diff --git a/android_keymaster/android_keymaster.cpp b/android_keymaster/android_keymaster.cpp
index cceba59..9743f66 100644
--- a/android_keymaster/android_keymaster.cpp
+++ b/android_keymaster/android_keymaster.cpp
@@ -77,7 +77,7 @@
 template <typename T>
 bool check_supported(const KeymasterContext& context, keymaster_algorithm_t algorithm,
                      SupportedResponse<T>* response) {
-    if (context.GetKeyFactory(algorithm) == NULL) {
+    if (context.GetKeyFactory(algorithm) == nullptr) {
         response->error = KM_ERROR_UNSUPPORTED_ALGORITHM;
         return false;
     }
@@ -85,7 +85,7 @@
 }
 
 void AndroidKeymaster::GetVersion(const GetVersionRequest&, GetVersionResponse* rsp) {
-    if (rsp == NULL)
+    if (rsp == nullptr)
         return;
 
     rsp->major_ver = MAJOR_VER;
@@ -96,7 +96,7 @@
 
 void AndroidKeymaster::SupportedAlgorithms(const SupportedAlgorithmsRequest& /* request */,
                                            SupportedAlgorithmsResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     response->error = KM_ERROR_OK;
@@ -116,7 +116,7 @@
                   keymaster_purpose_t purpose,
                   const T* (OperationFactory::*get_supported_method)(size_t* count) const,
                   SupportedResponse<T>* response) {
-    if (response == NULL || !check_supported(context, algorithm, response))
+    if (response == nullptr || !check_supported(context, algorithm, response))
         return;
 
     const OperationFactory* factory = context.GetOperationFactory(algorithm, purpose);
@@ -150,7 +150,7 @@
 
 void AndroidKeymaster::SupportedImportFormats(const SupportedImportFormatsRequest& request,
                                               SupportedImportFormatsResponse* response) {
-    if (response == NULL || !check_supported(*context_, request.algorithm, response))
+    if (response == nullptr || !check_supported(*context_, request.algorithm, response))
         return;
 
     size_t count;
@@ -161,7 +161,7 @@
 
 void AndroidKeymaster::SupportedExportFormats(const SupportedExportFormatsRequest& request,
                                               SupportedExportFormatsResponse* response) {
-    if (response == NULL || !check_supported(*context_, request.algorithm, response))
+    if (response == nullptr || !check_supported(*context_, request.algorithm, response))
         return;
 
     size_t count;
@@ -215,11 +215,11 @@
 
 void AndroidKeymaster::GenerateKey(const GenerateKeyRequest& request,
                                    GenerateKeyResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     keymaster_algorithm_t algorithm;
-    KeyFactory* factory = 0;
+    KeyFactory* factory = nullptr;
     UniquePtr<Key> key;
     if (!request.key_description.GetTagValue(TAG_ALGORITHM, &algorithm) ||
         !(factory = context_->GetKeyFactory(algorithm)))
@@ -237,7 +237,7 @@
 
 void AndroidKeymaster::GetKeyCharacteristics(const GetKeyCharacteristicsRequest& request,
                                              GetKeyCharacteristicsResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     UniquePtr<Key> key;
@@ -256,7 +256,7 @@
 
 void AndroidKeymaster::BeginOperation(const BeginOperationRequest& request,
                                       BeginOperationResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
     response->op_handle = 0;
 
@@ -277,7 +277,7 @@
 
     OperationPtr operation(
         factory->CreateOperation(move(*key), request.additional_params, &response->error));
-    if (operation.get() == NULL) return;
+    if (operation.get() == nullptr) return;
 
     if (context_->enforcement_policy()) {
         km_id_t key_id;
@@ -301,12 +301,12 @@
 
 void AndroidKeymaster::UpdateOperation(const UpdateOperationRequest& request,
                                        UpdateOperationResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     response->error = KM_ERROR_INVALID_OPERATION_HANDLE;
     Operation* operation = operation_table_->Find(request.op_handle);
-    if (operation == NULL)
+    if (operation == nullptr)
         return;
 
     if (context_->enforcement_policy()) {
@@ -330,12 +330,12 @@
 
 void AndroidKeymaster::FinishOperation(const FinishOperationRequest& request,
                                        FinishOperationResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     response->error = KM_ERROR_INVALID_OPERATION_HANDLE;
     Operation* operation = operation_table_->Find(request.op_handle);
-    if (operation == NULL)
+    if (operation == nullptr)
         return;
 
     if (context_->enforcement_policy()) {
@@ -369,7 +369,7 @@
 }
 
 void AndroidKeymaster::ExportKey(const ExportKeyRequest& request, ExportKeyResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     UniquePtr<Key> key;
@@ -428,11 +428,11 @@
 }
 
 void AndroidKeymaster::ImportKey(const ImportKeyRequest& request, ImportKeyResponse* response) {
-    if (response == NULL)
+    if (response == nullptr)
         return;
 
