diff --git a/payload_generator/delta_diff_generator.cc b/payload_generator/delta_diff_generator.cc
index 3a5e1eb..0791f4d 100644
--- a/payload_generator/delta_diff_generator.cc
+++ b/payload_generator/delta_diff_generator.cc
@@ -128,7 +128,7 @@
                    off_t chunk_size,
                    int data_fd,
                    off_t* data_file_size) {
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation operation;
 
   string old_path = (old_root == kEmptyPath) ? kEmptyPath :
@@ -172,7 +172,7 @@
     operation.set_data_length(data.size());
   }
 
-  TEST_AND_RETURN_FALSE(utils::WriteAll(data_fd, &data[0], data.size()));
+  TEST_AND_RETURN_FALSE(utils::WriteAll(data_fd, data.data(), data.size()));
   *data_file_size += data.size();
 
   // Now, insert into graph and blocks vector
@@ -336,8 +336,8 @@
 
   // Code will handle buffers of any size that's a multiple of kBlockSize,
   // so we arbitrarily set it to 1024 * kBlockSize.
-  vector<char> new_buf(1024 * kBlockSize);
-  vector<char> old_buf(1024 * kBlockSize);
+  chromeos::Blob new_buf(1024 * kBlockSize);
+  chromeos::Blob old_buf(1024 * kBlockSize);
 
   LOG(INFO) << "Scanning " << block_count << " unwritten blocks";
   vector<Extent> changed_extents;
@@ -355,15 +355,15 @@
       const uint64_t copy_first_block = extent.start_block() + blocks_read;
       const int copy_block_cnt =
           min(new_buf.size() / kBlockSize,
-              static_cast<vector<char>::size_type>(
+              static_cast<chromeos::Blob::size_type>(
                   extent.num_blocks() - blocks_read));
       const size_t count = copy_block_cnt * kBlockSize;
       const off_t offset = copy_first_block * kBlockSize;
-      ssize_t rc = pread(new_image_fd, &new_buf[0], count, offset);
+      ssize_t rc = pread(new_image_fd, new_buf.data(), count, offset);
       TEST_AND_RETURN_FALSE_ERRNO(rc >= 0);
       TEST_AND_RETURN_FALSE(static_cast<size_t>(rc) == count);
 
-      rc = pread(old_image_fd, &old_buf[0], count, offset);
+      rc = pread(old_image_fd, old_buf.data(), count, offset);
       TEST_AND_RETURN_FALSE_ERRNO(rc >= 0);
       TEST_AND_RETURN_FALSE(static_cast<size_t>(rc) == count);
 
@@ -407,7 +407,7 @@
 
   LOG(INFO) << "Compressed " << changed_block_count << " blocks ("
             << block_count - changed_block_count << " blocks unchanged)";
-  vector<char> compressed_data;
+  chromeos::Blob compressed_data;
   if (changed_block_count > 0) {
     LOG(INFO) << "Reading compressed data off disk";
     TEST_AND_RETURN_FALSE(utils::ReadFile(temp_file_path, &compressed_data));
@@ -426,7 +426,7 @@
                                    out_op->mutable_dst_extents());
 
   TEST_AND_RETURN_FALSE(utils::WriteAll(blobs_fd,
-                                        &compressed_data[0],
+                                        compressed_data.data(),
                                         compressed_data.size()));
   LOG(INFO) << "Done processing unwritten blocks";
   return true;
@@ -503,7 +503,7 @@
   LOG_IF(INFO, old_kernel_part.empty()) << "Generating full kernel update...";
 
   DeltaArchiveManifest_InstallOperation op;
-  vector<char> data;
+  chromeos::Blob data;
   TEST_AND_RETURN_FALSE(
       DeltaDiffGenerator::ReadFileToDiff(old_kernel_part,
                                          new_kernel_part,
@@ -535,7 +535,7 @@
   ops->clear();
   ops->push_back(op);
 
-  TEST_AND_RETURN_FALSE(utils::WriteAll(blobs_fd, &data[0], data.size()));
+  TEST_AND_RETURN_FALSE(utils::WriteAll(blobs_fd, data.data(), data.size()));
   *blobs_length += data.size();
 
   LOG(INFO) << "Done delta compressing kernel partition: "
@@ -708,11 +708,11 @@
     off_t chunk_offset,
     off_t chunk_size,
     bool bsdiff_allowed,
-    vector<char>* out_data,
+    chromeos::Blob* out_data,
     DeltaArchiveManifest_InstallOperation* out_op,
     bool gather_extents) {
   // Read new data in
-  vector<char> new_data;
+  chromeos::Blob new_data;
   TEST_AND_RETURN_FALSE(
       utils::ReadFileChunk(new_filename, chunk_offset, chunk_size, &new_data));
 
@@ -720,11 +720,11 @@
   TEST_AND_RETURN_FALSE(chunk_size == -1 ||
                         static_cast<off_t>(new_data.size()) <= chunk_size);
 
-  vector<char> new_data_bz;
+  chromeos::Blob new_data_bz;
   TEST_AND_RETURN_FALSE(BzipCompress(new_data, &new_data_bz));
   CHECK(!new_data_bz.empty());
 
-  vector<char> data;  // Data blob that will be written to delta file.
+  chromeos::Blob data;  // Data blob that will be written to delta file.
 
