR: certificate prefix does not match the revoked certificate" << std::endl;
         return 1;
       }
     }
-    certName
-      .appendVersion()
-      .append("REVOKED");
+    certName.appendVersion().append("REVOKED");
 
     Data revocationCert;
     revocationCert.setName(certName);
@@ -153,18 +146,19 @@
     std::cerr << "ERROR: No valid KeyLocator!" << std::endl;
     return 1;
   }
-  catch (const v1::IdentityCertificate::Error& e) {
+  catch (const security::v1::IdentityCertificate::Error& e) {
     std::cerr << "ERROR: Cannot determine the signing key!" << std::endl;
     return 1;
   }
-  catch (const v1::SecPublicInfo::Error& e) {
+  catch (const security::v1::SecPublicInfo::Error& e) {
     std::cerr << "ERROR: Incomplete or corrupted PIB (" << e.what() << ")" << std::endl;
     return 1;
   }
 
   try {
-    transform::bufferSource(wire.wire(), wire.size()) >> transform::base64Encode(true) >> transform::streamSink(std::cout);
-    }
+    transform::bufferSource(wire.wire(), wire.size()) >> transform::base64Encode(true) >>
+      transform::streamSink(std::cout);
+  }
   catch (const transform::Error& e) {
     std::cerr << "ERROR: " << e.what() << std::endl;
     return 1;
@@ -173,4 +167,5 @@
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_CERT_REVOKE_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/delete.hpp b/tools/ndnsec/delete.cpp
similarity index 86%
rename from tools/ndnsec/delete.hpp
rename to tools/ndnsec/delete.cpp
index 420af1c..cfda520 100644
--- a/tools/ndnsec/delete.hpp
+++ b/tools/ndnsec/delete.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_DELETE_HPP
-#define NDN_TOOLS_NDNSEC_DELETE_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_delete(int argc, char** argv)
 {
@@ -55,8 +54,7 @@
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-              vm);
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
@@ -66,7 +64,7 @@
   }
 
   if (vm.count("help") != 0) {
-    std::cerr << description << std::endl;;
+    std::cerr << description << std::endl;
     return 0;
   }
 
@@ -82,7 +80,7 @@
   else if (vm.count("delete-key") != 0 || vm.count("delete-key2") != 0)
     isDeleteKey = true;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   try {
     if (isDeleteCert) {
@@ -95,8 +93,7 @@
       std::cerr << "OK: Delete certificate: " << name << std::endl;
     }
     else if (isDeleteKey) {
-      if (!keyChain.doesPublicKeyExist(name) &&
-          !keyChain.doesKeyExistInTpm(name, KeyClass::PRIVATE)) {
+      if (!keyChain.doesPublicKeyExist(name) && !keyChain.doesKeyExistInTpm(name, KeyClass::PRIVATE)) {
         std::cerr << "ERROR: Key does not exist: " << name << std::endl;
         return 1;
       }
@@ -114,15 +111,15 @@
       std::cerr << "OK: Delete identity: " << name << std::endl;
     }
   }
-  catch (const ndn::security::v1::SecPublicInfo::Error& e) {
+  catch (const security::v1::SecPublicInfo::Error& e) {
     std::cerr << "ERROR: Cannot delete the item: " << e.what() << std::endl;
     return 2;
   }
-  catch (const ndn::security::v1::SecTpm::Error& e) {
+  catch (const security::v1::SecTpm::Error& e) {
     std::cerr << "ERROR: Cannot delete the item: " << e.what() << std::endl;
     return 2;
   }
-  catch (const ndn::security::v1::KeyChain::Error& e) {
+  catch (const security::v1::KeyChain::Error& e) {
     std::cerr << "ERROR: " << e.what() << std::endl;
     return 2;
   }
@@ -130,4 +127,5 @@
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_DELETE_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/dsk-gen.hpp b/tools/ndnsec/dsk-gen.cpp
similarity index 83%
rename from tools/ndnsec/dsk-gen.hpp
rename to tools/ndnsec/dsk-gen.cpp
index 4996383..a9109ee 100644
--- a/tools/ndnsec/dsk-gen.hpp
+++ b/tools/ndnsec/dsk-gen.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_DSK_GEN_HPP
-#define NDN_TOOLS_NDNSEC_DSK_GEN_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_dsk_gen(int argc, char** argv)
 {
@@ -74,15 +73,15 @@
     return 1;
   }
 
-  shared_ptr<v1::IdentityCertificate> kskCert;
+  shared_ptr<security::v1::IdentityCertificate> kskCert;
   Name signingCertName;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   try {
     Name defaultCertName = keyChain.getDefaultCertificateNameForIdentity(identityName);
     bool isDefaultDsk = false;
-    std::string keyUsageTag = defaultCertName.get(-3).toUri().substr(0,4);
+    std::string keyUsageTag = defaultCertName.get(-3).toUri().substr(0, 4);
     if (keyUsageTag == "ksk-")
       isDefaultDsk = false;
     else if (keyUsageTag == "dsk-")
@@ -93,14 +92,14 @@
     }
 
     if (isDefaultDsk) {
-      shared_ptr<v1::IdentityCertificate> dskCert = keyChain.getCertificate(defaultCertName);
+      shared_ptr<security::v1::IdentityCertificate> dskCert = keyChain.getCertificate(defaultCertName);
 
-      if (static_cast<bool>(dskCert)) {
+      if (dskCert != nullptr) {
         SignatureSha256WithRsa sha256sig(dskCert->getSignature());
 
         Name keyLocatorName = sha256sig.getKeyLocator().getName();
 
-        Name kskName = v1::IdentityCertificate::certificateNameToPublicKeyName(keyLocatorName);
+        Name kskName = security::v1::IdentityCertificate::certificateNameToPublicKeyName(keyLocatorName);
         Name kskCertName = keyChain.getDefaultCertificateNameForKey(kskName);
         signingCertName = kskCertName;
         kskCert = keyChain.getCertificate(kskCertName);
@@ -115,15 +114,14 @@
       kskCert = keyChain.getCertificate(defaultCertName);
     }
 
-    if (!static_cast<bool>(kskCert)) {
+    if (kskCert == nullptr) {
       std::cerr << "ERROR: KSK certificate is missing." << std::endl;
       return 1;
     }
 
     Name newKeyName;
     switch (keyType) {
-    case 'r':
-      {
+      case 'r': {
         RsaKeyParams params;
         newKeyName = keyChain.generateRsaKeyPair(Name(identityName), false, params.getKeySize());
         if (0 == newKeyName.size()) {
@@ -132,8 +130,7 @@
         }
         break;
       }
-    case 'e':
-      {
+      case 'e': {
         EcKeyParams params;
         newKeyName = keyChain.generateEcKeyPair(Name(identityName), false, params.getKeySize());
         if (0 == newKeyName.size()) {
@@ -142,29 +139,28 @@
         }
         break;
       }
-    default:
-      std::cerr << "ERROR: Unrecongized key type" << "\n";
-      std::cerr << description << std::endl;
-      return 1;
+      default:
+        std::cerr << "ERROR: Unrecongized key type"
+                  << "\n";
+        std::cerr << description << std::endl;
+        return 1;
     }
 
