diff --git a/src/detail/ca-request-state.hpp b/src/detail/ca-request-state.hpp
index a90d44f..94305c0 100644
--- a/src/detail/ca-request-state.hpp
+++ b/src/detail/ca-request-state.hpp
@@ -94,10 +94,10 @@
    * @brief Used to instantiate a RequestState after challenge is started.
    */
   RequestState(const Name& caName, const RequestId& requestId, RequestType requestType, Status status,
-          const security::Certificate& cert, const std::string& challengeType,
-          const std::string& challengeStatus, const time::system_clock::TimePoint& challengeTp,
-          size_t remainingTries, time::seconds remainingTime, JsonSection&& challengeSecrets,
-          Block m_encryptionKey, uint32_t aesBlockCounter);
+               const security::Certificate& cert, const std::string& challengeType,
+               const std::string& challengeStatus, const time::system_clock::TimePoint& challengeTp,
+               size_t remainingTries, time::seconds remainingTime, JsonSection&& challengeSecrets,
+               Block m_encryptionKey, uint32_t aesBlockCounter);
 
 public:
   /**
diff --git a/src/detail/challenge-encoder.cpp b/src/detail/challenge-encoder.cpp
index f2b1933..5c3a4d4 100644
--- a/src/detail/challenge-encoder.cpp
+++ b/src/detail/challenge-encoder.cpp
@@ -24,7 +24,7 @@
 namespace ndncert {
 
 Block
-ChallengeEncoder::encodeDataContent(const ca::RequestState& request, optional<Name> issuedCertName)
+ChallengeEncoder::encodeDataContent(ca::RequestState& request, optional<Name> issuedCertName)
 {
   Block response = makeEmptyBlock(tlv::EncryptedPayload);
   response.push_back(makeNonNegativeIntegerBlock(tlv::Status, static_cast<size_t>(request.m_status)));
@@ -39,12 +39,17 @@
     response.push_back(makeNestedBlock(tlv::IssuedCertName, *issuedCertName));
   }
   response.encode();
-  return response;
+  return encodeBlockWithAesGcm128(ndn::tlv::Content, request.m_encryptionKey.value(),
+                                  response.value(), response.value_size(),
+                                  request.m_requestId.data(), request.m_requestId.size(), request.m_aesBlockCounter);
 }
 
 void
-ChallengeEncoder::decodeDataContent(const Block& data, requester::RequestContext& state)
+ChallengeEncoder::decodeDataContent(const Block& contentBlock, requester::RequestContext& state)
 {
+  auto result = decodeBlockWithAesGcm128(contentBlock, state.m_aesKey,
+                                         state.m_requestId.data(), state.m_requestId.size());
+  auto data = makeBinaryBlock(tlv::EncryptedPayload, result.data(), result.size());
   data.parse();
   state.m_status = static_cast<Status>(readNonNegativeInteger(data.get(tlv::Status)));
   if (data.find(tlv::ChallengeStatus) != data.elements_end()) {
diff --git a/src/detail/challenge-encoder.hpp b/src/detail/challenge-encoder.hpp
index ab1fe8f..d0ad429 100644
--- a/src/detail/challenge-encoder.hpp
+++ b/src/detail/challenge-encoder.hpp
@@ -31,7 +31,7 @@
 {
 public:
   static Block
-  encodeDataContent(const ca::RequestState& request, optional<Name> issuedCertName = nullopt);
+  encodeDataContent(ca::RequestState& request, optional<Name> issuedCertName = nullopt);
 
   static void
   decodeDataContent(const Block& data, requester::RequestContext& state);