diff --git a/ssl/handshake.cc b/ssl/handshake.cc
index 3df004c..d62f986 100644
--- a/ssl/handshake.cc
+++ b/ssl/handshake.cc
@@ -157,6 +157,13 @@
   ssl->ctx->x509_method->hs_flush_cached_ca_names(this);
 }
 
+void SSL_HANDSHAKE::ResizeSecrets(size_t hash_len) {
+  if (hash_len > SSL_MAX_MD_SIZE) {
+    abort();
+  }
+  hash_len_ = hash_len;
+}
+
 UniquePtr<SSL_HANDSHAKE> ssl_handshake_new(SSL *ssl) {
   UniquePtr<SSL_HANDSHAKE> hs = MakeUnique<SSL_HANDSHAKE>(ssl);
   if (!hs || !hs->transcript.Init()) {
diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc
index e1b6afe..4e8ca6a 100644
--- a/ssl/handshake_client.cc
+++ b/ssl/handshake_client.cc
@@ -460,9 +460,8 @@
           hs, MakeConstSpan(ssl->session->master_key,
                             ssl->session->master_key_length)) ||
       !tls13_derive_early_secrets(hs) ||
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_early_data, evp_aead_seal,
-          MakeConstSpan(hs->early_traffic_secret, hs->hash_len))) {
+      !tls13_set_traffic_key(ssl, ssl_encryption_early_data, evp_aead_seal,
+                             hs->early_traffic_secret())) {
     return ssl_hs_error;
   }
 
diff --git a/ssl/internal.h b/ssl/internal.h
index e9b8201..ed37993 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -1452,14 +1452,38 @@
   // |SSL_OP_NO_*| and |SSL_CTX_set_max_proto_version| APIs.
   uint16_t max_version = 0;
 
-  size_t hash_len = 0;
-  uint8_t secret[SSL_MAX_MD_SIZE] = {0};
-  uint8_t early_traffic_secret[SSL_MAX_MD_SIZE] = {0};
-  uint8_t client_handshake_secret[SSL_MAX_MD_SIZE] = {0};
-  uint8_t server_handshake_secret[SSL_MAX_MD_SIZE] = {0};
-  uint8_t client_traffic_secret_0[SSL_MAX_MD_SIZE] = {0};
-  uint8_t server_traffic_secret_0[SSL_MAX_MD_SIZE] = {0};
-  uint8_t expected_client_finished[SSL_MAX_MD_SIZE] = {0};
+ private:
+  size_t hash_len_ = 0;
+  uint8_t secret_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t early_traffic_secret_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t client_handshake_secret_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t server_handshake_secret_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t client_traffic_secret_0_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t server_traffic_secret_0_[SSL_MAX_MD_SIZE] = {0};
+  uint8_t expected_client_finished_[SSL_MAX_MD_SIZE] = {0};
+
+ public:
+  void ResizeSecrets(size_t hash_len);
+
+  Span<uint8_t> secret() { return MakeSpan(secret_, hash_len_); }
+  Span<uint8_t> early_traffic_secret() {
+    return MakeSpan(early_traffic_secret_, hash_len_);
+  }
+  Span<uint8_t> client_handshake_secret() {
+    return MakeSpan(client_handshake_secret_, hash_len_);
+  }
+  Span<uint8_t> server_handshake_secret() {
+    return MakeSpan(server_handshake_secret_, hash_len_);
+  }
+  Span<uint8_t> client_traffic_secret_0() {
+    return MakeSpan(client_traffic_secret_0_, hash_len_);
+  }
+  Span<uint8_t> server_traffic_secret_0() {
+    return MakeSpan(server_traffic_secret_0_, hash_len_);
+  }
+  Span<uint8_t> expected_client_finished() {
+    return MakeSpan(expected_client_finished_, hash_len_);
+  }
 
