diff --git a/tests/unit/security/key-chain.t.cpp b/tests/unit/security/key-chain.t.cpp
index ee3e28e..ec40fbd 100644
--- a/tests/unit/security/key-chain.t.cpp
+++ b/tests/unit/security/key-chain.t.cpp
@@ -575,10 +575,10 @@
 
 BOOST_FIXTURE_TEST_CASE(ImportPrivateKey, KeyChainFixture)
 {
-  Name keyName("/test/device2");
-  std::string rawKey("nPSNOHyZKsg2WLqHAs7MXGb0sjQb4zCT");
+  const Name keyName("/test/device2");
+  const uint8_t rawKey[] = "nPSNOHyZKsg2WLqHAs7MXGb0sjQb4zCT";
   auto key = make_shared<transform::PrivateKey>();
-  key->loadRaw(KeyType::HMAC, reinterpret_cast<const uint8_t*>(rawKey.data()), rawKey.size());
+  key->loadRaw(KeyType::HMAC, rawKey);
 
   m_keyChain.importPrivateKey(keyName, key);
   BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(keyName), true);
diff --git a/tests/unit/security/pib/impl/identity-impl.t.cpp b/tests/unit/security/pib/impl/identity-impl.t.cpp
index 3890ddc..1b4527f 100644
--- a/tests/unit/security/pib/impl/identity-impl.t.cpp
+++ b/tests/unit/security/pib/impl/identity-impl.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2020 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -63,14 +63,15 @@
   BOOST_REQUIRE_THROW(identity1.setDefaultKey(id1Key1Name), Pib::Error);
 
   // add key
-  identity1.addKey(id1Key1.data(), id1Key1.size(), id1Key1Name);
+  identity1.addKey(id1Key1, id1Key1Name);
   BOOST_CHECK_NO_THROW(identity1.getKey(id1Key1Name));
 
   // new key becomes default key when there is no default key
   BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
   const Key& defaultKey0 = identity1.getDefaultKey();
   BOOST_CHECK_EQUAL(defaultKey0.getName(), id1Key1Name);
-  BOOST_CHECK(defaultKey0.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(defaultKey0.getPublicKey().begin(), defaultKey0.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
 
   // remove key
   identity1.removeKey(id1Key1Name);
@@ -78,17 +79,18 @@
   BOOST_CHECK_THROW(identity1.getDefaultKey(), Pib::Error);
 
   // set default key directly
-  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1.data(), id1Key1.size(), id1Key1Name));
+  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1, id1Key1Name));
   BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
   BOOST_CHECK_NO_THROW(identity1.getKey(id1Key1Name));
 
   // check default key
   const Key& defaultKey1 = identity1.getDefaultKey();
   BOOST_CHECK_EQUAL(defaultKey1.getName(), id1Key1Name);
-  BOOST_CHECK(defaultKey1.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(defaultKey1.getPublicKey().begin(), defaultKey1.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
 
   // add another key
-  identity1.addKey(id1Key2.data(), id1Key2.size(), id1Key2Name);
+  identity1.addKey(id1Key2, id1Key2Name);
   BOOST_CHECK_EQUAL(identity1.getKeys().size(), 2);
 
   // set default key through name
@@ -96,7 +98,8 @@
   BOOST_REQUIRE_NO_THROW(identity1.getDefaultKey());
   const Key& defaultKey2 = identity1.getDefaultKey();
   BOOST_CHECK_EQUAL(defaultKey2.getName(), id1Key2Name);
-  BOOST_CHECK(defaultKey2.getPublicKey() == id1Key2);
+  BOOST_CHECK_EQUAL_COLLECTIONS(defaultKey2.getPublicKey().begin(), defaultKey2.getPublicKey().end(),
+                                id1Key2.begin(), id1Key2.end());
 
   // remove key
   identity1.removeKey(id1Key1Name);
@@ -104,10 +107,11 @@
   BOOST_CHECK_EQUAL(identity1.getKeys().size(), 1);
 
   // set default key directly again, change the default setting
-  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1.data(), id1Key1.size(), id1Key1Name));
+  BOOST_REQUIRE_NO_THROW(identity1.setDefaultKey(id1Key1, id1Key1Name));
   const Key& defaultKey3 = identity1.getDefaultKey();
   BOOST_CHECK_EQUAL(defaultKey3.getName(), id1Key1Name);
-  BOOST_CHECK(defaultKey3.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(defaultKey3.getPublicKey().begin(), defaultKey3.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
   BOOST_CHECK_EQUAL(identity1.getKeys().size(), 2);
 
   // remove all keys
@@ -125,11 +129,15 @@
   auto pibImpl = make_shared<pib::PibMemory>();
   IdentityImpl identity1(id1, pibImpl, true);
 
-  identity1.addKey(id1Key1.data(), id1Key1.size(), id1Key1Name);
-  BOOST_CHECK(identity1.getKey(id1Key1Name).getPublicKey() == id1Key1);
+  identity1.addKey(id1Key1, id1Key1Name);
+  auto k1 = identity1.getKey(id1Key1Name);
+  BOOST_CHECK_EQUAL_COLLECTIONS(k1.getPublicKey().begin(), k1.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
 
-  identity1.addKey(id1Key2.data(), id1Key2.size(), id1Key1Name); // overwriting key should work
-  BOOST_CHECK(identity1.getKey(id1Key1Name).getPublicKey() == id1Key2);
+  identity1.addKey(id1Key2, id1Key1Name); // overwriting key should work
+  auto k2 = identity1.getKey(id1Key1Name);
+  BOOST_CHECK_EQUAL_COLLECTIONS(k2.getPublicKey().begin(), k2.getPublicKey().end(),
+                                id1Key2.begin(), id1Key2.end());
 }
 
 BOOST_AUTO_TEST_CASE(Errors)
@@ -139,11 +147,11 @@
   BOOST_CHECK_THROW(IdentityImpl(id1, pibImpl, false), Pib::Error);
   IdentityImpl identity1(id1, pibImpl, true);
 
-  identity1.addKey(id1Key1.data(), id1Key1.size(), id1Key1Name);
-  BOOST_CHECK_THROW(identity1.addKey(id2Key1.data(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  identity1.addKey(id1Key1, id1Key1Name);
+  BOOST_CHECK_THROW(identity1.addKey(id2Key1, id2Key1Name), std::invalid_argument);
   BOOST_CHECK_THROW(identity1.removeKey(id2Key1Name), std::invalid_argument);
   BOOST_CHECK_THROW(identity1.getKey(id2Key1Name), std::invalid_argument);
-  BOOST_CHECK_THROW(identity1.setDefaultKey(id2Key1.data(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(identity1.setDefaultKey(id2Key1, id2Key1Name), std::invalid_argument);
   BOOST_CHECK_THROW(identity1.setDefaultKey(id2Key1Name), std::invalid_argument);
 }
 
diff --git a/tests/unit/security/pib/impl/key-impl.t.cpp b/tests/unit/security/pib/impl/key-impl.t.cpp
index be986a1..c59efb5 100644
--- a/tests/unit/security/pib/impl/key-impl.t.cpp
+++ b/tests/unit/security/pib/impl/key-impl.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2020 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -42,24 +42,26 @@
 BOOST_AUTO_TEST_CASE(Basic)
 {
   auto pibImpl = make_shared<pib::PibMemory>();
-  KeyImpl key11(id1Key1Name, id1Key1.data(), id1Key1.size(), pibImpl);
+  KeyImpl key11(id1Key1Name, id1Key1, pibImpl);
 
   BOOST_CHECK_EQUAL(key11.getName(), id1Key1Name);
   BOOST_CHECK_EQUAL(key11.getIdentity(), id1);
   BOOST_CHECK_EQUAL(key11.getKeyType(), KeyType::EC);
-  BOOST_CHECK(key11.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key11.getPublicKey().begin(), key11.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
 
   KeyImpl key11Bak(id1Key1Name, pibImpl);
   BOOST_CHECK_EQUAL(key11Bak.getName(), id1Key1Name);
   BOOST_CHECK_EQUAL(key11Bak.getIdentity(), id1);
   BOOST_CHECK_EQUAL(key11Bak.getKeyType(), KeyType::EC);
-  BOOST_CHECK(key11Bak.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key11Bak.getPublicKey().begin(), key11Bak.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
 }
 
 BOOST_AUTO_TEST_CASE(CertificateOperation)
 {
   auto pibImpl = make_shared<pib::PibMemory>();
-  KeyImpl key11(id1Key1Name, id1Key1.data(), id1Key1.size(), pibImpl);
+  KeyImpl key11(id1Key1Name, id1Key1, pibImpl);
   BOOST_CHECK_NO_THROW(KeyImpl(id1Key1Name, pibImpl));
 
   // key does not have any certificate
@@ -140,14 +142,16 @@
   auto pibImpl = make_shared<pib::PibMemory>();
 
   BOOST_CHECK_THROW(KeyImpl(id1Key1Name, pibImpl), Pib::Error);
-  KeyImpl(id1Key1Name, id1Key1.data(), id1Key1.size(), pibImpl);
+  KeyImpl(id1Key1Name, id1Key1, pibImpl);
   KeyImpl key1(id1Key1Name, pibImpl);
 
-  KeyImpl(id1Key1Name, id1Key2.data(), id1Key2.size(), pibImpl); // overwriting of the key should work
+  KeyImpl(id1Key1Name, id1Key2, pibImpl); // overwriting of the key should work
   KeyImpl key2(id1Key1Name, pibImpl);
 
-  BOOST_CHECK(key1.getPublicKey() != key2.getPublicKey()); // key1 cached the original public key
-  BOOST_CHECK(key2.getPublicKey() == id1Key2);
+  Buffer key1buf(key1.getPublicKey().begin(), key1.getPublicKey().end());
+  Buffer key2buf(key2.getPublicKey().begin(), key2.getPublicKey().end());
+  BOOST_CHECK(key1buf != key2buf); // key1 cached the original public key
+  BOOST_CHECK(key2buf == id1Key2);
 
   key1.addCertificate(id1Key1Cert1);
   BOOST_CHECK_EQUAL(key1.getCertificate(id1Key1Cert1.getName()), id1Key1Cert1);
@@ -172,12 +176,12 @@
   auto pibImpl = make_shared<pib::PibMemory>();
 
   BOOST_CHECK_THROW(KeyImpl(id1Key1Name, pibImpl), Pib::Error);
-  KeyImpl key11(id1Key1Name, id1Key1.data(), id1Key1.size(), pibImpl);
+  KeyImpl key11(id1Key1Name, id1Key1, pibImpl);
 
   BOOST_CHECK_THROW(KeyImpl(Name("/wrong"), pibImpl), std::invalid_argument);
-  BOOST_CHECK_THROW(KeyImpl(Name("/wrong"), id1Key1.data(), id1Key1.size(), pibImpl), std::invalid_argument);
+  BOOST_CHECK_THROW(KeyImpl(Name("/wrong"), id1Key1, pibImpl), std::invalid_argument);
   Buffer wrongKey;
-  BOOST_CHECK_THROW(KeyImpl(id1Key2Name, wrongKey.data(), wrongKey.size(), pibImpl), std::invalid_argument);
+  BOOST_CHECK_THROW(KeyImpl(id1Key2Name, wrongKey, pibImpl), std::invalid_argument);
 
   key11.addCertificate(id1Key1Cert1);
   BOOST_CHECK_THROW(key11.addCertificate(id1Key2Cert1), std::invalid_argument);
diff --git a/tests/unit/security/pib/key-container.t.cpp b/tests/unit/security/pib/key-container.t.cpp
index 1a66573..25188a2 100644
--- a/tests/unit/security/pib/key-container.t.cpp
+++ b/tests/unit/security/pib/key-container.t.cpp
@@ -49,25 +49,28 @@
   BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 0);
 
