diff --git a/src/ctap2/get_assertion.rs b/src/ctap2/get_assertion.rs
index 4ad2c30..54e1114 100644
--- a/src/ctap2/get_assertion.rs
+++ b/src/ctap2/get_assertion.rs
@@ -10,21 +10,22 @@ use crate::webauthn::*;
 #[derive(Clone, Debug, Eq, PartialEq, SerializeIndexed, DeserializeIndexed)]
 #[non_exhaustive]
 #[serde_indexed(offset = 1)]
-pub struct HmacSecretInput {
+pub struct HmacSecretInput<'a> {
     pub key_agreement: EcdhEsHkdf256PublicKey,
     // *either* enc(salt1) *or* enc(salt1 || salt2)
-    pub salt_enc: Bytes<80>,
-    pub salt_auth: Bytes<32>,
+    pub salt_enc: &'a serde_bytes::Bytes,
+    pub salt_auth: &'a serde_bytes::Bytes,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub pin_protocol: Option<u32>,
 }
 
 #[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
 #[non_exhaustive]
-pub struct ExtensionsInput {
+pub struct ExtensionsInput<'a> {
+    #[serde(borrow)]
     #[serde(rename = "hmac-secret")]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub hmac_secret: Option<HmacSecretInput>,
+    pub hmac_secret: Option<HmacSecretInput<'a>>,
     /// Whether a large blob key is requested.
     #[serde(rename = "largeBlobKey")]
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -62,7 +63,7 @@ pub struct Request<'a> {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub allow_list: Option<AllowList<'a>>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub extensions: Option<ExtensionsInput>,
+    pub extensions: Option<ExtensionsInput<'a>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub options: Option<AuthenticatorOptions>,
     #[serde(skip_serializing_if = "Option::is_none")]