diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 6329e0d..a50fe86 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -52,11 +52,6 @@
 #include "mbedtls/ecjpake.h"
 #endif
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-#include "psa/crypto.h"
-#include "mbedtls/psa_util.h"
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
 #include "common.h"
 
 #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
@@ -2187,11 +2182,15 @@
         case PSA_SUCCESS:
             return( 0 );
         case PSA_ERROR_INSUFFICIENT_MEMORY:
-            return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
         case PSA_ERROR_NOT_SUPPORTED:
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
         case PSA_ERROR_INVALID_SIGNATURE:
             return( MBEDTLS_ERR_SSL_INVALID_MAC );
+        case PSA_ERROR_INVALID_ARGUMENT:
+            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        case PSA_ERROR_BAD_STATE:
+            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
         default:
             return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
     }
diff --git a/library/ssl_tls13_invasive.h b/library/ssl_tls13_invasive.h
index a025dbe..4e39f90 100644
--- a/library/ssl_tls13_invasive.h
+++ b/library/ssl_tls13_invasive.h
@@ -20,22 +20,17 @@
 
 #include "common.h"
 
-#if defined(MBEDTLS_PSA_CRYPTO_C)
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+
 #include "psa/crypto.h"
-#endif
 
 #if defined(MBEDTLS_TEST_HOOKS)
 
-#if defined(MBEDTLS_PSA_CRYPTO_C)
-
 /**
  *  \brief  Take the input keying material \p ikm and extract from it a
  *          fixed-length pseudorandom key \p prk.
  *
- *  \param       alg       The HMAC algorithm to use
- *                         (\c #PSA_ALG_HMAC( PSA_ALG_XXX ) value such that
- *                         PSA_ALG_XXX is a hash algorithm and
- *                         #PSA_ALG_IS_HMAC(\p alg) is true).
+ *  \param       hash_alg  Hash algorithm to use.
  *  \param       salt      An optional salt value (a non-secret random value);
  *                         if the salt is not provided, a string of all zeros
  *                         of the length of the hash provided by \p alg is used
@@ -53,7 +48,7 @@
  *  \return An PSA_ERROR_* error for errors returned from the underlying
  *          PSA layer.
  */
-psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg,
+psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t hash_alg,
                                        const unsigned char *salt, size_t salt_len,
                                        const unsigned char *ikm, size_t ikm_len,
                                        unsigned char *prk, size_t prk_size,
@@ -63,9 +58,7 @@
  *  \brief  Expand the supplied \p prk into several additional pseudorandom
  *          keys, which is the output of the HKDF.
  *
- *  \param  alg       The HMAC algorithm to use (\c #PSA_ALG_HMAC( PSA_ALG_XXX )
- *                    value such that PSA_ALG_XXX is a hash algorithm and
- *                    #PSA_ALG_IS_HMAC(\p alg) is true).
+ *  \param  hash_alg  Hash algorithm to use.
  *  \param  prk       A pseudorandom key of \p prk_len bytes. \p prk is
  *                    usually the output from the HKDF extract step.
  *  \param  prk_len   The length in bytes of \p prk.
@@ -82,13 +75,13 @@
  *  \return An PSA_ERROR_* error for errors returned from the underlying
  *          PSA layer.
  */
-psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg,
+psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t hash_alg,
                                       const unsigned char *prk, size_t prk_len,
                                       const unsigned char *info, size_t info_len,
                                       unsigned char *okm, size_t okm_len );
 
-#endif /* MBEDTLS_PSA_CRYPTO_C */
-
 #endif /* MBEDTLS_TEST_HOOKS */
 
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
 #endif /* MBEDTLS_SSL_TLS13_INVASIVE_H */
diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index a5af590..d7deaba 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -136,10 +136,8 @@
     *dst_len = total_hkdf_lbl_len;
 }
 
-#if defined( MBEDTLS_TEST_HOOKS )
-
 MBEDTLS_STATIC_TESTABLE
-psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg,
+psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t hash_alg,
                                        const unsigned char *salt, size_t salt_len,
                                        const unsigned char *ikm, size_t ikm_len,
                                        unsigned char *prk, size_t prk_size,
@@ -150,6 +148,7 @@
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     psa_status_t destroy_status = PSA_ERROR_CORRUPTION_DETECTED;
+    psa_algorithm_t alg = PSA_ALG_HMAC( hash_alg );
 
     if( salt == NULL || salt_len == 0 )
     {
@@ -192,7 +191,7 @@
 }
 
 MBEDTLS_STATIC_TESTABLE
-psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t alg,
+psa_status_t mbedtls_psa_hkdf_expand( psa_algorithm_t hash_alg,
                                       const unsigned char *prk, size_t prk_len,
                                       const unsigned char *info, size_t info_len,
                                       unsigned char *okm, size_t okm_len )
@@ -208,6 +207,7 @@
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     psa_status_t destroy_status = PSA_ERROR_CORRUPTION_DETECTED;
     unsigned char t[PSA_MAC_MAX_SIZE];
+    psa_algorithm_t alg = PSA_ALG_HMAC( hash_alg );
 
     if( okm == NULL )
     {
@@ -312,16 +312,13 @@
     return( ( status == PSA_SUCCESS ) ? destroy_status : status );
 }
 
-#endif /* MBEDTLS_TEST_HOOKS */
-
 int mbedtls_ssl_tls13_hkdf_expand_label(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *secret, size_t secret_len,
                      const unsigned char *label, size_t label_len,
                      const unsigned char *ctx, size_t ctx_len,
                      unsigned char *buf, size_t buf_len )
 {
-    const mbedtls_md_info_t *md_info;
     unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ];
     size_t hkdf_label_len;
 
@@ -345,8 +342,7 @@
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    md_info = mbedtls_md_info_from_type( hash_alg );
-    if( md_info == NULL )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     ssl_tls13_hkdf_encode_label( buf_len,
@@ -355,10 +351,11 @@
                                  hkdf_label,
                                  &hkdf_label_len );
 
-    return( mbedtls_hkdf_expand( md_info,
-                                 secret, secret_len,
-                                 hkdf_label, hkdf_label_len,
-                                 buf, buf_len ) );
+    return( psa_ssl_status_to_mbedtls(
+                mbedtls_psa_hkdf_expand( hash_alg,
+                                         secret, secret_len,
+                                         hkdf_label, hkdf_label_len,
+                                         buf, buf_len ) ) );
 }
 
