diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index f04d3df..e378314 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -252,12 +252,6 @@
                                        "Cannot derive a shared secret using the provided ECDH key."));
     return;
   }
-  // generate salt for HKDF
-  std::array<uint8_t, 32> salt;
-  random::generateSecureBytes(salt.data(), salt.size());
-  // hkdf
-  std::array<uint8_t, 16> aesKey;
-  hkdf(sharedSecret.data(), sharedSecret.size(), salt.data(), salt.size(), aesKey.data(), aesKey.size());
 
   // verify identity name
   if (!m_config.caProfile.caPrefix.isPrefixOf(clientCert->getIdentity())
@@ -334,6 +328,13 @@
   requestState.requestId = id;
   requestState.requestType = requestType;
   requestState.cert = *clientCert;
+  // generate salt for HKDF
+  std::array<uint8_t, 32> salt;
+  random::generateSecureBytes(salt.data(), salt.size());
+  // hkdf
+  std::array<uint8_t, 16> aesKey;
+  hkdf(sharedSecret.data(), sharedSecret.size(), salt.data(), salt.size(),
+       aesKey.data(), aesKey.size(), id.data(), id.size());
   requestState.encryptionKey = aesKey;
   try {
     m_storage->addRequest(requestState);
diff --git a/src/detail/challenge-encoder.cpp b/src/detail/challenge-encoder.cpp
index 083fa61..3870c95 100644
--- a/src/detail/challenge-encoder.cpp
+++ b/src/detail/challenge-encoder.cpp
@@ -53,25 +53,25 @@
 void
 challengetlv::decodeDataContent(const Block& contentBlock, requester::Request& state)
 {
-  auto result = decodeBlockWithAesGcm128(contentBlock, state.aesKey.data(),
-                                         state.requestId.data(), state.requestId.size(),
-                                         state.decryptionIv);
+  auto result = decodeBlockWithAesGcm128(contentBlock, state.m_aesKey.data(),
+                                         state.m_requestId.data(), state.m_requestId.size(),
+                                         state.m_decryptionIv);
   auto data = makeBinaryBlock(tlv::EncryptedPayload, result.data(), result.size());
   data.parse();
-  state.status = statusFromBlock(data.get(tlv::Status));
+  state.m_status = statusFromBlock(data.get(tlv::Status));
   if (data.find(tlv::ChallengeStatus) != data.elements_end()) {
-    state.challengeStatus = readString(data.get(tlv::ChallengeStatus));
+    state.m_challengeStatus = readString(data.get(tlv::ChallengeStatus));
   }
   if (data.find(tlv::RemainingTries) != data.elements_end()) {
-    state.remainingTries = readNonNegativeInteger(data.get(tlv::RemainingTries));
+    state.m_remainingTries = readNonNegativeInteger(data.get(tlv::RemainingTries));
   }
   if (data.find(tlv::RemainingTime) != data.elements_end()) {
-    state.freshBefore = time::system_clock::now() +
-                        time::seconds(readNonNegativeInteger(data.get(tlv::RemainingTime)));
+    state.m_freshBefore = time::system_clock::now() +
+                          time::seconds(readNonNegativeInteger(data.get(tlv::RemainingTime)));
   }
   if (data.find(tlv::IssuedCertName) != data.elements_end()) {
     Block issuedCertNameBlock = data.get(tlv::IssuedCertName);
-    state.issuedCertName = Name(issuedCertNameBlock.blockFromValue());
+    state.m_issuedCertName = Name(issuedCertNameBlock.blockFromValue());
   }
   if (data.find(tlv::ParameterKey) != data.elements_end() &&
       readString(data.get(tlv::ParameterKey)) == "nonce") {
@@ -82,7 +82,7 @@
     if (nonceBlock.value_size() != 16) {
         NDN_THROW(std::runtime_error("Wrong nonce length"));
     }
-    memcpy(state.nonce.data(), nonceBlock.value(), 16);
+    memcpy(state.m_nonce.data(), nonceBlock.value(), 16);
   }
 }
 
diff --git a/src/requester-request.cpp b/src/requester-request.cpp
index 72f7162..5929794 100644
--- a/src/requester-request.cpp
+++ b/src/requester-request.cpp
@@ -121,8 +121,8 @@
 }
 
 Request::Request(security::KeyChain& keyChain, const CaProfile& profile, RequestType requestType)
-    : caProfile(profile)
-    , type(requestType)
+    : m_caProfile(profile)
+    , m_type(requestType)
     , m_keyChain(keyChain)
 {}
 