     Name certName = newKeyName.getPrefix(-1);
-    certName.append("KEY")
-      .append(newKeyName.get(-1))
-      .append("ID-CERT")
-      .appendVersion();
+    certName.append("KEY").append(newKeyName.get(-1)).append("ID-CERT").appendVersion();
 
-    shared_ptr<v1::IdentityCertificate> certificate =
+    shared_ptr<security::v1::IdentityCertificate> certificate =
       keyChain.prepareUnsignedIdentityCertificate(newKeyName,
                                                   Name(identityName),
                                                   kskCert->getNotBefore(),
                                                   kskCert->getNotAfter(),
                                                   kskCert->getSubjectDescriptionList());
 
-    if (static_cast<bool>(certificate))
+    if (certificate != nullptr)
       certificate->encode();
     else {
-      std::cerr << "ERROR: Cannot format the certificate of the requested dsk." << "\n";
+      std::cerr << "ERROR: Cannot format the certificate of the requested dsk."
+                << "\n";
       return 1;
     }
 
@@ -173,14 +169,15 @@
 
     keyChain.addCertificateAsIdentityDefault(*certificate);
 
-    std::cerr << "OK: dsk certificate with name [" << certificate->getName() <<
-      "] has been successfully installed\n";
+    std::cerr << "OK: dsk certificate with name [" << certificate->getName()
+              << "] has been successfully installed\n";
     return 0;
   }
-  catch (std::runtime_error& e) {
+  catch (const std::runtime_error& e) {
     std::cerr << "ERROR: other runtime errors: " << e.what() << "\n";
     return 1;
   }
 }
 
-#endif // NDN_TOOLS_NDNSEC_DSK_GEN_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/export.hpp b/tools/ndnsec/export.cpp
similarity index 85%
rename from tools/ndnsec/export.hpp
rename to tools/ndnsec/export.cpp
index 45c3d32..9b7a0e9 100644
--- a/tools/ndnsec/export.hpp
+++ b/tools/ndnsec/export.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_EXPORT_HPP
-#define NDN_TOOLS_NDNSEC_EXPORT_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_export(int argc, char** argv)
 {
@@ -50,8 +49,7 @@
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-              vm);
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
@@ -79,9 +77,9 @@
 
   Name identity(identityStr);
   if (!isPrivateExport) {
-    ndn::security::v1::KeyChain keyChain;
-    shared_ptr<security::v1::IdentityCertificate> cert
-      = keyChain.getCertificate(keyChain.getDefaultCertificateNameForIdentity(identity));
+    security::v1::KeyChain keyChain;
+    shared_ptr<security::v1::IdentityCertificate> cert =
+      keyChain.getCertificate(keyChain.getDefaultCertificateNameForIdentity(identity));
 
     if (output == "-")
       io::save(*cert, std::cout);
@@ -93,7 +91,7 @@
   else {
     Block wire;
     try {
-      ndn::security::v1::KeyChain keyChain;
+      security::v1::KeyChain keyChain;
 
       int count = 3;
       while (!getPassword(exportPassword, "Passphrase for the private key: ")) {
@@ -104,7 +102,8 @@
           return 1;
         }
       }
-      shared_ptr<ndn::security::v1::SecuredBag> securedBag = keyChain.exportIdentity(identity, exportPassword);
+      shared_ptr<security::v1::SecuredBag> securedBag =
+        keyChain.exportIdentity(identity, exportPassword);
       memset(const_cast<char*>(exportPassword.c_str()), 0, exportPassword.size());
 