   // add the first key
-  Key key11 = container.add(id1Key1.data(), id1Key1.size(), id1Key1Name);
+  Key key11 = container.add(id1Key1, id1Key1Name);
   BOOST_CHECK_EQUAL(key11.getName(), id1Key1Name);
-  BOOST_CHECK(key11.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key11.getPublicKey().begin(), key11.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
   BOOST_CHECK_EQUAL(container.size(), 1);
   BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 1);
   BOOST_CHECK(container.find(id1Key1Name) != container.end());
 
   // add the same key again
-  Key key12 = container.add(id1Key1.data(), id1Key1.size(), id1Key1Name);
+  Key key12 = container.add(id1Key1, id1Key1Name);
   BOOST_CHECK_EQUAL(key12.getName(), id1Key1Name);
-  BOOST_CHECK(key12.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key12.getPublicKey().begin(), key12.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
   BOOST_CHECK_EQUAL(container.size(), 1);
   BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 1);
   BOOST_CHECK(container.find(id1Key1Name) != container.end());
 
   // add the second key
-  Key key21 = container.add(id1Key2.data(), id1Key2.size(), id1Key2Name);
+  Key key21 = container.add(id1Key2, id1Key2Name);
   BOOST_CHECK_EQUAL(key21.getName(), id1Key2Name);
-  BOOST_CHECK(key21.getPublicKey() == id1Key2);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key21.getPublicKey().begin(), key21.getPublicKey().end(),
+                                id1Key2.begin(), id1Key2.end());
   BOOST_CHECK_EQUAL(container.size(), 2);
   BOOST_CHECK_EQUAL(container.getLoadedKeys().size(), 2);
   BOOST_CHECK(container.find(id1Key1Name) != container.end());
@@ -83,9 +86,11 @@
   Key key1 = container.get(id1Key1Name);
   Key key2 = container.get(id1Key2Name);
   BOOST_CHECK_EQUAL(key1.getName(), id1Key1Name);
-  BOOST_CHECK(key1.getPublicKey() == id1Key1);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key1.getPublicKey().begin(), key1.getPublicKey().end(),
+                                id1Key1.begin(), id1Key1.end());
   BOOST_CHECK_EQUAL(key2.getName(), id1Key2Name);
-  BOOST_CHECK(key2.getPublicKey() == id1Key2);
+  BOOST_CHECK_EQUAL_COLLECTIONS(key2.getPublicKey().begin(), key2.getPublicKey().end(),
+                                id1Key2.begin(), id1Key2.end());
 
   // create another container from the same PibImpl
   // cache should be empty
@@ -122,7 +127,7 @@
 
   KeyContainer container(id1, pibImpl);
 
-  BOOST_CHECK_THROW(container.add(id2Key1.data(), id2Key1.size(), id2Key1Name), std::invalid_argument);
+  BOOST_CHECK_THROW(container.add(id2Key1, id2Key1Name), std::invalid_argument);
   BOOST_CHECK_THROW(container.remove(id2Key1Name), std::invalid_argument);
   BOOST_CHECK_THROW(container.get(id2Key1Name), std::invalid_argument);
 }
@@ -132,8 +137,8 @@
   auto pibImpl = make_shared<PibMemory>();
   KeyContainer container(id1, pibImpl);
 
-  container.add(id1Key1.data(), id1Key1.size(), id1Key1Name);
-  container.add(id1Key2.data(), id1Key2.size(), id1Key2Name);
+  container.add(id1Key1, id1Key1Name);
+  container.add(id1Key2, id1Key2Name);
 
   std::set<Name> keyNames;
   keyNames.insert(id1Key1Name);
diff --git a/tests/unit/security/pib/key.t.cpp b/tests/unit/security/pib/key.t.cpp
index 544848f..8d0244f 100644
--- a/tests/unit/security/pib/key.t.cpp
+++ b/tests/unit/security/pib/key.t.cpp
@@ -44,8 +44,8 @@
   BOOST_CHECK(!key);
   BOOST_CHECK_EQUAL(static_cast<bool>(key), false);
 
-  auto keyImpl = make_shared<detail::KeyImpl>(id1Key1Name, id1Key1.data(), id1Key1.size(),
-                                              make_shared<pib::PibMemory>());
+  auto keyImpl = std::make_shared<detail::KeyImpl>(id1Key1Name, id1Key1,
+                                                   std::make_shared<pib::PibMemory>());
   key = Key(keyImpl);
   BOOST_CHECK(key);
   BOOST_CHECK_EQUAL(!key, false);
@@ -56,8 +56,8 @@
 // of pib::Key in this test case.
 BOOST_AUTO_TEST_CASE(SharedImpl)
 {
-  auto keyImpl = make_shared<detail::KeyImpl>(id1Key1Name, id1Key1.data(), id1Key1.size(),
-                                              make_shared<pib::PibMemory>());
+  auto keyImpl = std::make_shared<detail::KeyImpl>(id1Key1Name, id1Key1,
+                                                   std::make_shared<pib::PibMemory>());
   Key key1(keyImpl);
   Key key2(keyImpl);
   BOOST_CHECK_EQUAL(key1, key2);
diff --git a/tests/unit/security/pib/pib-data-fixture.cpp b/tests/unit/security/pib/pib-data-fixture.cpp
index b641f31..d27c742 100644
--- a/tests/unit/security/pib/pib-data-fixture.cpp
+++ b/tests/unit/security/pib/pib-data-fixture.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2020 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -37,18 +37,13 @@
 // class TestCertDataGenerator
 // {
 // public:
-//   TestCertDataGenerator()
-//     : tpm("test", "test", make_unique<tpm::BackEndMem>())
-//   {
-//   }
-
 //   void
 //   printTestDataForId(const std::string& prefix, const Name& id)
 //   {
-//     for (int keyId : {1, 2}) {
+//     for (auto keyId : {1u, 2u}) {
 //       Name keyName = tpm.createKey(id, EcKeyParams(name::Component::fromNumber(keyId)));
 
-//       for (int certVersion : {1, 2}) {
+//       for (auto certVersion : {1u, 2u}) {
 //         Name certName = keyName;
 //         certName
 //           .append("issuer")
@@ -79,22 +74,16 @@
 //   static void
 //   printBytes(const std::string& name, const Block& block)
 //   {
-//     printBytes(name, block.wire(), block.size());
+//     printBytes(name, make_span(block.wire(), block.size()));
 //   }
 
 //   static void
-//   printBytes(const std::string& name, const Buffer& buffer)
-//   {
-//     printBytes(name, buffer.data(), buffer.size());
-//   }
-
-//   static void
-//   printBytes(const std::string& name, const uint8_t* buf, size_t size)
+//   printBytes(const std::string& name, span<const uint8_t> buf)
 //   {
 //     std::cout << "\nconst uint8_t " << name << "[] = {\n"
 //               << "  ";
 
-//     std::string hex = toHex(buf, size);
+//     std::string hex = toHex(buf);
 
 //     for (size_t i = 0; i < hex.size(); i++) {
 //       if (i > 0 && i % 40 == 0)
@@ -103,7 +92,7 @@
 //       std::cout << "0x" << hex[i];
 //       std::cout << hex[++i];
 
-//       if ((i + 1) != hex.size())
+//       if (i + 1 != hex.size())
 //         std::cout << ", ";
 //     }
 //     std::cout << "\n"
@@ -112,7 +101,7 @@
 
 // private:
 //   pib::PibMemory pib;
-//   Tpm tpm;
+//   Tpm tpm{"test", "test", make_unique<tpm::BackEndMem>()};
 // };
 
 // // The test data can be generated using this test case
diff --git a/tests/unit/security/pib/pib-impl.t.cpp b/tests/unit/security/pib/pib-impl.t.cpp
index 971d995..097b1c0 100644
--- a/tests/unit/security/pib/pib-impl.t.cpp
+++ b/tests/unit/security/pib/pib-impl.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2020 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -163,7 +163,7 @@
   BOOST_CHECK_EQUAL(this->pib.hasIdentity(this->id1), false);
 
   // add id1Key1, should be default, id1 should be added implicitly
-  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1.data(), this->id1Key1.size());
+  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1);
   BOOST_CHECK_EQUAL(this->pib.hasKey(this->id1Key1Name), true);
   BOOST_CHECK_EQUAL(this->pib.hasIdentity(this->id1), true);
   const Buffer& keyBits = this->pib.getKeyBits(this->id1Key1Name);
@@ -172,7 +172,7 @@
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id1), this->id1Key1Name);
 
   // add id1Key2, should not be default
-  this->pib.addKey(this->id1, this->id1Key2Name, this->id1Key2.data(), this->id1Key2.size());
+  this->pib.addKey(this->id1, this->id1Key2Name, this->id1Key2);
   BOOST_CHECK_EQUAL(this->pib.hasKey(this->id1Key2Name), true);
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id1), this->id1Key1Name);
 
@@ -191,7 +191,7 @@
   BOOST_CHECK_THROW(this->pib.getDefaultKeyOfIdentity(this->id1), Pib::Error);
 
   // add id1Key2 back, should be default
-  this->pib.addKey(this->id1, this->id1Key2Name, this->id1Key2.data(), this->id1Key2.size());
+  this->pib.addKey(this->id1, this->id1Key2Name, this->id1Key2);
   BOOST_CHECK_NO_THROW(this->pib.getKeyBits(this->id1Key2Name));
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id1), this->id1Key2Name);
 
@@ -274,11 +274,11 @@
   this->pib.removeIdentity(this->id1);
   BOOST_CHECK_THROW(this->pib.getDefaultIdentity(), Pib::Error);
 
-  this->pib.addKey(this->id2, this->id2Key1Name, this->id2Key1.data(), this->id2Key1.size());
+  this->pib.addKey(this->id2, this->id2Key1Name, this->id2Key1);
   BOOST_CHECK_EQUAL(this->pib.getDefaultIdentity(), this->id2);
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id2), this->id2Key1Name);
 
-  this->pib.addKey(this->id2, this->id2Key2Name, this->id2Key2.data(), this->id2Key2.size());
+  this->pib.addKey(this->id2, this->id2Key2Name, this->id2Key2);
   BOOST_CHECK_EQUAL(this->pib.getDefaultKeyOfIdentity(this->id2), this->id2Key1Name);
 
   this->pib.removeKey(this->id2Key1Name);
@@ -305,13 +305,13 @@
   BOOST_CHECK_EQUAL(this->pib.hasKey(this->id1Key1Name), false);
 
   // add id1Key1
-  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1.data(), this->id1Key1.size());
+  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1);
   BOOST_CHECK_EQUAL(this->pib.hasKey(this->id1Key1Name), true);
   const Buffer& keyBits = this->pib.getKeyBits(this->id1Key1Name);
   BOOST_CHECK(keyBits == this->id1Key1);
 
   // check overwrite, add a key with the same name.
-  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key2.data(), this->id1Key2.size());
+  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key2);
   const Buffer& keyBits2 = this->pib.getKeyBits(this->id1Key1Name);
   BOOST_CHECK(keyBits2 == this->id1Key2);
 
@@ -320,7 +320,7 @@
   BOOST_CHECK_EQUAL(this->pib.hasCertificate(this->id1Key1Cert1.getName()), false);
 