 /*
@@ -378,7 +375,7 @@
  * keys in a single function call.
  */
 int mbedtls_ssl_tls13_make_traffic_keys(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *client_secret,
                      const unsigned char *server_secret, size_t secret_len,
                      size_t key_len, size_t iv_len,
@@ -425,7 +422,7 @@
 }
 
 int mbedtls_ssl_tls13_derive_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret, size_t secret_len,
                    const unsigned char *label, size_t label_len,
                    const unsigned char *ctx, size_t ctx_len,
@@ -433,19 +430,18 @@
                    unsigned char *dstbuf, size_t dstbuf_len )
 {
     int ret;
-    unsigned char hashed_context[ MBEDTLS_MD_MAX_SIZE ];
-
-    const mbedtls_md_info_t *md_info;
-    md_info = mbedtls_md_info_from_type( hash_alg );
-    if( md_info == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
-
+    unsigned char hashed_context[ PSA_HASH_MAX_SIZE ];
     if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED )
     {
-        ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context );
-        if( ret != 0 )
-            return( ret );
-        ctx_len = mbedtls_md_get_size( md_info );
+        psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+
+        status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context,
+                                   PSA_HASH_LENGTH( hash_alg ), &ctx_len );
+        if( status != PSA_SUCCESS )
+        {
+            ret = psa_ssl_status_to_mbedtls( status );
+            return ret;
+        }
     }
     else
     {
@@ -466,25 +462,25 @@
                                                  label, label_len,
                                                  hashed_context, ctx_len,
                                                  dstbuf, dstbuf_len ) );
+
 }
 
 int mbedtls_ssl_tls13_evolve_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret_old,
                    const unsigned char *input, size_t input_len,
                    unsigned char *secret_new )
 {
     int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
     size_t hlen, ilen;
-    unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 };
+    unsigned char tmp_secret[ PSA_MAC_MAX_SIZE ] = { 0 };
     unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 };
+    size_t secret_len;
 
-    const mbedtls_md_info_t *md_info;
-    md_info = mbedtls_md_info_from_type( hash_alg );
-    if( md_info == NULL )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    hlen = mbedtls_md_get_size( md_info );
+    hlen = PSA_HASH_LENGTH( hash_alg );
 
     /* For non-initial runs, call Derive-Secret( ., "derived", "")
      * on the old secret. */
@@ -514,14 +510,11 @@
     /* HKDF-Extract takes a salt and input key material.
      * The salt is the old secret, and the input key material
      * is the input secret (PSK / ECDHE). */
-    ret = mbedtls_hkdf_extract( md_info,
-                    tmp_secret, hlen,
-                    tmp_input, ilen,
-                    secret_new );
-    if( ret != 0 )
-        goto cleanup;
-
-    ret = 0;
+    ret = psa_ssl_status_to_mbedtls(
+            mbedtls_psa_hkdf_extract( hash_alg,
+                                      tmp_secret, hlen,
+                                      tmp_input, ilen,
+                                      secret_new, hlen, &secret_len ) );
 
  cleanup:
 
@@ -531,18 +524,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_early_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *early_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_early_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -560,24 +552,24 @@
      */
 
     /* Create client_early_traffic_secret */
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                         early_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                         early_secret, hash_len,
                          MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ),
                          transcript, transcript_len,
                          MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
                          derived->client_early_traffic_secret,
-                         md_size );
+                         hash_len );
     if( ret != 0 )
         return( ret );
 
     /* Create early exporter */
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                         early_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                         early_secret, hash_len,
                          MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ),
                          transcript, transcript_len,
                          MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
                          derived->early_exporter_master_secret,
-                         md_size );
+                         hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -585,18 +577,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_handshake_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *handshake_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_handshake_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -618,13 +609,13 @@
      * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello )
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-             handshake_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+             handshake_secret, hash_len,
              MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ),
              transcript, transcript_len,
              MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
              derived->client_handshake_traffic_secret,
-             md_size );
+             hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -633,13 +624,13 @@
      * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello )
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-             handshake_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+             handshake_secret, hash_len,
              MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ),
              transcript, transcript_len,
              MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
              derived->server_handshake_traffic_secret,
-             md_size );
+             hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -647,18 +638,17 @@
 }
 
 int mbedtls_ssl_tls13_derive_application_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /* Generate {client,server}_application_traffic_secret_0
@@ -679,33 +669,33 @@
      *
      */
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->client_application_traffic_secret_N,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->server_application_traffic_secret_N,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->exporter_master_secret,
-              md_size );
+              hash_len );
     if( ret != 0 )
         return( ret );
 
@@ -717,27 +707,26 @@
  * This is not integrated with mbedtls_ssl_tls13_derive_application_secrets()
  * because it uses the transcript hash up to and including ClientFinished. */
 int mbedtls_ssl_tls13_derive_resumption_master_secret(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived )
 {
     int ret;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
-    ret = mbedtls_ssl_tls13_derive_secret( md_type,
-              application_secret, md_size,
+    ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+              application_secret, hash_len,
               MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ),
               transcript, transcript_len,
               MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
               derived->resumption_master_secret,
-              md_size );
+              hash_len );
 
     if( ret != 0 )
         return( ret );
@@ -749,16 +738,13 @@
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
-    mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac;
-#if defined(MBEDTLS_DEBUG_C)
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-#endif /* MBEDTLS_DEBUG_C */
+    psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
+                                        handshake->ciphersuite_info->mac );
 
     /*
      * Compute MasterSecret
      */
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                     handshake->tls13_master_secrets.handshake,
                     NULL, 0,
                     handshake->tls13_master_secrets.app );
@@ -769,24 +755,28 @@
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret",
-             handshake->tls13_master_secrets.app, md_size );
+             handshake->tls13_master_secrets.app, PSA_HASH_LENGTH( hash_alg ) );
 
     return( 0 );
 }
 
-static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type,
+static int ssl_tls13_calc_finished_core( psa_algorithm_t hash_alg,
                                          unsigned char const *base_key,
                                          unsigned char const *transcript,
-                                         unsigned char *dst )
+                                         unsigned char *dst,
+                                         size_t *dst_len )
 {
-    const mbedtls_md_info_t* const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    unsigned char finished_key[MBEDTLS_MD_MAX_SIZE];
+    mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+    size_t hash_len = PSA_HASH_LENGTH( hash_alg );
+    unsigned char finished_key[PSA_MAC_MAX_SIZE];
     int ret;
+    psa_algorithm_t alg;
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /* TLS 1.3 Finished message
@@ -807,20 +797,37 @@
      */
 
     ret = mbedtls_ssl_tls13_hkdf_expand_label(
-                                 md_type, base_key, md_size,
+                                 hash_alg, base_key, hash_len,
                                  MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ),
                                  NULL, 0,
-                                 finished_key, md_size );
+                                 finished_key, hash_len );
     if( ret != 0 )
         goto exit;
 
