diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 25a1b5086..d135afc86 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -167,6 +167,8 @@ psa_status_t mbedtls_psa_hkdf_extract( psa_algorithm_t alg,
             return( PSA_ERROR_INVALID_ARGUMENT );
         }
 
+        /* salt_len <= sizeof( salt ) because
+           PSA_HASH_LENGTH( alg ) <= PSA_MAC_MAX_SIZE. */
         salt = null_salt;
         salt_len = hash_len;
     }