     keymaster_algorithm_t algorithm;
-    KeyFactory* factory = 0;
+    KeyFactory* factory = nullptr;
     UniquePtr<Key> key;
     if (!request.key_description.GetTagValue(TAG_ALGORITHM, &algorithm) ||
         !(factory = context_->GetKeyFactory(algorithm)))
@@ -514,7 +514,7 @@
     }
 
     keymaster_algorithm_t algorithm;
-    KeyFactory* factory = 0;
+    KeyFactory* factory = nullptr;
     if (!key_description.GetTagValue(TAG_ALGORITHM, &algorithm) ||
         !(factory = context_->GetKeyFactory(algorithm))) {
         response->error = KM_ERROR_UNSUPPORTED_ALGORITHM;
diff --git a/android_keymaster/android_keymaster_messages.cpp b/android_keymaster/android_keymaster_messages.cpp
index 0163aaa..1c5695e 100644
--- a/android_keymaster/android_keymaster_messages.cpp
+++ b/android_keymaster/android_keymaster_messages.cpp
@@ -41,7 +41,7 @@
 static bool deserialize_key_blob(keymaster_key_blob_t* key_blob, const uint8_t** buf_ptr,
                                  const uint8_t* end) {
     delete[] key_blob->key_material;
-    key_blob->key_material = 0;
+    key_blob->key_material = nullptr;
     UniquePtr<uint8_t[]> deserialized_key_material;
     if (!copy_size_and_data_from_buf(buf_ptr, end, &key_blob->key_material_size,
                                      &deserialized_key_material))
@@ -341,7 +341,7 @@
 
 bool ImportKeyRequest::Deserialize(const uint8_t** buf_ptr, const uint8_t* end) {
     delete[] key_data;
-    key_data = NULL;
+    key_data = nullptr;
     UniquePtr<uint8_t[]> deserialized_key_material;
     if (!key_description.Deserialize(buf_ptr, end) ||
         !copy_uint32_from_buf(buf_ptr, end, &key_format) ||
@@ -407,7 +407,7 @@
 
 bool ExportKeyResponse::NonErrorDeserialize(const uint8_t** buf_ptr, const uint8_t* end) {
     delete[] key_data;
-    key_data = NULL;
+    key_data = nullptr;
     UniquePtr<uint8_t[]> deserialized_key_material;
     if (!copy_size_and_data_from_buf(buf_ptr, end, &key_data_length, &deserialized_key_material))
         return false;
diff --git a/android_keymaster/authorization_set.cpp b/android_keymaster/authorization_set.cpp
index 7073b5b..778ef42 100644
--- a/android_keymaster/authorization_set.cpp
+++ b/android_keymaster/authorization_set.cpp
@@ -36,7 +36,7 @@
 
 AuthorizationSet::AuthorizationSet(AuthorizationSetBuilder& builder) {
     elems_ = builder.set.elems_;
-    builder.set.elems_ = NULL;
+    builder.set.elems_ = nullptr;
 
     elems_size_ = builder.set.elems_size_;
     builder.set.elems_size_ = 0;
@@ -45,7 +45,7 @@
     builder.set.elems_capacity_ = 0;
 
     indirect_data_ = builder.set.indirect_data_;
-    builder.set.indirect_data_ = NULL;
+    builder.set.indirect_data_ = nullptr;
 
     indirect_data_capacity_ = builder.set.indirect_data_capacity_;
     builder.set.indirect_data_capacity_ = 0;
@@ -67,7 +67,7 @@
 
     if (count > elems_capacity_) {
         keymaster_key_param_t* new_elems = new (std::nothrow) keymaster_key_param_t[count];
-        if (new_elems == NULL) {
+        if (new_elems == nullptr) {
             set_invalid(ALLOCATION_FAILURE);
             return false;
         }
@@ -85,7 +85,7 @@
 
     if (length > indirect_data_capacity_) {
         uint8_t* new_data = new (std::nothrow) uint8_t[length];
-        if (new_data == NULL) {
+        if (new_data == nullptr) {
             set_invalid(ALLOCATION_FAILURE);
             return false;
         }
@@ -123,7 +123,7 @@
 bool AuthorizationSet::Reinitialize(const keymaster_key_param_t* elems, const size_t count) {
     FreeData();
 
-    if (elems == NULL || count == 0) {
+    if (elems == nullptr || count == 0) {
         error_ = OK;
         return true;
     }
@@ -510,8 +510,8 @@
     delete[] elems_;
     delete[] indirect_data_;
 
-    elems_ = NULL;
-    indirect_data_ = NULL;
+    elems_ = nullptr;
+    indirect_data_ = nullptr;
     elems_capacity_ = 0;
     indirect_data_capacity_ = 0;
     error_ = OK;
diff --git a/android_keymaster/logger.cpp b/android_keymaster/logger.cpp
index f86a68f..0d1d4af 100644
--- a/android_keymaster/logger.cpp
+++ b/android_keymaster/logger.cpp
@@ -18,7 +18,7 @@
 
 namespace keymaster {
 
-Logger* Logger::instance_ = 0;
+Logger* Logger::instance_ = nullptr;
 
 /* static */
 int Logger::Log(LogLevel level, const char* fmt, va_list args) {
diff --git a/android_keymaster/operation_table.cpp b/android_keymaster/operation_table.cpp
index d2ad830..2e630c8 100644
--- a/android_keymaster/operation_table.cpp
+++ b/android_keymaster/operation_table.cpp
@@ -39,16 +39,16 @@
 
 Operation* OperationTable::Find(keymaster_operation_handle_t op_handle) {
     if (op_handle == 0)
-        return NULL;
+        return nullptr;
 
     if (!table_.get())
-        return NULL;
+        return nullptr;
 
     for (size_t i = 0; i < table_size_; ++i) {
         if (table_[i] && table_[i]->operation_handle() == op_handle)
             return table_[i].get();
     }
-    return NULL;
+    return nullptr;
 }
 
 bool OperationTable::Delete(keymaster_operation_handle_t op_handle) {
diff --git a/contexts/soft_keymaster_context.cpp b/contexts/soft_keymaster_context.cpp
index 7c28bdc..a0a42d3 100644
--- a/contexts/soft_keymaster_context.cpp
+++ b/contexts/soft_keymaster_context.cpp
@@ -185,7 +185,7 @@
         }
     }
 
-    sw_enforced->push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
+    sw_enforced->push_back(TAG_CREATION_DATETIME, java_time(time(nullptr)));
     sw_enforced->push_back(TAG_ORIGIN, origin);
     sw_enforced->push_back(TAG_OS_VERSION, os_version);
     sw_enforced->push_back(TAG_OS_PATCHLEVEL, os_patchlevel);
diff --git a/contexts/soft_keymaster_device.cpp b/contexts/soft_keymaster_device.cpp
index 0143021..23a6eda 100644
--- a/contexts/soft_keymaster_device.cpp
+++ b/contexts/soft_keymaster_device.cpp
@@ -54,7 +54,7 @@
             .name = "OpenSSL-based SoftKeymaster HAL",
             .author = "The Android Open Source Project",
             .methods = nullptr,
-            .dso = 0,
+            .dso = nullptr,
             .reserved = {},
         },
 };
@@ -69,7 +69,7 @@
             .name = "OpenSSL-based SoftKeymaster HAL",
             .author = "The Android Open Source Project",
             .methods = nullptr,
-            .dso = 0,
+            .dso = nullptr,
             .reserved = {},
         },
 };
diff --git a/include/keymaster/authorization_set.h b/include/keymaster/authorization_set.h
index d018db9..fec3d46 100644
--- a/include/keymaster/authorization_set.h
+++ b/include/keymaster/authorization_set.h
@@ -41,7 +41,7 @@
      * buffers, with \p Reinitialize.
      */
     AuthorizationSet()
-        : elems_capacity_(0), indirect_data_(NULL), indirect_data_size_(0),
+        : elems_capacity_(0), indirect_data_(nullptr), indirect_data_size_(0),
           indirect_data_capacity_(0), error_(OK) {
         elems_ = nullptr;
         elems_size_ = 0;
diff --git a/include/keymaster/km_openssl/symmetric_key.h b/include/keymaster/km_openssl/symmetric_key.h
index e8a0c12..5a5252d 100644
--- a/include/keymaster/km_openssl/symmetric_key.h
+++ b/include/keymaster/km_openssl/symmetric_key.h
@@ -61,7 +61,7 @@
 
     const keymaster_key_format_t* NoFormats(size_t* format_count) const {
         *format_count = 0;
-        return NULL;
+        return nullptr;
     }
     const RandomSource& random_source_;
 };
diff --git a/include/keymaster/operation.h b/include/keymaster/operation.h
index 65ae82a..682aadf 100644
--- a/include/keymaster/operation.h
+++ b/include/keymaster/operation.h
@@ -59,15 +59,15 @@
     // deallocated or modified.
     virtual const keymaster_padding_t* SupportedPaddingModes(size_t* padding_count) const {
         *padding_count = 0;
-        return NULL;
+        return nullptr;
     }
     virtual const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const {
         *block_mode_count = 0;
-        return NULL;
+        return nullptr;
     }
     virtual const keymaster_digest_t* SupportedDigests(size_t* digest_count) const {
         *digest_count = 0;
-        return NULL;
+        return nullptr;
     }
 