   DeltaArchiveManifest_InstallOperation operation;
   size_t current_best_size = 0;
@@ -747,7 +747,7 @@
     original = false;
   }
 
-  vector<char> old_data;
+  chromeos::Blob old_data;
   if (original) {
     // Read old data
     TEST_AND_RETURN_FALSE(
@@ -766,18 +766,18 @@
       ScopedPathUnlinker old_unlinker(old_chunk.value());
       TEST_AND_RETURN_FALSE(
           utils::WriteFile(old_chunk.value().c_str(),
-                           &old_data[0], old_data.size()));
+                           old_data.data(), old_data.size()));
       base::FilePath new_chunk;
       TEST_AND_RETURN_FALSE(base::CreateTemporaryFile(&new_chunk));
       ScopedPathUnlinker new_unlinker(new_chunk.value());
       TEST_AND_RETURN_FALSE(
           utils::WriteFile(new_chunk.value().c_str(),
-                           &new_data[0], new_data.size()));
+                           new_data.data(), new_data.size()));
 
-      vector<char> bsdiff_delta;
+      chromeos::Blob bsdiff_delta;
       TEST_AND_RETURN_FALSE(
           BsdiffFiles(old_chunk.value(), new_chunk.value(), &bsdiff_delta));
-      CHECK_GT(bsdiff_delta.size(), static_cast<vector<char>::size_type>(0));
+      CHECK_GT(bsdiff_delta.size(), static_cast<chromeos::Blob::size_type>(0));
       if (bsdiff_delta.size() < current_best_size) {
         operation.set_type(DeltaArchiveManifest_InstallOperation_Type_BSDIFF);
         current_best_size = bsdiff_delta.size();
@@ -863,7 +863,7 @@
   OmahaHashCalculator hasher;
   TEST_AND_RETURN_FALSE(hasher.UpdateFile(partition, size) == size);
   TEST_AND_RETURN_FALSE(hasher.Finalize());
-  const vector<char>& hash = hasher.raw_hash();
+  const chromeos::Blob& hash = hasher.raw_hash();
   info->set_hash(hash.data(), hash.size());
   LOG(INFO) << partition << ": size=" << size << " hash=" << hasher.hash();
   return true;
@@ -1422,15 +1422,15 @@
     if (!op->has_data_offset())
       continue;
     CHECK(op->has_data_length());
-    vector<char> buf(op->data_length());
-    ssize_t rc = pread(in_fd, &buf[0], buf.size(), op->data_offset());
+    chromeos::Blob buf(op->data_length());
+    ssize_t rc = pread(in_fd, buf.data(), buf.size(), op->data_offset());
     TEST_AND_RETURN_FALSE(rc == static_cast<ssize_t>(buf.size()));
 
     // Add the hash of the data blobs for this operation
     TEST_AND_RETURN_FALSE(AddOperationHash(op, buf));
 
     op->set_data_offset(out_file_size);
-    TEST_AND_RETURN_FALSE(writer.Write(&buf[0], buf.size()));
+    TEST_AND_RETURN_FALSE(writer.Write(buf.data(), buf.size()));
     out_file_size += buf.size();
   }
   return true;
@@ -1438,13 +1438,13 @@
 
 bool DeltaDiffGenerator::AddOperationHash(
     DeltaArchiveManifest_InstallOperation* op,
-    const vector<char>& buf) {
+    const chromeos::Blob& buf) {
   OmahaHashCalculator hasher;
 
-  TEST_AND_RETURN_FALSE(hasher.Update(&buf[0], buf.size()));
+  TEST_AND_RETURN_FALSE(hasher.Update(buf.data(), buf.size()));
   TEST_AND_RETURN_FALSE(hasher.Finalize());
 
-  const vector<char>& hash = hasher.raw_hash();
+  const chromeos::Blob& hash = hasher.raw_hash();
   op->set_data_sha256_hash(hash.data(), hash.size());
   return true;
 }
@@ -1844,12 +1844,12 @@
   // Write signature blob.
   if (!private_key_path.empty()) {
     LOG(INFO) << "Signing the update...";
-    vector<char> signature_blob;
+    chromeos::Blob signature_blob;
     TEST_AND_RETURN_FALSE(PayloadSigner::SignPayload(
         output_path,
         vector<string>(1, private_key_path),
         &signature_blob));
-    TEST_AND_RETURN_FALSE(writer.Write(&signature_blob[0],
+    TEST_AND_RETURN_FALSE(writer.Write(signature_blob.data(),
                                        signature_blob.size()));
   }
 
@@ -1866,7 +1866,7 @@
 // 'out'. Returns true on success.
 bool DeltaDiffGenerator::BsdiffFiles(const string& old_file,
                                      const string& new_file,
-                                     vector<char>* out) {
+                                     chromeos::Blob* out) {
   const string kPatchFile = "delta.patchXXXXXX";
   string patch_file_path;
 
