diff --git a/samples/SocialSample/Startup.cs b/samples/SocialSample/Startup.cs
index 6e7b5c6323..d0b8d92801 100644
--- a/samples/SocialSample/Startup.cs
+++ b/samples/SocialSample/Startup.cs
@@ -2,11 +2,11 @@ using System.Net.Http;
 using System.Net.Http.Headers;
 using System.Security.Claims;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Http.Security;
 using Microsoft.AspNet.Security;
 using Microsoft.AspNet.Security.Cookies;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Google;
 using Microsoft.AspNet.Security.MicrosoftAccount;
 using Microsoft.AspNet.Security.OAuth;
diff --git a/src/Microsoft.AspNet.Security.Cookies/CookieAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.Cookies/CookieAuthenticationMiddleware.cs
index 8f1cc4b542..ba81365599 100644
--- a/src/Microsoft.AspNet.Security.Cookies/CookieAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.Cookies/CookieAuthenticationMiddleware.cs
@@ -4,9 +4,9 @@
 
 using System;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.Cookies.Infrastructure;
 using Microsoft.AspNet.Security.DataHandler;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.Framework.Logging;
 using Microsoft.Framework.OptionsModel;
@@ -35,7 +35,7 @@ namespace Microsoft.AspNet.Security.Cookies
             }
             if (Options.TicketDataFormat == null)
             {
-                IDataProtector dataProtector = dataProtectionProvider.CreateDataProtector(
+                IDataProtector dataProtector = dataProtectionProvider.CreateProtector(
                     typeof(CookieAuthenticationMiddleware).FullName, Options.AuthenticationType, "v2");
                 Options.TicketDataFormat = new TicketDataFormat(dataProtector);
             }
diff --git a/src/Microsoft.AspNet.Security.Facebook/FacebookAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.Facebook/FacebookAuthenticationMiddleware.cs
index 5f6eb525eb..4873ea2fd2 100644
--- a/src/Microsoft.AspNet.Security.Facebook/FacebookAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.Facebook/FacebookAuthenticationMiddleware.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Globalization;
 using Microsoft.AspNet.Builder;
-using Microsoft.AspNet.Security.DataProtection;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.AspNet.Security.OAuth;
 using Microsoft.Framework.Logging;
diff --git a/src/Microsoft.AspNet.Security.Google/GoogleAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.Google/GoogleAuthenticationMiddleware.cs
index 7de2530704..a72c0524f5 100644
--- a/src/Microsoft.AspNet.Security.Google/GoogleAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.Google/GoogleAuthenticationMiddleware.cs
@@ -6,8 +6,8 @@ using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.DataHandler;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.AspNet.Security.OAuth;
 using Microsoft.Framework.Logging;
diff --git a/src/Microsoft.AspNet.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs
index ce50b7033e..5d0afe1f35 100644
--- a/src/Microsoft.AspNet.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Globalization;
 using Microsoft.AspNet.Builder;
-using Microsoft.AspNet.Security.DataProtection;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.AspNet.Security.OAuth;
 using Microsoft.Framework.Logging;
diff --git a/src/Microsoft.AspNet.Security.OAuth/OAuthAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.OAuth/OAuthAuthenticationMiddleware.cs
index 18dd9c9a86..c525af881b 100644
--- a/src/Microsoft.AspNet.Security.OAuth/OAuthAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.OAuth/OAuthAuthenticationMiddleware.cs
@@ -1,16 +1,16 @@
 // Copyright (c) Microsoft Open Technologies, Inc. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using Microsoft.AspNet.Builder;
-using Microsoft.AspNet.Security.DataHandler;
-using Microsoft.AspNet.Security.DataProtection;
-using Microsoft.AspNet.Security.Infrastructure;
-using Microsoft.Framework.Logging;
-using Microsoft.Framework.OptionsModel;
 using System;
 using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
+using Microsoft.AspNet.Security.DataHandler;
+using Microsoft.AspNet.Security.Infrastructure;
+using Microsoft.Framework.Logging;
+using Microsoft.Framework.OptionsModel;
 
 namespace Microsoft.AspNet.Security.OAuth
 {
@@ -70,7 +70,7 @@ namespace Microsoft.AspNet.Security.OAuth
 
