diff --git a/quic/core/chlo_extractor.cc b/quic/core/chlo_extractor.cc
index 02c0cdf..1cf6e14 100644
--- a/quic/core/chlo_extractor.cc
+++ b/quic/core/chlo_extractor.cc
@@ -125,8 +125,8 @@
   // are used instead, so those need to be created and installed.
   if (header.version.handshake_protocol == PROTOCOL_TLS1_3) {
     CrypterPair crypters;
-    CryptoUtils::CreateTlsInitialCrypters(
-        Perspective::IS_SERVER, header.version.transport_version,
+    CryptoUtils::CreateInitialObfuscators(
+        Perspective::IS_SERVER, header.version,
         header.destination_connection_id, &crypters);
     framer_->SetEncrypter(ENCRYPTION_INITIAL, std::move(crypters.encrypter));
     if (framer_->version().KnowsWhichDecrypterToUse()) {
diff --git a/quic/core/chlo_extractor_test.cc b/quic/core/chlo_extractor_test.cc
index 34f9ff4..806f6dc 100644
--- a/quic/core/chlo_extractor_test.cc
+++ b/quic/core/chlo_extractor_test.cc
@@ -72,8 +72,7 @@
                       Perspective::IS_CLIENT, kQuicDefaultConnectionIdLength);
     if (version.handshake_protocol == PROTOCOL_TLS1_3) {
       CrypterPair crypters;
-      CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_CLIENT,
-                                            version.transport_version,
+      CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT, version,
                                             TestConnectionId(), &crypters);
       framer.SetEncrypter(ENCRYPTION_INITIAL, std::move(crypters.encrypter));
       framer.InstallDecrypter(ENCRYPTION_INITIAL,
diff --git a/quic/core/crypto/crypto_utils.cc b/quic/core/crypto/crypto_utils.cc
index 89d5379..24664e9 100644
--- a/quic/core/crypto/crypto_utils.cc
+++ b/quic/core/crypto/crypto_utils.cc
@@ -14,6 +14,8 @@
 #include "net/third_party/quiche/src/quic/core/crypto/aes_128_gcm_encrypter.h"
 #include "net/third_party/quiche/src/quic/core/crypto/crypto_handshake.h"
 #include "net/third_party/quiche/src/quic/core/crypto/crypto_protocol.h"
+#include "net/third_party/quiche/src/quic/core/crypto/null_decrypter.h"
+#include "net/third_party/quiche/src/quic/core/crypto/null_encrypter.h"
 #include "net/third_party/quiche/src/quic/core/crypto/quic_decrypter.h"
 #include "net/third_party/quiche/src/quic/core/crypto/quic_encrypter.h"
 #include "net/third_party/quiche/src/quic/core/crypto/quic_hkdf.h"
@@ -99,18 +101,24 @@
 }  // namespace
 
 // static
-void CryptoUtils::CreateTlsInitialCrypters(Perspective perspective,
-                                           QuicTransportVersion version,
+void CryptoUtils::CreateInitialObfuscators(Perspective perspective,
+                                           ParsedQuicVersion version,
                                            QuicConnectionId connection_id,
                                            CrypterPair* crypters) {
   QUIC_DLOG(INFO) << "Creating "
                   << (perspective == Perspective::IS_CLIENT ? "client"
                                                             : "server")
-                  << " TLS crypters for " << connection_id;
-  QUIC_BUG_IF(!QuicUtils::IsConnectionIdValidForVersion(connection_id, version))
+                  << " crypters for version " << version << " with CID "
+                  << connection_id;
+  if (!version.UsesInitialObfuscators()) {
+    crypters->encrypter = std::make_unique<NullEncrypter>(perspective);
+    crypters->decrypter = std::make_unique<NullDecrypter>(perspective);
+    return;
+  }
+  QUIC_BUG_IF(!QuicUtils::IsConnectionIdValidForVersion(
+      connection_id, version.transport_version))
       << "CreateTlsInitialCrypters: attempted to use connection ID "
-      << connection_id << " which is invalid with version "
-      << QuicVersionToString(version);
+      << connection_id << " which is invalid with version " << version;
   const EVP_MD* hash = EVP_sha256();
 
   std::vector<uint8_t> handshake_secret;
diff --git a/quic/core/crypto/crypto_utils.h b/quic/core/crypto/crypto_utils.h
index b881778..0eae972 100644
--- a/quic/core/crypto/crypto_utils.h
+++ b/quic/core/crypto/crypto_utils.h
@@ -80,16 +80,18 @@
                           const std::vector<uint8_t>& pp_secret,
                           QuicCrypter* crypter);
 