@@ -1880,7 +1880,7 @@
   cmd.push_back(patch_file_path);
 
   int rc = 1;
-  vector<char> patch_file;
+  chromeos::Blob patch_file;
   TEST_AND_RETURN_FALSE(Subprocess::SynchronousExec(cmd, &rc, nullptr));
   TEST_AND_RETURN_FALSE(rc == 0);
   TEST_AND_RETURN_FALSE(utils::ReadFile(patch_file_path, out));
diff --git a/payload_generator/delta_diff_generator.h b/payload_generator/delta_diff_generator.h
index 109004e..a6dfa6a 100644
--- a/payload_generator/delta_diff_generator.h
+++ b/payload_generator/delta_diff_generator.h
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include <base/macros.h>
+#include <chromeos/secure_blob.h>
 
 #include "update_engine/payload_generator/graph_types.h"
 #include "update_engine/update_metadata.pb.h"
@@ -118,7 +119,7 @@
                              off_t chunk_offset,
                              off_t chunk_size,
                              bool bsdiff_allowed,
-                             std::vector<char>* out_data,
+                             chromeos::Blob* out_data,
                              DeltaArchiveManifest_InstallOperation* out_op,
                              bool gather_extents);
 
@@ -196,7 +197,7 @@
   // blob will not be available at payload creation time. So, update_engine will
   // gracefully ignore the dummy signature operation.
   static bool AddOperationHash(DeltaArchiveManifest_InstallOperation* op,
-                               const std::vector<char>& buf);
+                               const chromeos::Blob& buf);
 
   // Handles allocation of temp blocks to a cut edge by converting the
   // dest node to a full op. This removes the need for temp blocks, but
@@ -246,7 +247,7 @@
   // |out|. Returns true on success.
   static bool BsdiffFiles(const std::string& old_file,
                           const std::string& new_file,
-                          std::vector<char>* out);
+                          chromeos::Blob* out);
 
   // The |blocks| vector contains a reader and writer for each block on the
   // filesystem that's being in-place updated. We populate the reader/writer
diff --git a/payload_generator/delta_diff_generator_unittest.cc b/payload_generator/delta_diff_generator_unittest.cc
index 9febf70..88e1b75 100644
--- a/payload_generator/delta_diff_generator_unittest.cc
+++ b/payload_generator/delta_diff_generator_unittest.cc
@@ -88,7 +88,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                reinterpret_cast<const char*>(kRandomString),
                                sizeof(kRandomString)));
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
                                                  new_path(),
@@ -178,7 +178,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                random_data.c_str(), file_len));
 
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
                                                  new_path(),
@@ -242,7 +242,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                reinterpret_cast<const char*>(kRandomString),
                                sizeof(kRandomString)));
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
                                                  new_path(),
@@ -274,7 +274,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                reinterpret_cast<const char*>(kRandomString),
                                sizeof(kRandomString)));
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
 
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
@@ -300,7 +300,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                reinterpret_cast<const char*>(kRandomString),
                                sizeof(kRandomString)));
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
 
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
@@ -320,15 +320,14 @@
 }
 
 TEST_F(DeltaDiffGeneratorTest, RunAsRootReplaceSmallTest) {
-  vector<char> new_data;
+  chromeos::Blob new_data;
   for (int i = 0; i < 2; i++) {
     new_data.insert(new_data.end(),
-                    kRandomString,
-                    kRandomString + sizeof(kRandomString));
+                    std::begin(kRandomString), std::end(kRandomString));
     EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
-                                 &new_data[0],
+                                 new_data.data(),
                                  new_data.size()));
-    vector<char> data;
+    chromeos::Blob data;
     DeltaArchiveManifest_InstallOperation op;
     EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
                                                    new_path(),
@@ -362,7 +361,7 @@
   EXPECT_TRUE(utils::WriteFile(new_path().c_str(),
                                reinterpret_cast<const char*>(kRandomString),
                                sizeof(kRandomString)));
-  vector<char> data;
+  chromeos::Blob data;
   DeltaArchiveManifest_InstallOperation op;
   EXPECT_TRUE(DeltaDiffGenerator::ReadFileToDiff(old_path(),
                                                  new_path(),
@@ -713,7 +712,7 @@
   ScopedDirRemover temp_dir_remover(temp_dir);
 
   const size_t kBlockSize = 4096;
-  vector<char> temp_data(kBlockSize * 50);
+  chromeos::Blob temp_data(kBlockSize * 50);
   FillWithData(&temp_data);
   EXPECT_TRUE(WriteFileVector(temp_dir + kFilename, temp_data));
   ScopedPathUnlinker filename_unlinker(temp_dir + kFilename);
@@ -830,7 +829,7 @@
   ScopedDirRemover temp_dir_remover(temp_dir);
 
   const size_t kBlockSize = 4096;
-  vector<char> temp_data(kBlockSize);
+  chromeos::Blob temp_data(kBlockSize);
   FillWithData(&temp_data);
   EXPECT_TRUE(WriteFileVector(temp_dir + kFilename, temp_data));
   ScopedPathUnlinker filename_unlinker(temp_dir + kFilename);
@@ -1091,7 +1090,7 @@
   ScopedDirRemover temp_dir_remover(temp_dir);
 