     // Convenience methods
diff --git a/key_blob_utils/integrity_assured_key_blob.cpp b/key_blob_utils/integrity_assured_key_blob.cpp
index 505d205..35b5390 100644
--- a/key_blob_utils/integrity_assured_key_blob.cpp
+++ b/key_blob_utils/integrity_assured_key_blob.cpp
@@ -59,7 +59,7 @@
     HMAC_CTX ctx;
     HMAC_CTX_init(&ctx);
     const EVP_MD* md = EVP_sha256();
-    if (!HMAC_Init_ex(&ctx, HMAC_KEY, sizeof(HMAC_KEY), md, NULL /* engine */))
+    if (!HMAC_Init_ex(&ctx, HMAC_KEY, sizeof(HMAC_KEY), md, nullptr /* engine */))
         return TranslateLastOpenSslError();
     HmacCleanup cleanup(&ctx);
 
diff --git a/key_blob_utils/ocb_utils.cpp b/key_blob_utils/ocb_utils.cpp
index 7fe7ad9..409029c 100644
--- a/key_blob_utils/ocb_utils.cpp
+++ b/key_blob_utils/ocb_utils.cpp
@@ -33,7 +33,7 @@
 
 class AeCtx {
   public:
-    AeCtx() : ctx_(ae_allocate(NULL)) {}
+    AeCtx() : ctx_(ae_allocate(nullptr)) {}
     ~AeCtx() {
         ae_clear(ctx_);
         ae_free(ctx_);
@@ -138,7 +138,7 @@
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
     int ae_err = ae_encrypt(ctx.get(), nonce.peek_read(), plaintext.key_material,
-                            plaintext.key_material_size, NULL /* additional data */,
+                            plaintext.key_material_size, nullptr /* additional data */,
                             0 /* additional data length */, ciphertext->writable_data(),
                             tag->peek_write(), 1 /* final */);
     if (ae_err < 0) {
@@ -174,7 +174,7 @@
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
     int ae_err = ae_decrypt(ctx.get(), nonce.peek_read(), ciphertext.key_material,
-                            ciphertext.key_material_size, NULL /* additional data */,
+                            ciphertext.key_material_size, nullptr /* additional data */,
                             0 /* additional data length */, plaintext->writable_data(),
                             tag.peek_read(), 1 /* final */);
     if (ae_err == AE_INVALID) {
diff --git a/key_blob_utils/software_keyblobs.cpp b/key_blob_utils/software_keyblobs.cpp
index bba3f6a..c490631 100644
--- a/key_blob_utils/software_keyblobs.cpp
+++ b/key_blob_utils/software_keyblobs.cpp
@@ -292,7 +292,7 @@
         }
     }
 
-    sw_enforced->push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
+    sw_enforced->push_back(TAG_CREATION_DATETIME, java_time(time(nullptr)));
     sw_enforced->push_back(TAG_ORIGIN, origin);
     sw_enforced->push_back(TAG_OS_VERSION, os_version);
     sw_enforced->push_back(TAG_OS_PATCHLEVEL, os_patchlevel);
diff --git a/km_openssl/asymmetric_key.cpp b/km_openssl/asymmetric_key.cpp
index 5339a6f..7e459a0 100644
--- a/km_openssl/asymmetric_key.cpp
+++ b/km_openssl/asymmetric_key.cpp
@@ -38,19 +38,19 @@
     if (format != KM_KEY_FORMAT_X509)
         return KM_ERROR_UNSUPPORTED_KEY_FORMAT;
 
-    if (material == NULL || size == NULL)
+    if (material == nullptr || size == nullptr)
         return KM_ERROR_OUTPUT_PARAMETER_NULL;
 
     EVP_PKEY_Ptr pkey(EVP_PKEY_new());
     if (!InternalToEvp(pkey.get()))
         return TranslateLastOpenSslError();
 
-    int key_data_length = i2d_PUBKEY(pkey.get(), NULL);
+    int key_data_length = i2d_PUBKEY(pkey.get(), nullptr);
     if (key_data_length <= 0)
         return TranslateLastOpenSslError();
 
     material->reset(new(std::nothrow) uint8_t[key_data_length]);
-    if (material->get() == NULL)
+    if (material->get() == nullptr)
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
     uint8_t* tmp = material->get();
diff --git a/km_openssl/asymmetric_key_factory.cpp b/km_openssl/asymmetric_key_factory.cpp
index 0221208..b34924a 100644
--- a/km_openssl/asymmetric_key_factory.cpp
+++ b/km_openssl/asymmetric_key_factory.cpp
@@ -52,7 +52,7 @@
     asym_key->key_material() = move(key_material);
 
     EVP_PKEY* pkey =
-        d2i_PrivateKey(evp_key_type(), NULL /* pkey */, &tmp,
+        d2i_PrivateKey(evp_key_type(), nullptr /* pkey */, &tmp,
                        asym_key->key_material().key_material_size);
     if (!pkey)
         return TranslateLastOpenSslError();
diff --git a/km_openssl/block_cipher_operation.cpp b/km_openssl/block_cipher_operation.cpp
index b9504ea..20bd2a6 100644
--- a/km_openssl/block_cipher_operation.cpp
+++ b/km_openssl/block_cipher_operation.cpp
@@ -197,7 +197,7 @@
     int output_written = -1;
     if (!EVP_CipherFinal_ex(&ctx_, output->peek_write(), &output_written)) {
         if (tag_length_ > 0) return KM_ERROR_VERIFICATION_FAILED;
-        LOG_E("Error encrypting final block: %s", ERR_error_string(ERR_peek_last_error(), NULL));
+        LOG_E("Error encrypting final block: %s", ERR_error_string(ERR_peek_last_error(), nullptr));
         return TranslateLastOpenSslError();
     }
 