             if (Options.StateDataFormat == null)
             {
-                IDataProtector dataProtector = dataProtectionProvider.CreateDataProtector(
+                IDataProtector dataProtector = dataProtectionProvider.CreateProtector(
                     this.GetType().FullName, Options.AuthenticationType, "v1");
                 Options.StateDataFormat = new PropertiesDataFormat(dataProtector);
             }
diff --git a/src/Microsoft.AspNet.Security.OAuth/project.json b/src/Microsoft.AspNet.Security.OAuth/project.json
index 39ba020fc7..d29f6d9144 100644
--- a/src/Microsoft.AspNet.Security.OAuth/project.json
+++ b/src/Microsoft.AspNet.Security.OAuth/project.json
@@ -2,8 +2,8 @@
     "version": "1.0.0-*",
     "description": "ASP.NET 5 middleware that enables an application to support any standard OAuth 2.0 authentication workflow.",
     "dependencies": {
-        "Microsoft.AspNet.Security": "1.0.0-*",
-        "Microsoft.AspNet.Security.DataProtection": "1.0.0-*",
+        "Microsoft.AspNet.DataProtection": "1.0.0-*",
+        "Microsoft.AspNet.Security": "1.0.0-*"
     },
     "frameworks": {
         "aspnet50": {
diff --git a/src/Microsoft.AspNet.Security.OAuthBearer/OAuthBearerAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.OAuthBearer/OAuthBearerAuthenticationMiddleware.cs
index 0403896ae2..d1ae0ad1a8 100644
--- a/src/Microsoft.AspNet.Security.OAuthBearer/OAuthBearerAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.OAuthBearer/OAuthBearerAuthenticationMiddleware.cs
@@ -7,7 +7,6 @@ using System.Diagnostics.CodeAnalysis;
 using System.IdentityModel.Tokens;
 using System.Net.Http;
 using Microsoft.AspNet.Builder;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.Framework.Logging;
 using Microsoft.Framework.OptionsModel;
diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs
index bbe59f50d2..9e6baf45d9 100644
--- a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs
@@ -8,11 +8,11 @@ using System.IdentityModel.Tokens;
 using System.Net.Http;
 using System.Text;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Security.DataHandler;
 using Microsoft.AspNet.Security.DataHandler.Encoder;
 using Microsoft.AspNet.Security.DataHandler.Serializer;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.Framework.Logging;
 using Microsoft.Framework.OptionsModel;
@@ -53,7 +53,7 @@ namespace Microsoft.AspNet.Security.OpenIdConnect
 
             if (Options.StateDataFormat == null)
             {
-                var dataProtector = dataProtectionProvider.CreateDataProtector(
+                var dataProtector = dataProtectionProvider.CreateProtector(
                     typeof(OpenIdConnectAuthenticationMiddleware).FullName, 
 					typeof(string).FullName,
                     Options.AuthenticationType,
@@ -64,7 +64,7 @@ namespace Microsoft.AspNet.Security.OpenIdConnect
 
             if (Options.StringDataFormat == null)
             {
-                var dataProtector = dataProtectionProvider.CreateDataProtector(
+                var dataProtector = dataProtectionProvider.CreateProtector(
                     typeof(OpenIdConnectAuthenticationMiddleware).FullName,
                     typeof(string).FullName,
                     Options.AuthenticationType,
diff --git a/src/Microsoft.AspNet.Security.Twitter/TwitterAuthenticationMiddleware.cs b/src/Microsoft.AspNet.Security.Twitter/TwitterAuthenticationMiddleware.cs
index 6c4204a4b6..98cdbdf377 100644
--- a/src/Microsoft.AspNet.Security.Twitter/TwitterAuthenticationMiddleware.cs
+++ b/src/Microsoft.AspNet.Security.Twitter/TwitterAuthenticationMiddleware.cs
@@ -6,9 +6,9 @@ using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.DataHandler;
 using Microsoft.AspNet.Security.DataHandler.Encoder;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.Infrastructure;
 using Microsoft.AspNet.Security.Twitter.Messages;
 using Microsoft.Framework.Logging;
@@ -60,7 +60,7 @@ namespace Microsoft.AspNet.Security.Twitter
             }
             if (Options.StateDataFormat == null)
             {
-                IDataProtector dataProtector = dataProtectionProvider.CreateDataProtector(
+                IDataProtector dataProtector = dataProtectionProvider.CreateProtector(
                     typeof(TwitterAuthenticationMiddleware).FullName, Options.AuthenticationType, "v1");
                 Options.StateDataFormat = new SecureDataFormat<RequestToken>(
                     Serializers.RequestToken,
diff --git a/src/Microsoft.AspNet.Security/DataHandler/PropertiesDataFormat.cs b/src/Microsoft.AspNet.Security/DataHandler/PropertiesDataFormat.cs
index 050f9d24ee..19a11a2522 100644
--- a/src/Microsoft.AspNet.Security/DataHandler/PropertiesDataFormat.cs
+++ b/src/Microsoft.AspNet.Security/DataHandler/PropertiesDataFormat.cs
@@ -1,10 +1,10 @@
 // Copyright (c) Microsoft Open Technologies, Inc. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http.Security;
 using Microsoft.AspNet.Security.DataHandler.Encoder;
 using Microsoft.AspNet.Security.DataHandler.Serializer;
-using Microsoft.AspNet.Security.DataProtection;
 