   const size_t kBlockSize = 4096;
-  vector<char> temp_data(kBlockSize * 3);
+  chromeos::Blob temp_data(kBlockSize * 3);
   FillWithData(&temp_data);
   EXPECT_TRUE(WriteFileVector(temp_dir + kFilename, temp_data));
   ScopedPathUnlinker filename_unlinker(temp_dir + kFilename);
diff --git a/payload_generator/full_update_generator.cc b/payload_generator/full_update_generator.cc
index 2b114f7..f1d6b23 100644
--- a/payload_generator/full_update_generator.cc
+++ b/payload_generator/full_update_generator.cc
@@ -40,8 +40,8 @@
   ~ChunkProcessor() { Wait(); }
 
   off_t offset() const { return offset_; }
-  const vector<char>& buffer_in() const { return buffer_in_; }
-  const vector<char>& buffer_compressed() const { return buffer_compressed_; }
+  const chromeos::Blob& buffer_in() const { return buffer_in_; }
+  const chromeos::Blob& buffer_compressed() const { return buffer_compressed_; }
 
   // Starts the processor. Returns true on success, false on failure.
   bool Start();
@@ -63,8 +63,8 @@
   GThread* thread_;
   int fd_;
   off_t offset_;
-  vector<char> buffer_in_;
-  vector<char> buffer_compressed_;
+  chromeos::Blob buffer_in_;
+  chromeos::Blob buffer_compressed_;
 
   DISALLOW_COPY_AND_ASSIGN(ChunkProcessor);
 };
@@ -174,13 +174,14 @@
       }
 
       const bool compress = processor->ShouldCompress();
-      const vector<char>& use_buf =
+      const chromeos::Blob& use_buf =
           compress ? processor->buffer_compressed() : processor->buffer_in();
       op->set_type(compress ?
                    DeltaArchiveManifest_InstallOperation_Type_REPLACE_BZ :
                    DeltaArchiveManifest_InstallOperation_Type_REPLACE);
       op->set_data_offset(*data_file_size);
-      TEST_AND_RETURN_FALSE(utils::WriteAll(fd, &use_buf[0], use_buf.size()));
+      TEST_AND_RETURN_FALSE(utils::WriteAll(fd, use_buf.data(),
+                                            use_buf.size()));
       *data_file_size += use_buf.size();
       op->set_data_length(use_buf.size());
       Extent* dst_extent = op->add_dst_extents();
diff --git a/payload_generator/full_update_generator_unittest.cc b/payload_generator/full_update_generator_unittest.cc
index 95a40ae..9f4aad5 100644
--- a/payload_generator/full_update_generator_unittest.cc
+++ b/payload_generator/full_update_generator_unittest.cc
@@ -26,8 +26,8 @@
 
 
 TEST(FullUpdateGeneratorTest, RunTest) {
-  vector<char> new_root(20 * 1024 * 1024);
-  vector<char> new_kern(16 * 1024 * 1024);
+  chromeos::Blob new_root(20 * 1024 * 1024);
+  chromeos::Blob new_kern(16 * 1024 * 1024);
   const off_t kChunkSize = 128 * 1024;
   FillWithData(&new_root);
   FillWithData(&new_kern);
diff --git a/payload_generator/generate_delta_main.cc b/payload_generator/generate_delta_main.cc
index c0dfe18..cbcbaf0 100644
--- a/payload_generator/generate_delta_main.cc
+++ b/payload_generator/generate_delta_main.cc
@@ -103,7 +103,7 @@
   LOG_IF(FATAL, out_hash_file.empty())
       << "Must pass --out_hash_file to calculate hash for signing.";
 
-  vector<char> hash;
+  chromeos::Blob hash;
   bool result = PayloadSigner::HashPayloadForSigning(in_file, sizes,
                                                      &hash);
   CHECK(result);
@@ -123,7 +123,7 @@
   LOG_IF(FATAL, out_metadata_hash_file.empty())
       << "Must pass --out_metadata_hash_file to calculate metadata hash.";
 
-  vector<char> hash;
+  chromeos::Blob hash;
   bool result = PayloadSigner::HashMetadataForSigning(in_file, sizes,
                                                       &hash);
   CHECK(result);
@@ -145,11 +145,11 @@
       << "Must pass --out_file to sign payload.";
   LOG_IF(FATAL, signature_file.empty())
       << "Must pass --signature_file to sign payload.";
-  vector<vector<char>> signatures;
+  vector<chromeos::Blob> signatures;
   vector<string> signature_files;
   base::SplitString(signature_file, ':', &signature_files);
   for (const string& signature_file : signature_files) {
-    vector<char> signature;
+    chromeos::Blob signature;
     CHECK(utils::ReadFile(signature_file, &signature));
     signatures.push_back(signature);
   }
@@ -201,16 +201,16 @@
   DeltaPerformer performer(&prefs, nullptr, &install_plan);
   CHECK_EQ(performer.Open(old_image.c_str(), 0, 0), 0);
   CHECK(performer.OpenKernel(old_kernel.c_str()));
-  vector<char> buf(1024 * 1024);
+  chromeos::Blob buf(1024 * 1024);
   int fd = open(in_file.c_str(), O_RDONLY, 0);
   CHECK_GE(fd, 0);
   ScopedFdCloser fd_closer(&fd);
   for (off_t offset = 0;; offset += buf.size()) {
     ssize_t bytes_read;
-    CHECK(utils::PReadAll(fd, &buf[0], buf.size(), offset, &bytes_read));
+    CHECK(utils::PReadAll(fd, buf.data(), buf.size(), offset, &bytes_read));
     if (bytes_read == 0)
       break;
-    CHECK_EQ(performer.Write(&buf[0], bytes_read), bytes_read);
+    CHECK_EQ(performer.Write(buf.data(), bytes_read), bytes_read);
   }
   CHECK_EQ(performer.Close(), 0);
   DeltaPerformer::ResetUpdateProgress(&prefs, false);
diff --git a/payload_generator/metadata.cc b/payload_generator/metadata.cc
index 4e0265a..7a6493c 100644
--- a/payload_generator/metadata.cc
+++ b/payload_generator/metadata.cc
@@ -36,7 +36,7 @@
 // Read data from the specified extents.
 bool ReadExtentsData(const ext2_filsys fs,
                      const vector<Extent>& extents,
-                     vector<char>* data) {
+                     chromeos::Blob* data) {
   // Resize the data buffer to hold all data in the extents
   size_t num_data_blocks = 0;
   for (const Extent& extent : extents) {
@@ -69,9 +69,9 @@
 }
 