@@ -228,7 +228,7 @@
         cipher_description_.GetCipherInstance(key.key_material_size, block_mode_, &error);
     if (error) return error;
 
-    if (!EVP_CipherInit_ex(&ctx_, cipher, NULL /* engine */, key.key_material, iv_.data,
+    if (!EVP_CipherInit_ex(&ctx_, cipher, nullptr /* engine */, key.key_material, iv_.data,
                            evp_encrypt_mode())) {
         return TranslateLastOpenSslError();
     }
diff --git a/km_openssl/ec_key.cpp b/km_openssl/ec_key.cpp
index 87a0a29..5e1cbe9 100644
--- a/km_openssl/ec_key.cpp
+++ b/km_openssl/ec_key.cpp
@@ -26,7 +26,7 @@
 
 bool EcKey::EvpToInternal(const EVP_PKEY* pkey) {
     ec_key_.reset(EVP_PKEY_get1_EC_KEY(const_cast<EVP_PKEY*>(pkey)));
-    return ec_key_.get() != NULL;
+    return ec_key_.get() != nullptr;
 }
 
 bool EcKey::InternalToEvp(EVP_PKEY* pkey) const {
diff --git a/km_openssl/ec_key_factory.cpp b/km_openssl/ec_key_factory.cpp
index 8fb364c..8dead88 100644
--- a/km_openssl/ec_key_factory.cpp
+++ b/km_openssl/ec_key_factory.cpp
@@ -93,11 +93,11 @@
 
     UniquePtr<EC_KEY, EC_KEY_Delete> ec_key(EC_KEY_new());
     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
-    if (ec_key.get() == NULL || pkey.get() == NULL)
+    if (ec_key.get() == nullptr || pkey.get() == nullptr)
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
     UniquePtr<EC_GROUP, EC_GROUP_Delete> group(ChooseGroup(ec_curve));
-    if (group.get() == NULL) {
+    if (group.get() == nullptr) {
         LOG_E("Unable to get EC group for curve %d", ec_curve);
         return KM_ERROR_UNSUPPORTED_KEY_SIZE;
     }
@@ -213,7 +213,7 @@
         return EC_GROUP_new_by_curve_name(NID_secp521r1);
         break;
     default:
-        return NULL;
+        return nullptr;
         break;
     }
 }
diff --git a/km_openssl/ecdsa_operation.cpp b/km_openssl/ecdsa_operation.cpp
index 62c2079..59ce624 100644
--- a/km_openssl/ecdsa_operation.cpp
+++ b/km_openssl/ecdsa_operation.cpp
@@ -54,7 +54,7 @@
 }
 
 EcdsaOperation::~EcdsaOperation() {
-    if (ecdsa_key_ != NULL)
+    if (ecdsa_key_ != nullptr)
         EVP_PKEY_free(ecdsa_key_);
     EVP_MD_CTX_cleanup(&digest_ctx_);
 }
diff --git a/km_openssl/hmac_operation.cpp b/km_openssl/hmac_operation.cpp
index 830aa6f..c4f180e 100644
--- a/km_openssl/hmac_operation.cpp
+++ b/km_openssl/hmac_operation.cpp
@@ -132,7 +132,7 @@
     }
 
     KeymasterKeyBlob blob = key.key_material_move();
-    HMAC_Init_ex(&ctx_, blob.key_material, blob.key_material_size, md, NULL /* engine */);
+    HMAC_Init_ex(&ctx_, blob.key_material, blob.key_material_size, md, nullptr /* engine */);
 }
 
 HmacOperation::~HmacOperation() {
diff --git a/km_openssl/openssl_err.cpp b/km_openssl/openssl_err.cpp
index 40a9e76..1391f40 100644
--- a/km_openssl/openssl_err.cpp
+++ b/km_openssl/openssl_err.cpp
@@ -44,7 +44,7 @@
     unsigned long error = ERR_peek_last_error();
 
     if (log_message) {
-        LOG_D("%s", ERR_error_string(error, NULL));
+        LOG_D("%s", ERR_error_string(error, nullptr));
     }
 
     int reason = ERR_GET_REASON(error);
diff --git a/km_openssl/openssl_utils.cpp b/km_openssl/openssl_utils.cpp
index 6302838..06cfafa 100644
--- a/km_openssl/openssl_utils.cpp
+++ b/km_openssl/openssl_utils.cpp
@@ -77,12 +77,12 @@
 keymaster_error_t convert_pkcs8_blob_to_evp(const uint8_t* key_data, size_t key_length,
                                             keymaster_algorithm_t expected_algorithm,
                                             UniquePtr<EVP_PKEY, EVP_PKEY_Delete>* pkey) {
-    if (key_data == NULL || key_length <= 0)
+    if (key_data == nullptr || key_length <= 0)
         return KM_ERROR_INVALID_KEY_BLOB;
 
     UniquePtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_Delete> pkcs8(
-        d2i_PKCS8_PRIV_KEY_INFO(NULL, &key_data, key_length));
-    if (pkcs8.get() == NULL)
+        d2i_PKCS8_PRIV_KEY_INFO(nullptr, &key_data, key_length));
+    if (pkcs8.get() == nullptr)
         return TranslateLastOpenSslError(true /* log_message */);
 
     pkey->reset(EVP_PKCS82PKEY(pkcs8.get()));
@@ -110,7 +110,7 @@
 }
 
 keymaster_error_t EvpKeyToKeyMaterial(const EVP_PKEY* pkey, KeymasterKeyBlob* key_blob) {
-    int key_data_size = i2d_PrivateKey(pkey, NULL /* key_data*/);
+    int key_data_size = i2d_PrivateKey(pkey, nullptr /* key_data*/);
     if (key_data_size <= 0)
         return TranslateLastOpenSslError();
 
diff --git a/km_openssl/rsa_key.cpp b/km_openssl/rsa_key.cpp
index dccda02..8b5b6ae 100644
--- a/km_openssl/rsa_key.cpp
+++ b/km_openssl/rsa_key.cpp
@@ -25,7 +25,7 @@
 
 bool RsaKey::EvpToInternal(const EVP_PKEY* pkey) {
     rsa_key_.reset(EVP_PKEY_get1_RSA(const_cast<EVP_PKEY*>(pkey)));
-    return rsa_key_.get() != NULL;
+    return rsa_key_.get() != nullptr;
 }
 
 bool RsaKey::InternalToEvp(EVP_PKEY* pkey) const {
diff --git a/km_openssl/rsa_key_factory.cpp b/km_openssl/rsa_key_factory.cpp
index 27c6ce1..30bb9fb 100644
--- a/km_openssl/rsa_key_factory.cpp
+++ b/km_openssl/rsa_key_factory.cpp
@@ -81,11 +81,11 @@
     UniquePtr<BIGNUM, BIGNUM_Delete> exponent(BN_new());
     UniquePtr<RSA, RsaKey::RSA_Delete> rsa_key(RSA_new());
     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
-    if (exponent.get() == NULL || rsa_key.get() == NULL || pkey.get() == NULL)
+    if (exponent.get() == nullptr || rsa_key.get() == nullptr || pkey.get() == nullptr)
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
     if (!BN_set_word(exponent.get(), public_exponent) ||
-        !RSA_generate_key_ex(rsa_key.get(), key_size, exponent.get(), NULL /* callback */))
+        !RSA_generate_key_ex(rsa_key.get(), key_size, exponent.get(), nullptr /* callback */))
         return TranslateLastOpenSslError();
 
     if (EVP_PKEY_set1_RSA(pkey.get(), rsa_key.get()) != 1)
diff --git a/km_openssl/rsa_operation.cpp b/km_openssl/rsa_operation.cpp
index a6ddd85..b8d1443 100644
--- a/km_openssl/rsa_operation.cpp
+++ b/km_openssl/rsa_operation.cpp
@@ -127,7 +127,7 @@
 }
 
 RsaOperation::~RsaOperation() {
-    if (rsa_key_ != NULL)
+    if (rsa_key_ != nullptr)
         EVP_PKEY_free(rsa_key_);
 }
 
@@ -394,7 +394,7 @@
         return KM_ERROR_OK;
 
     EVP_PKEY_CTX* pkey_ctx;
-    if (EVP_DigestVerifyInit(&digest_ctx_, &pkey_ctx, digest_algorithm_, NULL, rsa_key_) != 1)
+    if (EVP_DigestVerifyInit(&digest_ctx_, &pkey_ctx, digest_algorithm_, nullptr, rsa_key_) != 1)
         return TranslateLastOpenSslError();
     return SetRsaPaddingInEvpContext(pkey_ctx, false /* signing */);
 }
diff --git a/legacy_support/keymaster0_engine.cpp b/legacy_support/keymaster0_engine.cpp
index 85af991..e856318 100644
--- a/legacy_support/keymaster0_engine.cpp
+++ b/legacy_support/keymaster0_engine.cpp
@@ -44,9 +44,9 @@
     assert(!instance_);
     instance_ = this;
 
-    rsa_index_ = RSA_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */,
+    rsa_index_ = RSA_get_ex_new_index(0 /* argl */, nullptr /* argp */, nullptr /* new_func */,
                                       keyblob_dup, keyblob_free);
-    ec_key_index_ = EC_KEY_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */,
+    ec_key_index_ = EC_KEY_get_ex_new_index(0 /* argl */, nullptr /* argp */, nullptr /* new_func */,
                                             keyblob_dup, keyblob_free);
 
     memset(&rsa_method_, 0, sizeof(rsa_method_));
@@ -83,7 +83,7 @@
     params.public_exponent = public_exponent;
     params.modulus_size = public_modulus;
 
-    uint8_t* key_blob = 0;
+    uint8_t* key_blob = nullptr;
     if (keymaster0_device_->generate_keypair(keymaster0_device_, TYPE_RSA, &params, &key_blob,
                                              &key_material->key_material_size) < 0) {
         ALOGE("Error generating RSA key pair with keymaster0 device");
@@ -99,7 +99,7 @@
     keymaster_ec_keygen_params_t params;
     params.field_size = key_size;
 