   union {
     // sent is a bitset where the bits correspond to elements of kExtensions
diff --git a/ssl/tls13_both.cc b/ssl/tls13_both.cc
index 1a49e4c..7457155 100644
--- a/ssl/tls13_both.cc
+++ b/ssl/tls13_both.cc
@@ -384,21 +384,20 @@
                             bool use_saved_value) {
   SSL *const ssl = hs->ssl;
   uint8_t verify_data_buf[EVP_MAX_MD_SIZE];
-  const uint8_t *verify_data;
-  size_t verify_data_len;
+  Span<const uint8_t> verify_data;
   if (use_saved_value) {
     assert(ssl->server);
-    verify_data = hs->expected_client_finished;
-    verify_data_len = hs->hash_len;
+    verify_data = hs->expected_client_finished();
   } else {
-    if (!tls13_finished_mac(hs, verify_data_buf, &verify_data_len,
-                            !ssl->server)) {
+    size_t len;
+    if (!tls13_finished_mac(hs, verify_data_buf, &len, !ssl->server)) {
       return false;
     }
-    verify_data = verify_data_buf;
+    verify_data = MakeConstSpan(verify_data_buf, len);
   }
 
-  bool finished_ok = CBS_mem_equal(&msg.body, verify_data, verify_data_len);
+  bool finished_ok =
+      CBS_mem_equal(&msg.body, verify_data.data(), verify_data.size());
 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
   finished_ok = true;
 #endif
diff --git a/ssl/tls13_client.cc b/ssl/tls13_client.cc
index ba7dc55..a7d0d89 100644
--- a/ssl/tls13_client.cc
+++ b/ssl/tls13_client.cc
@@ -393,18 +393,16 @@
   if (!tls13_advance_key_schedule(hs, dhe_secret) ||
       !ssl_hash_message(hs, msg) ||
       !tls13_derive_handshake_secrets(hs) ||
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_handshake, evp_aead_open,
-          MakeConstSpan(hs->server_handshake_secret, hs->hash_len))) {
+      !tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
+                             hs->server_handshake_secret())) {
     return ssl_hs_error;
   }
 
   if (!hs->early_data_offered) {
     // If not sending early data, set client traffic keys now so that alerts are
     // encrypted.
-    if (!tls13_set_traffic_key(
-            ssl, ssl_encryption_handshake, evp_aead_seal,
-            MakeConstSpan(hs->client_handshake_secret, hs->hash_len))) {
+    if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal,
+                               hs->client_handshake_secret())) {
       return ssl_hs_error;
     }
   }
@@ -619,7 +617,8 @@
       !tls13_process_finished(hs, msg, false /* don't use saved value */) ||
       !ssl_hash_message(hs, msg) ||
       // Update the secret to the master secret and derive traffic keys.
-      !tls13_advance_key_schedule(hs, MakeConstSpan(kZeroes, hs->hash_len)) ||
+      !tls13_advance_key_schedule(
+          hs, MakeConstSpan(kZeroes, hs->transcript.DigestLen())) ||
       !tls13_derive_application_secrets(hs)) {
     return ssl_hs_error;
   }
@@ -644,9 +643,8 @@
   }
 
   if (hs->early_data_offered) {
-    if (!tls13_set_traffic_key(
-            ssl, ssl_encryption_handshake, evp_aead_seal,
-            MakeConstSpan(hs->client_handshake_secret, hs->hash_len))) {
+    if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal,
+                               hs->client_handshake_secret())) {
       return ssl_hs_error;
     }
   }
@@ -740,12 +738,10 @@
   }
 
   // Derive the final keys and enable them.
-  if (!tls13_set_traffic_key(
-          ssl, ssl_encryption_application, evp_aead_open,
-          MakeConstSpan(hs->server_traffic_secret_0, hs->hash_len)) ||
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_application, evp_aead_seal,
-          MakeConstSpan(hs->client_traffic_secret_0, hs->hash_len)) ||
+  if (!tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_open,
+                             hs->server_traffic_secret_0()) ||
+      !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal,
+                             hs->client_traffic_secret_0()) ||
       !tls13_derive_resumption_secret(hs)) {
     return ssl_hs_error;
   }
diff --git a/ssl/tls13_enc.cc b/ssl/tls13_enc.cc
index c07afd1..b8bebe1 100644
--- a/ssl/tls13_enc.cc
+++ b/ssl/tls13_enc.cc
@@ -17,6 +17,7 @@
 #include <assert.h>
 #include <string.h>
 
+#include <algorithm>
 #include <utility>
 
 #include <openssl/aead.h>
@@ -38,31 +39,38 @@
     return false;
   }
 
-  assert(hs->transcript.DigestLen() <= SSL_MAX_MD_SIZE);
-  hs->hash_len = hs->transcript.DigestLen();
-
   // Initialize the secret to the zero key.
-  OPENSSL_memset(hs->secret, 0, hs->hash_len);
+  hs->ResizeSecrets(hs->transcript.DigestLen());
+  OPENSSL_memset(hs->secret().data(), 0, hs->secret().size());
 
   return true;
 }
 
+static bool hkdf_extract_to_secret(SSL_HANDSHAKE *hs, Span<const uint8_t> in) {
+  size_t len;
+  if (!HKDF_extract(hs->secret().data(), &len, hs->transcript.Digest(),
+                    in.data(), in.size(), hs->secret().data(),
+                    hs->secret().size())) {
+    return false;
+  }
+  assert(len == hs->secret().size());
+  return true;
+}
+
 bool tls13_init_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> psk) {
   if (!init_key_schedule(hs, ssl_protocol_version(hs->ssl), hs->new_cipher)) {
     return false;
   }
 
   hs->transcript.FreeBuffer();
-  return HKDF_extract(hs->secret, &hs->hash_len, hs->transcript.Digest(),
-                      psk.data(), psk.size(), hs->secret, hs->hash_len);
+  return hkdf_extract_to_secret(hs, psk);
 }
 
 bool tls13_init_early_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> psk) {
   SSL *const ssl = hs->ssl;
   return init_key_schedule(hs, ssl_session_protocol_version(ssl->session.get()),
                            ssl->session->cipher) &&
-         HKDF_extract(hs->secret, &hs->hash_len, hs->transcript.Digest(),
-                      psk.data(), psk.size(), hs->secret, hs->hash_len);
+         hkdf_extract_to_secret(hs, psk);
 }
 
 static Span<const char> label_to_span(const char *label) {
@@ -101,21 +109,12 @@
 bool tls13_advance_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> in) {
   uint8_t derive_context[EVP_MAX_MD_SIZE];
   unsigned derive_context_len;
-  if (!EVP_Digest(nullptr, 0, derive_context, &derive_context_len,
-                  hs->transcript.Digest(), nullptr)) {
-    return false;
-  }
-
-  if (!hkdf_expand_label(MakeSpan(hs->secret, hs->hash_len),
-                         hs->transcript.Digest(),
-                         MakeConstSpan(hs->secret, hs->hash_len),
-                         label_to_span(kTLS13LabelDerived),
-                         MakeConstSpan(derive_context, derive_context_len))) {
-    return false;
-  }
-
-  return HKDF_extract(hs->secret, &hs->hash_len, hs->transcript.Digest(),
-                      in.data(), in.size(), hs->secret, hs->hash_len);
+  return EVP_Digest(nullptr, 0, derive_context, &derive_context_len,
+                    hs->transcript.Digest(), nullptr) &&
+         hkdf_expand_label(hs->secret(), hs->transcript.Digest(), hs->secret(),
+                           label_to_span(kTLS13LabelDerived),
+                           MakeConstSpan(derive_context, derive_context_len)) &&
+         hkdf_extract_to_secret(hs, in);
 }
 
 // derive_secret derives a secret of length |out.size()| and writes the result
@@ -130,8 +129,7 @@
     return false;
   }
 
