diff --git a/internal/proto/credential.proto b/internal/proto/credential.proto
index b47bfcbb..d617c6a4 100644
--- a/internal/proto/credential.proto
+++ b/internal/proto/credential.proto
@@ -43,7 +43,7 @@ enum CredentialType {
 // The shared credential is derived from local credential, and distributed to
 // remote devices based on the trust token for identity decryption and
 // authentication.
-// NEXT_ID=18
+// NEXT_ID=19
 // LINT.IfChange(SharedCredential)
 message SharedCredential {
   // The randomly generated unique id of the public credential.
@@ -92,8 +92,9 @@ message SharedCredential {
   // metadata_encryption_key.
   bytes encrypted_metadata_bytes_v1 = 12;
 
-  // The tag for verifying metadata_encryption_key for an unsigned V1 adv.
-  bytes metadata_encryption_key_unsigned_adv_tag_v1 = 13;
+  // The HMAC of the plaintext identity token included (in encrypted form) in an
+  // unsigned, short salt, V1 advertisement.
+  bytes identity_token_short_salt_adv_hmac_key_v1 = 13;
 
   // The randomly generated positive unique id of the shared credential.
   int64 id = 14;
@@ -105,5 +106,13 @@ message SharedCredential {
   // Signature algorithm version. Used to determine which algorithm to use to
   // verify incoming signatures.
   string signature_version = 16;
+
+  // The HMAC of the plaintext identity token included (in encrypted form) in an
+  // unsigned, extended salt, V1 advertisement.
+  bytes identity_token_extended_salt_adv_hmac_key_v1 = 17;
+
+  // The HMAC of the plaintext identity token included (in encrypted form) in a
+  // signed V1 advertisement.
+  bytes identity_token_signed_adv_hmac_key_v1 = 18;
 }
 // LINT.ThenChange(//depot/google3/google/internal/location/nearby/presence/v1/nearby_resources.proto:SharedCredential)
diff --git a/internal/proto/local_credential.proto b/internal/proto/local_credential.proto
index b1dc79e2..e1f63b0d 100644
--- a/internal/proto/local_credential.proto
+++ b/internal/proto/local_credential.proto
@@ -72,8 +72,10 @@ message LocalCredential {
   // The set of 2-byte salts already used to encrypt the metadata key.
   map<uint32, bool> consumed_salts = 9;
 
-  // The 16 bytes aes key to encrypt metadata in PublicCredential.
-  bytes metadata_encryption_key_v1 = 10;
+  // 16 bytes of crypto-grade random data that the credential's identity
+  // provider can use to encrypt metadata in a DiscoveryCredential
+  // (SharedCredential).
+  bytes identity_token_v1 = 10;
 
   // The positive unique id of (and hashed based on) a pair of Secret Key and
   // X509Certificate's public key.