diff --git a/src/crypto-support/crypto-helper.cpp b/src/crypto-support/crypto-helper.cpp
index 915f17c..c93a29c 100644
--- a/src/crypto-support/crypto-helper.cpp
+++ b/src/crypto-support/crypto-helper.cpp
@@ -1,5 +1,5 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
-/**
+/*
  * Copyright (c) 2017-2019, Regents of the University of California.
  *
  * This file is part of ndncert, a certificate management system based on NDN.
@@ -20,18 +20,18 @@
 
 #include "crypto-helper.hpp"
 #include "../logging.hpp"
-#include <openssl/pem.h>
-#include <openssl/rand.h>
+
 #include <openssl/err.h>
-#include <ndn-cxx/security/transform/block-cipher.hpp>
+#include <openssl/pem.h>
+
+#include <ndn-cxx/encoding/buffer-stream.hpp>
 #include <ndn-cxx/security/transform/base64-decode.hpp>
 #include <ndn-cxx/security/transform/base64-encode.hpp>
 #include <ndn-cxx/security/transform/buffer-source.hpp>
+#include <ndn-cxx/security/transform/private-key.hpp>
+#include <ndn-cxx/security/transform/signer-filter.hpp>
 #include <ndn-cxx/security/transform/step-source.hpp>
 #include <ndn-cxx/security/transform/stream-sink.hpp>
-#include <ndn-cxx/util/random.hpp>
-#include <ndn-cxx/encoding/buffer-stream.hpp>
-#include <ndn-cxx/security/transform/hmac-filter.hpp>
 
 namespace ndn {
 namespace ndncert {
@@ -139,12 +139,16 @@
 std::string
 ECDHState::getBase64PubKey()
 {
+  namespace t = ndn::security::transform;
+
   if (context->publicKeyLen == 0) {
     this->getRawSelfPubKey();
   }
-  std::stringstream os;
-  security::transform::bufferSource(context->publicKey, context->publicKeyLen)
-    >> security::transform::base64Encode() >> security::transform::streamSink(os);
+
+  std::ostringstream os;
+  t::bufferSource(context->publicKey, context->publicKeyLen)
+    >> t::base64Encode()
+    >> t::streamSink(os);
   return os.str();
 }
 
@@ -177,35 +181,41 @@
 ECDHState::deriveSecret(const std::string& peerKeyStr)
 {
   namespace t = ndn::security::transform;
+
   OBufferStream os;
-  security::transform::bufferSource(peerKeyStr)
-    >> security::transform::base64Decode()
-    >> security::transform::streamSink(os);
-  ConstBufferPtr result = os.buf();
+  t::bufferSource(peerKeyStr) >> t::base64Decode() >> t::streamSink(os);
+  auto result = os.buf();
+
   return this->deriveSecret(result->data(), result->size());
 }
 
-int ndn_compute_hmac_sha256 (const uint8_t *data, const unsigned  data_length,
-                             const uint8_t *key, const unsigned key_length,
-                             uint8_t *prk) {
+int
+ndn_compute_hmac_sha256(const uint8_t *data, const unsigned data_length,
+                        const uint8_t *key, const unsigned key_length,
+                        uint8_t *prk)
+{
+  namespace t = ndn::security::transform;
+
+  t::PrivateKey privKey;
+  privKey.loadRaw(KeyType::HMAC, key, key_length);
   OBufferStream os;
 
-  security::transform::bufferSource(data, data_length) >>
-    security::transform::hmacFilter(
-                                    DigestAlgorithm::SHA256, key, key_length) >>
-    security::transform::streamSink(os);
+  t::bufferSource(data, data_length)
+    >> t::signerFilter(DigestAlgorithm::SHA256, privKey)
+    >> t::streamSink(os);
 
-  auto result = os.buf();
-  memcpy(prk, result->data(), HASH_SIZE);
+  memcpy(prk, os.buf()->data(), HASH_SIZE);
   return 0;
 }
 