   // add id1Key1Cert1
-  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1.data(), this->id1Key1.size());
+  this->pib.addKey(this->id1, this->id1Key1Name, this->id1Key1);
   this->pib.addCertificate(this->id1Key1Cert1);
   BOOST_CHECK_EQUAL(this->pib.hasCertificate(this->id1Key1Cert1.getName()), true);
 
diff --git a/tests/unit/security/safe-bag.t.cpp b/tests/unit/security/safe-bag.t.cpp
index 53f28cf..c3cc7c2 100644
--- a/tests/unit/security/safe-bag.t.cpp
+++ b/tests/unit/security/safe-bag.t.cpp
@@ -72,7 +72,7 @@
           0xfc, 0x90, 0x7a, 0xb8, 0x66, 0x9c, 0x0e, 0xf6, 0xb7, 0x64, 0xd1
 };
 
-const uint8_t ENCRYPTED_KEY_BAG[] = {
+const uint8_t ENCRYPTED_KEY[] = {
   0x2f, 0xd6, 0xf1, 0x6e, 0x80, 0x6f, 0x10, 0xbe
 };
 
@@ -121,29 +121,24 @@
 
 BOOST_AUTO_TEST_CASE(Constructor)
 {
-  Block dataBlock(CERT, sizeof(CERT));
-  Data data(dataBlock);
-  SafeBag safeBag1(data, ENCRYPTED_KEY_BAG, sizeof(ENCRYPTED_KEY_BAG));
-
-  Block safeBagBlock(SAFE_BAG, sizeof(SAFE_BAG));
-  SafeBag safeBag2(safeBagBlock);
-
-  Buffer buffer(ENCRYPTED_KEY_BAG, sizeof(ENCRYPTED_KEY_BAG));
-  SafeBag safeBag3(data, buffer);
+  Data data(Block(CERT, sizeof(CERT)));
+  SafeBag safeBag1(data, ENCRYPTED_KEY);
+  SafeBag safeBag2(Block(SAFE_BAG, sizeof(SAFE_BAG)));
+  auto encKey = make_span(ENCRYPTED_KEY);
 
   BOOST_CHECK(safeBag1.getCertificate() == data);
-  BOOST_CHECK(safeBag1.getEncryptedKey() == buffer);
+  BOOST_CHECK_EQUAL_COLLECTIONS(safeBag1.getEncryptedKey().begin(), safeBag1.getEncryptedKey().end(),
+                                encKey.begin(), encKey.end());
   BOOST_CHECK(safeBag2.getCertificate() == data);
-  BOOST_CHECK(safeBag2.getEncryptedKey() == buffer);
-  BOOST_CHECK(safeBag3.getCertificate() == data);
-  BOOST_CHECK(safeBag3.getEncryptedKey() == buffer);
+  BOOST_CHECK_EQUAL_COLLECTIONS(safeBag2.getEncryptedKey().begin(), safeBag2.getEncryptedKey().end(),
+                                encKey.begin(), encKey.end());
 }
 
 BOOST_AUTO_TEST_CASE(EncoderAndDecoder)
 {
   Block dataBlock(CERT, sizeof(CERT));
   Data data(dataBlock);
-  SafeBag safeBag(data, ENCRYPTED_KEY_BAG, sizeof(ENCRYPTED_KEY_BAG));
+  SafeBag safeBag(data, ENCRYPTED_KEY);
 
   // wire encode
   Block wireBlock = safeBag.wireEncode();
@@ -157,8 +152,8 @@
   safeBag2.wireDecode(wireBlock);
 
   // check equal
-  Buffer buffer1 = safeBag2.getEncryptedKey();
-  Buffer buffer2(ENCRYPTED_KEY_BAG, sizeof(ENCRYPTED_KEY_BAG));
+  Buffer buffer1(safeBag2.getEncryptedKey().begin(), safeBag2.getEncryptedKey().end());
+  Buffer buffer2(ENCRYPTED_KEY, sizeof(ENCRYPTED_KEY));
   BOOST_CHECK(buffer1 == buffer2);
 }
 
diff --git a/tests/unit/security/tpm/back-end.t.cpp b/tests/unit/security/tpm/back-end.t.cpp
index 3b08c62..0b22d54 100644
--- a/tests/unit/security/tpm/back-end.t.cpp
+++ b/tests/unit/security/tpm/back-end.t.cpp
@@ -121,37 +121,34 @@
   Name keyName = key->getKeyName();
 
   transform::PublicKey pubKey;
-  ConstBufferPtr pubKeyBits = key->derivePublicKey();
-  pubKey.loadPkcs8(pubKeyBits->data(), pubKeyBits->size());
+  auto pubKeyBits = key->derivePublicKey();
+  pubKey.loadPkcs8(*pubKeyBits);
 
-  // Sign using single buffer API
+  // Sign a single buffer
   const uint8_t content1[] = {0x01, 0x02, 0x03, 0x04};
-  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, content1, sizeof(content1));
+  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, {content1});
   BOOST_REQUIRE(sigValueSingle != nullptr);
 
   bool resultSingle;
   {
     using namespace transform;
-    bufferSource(content1, sizeof(content1)) >>
-      verifierFilter(DigestAlgorithm::SHA256, pubKey,
-                     sigValueSingle->data(), sigValueSingle->size()) >>
-      boolSink(resultSingle);
+    bufferSource(content1)
+      >> verifierFilter(DigestAlgorithm::SHA256, pubKey, sigValueSingle->data(), sigValueSingle->size())
+      >> boolSink(resultSingle);
   }
   BOOST_CHECK_EQUAL(resultSingle, true);
 
-  // Sign using vectored API
+  // Sign multiple buffers
   const uint8_t content2[] = {0x05, 0x06, 0x07, 0x08};
-  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {{content1, sizeof(content1)},
-                                                            {content2, sizeof(content2)}});
+  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {content1, content2});
   BOOST_REQUIRE(sigValueVector != nullptr);
 
   bool resultVector;
   {
     using namespace transform;
-    bufferSource({{content1, sizeof(content1)}, {content2, sizeof(content2)}}) >>
-      verifierFilter(DigestAlgorithm::SHA256, pubKey,
-                     sigValueVector->data(), sigValueVector->size()) >>
-      boolSink(resultVector);
+    bufferSource(InputBuffers{content1, content2})
+      >> verifierFilter(DigestAlgorithm::SHA256, pubKey, sigValueVector->data(), sigValueVector->size())
+      >> boolSink(resultVector);
   }
   BOOST_CHECK_EQUAL(resultVector, true);
 
@@ -172,11 +169,11 @@
   const uint8_t content[] = {0x01, 0x02, 0x03, 0x04};
 
   transform::PublicKey pubKey;
-  ConstBufferPtr pubKeyBits = key->derivePublicKey();
-  pubKey.loadPkcs8(pubKeyBits->data(), pubKeyBits->size());
+  auto pubKeyBits = key->derivePublicKey();
+  pubKey.loadPkcs8(*pubKeyBits);
 
-  ConstBufferPtr cipherText = pubKey.encrypt(content, sizeof(content));
-  ConstBufferPtr plainText = key->decrypt(cipherText->data(), cipherText->size());
+  ConstBufferPtr cipherText = pubKey.encrypt(content);
+  ConstBufferPtr plainText = key->decrypt(*cipherText);
 
   BOOST_CHECK_EQUAL_COLLECTIONS(content, content + sizeof(content),
                                 plainText->begin(), plainText->end());
@@ -196,37 +193,34 @@
   Name ecKeyName = key->getKeyName();
 
   transform::PublicKey pubKey;
-  ConstBufferPtr pubKeyBits = key->derivePublicKey();
-  pubKey.loadPkcs8(pubKeyBits->data(), pubKeyBits->size());
+  auto pubKeyBits = key->derivePublicKey();
+  pubKey.loadPkcs8(*pubKeyBits);
 
-  // Sign using single buffer API
+  // Sign a single buffer
   const uint8_t content1[] = {0x01, 0x02, 0x03, 0x04};
-  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, content1, sizeof(content1));
+  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, {content1});
   BOOST_REQUIRE(sigValueSingle != nullptr);
 
   bool resultSingle;
   {
     using namespace transform;
-    bufferSource(content1, sizeof(content1)) >>
-      verifierFilter(DigestAlgorithm::SHA256, pubKey,
-                     sigValueSingle->data(), sigValueSingle->size()) >>
-      boolSink(resultSingle);
+    bufferSource(content1)
+      >> verifierFilter(DigestAlgorithm::SHA256, pubKey, sigValueSingle->data(), sigValueSingle->size())
+      >> boolSink(resultSingle);
   }
   BOOST_CHECK_EQUAL(resultSingle, true);
 
-  // Sign using vectored API
+  // Sign multiple buffers
   const uint8_t content2[] = {0x05, 0x06, 0x07, 0x08};
-  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {{content1, sizeof(content1)},
-                                                            {content2, sizeof(content2)}});
+  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {content1, content2});
   BOOST_REQUIRE(sigValueVector != nullptr);
 
   bool resultVector;
   {
     using namespace transform;
-    bufferSource({{content1, sizeof(content1)}, {content2, sizeof(content2)}}) >>
-      verifierFilter(DigestAlgorithm::SHA256, pubKey,
-                     sigValueVector->data(), sigValueVector->size()) >>
-      boolSink(resultVector);
+    bufferSource(InputBuffers{content1, content2})
+      >> verifierFilter(DigestAlgorithm::SHA256, pubKey, sigValueVector->data(), sigValueVector->size())
+      >> boolSink(resultVector);
   }
   BOOST_CHECK_EQUAL(resultVector, true);
 
@@ -245,23 +239,18 @@
   unique_ptr<KeyHandle> key = tpm.createKey(identity, HmacKeyParams());
   Name hmacKeyName = key->getKeyName();
 
-  // Sign and verify using single buffer API
+  // Sign and verify a single buffer
   const uint8_t content1[] = {0x01, 0x02, 0x03, 0x04};
-  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, content1, sizeof(content1));
+  auto sigValueSingle = key->sign(DigestAlgorithm::SHA256, {content1});
   BOOST_REQUIRE(sigValueSingle != nullptr);
-  bool resultSingle = key->verify(DigestAlgorithm::SHA256, content1, sizeof(content1),
-                                  sigValueSingle->data(), sigValueSingle->size());
+  bool resultSingle = key->verify(DigestAlgorithm::SHA256, {content1}, *sigValueSingle);
   BOOST_CHECK_EQUAL(resultSingle, true);
 
-  // Sign and verify using vectored API
+  // Sign and verify multiple buffers
   const uint8_t content2[] = {0x05, 0x06, 0x07, 0x08};
-  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {{content1, sizeof(content1)},
-                                                            {content2, sizeof(content2)}});
+  auto sigValueVector = key->sign(DigestAlgorithm::SHA256, {content1, content2});
   BOOST_REQUIRE(sigValueVector != nullptr);
-  bool resultVector = key->verify(DigestAlgorithm::SHA256,
-                                  {{content1, sizeof(content1)},
-                                   {content2, sizeof(content2)}},
-                                  sigValueVector->data(), sigValueVector->size());
+  bool resultVector = key->verify(DigestAlgorithm::SHA256, {content1, content2}, *sigValueVector);
   BOOST_CHECK_EQUAL(resultVector, true);
 
   tpm.deleteKey(hmacKeyName);
@@ -308,22 +297,22 @@
   BOOST_REQUIRE_EQUAL(tpm.hasKey(keyName), false);
 
   transform::PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(privKeyPkcs1.data()), privKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(privKeyPkcs1.data()), privKeyPkcs1.size()});
   OBufferStream os;
   sKey.savePkcs8(os, password.data(), password.size());
   auto pkcs8 = os.buf();
 
   // import with wrong password
-  BOOST_CHECK_THROW(tpm.importKey(keyName, pkcs8->data(), pkcs8->size(), wrongPassword.data(), wrongPassword.size()),
+  BOOST_CHECK_THROW(tpm.importKey(keyName, *pkcs8, wrongPassword.data(), wrongPassword.size()),
                     Tpm::Error);
   BOOST_CHECK_EQUAL(tpm.hasKey(keyName), false);
 
   // import with correct password
-  tpm.importKey(keyName, pkcs8->data(), pkcs8->size(), password.data(), password.size());
+  tpm.importKey(keyName, *pkcs8, password.data(), password.size());
   BOOST_CHECK_EQUAL(tpm.hasKey(keyName), true);
 
   // import already present key
-  BOOST_CHECK_THROW(tpm.importKey(keyName, pkcs8->data(), pkcs8->size(), password.data(), password.size()),
+  BOOST_CHECK_THROW(tpm.importKey(keyName, *pkcs8, password.data(), password.size()),
                     Tpm::Error);
 
   // test derivePublicKey with the imported key
@@ -336,7 +325,7 @@
   BOOST_CHECK_EQUAL(tpm.hasKey(keyName), true);
 
   transform::PrivateKey sKey2;
-  sKey2.loadPkcs8(exportedKey->data(), exportedKey->size(), password.data(), password.size());
+  sKey2.loadPkcs8(*exportedKey, password.data(), password.size());
   OBufferStream os2;
   sKey.savePkcs1Base64(os2);
   auto pkcs1 = os2.buf();
diff --git a/tests/unit/security/transform/base64-decode.t.cpp b/tests/unit/security/transform/base64-decode.t.cpp
index 93d09c2..5d89fe6 100644
--- a/tests/unit/security/transform/base64-decode.t.cpp
+++ b/tests/unit/security/transform/base64-decode.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -38,12 +38,11 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  std::string in =
+  const std::string in =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=\n";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -71,12 +70,11 @@
 
 BOOST_AUTO_TEST_CASE(NoNewLine)
 {
-  std::string in =
+  const std::string in =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -104,7 +102,7 @@
 
 BOOST_AUTO_TEST_CASE(StepByStep)
 {
-  std::string in =
+  const std::string in =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
@@ -113,8 +111,7 @@
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -145,17 +142,17 @@
   OBufferStream os;
   StepSource source;
   source >> base64Decode() >> streamSink(os);
-  source.write(input, 65);       // complete line with "\n"
-  source.write(input + 65, 64);  // complete line without "\n"
-  source.write(input + 129, 1);  // single "\n"
-  source.write(input + 130, 35); // front of a line
-  source.write(input + 165, 30); // end of a line with "\n"
-  source.write(input + 195, 25); // front of a line
-  source.write(input + 220, 20); // middle of a line
-  source.write(input + 240, 19); // end of a line without "\n"
-  source.write(input + 259, 101); // "\n" plus one and half line
-  source.write(input + 360, 65); // end of a line plus front of another line
-  source.write(input + 425, 95); // remaining
+  source.write({input, 65});       // complete line with "\n"
+  source.write({input + 65, 64});  // complete line without "\n"
+  source.write({input + 129, 1});  // single "\n"
+  source.write({input + 130, 35}); // front of a line
+  source.write({input + 165, 30}); // end of a line with "\n"
+  source.write({input + 195, 25}); // front of a line
+  source.write({input + 220, 20}); // middle of a line
+  source.write({input + 240, 19}); // end of a line without "\n"
+  source.write({input + 259, 101}); // "\n" plus one and half line
+  source.write({input + 360, 65}); // end of a line plus front of another line
+  source.write({input + 425, 95}); // remaining
   source.end();
 
   ConstBufferPtr buf1 = os.buf();
@@ -168,6 +165,7 @@
   StepSource source;
   source >> base64Decode() >> streamSink(os);
   source.end();
+
   BOOST_CHECK_EQUAL(os.buf()->size(), 0);
 }
 
diff --git a/tests/unit/security/transform/base64-encode.t.cpp b/tests/unit/security/transform/base64-encode.t.cpp
index 228f214..7b4aa47 100644
--- a/tests/unit/security/transform/base64-encode.t.cpp
+++ b/tests/unit/security/transform/base64-encode.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -39,7 +39,7 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  uint8_t in[] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -57,14 +57,13 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=\n";
 
   OBufferStream os;
-  bufferSource(in, sizeof(in)) >> base64Encode() >> streamSink(os);
+  bufferSource(in) >> base64Encode() >> streamSink(os);
 
   ConstBufferPtr buf1 = os.buf();
   BOOST_CHECK_EQUAL_COLLECTIONS(out.begin(), out.end(), buf1->begin(), buf1->end());
@@ -72,7 +71,7 @@
 
 BOOST_AUTO_TEST_CASE(NoNewLine)
 {
-  uint8_t in[] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -90,14 +89,13 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8=";
 
   OBufferStream os;
-  BufferSource(in, sizeof(in)) >> base64Encode(false) >> streamSink(os);
+  BufferSource(in) >> base64Encode(false) >> streamSink(os);
 
   ConstBufferPtr buf1 = os.buf();
   BOOST_CHECK_EQUAL_COLLECTIONS(out.begin(), out.end(), buf1->begin(), buf1->end());
@@ -105,7 +103,7 @@
 
 BOOST_AUTO_TEST_CASE(StepByStep)
 {
-  uint8_t in[] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -131,8 +129,7 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
     "AAECAwQFBgcICQoLDA0ODwABAgMEBQYHCAkKCwwNDg8AAQIDBAUGBwgJCgsMDQ4P\n"
@@ -145,15 +142,15 @@
   OBufferStream os;
   StepSource source;
   source >> base64Encode() >> streamSink(os);
-  source.write(in, 64); // complete chunk
-  source.write(in + 64, 32); // first half of a chunk
-  source.write(in + 96, 32); // second half of a chunk
-  source.write(in + 128, 24); // front of a chunk
-  source.write(in + 152, 20); // middle of a chunk
-  source.write(in + 172, 20); // end of a chunk
-  source.write(in + 192, 63); // odd number of bytes
-  source.write(in + 255, 85); // one and half chunk
-  source.write(in + 340, 44); // remaining part
+  source.write({in, 64}); // complete chunk
+  source.write({in + 64, 32}); // first half of a chunk
+  source.write({in + 96, 32}); // second half of a chunk
+  source.write({in + 128, 24}); // front of a chunk
+  source.write({in + 152, 20}); // middle of a chunk
+  source.write({in + 172, 20}); // end of a chunk
+  source.write({in + 192, 63}); // odd number of bytes
+  source.write({in + 255, 85}); // one and half chunk
+  source.write({in + 340, 44}); // remaining part
   source.end();
 
   ConstBufferPtr buf1 = os.buf();
@@ -166,6 +163,7 @@
   StepSource source;
   source >> base64Encode() >> streamSink(os);
   source.end();
+
   BOOST_CHECK_EQUAL(os.buf()->size(), 0);
 }
 
diff --git a/tests/unit/security/transform/block-cipher.t.cpp b/tests/unit/security/transform/block-cipher.t.cpp
index 12b20bb..60944ad 100644
--- a/tests/unit/security/transform/block-cipher.t.cpp
+++ b/tests/unit/security/transform/block-cipher.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -67,7 +67,7 @@
 
   // encrypt
   OBufferStream os;
-  bufferSource(plainText, sizeof(plainText)) >>
+  bufferSource(plainText) >>
     blockCipher(BlockCipherAlgorithm::AES_CBC, CipherOperator::ENCRYPT,
                 key, sizeof(key), iv, sizeof(iv)) >> streamSink(os);
 
@@ -77,7 +77,7 @@
 
   // decrypt
   OBufferStream os2;
-  bufferSource(cipherText, sizeof(cipherText)) >>
+  bufferSource(cipherText) >>
     blockCipher(BlockCipherAlgorithm::AES_CBC, CipherOperator::DECRYPT,
                 key, sizeof(key), iv, sizeof(iv)) >> streamSink(os2);
 
diff --git a/tests/unit/security/transform/bool-sink.t.cpp b/tests/unit/security/transform/bool-sink.t.cpp
index f287e1c..a7640c6 100644
--- a/tests/unit/security/transform/bool-sink.t.cpp
+++ b/tests/unit/security/transform/bool-sink.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -34,23 +34,23 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  uint8_t in1[] = {0x00, 0x01};
+  const uint8_t in1[] = {0x00, 0x01};
   bool value1 = true;
   BoolSink sink1(value1);
-  BOOST_CHECK_EQUAL(sink1.write(in1, 1), 1);
-  BOOST_CHECK_EQUAL(sink1.write(in1 + 1, 1), 1);
+  BOOST_CHECK_EQUAL(sink1.write({in1, 1}), 1);
+  BOOST_CHECK_EQUAL(sink1.write({in1 + 1, 1}), 1);
   sink1.end();
   BOOST_CHECK_EQUAL(value1, false);
-  BOOST_CHECK_THROW(sink1.write(in1 + 1, 1), transform::Error);
+  BOOST_CHECK_THROW(sink1.write({in1 + 1, 1}), transform::Error);
 
-  uint8_t in2[] = {0x01, 0x00};
+  const uint8_t in2[] = {0x01, 0x00};
   bool value2 = false;
   BoolSink sink2(value2);
-  BOOST_CHECK_EQUAL(sink2.write(in2, 1), 1);
-  BOOST_CHECK_EQUAL(sink2.write(in2 + 1, 1), 1);
+  BOOST_CHECK_EQUAL(sink2.write({in2, 1}), 1);
+  BOOST_CHECK_EQUAL(sink2.write({in2 + 1, 1}), 1);
   sink2.end();
   BOOST_CHECK_EQUAL(value2, true);
-  BOOST_CHECK_THROW(sink2.write(in2 + 1, 1), transform::Error);
+  BOOST_CHECK_THROW(sink2.write({in2 + 1, 1}), transform::Error);
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestBoolSink
diff --git a/tests/unit/security/transform/buffer-source.t.cpp b/tests/unit/security/transform/buffer-source.t.cpp
index 8f1a23e..4c56591 100644
--- a/tests/unit/security/transform/buffer-source.t.cpp
+++ b/tests/unit/security/transform/buffer-source.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2020 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -35,17 +35,16 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  uint8_t in[16] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
   std::ostringstream os1;
-  bufferSource(in, sizeof(in)) >> streamSink(os1);
+  bufferSource(in) >> streamSink(os1);
   std::string out1 = os1.str();
   BOOST_CHECK_EQUAL_COLLECTIONS(out1.begin(), out1.end(), in, in + sizeof(in));
 
-  std::string in2 =
+  const std::string in2 =
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567"
@@ -66,27 +65,26 @@
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567";
-
   std::ostringstream os2;
   bufferSource(in2) >> streamSink(os2);
   std::string out2 = os2.str();
   BOOST_CHECK_EQUAL_COLLECTIONS(out2.begin(), out2.end(), in2.begin(), in2.end());
 
-  Buffer in3(in, sizeof(in));
+  std::vector<uint8_t> in3(in, in + sizeof(in));
   std::ostringstream os3;
   bufferSource(in3) >> streamSink(os3);
   std::string out3 = os3.str();
   BOOST_CHECK_EQUAL_COLLECTIONS(out3.begin(), out3.end(), in3.begin(), in3.end());
 
-  InputBuffers in4{{in, sizeof(in)}, {reinterpret_cast<const uint8_t*>(in2.data()), in2.size()}};
+  InputBuffers in4{make_span(in), {reinterpret_cast<const uint8_t*>(in2.data()), in2.size()}};
   std::ostringstream os4;
   bufferSource(in4) >> streamSink(os4);
   std::string out4 = os4.str();
   BOOST_CHECK_EQUAL(out4.size(), sizeof(in) + in2.size());
-  BOOST_CHECK_EQUAL_COLLECTIONS(out4.begin(), out4.begin() + in4[0].second,
-                                in4[0].first, in4[0].first + in4[0].second);
-  BOOST_CHECK_EQUAL_COLLECTIONS(out4.begin() + in4[0].second, out4.end(),
-                                in4[1].first, in4[1].first + in4[1].second);
+  BOOST_CHECK_EQUAL_COLLECTIONS(out4.begin(), out4.begin() + sizeof(in),
+                                in4[0].begin(), in4[0].end());
+  BOOST_CHECK_EQUAL_COLLECTIONS(out4.begin() + sizeof(in), out4.end(),
+                                in4[1].begin(), in4[1].end());
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestBufferSource
diff --git a/tests/unit/security/transform/digest-filter.t.cpp b/tests/unit/security/transform/digest-filter.t.cpp
index 984611d..fa109bb 100644
--- a/tests/unit/security/transform/digest-filter.t.cpp
+++ b/tests/unit/security/transform/digest-filter.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -66,7 +66,7 @@
 BOOST_AUTO_TEST_CASE(BufferInput)
 {
   OBufferStream os;
-  bufferSource(in, sizeof(in)) >> digestFilter(DigestAlgorithm::SHA256) >> streamSink(os);
+  bufferSource(in) >> digestFilter(DigestAlgorithm::SHA256) >> streamSink(os);
   BOOST_CHECK_EQUAL_COLLECTIONS(out, out + sizeof(out), os.buf()->begin(), os.buf()->end());
 }
 
@@ -75,12 +75,12 @@
   StepSource source;
   OBufferStream os;
   source >> digestFilter(DigestAlgorithm::SHA256) >> streamSink(os);
-  source.write(in, 32);
-  source.write(in + 32, 1);
-  source.write(in + 33, 2);
-  source.write(in + 35, 3);
-  source.write(in + 38, 26);
-  source.write(in + 64, 64);
+  source.write({in, 32});
+  source.write({in + 32, 1});
+  source.write({in + 33, 2});
+  source.write({in + 35, 3});
+  source.write({in + 38, 26});
+  source.write({in + 64, 64});
   source.end();
   BOOST_CHECK_EQUAL_COLLECTIONS(out, out + sizeof(out), os.buf()->begin(), os.buf()->end());
 }
diff --git a/tests/unit/security/transform/hex-decode.t.cpp b/tests/unit/security/transform/hex-decode.t.cpp
index bd2e880..23ca9aa 100644
--- a/tests/unit/security/transform/hex-decode.t.cpp
+++ b/tests/unit/security/transform/hex-decode.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -39,13 +39,12 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  std::string in =
+  const std::string in =
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -73,13 +72,12 @@
 
 BOOST_AUTO_TEST_CASE(UpperCase)
 {
-  std::string in =
+  const std::string in =
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -107,7 +105,7 @@
 
 BOOST_AUTO_TEST_CASE(MixCase)
 {
-  std::string in =
+  const std::string in =
     "000102030405060708090a0b0c0d0e0f"
     "101112131415161718191a1b1c1d1e1f"
     "202122232425262728292a2b2c2d2e2f"
@@ -150,8 +148,7 @@
     "BaBbBcBdBeBfBABBBCBD"
     "CaCbCcCdCeCfCACBCCCD"
     "DaDbDcDdDeDfDADBDCDD";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
     0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
     0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F,
@@ -203,10 +200,9 @@
   BOOST_CHECK_EQUAL_COLLECTIONS(out, out + sizeof(out), buf1->begin(), buf1->end());
 }
 
-
 BOOST_AUTO_TEST_CASE(StepByStep)
 {
-  std::string in =
+  const std::string in =
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
@@ -219,8 +215,7 @@
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f";
-
-  uint8_t out[] = {
+  const uint8_t out[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -247,16 +242,16 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
 
-  const uint8_t* input = reinterpret_cast<const uint8_t*>(in.data());
+  auto input = reinterpret_cast<const uint8_t*>(in.data());
   OBufferStream os;
   StepSource source;
   source >> hexDecode() >> streamSink(os);
-  source.write(input, 128);       // complete chunk
-  source.write(input + 128, 64);  // first half of a chunk
-  source.write(input + 192, 64);  // second half of a chunk
-  source.write(input + 256, 127); // odd number of byets
-  source.write(input + 383, 192); // one and half chunk
-  source.write(input + 575, 193); // remaining part
+  source.write({input, 128});       // complete chunk
+  source.write({input + 128, 64});  // first half of a chunk
+  source.write({input + 192, 64});  // second half of a chunk
+  source.write({input + 256, 127}); // odd number of byets
+  source.write({input + 383, 192}); // one and half chunk
+  source.write({input + 575, 193}); // remaining part
   source.end();
 
   ConstBufferPtr buf1 = os.buf();
@@ -265,15 +260,13 @@
 
 BOOST_AUTO_TEST_CASE(OddByte)
 {
-  std::string in1 = "0001020304050";
-
+  const std::string in1 = "0001020304050";
   OBufferStream os1;
-  BOOST_REQUIRE_THROW(bufferSource(in1) >> hexDecode() >> streamSink(os1), transform::Error);
+  BOOST_CHECK_THROW(bufferSource(in1) >> hexDecode() >> streamSink(os1), transform::Error);
 
-  std::string in2 = "0001020304xy";
-
+  const std::string in2 = "0001020304xy";
   OBufferStream os2;
-  BOOST_REQUIRE_THROW(bufferSource(in2) >> hexDecode() >> streamSink(os2), transform::Error);
+  BOOST_CHECK_THROW(bufferSource(in2) >> hexDecode() >> streamSink(os2), transform::Error);
 }
 
 BOOST_AUTO_TEST_CASE(EmptyInput)
@@ -282,6 +275,7 @@
   StepSource source;
   source >> hexDecode() >> streamSink(os);
   source.end();
+
   BOOST_CHECK_EQUAL(os.buf()->size(), 0);
 }
 
diff --git a/tests/unit/security/transform/hex-encode.t.cpp b/tests/unit/security/transform/hex-encode.t.cpp
index 791fdd7..8025c37 100644
--- a/tests/unit/security/transform/hex-encode.t.cpp
+++ b/tests/unit/security/transform/hex-encode.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -38,7 +38,7 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  uint8_t in[128] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -56,15 +56,14 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f";
 
   OBufferStream os;
-  bufferSource(in, sizeof(in)) >> hexEncode() >> streamSink(os);
+  bufferSource(in) >> hexEncode() >> streamSink(os);
 
   ConstBufferPtr buf1 = os.buf();
   BOOST_CHECK_EQUAL_COLLECTIONS(out.begin(), out.end(), buf1->begin(), buf1->end());
@@ -72,7 +71,7 @@
 
 BOOST_AUTO_TEST_CASE(UpperCase)
 {
-  uint8_t in[128] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -90,15 +89,14 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F"
     "000102030405060708090A0B0C0D0E0F000102030405060708090A0B0C0D0E0F";
 
   OBufferStream os;
-  bufferSource(in, sizeof(in)) >> hexEncode(true) >> streamSink(os);
+  bufferSource(in) >> hexEncode(true) >> streamSink(os);
 
   ConstBufferPtr buf1 = os.buf();
   BOOST_CHECK_EQUAL_COLLECTIONS(out.begin(), out.end(), buf1->begin(), buf1->end());
@@ -106,7 +104,7 @@
 
 BOOST_AUTO_TEST_CASE(StepByStep)
 {
-  uint8_t in[] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -132,8 +130,7 @@
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
   };
-
-  std::string out =
+  const std::string out =
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
     "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"
@@ -150,15 +147,15 @@
   OBufferStream os;
   StepSource source;
   source >> hexEncode() >> streamSink(os);
-  source.write(in, 64);       // complete chunk
-  source.write(in + 64, 32);  // first half of a chunk
-  source.write(in + 96, 32);  // second half of a chunk
-  source.write(in + 128, 20); // front of a chunk
-  source.write(in + 148, 20); // middle of a chunk
-  source.write(in + 168, 24); // end of a chunk
-  source.write(in + 192, 63); // odd number of bytes
-  source.write(in + 255, 85); // one and half chunk
-  source.write(in + 340, 44); // remaining part
+  source.write({in, 64});       // complete chunk
+  source.write({in + 64, 32});  // first half of a chunk
+  source.write({in + 96, 32});  // second half of a chunk
+  source.write({in + 128, 20}); // front of a chunk
+  source.write({in + 148, 20}); // middle of a chunk
+  source.write({in + 168, 24}); // end of a chunk
+  source.write({in + 192, 63}); // odd number of bytes
+  source.write({in + 255, 85}); // one and half chunk
+  source.write({in + 340, 44}); // remaining part
   source.end();
 
   ConstBufferPtr buf1 = os.buf();
@@ -171,6 +168,7 @@
   StepSource source;
   source >> hexEncode() >> streamSink(os);
   source.end();
+
   BOOST_CHECK_EQUAL(os.buf()->size(), 0);
 }
 
diff --git a/tests/unit/security/transform/private-key.t.cpp b/tests/unit/security/transform/private-key.t.cpp
index 042f571..87d39fe 100644
--- a/tests/unit/security/transform/private-key.t.cpp
+++ b/tests/unit/security/transform/private-key.t.cpp
@@ -56,8 +56,7 @@
   BOOST_CHECK_EQUAL(sKey.getKeySize(), 0);
   BOOST_CHECK_THROW(sKey.getKeyDigest(DigestAlgorithm::SHA256), PrivateKey::Error);
   BOOST_CHECK_THROW(sKey.derivePublicKey(), PrivateKey::Error);
-  const uint8_t theAnswer = 42;
-  BOOST_CHECK_THROW(sKey.decrypt(&theAnswer, sizeof(theAnswer)), PrivateKey::Error);
+  BOOST_CHECK_THROW(sKey.decrypt({}), PrivateKey::Error);
   std::ostringstream os;
   BOOST_CHECK_THROW(sKey.savePkcs1(os), PrivateKey::Error);
   std::string passwd("password");
@@ -69,7 +68,7 @@
 {
   const Buffer buf(16);
   PrivateKey sKey;
-  sKey.loadRaw(KeyType::HMAC, buf.data(), buf.size());
+  sKey.loadRaw(KeyType::HMAC, buf);
   auto digest = sKey.getKeyDigest(DigestAlgorithm::SHA256);
 
   const uint8_t expected[] = {
@@ -85,17 +84,17 @@
 {
   const Buffer buf(32);
   PrivateKey sKey;
-  sKey.loadRaw(KeyType::HMAC, buf.data(), buf.size());
+  sKey.loadRaw(KeyType::HMAC, buf);
 #if OPENSSL_VERSION_NUMBER < 0x30000000L // FIXME #5154
   BOOST_CHECK_EQUAL(sKey.getKeyType(), KeyType::HMAC);
   BOOST_CHECK_EQUAL(sKey.getKeySize(), 256);
 #endif
 