       if (output == "-")
@@ -122,4 +121,5 @@
   }
 }
 
-#endif // NDN_TOOLS_NDNSEC_EXPORT_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/get-default.cpp b/tools/ndnsec/get-default.cpp
new file mode 100644
index 0000000..96ee12e
--- /dev/null
+++ b/tools/ndnsec/get-default.cpp
@@ -0,0 +1,139 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "ndnsec.hpp"
+#include "util.hpp"
+
+namespace ndn {
+namespace ndnsec {
+
+int
+ndnsec_get_default(int argc, char** argv)
+{
+  using namespace ndn;
+  namespace po = boost::program_options;
+
+  bool isGetDefaultId = true;
+  bool isGetDefaultKey = false;
+  bool isGetDefaultCert = false;
+  bool isQuiet = false;
+  std::string identityString;
+  std::string keyName;
+
+  po::options_description description("General Usage\n"
+                                      "  ndnsec get-default [-h] [-k|c] [-i identity|-K key] [-q]\n"
+                                      "General options");
+  description.add_options()
+    ("help,h", "produce help message")
+    ("default_key,k", "get default key")
+    ("default_cert,c", "get default certificate")
+    ("identity,i", po::value<std::string>(&identityString), "target identity")
+    ("key,K", po::value<std::string>(&keyName), "target key")
+    ("quiet,q", "don't output trailing newline")
+    ;
+
+  po::variables_map vm;
+  try {
+    po::store(po::parse_command_line(argc, argv, description), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
+
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    ;
+    return 0;
+  }
+
+  if (vm.count("default_cert") != 0) {
+    isGetDefaultCert = true;
+    isGetDefaultId = false;
+  }
+  else if (vm.count("default_key") != 0) {
+    isGetDefaultKey = true;
+    isGetDefaultId = false;
+  }
+
+  if (vm.count("quiet") != 0) {
+    isQuiet = true;
+  }
+
+  security::v1::KeyChain keyChain;
+
+  if (vm.count("key") != 0) {
+    Name keyNdnName(keyName);
+    if (isGetDefaultCert) {
+      std::cout << keyChain.getDefaultCertificateNameForKey(keyNdnName);
+      if (!isQuiet)
+        std::cout << std::endl;
+      return 0;
+    }
+    return 1;
+  }
+  else if (vm.count("identity") != 0) {
+    Name identity(identityString);
+
+    if (isGetDefaultKey) {
+      std::cout << keyChain.getDefaultKeyNameForIdentity(identity);
+      if (!isQuiet)
+        std::cout << std::endl;
+
+      return 0;
+    }
+    if (isGetDefaultCert) {
+      std::cout << keyChain.getDefaultCertificateNameForIdentity(identity);
+      if (!isQuiet)
+        std::cout << std::endl;
+
+      return 0;
+    }
+    return 1;
+  }
+  else {
+    Name identity = keyChain.getDefaultIdentity();
+    if (isGetDefaultId) {
+      std::cout << identity;
+      if (!isQuiet)
+        std::cout << std::endl;
+      return 0;
+    }
+    if (isGetDefaultKey) {
+      std::cout << keyChain.getDefaultKeyNameForIdentity(identity);
+      if (!isQuiet)
+        std::cout << std::endl;
+      return 0;
+    }
+    if (isGetDefaultCert) {
+      std::cout << keyChain.getDefaultCertificateNameForIdentity(identity);
+      if (!isQuiet)
+        std::cout << std::endl;
+      return 0;
+    }
+    return 1;
+  }
+}
+
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/get-default.hpp b/tools/ndnsec/get-default.hpp
deleted file mode 100644
index b701015..0000000
--- a/tools/ndnsec/get-default.hpp
+++ /dev/null
@@ -1,147 +0,0 @@
-/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2013-2017 Regents of the University of California.
- *
- * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
- *
- * ndn-cxx library is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Lesser General Public License as published by the Free Software
- * Foundation, either version 3 of the License, or (at your option) any later version.
- *
- * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
- * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
- * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
- *
- * You should have received copies of the GNU General Public License and GNU Lesser
- * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
- */
-
-#ifndef NDN_TOOLS_NDNSEC_GET_DEFAULT_HPP
-#define NDN_TOOLS_NDNSEC_GET_DEFAULT_HPP
-
-#include "util.hpp"
-
-int
-ndnsec_get_default(int argc, char** argv)
-{
-  using namespace ndn;
-  namespace po = boost::program_options;
-
-  bool isGetDefaultId = true;
-  bool isGetDefaultKey = false;
-  bool isGetDefaultCert = false;
-  bool isQuiet = false;
-  std::string identityString;
-  std::string keyName;
-
-  po::options_description description("General Usage\n  ndnsec get-default [-h] [-k|c] [-i identity|-K key] [-q]\nGeneral options");
-  description.add_options()
-    ("help,h", "produce help message")
-    ("default_key,k", "get default key")
-    ("default_cert,c", "get default certificate")
-    ("identity,i", po::value<std::string>(&identityString), "target identity")
-    ("key,K", po::value<std::string>(&keyName), "target key")
-    ("quiet,q", "don't output trailing newline")
-    ;
-
-  po::variables_map vm;
-  try
-    {
-      po::store(po::parse_command_line(argc, argv, description), vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
-
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;;
-      return 0;
-    }
-
-  if (vm.count("default_cert") != 0)
-    {
-      isGetDefaultCert = true;
-      isGetDefaultId = false;
-    }
-  else if (vm.count("default_key") != 0)
-    {
-      isGetDefaultKey = true;
-      isGetDefaultId = false;
-    }
-
-  if (vm.count("quiet") != 0)
-    {
-      isQuiet = true;
-    }
-
-  ndn::security::v1::KeyChain keyChain;
-
-  if (vm.count("key") != 0)
-    {
-      Name keyNdnName(keyName);
-      if (isGetDefaultCert)
-        {
-          std::cout << keyChain.getDefaultCertificateNameForKey(keyNdnName);
-          if (!isQuiet) std::cout << std::endl;
-          return 0;
-        }
-      return 1;
-    }
-  else if (vm.count("identity") != 0)
-    {
-      Name identity(identityString);
-
-      if (isGetDefaultKey)
-        {
-          std::cout << keyChain.getDefaultKeyNameForIdentity(identity);
-          if (!isQuiet)
-            std::cout << std::endl;
-
-          return 0;
-        }
-      if (isGetDefaultCert)
-        {
-          std::cout << keyChain.getDefaultCertificateNameForIdentity(identity);
-          if (!isQuiet)
-            std::cout << std::endl;
-
-          return 0;
-        }
-      return 1;
-    }
-  else
-    {
-      Name identity = keyChain.getDefaultIdentity();
-      if (isGetDefaultId)
-        {
-          std::cout << identity;
-          if (!isQuiet) std::cout << std::endl;
-          return 0;
-        }
-      if (isGetDefaultKey)
-        {
-          std::cout << keyChain.getDefaultKeyNameForIdentity(identity);
-          if (!isQuiet) std::cout << std::endl;
-          return 0;
-        }
-      if (isGetDefaultCert)
-        {
-          std::cout << keyChain.getDefaultCertificateNameForIdentity(identity);
-          if (!isQuiet) std::cout << std::endl;
-          return 0;
-        }
-      return 1;
-    }
-}
-
-#endif // NDN_TOOLS_NDNSEC_GET_DEFAULT_HPP
diff --git a/tools/ndnsec/import.cpp b/tools/ndnsec/import.cpp
new file mode 100644
index 0000000..57b9f1b
--- /dev/null
+++ b/tools/ndnsec/import.cpp
@@ -0,0 +1,105 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "ndnsec.hpp"
+#include "util.hpp"
+
+namespace ndn {
+namespace ndnsec {
+
+int
+ndnsec_import(int argc, char** argv)
+{
+  using namespace ndn;
+  namespace po = boost::program_options;
+
+  std::string input("-");
+  std::string importPassword;
+  bool isPrivateImport = false;
+
+  po::options_description description("General Usage\n  ndnsec import [-h] [-p] input \nGeneral options");
+  description.add_options()
+    ("help,h", "produce help message")
+    ("private,p", "import info contains private key")
+    ("input,i", po::value<std::string>(&input), "input source, stdin if -")
+    ;
+
+  po::positional_options_description p;
+  p.add("input", 1);
+
+  po::variables_map vm;
+  try {
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
+
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    return 0;
+  }
+
+  if (vm.count("private") != 0)
+    isPrivateImport = true;
+
+  if (!isPrivateImport) {
+    std::cerr << "You are trying to import certificate!\n"
+              << "Please use ndnsec cert-install!" << std::endl;
+    return 1;
+  }
+  else {
+    try {
+      security::v1::KeyChain keyChain;
+
+      shared_ptr<security::v1::SecuredBag> securedBag;
+      if (input == "-")
+        securedBag = io::load<security::v1::SecuredBag>(std::cin);
+      else
+        securedBag = io::load<security::v1::SecuredBag>(input);
+
+      int count = 3;
+      while (!getPassword(importPassword, "Passphrase for the private key: ")) {
+        count--;
+        if (count <= 0) {
+          std::cerr << "ERROR: Fail to get password" << std::endl;
+          memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
+          return 1;
+        }
+      }
+      keyChain.importIdentity(*securedBag, importPassword);
+      memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
+    }
+    catch (const std::runtime_error& e) {
+      std::cerr << "ERROR: " << e.what() << std::endl;
+      memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
+      return 1;
+    }
+
+    return 0;
+  }
+}
+
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/import.hpp b/tools/ndnsec/import.hpp
deleted file mode 100644
index 41cf602..0000000
--- a/tools/ndnsec/import.hpp
+++ /dev/null
@@ -1,115 +0,0 @@
-/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2013-2017 Regents of the University of California.
- *
- * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
- *
- * ndn-cxx library is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Lesser General Public License as published by the Free Software
- * Foundation, either version 3 of the License, or (at your option) any later version.
- *
- * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
- * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
- * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
- *
- * You should have received copies of the GNU General Public License and GNU Lesser
- * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
- */
-
-#ifndef NDN_TOOLS_NDNSEC_IMPORT_HPP
-#define NDN_TOOLS_NDNSEC_IMPORT_HPP
-
-#include "util.hpp"
-
-int
-ndnsec_import(int argc, char** argv)
-{
-  using namespace ndn;
-  namespace po = boost::program_options;
-
-  std::string input("-");
-  std::string importPassword;
-  bool isPrivateImport = false;
-
-  po::options_description description("General Usage\n  ndnsec import [-h] [-p] input \nGeneral options");
-  description.add_options()
-    ("help,h", "produce help message")
-    ("private,p", "import info contains private key")
-    ("input,i", po::value<std::string>(&input), "input source, stdin if -")
-    ;
-
-  po::positional_options_description p;
-  p.add("input", 1);
-
-  po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
-
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
-
-  if (vm.count("private") != 0)
-    isPrivateImport = true;
-
-  if (!isPrivateImport)
-    {
-      std::cerr << "You are trying to import certificate!\n"
-                << "Please use ndnsec cert-install!" << std::endl;
-      return 1;
-    }
-  else
-    {
-      try
-        {
-          ndn::security::v1::KeyChain keyChain;
-
-          shared_ptr<ndn::security::v1::SecuredBag> securedBag;
-          if (input == "-")
-            securedBag = io::load<ndn::security::v1::SecuredBag>(std::cin);
-          else
-            securedBag = io::load<ndn::security::v1::SecuredBag>(input);
-
-          int count = 3;
-          while (!getPassword(importPassword, "Passphrase for the private key: "))
-            {
-              count--;
-              if (count <= 0)
-                {
-                  std::cerr << "ERROR: Fail to get password" << std::endl;
-                  memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
-                  return 1;
-                }
-            }
-          keyChain.importIdentity(*securedBag, importPassword);
-          memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
-        }
-      catch (const std::runtime_error& e)
-        {
-          std::cerr << "ERROR: " << e.what() << std::endl;
-          memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
-          return 1;
-        }
-
-      return 0;
-    }
-}
-
-#endif // NDN_TOOLS_NDNSEC_IMPORT_HPP
diff --git a/tools/ndnsec/key-gen.hpp b/tools/ndnsec/key-gen.cpp
similarity index 81%
rename from tools/ndnsec/key-gen.hpp
rename to tools/ndnsec/key-gen.cpp
index cd19ded..584b79c 100644
--- a/tools/ndnsec/key-gen.hpp
+++ b/tools/ndnsec/key-gen.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_KEY_GEN_HPP
-#define NDN_TOOLS_NDNSEC_KEY_GEN_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_key_gen(int argc, char** argv)
 {
@@ -59,8 +58,7 @@
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-              vm);
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
@@ -85,25 +83,25 @@
 