-//removed dependency of OpenSSL@1.1
+// avoid dependency on OpenSSL >= 1.1
 int
 hkdf(const uint8_t* secret, int secretLen, const uint8_t* salt,
      int saltLen, uint8_t* okm, int okm_len,
      const uint8_t* info, int info_len)
 {
+  namespace t = ndn::security::transform;
+
   // hkdf generate prk
   uint8_t prk[HASH_SIZE];
   ndn_compute_hmac_sha256(salt, saltLen, secret, secretLen, prk);
@@ -213,32 +223,32 @@
   // hkdf expand
   uint8_t prev[HASH_SIZE] = {0};
   int done_len = 0, dig_len = HASH_SIZE, n = okm_len / dig_len;
-  if (okm_len % dig_len) n++;
-  if (n > 255 || okm == nullptr) return 0;
+  if (okm_len % dig_len)
+    n++;
+  if (n > 255 || okm == nullptr)
+    return 0;
+
   for (int i = 1; i <= n; i++) {
     size_t copy_len;
     const uint8_t ctr = i;
-    OBufferStream os;
-    security::transform::StepSource source;
 
-    source >> security::transform::hmacFilter(DigestAlgorithm::SHA256, prk, dig_len)
-           >> security::transform::streamSink(os);
+    t::StepSource source;
+    t::PrivateKey privKey;
+    privKey.loadRaw(KeyType::HMAC, prk, dig_len);
+    OBufferStream os;
+    source >> t::signerFilter(DigestAlgorithm::SHA256, privKey)
+           >> t::streamSink(os);
 
     if (i > 1) {
       source.write(prev, dig_len);
     }
-
     source.write(info, info_len);
     source.write(&ctr, 1);
     source.end();
 
     auto result = os.buf();
     memcpy(prev, result->data(), dig_len);
-
-    copy_len = (done_len + dig_len > okm_len) ?
-      okm_len - done_len :
-      dig_len;
-
+    copy_len = (done_len + dig_len > okm_len) ? okm_len - done_len : dig_len;
     memcpy(okm + done_len, prev, copy_len);
     done_len += copy_len;
   }
diff --git a/tests/unit-tests/crypto-helper.t.cpp b/tests/unit-tests/crypto-helper.t.cpp
index dc2dd66..6638515 100644
--- a/tests/unit-tests/crypto-helper.t.cpp
+++ b/tests/unit-tests/crypto-helper.t.cpp
@@ -72,57 +72,7 @@
                                 bobResult, bobResult + 32);
 }
 