-  // QUIC encrypts TLS handshake messages with a version-specific key (to
-  // prevent network observers that are not aware of that QUIC version from
+  // IETF QUIC encrypts ENCRYPTION_INITIAL messages with a version-specific key
+  // (to prevent network observers that are not aware of that QUIC version from
   // making decisions based on the TLS handshake). This packet protection secret
   // is derived from the connection ID in the client's Initial packet.
   //
   // This function takes that |connection_id| and creates the encrypter and
   // decrypter (put in |*crypters|) to use for this packet protection, as well
-  // as setting the key and IV on those crypters.
-  static void CreateTlsInitialCrypters(Perspective perspective,
-                                       QuicTransportVersion version,
+  // as setting the key and IV on those crypters. For older versions of QUIC
+  // that do not use the new IETF style ENCRYPTION_INITIAL obfuscators, this
+  // function puts a NullEncrypter and NullDecrypter in |*crypters|.
+  static void CreateInitialObfuscators(Perspective perspective,
+                                       ParsedQuicVersion version,
                                        QuicConnectionId connection_id,
                                        CrypterPair* crypters);
 
diff --git a/quic/core/quic_connection.cc b/quic/core/quic_connection.cc
index 87deb70..ebd2f45 100644
--- a/quic/core/quic_connection.cc
+++ b/quic/core/quic_connection.cc
@@ -365,8 +365,8 @@
     return;
   }
   CrypterPair crypters;
-  CryptoUtils::CreateTlsInitialCrypters(perspective_, transport_version(),
-                                        connection_id, &crypters);
+  CryptoUtils::CreateInitialObfuscators(perspective_, version(), connection_id,
+                                        &crypters);
   SetEncrypter(ENCRYPTION_INITIAL, std::move(crypters.encrypter));
   InstallDecrypter(ENCRYPTION_INITIAL, std::move(crypters.decrypter));
 }
diff --git a/quic/core/quic_framer_test.cc b/quic/core/quic_framer_test.cc
index 933b975..beb6571 100644
--- a/quic/core/quic_framer_test.cc
+++ b/quic/core/quic_framer_test.cc
@@ -12214,8 +12214,8 @@
     // bogus connection ID; it should fail to decrypt everything.
     QuicConnectionId bogus_connection_id = TestConnectionId(0xbad);
     CrypterPair bogus_crypters;
-    CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_CLIENT,
-                                          framer_.transport_version(),
+    CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT,
+                                          framer_.version(),
                                           bogus_connection_id, &bogus_crypters);
     // This removes all other decrypters.
     framer_.SetDecrypter(ENCRYPTION_FORWARD_SECURE,
@@ -12319,9 +12319,9 @@
   // bogus connection ID; it should fail to decrypt everything.
   QuicConnectionId bogus_connection_id = TestConnectionId(0xbad);
   CrypterPair bad_handshake_crypters;
-  CryptoUtils::CreateTlsInitialCrypters(
-      Perspective::IS_CLIENT, framer_.transport_version(), bogus_connection_id,
-      &bad_handshake_crypters);
+  CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT,
+                                        framer_.version(), bogus_connection_id,
+                                        &bad_handshake_crypters);
   if (framer_.version().KnowsWhichDecrypterToUse()) {
     framer_.InstallDecrypter(ENCRYPTION_HANDSHAKE,
                              std::move(bad_handshake_crypters.decrypter));
@@ -12431,9 +12431,9 @@
   // bogus connection ID; it should fail to decrypt everything.
   QuicConnectionId bogus_connection_id = TestConnectionId(0xbad);
   CrypterPair bad_handshake_crypters;
-  CryptoUtils::CreateTlsInitialCrypters(
-      Perspective::IS_CLIENT, framer_.transport_version(), bogus_connection_id,
-      &bad_handshake_crypters);
+  CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT,
+                                        framer_.version(), bogus_connection_id,
+                                        &bad_handshake_crypters);
   framer_.InstallDecrypter(ENCRYPTION_HANDSHAKE,
                            std::move(bad_handshake_crypters.decrypter));
   // clang-format off
@@ -12694,7 +12694,8 @@
 // padding inside the initial. We need to make sure that we still process
 // the initial correctly and ignore the zeroes.
 TEST_P(QuicFramerTest, CoalescedPacketWithZeroesRoundTrip) {
-  if (!QuicVersionHasLongHeaderLengths(framer_.transport_version())) {
+  if (!QuicVersionHasLongHeaderLengths(framer_.transport_version()) ||
+      !framer_.version().UsesInitialObfuscators()) {
     return;
   }
   ASSERT_TRUE(framer_.version().KnowsWhichDecrypterToUse());
@@ -12702,9 +12703,9 @@
   QuicFramerPeer::SetPerspective(&framer_, Perspective::IS_CLIENT);
 