   bool isKsk = (vm.count("dsk") == 0);
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
   Name keyName;
 
   try {
     switch (keyType) {
-    case 'r':
-      keyName = keyChain.generateRsaKeyPair(Name(identityName), isKsk, RsaKeyParams().getKeySize());
-      break;
-    case 'e':
-      keyName = keyChain.generateEcKeyPair(Name(identityName), isKsk, EcKeyParams().getKeySize());
-      break;
-    default:
-      std::cerr << "Unrecongized key type" << "\n";
-      std::cerr << description << std::endl;
-      return 1;
+      case 'r':
+        keyName = keyChain.generateRsaKeyPair(Name(identityName), isKsk, RsaKeyParams().getKeySize());
+        break;
+      case 'e':
+        keyName = keyChain.generateEcKeyPair(Name(identityName), isKsk, EcKeyParams().getKeySize());
+        break;
+      default:
+        std::cerr << "Unrecongized key type\n"
+                  << description << std::endl;
+        return 1;
     }
 
-    if (0 == keyName.size()) {
-      std::cerr << "Error: failed to generate key" << "\n";
+    if (keyName.empty()) {
+      std::cerr << "Error: failed to generate key" << std::endl;
       return 1;
     }
 
@@ -122,4 +120,5 @@
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_KEY_GEN_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/list.hpp b/tools/ndnsec/list.cpp
similarity index 86%
rename from tools/ndnsec/list.hpp
rename to tools/ndnsec/list.cpp
index d7d3c4f..f6adbfe 100644
--- a/tools/ndnsec/list.hpp
+++ b/tools/ndnsec/list.cpp
@@ -17,17 +17,16 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_LIST_HPP
-#define NDN_TOOLS_NDNSEC_LIST_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 void
-printCertificate(ndn::security::v1::KeyChain& keyChain,
+printCertificate(security::v1::KeyChain& keyChain,
                  const ndn::Name& certName,
                  bool isDefault,
                  int verboseLevel)
@@ -40,17 +39,14 @@
   std::cout << certName << std::endl;
 
   if (verboseLevel >= 3) {
-    ndn::shared_ptr<ndn::security::v1::IdentityCertificate> certificate = keyChain.getCertificate(certName);
-    if (static_cast<bool>(certificate))
+    shared_ptr<security::v1::IdentityCertificate> certificate = keyChain.getCertificate(certName);
+    if (certificate != nullptr)
       certificate->printCertificate(std::cout, "            ");
   }
 }
 
 void
-printKey(ndn::security::v1::KeyChain& keyChain,
-         const ndn::Name& keyName,
-         bool isDefault,
-         int verboseLevel)
+printKey(security::v1::KeyChain& keyChain, const ndn::Name& keyName, bool isDefault, int verboseLevel)
 {
   if (isDefault)
     std::cout << "  +->* ";
@@ -74,7 +70,7 @@
 }
 
 void
-printIdentity(ndn::security::v1::KeyChain& keyChain,
+printIdentity(security::v1::KeyChain& keyChain,
               const ndn::Name& identity,
               bool isDefault,
               int verboseLevel)
@@ -142,19 +138,20 @@
   }
 
   if (vm.count("help") != 0) {
-    std::cerr << options << std::endl;;
+    std::cerr << options << std::endl;
+    ;
     return 0;
   }
 
   int tmpVerboseLevel = 0;
   if (vm.count("cert") != 0 || vm.count("cert2") != 0)
     tmpVerboseLevel = 2;
-  else if(vm.count("key") != 0 || vm.count("key2") != 0)
+  else if (vm.count("key") != 0 || vm.count("key2") != 0)
     tmpVerboseLevel = 1;
 
   verboseLevel = std::max(verboseLevel, tmpVerboseLevel);
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   std::vector<Name> defaultIdentities;
   keyChain.getAllIdentities(defaultIdentities, true);
@@ -171,4 +168,5 @@
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_LIST_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/main.cpp b/tools/ndnsec/main.cpp
index 4dc7ee0..6a2572a 100644
--- a/tools/ndnsec/main.cpp
+++ b/tools/ndnsec/main.cpp
@@ -17,101 +17,70 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
+#include "ndnsec.hpp"
+#include "util.hpp"
 #include "version.hpp"
 