-BOOST_AUTO_TEST_CASE(HmacSha256)
-{
-  uint8_t secret[] = {0x00,0x01,0x02,0x03,0x04,0x05,
-                      0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c};
-
-  uint8_t salt[] = {0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b};
-
-  uint8_t result[32];
-
-  uint8_t expected[] = {0x07,0x77,0x09,0x36,0x2c,0x2e,0x32,
-                        0xdf,0x0d,0xdc,0x3f,0x0d,0xc4,0x7b,
-                        0xba,0x63,0x90,0xb6,0xc7,0x3b,0xb5,
-                        0x0f,0x9c,0x31,0x22,0xec,0x84,0x4a,
-                        0xd7,0xc2,0xb3,0xe5};
-
-  ndn_compute_hmac_sha256(salt, sizeof(salt), secret, sizeof(secret), result);
-  BOOST_CHECK(memcmp(expected, result, sizeof(result)) == 0);
-}
-
-BOOST_AUTO_TEST_CASE(HkdfIetf1)
-{
-  uint8_t secret[] = {0x00,0x01,0x02,0x03,0x04,0x05,
-                      0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c};
-
-  uint8_t salt[] = {0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b};
-
-  uint8_t info[] = {0xf0,0xf1,0xf2,0xf3,0xf4,
-                    0xf5,0xf6,0xf7,0xf8,0xf9};
-
-  uint8_t result[42];
-  uint8_t expected[] = {0x3c,0xb2,0x5f,0x25,0xfa,0xac,0xd5,0x7a,0x90,0x43,
-                        0x4f,0x64,0xd0,0x36,0x2f,0x2a,0x2d,0x2d,0x0a,0x90,
-                        0xcf,0x1a,0x5a,0x4c,0x5d,0xb0,0x2d,0x56,0xec,0xc4,
-                        0xc5,0xbf,0x34,0x00,0x72,0x08,0xd5,0xb8,0x87,0x18,
-                        0x58,0x65};
-
-  auto resultLen = hkdf(secret, sizeof(secret),
-                        salt,sizeof(salt),
-                        result, sizeof(result),
-                        info, sizeof(info));
-
-  BOOST_CHECK(resultLen != 0);
-  BOOST_CHECK(memcmp(expected, result, sizeof(result)) == 0);
-}
-
+// Test case 2 from RFC 5869
 BOOST_AUTO_TEST_CASE(HkdfIetf2)
 {
   uint8_t secret[] = {0x60,0x61,0x62,0x63,0x64,0x65,0x66,0x67,
@@ -158,7 +108,6 @@
                     0xf0,0xf1,0xf2,0xf3,0xf4,0xf5,0xf6,0xf7,
                     0xf8,0xf9,0xfa,0xfb,0xfc,0xfd,0xfe,0xff};
 
-  uint8_t result[82];
   uint8_t expected[] = {0xb1,0x1e,0x39,0x8d,0xc8,0x03,0x27,
                         0xa1,0xc8,0xe7,0xf7,0x8c,0x59,0x6a,
                         0x49,0x34,0x4f,0x01,0x2e,0xda,0x2d,
@@ -172,40 +121,15 @@
                         0x3e,0x87,0xc1,0x4c,0x01,0xd5,0xc1,
                         0xf3,0x43,0x4f,0x1d,0x87};
 
+  uint8_t result[82];
   auto resultLen = hkdf(secret, sizeof(secret),
                         salt,sizeof(salt),
                         result, sizeof(result),
                         info, sizeof(info));
 
-  BOOST_CHECK(resultLen != 0);
-  BOOST_CHECK(memcmp(expected, result, 42) == 0);
-}
-
-BOOST_AUTO_TEST_CASE(HkdfIetf3)
-{
-  //uint8_t secret[] = {}; secret is empty in this test
-
-  uint8_t salt[] = {0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,0x0b,
-                    0x0b,0x0b,0x0b,0x0b,0x0b,0x0b};
-
-  //uint8_t info[] = {}; info is empty in this test
-
-  uint8_t result[42];
-  uint8_t expected[] = {0x8d,0xa4,0xe7,0x75,0xa5,0x63,0xc1,0x8f,
-                        0x71,0x5f,0x80,0x2a,0x06,0x3c,0x5a,0x31,
-                        0xb8,0xa1,0x1f,0x5c,0x5e,0xe1,0x87,0x9e,
-                        0xc3,0x45,0x4e,0x5f,0x3c,0x73,0x8d,0x2d,
-                        0x9d,0x20,0x13,0x95,0xfa,0xa4,0xb6,0x1a,
-                        0x96,0xc8};
-
-  auto resultLen = hkdf(nullptr, 0,
-                        salt,sizeof(salt),
-                        result, sizeof(result),
-                        nullptr, 0);
-
-  BOOST_CHECK(resultLen != 0);
-  BOOST_CHECK(memcmp(expected, result, sizeof(result)) == 0);
+  BOOST_CHECK_EQUAL(resultLen, 82);
+  BOOST_CHECK_EQUAL_COLLECTIONS(result, result + sizeof(result),
+                                expected, expected + sizeof(expected));
 }
 
 BOOST_AUTO_TEST_SUITE_END()