diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 44db38f..2ce654b 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -311,7 +311,7 @@
 }
 
 int mbedtls_ssl_tls13_hkdf_expand_label(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *secret, size_t secret_len,
                      const unsigned char *label, size_t label_len,
                      const unsigned char *ctx, size_t ctx_len,
@@ -320,8 +320,6 @@
     unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ];
     size_t hkdf_label_len;
 
-    psa_algorithm_t alg;
-
     if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN )
     {
         /* Should never happen since this is an internal
@@ -342,12 +340,9 @@
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    alg = mbedtls_psa_translate_md( hash_alg );
-    if( ! PSA_ALG_IS_HASH( alg ) )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    alg = PSA_ALG_HMAC( alg );
-
     ssl_tls13_hkdf_encode_label( buf_len,
                                  label, label_len,
                                  ctx, ctx_len,
@@ -355,7 +350,7 @@
                                  &hkdf_label_len );
 
     return( psa_ssl_status_to_mbedtls(
-                mbedtls_psa_hkdf_expand( alg,
+                mbedtls_psa_hkdf_expand( PSA_ALG_HMAC( hash_alg ),
                                          secret, secret_len,
                                          hkdf_label, hkdf_label_len,
                                          buf, buf_len ) ) );
@@ -378,7 +373,7 @@
  * keys in a single function call.
  */
 int mbedtls_ssl_tls13_make_traffic_keys(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *client_secret,
                      const unsigned char *server_secret, size_t secret_len,
                      size_t key_len, size_t iv_len,
@@ -425,7 +420,7 @@
 }
 
 int mbedtls_ssl_tls13_derive_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret, size_t secret_len,
                    const unsigned char *label, size_t label_len,
                    const unsigned char *ctx, size_t ctx_len,
@@ -433,19 +428,30 @@
                    unsigned char *dstbuf, size_t dstbuf_len )
 {
     int ret;
-    unsigned char hashed_context[ MBEDTLS_MD_MAX_SIZE ];
-
+    unsigned char hashed_context[ PSA_HASH_MAX_SIZE ];
+/*
     const mbedtls_md_info_t *md_info;
     md_info = mbedtls_md_info_from_type( hash_alg );
     if( md_info == NULL )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
-
+*/
     if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED )
     {
+/*
         ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context );
         if( ret != 0 )
             return( ret );
         ctx_len = mbedtls_md_get_size( md_info );
+*/
+        psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+
+        status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context,
+                                   PSA_HASH_LENGTH( hash_alg ), &ctx_len );
+        if( status != PSA_SUCCESS )
+        {
+            ret = psa_ssl_status_to_mbedtls( status );
+            return ret;
+        }
     }
     else
     {
@@ -466,26 +472,25 @@
                                                  label, label_len,
                                                  hashed_context, ctx_len,
                                                  dstbuf, dstbuf_len ) );
+
 }
 
 int mbedtls_ssl_tls13_evolve_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret_old,
                    const unsigned char *input, size_t input_len,
                    unsigned char *secret_new )
 {
     int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
     size_t hlen, ilen;
-    unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 };
+    unsigned char tmp_secret[ PSA_MAC_MAX_SIZE ] = { 0 };
     unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 };
-
     size_t secret_len;
-    psa_algorithm_t alg = mbedtls_psa_translate_md( hash_alg );
-    if( ! PSA_ALG_IS_HASH( alg ) )
+
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    alg = PSA_ALG_HMAC( alg );
-    hlen = PSA_HASH_LENGTH( alg );
+    hlen = PSA_HASH_LENGTH( hash_alg );
 
     /* For non-initial runs, call Derive-Secret( ., "derived", "")
      * on the old secret. */
@@ -516,7 +521,7 @@
      * The salt is the old secret, and the input key material
      * is the input secret (PSK / ECDHE). */
     ret = psa_ssl_status_to_mbedtls(
-            mbedtls_psa_hkdf_extract( alg,
+            mbedtls_psa_hkdf_extract( PSA_ALG_HMAC( hash_alg ),
                                       tmp_secret, hlen,
                                       tmp_input, ilen,
                                       secret_new, hlen, &secret_len ) );
@@ -529,18 +534,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_early_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *early_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_early_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -558,24 +562,24 @@
      */
 
     /* Create client_early_traffic_secret */
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                         early_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                         early_secret, hash_len,
                          MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ),
                          transcript, transcript_len,
                          MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
                          derived->client_early_traffic_secret,
-                         md_size );
+                         hash_len );
     if( ret != 0 )
         return( ret );
 
     /* Create early exporter */
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                         early_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                         early_secret, hash_len,
                          MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ),
                          transcript, transcript_len,
                          MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
                          derived->early_exporter_master_secret,
-                         md_size );
+                         hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -583,18 +587,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_handshake_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *handshake_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_handshake_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -616,13 +619,13 @@
      * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello )
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-             handshake_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+             handshake_secret, hash_len,
              MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ),
              transcript, transcript_len,
              MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
              derived->client_handshake_traffic_secret,
-             md_size );
+             hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -631,13 +634,13 @@
      * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello )
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-             handshake_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+             handshake_secret, hash_len,
              MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ),
              transcript, transcript_len,
              MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
              derived->server_handshake_traffic_secret,
-             md_size );
+             hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -645,18 +648,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_application_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /* Generate {client,server}_application_traffic_secret_0
@@ -677,33 +679,33 @@
      *
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->client_application_traffic_secret_N,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->server_application_traffic_secret_N,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->exporter_master_secret,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -715,27 +717,26 @@
  * This is not integrated with mbedtls_ssl_tls13_derive_application_secrets()
  * because it uses the transcript hash up to and including ClientFinished. */
 int mbedtls_ssl_tls13_derive_resumption_master_secret(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->resumption_master_secret,
-              md_size );
+              hash_len );
 
     if( ret != 0 )
         return( ret );
@@ -747,16 +748,13 @@
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
-    mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac;
-#if defined(MBEDTLS_DEBUG_C)
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-#endif /* MBEDTLS_DEBUG_C */
+    psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
+                                        handshake->ciphersuite_info->mac );
 
     /*
      * Compute MasterSecret
      */
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                     handshake->tls13_master_secrets.handshake,
                     NULL, 0,
                     handshake->tls13_master_secrets.app );
@@ -767,24 +765,28 @@
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret",
-             handshake->tls13_master_secrets.app, md_size );
+             handshake->tls13_master_secrets.app, PSA_HASH_LENGTH( hash_alg ) );
 
     return( 0 );
 }
 
-static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type,
+static int ssl_tls13_calc_finished_core( psa_algorithm_t hash_alg,
                                          unsigned char const *base_key,
                                          unsigned char const *transcript,
-                                         unsigned char *dst )
+                                         unsigned char *dst,
+                                         size_t *dst_len )
 {
-    const mbedtls_md_info_t* const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    unsigned char finished_key[MBEDTLS_MD_MAX_SIZE];
+    mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+    size_t hash_len = PSA_HASH_LENGTH( hash_alg );
+    unsigned char finished_key[PSA_MAC_MAX_SIZE];
     int ret;
+    psa_algorithm_t alg;
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /* TLS 1.3 Finished message
@@ -805,20 +807,37 @@
      */
 
     ret = mbedtls_ssl_tls13_hkdf_expand_label(
-                                 md_type, base_key, md_size,
+                                 hash_alg, base_key, hash_len,
                                  MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ),
                                  NULL, 0,
-                                 finished_key, md_size );
+                                 finished_key, hash_len );
     if( ret != 0 )
         goto exit;
 
-    ret = mbedtls_md_hmac( md_info, finished_key, md_size, transcript, md_size, dst );
-    if( ret != 0 )
+    alg = PSA_ALG_HMAC( hash_alg );
+    psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
+    psa_set_key_algorithm( &attributes, alg );
+    psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
+
+    status = psa_import_key( &attributes, finished_key, hash_len, &key );
+    if( status != PSA_SUCCESS )
+    {
+        ret = psa_ssl_status_to_mbedtls( status );
         goto exit;
+    }
+
+    status = psa_mac_compute( key, alg, transcript, hash_len,
+                              dst, hash_len, dst_len );
+    ret = psa_ssl_status_to_mbedtls( status );
 
 exit:
 
+    status = psa_destroy_key( key );
+    if( ret == 0 )
+        ret = psa_ssl_status_to_mbedtls( status );
+
     mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) );
+
     return( ret );
 }
 
@@ -839,9 +858,10 @@
                                             &ssl->handshake->tls13_hs_secrets;
 
     mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac;
-    const mbedtls_md_info_t* const md_info =
-                                   mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+
+    psa_algorithm_t hash_alg = mbedtls_psa_translate_md(
+                                    ssl->handshake->ciphersuite_info->mac );
+    size_t const hash_lem = PSA_HASH_LENGTH( hash_alg );
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) );
 
@@ -856,7 +876,7 @@
         base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret );
     }
 
-    if( dst_len < md_size )
+    if( dst_len < hash_lem )
     {
         ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
         goto exit;
@@ -872,12 +892,11 @@
     }
     MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len );
 
-    ret = ssl_tls13_calc_finished_core( md_type, base_key, transcript, dst );
+    ret = ssl_tls13_calc_finished_core( hash_alg, base_key, transcript, dst, actual_len );
     if( ret != 0 )
         goto exit;
-    *actual_len = md_size;
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_lem );
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) );
 
 exit:
@@ -888,7 +907,7 @@
 }
 
 int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
-                               const mbedtls_md_type_t md_type,
+                               const psa_algorithm_t hash_alg,
                                unsigned char const *psk, size_t psk_len,
                                int psk_type,
                                unsigned char const *transcript,
@@ -897,8 +916,8 @@
     int ret = 0;
     unsigned char binder_key[MBEDTLS_MD_MAX_SIZE];
     unsigned char early_secret[MBEDTLS_MD_MAX_SIZE];
-    mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
+    size_t actual_len;
 
 #if !defined(MBEDTLS_DEBUG_C)
     ssl = NULL; /* make sure we don't use it except for debug */
@@ -907,7 +926,7 @@
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -921,7 +940,7 @@
      *            v
      */
 
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                                            NULL,          /* Old secret */
                                            psk, psk_len,  /* Input      */
                                            early_secret );
@@ -933,20 +952,20 @@
 
     if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION )
     {
-        ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                            early_secret, md_size,
+        ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                            early_secret, hash_len,
                             MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ),
                             NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
-                            binder_key, md_size );
+                            binder_key, hash_len );
         MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) );
     }
     else
     {
-        ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                            early_secret, md_size,
+        ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                            early_secret, hash_len,
                             MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ),
                             NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
-                            binder_key, md_size );
+                            binder_key, hash_len );
         MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) );
     }
 
@@ -961,11 +980,12 @@
      * but with the BaseKey being the binder_key.
      */
 
-    ret = ssl_tls13_calc_finished_core( md_type, binder_key, transcript, result );
+    ret = ssl_tls13_calc_finished_core( hash_alg, binder_key, transcript,
+                                        result, &actual_len );
     if( ret != 0 )
         goto exit;
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, md_size );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, actual_len );
 
 exit:
 
@@ -1155,7 +1175,7 @@
 int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl )
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-    mbedtls_md_type_t md_type;
+    psa_algorithm_t hash_alg;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
 
     if( handshake->ciphersuite_info == NULL )
@@ -1164,9 +1184,9 @@
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    md_type = handshake->ciphersuite_info->mac;
+    hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
 
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type, NULL, NULL, 0,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, NULL, 0,
                                            handshake->tls13_master_secrets.early );
     if( ret != 0 )
     {
@@ -1185,8 +1205,9 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     mbedtls_md_type_t md_type;
-    mbedtls_md_info_t const *md_info;
-    size_t md_size;
+
+    psa_algorithm_t hash_alg;
+    size_t hash_len;
 
     unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
     size_t transcript_len;
@@ -1205,8 +1226,9 @@
     iv_len = cipher_info->iv_size;
 
     md_type = ciphersuite_info->mac;
-    md_info = mbedtls_md_info_from_type( md_type );
-    md_size = mbedtls_md_get_size( md_info );
+
+    hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+    hash_len = PSA_HASH_LENGTH( hash_alg );
 
     ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type,
                                                 transcript,
@@ -1220,7 +1242,7 @@
         return( ret );
     }
 
-    ret = mbedtls_ssl_tls13_derive_handshake_secrets( md_type,
+    ret = mbedtls_ssl_tls13_derive_handshake_secrets( hash_alg,
                                     handshake->tls13_master_secrets.handshake,
                                     transcript, transcript_len, tls13_hs_secrets );
     if( ret != 0 )
@@ -1232,10 +1254,10 @@
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret",
                     tls13_hs_secrets->client_handshake_traffic_secret,
-                    md_size );
+                    hash_len );
     MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret",
                     tls13_hs_secrets->server_handshake_traffic_secret,
-                    md_size );
+                    hash_len );
 