-    uint8_t* key_blob = 0;
+    uint8_t* key_blob = nullptr;
     if (keymaster0_device_->generate_keypair(keymaster0_device_, TYPE_EC, &params, &key_blob,
                                              &key_material->key_material_size) < 0) {
         ALOGE("Error generating EC key pair with keymaster0 device");
@@ -117,7 +117,7 @@
     if (key_format != KM_KEY_FORMAT_PKCS8)
         return false;
 
-    uint8_t* key_blob = 0;
+    uint8_t* key_blob = nullptr;
     if (keymaster0_device_->import_keypair(keymaster0_device_, to_import.key_material,
                                            to_import.key_material_size, &key_blob,
                                            &imported_key->key_material_size) < 0) {
@@ -299,7 +299,7 @@
 int Keymaster0Engine::RsaPrivateTransform(RSA* rsa, uint8_t* out, const uint8_t* in,
                                           size_t len) const {
     const keymaster_key_blob_t* key_blob = RsaKeyToBlob(rsa);
-    if (key_blob == NULL) {
+    if (key_blob == nullptr) {
         ALOGE("key had no key_blob!");
         return 0;
     }
@@ -343,7 +343,7 @@
 int Keymaster0Engine::EcdsaSign(const uint8_t* digest, size_t digest_len, uint8_t* sig,
                                 unsigned int* sig_len, EC_KEY* ec_key) const {
     const keymaster_key_blob_t* key_blob = EcKeyToBlob(ec_key);
-    if (key_blob == NULL) {
+    if (key_blob == nullptr) {
         ALOGE("key had no key_blob!");
         return 0;
     }
diff --git a/legacy_support/keymaster1_engine.cpp b/legacy_support/keymaster1_engine.cpp
index 7fd7fea..7dd2c8a 100644
--- a/legacy_support/keymaster1_engine.cpp
+++ b/legacy_support/keymaster1_engine.cpp
@@ -41,10 +41,10 @@
 
 Keymaster1Engine::Keymaster1Engine(const keymaster1_device_t* keymaster1_device)
     : keymaster1_device_(keymaster1_device), engine_(ENGINE_new()),
-      rsa_index_(RSA_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */,
+      rsa_index_(RSA_get_ex_new_index(0 /* argl */, nullptr /* argp */, nullptr /* new_func */,
                                       Keymaster1Engine::duplicate_key_data,
                                       Keymaster1Engine::free_key_data)),
-      ec_key_index_(EC_KEY_get_ex_new_index(0 /* argl */, NULL /* argp */, NULL /* new_func */,
+      ec_key_index_(EC_KEY_get_ex_new_index(0 /* argl */, nullptr /* argp */, nullptr /* new_func */,
                                             Keymaster1Engine::duplicate_key_data,
                                             Keymaster1Engine::free_key_data)),
       rsa_method_(BuildRsaMethod()), ecdsa_method_(BuildEcdsaMethod()) {
diff --git a/legacy_support/keymaster_passthrough_operation.h b/legacy_support/keymaster_passthrough_operation.h
index 307b32f..29c0372 100644
--- a/legacy_support/keymaster_passthrough_operation.h
+++ b/legacy_support/keymaster_passthrough_operation.h
@@ -117,15 +117,15 @@
     // deallocated or modified.
     const keymaster_padding_t* SupportedPaddingModes(size_t* padding_count) const override {
         *padding_count = 0;
-        return NULL;
+        return nullptr;
     }
     const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const override {
         *block_mode_count = 0;
-        return NULL;
+        return nullptr;
     }
     const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override {
         *digest_count = 0;
-        return NULL;
+        return nullptr;
     }
 
   private:
diff --git a/tests/android_keymaster_messages_test.cpp b/tests/android_keymaster_messages_test.cpp
index a933cf8..7dcffbe 100644
--- a/tests/android_keymaster_messages_test.cpp
+++ b/tests/android_keymaster_messages_test.cpp
@@ -35,7 +35,7 @@
     size_t size = message.SerializedSize();
     EXPECT_EQ(expected_size, size);
     if (size == 0)
-        return NULL;
+        return nullptr;
 
     UniquePtr<uint8_t[]> buf(new uint8_t[size]);
     EXPECT_EQ(buf.get() + size, message.Serialize(buf.get(), buf.get() + size));
@@ -669,7 +669,7 @@
         }
     }
 
