diff --git a/src/lib/crypto/dl_ossl.cpp b/src/lib/crypto/dl_ossl.cpp
index caf7805eb..b43eeb10b 100644
--- a/src/lib/crypto/dl_ossl.cpp
+++ b/src/lib/crypto/dl_ossl.cpp
@@ -71,7 +71,7 @@ dl_load_key(const pgp::mpi &mp,
     if (!p || (mq && !q) || !g || !y || (mx && !x)) {
         /* LCOV_EXCL_START */
         RNP_LOG("out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -80,14 +80,14 @@ dl_load_key(const pgp::mpi &mp,
     if (!params) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to build dsa params");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     rnp::ossl::evp::PKeyCtx ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_DH, NULL));
     if (!ctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to create dl context");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     EVP_PKEY *rawkey = NULL;
@@ -102,33 +102,33 @@ dl_load_key(const pgp::mpi &mp,
     if (!dh) {
         /* LCOV_EXCL_START */
         RNP_LOG("out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     /* line below must not fail */
     int res = DH_set0_pqg(dh.get(), p.own(), q.own(), g.own());
     assert(res == 1);
     if (res < 1) {
-        return NULL;
+        return nullptr;
     }
     /* line below must not fail */
     res = DH_set0_key(dh.get(), y.own(), x.own());
     assert(res == 1);
     if (res < 1) {
-        return NULL;
+        return nullptr;
     }
 
     rnp::ossl::evp::PKey evpkey(EVP_PKEY_new());
     if (!evpkey) {
         /* LCOV_EXCL_START */
         RNP_LOG("allocation failed");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EVP_PKEY_set1_DH(evpkey.get(), dh.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     return evpkey;
diff --git a/src/lib/crypto/dsa_ossl.cpp b/src/lib/crypto/dsa_ossl.cpp
index bc9848148..b97798cba 100644
--- a/src/lib/crypto/dsa_ossl.cpp
+++ b/src/lib/crypto/dsa_ossl.cpp
@@ -86,7 +86,7 @@ build_params(rnp::bn &p, rnp::bn &q, rnp::bn &g, rnp::bn &y, rnp::bn &x)
         !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_FFC_G, g.get()) ||
         !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_PUB_KEY, y.get()) ||
         (x && !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_PRIV_KEY, x.get()))) {
-        return NULL; // LCOV_EXCL_LINE
+        return nullptr; // LCOV_EXCL_LINE
     }
     return rnp::ossl::Param(OSSL_PARAM_BLD_to_param(bld.get()));
 }
@@ -104,7 +104,7 @@ load_key(const Key &key, bool secret = false)
     if (!p || !q || !g || !y || (secret && !x)) {
         /* LCOV_EXCL_START */
         RNP_LOG("out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -113,14 +113,14 @@ load_key(const Key &key, bool secret = false)
     if (!params) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to build dsa params");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     rnp::ossl::evp::PKeyCtx ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_DSA, NULL));
     if (!ctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to create dsa context");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     EVP_PKEY *rawkey = NULL;
@@ -130,7 +130,7 @@ load_key(const Key &key, bool secret = false)
                            secret ? EVP_PKEY_KEYPAIR : EVP_PKEY_PUBLIC_KEY,
                            params.get()) != 1)) {
         RNP_LOG("failed to create key from data");
-        return NULL;
+        return nullptr;
     }
     return rnp::ossl::evp::PKey(rawkey);
 #else
@@ -138,19 +138,19 @@ load_key(const Key &key, bool secret = false)
     if (!dsa) {
         /* LCOV_EXCL_START */
         RNP_LOG("Out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (DSA_set0_pqg(dsa.get(), p.own(), q.own(), g.own()) != 1) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set pqg. Error: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (DSA_set0_key(dsa.get(), y.own(), x.own()) != 1) {
         /* LCOV_EXCL_START */
         RNP_LOG("Secret key load error: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -158,13 +158,13 @@ load_key(const Key &key, bool secret = false)
     if (!evpkey) {
         /* LCOV_EXCL_START */
         RNP_LOG("allocation failed");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EVP_PKEY_set1_DSA(evpkey.get(), dsa.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     return evpkey;
diff --git a/src/lib/crypto/ec_ossl.cpp b/src/lib/crypto/ec_ossl.cpp
index cf57e271a..40d51ba89 100644
--- a/src/lib/crypto/ec_ossl.cpp
+++ b/src/lib/crypto/ec_ossl.cpp
@@ -60,17 +60,17 @@ rnp::ossl::evp::PKey
 generate_pkey(const pgp_pubkey_alg_t alg_id, const pgp_curve_t curve)
 {
     if (!Curve::alg_allows(alg_id, curve)) {
-        return NULL;
+        return nullptr;
     }
     auto ec_desc = Curve::get(curve);
     if (!ec_desc) {
-        return NULL;
+        return nullptr;
     }
     int nid = OBJ_sn2nid(ec_desc->openssl_name);
     if (nid == NID_undef) {
         /* LCOV_EXCL_START */
         RNP_LOG("Unknown SN: %s", ec_desc->openssl_name);
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     bool                    raw = is_raw_key(curve);
@@ -78,19 +78,19 @@ generate_pkey(const pgp_pubkey_alg_t alg_id, const pgp_curve_t curve)
     if (!ctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to create ctx: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EVP_PKEY_keygen_init(ctx.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to init keygen: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (!raw && (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), nid) <= 0)) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set curve nid: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     EVP_PKEY *rawkey = NULL;
@@ -179,7 +179,7 @@ load_raw_key(const pgp::mpi &keyp, const pgp::mpi *keyx, int nid)
         /* as per RFC, EdDSA & 25519 keys must use 0x40 byte for encoding */
         if ((keyp.bytes() != 33) || (keyp.mpi[0] != 0x40)) {
             RNP_LOG("Invalid 25519 public key.");
-            return NULL;
+            nullptr
         }
         rnp::ossl::evp::PKey evpkey(
           EVP_PKEY_new_raw_public_key(nid, NULL, &keyp.mpi[1], keyp.bytes() - 1));
@@ -193,7 +193,7 @@ load_raw_key(const pgp::mpi &keyp, const pgp::mpi *keyx, int nid)
     if (nid == EVP_PKEY_X25519) {
         if (keyx->len != 32) {
             RNP_LOG("Invalid 25519 secret key");
-            return NULL;
+            return nullptr;
         }
         /* need to reverse byte order since in mpi we have big-endian */
         rnp::secure_array<uint8_t, 32> prkey;
@@ -204,7 +204,7 @@ load_raw_key(const pgp::mpi &keyp, const pgp::mpi *keyx, int nid)
     } else {
         if (keyx->len > 32) {
             RNP_LOG("Invalid Ed25519 secret key");
-            return NULL;
+            return nullptr;
         }
         /* keyx->len may be smaller then 32 as high byte is random and could become 0 */
         rnp::secure_array<uint8_t, 32> prkey{};
@@ -223,13 +223,13 @@ build_params(const pgp::mpi &p, const pgp::mpi *x, const char *curve)
 {
     rnp::ossl::ParamBld bld(OSSL_PARAM_BLD_new());
     if (!bld) {
-        return NULL;
+        return nullptr;
     }
     rnp::bn bx(x);
     if (!OSSL_PARAM_BLD_push_utf8_string(bld.get(), OSSL_PKEY_PARAM_GROUP_NAME, curve, 0) ||
         !OSSL_PARAM_BLD_push_octet_string(bld.get(), OSSL_PKEY_PARAM_PUB_KEY, p.mpi, p.len) ||
         (x && !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_PRIV_KEY, bx.get()))) {
-        return NULL; // LCOV_EXCL_LINE
+        return nullptr; // LCOV_EXCL_LINE
     }
     return rnp::ossl::Param(OSSL_PARAM_BLD_to_param(bld.get()));
 }
@@ -241,14 +241,14 @@ load_key_openssl3(const pgp::mpi &keyp, const pgp::mpi *keyx, const Curve &curv_
     if (!params) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to build ec params");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     rnp::ossl::evp::PKeyCtx ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL));
     if (!ctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("failed to create ec context");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     EVP_PKEY *evpkey = NULL;
@@ -271,17 +271,17 @@ load_key(const pgp::mpi &keyp, const pgp::mpi *keyx, pgp_curve_t curve)
     auto curv_desc = Curve::get(curve);
     if (!curv_desc) {
         RNP_LOG("unknown curve");
-        return NULL;
+        return nullptr;
     }
     if (!Curve::is_supported(curve)) {
         RNP_LOG("Curve %s is not supported.", curv_desc->pgp_name);
-        return NULL;
+        return nullptr;
     }
     int nid = OBJ_sn2nid(curv_desc->openssl_name);
     if (nid == NID_undef) {
         /* LCOV_EXCL_START */
         RNP_LOG("Unknown SN: %s", curv_desc->openssl_name);
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     /* EdDSA and X25519 keys are loaded in a different way */
@@ -297,7 +297,7 @@ load_key(const pgp::mpi &keyp, const pgp::mpi *keyx, pgp_curve_t curve)
         RNP_LOG("Failed to create EC key with group %s: %s",
                 curv_desc->openssl_name,
                 rnp::ossl::latest_err());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -306,19 +306,19 @@ load_key(const pgp::mpi &keyp, const pgp::mpi *keyx, pgp_curve_t curve)
     if (!p) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to allocate point: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EC_POINT_oct2point(group, p.get(), keyp.mpi, keyp.len, NULL) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to decode point: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EC_KEY_set_public_key(ec.get(), p.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set public key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -326,12 +326,12 @@ load_key(const pgp::mpi &keyp, const pgp::mpi *keyx, pgp_curve_t curve)
     if (!pkey) {
         /* LCOV_EXCL_START */
         RNP_LOG("EVP_PKEY allocation failed: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
     if (EVP_PKEY_set1_EC_KEY(pkey.get(), ec.get()) <= 0) {
-        return NULL;
+        return nullptr;
     }
 