 namespace Microsoft.AspNet.Security.DataHandler
 {
diff --git a/src/Microsoft.AspNet.Security/DataHandler/SecureDataFormat.cs b/src/Microsoft.AspNet.Security/DataHandler/SecureDataFormat.cs
index e10d17db12..0c314fbf2c 100644
--- a/src/Microsoft.AspNet.Security/DataHandler/SecureDataFormat.cs
+++ b/src/Microsoft.AspNet.Security/DataHandler/SecureDataFormat.cs
@@ -3,9 +3,9 @@
 
 
 using System.Diagnostics.CodeAnalysis;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.DataHandler.Encoder;
 using Microsoft.AspNet.Security.DataHandler.Serializer;
-using Microsoft.AspNet.Security.DataProtection;
 
 namespace Microsoft.AspNet.Security.DataHandler
 {
diff --git a/src/Microsoft.AspNet.Security/DataHandler/TicketDataFormat.cs b/src/Microsoft.AspNet.Security/DataHandler/TicketDataFormat.cs
index acc731e0ba..b54f166662 100644
--- a/src/Microsoft.AspNet.Security/DataHandler/TicketDataFormat.cs
+++ b/src/Microsoft.AspNet.Security/DataHandler/TicketDataFormat.cs
@@ -2,9 +2,9 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Security.DataHandler.Encoder;
 using Microsoft.AspNet.Security.DataHandler.Serializer;
-using Microsoft.AspNet.Security.DataProtection;
 
 namespace Microsoft.AspNet.Security.DataHandler
 {
diff --git a/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs b/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs
deleted file mode 100644
index 986bc8dc80..0000000000
--- a/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright (c) Microsoft Open Technologies, Inc. All rights reserved.
-// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-
-namespace Microsoft.AspNet.Security.DataProtection
-{
-    public static class DataProtectionHelpers
-    {
-        public static IDataProtector CreateDataProtector([NotNull] this IDataProtectionProvider dataProtectionProvider, params string[] purposes)
-        {
-            return dataProtectionProvider.CreateProtector(string.Join(";", purposes));
-        }
-    }
-}
diff --git a/src/Microsoft.AspNet.Security/project.json b/src/Microsoft.AspNet.Security/project.json
index af2d2fb981..62d2233183 100644
--- a/src/Microsoft.AspNet.Security/project.json
+++ b/src/Microsoft.AspNet.Security/project.json
@@ -2,10 +2,10 @@
     "version": "1.0.0-*",
     "description": "ASP.NET 5 common types used by the various authentication middleware.",
     "dependencies": {
+        "Microsoft.AspNet.DataProtection": "1.0.0-*",
         "Microsoft.AspNet.RequestContainer": "1.0.0-*",
         "Microsoft.AspNet.Http.Interfaces": "1.0.0-*",
         "Microsoft.AspNet.Http.Core": "1.0.0-*",
-        "Microsoft.AspNet.Security.DataProtection": "1.0.0-*",
         "Microsoft.Framework.Logging": "1.0.0-*"
     },
     "frameworks": {
diff --git a/test/Microsoft.AspNet.Security.Test/Facebook/FacebookMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/Facebook/FacebookMiddlewareTests.cs
index 7377d1a1f1..42137b1426 100644
--- a/test/Microsoft.AspNet.Security.Test/Facebook/FacebookMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/Facebook/FacebookMiddlewareTests.cs
@@ -9,7 +9,6 @@ using System.Net.Http;
 using System.Threading.Tasks;
 using Microsoft.AspNet.Builder;
 using Microsoft.AspNet.Http;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.TestHost;
 using Microsoft.Framework.DependencyInjection;
 using Shouldly;
diff --git a/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
index 5b6046aa9c..e019512f7f 100644
--- a/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
@@ -12,17 +12,17 @@ using System.Threading.Tasks;
 using System.Xml;
 using System.Xml.Linq;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Http.Security;
 using Microsoft.AspNet.Security.Cookies;
+using Microsoft.AspNet.Security.DataHandler;
 using Microsoft.AspNet.TestHost;
+using Microsoft.Framework.DependencyInjection;
+using Microsoft.Framework.OptionsModel;
 using Newtonsoft.Json;
 using Shouldly;
 using Xunit;
-using Microsoft.Framework.OptionsModel;
-using Microsoft.Framework.DependencyInjection;
-using Microsoft.AspNet.Security.DataProtection;
-using Microsoft.AspNet.Security.DataHandler;
 
