diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index eee9942..09a923d 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -106,7 +106,7 @@
             *length = 0;
         }
     } else {
-        *data = NULL;
+        *data = nullptr;
         *length = 0;
     }
 }
@@ -1056,7 +1056,7 @@
                         sp<KeystoreArg> arg = new KeystoreArg(data.readInplace(inSize), inSize);
                         args.push_back(arg);
                     } else {
-                        args.push_back(NULL);
+                        args.push_back(nullptr);
                     }
                 }
             }
@@ -1290,7 +1290,7 @@
     }
     case ADD_AUTH_TOKEN: {
         CHECK_INTERFACE(IKeystoreService, data, reply);
-        const uint8_t* token_bytes = NULL;
+        const uint8_t* token_bytes = nullptr;
         size_t size = 0;
         readByteArray(data, &token_bytes, &size);
         int32_t result = addAuthToken(token_bytes, size);
diff --git a/keystore/auth_token_table.cpp b/keystore/auth_token_table.cpp
index 8b81e47..b7cc845 100644
--- a/keystore/auth_token_table.cpp
+++ b/keystore/auth_token_table.cpp
@@ -151,7 +151,7 @@
                                                              HardwareAuthenticatorType auth_type,
                                                              const AuthorizationSet& key_info,
                                                              const HardwareAuthToken** found) {
-    Entry* newest_match = NULL;
+    Entry* newest_match = nullptr;
     for (auto& entry : entries_)
         if (entry.SatisfiesAuth(sids, auth_type) && entry.is_newer_than(newest_match))
             newest_match = &entry;
diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index eb5fe86..38cea69 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -66,7 +66,7 @@
 std::pair<KeyStoreServiceReturnCode, bool> hadFactoryResetSinceIdRotation() {
     struct stat sbuf;
     if (stat(kTimestampFilePath, &sbuf) == 0) {
-        double diff_secs = difftime(time(NULL), sbuf.st_ctime);
+        double diff_secs = difftime(time(nullptr), sbuf.st_ctime);
         return {ResponseCode::NO_ERROR, diff_secs < kIdRotationPeriod};
     }
 
@@ -178,7 +178,7 @@
     String8 name8(name);
     String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, targetUid, ::TYPE_GENERIC));
 
-    Blob keyBlob(&item[0], item.size(), NULL, 0, ::TYPE_GENERIC);
+    Blob keyBlob(&item[0], item.size(), nullptr, 0, ::TYPE_GENERIC);
     keyBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
 
     return mKeyStore->put(filename.string(), &keyBlob, get_user_id(targetUid));
@@ -399,10 +399,10 @@
             return ResponseCode::SYSTEM_ERROR;
         } else if (args->size() == 1) {
             const sp<KeystoreArg>& expArg = args->itemAt(0);
-            if (expArg != NULL) {
+            if (expArg != nullptr) {
                 Unique_BIGNUM pubExpBn(BN_bin2bn(
-                    reinterpret_cast<const unsigned char*>(expArg->data()), expArg->size(), NULL));
-                if (pubExpBn.get() == NULL) {
+                    reinterpret_cast<const unsigned char*>(expArg->data()), expArg->size(), nullptr));
+                if (pubExpBn.get() == nullptr) {
                     ALOGI("Could not convert public exponent to BN");
                     return ResponseCode::SYSTEM_ERROR;
                 }
@@ -426,7 +426,7 @@
     }
 
     auto rc = generateKey(name, params.hidl_data(), hidl_vec<uint8_t>(), targetUid, flags,
-                          /*outCharacteristics*/ NULL);
+                          /*outCharacteristics*/ nullptr);
     if (!rc.isOk()) {
         ALOGW("generate failed: %d", int32_t(rc));
     }
@@ -439,7 +439,7 @@
 
     const uint8_t* ptr = &data[0];
 
-    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &ptr, data.size()));
+    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(nullptr, &ptr, data.size()));
     if (!pkcs8.get()) {
         return ResponseCode::SYSTEM_ERROR;
     }
@@ -463,7 +463,7 @@
     }
 
     auto rc = importKey(name, params.hidl_data(), KeyFormat::PKCS8, data, targetUid, flags,
-                        /*outCharacteristics*/ NULL);
+                        /*outCharacteristics*/ nullptr);
 
     if (!rc.isOk()) {
         ALOGW("importKey failed: %d", int32_t(rc));
@@ -731,7 +731,7 @@
         String8 name8(name);
         String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, uid, ::TYPE_KEYMASTER_10));
 