@@ -131,26 +131,26 @@
                         const time::system_clock::TimePoint& notBefore,
                         const time::system_clock::TimePoint& notAfter)
 {
-  if (!caProfile.caPrefix.isPrefixOf(newIdentityName)) {
+  if (!m_caProfile.caPrefix.isPrefixOf(newIdentityName)) {
     return nullptr;
   }
   if (newIdentityName.empty()) {
     NDN_LOG_TRACE("Randomly create a new name because newIdentityName is empty and the param is empty.");
-    identityName = caProfile.caPrefix;
-    identityName.append(std::to_string(random::generateSecureWord64()));
+    m_identityName = m_caProfile.caPrefix;
+    m_identityName.append(std::to_string(random::generateSecureWord64()));
   }
   else {
-    identityName = newIdentityName;
+    m_identityName = newIdentityName;
   }
 
   // generate a newly key pair or use an existing key
   const auto& pib = m_keyChain.getPib();
   security::pib::Identity identity;
   try {
-    identity = pib.getIdentity(identityName);
+    identity = pib.getIdentity(m_identityName);
   }
   catch (const security::Pib::Error& e) {
-    identity = m_keyChain.createIdentity(identityName);
+    identity = m_keyChain.createIdentity(m_identityName);
     m_isNewlyCreatedIdentity = true;
     m_isNewlyCreatedKey = true;
   }
@@ -173,13 +173,13 @@
   m_keyChain.sign(certRequest, signingByKey(keyName).setSignatureInfo(signatureInfo));
 
   // generate Interest packet
-  Name interestName = caProfile.caPrefix;
+  Name interestName = m_caProfile.caPrefix;
   interestName.append("CA").append("NEW");
   auto interest =std::make_shared<Interest>(interestName);
   interest->setMustBeFresh(true);
   interest->setCanBePrefix(false);
   interest->setApplicationParameters(
-          requesttlv::encodeApplicationParameters(RequestType::NEW, ecdh.getSelfPubKey(), certRequest));
+          requesttlv::encodeApplicationParameters(RequestType::NEW, m_ecdh.getSelfPubKey(), certRequest));
 
   // sign the Interest packet
   m_keyChain.sign(*interest, signingByKey(keyName));
@@ -189,24 +189,24 @@
 shared_ptr<Interest>
 Request::genRevokeInterest(const security::Certificate& certificate)
 {
-  if (!caProfile.caPrefix.isPrefixOf(certificate.getName())) {
+  if (!m_caProfile.caPrefix.isPrefixOf(certificate.getName())) {
     return nullptr;
   }
   // generate Interest packet
-  Name interestName = caProfile.caPrefix;
+  Name interestName = m_caProfile.caPrefix;
   interestName.append("CA").append("REVOKE");
   auto interest =std::make_shared<Interest>(interestName);
   interest->setMustBeFresh(true);
   interest->setCanBePrefix(false);
   interest->setApplicationParameters(
-          requesttlv::encodeApplicationParameters(RequestType::REVOKE, ecdh.getSelfPubKey(), certificate));
+          requesttlv::encodeApplicationParameters(RequestType::REVOKE, m_ecdh.getSelfPubKey(), certificate));
   return interest;
 }
 
 std::list<std::string>
 Request::onNewRenewRevokeResponse(const Data& reply)
 {
-  if (!security::verifySignature(reply, *caProfile.cert)) {
+  if (!security::verifySignature(reply, *m_caProfile.cert)) {
     NDN_LOG_ERROR("Cannot verify replied Data packet signature.");
     NDN_THROW(std::runtime_error("Cannot verify replied Data packet signature."));
   }
@@ -215,12 +215,13 @@
   const auto& contentTLV = reply.getContent();
   std::vector<uint8_t> ecdhKey;
   std::array<uint8_t, 32> salt;
-  auto challenges = requesttlv::decodeDataContent(contentTLV, ecdhKey, salt, requestId);
+  auto challenges = requesttlv::decodeDataContent(contentTLV, ecdhKey, salt, m_requestId);
 
   // ECDH and HKDF
-  auto sharedSecret = ecdh.deriveSecret(ecdhKey);
+  auto sharedSecret = m_ecdh.deriveSecret(ecdhKey);
   hkdf(sharedSecret.data(), sharedSecret.size(),
-       salt.data(), salt.size(), aesKey.data(), aesKey.size());
+       salt.data(), salt.size(), m_aesKey.data(), m_aesKey.size(),
+       m_requestId.data(), m_requestId.size());
 