   PrivateKey sKey2;
-  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::NONE, buf.data(), buf.size()), std::invalid_argument);
-  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::RSA, buf.data(), buf.size()), std::invalid_argument);
-  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::EC, buf.data(), buf.size()), std::invalid_argument);
-  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::AES, buf.data(), buf.size()), std::invalid_argument);
+  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::NONE, buf), std::invalid_argument);
+  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::RSA, buf), std::invalid_argument);
+  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::EC, buf), std::invalid_argument);
+  BOOST_CHECK_THROW(sKey2.loadRaw(KeyType::AES, buf), std::invalid_argument);
 }
 
 struct RsaKey_DesEncrypted
@@ -397,7 +396,7 @@
                    const ConstBufferPtr& pkcs1)
 {
   PrivateKey sKey;
-  sKey.loadPkcs8(encoding->data(), encoding->size(), password.data(), password.size());
+  sKey.loadPkcs8(*encoding, password.data(), password.size());
   OBufferStream os;
   sKey.savePkcs1(os);
   BOOST_CHECK_EQUAL_COLLECTIONS(pkcs1->begin(), pkcs1->end(),
@@ -418,17 +417,15 @@
 {
   T dataSet;
 
-  auto sKeyPkcs1Base64 = reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data());
-  auto sKeyPkcs1Base64Len = dataSet.privateKeyPkcs1.size();
+  auto sKeyPkcs1Base64 = make_span(reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
+                                   dataSet.privateKeyPkcs1.size());
   OBufferStream os;
-  bufferSource(sKeyPkcs1Base64, sKeyPkcs1Base64Len) >> base64Decode() >> streamSink(os);
-  ConstBufferPtr sKeyPkcs1Buf = os.buf();
-  const uint8_t* sKeyPkcs1 = sKeyPkcs1Buf->data();
-  size_t sKeyPkcs1Len = sKeyPkcs1Buf->size();
+  bufferSource(sKeyPkcs1Base64) >> base64Decode() >> streamSink(os);
+  auto sKeyPkcs1 = os.buf();
 
   // load key in base64-encoded pkcs1 format
   PrivateKey sKey;
-  BOOST_CHECK_NO_THROW(sKey.loadPkcs1Base64(sKeyPkcs1Base64, sKeyPkcs1Base64Len));
+  BOOST_CHECK_NO_THROW(sKey.loadPkcs1Base64(sKeyPkcs1Base64));
   BOOST_CHECK_EQUAL(sKey.getKeySize(), dataSet.keySize);
 
   std::stringstream ss2(dataSet.privateKeyPkcs1);
@@ -437,32 +434,31 @@
 
   // load key in pkcs1 format
   PrivateKey sKey3;
-  BOOST_CHECK_NO_THROW(sKey3.loadPkcs1(sKeyPkcs1, sKeyPkcs1Len));
+  BOOST_CHECK_NO_THROW(sKey3.loadPkcs1(*sKeyPkcs1));
   BOOST_CHECK_EQUAL(sKey3.getKeySize(), dataSet.keySize);
 
   std::stringstream ss4;
-  ss4.write(reinterpret_cast<const char*>(sKeyPkcs1), sKeyPkcs1Len);
+  ss4.write(reinterpret_cast<const char*>(sKeyPkcs1->data()), sKeyPkcs1->size());
   PrivateKey sKey4;
   BOOST_CHECK_NO_THROW(sKey4.loadPkcs1(ss4));
 
   // save key in base64-encoded pkcs1 format
   OBufferStream os2;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs1Base64(os2));
-  BOOST_CHECK_EQUAL_COLLECTIONS(sKeyPkcs1Base64, sKeyPkcs1Base64 + sKeyPkcs1Base64Len,
+  BOOST_CHECK_EQUAL_COLLECTIONS(sKeyPkcs1Base64.begin(), sKeyPkcs1Base64.end(),
                                 os2.buf()->begin(), os2.buf()->end());
 
   // save key in pkcs1 format
   OBufferStream os3;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs1(os3));
-  BOOST_CHECK_EQUAL_COLLECTIONS(sKeyPkcs1, sKeyPkcs1 + sKeyPkcs1Len,
+  BOOST_CHECK_EQUAL_COLLECTIONS(sKeyPkcs1->begin(), sKeyPkcs1->end(),
                                 os3.buf()->begin(), os3.buf()->end());
 
-  auto sKeyPkcs8Base64 = reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs8.data());
-  auto sKeyPkcs8Base64Len = dataSet.privateKeyPkcs8.size();
+  auto sKeyPkcs8Base64 = make_span(reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs8.data()),
+                                   dataSet.privateKeyPkcs8.size());
   OBufferStream os4;
-  bufferSource(sKeyPkcs8Base64, sKeyPkcs8Base64Len) >> base64Decode() >> streamSink(os4);
-  const uint8_t* sKeyPkcs8 = os4.buf()->data();
-  size_t sKeyPkcs8Len = os4.buf()->size();
+  bufferSource(sKeyPkcs8Base64) >> base64Decode() >> streamSink(os4);
+  auto sKeyPkcs8 = os4.buf();
 
   std::string password("password");
   std::string wrongpw("wrongpw");
@@ -474,12 +470,11 @@
 
   // load key in base64-encoded pkcs8 format
   PrivateKey sKey5;
-  BOOST_CHECK_NO_THROW(sKey5.loadPkcs8Base64(sKeyPkcs8Base64, sKeyPkcs8Base64Len,
-                                             password.data(), password.size()));
+  BOOST_CHECK_NO_THROW(sKey5.loadPkcs8Base64(sKeyPkcs8Base64, password.data(), password.size()));
   BOOST_CHECK_EQUAL(sKey5.getKeySize(), dataSet.keySize);
 
   PrivateKey sKey6;
-  BOOST_CHECK_NO_THROW(sKey6.loadPkcs8Base64(sKeyPkcs8Base64, sKeyPkcs8Base64Len, pwCallback));
+  BOOST_CHECK_NO_THROW(sKey6.loadPkcs8Base64(sKeyPkcs8Base64, pwCallback));
 
   std::stringstream ss7(dataSet.privateKeyPkcs8);
   PrivateKey sKey7;
@@ -491,25 +486,25 @@
 
   // load key in pkcs8 format
   PrivateKey sKey9;
-  BOOST_CHECK_NO_THROW(sKey9.loadPkcs8(sKeyPkcs8, sKeyPkcs8Len, password.data(), password.size()));
+  BOOST_CHECK_NO_THROW(sKey9.loadPkcs8(*sKeyPkcs8, password.data(), password.size()));
   BOOST_CHECK_EQUAL(sKey9.getKeySize(), dataSet.keySize);
 
   PrivateKey sKey10;
-  BOOST_CHECK_NO_THROW(sKey10.loadPkcs8(sKeyPkcs8, sKeyPkcs8Len, pwCallback));
+  BOOST_CHECK_NO_THROW(sKey10.loadPkcs8(*sKeyPkcs8, pwCallback));
 
   std::stringstream ss11;
-  ss11.write(reinterpret_cast<const char*>(sKeyPkcs8), sKeyPkcs8Len);
+  ss11.write(reinterpret_cast<const char*>(sKeyPkcs8->data()), sKeyPkcs8->size());
   PrivateKey sKey11;
   BOOST_CHECK_NO_THROW(sKey11.loadPkcs8(ss11, password.data(), password.size()));
 
   std::stringstream ss12;
-  ss12.write(reinterpret_cast<const char*>(sKeyPkcs8), sKeyPkcs8Len);
+  ss12.write(reinterpret_cast<const char*>(sKeyPkcs8->data()), sKeyPkcs8->size());
   PrivateKey sKey12;
   BOOST_CHECK_NO_THROW(sKey12.loadPkcs8(ss12, pwCallback));
 
   // load key using wrong password, Error is expected
   PrivateKey sKey13;
-  BOOST_CHECK_THROW(sKey13.loadPkcs8Base64(sKeyPkcs8Base64, sKeyPkcs8Base64Len, wrongpw.data(), wrongpw.size()),
+  BOOST_CHECK_THROW(sKey13.loadPkcs8Base64(sKeyPkcs8Base64, wrongpw.data(), wrongpw.size()),
                     PrivateKey::Error);
   BOOST_CHECK_EQUAL(sKey13.getKeyType(), KeyType::NONE);
   BOOST_CHECK_EQUAL(sKey13.getKeySize(), 0);
@@ -517,30 +512,30 @@
   // save key in base64-encoded pkcs8 format
   OBufferStream os14;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs8Base64(os14, password.data(), password.size()));
-  checkPkcs8Base64Encoding(os14.buf(), password, sKeyPkcs1Buf);
+  checkPkcs8Base64Encoding(os14.buf(), password, sKeyPkcs1);
 
   OBufferStream os15;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs8Base64(os15, pwCallback));
-  checkPkcs8Base64Encoding(os15.buf(), password, sKeyPkcs1Buf);
+  checkPkcs8Base64Encoding(os15.buf(), password, sKeyPkcs1);
 
   // save key in pkcs8 format
   OBufferStream os16;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs8(os16, password.data(), password.size()));
-  checkPkcs8Encoding(os16.buf(), password, sKeyPkcs1Buf);
+  checkPkcs8Encoding(os16.buf(), password, sKeyPkcs1);
 
   OBufferStream os17;
   BOOST_REQUIRE_NO_THROW(sKey.savePkcs8(os17, pwCallback));
-  checkPkcs8Encoding(os17.buf(), password, sKeyPkcs1Buf);
+  checkPkcs8Encoding(os17.buf(), password, sKeyPkcs1);
 }
 
 BOOST_AUTO_TEST_CASE_TEMPLATE(DerivePublicKey, T, KeyTestDataSets)
 {
   T dataSet;
 
-  auto sKeyPkcs1Base64 = reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data());
-  auto sKeyPkcs1Base64Len = dataSet.privateKeyPkcs1.size();
+  auto sKeyPkcs1Base64 = make_span(reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
+                                   dataSet.privateKeyPkcs1.size());
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(sKeyPkcs1Base64, sKeyPkcs1Base64Len);
+  sKey.loadPkcs1Base64(sKeyPkcs1Base64);
 
   // derive public key and compare
   ConstBufferPtr pKeyBits = sKey.derivePublicKey();
@@ -555,8 +550,8 @@
   RsaKey_Aes256Encrypted dataSet;
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
-                       dataSet.privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
+                        dataSet.privateKeyPkcs1.size()});
   BOOST_CHECK_EQUAL(sKey.getKeyType(), KeyType::RSA);
 
   const uint8_t plaintext[] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07};
@@ -573,7 +568,7 @@
   OBufferStream os;
   bufferSource(ciphertext) >> base64Decode() >> streamSink(os);
 
-  auto decrypted = sKey.decrypt(os.buf()->data(), os.buf()->size());
+  auto decrypted = sKey.decrypt(*os.buf());
   BOOST_CHECK_EQUAL_COLLECTIONS(plaintext, plaintext + sizeof(plaintext),
                                 decrypted->begin(), decrypted->end());
 }
@@ -583,19 +578,19 @@
   RsaKey_Aes256Encrypted dataSet;
 
   PublicKey pKey;
-  pKey.loadPkcs8Base64(reinterpret_cast<const uint8_t*>(dataSet.publicKey.data()),
-                       dataSet.publicKey.size());
+  pKey.loadPkcs8Base64({reinterpret_cast<const uint8_t*>(dataSet.publicKey.data()),
+                        dataSet.publicKey.size()});
   BOOST_CHECK_EQUAL(pKey.getKeyType(), KeyType::RSA);
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
-                       dataSet.privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(dataSet.privateKeyPkcs1.data()),
+                        dataSet.privateKeyPkcs1.size()});
   BOOST_CHECK_EQUAL(sKey.getKeyType(), KeyType::RSA);
 
   const uint8_t plaintext[] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07};
 