-    ret = mbedtls_md_hmac( md_info, finished_key, md_size, transcript, md_size, dst );
-    if( ret != 0 )
+    alg = PSA_ALG_HMAC( hash_alg );
+    psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
+    psa_set_key_algorithm( &attributes, alg );
+    psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
+
+    status = psa_import_key( &attributes, finished_key, hash_len, &key );
+    if( status != PSA_SUCCESS )
+    {
+        ret = psa_ssl_status_to_mbedtls( status );
         goto exit;
+    }
+
+    status = psa_mac_compute( key, alg, transcript, hash_len,
+                              dst, hash_len, dst_len );
+    ret = psa_ssl_status_to_mbedtls( status );
 
 exit:
 
+    status = psa_destroy_key( key );
+    if( ret == 0 )
+        ret = psa_ssl_status_to_mbedtls( status );
+
     mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) );
+
     return( ret );
 }
 
@@ -841,9 +848,10 @@
                                             &ssl->handshake->tls13_hs_secrets;
 
     mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac;
-    const mbedtls_md_info_t* const md_info =
-                                   mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+
+    psa_algorithm_t hash_alg = mbedtls_psa_translate_md(
+                                    ssl->handshake->ciphersuite_info->mac );
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) );
 
@@ -858,7 +866,7 @@
         base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret );
     }
 
-    if( dst_len < md_size )
+    if( dst_len < hash_len )
     {
         ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
         goto exit;
@@ -874,12 +882,11 @@
     }
     MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len );
 
-    ret = ssl_tls13_calc_finished_core( md_type, base_key, transcript, dst );
+    ret = ssl_tls13_calc_finished_core( hash_alg, base_key, transcript, dst, actual_len );
     if( ret != 0 )
         goto exit;
-    *actual_len = md_size;
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_len );
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) );
 
 exit:
@@ -890,17 +897,17 @@
 }
 
 int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
-                               const mbedtls_md_type_t md_type,
+                               const psa_algorithm_t hash_alg,
                                unsigned char const *psk, size_t psk_len,
                                int psk_type,
                                unsigned char const *transcript,
                                unsigned char *result )
 {
     int ret = 0;
-    unsigned char binder_key[MBEDTLS_MD_MAX_SIZE];
-    unsigned char early_secret[MBEDTLS_MD_MAX_SIZE];
-    mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
+    unsigned char binder_key[PSA_MAC_MAX_SIZE];
+    unsigned char early_secret[PSA_MAC_MAX_SIZE];
+    size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
+    size_t actual_len;
 
 #if !defined(MBEDTLS_DEBUG_C)
     ssl = NULL; /* make sure we don't use it except for debug */
@@ -909,7 +916,7 @@
 
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
-    if( md_info == 0 )
+    if( ! PSA_ALG_IS_HASH( hash_alg ) )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
     /*
@@ -923,7 +930,7 @@
      *            v
      */
 
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                                            NULL,          /* Old secret */
                                            psk, psk_len,  /* Input      */
                                            early_secret );
@@ -935,20 +942,20 @@
 
     if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION )
     {
-        ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                            early_secret, md_size,
+        ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                            early_secret, hash_len,
                             MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ),
                             NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
-                            binder_key, md_size );
+                            binder_key, hash_len );
         MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) );
     }
     else
     {
-        ret = mbedtls_ssl_tls13_derive_secret( md_type,
-                            early_secret, md_size,
+        ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
+                            early_secret, hash_len,
                             MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ),
                             NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
-                            binder_key, md_size );
+                            binder_key, hash_len );
         MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) );
     }
 
@@ -963,11 +970,12 @@
      * but with the BaseKey being the binder_key.
      */
 
-    ret = ssl_tls13_calc_finished_core( md_type, binder_key, transcript, result );
+    ret = ssl_tls13_calc_finished_core( hash_alg, binder_key, transcript,
+                                        result, &actual_len );
     if( ret != 0 )
         goto exit;
 
-    MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, md_size );
+    MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, actual_len );
 
 exit:
 
@@ -1157,7 +1165,7 @@
 int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl )
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-    mbedtls_md_type_t md_type;
+    psa_algorithm_t hash_alg;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
 
     if( handshake->ciphersuite_info == NULL )
@@ -1166,9 +1174,9 @@
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
     }
 
-    md_type = handshake->ciphersuite_info->mac;
+    hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
 
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type, NULL, NULL, 0,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, NULL, 0,
                                            handshake->tls13_master_secrets.early );
     if( ret != 0 )
     {
@@ -1187,8 +1195,9 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     mbedtls_md_type_t md_type;
-    mbedtls_md_info_t const *md_info;
-    size_t md_size;
+
+    psa_algorithm_t hash_alg;
+    size_t hash_len;
 
     unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
     size_t transcript_len;
@@ -1207,8 +1216,9 @@
     iv_len = cipher_info->iv_size;
 
     md_type = ciphersuite_info->mac;
-    md_info = mbedtls_md_info_from_type( md_type );
-    md_size = mbedtls_md_get_size( md_info );
+
+    hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
+    hash_len = PSA_HASH_LENGTH( hash_alg );
 
     ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type,
                                                 transcript,
@@ -1222,7 +1232,7 @@
         return( ret );
     }
 
-    ret = mbedtls_ssl_tls13_derive_handshake_secrets( md_type,
+    ret = mbedtls_ssl_tls13_derive_handshake_secrets( hash_alg,
                                     handshake->tls13_master_secrets.handshake,
                                     transcript, transcript_len, tls13_hs_secrets );
     if( ret != 0 )
@@ -1234,10 +1244,10 @@
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret",
                     tls13_hs_secrets->client_handshake_traffic_secret,
-                    md_size );
+                    hash_len );
     MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret",
                     tls13_hs_secrets->server_handshake_traffic_secret,
-                    md_size );
+                    hash_len );
 
