diff --git a/src/challenge/challenge-email.cpp b/src/challenge/challenge-email.cpp
index ea0345c..01bb7ba 100644
--- a/src/challenge/challenge-email.cpp
+++ b/src/challenge/challenge-email.cpp
@@ -51,16 +51,15 @@
     std::string emailAddress = readString(params.get(tlv::ParameterValue));
     auto lastComponentRequested = readString(request.cert.getIdentity().get(-1));
     if (lastComponentRequested != emailAddress) {
-      NDN_LOG_TRACE("Email and requested name do not match. Email " << emailAddress << " requested last component "
-                    << lastComponentRequested);
+      NDN_LOG_TRACE("Email and requested name do not match. Email " << emailAddress
+                    << " - requested last component " << lastComponentRequested);
     }
     std::string emailCode = generateSecretCode();
     JsonSection secretJson;
     secretJson.add(PARAMETER_KEY_CODE, emailCode);
     // send out the email
     sendEmail(emailAddress, emailCode, request);
-    NDN_LOG_TRACE("Secret for request " << ndn::toHex(request.requestId.data(), request.requestId.size())
-                  << " : " << emailCode);
+    NDN_LOG_TRACE("Secret for request " << ndn::toHex(request.requestId) << " : " << emailCode);
     return returnWithNewChallengeStatus(request, NEED_CODE, std::move(secretJson),
                                         m_maxAttemptTimes, m_secretLifetime);
   }
@@ -104,7 +103,7 @@
 ChallengeEmail::getRequestedParameterList(Status status, const std::string& challengeStatus)
 {
   std::multimap<std::string, std::string> result;
-  if (status == Status::BEFORE_CHALLENGE && challengeStatus == "") {
+  if (status == Status::BEFORE_CHALLENGE && challengeStatus.empty()) {
     result.emplace(PARAMETER_KEY_EMAIL, "Please input your email address");
   }
   else if (status == Status::CHALLENGE && challengeStatus == NEED_CODE) {
diff --git a/src/challenge/challenge-pin.cpp b/src/challenge/challenge-pin.cpp
index 6e42969..46f65fd 100644
--- a/src/challenge/challenge-pin.cpp
+++ b/src/challenge/challenge-pin.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /*
- * Copyright (c) 2017-2021, Regents of the University of California.
+ * Copyright (c) 2017-2022, Regents of the University of California.
  *
  * This file is part of ndncert, a certificate management system based on NDN.
  *
@@ -48,7 +48,7 @@
     std::string secretCode = generateSecretCode();
     JsonSection secretJson;
     secretJson.add(PARAMETER_KEY_CODE, secretCode);
-    NDN_LOG_TRACE("Secret for request " << ndn::toHex(request.requestId.data(), request.requestId.size())
+    NDN_LOG_TRACE("Secret for request " << ndn::toHex(request.requestId)
                   << " : " << secretCode);
     return returnWithNewChallengeStatus(request, NEED_CODE, std::move(secretJson), m_maxAttemptTimes,
                                         m_secretLifetime);
diff --git a/src/challenge/challenge-possession.cpp b/src/challenge/challenge-possession.cpp
index a7f0f77..d4c8185 100644
--- a/src/challenge/challenge-possession.cpp
+++ b/src/challenge/challenge-possession.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2021, Regents of the University of California.
+ * Copyright (c) 2017-2022, Regents of the University of California.
  *
  * This file is part of ndncert, a certificate management system based on NDN.
  *
@@ -119,9 +119,8 @@
     if (credential.hasContent() && signatureLen == 0) {
       Name signingKeyName = credential.getSignatureInfo().getKeyLocator().getName();
       ndn::security::transform::PublicKey key;
-      const auto& pubKeyBuffer = credential.getPublicKey();
-      key.loadPkcs8(pubKeyBuffer.data(), pubKeyBuffer.size());
-      for (auto anchor : m_trustAnchors) {
+      key.loadPkcs8(credential.getPublicKey());
+      for (const auto& anchor : m_trustAnchors) {
         if (anchor.getKeyName() == signingKeyName) {
           if (ndn::security::verifySignature(credential, anchor)) {
             checkOK = true;
@@ -138,13 +137,12 @@
 