-  auto ciphertext = pKey.encrypt(plaintext, sizeof(plaintext));
-  auto decrypted = sKey.decrypt(ciphertext->data(), ciphertext->size());
+  auto ciphertext = pKey.encrypt(plaintext);
+  auto decrypted = sKey.decrypt(*ciphertext);
   BOOST_CHECK_EQUAL_COLLECTIONS(plaintext, plaintext + sizeof(plaintext),
                                 decrypted->begin(), decrypted->end());
 }
@@ -606,10 +601,10 @@
   bufferSource("Y2lhbyFob2xhIWhlbGxvIQ==") >> base64Decode() >> streamSink(os);
 
   auto ecKey = generatePrivateKey(EcKeyParams());
-  BOOST_CHECK_THROW(ecKey->decrypt(os.buf()->data(), os.buf()->size()), PrivateKey::Error);
+  BOOST_CHECK_THROW(ecKey->decrypt(*os.buf()), PrivateKey::Error);
 
   auto hmacKey = generatePrivateKey(HmacKeyParams());
-  BOOST_CHECK_THROW(hmacKey->decrypt(os.buf()->data(), os.buf()->size()), PrivateKey::Error);
+  BOOST_CHECK_THROW(hmacKey->decrypt(*os.buf()), PrivateKey::Error);
 }
 
 class RsaKeyGenParams
@@ -673,7 +668,7 @@
 
   const uint8_t data[] = {0x01, 0x02, 0x03, 0x04};
   OBufferStream os;
-  BOOST_REQUIRE_NO_THROW(bufferSource(data, sizeof(data)) >>
+  BOOST_REQUIRE_NO_THROW(bufferSource(data) >>
                          signerFilter(DigestAlgorithm::SHA256, *sKey) >>
                          streamSink(os));
   auto sig = os.buf();
@@ -684,8 +679,8 @@
     BOOST_REQUIRE(pKeyBits != nullptr);
     T::checkPublicKey(*pKeyBits);
     PublicKey pKey;
-    pKey.loadPkcs8(pKeyBits->data(), pKeyBits->size());
-    BOOST_CHECK_NO_THROW(bufferSource(data, sizeof(data)) >>
+    pKey.loadPkcs8(*pKeyBits);
+    BOOST_CHECK_NO_THROW(bufferSource(data) >>
                          verifierFilter(DigestAlgorithm::SHA256, pKey, sig->data(), sig->size()) >>
                          boolSink(result));
   }
@@ -693,7 +688,7 @@
 #if OPENSSL_VERSION_NUMBER >= 0x1010100fL
     BOOST_CHECK_THROW(sKey->derivePublicKey(), PrivateKey::Error);
 #endif
-    BOOST_CHECK_NO_THROW(bufferSource(data, sizeof(data)) >>
+    BOOST_CHECK_NO_THROW(bufferSource(data) >>
                          verifierFilter(DigestAlgorithm::SHA256, *sKey, sig->data(), sig->size()) >>
                          boolSink(result));
   }
diff --git a/tests/unit/security/transform/public-key.t.cpp b/tests/unit/security/transform/public-key.t.cpp
index ae234b3..d572ecc 100644
--- a/tests/unit/security/transform/public-key.t.cpp
+++ b/tests/unit/security/transform/public-key.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -22,7 +22,9 @@
 #include "ndn-cxx/security/transform/public-key.hpp"
 
 #include "ndn-cxx/encoding/buffer-stream.hpp"
-#include "ndn-cxx/security/transform.hpp"
+#include "ndn-cxx/security/transform/base64-decode.hpp"
+#include "ndn-cxx/security/transform/buffer-source.hpp"
+#include "ndn-cxx/security/transform/stream-sink.hpp"
 
 #include "tests/boost-test.hpp"
 
@@ -69,26 +71,24 @@
 {
   T dataSet;
 
-  const uint8_t* pKeyPkcs8Base64 = reinterpret_cast<const uint8_t*>(dataSet.publicKeyPkcs8.c_str());
+  auto pKeyPkcs8Base64 = reinterpret_cast<const uint8_t*>(dataSet.publicKeyPkcs8.data());
   size_t pKeyPkcs8Base64Len = dataSet.publicKeyPkcs8.size();
   OBufferStream os;
-  bufferSource(pKeyPkcs8Base64, pKeyPkcs8Base64Len) >> base64Decode() >> streamSink(os);
-  ConstBufferPtr pKeyPkcs8Buf = os.buf();
-  const uint8_t* pKeyPkcs8 = pKeyPkcs8Buf->data();
-  size_t pKeyPkcs8Len = pKeyPkcs8Buf->size();
+  bufferSource(make_span(pKeyPkcs8Base64, pKeyPkcs8Base64Len)) >> base64Decode() >> streamSink(os);
+  auto pKeyPkcs8 = os.buf();
 
   PublicKey pKey1;
-  BOOST_CHECK_NO_THROW(pKey1.loadPkcs8Base64(pKeyPkcs8Base64, pKeyPkcs8Base64Len));
+  BOOST_CHECK_NO_THROW(pKey1.loadPkcs8Base64({pKeyPkcs8Base64, pKeyPkcs8Base64Len}));
 
   std::stringstream ss2(dataSet.publicKeyPkcs8);
   PublicKey pKey2;
   BOOST_CHECK_NO_THROW(pKey2.loadPkcs8Base64(ss2));
 
   PublicKey pKey3;
-  BOOST_CHECK_NO_THROW(pKey3.loadPkcs8(pKeyPkcs8, pKeyPkcs8Len));
+  BOOST_CHECK_NO_THROW(pKey3.loadPkcs8(*pKeyPkcs8));
 
   std::stringstream ss4;
-  ss4.write(reinterpret_cast<const char*>(pKeyPkcs8), pKeyPkcs8Len);
+  ss4.write(reinterpret_cast<const char*>(pKeyPkcs8->data()), pKeyPkcs8->size());
   PublicKey pKey4;
   BOOST_CHECK_NO_THROW(pKey4.loadPkcs8(ss4));
 
@@ -99,7 +99,7 @@
 
   OBufferStream os6;
   BOOST_REQUIRE_NO_THROW(pKey1.savePkcs8(os6));
-  BOOST_CHECK_EQUAL_COLLECTIONS(pKeyPkcs8, pKeyPkcs8 + pKeyPkcs8Len,
+  BOOST_CHECK_EQUAL_COLLECTIONS(pKeyPkcs8->begin(), pKeyPkcs8->end(),
                                 os6.buf()->begin(), os6.buf()->end());
 }
 
@@ -113,14 +113,14 @@
   EcKeyTestData dataSet;
 
   PublicKey pKey;
-  pKey.loadPkcs8Base64(reinterpret_cast<const uint8_t*>(dataSet.publicKeyPkcs8.c_str()),
-                       dataSet.publicKeyPkcs8.size());
+  pKey.loadPkcs8Base64({reinterpret_cast<const uint8_t*>(dataSet.publicKeyPkcs8.data()),
+                        dataSet.publicKeyPkcs8.size()});
   BOOST_CHECK_EQUAL(pKey.getKeyType(), KeyType::EC);
 
   OBufferStream os;
   bufferSource("Y2lhbyFob2xhIWhlbGxvIQ==") >> base64Decode() >> streamSink(os);
 
-  BOOST_CHECK_THROW(pKey.encrypt(os.buf()->data(), os.buf()->size()), PublicKey::Error);
+  BOOST_CHECK_THROW(pKey.encrypt(*os.buf()), PublicKey::Error);
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestPublicKey
diff --git a/tests/unit/security/transform/signer-filter.t.cpp b/tests/unit/security/transform/signer-filter.t.cpp
index b2145e6..063e3fc 100644
--- a/tests/unit/security/transform/signer-filter.t.cpp
+++ b/tests/unit/security/transform/signer-filter.t.cpp
@@ -40,8 +40,6 @@
 BOOST_AUTO_TEST_SUITE(Transform)
 BOOST_AUTO_TEST_SUITE(TestSignerFilter)
 
-const uint8_t DATA[] = {0x01, 0x02, 0x03, 0x04};
-
 BOOST_AUTO_TEST_CASE(Rsa)
 {
   const std::string publicKeyPkcs8 =
@@ -78,21 +76,23 @@
     "cuHICmsCgYAtFJ1idqMoHxES3mlRpf2JxyQudP3SCm2WpGmqVzhRYInqeatY5sUd\n"
     "lPLHm/p77RT7EyxQHTlwn8FJPuM/4ZH1rQd/vB+Y8qAtYJCexDMsbvLW+Js+VOvk\n"
     "jweEC0nrcL31j9mF0vz5E6tfRu4hhJ6L4yfWs0gSejskeVB/w8QY4g==\n";
+  const uint8_t data[] = {0x01, 0x02, 0x03, 0x04};
 
   OBufferStream os1;
   bufferSource(publicKeyPkcs8) >> base64Decode() >> streamSink(os1);
   auto pubKey = os1.buf();
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()), privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()),
+                        privateKeyPkcs1.size()});
 
   BOOST_CHECK_THROW(SignerFilter(DigestAlgorithm::NONE, sKey), Error);
 
   OBufferStream os2;
-  bufferSource(DATA, sizeof(DATA)) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
+  bufferSource(data) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
   auto sig = os2.buf();
 
-  BOOST_TEST(verifySignature({{DATA, sizeof(DATA)}}, sig->data(), sig->size(), pubKey->data(), pubKey->size()));
+  BOOST_TEST(verifySignature({{data, sizeof(data)}}, sig->data(), sig->size(), pubKey->data(), pubKey->size()));
 }
 
 BOOST_AUTO_TEST_CASE(Ecdsa)
@@ -114,21 +114,23 @@
     "RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA\n"
     "//////////+85vqtpxeehPO5ysL8YyVRAgEBA0IABGhuFibgwLdEJBDOLdvSg1Hc\n"
     "5EJTDxq6ls5FoYLfThp8HOjuwGSz0qw8ocMqyku1y0V5peQ4rEPd0bwcpZd9svA=\n";
+  const uint8_t data[] = {0x01, 0x02, 0x03, 0x04};
 
   OBufferStream os1;
   bufferSource(publicKeyPkcs8) >> base64Decode() >> streamSink(os1);
   auto pubKey = os1.buf();
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()), privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()),
+                        privateKeyPkcs1.size()});
 
   BOOST_CHECK_THROW(SignerFilter(DigestAlgorithm::NONE, sKey), Error);
 
   OBufferStream os2;
-  bufferSource(DATA, sizeof(DATA)) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
+  bufferSource(data) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
   auto sig = os2.buf();
 
-  BOOST_TEST(verifySignature({{DATA, sizeof(DATA)}}, sig->data(), sig->size(), pubKey->data(), pubKey->size()));
+  BOOST_TEST(verifySignature({{data, sizeof(data)}}, sig->data(), sig->size(), pubKey->data(), pubKey->size()));
 }
 
 BOOST_AUTO_TEST_SUITE(Hmac)
@@ -162,7 +164,7 @@
                                 0x3a, 0x12, 0x68, 0x54};
 
   PrivateKey key;
-  key.loadRaw(KeyType::HMAC, rawKey, sizeof(rawKey));
+  key.loadRaw(KeyType::HMAC, rawKey);
 
