diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h
index da967c3..928fa58 100644
--- a/library/ssl_tls13_keys.h
+++ b/library/ssl_tls13_keys.h
@@ -114,7 +114,7 @@
  */
 
 int mbedtls_ssl_tls13_hkdf_expand_label(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *secret, size_t secret_len,
                      const unsigned char *label, size_t label_len,
                      const unsigned char *ctx, size_t ctx_len,
@@ -152,7 +152,7 @@
  */
 
 int mbedtls_ssl_tls13_make_traffic_keys(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *client_secret,
                      const unsigned char *server_secret, size_t secret_len,
                      size_t key_len, size_t iv_len,
@@ -202,7 +202,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret, size_t secret_len,
                    const unsigned char *label, size_t label_len,
                    const unsigned char *ctx, size_t ctx_len,
@@ -235,14 +235,14 @@
  *        is omitted here. Its calculation is part of the separate routine
  *        mbedtls_ssl_tls13_create_psk_binder().
  *
- * \param md_type      The hash algorithm associated with the PSK for which
+ * \param hash_alg     The hash algorithm associated with the PSK for which
  *                     early data key material is being derived.
  * \param early_secret The early secret from which the early data key material
  *                     should be derived. This must be a readable buffer whose
  *                     length is the digest size of the hash algorithm
  *                     represented by \p md_size.
  * \param transcript   The transcript of the handshake so far, calculated with
- *                     respect to \p md_type. This must be a readable buffer
+ *                     respect to \p hash_alg. This must be a readable buffer
  *                     whose length is the digest size of the hash algorithm
  *                     represented by \p md_size.
  * \param derived      The address of the structure in which to store
@@ -252,7 +252,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_early_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *early_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_early_secrets *derived );
@@ -280,14 +280,14 @@
  *        the client and server secret derived by this function need to be
  *        further processed by mbedtls_ssl_tls13_make_traffic_keys().
  *
- * \param md_type           The hash algorithm associated with the ciphersuite
+ * \param hash_alg          The hash algorithm associated with the ciphersuite
  *                          that's being used for the connection.
  * \param handshake_secret  The handshake secret from which the handshake key
  *                          material should be derived. This must be a readable
  *                          buffer whose length is the digest size of the hash
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake so far, calculated
- *                          with respect to \p md_type. This must be a readable
+ *                          with respect to \p hash_alg. This must be a readable
  *                          buffer whose length is the digest size of the hash
  *                          algorithm represented by \p md_size.
  * \param derived           The address of the structure in which to
@@ -297,7 +297,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_handshake_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *handshake_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_handshake_secrets *derived );
@@ -329,7 +329,7 @@
  *        the client and server secret derived by this function need to be
  *        further processed by mbedtls_ssl_tls13_make_traffic_keys().
  *
- * \param md_type           The hash algorithm associated with the ciphersuite
+ * \param hash_alg          The hash algorithm associated with the ciphersuite
  *                          that's being used for the connection.
  * \param master_secret     The master secret from which the application key
  *                          material should be derived. This must be a readable
@@ -337,9 +337,9 @@
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake up to and including
  *                          the ServerFinished message, calculated with respect
- *                          to \p md_type. This must be a readable buffer whose
+ *                          to \p hash_alg. This must be a readable buffer whose
  *                          length is the digest size of the hash algorithm
- *                          represented by \p md_type.
+ *                          represented by \p hash_alg.
  * \param derived           The address of the structure in which to
  *                          store the application key material.
  *
@@ -347,7 +347,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_application_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *master_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived );
@@ -358,7 +358,7 @@
  *        This is a small wrapper invoking mbedtls_ssl_tls13_derive_secret()
  *        with the appropriate labels from the standard.
  *
- * \param md_type           The hash algorithm used in the application for which
+ * \param hash_alg          The hash algorithm used in the application for which
  *                          key material is being derived.
  * \param application_secret The application secret from which the resumption master
  *                          secret should be derived. This must be a readable
@@ -366,9 +366,9 @@
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake up to and including
  *                          the ClientFinished message, calculated with respect
- *                          to \p md_type. This must be a readable buffer whose
+ *                          to \p hash_alg. This must be a readable buffer whose
  *                          length is the digest size of the hash algorithm
- *                          represented by \p md_type.
+ *                          represented by \p hash_alg.
  * \param transcript_len    The length of \p transcript in Bytes.
  * \param derived           The address of the structure in which to
  *                          store the resumption master secret.
@@ -377,7 +377,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_resumption_master_secret(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived );
@@ -450,7 +450,7 @@
  */
 
 int mbedtls_ssl_tls13_evolve_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret_old,
                    const unsigned char *input, size_t input_len,
                    unsigned char *secret_new );
@@ -463,7 +463,7 @@
  *
  * \param ssl         The SSL context. This is used for debugging only and may
  *                    be \c NULL if MBEDTLS_DEBUG_C is disabled.
- * \param md_type     The hash algorithm associated to the PSK \p psk.
+ * \param hash_alg    The hash algorithm associated to the PSK \p psk.
  * \param psk         The buffer holding the PSK for which to create a binder.
  * \param psk_len     The size of \p psk in bytes.
  * \param psk_type    This indicates whether the PSK \p psk is externally
@@ -472,17 +472,17 @@
  * \param transcript  The handshake transcript up to the point where the
  *                    PSK binder calculation happens. This must be readable,
  *                    and its size must be equal to the digest size of
- *                    the hash algorithm represented by \p md_type.
+ *                    the hash algorithm represented by \p hash_alg.
  * \param result      The address at which to store the PSK binder on success.
  *                    This must be writable, and its size must be equal to the
  *                    digest size of  the hash algorithm represented by
- *                    \p md_type.
+ *                    \p hash_alg.
  *
  * \returns           \c 0 on success.
  * \returns           A negative error code on failure.
  */
 int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
-                               const mbedtls_md_type_t md_type,
+                               const psa_algorithm_t hash_alg,
                                unsigned char const *psk, size_t psk_len,
                                int psk_type,
                                unsigned char const *transcript,