     if (!keyx) {
@@ -342,13 +342,13 @@ load_key(const pgp::mpi &keyp, const pgp::mpi *keyx, pgp_curve_t curve)
     if (!x) {
         /* LCOV_EXCL_START */
         RNP_LOG("allocation failed");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     if (EC_KEY_set_private_key(ec.get(), x.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set secret key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     return pkey;
diff --git a/src/lib/crypto/hash_common.cpp b/src/lib/crypto/hash_common.cpp
index 92a4d01c3..f9d6cb3fa 100644
--- a/src/lib/crypto/hash_common.cpp
+++ b/src/lib/crypto/hash_common.cpp
@@ -186,7 +186,7 @@ HashList::get(pgp_hash_alg_t alg) const
             return hash.get();
         }
     }
-    return NULL;
+    return nullptr;
 }
 
 void
diff --git a/src/lib/crypto/rsa_ossl.cpp b/src/lib/crypto/rsa_ossl.cpp
index 10ba6ed95..bb456dca9 100644
--- a/src/lib/crypto/rsa_ossl.cpp
+++ b/src/lib/crypto/rsa_ossl.cpp
@@ -54,14 +54,14 @@ load_public_key(const Key &key)
     if (!n || !e || !rsa) {
         /* LCOV_EXCL_START */
         RNP_LOG("out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     /* OpenSSL set0 function transfers ownership of bignums */
     if (RSA_set0_key(rsa.get(), n.own(), e.own(), NULL) != 1) {
         /* LCOV_EXCL_START */
         RNP_LOG("Public key load error: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -69,7 +69,7 @@ load_public_key(const Key &key)
     if (!evpkey || (EVP_PKEY_set1_RSA(evpkey.get(), rsa.get()) <= 0)) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     return evpkey;
@@ -88,7 +88,7 @@ load_secret_key(const Key &key)
     if (!n || !p || !q || !e || !d || !rsa) {
         /* LCOV_EXCL_START */
         RNP_LOG("out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -96,14 +96,14 @@ load_secret_key(const Key &key)
     if (RSA_set0_key(rsa.get(), n.own(), e.own(), d.own()) != 1) {
         /* LCOV_EXCL_START */
         RNP_LOG("Secret key load error: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     /* OpenSSL has p < q, as we do */
     if (RSA_set0_factors(rsa.get(), p.own(), q.own()) != 1) {
         /* LCOV_EXCL_START */
         RNP_LOG("Factors load error: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -111,7 +111,7 @@ load_secret_key(const Key &key)
     if (!evpkey || (EVP_PKEY_set1_RSA(evpkey.get(), rsa.get()) <= 0)) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to set key: %lu", ERR_peek_last_error());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     return evpkey;
@@ -141,7 +141,7 @@ bld_params(const Key &key, bool secret)
     if (!n || !e || !bld) {
         /* LCOV_EXCL_START */
         RNP_LOG("Out of memory");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -149,7 +149,7 @@ bld_params(const Key &key, bool secret)
         !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_RSA_E, e.get())) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to push RSA params.");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
 
@@ -171,14 +171,14 @@ bld_params(const Key &key, bool secret)
     rnp::bn u(key.u);
 
     if (!d || !p || !q || !u) {
-        return NULL; // LCOV_EXCL_LINE
+        return nullptr; // LCOV_EXCL_LINE
     }
     /* We need to calculate exponents manually */
     rnp::ossl::BNCtx bnctx(BN_CTX_new());
     if (!bnctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to allocate BN_CTX.");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     auto p1 = BN_CTX_get(bnctx.get());
@@ -199,7 +199,7 @@ bld_params(const Key &key, bool secret)
         !OSSL_PARAM_BLD_push_BN(bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, u.get())) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to push RSA secret params.");
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     auto params = rnp::ossl::Param(OSSL_PARAM_BLD_to_param(bld.get()));
@@ -215,21 +215,21 @@ load_key(const Key &key, bool secret)
     /* Build params */
     auto params = bld_params(key, secret);
     if (!params) {
-        return NULL; // LCOV_EXCL_LINE
+        return nullptr; // LCOV_EXCL_LINE
     }
     /* Create context for key creation */
     rnp::ossl::evp::PKeyCtx ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL));
     if (!ctx) {
         /* LCOV_EXCL_START */
         RNP_LOG("Context allocation failed: %s", rnp::ossl::latest_err());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     /* Create key */
     if (EVP_PKEY_fromdata_init(ctx.get()) <= 0) {
         /* LCOV_EXCL_START */
         RNP_LOG("Failed to initialize key creation: %s", rnp::ossl::latest_err());
-        return NULL;
+        return nullptr;
         /* LCOV_EXCL_END */
     }
     EVP_PKEY *res = NULL;