diff --git a/src/transaction.rs b/src/transaction.rs
index 1bc1cf6b..4af147de 100644
--- a/src/transaction.rs
+++ b/src/transaction.rs
@@ -283,12 +283,10 @@ impl<'tx> Transaction<'tx> {
     pub(crate) fn authenticated_command(
         &self,
         sign_in: &[u8],
-        out: &mut [u8],
-        out_len: &mut usize,
         algorithm: u8,
         key: u8,
         decipher: bool,
-    ) -> Result<(), Error> {
+    ) -> Result<Buffer, Error> {
         let in_len = sign_in.len();
         let mut indata = [0u8; 1024];
         let templ = [0, Ins::Authenticate.code(), algorithm, key];
@@ -380,15 +378,7 @@ impl<'tx> Transaction<'tx> {
 
         offset += 1;
         offset += get_length(&data[offset..], &mut len);
-
-        if len > *out_len {
-            error!("wrong size on output buffer");
-            return Err(Error::SizeError);
-        }
-
-        *out_len = len;
-        out[..len].copy_from_slice(&data[offset..(offset + len)]);
-        Ok(())
+        Ok(Buffer::new(data[offset..(offset + len)].into()))
     }
 
     /// Send/receive large amounts of data to/from the YubiKey, splitting long
diff --git a/src/yubikey.rs b/src/yubikey.rs
index 96bd8298..c6c4cae7 100644
--- a/src/yubikey.rs
+++ b/src/yubikey.rs
@@ -357,15 +357,13 @@ impl YubiKey {
     pub fn sign_data(
         &mut self,
         raw_in: &[u8],
-        sign_out: &mut [u8],
-        out_len: &mut usize,
         algorithm: u8,
         key: SlotId,
-    ) -> Result<(), Error> {
+    ) -> Result<Buffer, Error> {
         let txn = self.begin_transaction()?;
 
         // don't attempt to reselect in crypt operations to avoid problems with PIN_ALWAYS
-        txn.authenticated_command(raw_in, sign_out, out_len, algorithm, key, false)
+        txn.authenticated_command(raw_in, algorithm, key, false)
     }
 
     /// Decrypt data using a PIV key
@@ -373,15 +371,13 @@ impl YubiKey {
     pub fn decrypt_data(
         &mut self,
         input: &[u8],
-        out: &mut [u8],
-        out_len: &mut usize,
         algorithm: u8,
         key: SlotId,
-    ) -> Result<(), Error> {
+    ) -> Result<Buffer, Error> {
         let txn = self.begin_transaction()?;
 
         // don't attempt to reselect in crypt operations to avoid problems with PIN_ALWAYS
-        txn.authenticated_command(input, out, out_len, algorithm, key, true)
+        txn.authenticated_command(input, algorithm, key, true)
     }
 
     /// Verify device PIN.