 // Compute the bsdiff between two metadata blobs.
-bool ComputeMetadataBsdiff(const vector<char>& old_metadata,
-                           const vector<char>& new_metadata,
-                           vector<char>* bsdiff_delta) {
+bool ComputeMetadataBsdiff(const chromeos::Blob& old_metadata,
+                           const chromeos::Blob& new_metadata,
+                           chromeos::Blob* bsdiff_delta) {
   const string kTempFileTemplate("CrAU_temp_data.XXXXXX");
 
   // Write the metadata buffers to temporary files
@@ -83,7 +83,7 @@
   ScopedPathUnlinker temp_old_file_path_unlinker(temp_old_file_path);
   ScopedFdCloser old_fd_closer(&old_fd);
   TEST_AND_RETURN_FALSE(utils::WriteAll(old_fd,
-                                        &old_metadata[0],
+                                        old_metadata.data(),
                                         old_metadata.size()));
 
   int new_fd;
@@ -94,7 +94,7 @@
   ScopedPathUnlinker temp_new_file_path_unlinker(temp_new_file_path);
   ScopedFdCloser new_fd_closer(&new_fd);
   TEST_AND_RETURN_FALSE(utils::WriteAll(new_fd,
-                                        &new_metadata[0],
+                                        new_metadata.data(),
                                         new_metadata.size()));
 
   // Perform bsdiff on these files
@@ -115,19 +115,19 @@
                         const vector<Extent>& extents,
                         int data_fd,
                         off_t* data_file_size) {
-  vector<char> data;  // Data blob that will be written to delta file.
+  chromeos::Blob data;  // Data blob that will be written to delta file.
   DeltaArchiveManifest_InstallOperation op;
 
   {
     // Read in the metadata blocks from the old and new image.
-    vector<char> old_data;
+    chromeos::Blob old_data;
     TEST_AND_RETURN_FALSE(ReadExtentsData(fs_old, extents, &old_data));
 
-    vector<char> new_data;
+    chromeos::Blob new_data;
     TEST_AND_RETURN_FALSE(ReadExtentsData(fs_new, extents, &new_data));
 
     // Determine the best way to compress this.
-    vector<char> new_data_bz;
+    chromeos::Blob new_data_bz;
     TEST_AND_RETURN_FALSE(BzipCompress(new_data, &new_data_bz));
     CHECK(!new_data_bz.empty());
 
@@ -149,11 +149,11 @@
       data.clear();
     } else {
       // Try bsdiff of old to new data
-      vector<char> bsdiff_delta;
+      chromeos::Blob bsdiff_delta;
       TEST_AND_RETURN_FALSE(ComputeMetadataBsdiff(old_data,
                                                   new_data,
                                                   &bsdiff_delta));
-      CHECK_GT(bsdiff_delta.size(), static_cast<vector<char>::size_type>(0));
+      CHECK_GT(bsdiff_delta.size(), 0u);
 
       if (bsdiff_delta.size() < current_best_size) {
         op.set_type(DeltaArchiveManifest_InstallOperation_Type_BSDIFF);
@@ -182,7 +182,7 @@
     op.set_data_length(data.size());
   }
 
-  TEST_AND_RETURN_FALSE(utils::WriteAll(data_fd, &data[0], data.size()));
+  TEST_AND_RETURN_FALSE(utils::WriteAll(data_fd, data.data(), data.size()));
   *data_file_size += data.size();
 
   // Now, insert into graph and blocks vector
diff --git a/payload_generator/payload_signer.cc b/payload_generator/payload_signer.cc
index f3cc4de..6e0b4ee 100644
--- a/payload_generator/payload_signer.cc
+++ b/payload_generator/payload_signer.cc
@@ -26,8 +26,8 @@
 