-  return hkdf_expand_label(out, hs->transcript.Digest(),
-                           MakeConstSpan(hs->secret, hs->hash_len), label,
+  return hkdf_expand_label(out, hs->transcript.Digest(), hs->secret(), label,
                            MakeConstSpan(context_hash, context_hash_len));
 }
 
@@ -230,25 +228,26 @@
 
 bool tls13_derive_early_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (!derive_secret(hs, MakeSpan(hs->early_traffic_secret, hs->hash_len),
+  if (!derive_secret(hs, hs->early_traffic_secret(),
                      label_to_span(kTLS13LabelClientEarlyTraffic)) ||
       !ssl_log_secret(ssl, "CLIENT_EARLY_TRAFFIC_SECRET",
-                      MakeConstSpan(hs->early_traffic_secret, hs->hash_len))) {
+                      hs->early_traffic_secret())) {
     return false;
   }
 
   if (ssl->quic_method != nullptr) {
     if (ssl->server) {
       if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_early_data, nullptr, hs->early_traffic_secret,
-              hs->hash_len)) {
+              ssl, ssl_encryption_early_data, nullptr,
+              hs->early_traffic_secret().data(),
+              hs->early_traffic_secret().size())) {
         OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
         return false;
       }
     } else {
       if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_early_data, hs->early_traffic_secret, nullptr,
-              hs->hash_len)) {
+              ssl, ssl_encryption_early_data, hs->early_traffic_secret().data(),
+              nullptr, hs->early_traffic_secret().size())) {
         OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
         return false;
       }
@@ -258,82 +257,65 @@
   return true;
 }
 
+static bool set_quic_secrets(SSL_HANDSHAKE *hs, ssl_encryption_level_t level,
+                             Span<const uint8_t> client_write_secret,
+                             Span<const uint8_t> server_write_secret) {
+  SSL *const ssl = hs->ssl;
+  assert(client_write_secret.size() == server_write_secret.size());
+  if (ssl->quic_method == nullptr) {
+    return true;
+  }
+  if (!ssl->server) {
+    std::swap(client_write_secret, server_write_secret);
+  }
+  return ssl->quic_method->set_encryption_secrets(
+      ssl, level,
+      /*read_secret=*/client_write_secret.data(),
+      /*write_secret=*/server_write_secret.data(), client_write_secret.size());
+}
+
 bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (!derive_secret(hs, MakeSpan(hs->client_handshake_secret, hs->hash_len),
+  if (!derive_secret(hs, hs->client_handshake_secret(),
                      label_to_span(kTLS13LabelClientHandshakeTraffic)) ||
-      !ssl_log_secret(
-          ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET",
-          MakeConstSpan(hs->client_handshake_secret, hs->hash_len)) ||
-      !derive_secret(hs, MakeSpan(hs->server_handshake_secret, hs->hash_len),
+      !ssl_log_secret(ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET",
+                      hs->client_handshake_secret()) ||
+      !derive_secret(hs, hs->server_handshake_secret(),
                      label_to_span(kTLS13LabelServerHandshakeTraffic)) ||
-      !ssl_log_secret(
-          ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET",
-          MakeConstSpan(hs->server_handshake_secret, hs->hash_len))) {
+      !ssl_log_secret(ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET",
+                      hs->server_handshake_secret()) ||
+      !set_quic_secrets(hs, ssl_encryption_handshake,
+                        hs->client_handshake_secret(),
+                        hs->server_handshake_secret())) {
     return false;
   }
 