     // for the first time, init the challenge
     std::array<uint8_t, 16> secretCode{};
-    ndn::random::generateSecureBytes(secretCode.data(), 16);
+    ndn::random::generateSecureBytes(secretCode);
     JsonSection secretJson;
-    secretJson.add(PARAMETER_KEY_NONCE, toHex(secretCode.data(), 16));
-    auto credential_block = credential.wireEncode();
-    secretJson.add(PARAMETER_KEY_CREDENTIAL_CERT, toHex(credential_block.wire(), credential_block.size()));
-    NDN_LOG_TRACE("Secret for request " << toHex(request.requestId.data(), request.requestId.size())
-                  << " : " << toHex(secretCode.data(), 16));
+    secretJson.add(PARAMETER_KEY_NONCE, toHex(secretCode));
+    const auto& credBlock = credential.wireEncode();
+    secretJson.add(PARAMETER_KEY_CREDENTIAL_CERT, toHex({credBlock.wire(), credBlock.size()}));
+    NDN_LOG_TRACE("Secret for request " << toHex(request.requestId) << " : " << toHex(secretCode));
     return returnWithNewChallengeStatus(request, NEED_PROOF, std::move(secretJson), m_maxAttemptTimes, m_secretLifetime);
   }
   else if (request.challengeState && request.challengeState->challengeStatus == NEED_PROOF) {
@@ -158,9 +156,8 @@
 
     //check the proof
     ndn::security::transform::PublicKey key;
-    const auto& pubKeyBuffer = credential.getPublicKey();
-    key.loadPkcs8(pubKeyBuffer.data(), pubKeyBuffer.size());
-    if (ndn::security::verifySignature({{secretCode.data(), secretCode.size()}}, signature, signatureLen, key)) {
+    key.loadPkcs8(credential.getPublicKey());
+    if (ndn::security::verifySignature({secretCode}, {signature, signatureLen}, key)) {
       return returnWithSuccess(request);
     }
     return returnWithError(request, ErrorCode::INVALID_PARAMETER,
@@ -203,7 +200,8 @@
         request.push_back(ndn::makeStringBlock(tlv::ParameterKey, PARAMETER_KEY_CREDENTIAL_CERT));
         Block valueBlock(tlv::ParameterValue);
         auto& certTlvStr = std::get<1>(item);
-        valueBlock.push_back(Block(reinterpret_cast<const uint8_t*>(certTlvStr.data()), certTlvStr.size()));
+        valueBlock.push_back(Block(ndn::make_span(reinterpret_cast<const uint8_t*>(certTlvStr.data()),
+                                                  certTlvStr.size())));
         request.push_back(valueBlock);
       }
       else {
@@ -219,9 +217,7 @@
       if (std::get<0>(item) == PARAMETER_KEY_PROOF) {
         request.push_back(ndn::makeStringBlock(tlv::ParameterKey, PARAMETER_KEY_PROOF));
         auto& sigTlvStr = std::get<1>(item);
-        auto valueBlock = ndn::makeBinaryBlock(tlv::ParameterValue,
-                                               reinterpret_cast<const uint8_t*>(sigTlvStr.data()),
-                                               sigTlvStr.size());
+        auto valueBlock = ndn::makeBinaryBlock(tlv::ParameterValue, sigTlvStr.data(), sigTlvStr.size());
         request.push_back(valueBlock);
       }
       else {
@@ -244,8 +240,8 @@
   auto keyName = ndn::security::extractKeyNameFromCertName(issuedCertName);
   auto id = keyChain.getPib().getIdentity(ndn::security::extractIdentityFromCertName(issuedCertName));
   auto issuedCert = id.getKey(keyName).getCertificate(issuedCertName);
-  auto issuedCertTlv = issuedCert.wireEncode();
-  auto signature = keyChain.getTpm().sign({{nonce.data(), nonce.size()}}, keyName, ndn::DigestAlgorithm::SHA256);
+  const auto& issuedCertTlv = issuedCert.wireEncode();
+  auto signature = keyChain.getTpm().sign({nonce}, keyName, ndn::DigestAlgorithm::SHA256);
 
   for (auto& item : params) {
     if (item.first == PARAMETER_KEY_CREDENTIAL_CERT) {