   CrypterPair client_crypters;
-  CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_CLIENT,
-                                        framer_.transport_version(),
-                                        connection_id, &client_crypters);
+  CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT,
+                                        framer_.version(), connection_id,
+                                        &client_crypters);
   framer_.SetEncrypter(ENCRYPTION_INITIAL,
                        std::move(client_crypters.encrypter));
 
@@ -12730,9 +12731,9 @@
 
   QuicFramerPeer::SetPerspective(&framer_, Perspective::IS_SERVER);
   CrypterPair server_crypters;
-  CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_SERVER,
-                                        framer_.transport_version(),
-                                        connection_id, &server_crypters);
+  CryptoUtils::CreateInitialObfuscators(Perspective::IS_SERVER,
+                                        framer_.version(), connection_id,
+                                        &server_crypters);
   framer_.InstallDecrypter(ENCRYPTION_INITIAL,
                            std::move(server_crypters.decrypter));
 
diff --git a/quic/core/quic_versions.cc b/quic/core/quic_versions.cc
index d2f4297..c69452a 100644
--- a/quic/core/quic_versions.cc
+++ b/quic/core/quic_versions.cc
@@ -54,6 +54,10 @@
          handshake_protocol == PROTOCOL_TLS1_3;
 }
 
+bool ParsedQuicVersion::UsesInitialObfuscators() const {
+  return handshake_protocol == PROTOCOL_TLS1_3;
+}
+
 bool ParsedQuicVersion::AllowsLowFlowControlLimits() const {
   return transport_version == QUIC_VERSION_99 &&
          handshake_protocol == PROTOCOL_TLS1_3;
diff --git a/quic/core/quic_versions.h b/quic/core/quic_versions.h
index 5b2a6ed..ba160a6 100644
--- a/quic/core/quic_versions.h
+++ b/quic/core/quic_versions.h
@@ -159,6 +159,10 @@
 
   bool KnowsWhichDecrypterToUse() const;
 
+  // Returns whether this version uses keys derived from the Connection ID for
+  // ENCRYPTION_INITIAL keys (instead of NullEncrypter/NullDecrypter).
+  bool UsesInitialObfuscators() const;
+
   // Indicates that this QUIC version does not have an enforced minimum value
   // for flow control values negotiated during the handshake.
   bool AllowsLowFlowControlLimits() const;
diff --git a/quic/test_tools/quic_test_utils.cc b/quic/test_tools/quic_test_utils.cc
index 7a43deb..594f9af 100644
--- a/quic/test_tools/quic_test_utils.cc
+++ b/quic/test_tools/quic_test_utils.cc
@@ -902,8 +902,7 @@
   if (version.handshake_protocol == PROTOCOL_TLS1_3 &&
       level == ENCRYPTION_INITIAL) {
     CrypterPair crypters;
-    CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_CLIENT,
-                                          version.transport_version,
+    CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT, version,
                                           destination_connection_id, &crypters);
     framer.SetEncrypter(ENCRYPTION_INITIAL, std::move(crypters.encrypter));
     if (version.KnowsWhichDecrypterToUse()) {
@@ -990,8 +989,7 @@
                     kQuicDefaultConnectionIdLength);
   if (version.handshake_protocol == PROTOCOL_TLS1_3 && version_flag) {
     CrypterPair crypters;
-    CryptoUtils::CreateTlsInitialCrypters(Perspective::IS_CLIENT,
-                                          version.transport_version,
+    CryptoUtils::CreateInitialObfuscators(Perspective::IS_CLIENT, version,
                                           destination_connection_id, &crypters);
     framer.SetEncrypter(ENCRYPTION_INITIAL, std::move(crypters.encrypter));
     framer.InstallDecrypter(ENCRYPTION_INITIAL, std::move(crypters.decrypter));