 namespace Microsoft.AspNet.Security.Google
 {
diff --git a/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
index 8fd06d8c97..0f3a9355c2 100644
--- a/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
@@ -12,18 +12,18 @@ using System.Threading.Tasks;
 using System.Xml;
 using System.Xml.Linq;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Http.Security;
 using Microsoft.AspNet.Security.Cookies;
+using Microsoft.AspNet.Security.DataHandler;
 using Microsoft.AspNet.Security.MicrosoftAccount;
 using Microsoft.AspNet.TestHost;
+using Microsoft.Framework.DependencyInjection;
+using Microsoft.Framework.OptionsModel;
 using Newtonsoft.Json;
 using Shouldly;
 using Xunit;
-using Microsoft.Framework.OptionsModel;
-using Microsoft.Framework.DependencyInjection;
-using Microsoft.AspNet.Security.DataHandler;
-using Microsoft.AspNet.Security.DataProtection;
 
 namespace Microsoft.AspNet.Security.Tests.MicrosoftAccount
 {
diff --git a/test/Microsoft.AspNet.Security.Test/OpenIdConnect/OpenIdConnectMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/OpenIdConnect/OpenIdConnectMiddlewareTests.cs
index e3a5df4718..d2d22a342c 100644
--- a/test/Microsoft.AspNet.Security.Test/OpenIdConnect/OpenIdConnectMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/OpenIdConnect/OpenIdConnectMiddlewareTests.cs
@@ -14,11 +14,11 @@ using System.Threading.Tasks;
 using System.Xml;
 using System.Xml.Linq;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Http.Security;
 using Microsoft.AspNet.Security.Cookies;
 using Microsoft.AspNet.Security.DataHandler;
-using Microsoft.AspNet.Security.DataProtection;
 using Microsoft.AspNet.Security.OpenIdConnect;
 using Microsoft.AspNet.TestHost;
 using Microsoft.Framework.DependencyInjection;
diff --git a/test/Microsoft.AspNet.Security.Test/Twitter/TwitterMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/Twitter/TwitterMiddlewareTests.cs
index 36a829404b..cb98aef0ce 100644
--- a/test/Microsoft.AspNet.Security.Test/Twitter/TwitterMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/Twitter/TwitterMiddlewareTests.cs
@@ -8,16 +8,16 @@ using System.Net.Http;
 using System.Text;
 using System.Threading.Tasks;
 using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.DataProtection;
 using Microsoft.AspNet.Http;
 using Microsoft.AspNet.Security.Cookies;
 using Microsoft.AspNet.Security.Twitter;
 using Microsoft.AspNet.TestHost;
+using Microsoft.Framework.DependencyInjection;
+using Microsoft.Framework.OptionsModel;
 using Newtonsoft.Json;
 using Shouldly;
 using Xunit;
-using Microsoft.Framework.OptionsModel;
-using Microsoft.Framework.DependencyInjection;
-using Microsoft.AspNet.Security.DataProtection;
 
 namespace Microsoft.AspNet.Security.Twitter
 {