   BOOST_CHECK_THROW(SignerFilter(DigestAlgorithm::NONE, key), Error);
 
@@ -198,7 +200,7 @@
                                 0x38, 0x43};
 
   PrivateKey key;
-  key.loadRaw(KeyType::HMAC, reinterpret_cast<const uint8_t*>(rawKey), std::strlen(rawKey));
+  key.loadRaw(KeyType::HMAC, {reinterpret_cast<const uint8_t*>(rawKey), std::strlen(rawKey)});
 
   OBufferStream os256;
   bufferSource(data) >> signerFilter(DigestAlgorithm::SHA256, key) >> streamSink(os256);
@@ -222,10 +224,10 @@
                                 0x65, 0xfe};
 
   PrivateKey key;
-  key.loadRaw(KeyType::HMAC, rawKey, sizeof(rawKey));
+  key.loadRaw(KeyType::HMAC, rawKey);
 
   OBufferStream os256;
-  bufferSource(data, sizeof(data)) >> signerFilter(DigestAlgorithm::SHA256, key) >> streamSink(os256);
+  bufferSource(data) >> signerFilter(DigestAlgorithm::SHA256, key) >> streamSink(os256);
   auto sig = os256.buf();
   BOOST_CHECK_EQUAL_COLLECTIONS(sig->begin(), sig->end(), hmacSha256, hmacSha256 + sizeof(hmacSha256));
 }
diff --git a/tests/unit/security/transform/step-source.t.cpp b/tests/unit/security/transform/step-source.t.cpp
index d8aae47..0179011 100644
--- a/tests/unit/security/transform/step-source.t.cpp
+++ b/tests/unit/security/transform/step-source.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -58,17 +58,18 @@
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567"
     "0123456701234567012345670123456701234567012345670123456701234567";
-  const uint8_t* buf = reinterpret_cast<const uint8_t*>(input.data());
+  auto buf = reinterpret_cast<const uint8_t*>(input.data());
 
   std::ostringstream os;
   StepSource ss;
   ss >> streamSink(os);
-  BOOST_CHECK_EQUAL(ss.write(buf, 320), 320);
-  BOOST_CHECK_EQUAL(ss.write(buf + 320, 320), 320);
-  BOOST_CHECK_EQUAL(ss.write(buf + 640, 320), 320);
-  BOOST_CHECK_EQUAL(ss.write(buf + 960, 320), 320);
+  BOOST_CHECK_EQUAL(ss.write({buf, 320}), 320);
+  BOOST_CHECK_EQUAL(ss.write({buf + 320, 320}), 320);
+  BOOST_CHECK_EQUAL(ss.write({buf + 640, 320}), 320);
+  BOOST_CHECK_EQUAL(ss.write({buf + 960, 320}), 320);
   ss.end();
-  BOOST_CHECK_THROW(ss.write(buf + 960, 320), transform::Error);
+
+  BOOST_CHECK_THROW(ss.write({buf + 960, 320}), transform::Error);
   BOOST_CHECK_EQUAL(os.str(), input);
 }
 
@@ -78,6 +79,7 @@
   StepSource ss;
   ss >> streamSink(os);
   ss.end();
+
   BOOST_CHECK_EQUAL(os.str(), "");
 }
 
diff --git a/tests/unit/security/transform/stream-sink.t.cpp b/tests/unit/security/transform/stream-sink.t.cpp
index 4704b01..f58bece 100644
--- a/tests/unit/security/transform/stream-sink.t.cpp
+++ b/tests/unit/security/transform/stream-sink.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -34,20 +34,21 @@
 
 BOOST_AUTO_TEST_CASE(Basic)
 {
-  uint8_t in[] = {
+  const uint8_t in[] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-    0x20, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+    0x20, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
   };
   std::ostringstream os;
   StreamSink sink(os);
-  BOOST_CHECK_EQUAL(sink.write(in, 4), 4);
-  BOOST_CHECK_EQUAL(sink.write(in + 4, 4), 4);
-  BOOST_CHECK_EQUAL(sink.write(in + 8, 4), 4);
-  BOOST_CHECK_EQUAL(sink.write(in + 12, 4), 4);
+  BOOST_CHECK_EQUAL(sink.write({in, 4}), 4);
+  BOOST_CHECK_EQUAL(sink.write({in + 4, 4}), 4);
+  BOOST_CHECK_EQUAL(sink.write({in + 8, 4}), 4);
+  BOOST_CHECK_EQUAL(sink.write({in + 12, 4}), 4);
   sink.end();
+
   std::string out = os.str();
   BOOST_CHECK_EQUAL_COLLECTIONS(in, in + sizeof(in), out.begin(), out.end());
-  BOOST_CHECK_THROW(sink.write(in + 8, 8), transform::Error);
+  BOOST_CHECK_THROW(sink.write({in + 8, 8}), transform::Error);
 }
 
 BOOST_AUTO_TEST_SUITE_END() // TestStreamSink
diff --git a/tests/unit/security/transform/strip-space.t.cpp b/tests/unit/security/transform/strip-space.t.cpp
index 29c2e7e..cd73270 100644
--- a/tests/unit/security/transform/strip-space.t.cpp
+++ b/tests/unit/security/transform/strip-space.t.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2013-2018 Regents of the University of California.
+ * Copyright (c) 2013-2021 Regents of the University of California.
  *
  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
  *
@@ -46,19 +46,19 @@
     pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia
     deserunt mollit anim id est laborum.
   )STR";
-  size_t inputLen = strlen(input);
+  const size_t inputLen = strlen(input);
 
   OBufferStream os;
   StepSource source;
   source >> stripSpace() >> streamSink(os);
 
   for (size_t offset = 0; offset < inputLen; offset += 40) {
-    source.write(reinterpret_cast<const uint8_t*>(input + offset),
-                 std::min<size_t>(40, inputLen - offset));
+    source.write({reinterpret_cast<const uint8_t*>(input + offset),
+                  std::min<size_t>(40, inputLen - offset)});
   }
   source.end();
 
-  std::string expected(
+  const std::string expected(
     "Loremipsumdolorsitamet,consecteturadipiscingelit,seddoeiusmodtemporincididuntutl"
     "aboreetdoloremagnaaliqua.Utenimadminimveniam,quisnostrudexercitationullamcolabor"
     "isnisiutaliquipexeacommodoconsequat.Duisauteiruredolorinreprehenderitinvoluptate"
diff --git a/tests/unit/security/transform/verifier-filter.t.cpp b/tests/unit/security/transform/verifier-filter.t.cpp
index 63fd03e..8feabfc 100644
--- a/tests/unit/security/transform/verifier-filter.t.cpp
+++ b/tests/unit/security/transform/verifier-filter.t.cpp
@@ -88,20 +88,21 @@
   auto pubKey = os1.buf();
 
   PublicKey pKey;
-  pKey.loadPkcs8(pubKey->data(), pubKey->size());
+  pKey.loadPkcs8(*pubKey);
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()), privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()),
+                        privateKeyPkcs1.size()});
 
   OBufferStream os2;
-  bufferSource(DATA, sizeof(DATA)) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
+  bufferSource(DATA) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
   auto sig = os2.buf();
 
   BOOST_CHECK_THROW(VerifierFilter(DigestAlgorithm::NONE, pKey, sig->data(), sig->size()), Error);
   BOOST_CHECK_THROW(VerifierFilter(DigestAlgorithm::SHA256, sKey, sig->data(), sig->size()), Error);
 
   bool result = false;
-  bufferSource(DATA, sizeof(DATA)) >>
+  bufferSource(DATA) >>
     verifierFilter(DigestAlgorithm::SHA256, pKey, sig->data(), sig->size()) >>
     boolSink(result);
 
@@ -133,20 +134,21 @@
   auto pubKey = os1.buf();
 
   PublicKey pKey;
-  pKey.loadPkcs8(pubKey->data(), pubKey->size());
+  pKey.loadPkcs8(*pubKey);
 
   PrivateKey sKey;
-  sKey.loadPkcs1Base64(reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()), privateKeyPkcs1.size());
+  sKey.loadPkcs1Base64({reinterpret_cast<const uint8_t*>(privateKeyPkcs1.data()),
+                        privateKeyPkcs1.size()});
 
   OBufferStream os2;
-  bufferSource(DATA, sizeof(DATA)) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
+  bufferSource(DATA) >> signerFilter(DigestAlgorithm::SHA256, sKey) >> streamSink(os2);
   auto sig = os2.buf();
 
   BOOST_CHECK_THROW(VerifierFilter(DigestAlgorithm::NONE, pKey, sig->data(), sig->size()), Error);
   BOOST_CHECK_THROW(VerifierFilter(DigestAlgorithm::SHA256, sKey, sig->data(), sig->size()), Error);
 
   bool result = false;
-  bufferSource(DATA, sizeof(DATA)) >>
+  bufferSource(DATA) >>
     verifierFilter(DigestAlgorithm::SHA256, pKey, sig->data(), sig->size()) >>
     boolSink(result);
 
@@ -158,14 +160,14 @@
   auto sKey = generatePrivateKey(HmacKeyParams());
 
   OBufferStream os;
-  bufferSource(DATA, sizeof(DATA)) >> signerFilter(DigestAlgorithm::SHA256, *sKey) >> streamSink(os);
+  bufferSource(DATA) >> signerFilter(DigestAlgorithm::SHA256, *sKey) >> streamSink(os);
   auto sig = os.buf();
 
   BOOST_CHECK_THROW(VerifierFilter(DigestAlgorithm::NONE, *sKey, sig->data(), sig->size()), Error);
 
 #if OPENSSL_VERSION_NUMBER < 0x30000000L // FIXME #5154
   bool result = false;
-  bufferSource(DATA, sizeof(DATA)) >>
+  bufferSource(DATA) >>
     verifierFilter(DigestAlgorithm::SHA256, *sKey, sig->data(), sig->size()) >>
     boolSink(result);
 
diff --git a/tests/unit/security/validation-policy-config.t.cpp b/tests/unit/security/validation-policy-config.t.cpp
index dcd7cb8..83de50e 100644
--- a/tests/unit/security/validation-policy-config.t.cpp
+++ b/tests/unit/security/validation-policy-config.t.cpp
@@ -248,7 +248,7 @@
     {
       using namespace ndn::security::transform;
       const auto& cert = this->identity.getDefaultKey().getDefaultCertificate().wireEncode();
-      bufferSource(cert.wire(), cert.size()) >> base64Encode(false) >> streamSink(os);
+      bufferSource(make_span(cert.wire(), cert.size())) >> base64Encode(false) >> streamSink(os);
     }
 
     this->policy.load(this->baseConfig + R"CONF(
diff --git a/tests/unit/security/verification-helpers.t.cpp b/tests/unit/security/verification-helpers.t.cpp
index 20ffee9..9925bb2 100644
--- a/tests/unit/security/verification-helpers.t.cpp
+++ b/tests/unit/security/verification-helpers.t.cpp
@@ -550,7 +550,7 @@
   Certificate cert(Block(dataset.cert.data(), dataset.cert.size()));
   Buffer keyRaw = cert.getPublicKey();
   transform::PublicKey key;
-  key.loadPkcs8(keyRaw.data(), keyRaw.size());
+  key.loadPkcs8(keyRaw);
   Data data(Block(dataset.goodData.data(), dataset.goodData.size()));
   Data badSigData(Block(dataset.badSigData.data(), dataset.badSigData.size()));
   Interest interest(Block(dataset.goodInterest.data(), dataset.goodInterest.size()));