diff --git a/quic/core/tls_handshaker.h b/quic/core/tls_handshaker.h
index 80615a1..ab84e3b 100644
--- a/quic/core/tls_handshaker.h
+++ b/quic/core/tls_handshaker.h
@@ -71,16 +71,22 @@
     return handshaker_delegate_;
   }
 
-  // SetEncryptionSecret provides the encryption secret to use at a particular
-  // encryption level. The secrets provided here are the ones from the TLS 1.3
-  // key schedule (RFC 8446 section 7.1), in particular the handshake traffic
-  // secrets and application traffic secrets. For a given secret |secret|,
-  // |level| indicates which EncryptionLevel it is to be used at, and |is_write|
-  // indicates whether it is used for encryption or decryption.
-  // Returns true if secret is sucessfully set, otherwise, returns false.
-  bool SetEncryptionSecret(EncryptionLevel level,
-                           const std::vector<uint8_t>& read_secret,
-                           const std::vector<uint8_t>& write_secret) override;
+  // SetWriteSecret provides the encryption secret used to encrypt messages at
+  // encryption level |level|. The secret provided here is the one from the TLS
+  // 1.3 key schedule (RFC 8446 section 7.1), in particular the handshake
+  // traffic secrets and application traffic secrets. The provided write secret
+  // must be used with the provided cipher suite |cipher|.
+  void SetWriteSecret(EncryptionLevel level,
+                      const SSL_CIPHER* cipher,
+                      const std::vector<uint8_t>& write_secret) override;
+
+  // SetReadSecret is similar to SetWriteSecret, except that it is used for
+  // decrypting messages. SetReadSecret at a particular level is always called
+  // after SetWriteSecret for that level, except for ENCRYPTION_ZERO_RTT, where
+  // the EncryptionLevel for SetWriteSecret is ENCRYPTION_FORWARD_SECURE.
+  bool SetReadSecret(EncryptionLevel level,
+                     const SSL_CIPHER* cipher,
+                     const std::vector<uint8_t>& read_secret) override;
 
   // WriteMessage is called when there is |data| from the TLS stack ready for
   // the QUIC stack to write in a crypto frame. The data must be transmitted at