     /*
      * Export client handshake traffic secret
@@ -1247,7 +1257,7 @@
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
                 tls13_hs_secrets->client_handshake_traffic_secret,
-                md_size,
+                hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
@@ -1255,16 +1265,16 @@
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET,
                 tls13_hs_secrets->server_handshake_traffic_secret,
-                md_size,
+                hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
     }
 
-    ret = mbedtls_ssl_tls13_make_traffic_keys( md_type,
+    ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
                             tls13_hs_secrets->client_handshake_traffic_secret,
                             tls13_hs_secrets->server_handshake_traffic_secret,
-                            md_size, key_len, iv_len, traffic_keys );
+                            hash_len, key_len, iv_len, traffic_keys );
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@@ -1301,11 +1311,8 @@
     psa_status_t status = PSA_ERROR_GENERIC_ERROR;
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
-    mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac;
-#if defined(MBEDTLS_DEBUG_C)
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-#endif /* MBEDTLS_DEBUG_C */
+    psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
+                                        handshake->ciphersuite_info->mac );
 
 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
     /*
@@ -1355,7 +1362,7 @@
     /*
      * Compute the Handshake Secret
      */
-    ret = mbedtls_ssl_tls13_evolve_secret( md_type,
+    ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
                                            handshake->tls13_master_secrets.early,
                                            handshake->premaster, handshake->pmslen,
                                            handshake->tls13_master_secrets.handshake );
@@ -1366,7 +1373,8 @@
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret",
-                           handshake->tls13_master_secrets.handshake, md_size );
+                           handshake->tls13_master_secrets.handshake,
+                           PSA_HASH_LENGTH( hash_alg ) );
 
 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
     mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) );
@@ -1394,8 +1402,9 @@
 
     /* Variables relating to the hash for the chosen ciphersuite. */
     mbedtls_md_type_t md_type;
-    mbedtls_md_info_t const *md_info;
-    size_t md_size;
+
+    psa_algorithm_t hash_alg;
+    size_t hash_len;
 
     /* Variables relating to the cipher for the chosen ciphersuite. */
     mbedtls_cipher_info_t const *cipher_info;
@@ -1411,8 +1420,9 @@
     iv_len = cipher_info->iv_size;
 
     md_type = handshake->ciphersuite_info->mac;
-    md_info = mbedtls_md_info_from_type( md_type );
-    md_size = mbedtls_md_get_size( md_info );
+
+    hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
+    hash_len = PSA_HASH_LENGTH( hash_alg );
 
     /* Compute current handshake transcript. It's the caller's responsiblity
      * to call this at the right time, that is, after the ServerFinished. */
@@ -1425,7 +1435,7 @@
 
     /* Compute application secrets from master secret and transcript hash. */
 
-    ret = mbedtls_ssl_tls13_derive_application_secrets( md_type,
+    ret = mbedtls_ssl_tls13_derive_application_secrets( hash_alg,
                                    handshake->tls13_master_secrets.app,
                                    transcript, transcript_len,
                                    app_secrets );
@@ -1441,10 +1451,10 @@
 
     /* Derive first epoch of IV + Key for application traffic. */
 
-    ret = mbedtls_ssl_tls13_make_traffic_keys( md_type,
+    ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
                              app_secrets->client_application_traffic_secret_N,
                              app_secrets->server_application_traffic_secret_N,
-                             md_size, key_len, iv_len, traffic_keys );
+                             hash_len, key_len, iv_len, traffic_keys );
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@@ -1453,11 +1463,11 @@
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret",
                            app_secrets->client_application_traffic_secret_N,
-                           md_size );
+                           hash_len );
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret",
                            app_secrets->server_application_traffic_secret_N,
-                           md_size );
+                           hash_len );
 
     /*
      * Export client/server application traffic secret 0
@@ -1466,7 +1476,7 @@
     {
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET,
-                app_secrets->client_application_traffic_secret_N, md_size,
+                app_secrets->client_application_traffic_secret_N, hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by
@@ -1474,7 +1484,7 @@
 
         ssl->f_export_keys( ssl->p_export_keys,
                 MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET,
-                app_secrets->server_application_traffic_secret_N, md_size,
+                app_secrets->server_application_traffic_secret_N, hash_len,
                 handshake->randbytes,
                 handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
                 MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by
diff --git a/library/ssl_tls13_keys.h b/library/ssl_tls13_keys.h
index da967c3..d56067c 100644
--- a/library/ssl_tls13_keys.h
+++ b/library/ssl_tls13_keys.h
@@ -44,6 +44,14 @@
     MBEDTLS_SSL_TLS1_3_LABEL( client_cv   , "TLS 1.3, client CertificateVerify" ) \
     MBEDTLS_SSL_TLS1_3_LABEL( server_cv   , "TLS 1.3, server CertificateVerify" )
 
+#define MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED 0
+#define MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED   1
+
+#define MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL   0
+#define MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION 1
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+
 #define MBEDTLS_SSL_TLS1_3_LABEL( name, string )       \
     const unsigned char name    [ sizeof(string) - 1 ];
 
@@ -114,7 +122,7 @@
  */
 
 int mbedtls_ssl_tls13_hkdf_expand_label(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *secret, size_t secret_len,
                      const unsigned char *label, size_t label_len,
                      const unsigned char *ctx, size_t ctx_len,
@@ -152,16 +160,12 @@
  */
 
 int mbedtls_ssl_tls13_make_traffic_keys(
-                     mbedtls_md_type_t hash_alg,
+                     psa_algorithm_t hash_alg,
                      const unsigned char *client_secret,
                      const unsigned char *server_secret, size_t secret_len,
                      size_t key_len, size_t iv_len,
                      mbedtls_ssl_key_set *keys );
 
-
-#define MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED 0
-#define MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED   1
-
 /**
  * \brief The \c Derive-Secret function from the TLS 1.3 standard RFC 8446.
  *
@@ -202,7 +206,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret, size_t secret_len,
                    const unsigned char *label, size_t label_len,
                    const unsigned char *ctx, size_t ctx_len,
@@ -235,14 +239,14 @@
  *        is omitted here. Its calculation is part of the separate routine
  *        mbedtls_ssl_tls13_create_psk_binder().
  *
- * \param md_type      The hash algorithm associated with the PSK for which
+ * \param hash_alg     The hash algorithm associated with the PSK for which
  *                     early data key material is being derived.
  * \param early_secret The early secret from which the early data key material
  *                     should be derived. This must be a readable buffer whose
  *                     length is the digest size of the hash algorithm
  *                     represented by \p md_size.
  * \param transcript   The transcript of the handshake so far, calculated with
- *                     respect to \p md_type. This must be a readable buffer
+ *                     respect to \p hash_alg. This must be a readable buffer
  *                     whose length is the digest size of the hash algorithm
  *                     represented by \p md_size.
  * \param derived      The address of the structure in which to store
@@ -252,7 +256,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_early_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *early_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_early_secrets *derived );
@@ -280,14 +284,14 @@
  *        the client and server secret derived by this function need to be
  *        further processed by mbedtls_ssl_tls13_make_traffic_keys().
  *
- * \param md_type           The hash algorithm associated with the ciphersuite
+ * \param hash_alg          The hash algorithm associated with the ciphersuite
  *                          that's being used for the connection.
  * \param handshake_secret  The handshake secret from which the handshake key
  *                          material should be derived. This must be a readable
  *                          buffer whose length is the digest size of the hash
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake so far, calculated
- *                          with respect to \p md_type. This must be a readable
+ *                          with respect to \p hash_alg. This must be a readable
  *                          buffer whose length is the digest size of the hash
  *                          algorithm represented by \p md_size.
  * \param derived           The address of the structure in which to
@@ -297,7 +301,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_handshake_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *handshake_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_handshake_secrets *derived );
@@ -329,7 +333,7 @@
  *        the client and server secret derived by this function need to be
  *        further processed by mbedtls_ssl_tls13_make_traffic_keys().
  *
- * \param md_type           The hash algorithm associated with the ciphersuite
+ * \param hash_alg          The hash algorithm associated with the ciphersuite
  *                          that's being used for the connection.
  * \param master_secret     The master secret from which the application key
  *                          material should be derived. This must be a readable
@@ -337,9 +341,9 @@
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake up to and including
  *                          the ServerFinished message, calculated with respect
- *                          to \p md_type. This must be a readable buffer whose
+ *                          to \p hash_alg. This must be a readable buffer whose
  *                          length is the digest size of the hash algorithm
- *                          represented by \p md_type.
+ *                          represented by \p hash_alg.
  * \param derived           The address of the structure in which to
  *                          store the application key material.
  *
@@ -347,7 +351,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_application_secrets(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *master_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived );
@@ -358,7 +362,7 @@
  *        This is a small wrapper invoking mbedtls_ssl_tls13_derive_secret()
  *        with the appropriate labels from the standard.
  *
- * \param md_type           The hash algorithm used in the application for which
+ * \param hash_alg          The hash algorithm used in the application for which
  *                          key material is being derived.
  * \param application_secret The application secret from which the resumption master
  *                          secret should be derived. This must be a readable
@@ -366,9 +370,9 @@
  *                          algorithm represented by \p md_size.
  * \param transcript        The transcript of the handshake up to and including
  *                          the ClientFinished message, calculated with respect
- *                          to \p md_type. This must be a readable buffer whose
+ *                          to \p hash_alg. This must be a readable buffer whose
  *                          length is the digest size of the hash algorithm
- *                          represented by \p md_type.
+ *                          represented by \p hash_alg.
  * \param transcript_len    The length of \p transcript in Bytes.
  * \param derived           The address of the structure in which to
  *                          store the resumption master secret.
@@ -377,7 +381,7 @@
  * \returns        A negative error code on failure.
  */
 int mbedtls_ssl_tls13_derive_resumption_master_secret(
-          mbedtls_md_type_t md_type,
+          psa_algorithm_t hash_alg,
           unsigned char const *application_secret,
           unsigned char const *transcript, size_t transcript_len,
           mbedtls_ssl_tls13_application_secrets *derived );
@@ -450,20 +454,17 @@
  */
 
 int mbedtls_ssl_tls13_evolve_secret(
-                   mbedtls_md_type_t hash_alg,
+                   psa_algorithm_t hash_alg,
                    const unsigned char *secret_old,
                    const unsigned char *input, size_t input_len,
                    unsigned char *secret_new );
 
-#define MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL   0
-#define MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION 1
-
 /**
  * \brief             Calculate a TLS 1.3 PSK binder.
  *
  * \param ssl         The SSL context. This is used for debugging only and may
  *                    be \c NULL if MBEDTLS_DEBUG_C is disabled.
- * \param md_type     The hash algorithm associated to the PSK \p psk.
+ * \param hash_alg    The hash algorithm associated to the PSK \p psk.
  * \param psk         The buffer holding the PSK for which to create a binder.
  * \param psk_len     The size of \p psk in bytes.
  * \param psk_type    This indicates whether the PSK \p psk is externally
@@ -472,17 +473,17 @@
  * \param transcript  The handshake transcript up to the point where the
  *                    PSK binder calculation happens. This must be readable,
  *                    and its size must be equal to the digest size of
- *                    the hash algorithm represented by \p md_type.
+ *                    the hash algorithm represented by \p hash_alg.
  * \param result      The address at which to store the PSK binder on success.
  *                    This must be writable, and its size must be equal to the
  *                    digest size of  the hash algorithm represented by
- *                    \p md_type.
+ *                    \p hash_alg.
  *
  * \returns           \c 0 on success.
  * \returns           A negative error code on failure.
  */
 int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
-                               const mbedtls_md_type_t md_type,
+                               const psa_algorithm_t hash_alg,
                                unsigned char const *psk, size_t psk_len,
                                int psk_type,
                                unsigned char const *transcript,
@@ -637,4 +638,6 @@
                                              size_t *actual_len,
                                              int which );
 
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
 #endif /* MBEDTLS_SSL_TLS1_3_KEYS_H */
diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data
index e330016..b46d3be 100644
--- a/tests/suites/test_suite_ssl.data
+++ b/tests/suites/test_suite_ssl.data
@@ -2780,218 +2780,240 @@
 SSL TLS 1.3 Key schedule: Secret evolution #1
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Initial secret to Early Secret
-depends_on:MBEDTLS_SSL_PROTO_TLS1_3
-ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_key_evolution:PSA_ALG_SHA_256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
 
 SSL TLS 1.3 Key schedule: Secret evolution #2
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Early secret to Handshake Secret
-ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_key_evolution:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a"
 