 // Given raw |signatures|, packs them into a protobuf and serializes it into a
 // binary blob. Returns true on success, false otherwise.
-bool ConvertSignatureToProtobufBlob(const vector<vector<char>>& signatures,
-                                    vector<char>* out_signature_blob) {
+bool ConvertSignatureToProtobufBlob(const vector<chromeos::Blob>& signatures,
+                                    chromeos::Blob* out_signature_blob) {
   // Pack it into a protobuf
   Signatures out_message;
   uint32_t version = kSignatureMessageOriginalVersion;
@@ -37,7 +37,7 @@
       << kSignatureMessageOriginalVersion << ", "
       << kSignatureMessageCurrentVersion << "] inclusive, but you only "
       << "provided " << signatures.size() << " signatures.";
-  for (const vector<char>& signature : signatures) {
+  for (const chromeos::Blob& signature : signatures) {
     Signatures_Signature* sig_message = out_message.add_signatures();
     sig_message->set_version(version++);
     sig_message->set_data(signature.data(), signature.size());
@@ -61,14 +61,14 @@
 // true on success, false otherwise.
 bool AddSignatureOpToPayload(const string& payload_path,
                              uint64_t signature_blob_size,
-                             vector<char>* out_payload,
+                             chromeos::Blob* out_payload,
                              uint64_t* out_metadata_size,
                              uint64_t* out_signatures_offset) {
   const int kProtobufOffset = 20;
   const int kProtobufSizeOffset = 12;
 
   // Loads the payload.
-  vector<char> payload;
+  chromeos::Blob payload;
   DeltaArchiveManifest manifest;
   uint64_t metadata_size;
   TEST_AND_RETURN_FALSE(PayloadVerifier::LoadPayload(
@@ -121,9 +121,9 @@
 }
 }  // namespace
 
-bool PayloadSigner::SignHash(const vector<char>& hash,
+bool PayloadSigner::SignHash(const chromeos::Blob& hash,
                              const string& private_key_path,
-                             vector<char>* out_signature) {
+                             chromeos::Blob* out_signature) {
   LOG(INFO) << "Signing hash with private key: " << private_key_path;
   string sig_path;
   TEST_AND_RETURN_FALSE(
@@ -136,7 +136,7 @@
   ScopedPathUnlinker hash_path_unlinker(hash_path);
   // We expect unpadded SHA256 hash coming in
   TEST_AND_RETURN_FALSE(hash.size() == 32);
-  vector<char> padded_hash(hash);
+  chromeos::Blob padded_hash(hash);
   PayloadVerifier::PadRSA2048SHA256Hash(&padded_hash);
   TEST_AND_RETURN_FALSE(utils::WriteFile(hash_path.c_str(),
                                          padded_hash.data(),
@@ -161,7 +161,7 @@
                                                     nullptr));
   TEST_AND_RETURN_FALSE(return_code == 0);
 
-  vector<char> signature;
+  chromeos::Blob signature;
   TEST_AND_RETURN_FALSE(utils::ReadFile(sig_path, &signature));
   out_signature->swap(signature);
   return true;
@@ -169,15 +169,15 @@
 
 bool PayloadSigner::SignPayload(const string& unsigned_payload_path,
                                 const vector<string>& private_key_paths,
-                                vector<char>* out_signature_blob) {
-  vector<char> hash_data;
+                                chromeos::Blob* out_signature_blob) {
+  chromeos::Blob hash_data;
   TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfFile(
       unsigned_payload_path, -1, &hash_data) ==
                         utils::FileSize(unsigned_payload_path));
 
-  vector<vector<char>> signatures;
+  vector<chromeos::Blob> signatures;
   for (const string& path : private_key_paths) {
-    vector<char> signature;
+    chromeos::Blob signature;
     TEST_AND_RETURN_FALSE(SignHash(hash_data, path, &signature));
     signatures.push_back(signature);
   }
@@ -196,7 +196,7 @@
   ScopedPathUnlinker x_path_unlinker(x_path);
   TEST_AND_RETURN_FALSE(utils::WriteFile(x_path.c_str(), "x", 1));
 
-  vector<char> sig_blob;
+  chromeos::Blob sig_blob;
   TEST_AND_RETURN_FALSE(PayloadSigner::SignPayload(x_path,
                                                    private_key_paths,
                                                    &sig_blob));
@@ -207,17 +207,17 @@
 bool PayloadSigner::PrepPayloadForHashing(
         const string& payload_path,
         const vector<int>& signature_sizes,
-        vector<char>* payload_out,
+        chromeos::Blob* payload_out,
         uint64_t* metadata_size_out,
         uint64_t* signatures_offset_out) {
   // TODO(petkov): Reduce memory usage -- the payload is manipulated in memory.
 
   // Loads the payload and adds the signature op to it.
-  vector<vector<char>> signatures;
+  vector<chromeos::Blob> signatures;
   for (int signature_size : signature_sizes) {
     signatures.emplace_back(signature_size, 0);
   }
-  vector<char> signature_blob;
+  chromeos::Blob signature_blob;
   TEST_AND_RETURN_FALSE(ConvertSignatureToProtobufBlob(signatures,
                                                        &signature_blob));
   TEST_AND_RETURN_FALSE(AddSignatureOpToPayload(payload_path,
@@ -231,8 +231,8 @@
 
 bool PayloadSigner::HashPayloadForSigning(const string& payload_path,
                                           const vector<int>& signature_sizes,
-                                          vector<char>* out_hash_data) {
-  vector<char> payload;
+                                          chromeos::Blob* out_hash_data) {
+  chromeos::Blob payload;
   uint64_t metadata_size;
   uint64_t signatures_offset;
 