   // update state
   return challenges;
@@ -233,33 +234,33 @@
   if (challenge == nullptr) {
     NDN_THROW(std::runtime_error("The challenge selected is not supported by your current version of NDNCERT."));
   }
-  challengeType = challengeSelected;
-  return challenge->getRequestedParameterList(status, challengeStatus);
+  m_challengeType = challengeSelected;
+  return challenge->getRequestedParameterList(m_status, m_challengeStatus);
 }
 
 shared_ptr<Interest>
 Request::genChallengeInterest(std::multimap<std::string, std::string>&& parameters)
 {
-  if (challengeType == "") {
+  if (m_challengeType == "") {
     NDN_THROW(std::runtime_error("The challenge has not been selected."));
   }
-  auto challenge = ChallengeModule::createChallengeModule(challengeType);
+  auto challenge = ChallengeModule::createChallengeModule(m_challengeType);
   if (challenge == nullptr) {
     NDN_THROW(std::runtime_error("The challenge selected is not supported by your current version of NDNCERT."));
   }
-  auto challengeParams = challenge->genChallengeRequestTLV(status, challengeStatus, std::move(parameters));
+  auto challengeParams = challenge->genChallengeRequestTLV(m_status, m_challengeStatus, std::move(parameters));
 
-  Name interestName = caProfile.caPrefix;
-  interestName.append("CA").append("CHALLENGE").append(requestId.data(), requestId.size());
+  Name interestName = m_caProfile.caPrefix;
+  interestName.append("CA").append("CHALLENGE").append(m_requestId.data(), m_requestId.size());
   auto interest =std::make_shared<Interest>(interestName);
   interest->setMustBeFresh(true);
   interest->setCanBePrefix(false);
 
   // encrypt the Interest parameters
-  auto paramBlock = encodeBlockWithAesGcm128(ndn::tlv::ApplicationParameters, aesKey.data(),
+  auto paramBlock = encodeBlockWithAesGcm128(ndn::tlv::ApplicationParameters, m_aesKey.data(),
                                              challengeParams.value(), challengeParams.value_size(),
-                                             requestId.data(), requestId.size(),
-                                             encryptionIv);
+                                             m_requestId.data(), m_requestId.size(),
+                                             m_encryptionIv);
   interest->setApplicationParameters(paramBlock);
   m_keyChain.sign(*interest, signingByKey(m_keyPair.getName()));
   return interest;
@@ -268,7 +269,7 @@
 void
 Request::onChallengeResponse(const Data& reply)
 {
-  if (!security::verifySignature(reply, *caProfile.cert)) {
+  if (!security::verifySignature(reply, *m_caProfile.cert)) {
     NDN_LOG_ERROR("Cannot verify replied Data packet signature.");
     NDN_THROW(std::runtime_error("Cannot verify replied Data packet signature."));
   }
@@ -279,7 +280,7 @@
 shared_ptr<Interest>
 Request::genCertFetchInterest() const
 {
-  Name interestName = issuedCertName;
+  Name interestName = m_issuedCertName;
   auto interest =std::make_shared<Interest>(interestName);
   interest->setMustBeFresh(false);
   interest->setCanBePrefix(false);
@@ -302,17 +303,17 @@
 void
 Request::endSession()
 {
-  if (status == Status::SUCCESS) {
+  if (m_status == Status::SUCCESS) {
     return;
   }
   if (m_isNewlyCreatedIdentity) {
     // put the identity into the if scope is because it may cause an error
     // outside since when endSession is called, identity may not have been created yet.
-    auto identity = m_keyChain.getPib().getIdentity(identityName);
+    auto identity = m_keyChain.getPib().getIdentity(m_identityName);
     m_keyChain.deleteIdentity(identity);
   }
   else if (m_isNewlyCreatedKey) {
-    auto identity = m_keyChain.getPib().getIdentity(identityName);
+    auto identity = m_keyChain.getPib().getIdentity(m_identityName);
     m_keyChain.deleteKey(identity, m_keyPair);
   }
 }
diff --git a/src/requester-request.hpp b/src/requester-request.hpp
index f27c873..a1817ea 100644
--- a/src/requester-request.hpp
+++ b/src/requester-request.hpp
@@ -211,63 +211,63 @@
   /**
    * @brief The CA profile for this request.
    */
-  CaProfile caProfile;
+  CaProfile m_caProfile;
   /**
    * @brief The type of request. Either NEW, RENEW, or REVOKE.
    */
-  RequestType type;
+  RequestType m_type;
   /**
    * @brief The identity name for the requesting certificate.
    */
-  Name identityName;
+  Name m_identityName;
   /**
    * @brief The CA-generated request ID for the request.
    */
-  RequestId requestId;
+  RequestId m_requestId;
   /**
    * @brief The current status of the request.
    */
-  Status status = Status::BEFORE_CHALLENGE;
+  Status m_status = Status::BEFORE_CHALLENGE;
   /**
    * @brief The type of challenge chosen.
    */
-  std::string challengeType;
+  std::string m_challengeType;
   /**
    * @brief The status of the current challenge.
    */
-  std::string challengeStatus;
+  std::string m_challengeStatus;
   /**
    * @brief The remaining number of tries left for the challenge
    */
-  int remainingTries = 0;
+  int m_remainingTries = 0;
   /**
    * @brief The time this challenge will remain fresh
    */
-  time::system_clock::TimePoint freshBefore;
+  time::system_clock::TimePoint m_freshBefore;
   /**
    * @brief the name of the certificate being issued.
    */
-  Name issuedCertName;
+  Name m_issuedCertName;
   /**
    * @brief ecdh state.
    */
-  ECDHState ecdh;
+  ECDHState m_ecdh;
   /**
    * @brief AES key derived from the ecdh shared secret.
    */
-  std::array<uint8_t, 16> aesKey = {};
+  std::array<uint8_t, 16> m_aesKey = {};
   /**
    * @brief The last Initialization Vector used by the AES encryption.
    */
-  std::vector<uint8_t> encryptionIv;
+  std::vector<uint8_t> m_encryptionIv;
   /**
    * @brief The last Initialization Vector used by the other side's AES encryption.
    */
-  std::vector<uint8_t> decryptionIv;
+  std::vector<uint8_t> m_decryptionIv;
   /**
    * @brief Store Nonce for signature
    */
-  std::array<uint8_t, 16> nonce = {};
+  std::array<uint8_t, 16> m_nonce = {};
 