 SSL TLS 1.3 Key schedule: Secret evolution #3
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Handshake secret to Master Secret
-ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_key_evolution:PSA_ALG_SHA_256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Extract
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5"
+psa_hkdf_extract:PSA_ALG_SHA_256:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #2 Extract
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244"
+psa_hkdf_extract:PSA_ALG_SHA_256:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #3 Extract
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_256):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04"
+psa_hkdf_extract:PSA_ALG_SHA_256:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #4 Extract
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243"
+psa_hkdf_extract:PSA_ALG_SHA_1:"0b0b0b0b0b0b0b0b0b0b0b":"000102030405060708090a0b0c":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #5 Extract
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"8adae09a2a307059478d309b26c4115a224cfaf6"
+psa_hkdf_extract:PSA_ALG_SHA_1:"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f":"606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf":"8adae09a2a307059478d309b26c4115a224cfaf6"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #6 Extract
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01"
+psa_hkdf_extract:PSA_ALG_SHA_1:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #7 Extract
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_extract:PSA_ALG_HMAC(PSA_ALG_SHA_1):"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c":"":"2adccada18779e7c2077ad2eb19d3f3e731385dd"
+psa_hkdf_extract:PSA_ALG_SHA_1:"0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c":"":"2adccada18779e7c2077ad2eb19d3f3e731385dd"
 
 SSL TLS 1.3 Key schedule: HKDF extract fails with wrong hash alg
 psa_hkdf_extract_ret:0:PSA_ERROR_INVALID_ARGUMENT
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Expand
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"f0f1f2f3f4f5f6f7f8f9":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5":"3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865"
+psa_hkdf_expand:PSA_ALG_SHA_256:"f0f1f2f3f4f5f6f7f8f9":"077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5":"3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #2 Expand
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244":"b11e398dc80327a1c8e7f78c596a49344f012eda2d4efad8a050cc4c19afa97c59045a99cac7827271cb41c65e590e09da3275600c2f09b8367793a9aca3db71cc30c58179ec3e87c14c01d5c1f3434f1d87"
+psa_hkdf_expand:PSA_ALG_SHA_256:"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244":"b11e398dc80327a1c8e7f78c596a49344f012eda2d4efad8a050cc4c19afa97c59045a99cac7827271cb41c65e590e09da3275600c2f09b8367793a9aca3db71cc30c58179ec3e87c14c01d5c1f3434f1d87"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #3 Expand
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_256):"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04":"8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"
+psa_hkdf_expand:PSA_ALG_SHA_256:"":"19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04":"8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #4 Expand
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"f0f1f2f3f4f5f6f7f8f9":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243":"085a01ea1b10f36933068b56efa5ad81a4f14b822f5b091568a9cdd4f155fda2c22e422478d305f3f896"
+psa_hkdf_expand:PSA_ALG_SHA_1:"f0f1f2f3f4f5f6f7f8f9":"9b6c18c432a7bf8f0e71c8eb88f4b30baa2ba243":"085a01ea1b10f36933068b56efa5ad81a4f14b822f5b091568a9cdd4f155fda2c22e422478d305f3f896"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #5 Expand
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"8adae09a2a307059478d309b26c4115a224cfaf6":"0bd770a74d1160f7c9f12cd5912a06ebff6adcae899d92191fe4305673ba2ffe8fa3f1a4e5ad79f3f334b3b202b2173c486ea37ce3d397ed034c7f9dfeb15c5e927336d0441f4c4300e2cff0d0900b52d3b4"
+psa_hkdf_expand:PSA_ALG_SHA_1:"b0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff":"8adae09a2a307059478d309b26c4115a224cfaf6":"0bd770a74d1160f7c9f12cd5912a06ebff6adcae899d92191fe4305673ba2ffe8fa3f1a4e5ad79f3f334b3b202b2173c486ea37ce3d397ed034c7f9dfeb15c5e927336d0441f4c4300e2cff0d0900b52d3b4"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #6 Expand
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01":"0ac1af7002b3d761d1e55298da9d0506b9ae52057220a306e07b6b87e8df21d0ea00033de03984d34918"
+psa_hkdf_expand:PSA_ALG_SHA_1:"":"da8c8a73c7fa77288ec6f5e7c297786aa0d32d01":"0ac1af7002b3d761d1e55298da9d0506b9ae52057220a306e07b6b87e8df21d0ea00033de03984d34918"
 
 SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #7 Expand
 depends_on:PSA_WANT_ALG_SHA_1
-psa_hkdf_expand:PSA_ALG_HMAC(PSA_ALG_SHA_1):"":"2adccada18779e7c2077ad2eb19d3f3e731385dd":"2c91117204d745f3500d636a62f64f0ab3bae548aa53d423b0d1f27ebba6f5e5673a081d70cce7acfc48"
+psa_hkdf_expand:PSA_ALG_SHA_1:"":"2adccada18779e7c2077ad2eb19d3f3e731385dd":"2c91117204d745f3500d636a62f64f0ab3bae548aa53d423b0d1f27ebba6f5e5673a081d70cce7acfc48"
 
 SSL TLS 1.3 Key schedule: HKDF expand fails with NULL okm
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:0:PSA_ERROR_INVALID_ARGUMENT
+psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:0:PSA_ERROR_INVALID_ARGUMENT
 
 SSL TLS 1.3 Key schedule: HKDF expand fails with invalid alg
 psa_hkdf_expand_ret:0:32:32:PSA_ERROR_INVALID_ARGUMENT
 
-SSL TLS 1.3 Key schedule: HKDF expand fails with incompatible alg
-depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:32:PSA_ERROR_INVALID_ARGUMENT
-
 SSL TLS 1.3 Key schedule: HKDF expand fails with prk_len < hash_len
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):16:32:PSA_ERROR_INVALID_ARGUMENT
+psa_hkdf_expand_ret:PSA_ALG_SHA_256:16:32:PSA_ERROR_INVALID_ARGUMENT
 
 SSL TLS 1.3 Key schedule: HKDF expand fails with okm_len / hash_len > 255
-psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:8192:PSA_ERROR_INVALID_ARGUMENT
+psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:8192:PSA_ERROR_INVALID_ARGUMENT
 
