diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index f591187..6df30eb 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -423,12 +423,7 @@
   Data result;
   result.setName(request.getName());
   result.setFreshnessPeriod(DEFAULT_DATA_FRESHNESS_PERIOD);
-  auto contentBlock = encodeBlockWithAesGcm128(ndn::tlv::Content, requestState->m_encryptionKey.value(),
-                                               payload.value(), payload.value_size(),
-                                               requestState->m_requestId.data(),
-                                               requestState->m_requestId.size(),
-                                               requestState->m_aesBlockCounter);
-  result.setContent(contentBlock);
+  result.setContent(payload);
   m_keyChain.sign(result, signingByIdentity(m_config.m_caItem.m_caPrefix));
   m_face.put(result);
   if (m_config.m_statusUpdateCallback) {
diff --git a/src/detail/ca-request-state.hpp b/src/detail/ca-request-state.hpp
index a90d44f..94305c0 100644
--- a/src/detail/ca-request-state.hpp
+++ b/src/detail/ca-request-state.hpp
@@ -94,10 +94,10 @@
    * @brief Used to instantiate a RequestState after challenge is started.
    */
   RequestState(const Name& caName, const RequestId& requestId, RequestType requestType, Status status,
-          const security::Certificate& cert, const std::string& challengeType,
-          const std::string& challengeStatus, const time::system_clock::TimePoint& challengeTp,
-          size_t remainingTries, time::seconds remainingTime, JsonSection&& challengeSecrets,
-          Block m_encryptionKey, uint32_t aesBlockCounter);
+               const security::Certificate& cert, const std::string& challengeType,
+               const std::string& challengeStatus, const time::system_clock::TimePoint& challengeTp,
+               size_t remainingTries, time::seconds remainingTime, JsonSection&& challengeSecrets,
+               Block m_encryptionKey, uint32_t aesBlockCounter);
 
 public:
   /**
diff --git a/src/detail/challenge-encoder.cpp b/src/detail/challenge-encoder.cpp
index f2b1933..5c3a4d4 100644
--- a/src/detail/challenge-encoder.cpp
+++ b/src/detail/challenge-encoder.cpp
@@ -24,7 +24,7 @@
 namespace ndncert {
 
 Block
-ChallengeEncoder::encodeDataContent(const ca::RequestState& request, optional<Name> issuedCertName)
+ChallengeEncoder::encodeDataContent(ca::RequestState& request, optional<Name> issuedCertName)
 {
   Block response = makeEmptyBlock(tlv::EncryptedPayload);
   response.push_back(makeNonNegativeIntegerBlock(tlv::Status, static_cast<size_t>(request.m_status)));
@@ -39,12 +39,17 @@
     response.push_back(makeNestedBlock(tlv::IssuedCertName, *issuedCertName));
   }
   response.encode();
-  return response;
+  return encodeBlockWithAesGcm128(ndn::tlv::Content, request.m_encryptionKey.value(),
+                                  response.value(), response.value_size(),
+                                  request.m_requestId.data(), request.m_requestId.size(), request.m_aesBlockCounter);
 }
 
 void
-ChallengeEncoder::decodeDataContent(const Block& data, requester::RequestContext& state)
+ChallengeEncoder::decodeDataContent(const Block& contentBlock, requester::RequestContext& state)
 {
+  auto result = decodeBlockWithAesGcm128(contentBlock, state.m_aesKey,
+                                         state.m_requestId.data(), state.m_requestId.size());
+  auto data = makeBinaryBlock(tlv::EncryptedPayload, result.data(), result.size());
   data.parse();
   state.m_status = static_cast<Status>(readNonNegativeInteger(data.get(tlv::Status)));
   if (data.find(tlv::ChallengeStatus) != data.elements_end()) {
diff --git a/src/detail/challenge-encoder.hpp b/src/detail/challenge-encoder.hpp
index ab1fe8f..d0ad429 100644
--- a/src/detail/challenge-encoder.hpp
+++ b/src/detail/challenge-encoder.hpp
@@ -31,7 +31,7 @@
 {
 public:
   static Block
-  encodeDataContent(const ca::RequestState& request, optional<Name> issuedCertName = nullopt);
+  encodeDataContent(ca::RequestState& request, optional<Name> issuedCertName = nullopt);
 
   static void
   decodeDataContent(const Block& data, requester::RequestContext& state);
diff --git a/src/requester.cpp b/src/requester.cpp
index 7b1df5f..52c0014 100644
--- a/src/requester.cpp
+++ b/src/requester.cpp
@@ -261,11 +261,7 @@
     NDN_THROW(std::runtime_error("Cannot verify replied Data packet signature."));
   }
   processIfError(reply);
-  auto result = decodeBlockWithAesGcm128(reply.getContent(), state.m_aesKey,
-                                         state.m_requestId.data(),
-                                         state.m_requestId.size());
-  Block contentTLV = makeBinaryBlock(tlv::EncryptedPayload, result.data(), result.size());
-  ChallengeEncoder::decodeDataContent(contentTLV, state);
+  ChallengeEncoder::decodeDataContent(reply.getContent(), state);
 }
 
 shared_ptr<Interest>