-    time_t now = time(NULL);
+    time_t now = time(nullptr);
     std::cout << "Seeding rand() with " << now << " for fuzz test." << std::endl;
     srand(now);
 
diff --git a/tests/android_keymaster_test_utils.cpp b/tests/android_keymaster_test_utils.cpp
index 917e95e..b031d26 100644
--- a/tests/android_keymaster_test_utils.cpp
+++ b/tests/android_keymaster_test_utils.cpp
@@ -107,7 +107,7 @@
         return a.boolean == b.boolean;
     case KM_BIGNUM:
     case KM_BYTES:
-        if ((a.blob.data == NULL || b.blob.data == NULL) && a.blob.data != b.blob.data)
+        if ((a.blob.data == nullptr || b.blob.data == nullptr) && a.blob.data != b.blob.data)
             return false;
         return a.blob.data_length == b.blob.data_length &&
                (memcmp(a.blob.data, b.blob.data, a.blob.data_length) == 0);
@@ -359,7 +359,7 @@
 }
 
 string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message) {
-    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), NULL /* output_params */));
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), nullptr /* output_params */));
 
     string result;
     EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, "" /* signature */, &result));
@@ -390,7 +390,7 @@
 
 string Keymaster2Test::ProcessMessage(keymaster_purpose_t purpose, const string& message,
                                       const string& signature) {
-    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), NULL /* output_params */));
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, client_params(), nullptr /* output_params */));
 
     string result;
     EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, signature, &result));
@@ -608,14 +608,14 @@
 
 keymaster_error_t Keymaster2Test::GetCharacteristics() {
     FreeCharacteristics();
-    return device()->get_key_characteristics(device(), &blob_, &client_id_, NULL /* app_data */,
+    return device()->get_key_characteristics(device(), &blob_, &client_id_, nullptr /* app_data */,
                                              &characteristics_);
 }
 
 keymaster_error_t Keymaster2Test::ExportKey(keymaster_key_format_t format, string* export_data) {
     keymaster_blob_t export_tmp;
     keymaster_error_t error = device()->export_key(device(), format, &blob_, &client_id_,
-                                                   NULL /* app_data */, &export_tmp);
+                                                   nullptr /* app_data */, &export_tmp);
 
     if (error != KM_ERROR_OK)
         return error;
@@ -691,7 +691,7 @@
 
 void Keymaster2Test::FreeKeyBlob() {
     free(const_cast<uint8_t*>(blob_.key_material));
-    blob_.key_material = NULL;
+    blob_.key_material = nullptr;
 }
 
 void Keymaster2Test::corrupt_key_blob() {
diff --git a/tests/android_keymaster_test_utils.h b/tests/android_keymaster_test_utils.h
index c6a1641..a1965be 100644
--- a/tests/android_keymaster_test_utils.h
+++ b/tests/android_keymaster_test_utils.h
@@ -196,7 +196,7 @@
 
     keymaster_error_t BeginOperation(keymaster_purpose_t purpose);
     keymaster_error_t BeginOperation(keymaster_purpose_t purpose, const AuthorizationSet& input_set,
-                                     AuthorizationSet* output_set = NULL);
+                                     AuthorizationSet* output_set = nullptr);
 
     keymaster_error_t UpdateOperation(const std::string& message, std::string* output,
                                       size_t* input_consumed);
@@ -229,11 +229,11 @@
     std::string ProcessMessage(keymaster_purpose_t purpose, const std::string& message,
                                const AuthorizationSet& begin_params,
                                const AuthorizationSet& update_params,
-                               AuthorizationSet* output_params = NULL);
+                               AuthorizationSet* output_params = nullptr);
     std::string ProcessMessage(keymaster_purpose_t purpose, const std::string& message,
                                const std::string& signature, const AuthorizationSet& begin_params,
                                const AuthorizationSet& update_params,
-                               AuthorizationSet* output_params = NULL);
+                               AuthorizationSet* output_params = nullptr);
     std::string ProcessMessage(keymaster_purpose_t purpose, const std::string& message,
                                const std::string& signature);
 
@@ -249,17 +249,17 @@
     void VerifyMac(const std::string& message, const std::string& signature);
 
     std::string EncryptMessage(const std::string& message, keymaster_padding_t padding,
-                               std::string* generated_nonce = NULL);
+                               std::string* generated_nonce = nullptr);
     std::string EncryptMessage(const std::string& message, keymaster_digest_t digest,
-                               keymaster_padding_t padding, std::string* generated_nonce = NULL);
+                               keymaster_padding_t padding, std::string* generated_nonce = nullptr);
     std::string EncryptMessage(const std::string& message, keymaster_block_mode_t block_mode,
-                               keymaster_padding_t padding, std::string* generated_nonce = NULL);
+                               keymaster_padding_t padding, std::string* generated_nonce = nullptr);
     std::string EncryptMessage(const AuthorizationSet& update_params, const std::string& message,
                                keymaster_digest_t digest, keymaster_padding_t padding,
-                               std::string* generated_nonce = NULL);
+                               std::string* generated_nonce = nullptr);
     std::string EncryptMessage(const AuthorizationSet& update_params, const std::string& message,
                                keymaster_block_mode_t block_mode, keymaster_padding_t padding,
-                               std::string* generated_nonce = NULL);
+                               std::string* generated_nonce = nullptr);
     std::string EncryptMessageWithParams(const std::string& message,
                                          const AuthorizationSet& begin_params,
                                          const AuthorizationSet& update_params,