diff --git a/include/dice/boringssl_ops.h b/include/dice/boringssl_ops.h
index c188f01..51d58cd 100644
--- a/include/dice/boringssl_ops.h
+++ b/include/dice/boringssl_ops.h
@@ -35,8 +35,8 @@
 
 DiceResult DiceBsslGenerateCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 
diff --git a/include/dice/cbor_cert_op.h b/include/dice/cbor_cert_op.h
index c87dac0..bc5b28c 100644
--- a/include/dice/cbor_cert_op.h
+++ b/include/dice/cbor_cert_op.h
@@ -26,8 +26,8 @@
 // ED25519-SHA512 signature scheme.
 DiceResult DiceGenerateCborCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 
diff --git a/include/dice/dice.h b/include/dice/dice.h
index 3565571..ede56d2 100644
--- a/include/dice/dice.h
+++ b/include/dice/dice.h
@@ -26,7 +26,7 @@
 #define DICE_HASH_SIZE 64
 #define DICE_HIDDEN_SIZE 64
 #define DICE_INLINE_CONFIG_SIZE 64
-#define DICE_PRIVATE_KEY_SIZE 32
+#define DICE_PRIVATE_KEY_SEED_SIZE 32
 
 typedef enum {
   kDiceResultOk,
@@ -115,14 +115,14 @@
                     const uint8_t* info, size_t info_size, uint8_t* output);
 
   // Generates an X.509 certificate, or an alternative certificate format, from
-  // the given |subject_private_key| and |input_values|, and signed by
-  // |authority_private_key|. The subject private key is supplied here so the
-  // implementation can choose between asymmetric mechanisms, for example ECDSA
-  // vs Ed25519.
+  // the given |subject_private_key_seed| and |input_values|, and signed by
+  // |authority_private_key_seed|. The subject private key seed is supplied
+  // here so the implementation can choose between asymmetric mechanisms, for
+  // example ECDSA vs Ed25519.
   DiceResult (*generate_certificate)(
       const DiceOps* ops,
-      const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-      const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+      const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+      const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
       const DiceInputValues* input_values, size_t certificate_buffer_size,
       uint8_t* certificate, size_t* certificate_actual_size);
 
@@ -133,12 +133,12 @@
   void (*clear_memory)(const DiceOps* ops, size_t size, void* address);
 };
 
-// Derives a |cdi_private_key| from a |cdi_attest| value. On success populates
-// |cdi_private_key| and returns kDiceResultOk. Note: of the provided |ops|,
-// only 'kdf' is called.
-DiceResult DiceDeriveCdiPrivateKey(
+// Derives a |cdi_private_key_seed| from a |cdi_attest| value. On success
+// populates |cdi_private_key_seed| and returns kDiceResultOk. Note: of the
+// provided |ops|, only 'kdf' is called.
+DiceResult DiceDeriveCdiPrivateKeySeed(
     const DiceOps* ops, const uint8_t cdi_attest[DICE_CDI_SIZE],
-    uint8_t cdi_private_key[DICE_PRIVATE_KEY_SIZE]);
+    uint8_t cdi_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE]);
 
 // Derives an |id| from a |cdi_public_key| value. Because public keys can vary
 // in length depending on the algorithm, the |cdi_public_key_size| in bytes must
diff --git a/include/dice/mbedtls_ops.h b/include/dice/mbedtls_ops.h
index 783cd3e..3b71ab6 100644
--- a/include/dice/mbedtls_ops.h
+++ b/include/dice/mbedtls_ops.h
@@ -36,8 +36,8 @@
 
 DiceResult DiceMbedtlsGenerateCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 
diff --git a/include/dice/template_cbor_cert_op.h b/include/dice/template_cbor_cert_op.h
index 0797024..c756701 100644
--- a/include/dice/template_cbor_cert_op.h
+++ b/include/dice/template_cbor_cert_op.h
@@ -40,8 +40,8 @@
 //   * config_type must be kDiceConfigTypeInline
 DiceResult DiceGenerateCborCertificateFromTemplateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 
diff --git a/include/dice/template_cert_op.h b/include/dice/template_cert_op.h
index 53a2930..da668f1 100644
--- a/include/dice/template_cert_op.h
+++ b/include/dice/template_cert_op.h
@@ -40,8 +40,8 @@
 //   * config_type must be kDiceConfigTypeInline
 DiceResult DiceGenerateCertificateFromTemplateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 
diff --git a/src/boringssl_cert_op.c b/src/boringssl_cert_op.c
index 4d75b22..cfac488 100644
--- a/src/boringssl_cert_op.c
+++ b/src/boringssl_cert_op.c
@@ -505,8 +505,8 @@
 
 DiceResult DiceBsslGenerateCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   DiceResult result = kDiceResultOk;
@@ -521,14 +521,16 @@
     result = kDiceResultPlatformError;
     goto out;
   }
-  authority_key = EVP_PKEY_new_raw_private_key(
-      EVP_PKEY_ED25519, NULL, authority_private_key, DICE_PRIVATE_KEY_SIZE);
+  authority_key = EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, NULL,
+                                               authority_private_key_seed,
+                                               DICE_PRIVATE_KEY_SEED_SIZE);
   if (!authority_key) {
     result = kDiceResultPlatformError;
     goto out;
   }
-  subject_key = EVP_PKEY_new_raw_private_key(
-      EVP_PKEY_ED25519, NULL, subject_private_key, DICE_PRIVATE_KEY_SIZE);
+  subject_key = EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, NULL,
+                                             subject_private_key_seed,
+                                             DICE_PRIVATE_KEY_SEED_SIZE);
   if (!subject_key) {
     result = kDiceResultPlatformError;
     goto out;
diff --git a/src/cbor_cert_op.c b/src/cbor_cert_op.c
index ab811e0..ac20f68 100644
--- a/src/cbor_cert_op.c
+++ b/src/cbor_cert_op.c
@@ -264,8 +264,8 @@
 
 DiceResult DiceGenerateCborCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   DiceResult result = kDiceResultOk;
@@ -285,11 +285,10 @@
   uint8_t payload[kMaxCertificateSize];
   uint8_t protected_attributes[kMaxProtectedAttributesSize];
 
-  // Derive public keys and IDs from the private keys. Note: the Boringssl
-  // implementation refers to the raw private key as a seed.
+  // Derive keys and IDs from the private key seeds.
   uint8_t subject_public_key[32];
   ED25519_keypair_from_seed(subject_public_key, subject_bssl_private_key,
-                            subject_private_key);
+                            subject_private_key_seed);
 
   uint8_t subject_id[20];
   result = DiceDeriveCdiCertificateId(ops, subject_public_key, 32, subject_id);
@@ -303,7 +302,7 @@
 
   uint8_t authority_public_key[32];
   ED25519_keypair_from_seed(authority_public_key, authority_bssl_private_key,
-                            authority_private_key);
+                            authority_private_key_seed);
 
   uint8_t authority_id[20];
   result =
diff --git a/src/dice.c b/src/dice.c
index 2c7d8a6..23548e9 100644
--- a/src/dice.c
+++ b/src/dice.c
@@ -34,14 +34,14 @@
     0x1D, 0xB9, 0x52, 0x0B, 0xA5, 0x1C, 0x7B, 0x29, 0xEA};
 static const size_t kIdSaltSize = 64;
 
-DiceResult DiceDeriveCdiPrivateKey(
+DiceResult DiceDeriveCdiPrivateKeySeed(
     const DiceOps* ops, const uint8_t cdi_attest[DICE_CDI_SIZE],
-    uint8_t cdi_private_key[DICE_PRIVATE_KEY_SIZE]) {
+    uint8_t cdi_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE]) {
   // Use the CDI as input key material, with fixed salt and info.
-  return ops->kdf(ops, /*length=*/DICE_PRIVATE_KEY_SIZE, cdi_attest,
+  return ops->kdf(ops, /*length=*/DICE_PRIVATE_KEY_SEED_SIZE, cdi_attest,
                   /*ikm_size=*/DICE_CDI_SIZE, kAsymSalt, kAsymSaltSize,
                   /*info=*/(const uint8_t*)"Key Pair", /*info_size=*/8,
-                  cdi_private_key);
+                  cdi_private_key_seed);
 }
 
 DiceResult DiceDeriveCdiCertificateId(const DiceOps* ops,
@@ -93,8 +93,8 @@
                        kHiddenSize];
   uint8_t attest_input_hash[DICE_HASH_SIZE];
   uint8_t seal_input_hash[DICE_HASH_SIZE];
-  uint8_t current_cdi_private_key[DICE_PRIVATE_KEY_SIZE];
-  uint8_t next_cdi_private_key[DICE_PRIVATE_KEY_SIZE];
+  uint8_t current_cdi_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE];
+  uint8_t next_cdi_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE];
 
   // Assemble the input buffer.
   memcpy(&input_buffer[kCodeOffset], input_values->code_hash, kCodeSize);
@@ -149,22 +149,23 @@
     goto out;
   }
 
-  // Derive asymmetric private keys from the attestation CDI values.
-  result =
-      DiceDeriveCdiPrivateKey(ops, current_cdi_attest, current_cdi_private_key);
+  // Derive asymmetric private key seeds from the attestation CDI values.
+  result = DiceDeriveCdiPrivateKeySeed(ops, current_cdi_attest,
+                                       current_cdi_private_key_seed);
   if (result != kDiceResultOk) {
     goto out;
   }
-  result = DiceDeriveCdiPrivateKey(ops, next_cdi_attest, next_cdi_private_key);
+  result = DiceDeriveCdiPrivateKeySeed(ops, next_cdi_attest,
+                                       next_cdi_private_key_seed);
   if (result != kDiceResultOk) {
     goto out;
   }
 
-  // Generate a certificate for |next_cdi_private_key| with
-  // |current_cdi_private_key| as the authority.
+  // Generate a certificate for |next_cdi_private_key_seed| with
+  // |current_cdi_private_key_seed| as the authority.
   result = ops->generate_certificate(
-      ops, next_cdi_private_key, current_cdi_private_key, input_values,
-      next_cdi_certificate_buffer_size, next_cdi_certificate,
+      ops, next_cdi_private_key_seed, current_cdi_private_key_seed,
+      input_values, next_cdi_certificate_buffer_size, next_cdi_certificate,
       next_cdi_certificate_actual_size);
   if (result != kDiceResultOk) {
     goto out;
@@ -174,8 +175,9 @@
   ops->clear_memory(ops, sizeof(input_buffer), input_buffer);
   ops->clear_memory(ops, sizeof(attest_input_hash), attest_input_hash);
   ops->clear_memory(ops, sizeof(seal_input_hash), seal_input_hash);
-  ops->clear_memory(ops, sizeof(current_cdi_private_key),
-                    current_cdi_private_key);
-  ops->clear_memory(ops, sizeof(next_cdi_private_key), next_cdi_private_key);
+  ops->clear_memory(ops, sizeof(current_cdi_private_key_seed),
+                    current_cdi_private_key_seed);
+  ops->clear_memory(ops, sizeof(next_cdi_private_key_seed),
+                    next_cdi_private_key_seed);
   return result;
 }
diff --git a/src/dice_standalone_main.c b/src/dice_standalone_main.c
index 5d68b9e..caa4814 100644
--- a/src/dice_standalone_main.c
+++ b/src/dice_standalone_main.c
@@ -43,13 +43,13 @@
 
 DiceResult FakeCertificate(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   (void)ops;
-  (void)subject_private_key;
-  (void)authority_private_key;
+  (void)subject_private_key_seed;
+  (void)authority_private_key_seed;
   (void)input_values;
   (void)certificate_buffer_size;
   (void)certificate;
diff --git a/src/dice_test.cc b/src/dice_test.cc
index e0e7965..ff4edf0 100644
--- a/src/dice_test.cc
+++ b/src/dice_test.cc
@@ -34,8 +34,8 @@
 
 DiceResult FakeGenerateCertificate(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size);
 }  // extern "C"
@@ -66,13 +66,13 @@
 
   // DiceOps calls to |generate_certificate| forward here.
   DiceResult GenerateCertificate(
-      const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-      const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+      const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+      const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
       const DiceInputValues* input_values, size_t certificate_buffer_size,
       uint8_t* certificate, size_t* certificate_actual_size) {
     const uint8_t kFakeCert[kFakeCertSize] = {};
-    (void)subject_private_key;
-    (void)authority_private_key;
+    (void)subject_private_key_seed;
+    (void)authority_private_key_seed;
     (void)input_values;
     generate_certificate_count_++;
     if (certificate_buffer_size < kFakeCertSize) {
@@ -118,14 +118,14 @@
 
 DiceResult FakeGenerateCertificate(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   return reinterpret_cast<FakeDiceOps*>(ops->context)
-      ->GenerateCertificate(subject_private_key, authority_private_key,
-                            input_values, certificate_buffer_size, certificate,
-                            certificate_actual_size);
+      ->GenerateCertificate(
+          subject_private_key_seed, authority_private_key_seed, input_values,
+          certificate_buffer_size, certificate, certificate_actual_size);
 }
 
 struct DiceStateForTest {
diff --git a/src/mbedtls_ops.c b/src/mbedtls_ops.c
index 0d2a3c2..a8e3151 100644
--- a/src/mbedtls_ops.c
+++ b/src/mbedtls_ops.c
@@ -36,21 +36,22 @@
 static const size_t kMaxExtensionSize = 2048;
 static const size_t kMaxKeyIdSize = 40;
 
-static DiceResult SetupKeyPair(const uint8_t private_key[DICE_PRIVATE_KEY_SIZE],
-                               mbedtls_pk_context* context) {
+static DiceResult SetupKeyPair(
+    const uint8_t private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    mbedtls_pk_context* context) {
   if (0 !=
       mbedtls_pk_setup(context, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY))) {
     return kDiceResultPlatformError;
   }
-  // Don't use the |private_key| directly, it may not be suitable. Rather use it
-  // to seed a PRNG which is then in turn used to generate the private key. This
-  // implementation uses HMAC_DRBG in a loop with no reduction, like RFC6979.
+  // Use the |private_key_seed| directly to seed a PRNG which is then in turn
+  // used to generate the private key. This implementation uses HMAC_DRBG in a
+  // loop with no reduction, like RFC6979.
   DiceResult result = kDiceResultOk;
   mbedtls_hmac_drbg_context rng_context;
   mbedtls_hmac_drbg_init(&rng_context);
   if (0 != mbedtls_hmac_drbg_seed_buf(
                &rng_context, mbedtls_md_info_from_type(MBEDTLS_MD_SHA512),
-               private_key, DICE_PRIVATE_KEY_SIZE)) {
+               private_key_seed, DICE_PRIVATE_KEY_SEED_SIZE)) {
     result = kDiceResultPlatformError;
     goto out;
   }
@@ -293,8 +294,8 @@
 
 DiceResult DiceMbedtlsGenerateCertificateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   // 1.3.6.1.4.1.11129.2.1.24
@@ -324,7 +325,7 @@
   uint8_t tmp_buffer[kMaxCertificateSize];
 
   // Derive key pairs and IDs.
-  result = SetupKeyPair(authority_private_key, &authority_key_context);
+  result = SetupKeyPair(authority_private_key_seed, &authority_key_context);
   if (result != kDiceResultOk) {
     goto out;
   }
@@ -344,7 +345,7 @@
   if (result != kDiceResultOk) {
     goto out;
   }
-  result = SetupKeyPair(subject_private_key, &subject_key_context);
+  result = SetupKeyPair(subject_private_key_seed, &subject_key_context);
   if (result != kDiceResultOk) {
     goto out;
   }
diff --git a/src/template_cbor_cert_op.c b/src/template_cbor_cert_op.c
index cb66aae..7fe9547 100644
--- a/src/template_cbor_cert_op.c
+++ b/src/template_cbor_cert_op.c
@@ -135,8 +135,8 @@
 
 DiceResult DiceGenerateCborCertificateFromTemplateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   DiceResult result = kDiceResultOk;
@@ -161,11 +161,10 @@
   // These are 'variably modified' types so need to be declared upfront.
   uint8_t tbs[kTbsSize];
 
-  // Derive public keys and IDs from the private keys. Note: the Boringssl
-  // implementation refers to the raw private key as a seed.
+  // Derive keys and IDs from the private key seeds.
   uint8_t subject_public_key[32];
   ED25519_keypair_from_seed(subject_public_key, subject_bssl_private_key,
-                            subject_private_key);
+                            subject_private_key_seed);
 
   uint8_t subject_id[20];
   result = DiceDeriveCdiCertificateId(ops, subject_public_key, 32, subject_id);
@@ -178,7 +177,7 @@
 
   uint8_t authority_public_key[32];
   ED25519_keypair_from_seed(authority_public_key, authority_bssl_private_key,
-                            authority_private_key);
+                            authority_private_key_seed);
 
   uint8_t authority_id[20];
   result =
diff --git a/src/template_cert_op.c b/src/template_cert_op.c
index 5ea0cdd..df05578 100644
--- a/src/template_cert_op.c
+++ b/src/template_cert_op.c
@@ -150,8 +150,8 @@
 
 DiceResult DiceGenerateCertificateFromTemplateOp(
     const DiceOps* ops,
-    const uint8_t subject_private_key[DICE_PRIVATE_KEY_SIZE],
-    const uint8_t authority_private_key[DICE_PRIVATE_KEY_SIZE],
+    const uint8_t subject_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t authority_private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
     const DiceInputValues* input_values, size_t certificate_buffer_size,
     uint8_t* certificate, size_t* certificate_actual_size) {
   DiceResult result = kDiceResultOk;
@@ -173,11 +173,10 @@
   uint8_t subject_bssl_private_key[64];
   uint8_t authority_bssl_private_key[64];
 
-  // Derive public keys and IDs from the private keys. Note: the Boringssl
-  // implementation refers to the raw private key as a seed.
+  // Derive keys and IDs from the private key seeds.
   uint8_t subject_public_key[32];
   ED25519_keypair_from_seed(subject_public_key, subject_bssl_private_key,
-                            subject_private_key);
+                            subject_private_key_seed);
 
   uint8_t subject_id[20];
   result = DiceDeriveCdiCertificateId(ops, subject_public_key, 32, subject_id);
@@ -190,7 +189,7 @@
 
   uint8_t authority_public_key[32];
   ED25519_keypair_from_seed(authority_public_key, authority_bssl_private_key,
-                            authority_private_key);
+                            authority_private_key_seed);
 
   uint8_t authority_id[20];
   result =
diff --git a/src/test_utils.cc b/src/test_utils.cc
index 373c0fd..07e5f19 100644
--- a/src/test_utils.cc
+++ b/src/test_utils.cc
@@ -159,13 +159,14 @@
   HMAC_CTX ctx_;
 };
 
-bssl::UniquePtr<EVP_PKEY> KeyFromRawKey(const uint8_t raw_key[32],
-                                        dice::test::KeyType key_type,
-                                        uint8_t raw_public_key[33],
-                                        size_t* raw_public_key_size) {
+bssl::UniquePtr<EVP_PKEY> KeyFromRawKey(
+    const uint8_t raw_key[DICE_PRIVATE_KEY_SEED_SIZE],
+    dice::test::KeyType key_type, uint8_t raw_public_key[33],
+    size_t* raw_public_key_size) {
   if (key_type == dice::test::KeyType_Ed25519) {
-    bssl::UniquePtr<EVP_PKEY> key(EVP_PKEY_new_raw_private_key(
-        EVP_PKEY_ED25519, /*unused=*/nullptr, raw_key, 32));
+    bssl::UniquePtr<EVP_PKEY> key(
+        EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, /*unused=*/nullptr,
+                                     raw_key, DICE_PRIVATE_KEY_SEED_SIZE));
     *raw_public_key_size = 32;
     EVP_PKEY_get_raw_public_key(key.get(), raw_public_key, raw_public_key_size);
     return key;
@@ -296,10 +297,10 @@
   return (1 == X509_verify_cert(x509_store_ctx.get()));
 }
 
-void CreateCborUdsCertificate(const uint8_t private_key[32],
-                              const uint8_t id[20],
-                              uint8_t certificate[dice::test::kTestCertSize],
-                              size_t* certificate_size) {
+void CreateCborUdsCertificate(
+    const uint8_t private_key_seed[DICE_PRIVATE_KEY_SEED_SIZE],
+    const uint8_t id[20], uint8_t certificate[dice::test::kTestCertSize],
+    size_t* certificate_size) {
   const uint8_t kProtectedAttributesCbor[3] = {
       0xa1 /* map(1) */, 0x01 /* alg(1) */, 0x27 /* EdDSA(-8) */};
   const int64_t kCwtIssuerLabel = 1;
@@ -311,7 +312,7 @@
   // Public key encoded as a COSE_Key.
   uint8_t public_key[32];
   uint8_t bssl_private_key[64];
-  ED25519_keypair_from_seed(public_key, bssl_private_key, private_key);
+  ED25519_keypair_from_seed(public_key, bssl_private_key, private_key_seed);
   cn_cbor_errback error;
   ScopedCbor public_key_cbor(cn_cbor_map_create(&error));
   // kty = okp
@@ -618,8 +619,8 @@
                               CertificateType cert_type, KeyType key_type,
                               uint8_t certificate[kTestCertSize],
                               size_t* certificate_size) {
-  uint8_t raw_key[32];
-  DiceDeriveCdiPrivateKey(&ops, uds, raw_key);
+  uint8_t raw_key[DICE_PRIVATE_KEY_SEED_SIZE];
+  DiceDeriveCdiPrivateKeySeed(&ops, uds, raw_key);
 
   uint8_t raw_public_key[33];
   size_t raw_public_key_size = 0;