-  if (ssl->quic_method != nullptr) {
-    if (ssl->server) {
-      if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_handshake, hs->client_handshake_secret,
-              hs->server_handshake_secret, hs->hash_len)) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
-        return false;
-      }
-    } else {
-      if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_handshake, hs->server_handshake_secret,
-              hs->client_handshake_secret, hs->hash_len)) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
-        return false;
-      }
-    }
-  }
-
   return true;
 }
 
 bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  ssl->s3->exporter_secret_len = hs->hash_len;
-  if (!derive_secret(hs, MakeSpan(hs->client_traffic_secret_0, hs->hash_len),
+  ssl->s3->exporter_secret_len = hs->transcript.DigestLen();
+  if (!derive_secret(hs, hs->client_traffic_secret_0(),
                      label_to_span(kTLS13LabelClientApplicationTraffic)) ||
-      !ssl_log_secret(
-          ssl, "CLIENT_TRAFFIC_SECRET_0",
-          MakeConstSpan(hs->client_traffic_secret_0, hs->hash_len)) ||
-      !derive_secret(hs, MakeSpan(hs->server_traffic_secret_0, hs->hash_len),
+      !ssl_log_secret(ssl, "CLIENT_TRAFFIC_SECRET_0",
+                      hs->client_traffic_secret_0()) ||
+      !derive_secret(hs, hs->server_traffic_secret_0(),
                      label_to_span(kTLS13LabelServerApplicationTraffic)) ||
-      !ssl_log_secret(
-          ssl, "SERVER_TRAFFIC_SECRET_0",
-          MakeConstSpan(hs->server_traffic_secret_0, hs->hash_len)) ||
+      !ssl_log_secret(ssl, "SERVER_TRAFFIC_SECRET_0",
+                      hs->server_traffic_secret_0()) ||
       !derive_secret(
           hs, MakeSpan(ssl->s3->exporter_secret, ssl->s3->exporter_secret_len),
           label_to_span(kTLS13LabelExporter)) ||
       !ssl_log_secret(ssl, "EXPORTER_SECRET",
                       MakeConstSpan(ssl->s3->exporter_secret,
-                                    ssl->s3->exporter_secret_len))) {
+                                    ssl->s3->exporter_secret_len)) ||
+      !set_quic_secrets(hs, ssl_encryption_application,
+                        hs->client_traffic_secret_0(),
+                        hs->server_traffic_secret_0())) {
     return false;
   }
 
-  if (ssl->quic_method != nullptr) {
-    if (ssl->server) {
-      if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_application, hs->client_traffic_secret_0,
-              hs->server_traffic_secret_0, hs->hash_len)) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
-        return false;
-      }
-    } else {
-      if (!ssl->quic_method->set_encryption_secrets(
-              ssl, ssl_encryption_application, hs->server_traffic_secret_0,
-              hs->client_traffic_secret_0, hs->hash_len)) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR);
-        return false;
-      }
-    }
-  }
-
   return true;
 }
 
@@ -359,11 +341,11 @@
 static const char kTLS13LabelResumption[] = "res master";
 
 bool tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) {
-  if (hs->hash_len > SSL_MAX_MASTER_KEY_LENGTH) {
+  if (hs->transcript.DigestLen() > SSL_MAX_MASTER_KEY_LENGTH) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
   }
-  hs->new_session->master_key_length = hs->hash_len;
+  hs->new_session->master_key_length = hs->transcript.DigestLen();
   return derive_secret(
       hs,
       MakeSpan(hs->new_session->master_key, hs->new_session->master_key_length),
@@ -394,12 +376,8 @@
 
 bool tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len,
                         bool is_server) {
-  Span<const uint8_t> traffic_secret;
-  if (is_server) {
-    traffic_secret = MakeConstSpan(hs->server_handshake_secret, hs->hash_len);
-  } else {
-    traffic_secret = MakeConstSpan(hs->client_handshake_secret, hs->hash_len);
-  }
+  Span<const uint8_t> traffic_secret =
+      is_server ? hs->server_handshake_secret() : hs->client_handshake_secret();
 
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
diff --git a/ssl/tls13_server.cc b/ssl/tls13_server.cc
index 7b6f5df..d99b5b4 100644
--- a/ssl/tls13_server.cc
+++ b/ssl/tls13_server.cc
@@ -607,9 +607,8 @@
 