-#include "security/v1/key-chain.hpp"
-#include "security/v1/certificate-subject-description.hpp"
-#include "security/v1/secured-bag.hpp"
-
-#include "util.hpp"
-#include "list.hpp"
-#include "get-default.hpp"
-#include "set-default.hpp"
-#include "key-gen.hpp"
-#include "dsk-gen.hpp"
-#include "sign-req.hpp"
-#include "cert-gen.hpp"
-#include "cert-revoke.hpp"
-#include "cert-dump.hpp"
-#include "cert-install.hpp"
-#include "export.hpp"
-#include "import.hpp"
-#include "delete.hpp"
-#include "set-acl.hpp"
-#include "unlock-tpm.hpp"
-#include "op-tool.hpp"
-
-using namespace ndn;
-using namespace ndn::security;
-using namespace ndn::security::v1;
-
-std::string ndnsec_helper("\
-  help         Show all commands.\n\
-  version      Show version and exit.\n\
-  list         Display information in PublicInfo.\n\
-  get-default  Get default setting info.\n\
-  set-default  Configure default setting.\n\
-  key-gen      Generate a Key-Signing-Key for an identity.\n\
-  dsk-gen      Generate a Data-Signing-Key for an identity.\n\
-  sign-req     Generate a certificate signing request.\n\
-  cert-gen     Generate an identity certificate.\n\
-  cert-revoke  Revoke an identity certificate.\n\
-  cert-dump    Dump a certificate from PublicInfo.\n\
-  cert-install Install a certificate into PublicInfo.\n\
-  delete       Delete identity/key/certificate.\n\
-  export       Export an identity package.\n\
-  import       Import an identity package.\n\
-  set-acl      Configure ACL of a private key.\n\
-  unlock-tpm   Unlock Tpm.\n\
-  op-tool      Operator tool.\n\
-");
+std::string ndnsec_helper = R"STR(
+  help         Show all commands
+  version      Show version and exit
+  list         Display information in PublicInfo
+  get-default  Get default setting info
+  set-default  Configure default setting
+  key-gen      Generate a Key-Signing-Key for an identity
+  dsk-gen      Generate a Data-Signing-Key for an identity
+  sign-req     Generate a certificate signing request
+  cert-gen     Generate an identity certificate
+  cert-revoke  Revoke an identity certificate
+  cert-dump    Dump a certificate from PublicInfo
+  cert-install Install a certificate into PublicInfo
+  delete       Delete identity/key/certificate
+  export       Export an identity package
+  import       Import an identity package
+  set-acl      Configure ACL of a private key
+  unlock-tpm   Unlock Tpm
+)STR";
 
 int
 main(int argc, char** argv)
 {
-  if (argc < 2)
-    {
+  if (argc < 2) {
+    std::cerr << ndnsec_helper << std::endl;
+    return 1;
+  }
+
+  using namespace ndn::ndnsec;
+
+  std::string command(argv[1]);
+  try {
+    if (command == "help")              { std::cout << ndnsec_helper << std::endl; }
+    else if (command == "version")      { std::cout << NDN_CXX_VERSION_BUILD_STRING << std::endl; }
+    else if (command == "list")         { return ndnsec_list(argc - 1, argv + 1); }
+    else if (command == "get-default")  { return ndnsec_get_default(argc - 1, argv + 1); }
+    else if (command == "set-default")  { return ndnsec_set_default(argc - 1, argv + 1); }
+    else if (command == "key-gen")      { return ndnsec_key_gen(argc - 1, argv + 1); }
+    else if (command == "dsk-gen")      { return ndnsec_dsk_gen(argc - 1, argv + 1); }
+    else if (command == "sign-req")     { return ndnsec_sign_req(argc - 1, argv + 1); }
+    else if (command == "cert-gen")     { return ndnsec_cert_gen(argc - 1, argv + 1); }
+    else if (command == "cert-revoke")  { return ndnsec_cert_revoke(argc - 1, argv + 1); }
+    else if (command == "cert-dump")    { return ndnsec_cert_dump(argc - 1, argv + 1); }
+    else if (command == "cert-install") { return ndnsec_cert_install(argc - 1, argv + 1); }
+    else if (command == "delete")       { return ndnsec_delete(argc - 1, argv + 1); }
+    else if (command == "export")       { return ndnsec_export(argc - 1, argv + 1); }
+    else if (command == "import")       { return ndnsec_import(argc - 1, argv + 1); }
+    else if (command == "set-acl")      { return ndnsec_set_acl(argc - 1, argv + 1); }
+    else if (command == "unlock-tpm")   { return ndnsec_unlock_tpm(argc - 1, argv + 1); }
+    else {
       std::cerr << ndnsec_helper << std::endl;
       return 1;
     }
-
-  std::string command(argv[1]);
-
-  try
-    {
-      if (command == "help")              { std::cout << ndnsec_helper << std::endl; }
-      else if (command == "version")      { std::cout << NDN_CXX_VERSION_BUILD_STRING
-                                                      << std::endl; }
-      else if (command == "list")         { return ndnsec_list(argc - 1, argv + 1); }
-      else if (command == "get-default")  { return ndnsec_get_default(argc - 1, argv + 1); }
-      else if (command == "set-default")  { return ndnsec_set_default(argc - 1, argv + 1); }
-      else if (command == "key-gen")      { return ndnsec_key_gen(argc - 1, argv + 1); }
-      else if (command == "dsk-gen")      { return ndnsec_dsk_gen(argc - 1, argv + 1); }
-      else if (command == "sign-req")     { return ndnsec_sign_req(argc - 1, argv + 1); }
-      else if (command == "cert-gen")     { return ndnsec_cert_gen(argc - 1, argv + 1); }
-      else if (command == "cert-revoke")  { return ndnsec_cert_revoke(argc - 1, argv + 1); }
-      else if (command == "cert-dump")    { return ndnsec_cert_dump(argc - 1, argv + 1); }
-      else if (command == "cert-install") { return ndnsec_cert_install(argc - 1, argv + 1); }
-      else if (command == "delete")       { return ndnsec_delete(argc - 1, argv + 1); }
-      else if (command == "export")       { return ndnsec_export(argc - 1, argv + 1); }
-      else if (command == "import")       { return ndnsec_import(argc - 1, argv + 1); }
-      else if (command == "set-acl")      { return ndnsec_set_acl(argc - 1, argv + 1); }
-      else if (command == "unlock-tpm")   { return ndnsec_unlock_tpm(argc - 1, argv + 1); }
-      else if (command == "op-tool")      { return ndnsec_op_tool(argc - 1, argv + 1); }
-      else {
-        std::cerr << ndnsec_helper << std::endl;
-        return 1;
-      }
-    }
-  catch (const std::runtime_error& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      return 1;
-    }
+  }
+  catch (const std::runtime_error& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    return 1;
+  }
 