     /*
      * Export client handshake traffic secret
@@ -1245,7 +1267,7 @@
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
                 tls13_hs_secrets->client_handshake_traffic_secret,
-                md_size,
+                hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
@@ -1253,16 +1275,16 @@
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET,
                 tls13_hs_secrets->server_handshake_traffic_secret,
-                md_size,
+                hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
     }
 
-    ret = mbedtls_ssl_tls13_make_traffic_keys( md_type,
+    ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
                             tls13_hs_secrets->client_handshake_traffic_secret,
                             tls13_hs_secrets->server_handshake_traffic_secret,
-                            md_size, key_len, iv_len, traffic_keys );
+                            hash_len, key_len, iv_len, traffic_keys );
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@@ -1299,11 +1321,8 @@
     psa_status_t status = PSA_ERROR_GENERIC_ERROR;
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
-    mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac;
-#if defined(MBEDTLS_DEBUG_C)
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-#endif /* MBEDTLS_DEBUG_C */
+    psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
+                                        handshake->ciphersuite_info->mac );
 
 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
     /*
@@ -1353,7 +1372,7 @@
     /*
      * Compute the Handshake Secret
      */
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                                            handshake->tls13_master_secrets.early,
                                            handshake->premaster, handshake->pmslen,
                                            handshake->tls13_master_secrets.handshake );
@@ -1364,7 +1383,8 @@
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret",
-                           handshake->tls13_master_secrets.handshake, md_size );
+                           handshake->tls13_master_secrets.handshake,
+                           PSA_HASH_LENGTH( hash_alg ) );
 
 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
     mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) );
@@ -1392,8 +1412,9 @@
 
     /* Variables relating to the hash for the chosen ciphersuite. */
     mbedtls_md_type_t md_type;
-    mbedtls_md_info_t const *md_info;
-    size_t md_size;
+
+    psa_algorithm_t hash_alg;
+    size_t hash_len;
 
     /* Variables relating to the cipher for the chosen ciphersuite. */
     mbedtls_cipher_info_t const *cipher_info;
@@ -1409,8 +1430,9 @@
     iv_len = cipher_info->iv_size;
 
     md_type = handshake->ciphersuite_info->mac;
-    md_info = mbedtls_md_info_from_type( md_type );
-    md_size = mbedtls_md_get_size( md_info );
+
+    hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
+    hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* Compute current handshake transcript. It's the caller's responsiblity
      * to call this at the right time, that is, after the ServerFinished. */
@@ -1423,7 +1445,7 @@
 
     /* Compute application secrets from master secret and transcript hash. */
 
-    ret = mbedtls_ssl_tls13_derive_application_secrets( md_type,
+    ret = mbedtls_ssl_tls13_derive_application_secrets( hash_alg,
                                    handshake->tls13_master_secrets.app,
                                    transcript, transcript_len,
                                    app_secrets );
@@ -1439,10 +1461,10 @@
 
     /* Derive first epoch of IV + Key for application traffic. */
 
-    ret = mbedtls_ssl_tls13_make_traffic_keys( md_type,
+    ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
                              app_secrets->client_application_traffic_secret_N,
                              app_secrets->server_application_traffic_secret_N,
-                             md_size, key_len, iv_len, traffic_keys );
+                             hash_len, key_len, iv_len, traffic_keys );
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@@ -1451,11 +1473,11 @@
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret",
                            app_secrets->client_application_traffic_secret_N,
-                           md_size );
+                           hash_len );
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret",
                            app_secrets->server_application_traffic_secret_N,
-                           md_size );
+                           hash_len );
 
     /*
      * Export client/server application traffic secret 0
@@ -1464,7 +1486,7 @@
     {
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET,
-                app_secrets->client_application_traffic_secret_N, md_size,
+                app_secrets->client_application_traffic_secret_N, hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by
@@ -1472,7 +1494,7 @@
 
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET,
-                app_secrets->server_application_traffic_secret_N, md_size,
+                app_secrets->server_application_traffic_secret_N, hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by