-        Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), NULL, 0, ::TYPE_KEYMASTER_10);
+        Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
         keyBlob.setFallback(usingFallback);
         keyBlob.setCriticalToDeviceEncryption(flags & KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
         if (isAuthenticationBound(params) && !keyBlob.isCriticalToDeviceEncryption()) {
@@ -772,7 +772,7 @@
         return ResponseCode::SYSTEM_ERROR;
     }
     auto kc_buf = kc_stream.str();
-    Blob charBlob(reinterpret_cast<const uint8_t*>(kc_buf.data()), kc_buf.size(), NULL, 0,
+    Blob charBlob(reinterpret_cast<const uint8_t*>(kc_buf.data()), kc_buf.size(), nullptr, 0,
                   ::TYPE_KEY_CHARACTERISTICS);
     charBlob.setFallback(usingFallback);
     charBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -902,7 +902,7 @@
         // Write the key:
         String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, uid, ::TYPE_KEYMASTER_10));
 
-        Blob ksBlob(&keyBlob[0], keyBlob.size(), NULL, 0, ::TYPE_KEYMASTER_10);
+        Blob ksBlob(&keyBlob[0], keyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
         ksBlob.setFallback(usingFallback);
         ksBlob.setCriticalToDeviceEncryption(flags & KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
         if (isAuthenticationBound(params) && !ksBlob.isCriticalToDeviceEncryption()) {
@@ -946,7 +946,7 @@
     if (kcStream.bad()) return ResponseCode::SYSTEM_ERROR;
     auto kcBuf = kcStream.str();
 
-    Blob charBlob(reinterpret_cast<const uint8_t*>(kcBuf.data()), kcBuf.size(), NULL, 0,
+    Blob charBlob(reinterpret_cast<const uint8_t*>(kcBuf.data()), kcBuf.size(), nullptr, 0,
                   ::TYPE_KEY_CHARACTERISTICS);
     charBlob.setFallback(usingFallback);
     charBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -1069,7 +1069,7 @@
         return;
     }
 
-    const HardwareAuthToken* authToken = NULL;
+    const HardwareAuthToken* authToken = nullptr;
 
     // Merge these characteristics with the ones cached when the key was generated or imported
     Blob charBlob;
@@ -1310,7 +1310,7 @@
     uint64_t handle;
     KeyPurpose purpose;
     km_id_t keyid;
-    if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, NULL)) {
+    if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, nullptr)) {
         return ErrorCode::INVALID_OPERATION_HANDLE;
     }
     mOperationMap.removeOperation(token);
@@ -1329,7 +1329,7 @@
     if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, &characteristics)) {
         return false;
     }
-    const HardwareAuthToken* authToken = NULL;
+    const HardwareAuthToken* authToken = nullptr;
     mOperationMap.getOperationAuthToken(token, &authToken);
     AuthorizationSet ignored;
     auto authResult = addOperationAuthTokenIfNeeded(token, &ignored);
@@ -1456,7 +1456,7 @@
 
     uid_t callingUid = IPCThreadState::self()->getCallingUid();
     sp<IBinder> binder = defaultServiceManager()->getService(String16("permission"));
-    if (binder == 0) {
+    if (binder == nullptr) {
         return ErrorCode::CANNOT_ATTEST_IDS;
     }
     if (!interface_cast<IPermissionController>(binder)->checkPermission(
diff --git a/keystore/keyblob_utils.cpp b/keystore/keyblob_utils.cpp
index 3616822..6c2fac9 100644
--- a/keystore/keyblob_utils.cpp
+++ b/keystore/keyblob_utils.cpp
@@ -48,7 +48,7 @@
 
 uint8_t* add_softkey_header(uint8_t* key_blob, size_t key_blob_length) {
     if (key_blob_length < sizeof(SOFT_KEY_MAGIC)) {
-        return NULL;
+        return nullptr;
     }
 
     memcpy(key_blob, SOFT_KEY_MAGIC, sizeof(SOFT_KEY_MAGIC));
diff --git a/keystore/keystore.cpp b/keystore/keystore.cpp
index a61ef73..582333d 100644
--- a/keystore/keystore.cpp
+++ b/keystore/keystore.cpp
@@ -242,7 +242,7 @@
 
 bool KeyStore::isEmpty(uid_t userId) const {
     const UserState* userState = getUserState(userId);
-    if (userState == NULL) {
+    if (userState == nullptr) {
         return true;
     }
 
@@ -253,7 +253,7 @@
 
     bool result = true;
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // We only care about files.
         if (file->d_type != DT_REG) {
             continue;
@@ -453,7 +453,7 @@
     }
 
