diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 25a1b50..d135afc 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -167,6 +167,8 @@
             return( PSA_ERROR_INVALID_ARGUMENT );
         }
 
+        /* salt_len <= sizeof( salt ) because
+           PSA_HASH_LENGTH( alg ) <= PSA_MAC_MAX_SIZE. */
         salt = null_salt;
         salt_len = hash_len;
     }