@@ -244,7 +244,7 @@
 
   // Calculates the hash on the updated payload. Note that we stop calculating
   // before we reach the signature information.
-  TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfBytes(&payload[0],
+  TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfBytes(payload.data(),
                                                             signatures_offset,
                                                             out_hash_data));
   return true;
@@ -252,8 +252,8 @@
 
 bool PayloadSigner::HashMetadataForSigning(const string& payload_path,
                                            const vector<int>& signature_sizes,
-                                           vector<char>* out_metadata_hash) {
-  vector<char> payload;
+                                           chromeos::Blob* out_metadata_hash) {
+  chromeos::Blob payload;
   uint64_t metadata_size;
   uint64_t signatures_offset;
 
@@ -264,7 +264,7 @@
                                               &signatures_offset));
 
   // Calculates the hash on the manifest.
-  TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfBytes(&payload[0],
+  TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfBytes(payload.data(),
                                                             metadata_size,
                                                             out_metadata_hash));
   return true;
@@ -272,16 +272,16 @@
 
 bool PayloadSigner::AddSignatureToPayload(
     const string& payload_path,
-    const vector<vector<char>>& signatures,
+    const vector<chromeos::Blob>& signatures,
     const string& signed_payload_path,
     uint64_t *out_metadata_size) {
   // TODO(petkov): Reduce memory usage -- the payload is manipulated in memory.
 
   // Loads the payload and adds the signature op to it.
-  vector<char> signature_blob;
+  chromeos::Blob signature_blob;
   TEST_AND_RETURN_FALSE(ConvertSignatureToProtobufBlob(signatures,
                                                        &signature_blob));
-  vector<char> payload;
+  chromeos::Blob payload;
   uint64_t signatures_offset;
   TEST_AND_RETURN_FALSE(AddSignatureOpToPayload(payload_path,
                                                 signature_blob.size(),
@@ -302,24 +302,23 @@
   return true;
 }
 
-bool PayloadSigner::GetMetadataSignature(const char* const metadata,
+bool PayloadSigner::GetMetadataSignature(const void* const metadata,
                                          size_t metadata_size,
                                          const string& private_key_path,
                                          string* out_signature) {
   // Calculates the hash on the updated payload. Note that the payload includes
   // the signature op but doesn't include the signature blob at the end.
-  vector<char> metadata_hash;
+  chromeos::Blob metadata_hash;
   TEST_AND_RETURN_FALSE(OmahaHashCalculator::RawHashOfBytes(metadata,
                                                             metadata_size,
                                                             &metadata_hash));
 
-  vector<char> signature;
+  chromeos::Blob signature;
   TEST_AND_RETURN_FALSE(SignHash(metadata_hash,
                                  private_key_path,
                                  &signature));
 
-  *out_signature = chromeos::data_encoding::Base64Encode(signature.data(),
-                                                         signature.size());
+  *out_signature = chromeos::data_encoding::Base64Encode(signature);
   return true;
 }
 
diff --git a/payload_generator/payload_signer.h b/payload_generator/payload_signer.h
index 4a35785..a17a984 100644
--- a/payload_generator/payload_signer.h
+++ b/payload_generator/payload_signer.h
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include <base/macros.h>
+#include <chromeos/secure_blob.h>
 
 #include "update_engine/update_metadata.pb.h"
 
@@ -21,9 +22,9 @@
  public:
   // Given a raw |hash| and a private key in |private_key_path| calculates the
   // raw signature in |out_signature|. Returns true on success, false otherwise.
-  static bool SignHash(const std::vector<char>& hash,
+  static bool SignHash(const chromeos::Blob& hash,
                        const std::string& private_key_path,
-                       std::vector<char>* out_signature);
+                       chromeos::Blob* out_signature);
 
   // Given an unsigned payload in |unsigned_payload_path| and private keys in
   // |private_key_path|, calculates the signature blob into
@@ -32,7 +33,7 @@
   // false otherwise.
   static bool SignPayload(const std::string& unsigned_payload_path,
                           const std::vector<std::string>& private_key_paths,
-                          std::vector<char>* out_signature_blob);
+                          chromeos::Blob* out_signature_blob);
 
   // Returns the length of out_signature_blob that will result in a call
   // to SignPayload with the given private keys. Returns true on success.
@@ -46,7 +47,7 @@
   static bool PrepPayloadForHashing(
         const std::string& payload_path,
         const std::vector<int>& signature_sizes,
-        std::vector<char>* payload_out,
+        chromeos::Blob* payload_out,
         uint64_t* metadata_size_out,
         uint64_t* signatures_offset_out);
 
@@ -61,7 +62,7 @@
   // The dummy signatures are not preserved or written to disk.
   static bool HashPayloadForSigning(const std::string& payload_path,
                                     const std::vector<int>& signature_sizes,
-                                    std::vector<char>* out_hash_data);
+                                    chromeos::Blob* out_hash_data);
 