 private:
   /**
diff --git a/tests/unit-tests/bench.t.cpp b/tests/unit-tests/bench.t.cpp
index 6f7b61c..7e321e3 100644
--- a/tests/unit-tests/bench.t.cpp
+++ b/tests/unit-tests/bench.t.cpp
@@ -130,8 +130,8 @@
       BOOST_CHECK(security::verifySignature(response, cert));
 
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::CHALLENGE);
-      BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::NEED_CODE);
+      BOOST_CHECK(state.m_status == Status::CHALLENGE);
+      BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::NEED_CODE);
       auto paramList = state.selectOrContinueChallenge("pin");
       challengeInterest2 = state.genChallengeInterest(std::move(paramList));
     }
@@ -140,8 +140,8 @@
       BOOST_CHECK(security::verifySignature(response, cert));
 
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::CHALLENGE);
-      BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::WRONG_CODE);
+      BOOST_CHECK(state.m_status == Status::CHALLENGE);
+      BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::WRONG_CODE);
 
       auto paramList = state.selectOrContinueChallenge("pin");
       auto request = ca.getCertificateRequest(*challengeInterest2);
@@ -155,7 +155,7 @@
       count++;
       BOOST_CHECK(security::verifySignature(response, cert));
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::SUCCESS);
+      BOOST_CHECK(state.m_status == Status::SUCCESS);
     }
   });
 
diff --git a/tests/unit-tests/ca-module.t.cpp b/tests/unit-tests/ca-module.t.cpp
index 3c4dbb4..385f7ef 100644
--- a/tests/unit-tests/ca-module.t.cpp
+++ b/tests/unit-tests/ca-module.t.cpp
@@ -262,7 +262,7 @@
     RequestId requestId;
     std::memcpy(requestId.data(), contentBlock.get(tlv::RequestId).value(), contentBlock.get(tlv::RequestId).value_size());
     auto ca_encryption_key = ca.getCaStorage()->getRequest(requestId).encryptionKey;
-    BOOST_CHECK_EQUAL_COLLECTIONS(state.aesKey.begin(), state.aesKey.end(),
+    BOOST_CHECK_EQUAL_COLLECTIONS(state.m_aesKey.begin(), state.m_aesKey.end(),
                                   ca_encryption_key.begin(), ca_encryption_key.end());
   });
   face.receive(*interest);
@@ -450,8 +450,8 @@
       BOOST_CHECK(security::verifySignature(response, cert));
 