   return 0;
 }
diff --git a/tools/ndnsec/ndnsec.hpp b/tools/ndnsec/ndnsec.hpp
new file mode 100644
index 0000000..b64a6b2
--- /dev/null
+++ b/tools/ndnsec/ndnsec.hpp
@@ -0,0 +1,76 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#ifndef NDN_TOOLS_NDNSEC_NDNSEC_HPP
+#define NDN_TOOLS_NDNSEC_NDNSEC_HPP
+
+namespace ndn {
+namespace ndnsec {
+
+int
+ndnsec_list(int argc, char** argv);
+
+int
+ndnsec_get_default(int argc, char** argv);
+
+int
+ndnsec_set_default(int argc, char** argv);
+
+int
+ndnsec_key_gen(int argc, char** argv);
+
+int
+ndnsec_dsk_gen(int argc, char** argv);
+
+int
+ndnsec_sign_req(int argc, char** argv);
+
+int
+ndnsec_cert_gen(int argc, char** argv);
+
+int
+ndnsec_cert_revoke(int argc, char** argv);
+
+int
+ndnsec_cert_dump(int argc, char** argv);
+
+int
+ndnsec_cert_install(int argc, char** argv);
+
+int
+ndnsec_delete(int argc, char** argv);
+
+int
+ndnsec_export(int argc, char** argv);
+
+int
+ndnsec_import(int argc, char** argv);
+
+int
+ndnsec_set_acl(int argc, char** argv);
+
+int
+ndnsec_unlock_tpm(int argc, char** argv);
+
+} // namespace ndnsec
+} // namespace ndn
+
+#endif // NDN_TOOLS_NDNSEC_NDNSEC_HPP
diff --git a/tools/ndnsec/op-tool.hpp b/tools/ndnsec/op-tool.hpp
deleted file mode 100644
index 971ad98..0000000
--- a/tools/ndnsec/op-tool.hpp
+++ /dev/null
@@ -1,96 +0,0 @@
-/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2013-2017 Regents of the University of California.
- *
- * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
- *
- * ndn-cxx library is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Lesser General Public License as published by the Free Software
- * Foundation, either version 3 of the License, or (at your option) any later version.
- *
- * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
- * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
- * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
- *
- * You should have received copies of the GNU General Public License and GNU Lesser
- * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
- */
-
-#ifndef NDN_TOOLS_NDNSEC_OP_TOOL_HPP
-#define NDN_TOOLS_NDNSEC_OP_TOOL_HPP
-
-#include "util.hpp"
-
-int
-ndnsec_op_tool(int argc, char** argv)
-{
-  using namespace ndn;
-  namespace po = boost::program_options;
-
-  std::string command;
-
-  po::options_description description("General options");
-  description.add_options()
-    ("help,h", "produce this help message")
-    ("command", po::value<std::string>(&command), "command")
-    ;
-
-  po::positional_options_description p;
-  p.add("command", 1);
-
-  po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return -1;
-    }
-
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
-
-  if (vm.count("command") == 0)
-    {
-      std::cerr << "command must be specified" << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
-
-  if (command == "sign") // the content to be signed from stdin
-    {
-      ndn::security::v1::KeyChain keyChain;
-
-      Buffer dataToSign((std::istreambuf_iterator<char>(std::cin)), std::istreambuf_iterator<char>());
-
-      Block value = keyChain.sign(dataToSign.buf(), dataToSign.size(),
-                                  security::SigningInfo(security::SigningInfo::SIGNER_TYPE_CERT,
-                                                        keyChain.getDefaultCertificateName()));
-
-      if (value.value_size() == 0)
-        {
-          std::cerr << "Error signing with default key" << std::endl;
-          return -1;
-        }
-
-      value.encode();
-      std::cout.write(reinterpret_cast<const char*>(value.wire()), value.size());
-    }
-
-  return 0;
-}
-
-#endif // NDN_TOOLS_NDNSEC_OP_TOOL_HPP
diff --git a/tools/ndnsec/set-acl.hpp b/tools/ndnsec/set-acl.cpp
similarity index 65%
rename from tools/ndnsec/set-acl.hpp
rename to tools/ndnsec/set-acl.cpp
index cf12d55..3f73f27 100644
--- a/tools/ndnsec/set-acl.hpp
+++ b/tools/ndnsec/set-acl.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_SET_ACL_HPP
-#define NDN_TOOLS_NDNSEC_SET_ACL_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_set_acl(int argc, char** argv)
 {
@@ -47,42 +46,37 @@
   p.add("appPath", 1);
 
   po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      return 1;
-    }
+  try {
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    return 1;
+  }
 
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    return 0;
+  }
 
-  if (vm.count("keyName") == 0)
-    {
-      std::cerr << "ERROR: keyName is required!" << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
+  if (vm.count("keyName") == 0) {
+    std::cerr << "ERROR: keyName is required!" << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
 
-  if (vm.count("appPath") == 0)
-    {
-      std::cerr << "ERROR: appPath is required!" << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
+  if (vm.count("appPath") == 0) {
+    std::cerr << "ERROR: appPath is required!" << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
   keyChain.addAppToAcl(keyName, KeyClass::PRIVATE, appPath, AclType::PRIVATE);
 