   // Given an unsigned payload in |payload_path|,
   // this method does two things:
@@ -75,7 +76,7 @@
   // The dummy signatures are not preserved or written to disk.
   static bool HashMetadataForSigning(const std::string& payload_path,
                                      const std::vector<int>& signature_sizes,
-                                     std::vector<char>* out_metadata_hash);
+                                     chromeos::Blob* out_metadata_hash);
 
   // Given an unsigned payload in |payload_path| (with no dummy signature op)
   // and the raw |signatures| updates the payload to include the signature thus
@@ -86,7 +87,7 @@
   // on success, false otherwise.
   static bool AddSignatureToPayload(
       const std::string& payload_path,
-      const std::vector<std::vector<char>>& signatures,
+      const std::vector<chromeos::Blob>& signatures,
       const std::string& signed_payload_path,
       uint64_t* out_metadata_size);
 
@@ -94,7 +95,7 @@
   // and signs the hash with the given private_key_path and writes the signed
   // hash in |out_signature|. Returns true if successful or false if there was
   // any error in the computations.
-  static bool GetMetadataSignature(const char* const metadata,
+  static bool GetMetadataSignature(const void* const metadata,
                                    size_t metadata_size,
                                    const std::string& private_key_path,
                                    std::string* out_signature);
diff --git a/payload_generator/payload_signer_unittest.cc b/payload_generator/payload_signer_unittest.cc
index c2cd209..d74cdfb 100644
--- a/payload_generator/payload_signer_unittest.cc
+++ b/payload_generator/payload_signer_unittest.cc
@@ -34,7 +34,7 @@
 // Generated by:
 // echo -n 'This is some data to sign.' | openssl dgst -sha256 -binary |
 //   hexdump -v -e '" " 8/1 "0x%02x, " "\n"'
-const unsigned char kDataHash[] = {
+const uint8_t kDataHash[] = {
   0x7a, 0x07, 0xa6, 0x44, 0x08, 0x86, 0x20, 0xa6,
   0xc1, 0xf8, 0xd9, 0x02, 0x05, 0x63, 0x0d, 0xb7,
   0xfc, 0x2b, 0xa0, 0xa9, 0x7c, 0x9d, 0x1d, 0x8c,
@@ -46,7 +46,7 @@
 // echo -n 'This is some data to sign.' | openssl dgst -sha256 -binary |
 //    ~/local/bin/openssl pkeyutl -sign -inkey unittest_key.pem -pkeyopt
 //    digest:sha256 | hexdump -v -e '" " 8/1 "0x%02x, " "\n"'
-const unsigned char kDataSignature[] = {
+const uint8_t kDataSignature[] = {
   0x9f, 0x86, 0x25, 0x8b, 0xf3, 0xcc, 0xe3, 0x95,
   0x5f, 0x45, 0x83, 0xb2, 0x66, 0xf0, 0x2a, 0xcf,
   0xb7, 0xaa, 0x52, 0x25, 0x7a, 0xdd, 0x9d, 0x65,
@@ -82,7 +82,7 @@
 };
 
 namespace {
-void SignSampleData(vector<char>* out_signature_blob) {
+void SignSampleData(chromeos::Blob* out_signature_blob) {
   string data_path;
   ASSERT_TRUE(
       utils::MakeTempFile("data.XXXXXX", &data_path, nullptr));
@@ -104,12 +104,12 @@
 }  // namespace
 
 TEST(PayloadSignerTest, SimpleTest) {
-  vector<char> signature_blob;
+  chromeos::Blob signature_blob;
   SignSampleData(&signature_blob);
 
   // Check the signature itself
   Signatures signatures;
-  EXPECT_TRUE(signatures.ParseFromArray(&signature_blob[0],
+  EXPECT_TRUE(signatures.ParseFromArray(signature_blob.data(),
                                         signature_blob.size()));
   EXPECT_EQ(1, signatures.signatures_size());
   const Signatures_Signature& signature = signatures.signatures(0);
@@ -117,21 +117,19 @@
   const string sig_data = signature.data();
   ASSERT_EQ(arraysize(kDataSignature), sig_data.size());
   for (size_t i = 0; i < arraysize(kDataSignature); i++) {
-    EXPECT_EQ(static_cast<char>(kDataSignature[i]), sig_data[i]);
+    EXPECT_EQ(kDataSignature[i], static_cast<uint8_t>(sig_data[i]));
   }
 }
 
 TEST(PayloadSignerTest, VerifySignatureTest) {
-  vector<char> signature_blob;
+  chromeos::Blob signature_blob;
   SignSampleData(&signature_blob);
 
-  vector<char> hash_data;
+  chromeos::Blob hash_data;
   EXPECT_TRUE(PayloadVerifier::VerifySignature(signature_blob,
                                              kUnittestPublicKeyPath,
                                              &hash_data));
-  vector<char> padded_hash_data(reinterpret_cast<const char *>(kDataHash),
-                                reinterpret_cast<const char *>(kDataHash +
-                                                         sizeof(kDataHash)));
+  chromeos::Blob padded_hash_data(std::begin(kDataHash), std::end(kDataHash));
   PayloadVerifier::PadRSA2048SHA256Hash(&padded_hash_data);
   ASSERT_EQ(padded_hash_data.size(), hash_data.size());
   for (size_t i = 0; i < padded_hash_data.size(); i++) {