   // Derive and enable the handshake traffic secrets.
   if (!tls13_derive_handshake_secrets(hs) ||
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_handshake, evp_aead_seal,
-          MakeConstSpan(hs->server_handshake_secret, hs->hash_len))) {
+      !tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal,
+                             hs->server_handshake_secret())) {
     return ssl_hs_error;
   }
 
@@ -717,11 +716,11 @@
   SSL *const ssl = hs->ssl;
   if (!tls13_add_finished(hs) ||
       // Update the secret to the master secret and derive traffic keys.
-      !tls13_advance_key_schedule(hs, MakeConstSpan(kZeroes, hs->hash_len)) ||
+      !tls13_advance_key_schedule(
+          hs, MakeConstSpan(kZeroes, hs->transcript.DigestLen())) ||
       !tls13_derive_application_secrets(hs) ||
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_application, evp_aead_seal,
-          MakeConstSpan(hs->server_traffic_secret_0, hs->hash_len))) {
+      !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal,
+                             hs->server_traffic_secret_0())) {
     return ssl_hs_error;
   }
 
@@ -738,12 +737,12 @@
     }
 
     size_t finished_len;
-    if (!tls13_finished_mac(hs, hs->expected_client_finished, &finished_len,
-                            false /* client */)) {
+    if (!tls13_finished_mac(hs, hs->expected_client_finished().data(),
+                            &finished_len, false /* client */)) {
       return ssl_hs_error;
     }
 
-    if (finished_len != hs->hash_len) {
+    if (finished_len != hs->expected_client_finished().size()) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
       return ssl_hs_error;
     }
@@ -753,13 +752,13 @@
     //
     // TODO(davidben): This will need to be updated for DTLS 1.3.
     assert(!SSL_is_dtls(hs->ssl));
-    assert(hs->hash_len <= 0xff);
-    uint8_t header[4] = {SSL3_MT_FINISHED, 0, 0,
-                         static_cast<uint8_t>(hs->hash_len)};
+    assert(hs->expected_client_finished().size() <= 0xff);
+    uint8_t header[4] = {
+        SSL3_MT_FINISHED, 0, 0,
+        static_cast<uint8_t>(hs->expected_client_finished().size())};
     bool unused_sent_tickets;
     if (!hs->transcript.Update(header) ||
-        !hs->transcript.Update(
-            MakeConstSpan(hs->expected_client_finished, hs->hash_len)) ||
+        !hs->transcript.Update(hs->expected_client_finished()) ||
         !tls13_derive_resumption_secret(hs) ||
         !add_new_session_tickets(hs, &unused_sent_tickets)) {
       return ssl_hs_error;
@@ -773,9 +772,8 @@
 static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
   if (ssl->s3->early_data_accepted) {
-    if (!tls13_set_traffic_key(
-            ssl, ssl_encryption_early_data, evp_aead_open,
-            MakeConstSpan(hs->early_traffic_secret, hs->hash_len))) {
+    if (!tls13_set_traffic_key(ssl, ssl_encryption_early_data, evp_aead_open,
+                               hs->early_traffic_secret())) {
       return ssl_hs_error;
     }
     hs->can_early_write = true;
@@ -809,9 +807,8 @@
       ssl->method->next_message(ssl);
     }
   }
-  if (!tls13_set_traffic_key(
-          ssl, ssl_encryption_handshake, evp_aead_open,
-          MakeConstSpan(hs->client_handshake_secret, hs->hash_len))) {
+  if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
+                             hs->client_handshake_secret())) {
     return ssl_hs_error;
   }
   hs->tls13_state = ssl->s3->early_data_accepted
@@ -917,9 +914,8 @@
       // and derived the resumption secret.
       !tls13_process_finished(hs, msg, ssl->s3->early_data_accepted) ||
       // evp_aead_seal keys have already been switched.
-      !tls13_set_traffic_key(
-          ssl, ssl_encryption_application, evp_aead_open,
-          MakeConstSpan(hs->client_traffic_secret_0, hs->hash_len))) {
+      !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_open,
+                             hs->client_traffic_secret_0())) {
     return ssl_hs_error;
   }