diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 8752528..4721f6b 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -1086,7 +1086,7 @@
 
     attributes->domain_parameters = copy;
     attributes->domain_parameters_size = data_length;
-    attributes->type = type;
+    attributes->core.type = type;
     return( PSA_SUCCESS );
 }
 
@@ -1153,11 +1153,11 @@
 static void psa_get_key_slot_attributes( psa_key_slot_t *slot,
                                          psa_key_attributes_t *attributes )
 {
-    attributes->id = slot->persistent_storage_id;
-    attributes->lifetime = slot->lifetime;
-    attributes->policy = slot->policy;
-    attributes->type = slot->type;
-    attributes->bits = psa_get_key_slot_bits( slot );
+    attributes->core.id = slot->persistent_storage_id;
+    attributes->core.lifetime = slot->lifetime;
+    attributes->core.policy = slot->policy;
+    attributes->core.type = slot->type;
+    attributes->core.bits = psa_get_key_slot_bits( slot );
 }
 
 /** Retrieve all the publicly-accessible attributes of a key.
@@ -1454,21 +1454,21 @@
         return( status );
     slot = *p_slot;
 
-    status = psa_set_key_policy_internal( slot, &attributes->policy );
+    status = psa_set_key_policy_internal( slot, &attributes->core.policy );
     if( status != PSA_SUCCESS )
         return( status );
-    slot->lifetime = attributes->lifetime;
+    slot->lifetime = attributes->core.lifetime;
 
-    if( attributes->lifetime != PSA_KEY_LIFETIME_VOLATILE )
+    if( attributes->core.lifetime != PSA_KEY_LIFETIME_VOLATILE )
     {
-        status = psa_validate_persistent_key_parameters( attributes->lifetime,
-                                                         attributes->id,
+        status = psa_validate_persistent_key_parameters( attributes->core.lifetime,
+                                                         attributes->core.id,
                                                          p_drv, 1 );
         if( status != PSA_SUCCESS )
             return( status );
-        slot->persistent_storage_id = attributes->id;
+        slot->persistent_storage_id = attributes->core.id;
     }
-    slot->type = attributes->type;
+    slot->type = attributes->core.type;
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
     /* For a key in a secure element, we need to do three things:
@@ -1628,9 +1628,9 @@
     const psa_key_slot_t *slot,
     const psa_key_attributes_t *attributes )
 {
-    if( attributes->type != 0 )
+    if( attributes->core.type != 0 )
     {
-        if( attributes->type != slot->type )
+        if( attributes->core.type != slot->type )
             return( PSA_ERROR_INVALID_ARGUMENT );
     }
 
@@ -1667,9 +1667,9 @@
         }
     }
 
-    if( attributes->bits != 0 )
+    if( attributes->core.bits != 0 )
     {
-        if( attributes->bits != psa_get_key_slot_bits( slot ) )
+        if( attributes->core.bits != psa_get_key_slot_bits( slot ) )
             return( PSA_ERROR_INVALID_ARGUMENT );
     }
 
@@ -1772,7 +1772,7 @@
     if( status != PSA_SUCCESS )
         goto exit;
 
-    status = psa_restrict_key_policy( &actual_attributes.policy,
+    status = psa_restrict_key_policy( &actual_attributes.core.policy,
                                       &source_slot->policy );
     if( status != PSA_SUCCESS )
         goto exit;
@@ -4706,7 +4706,7 @@
     if( status == PSA_SUCCESS )
     {
         status = psa_generate_derived_key_internal( slot,
-                                                    attributes->bits,
+                                                    attributes->core.bits,
                                                     operation );
     }
     if( status == PSA_SUCCESS )
@@ -5744,7 +5744,7 @@
     if( status == PSA_SUCCESS )
     {
         status = psa_generate_key_internal(
-            slot, attributes->bits,
+            slot, attributes->core.bits,
             attributes->domain_parameters, attributes->domain_parameters_size );
     }
     if( status == PSA_SUCCESS )
diff --git a/library/psa_crypto_core.h b/library/psa_crypto_core.h
index 8658490..d335b75 100644
--- a/library/psa_crypto_core.h
+++ b/library/psa_crypto_core.h
@@ -40,9 +40,9 @@
 typedef struct
 {
     psa_key_type_t type;
-    psa_key_policy_t policy;
     psa_key_lifetime_t lifetime;
     psa_key_file_id_t persistent_storage_id;
+    psa_key_policy_t policy;
     unsigned allocated : 1;
     union
     {
diff --git a/library/psa_crypto_se.c b/library/psa_crypto_se.c
index aece47d..58b0f38 100644
--- a/library/psa_crypto_se.c
+++ b/library/psa_crypto_se.c
@@ -198,7 +198,7 @@
     psa_drv_se_allocate_key_t p_allocate = NULL;
 
     /* If the lifetime is wrong, it's a bug in the library. */
-    if( driver->lifetime != attributes->lifetime )
+    if( driver->lifetime != psa_get_key_lifetime( attributes ) )
         return( PSA_ERROR_CORRUPTION_DETECTED );
 
     /* If the driver doesn't support key creation in any way, give up now. */
diff --git a/library/psa_crypto_slot_management.c b/library/psa_crypto_slot_management.c
index e63dcda..6add6b8 100644
--- a/library/psa_crypto_slot_management.c
+++ b/library/psa_crypto_slot_management.c
@@ -133,7 +133,7 @@
         goto exit;
     p_slot->lifetime = psa_get_key_lifetime( &attributes );
     p_slot->type = psa_get_key_type( &attributes );
-    p_slot->policy = attributes.policy;
+    p_slot->policy = attributes.core.policy;
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
     if( psa_key_lifetime_is_external( p_slot->lifetime ) )
diff --git a/library/psa_crypto_storage.c b/library/psa_crypto_storage.c
index b8569be..4113fb7 100644
--- a/library/psa_crypto_storage.c
+++ b/library/psa_crypto_storage.c
@@ -328,11 +328,11 @@
         memcpy( *key_data, storage_format->key_data, *key_data_length );
     }
 
-    GET_UINT32_LE( attributes->lifetime, storage_format->lifetime, 0 );
-    GET_UINT32_LE( attributes->type, storage_format->type, 0 );
-    GET_UINT32_LE( attributes->policy.usage, storage_format->policy, 0 );
-    GET_UINT32_LE( attributes->policy.alg, storage_format->policy, sizeof( uint32_t ) );
-    GET_UINT32_LE( attributes->policy.alg2, storage_format->policy, 2 * sizeof( uint32_t ) );
+    GET_UINT32_LE( attributes->core.lifetime, storage_format->lifetime, 0 );
+    GET_UINT32_LE( attributes->core.type, storage_format->type, 0 );
+    GET_UINT32_LE( attributes->core.policy.usage, storage_format->policy, 0 );
+    GET_UINT32_LE( attributes->core.policy.alg, storage_format->policy, sizeof( uint32_t ) );
+    GET_UINT32_LE( attributes->core.policy.alg2, storage_format->policy, 2 * sizeof( uint32_t ) );
 
     return( PSA_SUCCESS );
 }