   return 0;
 }
 
-#endif // NDN_TOOLS_NDNSEC_SET_ACL_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/set-default.cpp b/tools/ndnsec/set-default.cpp
new file mode 100644
index 0000000..ab045ef
--- /dev/null
+++ b/tools/ndnsec/set-default.cpp
@@ -0,0 +1,103 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "ndnsec.hpp"
+#include "util.hpp"
+
+namespace ndn {
+namespace ndnsec {
+
+int
+ndnsec_set_default(int argc, char** argv)
+{
+  using namespace ndn;
+  namespace po = boost::program_options;
+
+  std::string certFileName;
+  bool isSetDefaultId = true;
+  bool isSetDefaultKey = false;
+  bool isSetDefaultCert = false;
+  std::string name;
+
+  po::options_description description("General Usage\n  ndnsec set-default [-h] [-k|c] name\nGeneral options");
+  description.add_options()
+    ("help,h", "produce help message")
+    ("default_key,k", "set default key of the identity")
+    ("default_cert,c", "set default certificate of the key")
+    ("name,n", po::value<std::string>(&name), "the name to set")
+    ;
+
+  po::positional_options_description p;
+  p.add("name", 1);
+  po::variables_map vm;
+  try {
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
+
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    return 0;
+  }
+
+  if (vm.count("name") == 0) {
+    std::cerr << "ERROR: name is required!" << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
+
+  security::v1::KeyChain keyChain;
+
+  if (vm.count("default_key") != 0) {
+    isSetDefaultKey = true;
+    isSetDefaultId = false;
+  }
+  else if (vm.count("default_cert") != 0) {
+    isSetDefaultCert = true;
+    isSetDefaultId = false;
+  }
+
+  if (isSetDefaultId) {
+    Name idName(name);
+    keyChain.setDefaultIdentity(idName);
+    return 0;
+  }
+  if (isSetDefaultKey) {
+    Name keyName(name);
+    keyChain.setDefaultKeyNameForIdentity(keyName);
+    return 0;
+  }
+
+  if (isSetDefaultCert) {
+    keyChain.setDefaultCertificateNameForKey(name);
+    return 0;
+  }
+
+  return 1;
+}
+
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/set-default.hpp b/tools/ndnsec/set-default.hpp
deleted file mode 100644
index d1ff7fa..0000000
--- a/tools/ndnsec/set-default.hpp
+++ /dev/null
@@ -1,110 +0,0 @@
-/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
- * Copyright (c) 2013-2017 Regents of the University of California.
- *
- * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
- *
- * ndn-cxx library is free software: you can redistribute it and/or modify it under the
- * terms of the GNU Lesser General Public License as published by the Free Software
- * Foundation, either version 3 of the License, or (at your option) any later version.
- *
- * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
- * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
- * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
- *
- * You should have received copies of the GNU General Public License and GNU Lesser
- * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
- */
-
-#ifndef NDN_TOOLS_NDNSEC_SET_DEFAULT_HPP
-#define NDN_TOOLS_NDNSEC_SET_DEFAULT_HPP
-
-int
-ndnsec_set_default(int argc, char** argv)
-{
-  using namespace ndn;
-  namespace po = boost::program_options;
-
-  std::string certFileName;
-  bool isSetDefaultId = true;
-  bool isSetDefaultKey = false;
-  bool isSetDefaultCert = false;
-  std::string name;
-
-  po::options_description description("General Usage\n  ndnsec set-default [-h] [-k|c] name\nGeneral options");
-  description.add_options()
-    ("help,h", "produce help message")
-    ("default_key,k", "set default key of the identity")
-    ("default_cert,c", "set default certificate of the key")
-    ("name,n", po::value<std::string>(&name), "the name to set")
-    ;
-
-  po::positional_options_description p;
-  p.add("name", 1);
-  po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
-
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
-
-  if (vm.count("name") == 0)
-    {
-      std::cerr << "ERROR: name is required!" << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
-
-  ndn::security::v1::KeyChain keyChain;
-
-  if (vm.count("default_key") != 0)
-    {
-      isSetDefaultKey = true;
-      isSetDefaultId = false;
-    }
-  else if (vm.count("default_cert") != 0)
-    {
-      isSetDefaultCert = true;
-      isSetDefaultId = false;
-    }
-
-  if (isSetDefaultId)
-    {
-      Name idName(name);
-      keyChain.setDefaultIdentity(idName);
-      return 0;
-    }
-  if (isSetDefaultKey)
-    {
-      Name keyName(name);
-      keyChain.setDefaultKeyNameForIdentity(keyName);
-      return 0;
-    }
-
-  if (isSetDefaultCert)
-    {
-      keyChain.setDefaultCertificateNameForKey(name);
-      return 0;
-    }
-
-  return 1;
-}
-#endif // NDN_TOOLS_NDNSEC_SET_DEFAULT_HPP
diff --git a/tools/ndnsec/sign-req.hpp b/tools/ndnsec/sign-req.cpp
similarity index 65%
rename from tools/ndnsec/sign-req.hpp
rename to tools/ndnsec/sign-req.cpp
index 425839f..eced361 100644
--- a/tools/ndnsec/sign-req.hpp
+++ b/tools/ndnsec/sign-req.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_SIGN_REQ_HPP
-#define NDN_TOOLS_NDNSEC_SIGN_REQ_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_sign_req(int argc, char** argv)
 {
@@ -36,49 +35,44 @@
   std::string name;
   bool isKeyName = false;
 
-  po::options_description description("General Usage\n  ndnsec sign-req [-h] [-k] name\nGeneral options");
+  po::options_description description(
+    "General Usage\n  ndnsec sign-req [-h] [-k] name\nGeneral options");
   description.add_options()
     ("help,h", "produce help message")
     ("key,k", "optional, if specified, name is keyName (e.g. /ndn/edu/ucla/alice/ksk-123456789), otherwise identity name")
-    ("name,n", po::value<std::string>(&name), "name, for example, /ndn/edu/ucla/alice")
-    ;
+    ("name,n", po::value<std::string>(&name), "name, for example, /ndn/edu/ucla/alice");
 
   po::positional_options_description p;
   p.add("name", 1);
 
   po::variables_map vm;
-  try
-    {
-      po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
-                vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
+  try {
+    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
 
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    return 0;
+  }
 
-  if (vm.count("name") == 0)
-    {
-      std::cerr << "ERROR: name must be specified" << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
+  if (vm.count("name") == 0) {
+    std::cerr << "ERROR: name must be specified" << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
 
   if (vm.count("key") != 0)
     isKeyName = true;
 
-  shared_ptr<v1::IdentityCertificate> selfSignCert;
+  shared_ptr<security::v1::IdentityCertificate> selfSignCert;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   if (isKeyName)
     selfSignCert = keyChain.selfSign(name);
@@ -87,7 +81,7 @@
     selfSignCert = keyChain.selfSign(keyName);
   }
 
-  if (static_cast<bool>(selfSignCert)) {
+  if (selfSignCert != nullptr) {
     io::save(*selfSignCert, std::cout);
     return 0;
   }
@@ -97,4 +91,5 @@
   }
 }
 
-#endif // NDN_TOOLS_NDNSEC_SIGN_REQ_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/unlock-tpm.hpp b/tools/ndnsec/unlock-tpm.cpp
similarity index 66%
rename from tools/ndnsec/unlock-tpm.hpp
rename to tools/ndnsec/unlock-tpm.cpp
index 927bc81..86d7635 100644
--- a/tools/ndnsec/unlock-tpm.hpp
+++ b/tools/ndnsec/unlock-tpm.cpp
@@ -17,15 +17,14 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
-#ifndef NDN_TOOLS_NDNSEC_UNLOCK_TPM_HPP
-#define NDN_TOOLS_NDNSEC_UNLOCK_TPM_HPP
-
+#include "ndnsec.hpp"
 #include "util.hpp"
 
+namespace ndn {
+namespace ndnsec {
+
 int
 ndnsec_unlock_tpm(int argc, char** argv)
 {
@@ -36,53 +35,47 @@
   std::string keyName;
 
   po::options_description description("General Usage\n  ndnsec unlock-tpm [-h] \nGeneral options");
-  description.add_options()
-    ("help,h", "produce help message")
-    ;
+  description.add_options()("help,h", "produce help message");
 
   po::variables_map vm;
 
-  try
-    {
-      po::store(po::parse_command_line(argc, argv, description), vm);
-      po::notify(vm);
-    }
-  catch (const std::exception& e)
-    {
-      std::cerr << "ERROR: " << e.what() << std::endl;
-      std::cerr << description << std::endl;
-      return 1;
-    }
+  try {
+    po::store(po::parse_command_line(argc, argv, description), vm);
+    po::notify(vm);
+  }
+  catch (const std::exception& e) {
+    std::cerr << "ERROR: " << e.what() << std::endl;
+    std::cerr << description << std::endl;
+    return 1;
+  }
 
-  if (vm.count("help") != 0)
-    {
-      std::cerr << description << std::endl;
-      return 0;
-    }
+  if (vm.count("help") != 0) {
+    std::cerr << description << std::endl;
+    return 0;
+  }
 
   bool isUnlocked = false;
 
-  ndn::security::v1::KeyChain keyChain;
+  security::v1::KeyChain keyChain;
 
   char* password;
   password = getpass("Password to unlock the TPM: ");
   isUnlocked = keyChain.unlockTpm(password, strlen(password), true);
   memset(password, 0, strlen(password));
 
-  if (isUnlocked)
-    {
-      std::cerr << "OK: TPM is unlocked" << std::endl;
-      return 0;
-    }
-  else
-    {
-      std::cerr << "ERROR: TPM is still locked" << std::endl;
-      return 1;
-    }
+  if (isUnlocked) {
+    std::cerr << "OK: TPM is unlocked" << std::endl;
+    return 0;
+  }
+  else {
+    std::cerr << "ERROR: TPM is still locked" << std::endl;
+    return 1;
+  }
 #else
   std::cerr << "ERROR: Command not supported on this platform" << std::endl;
   return 1;
 #endif // NDN_CXX_HAVE_GETPASS
 }
 
-#endif // NDN_TOOLS_NDNSEC_UNLOCK_TPM_HPP
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/util.cpp b/tools/ndnsec/util.cpp
new file mode 100644
index 0000000..7afa036
--- /dev/null
+++ b/tools/ndnsec/util.cpp
@@ -0,0 +1,76 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2017 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#include "util.hpp"
+
+namespace ndn {
+namespace ndnsec {
+
+bool
+getPassword(std::string& password, const std::string& prompt)
+{
+#ifdef NDN_CXX_HAVE_GETPASS
+  bool isReady = false;
+
+  char* pw0 = nullptr;
+
+  pw0 = getpass(prompt.c_str());
+  if (!pw0)
+    return false;
+  std::string password1 = pw0;
+  memset(pw0, 0, strlen(pw0));
+
+  pw0 = getpass("Confirm:");
+  if (!pw0) {
+    char* pw1 = const_cast<char*>(password1.c_str());
+    memset(pw1, 0, password1.size());
+    return false;
+  }
+
+  if (!password1.compare(pw0)) {
+    isReady = true;
+    password.swap(password1);
+  }
+
+  char* pw1 = const_cast<char*>(password1.c_str());
+  memset(pw1, 0, password1.size());
+  memset(pw0, 0, strlen(pw0));
+
+  if (password.empty())
+    return false;
+
+  return isReady;
+#else
+  return false;
+#endif // NDN_CXX_HAVE_GETPASS
+}
+
+shared_ptr<security::v1::IdentityCertificate>
+getIdentityCertificate(const std::string& fileName)
+{
+  if (fileName == "-")
+    return io::load<security::v1::IdentityCertificate>(std::cin);
+  else
+    return io::load<security::v1::IdentityCertificate>(fileName);
+}
+
+} // namespace ndnsec
+} // namespace ndn
diff --git a/tools/ndnsec/util.hpp b/tools/ndnsec/util.hpp
index c026852..4f6cee4 100644
--- a/tools/ndnsec/util.hpp
+++ b/tools/ndnsec/util.hpp
@@ -17,82 +17,36 @@
  * <http://www.gnu.org/licenses/>.
  *
  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
- *
- * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
  */
 
 #ifndef NDN_TOOLS_NDNSEC_UTIL_HPP
 #define NDN_TOOLS_NDNSEC_UTIL_HPP
 
-#include <iostream>
-#include <fstream>
-#include <string>
-#include <cstring>
-
-#include <boost/program_options/options_description.hpp>
-#include <boost/program_options/variables_map.hpp>
-#include <boost/program_options/parsers.hpp>
-#include <boost/date_time/posix_time/posix_time.hpp>
-#include <boost/tokenizer.hpp>
-#include <boost/asio.hpp>
-#include <boost/exception/all.hpp>
-
 #include "encoding/buffer-stream.hpp"
-#include "security/v1/key-chain.hpp"
 #include "security/transform.hpp"
+#include "security/v1/key-chain.hpp"
 #include "util/io.hpp"
 
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include <boost/asio.hpp>
+#include <boost/date_time/posix_time/posix_time.hpp>
+#include <boost/exception/all.hpp>
+#include <boost/program_options/options_description.hpp>
+#include <boost/program_options/parsers.hpp>
+#include <boost/program_options/variables_map.hpp>
+#include <boost/tokenizer.hpp>
+
+namespace ndn {
+namespace ndnsec {
+
 bool
-getPassword(std::string& password, const std::string& prompt)
-{
-#ifdef NDN_CXX_HAVE_GETPASS
-  bool isReady = false;
+getPassword(std::string& password, const std::string& prompt);
 
-  char* pw0 = 0;
-
-  pw0 = getpass(prompt.c_str());
-  if (!pw0)
-    return false;
-  std::string password1 = pw0;
-  memset(pw0, 0, strlen(pw0));
-
-  pw0 = getpass("Confirm:");
-  if (!pw0)
-    {
-      char* pw1 = const_cast<char*>(password1.c_str());
-      memset(pw1, 0, password1.size());
-      return false;
-    }
-
-  if (!password1.compare(pw0))
-    {
-      isReady = true;
-      password.swap(password1);
-    }
-
-  char* pw1 = const_cast<char*>(password1.c_str());
-  memset(pw1, 0, password1.size());
-  memset(pw0, 0, strlen(pw0));
-
-  if (password.empty())
-    return false;
-
-  return isReady;
-#else
-  return false;
-#endif // NDN_CXX_HAVE_GETPASS
-}
-
-ndn::shared_ptr<ndn::security::v1::IdentityCertificate>
-getIdentityCertificate(const std::string& fileName)
-{
-
-  if (fileName == "-")
-    return ndn::io::load<ndn::security::v1::IdentityCertificate>(std::cin);
-  else
-    return ndn::io::load<ndn::security::v1::IdentityCertificate>(fileName);
-}
-
+shared_ptr<security::v1::IdentityCertificate>
+getIdentityCertificate(const std::string& fileName);
 
 /**
  * @brief An accumulating option value to handle multiple incrementing options.
@@ -112,11 +66,6 @@
   {
   }
 
-  virtual
-  ~AccumulatorType()
-  {
-  }
-
   /// @brief Set the default value for this option.
   AccumulatorType*
   setDefaultValue(const T& t)
@@ -132,7 +81,8 @@
    * to be applied on each occurrence of the option.
    */
   AccumulatorType*
-  setInterval(const T& t) {
+  setInterval(const T& t)
+  {
     m_interval = t;
     return this;
   }
@@ -177,9 +127,7 @@
    * There should never be any tokens.
    */
   void
-  parse(boost::any& value_store,
-        const std::vector<std::string>& new_tokens,
-        bool utf8) const final
+  parse(boost::any& value_store, const std::vector<std::string>& new_tokens, bool utf8) const final
   {
     if (value_store.empty())
       value_store = T();
@@ -216,21 +164,26 @@
 #endif // BOOST_VERSION >= 105900
 
 private:
-    T* m_store;
-    T m_interval;
-    T m_default;
+  T* m_store;
+  T m_interval;
+  T m_default;
 };
 
-template<typename T>
-AccumulatorType<T>* accumulator()
+template <typename T>
+AccumulatorType<T>*
+accumulator()
 {
   return new AccumulatorType<T>(0);
 }
 
-template<typename T>
-AccumulatorType<T>* accumulator(T* store)
+template <typename T>
+AccumulatorType<T>*
+accumulator(T* store)
 {
   return new AccumulatorType<T>(store);
 }
 
+} // namespace ndnsec
+} // namespace ndn
+
 #endif // NDN_TOOLS_NDNSEC_UTIL_HPP