diff --git a/quic/core/quic_connection_test.cc b/quic/core/quic_connection_test.cc
index 82195ec..de95792 100644
--- a/quic/core/quic_connection_test.cc
+++ b/quic/core/quic_connection_test.cc
@@ -98,6 +98,8 @@
   switch (level) {
     case ENCRYPTION_NONE:
       return INITIAL;
+    case ENCRYPTION_HANDSHAKE:
+      return HANDSHAKE;
     case ENCRYPTION_ZERO_RTT:
       return ZERO_RTT_PROTECTED;
     case ENCRYPTION_FORWARD_SECURE:
diff --git a/quic/core/quic_crypto_stream.cc b/quic/core/quic_crypto_stream.cc
index 61f2ab2..c424a55 100644
--- a/quic/core/quic_crypto_stream.cc
+++ b/quic/core/quic_crypto_stream.cc
@@ -30,6 +30,7 @@
                  /*is_static=*/true,
                  BIDIRECTIONAL),
       substreams_{{this, ENCRYPTION_NONE},
+                  {this, ENCRYPTION_HANDSHAKE},
                   {this, ENCRYPTION_ZERO_RTT},
                   {this, ENCRYPTION_FORWARD_SECURE}} {
   // The crypto stream is exempt from connection level flow control.
diff --git a/quic/core/quic_packet_creator.cc b/quic/core/quic_packet_creator.cc
index ec7248d..3702635 100644
--- a/quic/core/quic_packet_creator.cc
+++ b/quic/core/quic_packet_creator.cc
@@ -30,6 +30,8 @@
   switch (level) {
     case ENCRYPTION_NONE:
       return INITIAL;
+    case ENCRYPTION_HANDSHAKE:
+      return HANDSHAKE;
     case ENCRYPTION_ZERO_RTT:
       return ZERO_RTT_PROTECTED;
     case ENCRYPTION_FORWARD_SECURE:
diff --git a/quic/core/quic_packet_creator_test.cc b/quic/core/quic_packet_creator_test.cc
index 255c530..a781c51 100644
--- a/quic/core/quic_packet_creator_test.cc
+++ b/quic/core/quic_packet_creator_test.cc
@@ -147,6 +147,8 @@
         creator_(connection_id_, &client_framer_, &delegate_, &producer_),
         serialized_packet_(creator_.NoPacket()) {
     EXPECT_CALL(delegate_, GetPacketBuffer()).WillRepeatedly(Return(nullptr));
+    creator_.SetEncrypter(ENCRYPTION_HANDSHAKE, QuicMakeUnique<NullEncrypter>(
+                                                    Perspective::IS_CLIENT));
     creator_.SetEncrypter(ENCRYPTION_ZERO_RTT, QuicMakeUnique<NullEncrypter>(
                                                    Perspective::IS_CLIENT));
     creator_.SetEncrypter(
diff --git a/quic/core/quic_trace_visitor.cc b/quic/core/quic_trace_visitor.cc
index 9c69044..2c5b06d 100644
--- a/quic/core/quic_trace_visitor.cc
+++ b/quic/core/quic_trace_visitor.cc
@@ -14,6 +14,8 @@
   switch (level) {
     case ENCRYPTION_NONE:
       return quic_trace::ENCRYPTION_INITIAL;
+    case ENCRYPTION_HANDSHAKE:
+      return quic_trace::ENCRYPTION_HANDSHAKE;
     case ENCRYPTION_ZERO_RTT:
       return quic_trace::ENCRYPTION_0RTT;
     case ENCRYPTION_FORWARD_SECURE:
diff --git a/quic/core/quic_types.h b/quic/core/quic_types.h
index acf3e02..6827ff1 100644
--- a/quic/core/quic_types.h
+++ b/quic/core/quic_types.h
@@ -373,8 +373,9 @@
 // understand.
 enum EncryptionLevel : int8_t {
   ENCRYPTION_NONE = 0,
-  ENCRYPTION_ZERO_RTT = 1,
-  ENCRYPTION_FORWARD_SECURE = 2,
+  ENCRYPTION_HANDSHAKE = 1,
+  ENCRYPTION_ZERO_RTT = 2,
+  ENCRYPTION_FORWARD_SECURE = 3,
 
   NUM_ENCRYPTION_LEVELS,
 };
diff --git a/quic/core/quic_utils.cc b/quic/core/quic_utils.cc
index ddf5d3f..2768ca5 100644
--- a/quic/core/quic_utils.cc
+++ b/quic/core/quic_utils.cc
@@ -143,6 +143,7 @@
 const char* QuicUtils::EncryptionLevelToString(EncryptionLevel level) {
   switch (level) {
     RETURN_STRING_LITERAL(ENCRYPTION_NONE);
+    RETURN_STRING_LITERAL(ENCRYPTION_HANDSHAKE);
     RETURN_STRING_LITERAL(ENCRYPTION_ZERO_RTT);
     RETURN_STRING_LITERAL(ENCRYPTION_FORWARD_SECURE);
     RETURN_STRING_LITERAL(NUM_ENCRYPTION_LEVELS);
diff --git a/quic/core/tls_handshaker.cc b/quic/core/tls_handshaker.cc
index d6207bb..2b6c83f 100644
--- a/quic/core/tls_handshaker.cc
+++ b/quic/core/tls_handshaker.cc
@@ -118,6 +118,7 @@
   switch (level) {
     case ENCRYPTION_NONE:
       return ssl_encryption_initial;
+    case ENCRYPTION_HANDSHAKE:
     case ENCRYPTION_ZERO_RTT:
       return ssl_encryption_handshake;
     case ENCRYPTION_FORWARD_SECURE: