diff --git a/zssp/src/applicationlayer.rs b/zssp/src/applicationlayer.rs
index 68358aa95..80810944b 100644
--- a/zssp/src/applicationlayer.rs
+++ b/zssp/src/applicationlayer.rs
@@ -19,7 +19,7 @@ pub trait ApplicationLayer: Sized {
     type Data;
 
     /// Arbitrary object that dereferences to the session, such as Arc<Session<Self>>.
-    type SessionRef: Deref<Target = Session<Self>>;
+    type SessionRef<'a>: Deref<Target = Session<Self>>;
 
     /// A buffer containing data read from the network that can be cached.
     ///
@@ -57,16 +57,15 @@ pub trait ApplicationLayer: Sized {
     fn extract_s_public_from_raw(static_public: &[u8]) -> Option<P384PublicKey>;
 
     /// Look up a local session by local session ID or return None if not found.
-    fn lookup_session(&self, local_session_id: SessionId) -> Option<Self::SessionRef>;
+    fn lookup_session<'a>(&self, local_session_id: SessionId) -> Option<Self::SessionRef<'a>>;
 
     /// Rate limit and check an attempted new session (called before accept_new_session).
     fn check_new_session(&self, rc: &ReceiveContext<Self>, remote_address: &Self::RemoteAddress) -> bool;
 
     /// Check whether a new session should be accepted.
     ///
-    /// On success a tuple of local session ID, static secret, and associated object is returned. The
-    /// static secret is whatever results from agreement between the local and remote static public
-    /// keys.
+    /// On success a tuple of local session ID, psk, and associated object is returned.
+    /// Set psk to all zeros if one is not in use with the remote party.
     ///
     /// When `accept_new_session` is called, `remote_static_public` and `remote_metadata` have not yet been
     /// authenticated. As such avoid mutating state until OkNewSession(Session) is returned, as the connection
diff --git a/zssp/src/tests.rs b/zssp/src/tests.rs
index 96e4e62bb..d0f65efbc 100644
--- a/zssp/src/tests.rs
+++ b/zssp/src/tests.rs
@@ -17,7 +17,7 @@ mod tests {
         local_s: P384KeyPair,
         local_s_hash: [u8; 48],
         psk: Secret<64>,
-        session: Mutex<Option<Arc<Session<Box<TestHost>>>>>,
+        session: Mutex<Option<Arc<Session<TestHost>>>>,
         session_id_counter: Mutex<u64>,
         queue: Mutex<LinkedList<Vec<u8>>>,
         key_id: Mutex<[u8; 16]>,
@@ -43,9 +43,9 @@ mod tests {
         }
     }
 
-    impl ApplicationLayer for Box<TestHost> {
+    impl ApplicationLayer for TestHost {
         type Data = u32;
-        type SessionRef = Arc<Session<Box<TestHost>>>;
+        type SessionRef<'a> = Arc<Session<TestHost>>;
         type IncomingPacketBuffer = Vec<u8>;
         type RemoteAddress = u32;
 
@@ -67,7 +67,7 @@ mod tests {
             P384PublicKey::from_bytes(static_public)
         }
 
-        fn lookup_session(&self, local_session_id: SessionId) -> Option<Self::SessionRef> {
+        fn lookup_session<'a>(&self, local_session_id: SessionId) -> Option<Self::SessionRef<'a>> {
             self.session.lock().unwrap().as_ref().and_then(|s| {
                 if s.id == local_session_id {
                     Some(s.clone())
@@ -98,10 +98,10 @@ mod tests {
         let mut psk: Secret<64> = Secret::default();
         random::fill_bytes_secure(&mut psk.0);
 
-        let alice_host = Box::new(TestHost::new(psk.clone(), "alice", "bob"));
-        let bob_host = Box::new(TestHost::new(psk.clone(), "bob", "alice"));
-        let alice_rc: Box<ReceiveContext<Box<TestHost>>> = Box::new(ReceiveContext::new(&alice_host));
-        let bob_rc: Box<ReceiveContext<Box<TestHost>>> = Box::new(ReceiveContext::new(&bob_host));
+        let alice_host = TestHost::new(psk.clone(), "alice", "bob");
+        let bob_host = TestHost::new(psk.clone(), "bob", "alice");
+        let alice_rc: ReceiveContext<TestHost> = ReceiveContext::new(&alice_host);
+        let bob_rc: ReceiveContext<TestHost> = ReceiveContext::new(&bob_host);
 
         //println!("zssp: size of session (bytes): {}", std::mem::size_of::<Session<Box<TestHost>>>());
 
diff --git a/zssp/src/zssp.rs b/zssp/src/zssp.rs
index 93a2efecb..5c0b8d804 100644
--- a/zssp/src/zssp.rs
+++ b/zssp/src/zssp.rs
@@ -577,7 +577,7 @@ impl<Application: ApplicationLayer> ReceiveContext<Application> {
         canonical_header_bytes: &[u8; 12],
         fragments: &[Application::IncomingPacketBuffer],
         packet_type: u8,
-        session: Option<Application::SessionRef>,
+        session: Option<Application::SessionRef<'a>>,
         mtu: usize,
         current_time: i64,
     ) -> Result<ReceiveResult<'a, Application>, Error> {