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // We only care about files.
         if (file->d_type != DT_REG) {
             continue;
@@ -470,7 +470,7 @@
 
             size_t extra = decode_key_length(p, plen);
             char* match = (char*)malloc(extra + 1);
-            if (match != NULL) {
+            if (match != nullptr) {
                 decode_key(match, p, plen);
                 matches->push(android::String16(match, extra));
                 free(match);
@@ -497,7 +497,7 @@
 
 ResponseCode KeyStore::importKey(const uint8_t* key, size_t keyLen, const char* filename,
                                  uid_t userId, int32_t flags) {
-    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &key, keyLen));
+    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(nullptr, &key, keyLen));
     if (!pkcs8.get()) {
         return ResponseCode::SYSTEM_ERROR;
     }
@@ -540,7 +540,7 @@
         return ResponseCode::SYSTEM_ERROR;
     }
 
-    Blob keyBlob(&blob[0], blob.size(), NULL, 0, TYPE_KEYMASTER_10);
+    Blob keyBlob(&blob[0], blob.size(), nullptr, 0, TYPE_KEYMASTER_10);
 
     keyBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
     keyBlob.setFallback(false);
@@ -550,7 +550,7 @@
 
 bool KeyStore::isHardwareBacked(const android::String16& /*keyType*/) const {
     using ::android::hardware::hidl_string;
-    if (mDevice == NULL) {
+    if (mDevice == nullptr) {
         ALOGW("can't get keymaster device");
         return false;
     }
@@ -615,7 +615,7 @@
         }
     }
 
-    return NULL;
+    return nullptr;
 }
 
 const UserState* KeyStore::getUserStateByUid(uid_t uid) const {
@@ -669,19 +669,19 @@
 ResponseCode KeyStore::importBlobAsKey(Blob* blob, const char* filename, uid_t userId) {
     // We won't even write to the blob directly with this BIO, so const_cast is okay.
     Unique_BIO b(BIO_new_mem_buf(const_cast<uint8_t*>(blob->getValue()), blob->getLength()));
-    if (b.get() == NULL) {
+    if (b.get() == nullptr) {
         ALOGE("Problem instantiating BIO");
         return ResponseCode::SYSTEM_ERROR;
     }
 
-    Unique_EVP_PKEY pkey(PEM_read_bio_PrivateKey(b.get(), NULL, NULL, NULL));
-    if (pkey.get() == NULL) {
+    Unique_EVP_PKEY pkey(PEM_read_bio_PrivateKey(b.get(), nullptr, nullptr, nullptr));
+    if (pkey.get() == nullptr) {
         ALOGE("Couldn't read old PEM file");
         return ResponseCode::SYSTEM_ERROR;
     }
 
     Unique_PKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(pkey.get()));
-    int len = i2d_PKCS8_PRIV_KEY_INFO(pkcs8.get(), NULL);
+    int len = i2d_PKCS8_PRIV_KEY_INFO(pkcs8.get(), nullptr);
     if (len < 0) {
         ALOGE("Couldn't measure PKCS#8 length");
         return ResponseCode::SYSTEM_ERROR;
@@ -761,7 +761,7 @@
         }
 
         struct dirent* file;
-        while ((file = readdir(dir)) != NULL) {
+        while ((file = readdir(dir)) != nullptr) {
             // We only care about files.
             if (file->d_type != DT_REG) {
                 continue;
@@ -785,7 +785,7 @@
 
             // Rename the file into user directory.
             DIR* otherdir = opendir(otherUser->getUserDirName());
-            if (otherdir == NULL) {
+            if (otherdir == nullptr) {
                 ALOGW("couldn't open user directory for rename");
                 continue;
             }
diff --git a/keystore/keystore_cli.cpp b/keystore/keystore_cli.cpp
index 24af024..8b3be31 100644
--- a/keystore/keystore_cli.cpp
+++ b/keystore/keystore_cli.cpp
@@ -29,7 +29,7 @@
 using namespace keystore;
 
 static const char* responses[] = {
-    NULL,
+    nullptr,
     /* [NO_ERROR]           = */ "No error",
     /* [LOCKED]             = */ "Locked",
     /* [UNINITIALIZED]      = */ "Uninitialized",
@@ -219,7 +219,7 @@
     sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         fprintf(stderr, "%s: error: could not connect to keystore service\n", argv[0]);
         return 1;
     }
diff --git a/keystore/keystore_get.cpp b/keystore/keystore_get.cpp
index 8fb7f80..4ab6555 100644
--- a/keystore/keystore_get.cpp
+++ b/keystore/keystore_get.cpp
@@ -27,7 +27,7 @@
     sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         return -1;
     }
 
diff --git a/keystore/keystore_get_wifi_hidl.cpp b/keystore/keystore_get_wifi_hidl.cpp
index 79639b6..155201f 100644
--- a/keystore/keystore_get_wifi_hidl.cpp
+++ b/keystore/keystore_get_wifi_hidl.cpp
@@ -34,13 +34,13 @@
 using android::system::wifi::keystore::V1_0::IKeystore;
 
 ssize_t keystore_get(const char *key, size_t keyLength, uint8_t** value) {
-    if (key == NULL || keyLength == 0 || value == NULL) {
+    if (key == nullptr || keyLength == 0 || value == nullptr) {
         ALOGE("Null pointer argument passed");
         return -1;
     }
 
     sp<IKeystore> service = IKeystore::tryGetService();
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore HAL");
         return -1;
     }
diff --git a/keystore/keystore_keymaster_enforcement.h b/keystore/keystore_keymaster_enforcement.h
index 0389201..0abe070 100644
--- a/keystore/keystore_keymaster_enforcement.h
+++ b/keystore/keystore_keymaster_enforcement.h
@@ -39,7 +39,7 @@
     }
 
     bool activation_date_valid(uint64_t activation_date) const override {
-        time_t now = time(NULL);
+        time_t now = time(nullptr);
         if (now == static_cast<time_t>(-1)) {
             // Failed to obtain current time -- fail safe: activation_date hasn't yet occurred.
             return false;
@@ -57,7 +57,7 @@
     }
 
     bool expiration_date_passed(uint64_t expiration_date) const override {
-        time_t now = time(NULL);
+        time_t now = time(nullptr);
         if (now == static_cast<time_t>(-1)) {
             // Failed to obtain current time -- fail safe: expiration_date has passed.
             return true;
diff --git a/keystore/operation.cpp b/keystore/operation.cpp
index 8c39716..fdb3c64 100644
--- a/keystore/operation.cpp
+++ b/keystore/operation.cpp
@@ -111,7 +111,7 @@
 
 sp<IBinder> OperationMap::getOldestPruneableOperation() {
     if (!hasPruneableOperation()) {
-        return sp<IBinder>(NULL);
+        return sp<IBinder>(nullptr);
     }
     return mLru[0];
 }
diff --git a/keystore/permissions.cpp b/keystore/permissions.cpp
index 1ba91d9..40be938 100644
--- a/keystore/permissions.cpp
+++ b/keystore/permissions.cpp
@@ -119,7 +119,7 @@
 
 static bool keystore_selinux_check_access(uid_t uid, perm_t perm, pid_t spid) {
     audit_data ad;
-    char* sctx = NULL;
+    char* sctx = nullptr;
     const char* selinux_class = "keystore_key";
     const char* str_perm = get_perm_label(perm);
 
diff --git a/keystore/user_state.cpp b/keystore/user_state.cpp
index 5f9cd5f..b70de4c 100644
--- a/keystore/user_state.cpp
+++ b/keystore/user_state.cpp
@@ -155,7 +155,7 @@
     if (length > SALT_SIZE && rawBlob.info == SALT_SIZE) {
         salt = (uint8_t*)&rawBlob + length - SALT_SIZE;
     } else {
-        salt = NULL;
+        salt = nullptr;
     }
     uint8_t passwordKey[MASTER_KEY_SIZE_BYTES];
     generateKeyFromPassword(passwordKey, MASTER_KEY_SIZE_BYTES, pw, salt);
@@ -166,7 +166,7 @@
     }
     if (response == ResponseCode::NO_ERROR && masterKeyBlob.getLength() == MASTER_KEY_SIZE_BYTES) {
         // If salt was missing, generate one and write a new master key file with the salt.
-        if (salt == NULL) {
+        if (salt == nullptr) {
             if (!generateSalt(entropy)) {
                 return ResponseCode::SYSTEM_ERROR;
             }
@@ -209,7 +209,7 @@
     }
 
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // skip . and ..
         if (!strcmp(".", file->d_name) || !strcmp("..", file->d_name)) {
             continue;
@@ -224,7 +224,7 @@
 void UserState::generateKeyFromPassword(uint8_t* key, ssize_t keySize, const android::String8& pw,
                                         uint8_t* salt) {
     size_t saltSize;
-    if (salt != NULL) {
+    if (salt != nullptr) {
         saltSize = SALT_SIZE;
     } else {
         // Pre-gingerbread used this hardwired salt, readMasterKey will rewrite these when found