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::CHALLENGE);
-      BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::NEED_CODE);
+      BOOST_CHECK(state.m_status == Status::CHALLENGE);
+      BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::NEED_CODE);
       auto paramList = state.selectOrContinueChallenge("pin");
       challengeInterest2 = state.genChallengeInterest(std::move(paramList));
     }
@@ -460,8 +460,8 @@
       BOOST_CHECK(security::verifySignature(response, cert));
 
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::CHALLENGE);
-      BOOST_CHECK_EQUAL(state.challengeStatus, ChallengePin::WRONG_CODE);
+      BOOST_CHECK(state.m_status == Status::CHALLENGE);
+      BOOST_CHECK_EQUAL(state.m_challengeStatus, ChallengePin::WRONG_CODE);
 
       auto paramList = state.selectOrContinueChallenge("pin");
       auto request = ca.getCertificateRequest(*challengeInterest2);
@@ -473,7 +473,7 @@
       count++;
       BOOST_CHECK(security::verifySignature(response, cert));
       state.onChallengeResponse(response);
-      BOOST_CHECK(state.status == Status::SUCCESS);
+      BOOST_CHECK(state.m_status == Status::SUCCESS);
     }
   });
 
@@ -550,7 +550,7 @@
     RequestId requestId;
     std::memcpy(requestId.data(), contentBlock.get(tlv::RequestId).value(), contentBlock.get(tlv::RequestId).value_size());
     auto ca_encryption_key = ca.getCaStorage()->getRequest(requestId).encryptionKey;
-    BOOST_CHECK_EQUAL_COLLECTIONS(state.aesKey.begin(), state.aesKey.end(),
+    BOOST_CHECK_EQUAL_COLLECTIONS(state.m_aesKey.begin(), state.m_aesKey.end(),
                                   ca_encryption_key.begin(), ca_encryption_key.end());
   });
   face.receive(*interest);
diff --git a/tests/unit-tests/protocol-encoders.t.cpp b/tests/unit-tests/protocol-encoders.t.cpp
index 23ee95a..61128e3 100644
--- a/tests/unit-tests/protocol-encoders.t.cpp
+++ b/tests/unit-tests/protocol-encoders.t.cpp
@@ -158,16 +158,16 @@
   auto contentBlock = challengetlv::encodeDataContent(state, Name("/ndn/ucla/a/b/c"));
 
   requester::Request context(m_keyChain, caCache.getKnownProfiles().front(), RequestType::NEW);
-  context.requestId = id;
-  std::memcpy(context.aesKey.data(), key, sizeof(key));
+  context.m_requestId = id;
+  std::memcpy(context.m_aesKey.data(), key, sizeof(key));
   advanceClocks(time::seconds(10));
   challengetlv::decodeDataContent(contentBlock, context);
 
-  BOOST_CHECK_EQUAL(static_cast<size_t>(context.status), static_cast<size_t>(Status::PENDING));
-  BOOST_CHECK_EQUAL(context.challengeStatus, "test");
-  BOOST_CHECK_EQUAL(context.remainingTries, 3);
-  BOOST_CHECK_EQUAL(context.freshBefore, tp + time::seconds(3600) + time::seconds(10));
-  BOOST_CHECK_EQUAL(context.issuedCertName, "/ndn/ucla/a/b/c");
+  BOOST_CHECK_EQUAL(static_cast<size_t>(context.m_status), static_cast<size_t>(Status::PENDING));
+  BOOST_CHECK_EQUAL(context.m_challengeStatus, "test");
+  BOOST_CHECK_EQUAL(context.m_remainingTries, 3);
+  BOOST_CHECK_EQUAL(context.m_freshBefore, tp + time::seconds(3600) + time::seconds(10));
+  BOOST_CHECK_EQUAL(context.m_issuedCertName, "/ndn/ucla/a/b/c");
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/tools/ndncert-client.cpp b/tools/ndncert-client.cpp
index 816ec34..08c88f4 100644
--- a/tools/ndncert-client.cpp
+++ b/tools/ndncert-client.cpp
@@ -133,13 +133,13 @@
     std::cerr << "Error when decoding challenge step: " << e.what() << std::endl;
     exit(1);
   }
-  if (requesterState->status == Status::SUCCESS) {
+  if (requesterState->m_status == Status::SUCCESS) {
     std::cerr << "Certificate has already been issued, downloading certificate..." << std::endl;
     face.expressInterest(*requesterState->genCertFetchInterest(), bind(&certFetchCb, _2),
                          bind(&onNackCb), bind(&timeoutCb));
     return;
   }
-  runChallenge(requesterState->challengeType);
+  runChallenge(requesterState->m_challengeType);
 }
 
 static void