 SSL TLS 1.3 Key schedule: HKDF expand fails with key import
 depends_on:PSA_WANT_ALG_SHA_256
-psa_hkdf_expand_ret:PSA_ALG_HMAC(PSA_ALG_SHA_256):32:32:PSA_ERROR_INSUFFICIENT_MEMORY
+psa_hkdf_expand_ret:PSA_ALG_SHA_256:32:32:PSA_ERROR_INSUFFICIENT_MEMORY
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #1
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Server handshake traffic secret -> Server traffic key
 # HKDF-Expand-Label(server_handshake_secret, "key", "", 16)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #2
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Server handshake traffic secret -> Server traffic IV
 # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #3
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Client handshake traffic secret -> Client traffic key
 # HKDF-Expand-Label(client_handshake_secret, "key", "", 16)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #4
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Client handshake traffic secret -> Client traffic IV
 # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #5 (RFC 8448)
 # Vector from RFC 8448
 # Server handshake traffic secret -> Server traffic IV
 # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #6 (RFC 8448)
 # Vector from RFC 8448
 # Server handshake traffic secret -> Server traffic Key
 # HKDF-Expand-Label(server_handshake_secret, "key", "", 16)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #7 (RFC 8448)
 # Vector from RFC 8448
 # Client handshake traffic secret -> Client traffic IV
 # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #8 (RFC 8448)
 # Vector from RFC 8448
 # Client handshake traffic secret -> Client traffic Key
 # HKDF-Expand-Label(client_handshake_secret, "key", "", 16)
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #9 (RFC 8448)
 # Calculation of finished_key
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e"
 
 SSL TLS 1.3 Key schedule: HKDF Expand Label #10 (RFC 8448)
 # Calculation of resumption key
-ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3"
 
 SSL TLS 1.3 Key schedule: Traffic key generation #1
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV}
-ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
 
 SSL TLS 1.3 Key schedule: Traffic key generation #2 (RFC 8448)
 # Vector RFC 8448
 # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV}
-ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "derived", "")
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Derive-Secret( Early-Secret, "derived", "")
 # Tests the case where context isn't yet hashed (empty string here,
 # but still needs to be hashed)
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #1
 # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
 # Derive-Secret( MasterSecret, "s ap traffic", hash)
 # Tests the case where context is already hashed
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "c e traffic", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "e exp master", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "c hs traffic", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "s hs traffic", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "c ap traffic", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #2
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "exp master", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
 
 SSL TLS 1.3 Key schedule: Derive-Secret( ., "res master", hash)
 # Vector from RFC 8448
-ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
 
 SSL TLS 1.3 Key schedule: Early secrets derivation helper
 # Vector from RFC 8448
-ssl_tls13_derive_early_secrets:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_early_secrets:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
 
 SSL TLS 1.3 Key schedule: Handshake secrets derivation helper
 # Vector from RFC 8448
-ssl_tls13_derive_handshake_secrets:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_handshake_secrets:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
 
 SSL TLS 1.3 Record Encryption, tls13.ulfheim.net Example #1
 # - Server App Key: 0b6d22c8ff68097ea871c672073773bf
@@ -3051,17 +3073,20 @@
 
 SSL TLS 1.3 Key schedule: Application secrets derivation helper
 # Vector from RFC 8448
-ssl_tls13_derive_application_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_application_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
 
 SSL TLS 1.3 Key schedule: Resumption secrets derivation helper
 # Vector from RFC 8448
-ssl_tls13_derive_resumption_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_derive_resumption_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
 
 SSL TLS 1.3 Key schedule: PSK binder
 # Vector from RFC 8448
 # For the resumption PSK, see Section 3, 'generate resumption secret "tls13 resumption"'
 # For all other data, see Section 4, 'construct a ClientHello handshake message:'
-ssl_tls13_create_psk_binder:MBEDTLS_MD_SHA256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d"
+depends_on:PSA_WANT_ALG_SHA_256
+ssl_tls13_create_psk_binder:PSA_ALG_SHA_256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d"
 
 SSL TLS_PRF MBEDTLS_SSL_TLS_PRF_NONE
 ssl_tls_prf:MBEDTLS_SSL_TLS_PRF_NONE:"":"":"test tls_prf label":"":MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index f71e154..fd42b06 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -4121,8 +4121,10 @@
     TEST_ASSERT( (size_t) desired_length <= sizeof(dst) );
     TEST_ASSERT( (size_t) desired_length == expected->len );
 
+    PSA_INIT( );
+
     TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label(
-                      (mbedtls_md_type_t) hash_alg,
+                      (psa_algorithm_t) hash_alg,
                       secret->x, secret->len,
                       lbl, lbl_len,
                       ctx->x, ctx->len,
@@ -4130,6 +4132,8 @@
 
     ASSERT_COMPARE( dst, (size_t) desired_length,
                     expected->x, (size_t) expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4153,8 +4157,10 @@
     TEST_ASSERT( expected_client_write_key->len == expected_server_write_key->len &&
                  expected_client_write_key->len == (size_t) desired_key_len );
 
+    PSA_INIT( );
+
     TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys(
-                     (mbedtls_md_type_t) hash_alg,
+                     (psa_algorithm_t) hash_alg,
                      client_secret->x,
                      server_secret->x,
                      client_secret->len /* == server_secret->len */,
@@ -4177,6 +4183,8 @@
                     keys.iv_len,
                     expected_server_write_iv->x,
                     (size_t) desired_iv_len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4207,8 +4215,10 @@
     TEST_ASSERT( (size_t) desired_length <= sizeof(dst) );
     TEST_ASSERT( (size_t) desired_length == expected->len );
 
+    PSA_INIT( );
+
     TEST_ASSERT( mbedtls_ssl_tls13_derive_secret(
-                      (mbedtls_md_type_t) hash_alg,
+                      (psa_algorithm_t) hash_alg,
                       secret->x, secret->len,
                       lbl, lbl_len,
                       ctx->x, ctx->len,
@@ -4217,6 +4227,8 @@
 
     ASSERT_COMPARE( dst, desired_length,
                     expected->x, desired_length );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4230,23 +4242,26 @@
     mbedtls_ssl_tls13_early_secrets secrets;
 
     /* Double-check that we've passed sane parameters. */
-    mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    TEST_ASSERT( md_info != 0                      &&
-                 secret->len == md_size            &&
-                 transcript->len == md_size        &&
-                 traffic_expected->len == md_size  &&
-                 exporter_expected->len == md_size );
+    psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
+    size_t const hash_len = PSA_HASH_LENGTH( alg );
+    TEST_ASSERT( PSA_ALG_IS_HASH( alg )             &&
+                 secret->len == hash_len            &&
+                 transcript->len == hash_len        &&
+                 traffic_expected->len == hash_len  &&
+                 exporter_expected->len == hash_len );
+
+    PSA_INIT( );
 
     TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets(
-                     md_type, secret->x, transcript->x, transcript->len,
+                     alg, secret->x, transcript->x, transcript->len,
                      &secrets ) == 0 );
 
-    ASSERT_COMPARE( secrets.client_early_traffic_secret, md_size,
+    ASSERT_COMPARE( secrets.client_early_traffic_secret, hash_len,
                     traffic_expected->x, traffic_expected->len );
-    ASSERT_COMPARE( secrets.early_exporter_master_secret, md_size,
+    ASSERT_COMPARE( secrets.early_exporter_master_secret, hash_len,
                     exporter_expected->x, exporter_expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4260,23 +4275,26 @@
     mbedtls_ssl_tls13_handshake_secrets secrets;
 
     /* Double-check that we've passed sane parameters. */
-    mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    TEST_ASSERT( md_info != 0                      &&
-                 secret->len == md_size            &&
-                 transcript->len == md_size        &&
-                 client_expected->len == md_size   &&
-                 server_expected->len == md_size );
+    psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
+    size_t const hash_len = PSA_HASH_LENGTH( alg );
+    TEST_ASSERT( PSA_ALG_IS_HASH( alg )            &&
+                 secret->len == hash_len           &&
+                 transcript->len == hash_len       &&
+                 client_expected->len == hash_len  &&
+                 server_expected->len == hash_len );
+
+    PSA_INIT( );
 
     TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets(
-                     md_type, secret->x, transcript->x, transcript->len,
+                     alg, secret->x, transcript->x, transcript->len,
                      &secrets ) == 0 );
 
-    ASSERT_COMPARE( secrets.client_handshake_traffic_secret, md_size,
+    ASSERT_COMPARE( secrets.client_handshake_traffic_secret, hash_len,
                     client_expected->x, client_expected->len );
-    ASSERT_COMPARE( secrets.server_handshake_traffic_secret, md_size,
+    ASSERT_COMPARE( secrets.server_handshake_traffic_secret, hash_len,
                     server_expected->x, server_expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4291,26 +4309,29 @@
     mbedtls_ssl_tls13_application_secrets secrets;
 
     /* Double-check that we've passed sane parameters. */
-    mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    TEST_ASSERT( md_info != 0                      &&
-                 secret->len == md_size            &&
-                 transcript->len == md_size        &&
-                 client_expected->len == md_size   &&
-                 server_expected->len == md_size   &&
-                 exporter_expected->len == md_size );
+    psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
+    size_t const hash_len = PSA_HASH_LENGTH( alg );
+    TEST_ASSERT( PSA_ALG_IS_HASH( alg )            &&
+                 secret->len == hash_len           &&
+                 transcript->len == hash_len       &&
+                 client_expected->len == hash_len  &&
+                 server_expected->len == hash_len  &&
+                 exporter_expected->len == hash_len );
+
+    PSA_INIT( );
 
     TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets(
-                     md_type, secret->x, transcript->x, transcript->len,
+                     alg, secret->x, transcript->x, transcript->len,
                      &secrets ) == 0 );
 
-    ASSERT_COMPARE( secrets.client_application_traffic_secret_N, md_size,
+    ASSERT_COMPARE( secrets.client_application_traffic_secret_N, hash_len,
                     client_expected->x, client_expected->len );
-    ASSERT_COMPARE( secrets.server_application_traffic_secret_N, md_size,
+    ASSERT_COMPARE( secrets.server_application_traffic_secret_N, hash_len,
                     server_expected->x, server_expected->len );
-    ASSERT_COMPARE( secrets.exporter_master_secret, md_size,
+    ASSERT_COMPARE( secrets.exporter_master_secret, hash_len,
                     exporter_expected->x, exporter_expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4323,20 +4344,23 @@
     mbedtls_ssl_tls13_application_secrets secrets;
 
     /* Double-check that we've passed sane parameters. */
-    mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    TEST_ASSERT( md_info != 0                        &&
-                 secret->len == md_size              &&
-                 transcript->len == md_size          &&
-                 resumption_expected->len == md_size );
+    psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
+    size_t const hash_len = PSA_HASH_LENGTH( alg );
+    TEST_ASSERT( PSA_ALG_IS_HASH( alg )              &&
+                 secret->len == hash_len             &&
+                 transcript->len == hash_len         &&
+                 resumption_expected->len == hash_len );
+
+    PSA_INIT( );
 
     TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret(
-                     md_type, secret->x, transcript->x, transcript->len,
+                     alg, secret->x, transcript->x, transcript->len,
                      &secrets ) == 0 );
 
-    ASSERT_COMPARE( secrets.resumption_master_secret, md_size,
+    ASSERT_COMPARE( secrets.resumption_master_secret, hash_len,
                     resumption_expected->x, resumption_expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4350,23 +4374,26 @@
     unsigned char binder[ MBEDTLS_MD_MAX_SIZE ];
 
     /* Double-check that we've passed sane parameters. */
-    mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg;
-    mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
-    size_t const md_size = mbedtls_md_get_size( md_info );
-    TEST_ASSERT( md_info != 0                    &&
-                 transcript->len == md_size      &&
-                 binder_expected->len == md_size );
+    psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
+    size_t const hash_len = PSA_HASH_LENGTH( alg );
+    TEST_ASSERT( PSA_ALG_IS_HASH( alg )          &&
+                 transcript->len == hash_len     &&
+                 binder_expected->len == hash_len );
+
+    PSA_INIT( );
 
     TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder(
                      NULL, /* SSL context for debugging only */
-                     md_type,
+                     alg,
                      psk->x, psk->len,
                      psk_type,
                      transcript->x,
                      binder ) == 0 );
 
-    ASSERT_COMPARE( binder, md_size,
+    ASSERT_COMPARE( binder, hash_len,
                     binder_expected->x, binder_expected->len );
+
+    PSA_DONE( );
 }
 /* END_CASE */
 
@@ -4479,14 +4506,18 @@
 {
     unsigned char secret_new[ MBEDTLS_MD_MAX_SIZE ];
 
+    PSA_INIT();
+
     TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret(
-                      (mbedtls_md_type_t) hash_alg,
+                      (psa_algorithm_t) hash_alg,
                       secret->len ? secret->x : NULL,
                       input->len ? input->x : NULL, input->len,
                       secret_new ) == 0 );
 
     ASSERT_COMPARE( secret_new, (size_t) expected->len,
                     expected->x, (size_t) expected->len );
+
+    PSA_DONE();
 }
 /* END_CASE */