diff --git a/src/gsm/auth_milenage.c b/src/gsm/auth_milenage.c
index 84780c6..9e94293 100644
--- a/src/gsm/auth_milenage.c
+++ b/src/gsm/auth_milenage.c
@@ -19,6 +19,7 @@
  *
  */
 
+#include <errno.h>
 #include <osmocom/crypt/auth.h>
 #include <osmocom/core/bits.h>
 #include "milenage/common.h"
@@ -57,6 +58,11 @@
 
 	OSMO_ASSERT(aud->algo == OSMO_AUTH_ALG_MILENAGE);
 
+	if (aud->u.umts.k_len != 16)
+		return -EINVAL;
+	if (aud->u.umts.opc_len != 16)
+		return -EINVAL;
+
 	opc = gen_opc_if_needed(aud, gen_opc);
 	if (!opc)
 		return -1;
@@ -154,6 +160,11 @@
 
 	OSMO_ASSERT(aud->algo == OSMO_AUTH_ALG_MILENAGE);
 
+	if (aud->u.umts.k_len != 16)
+		return -EINVAL;
+	if (aud->u.umts.opc_len != 16)
+		return -EINVAL;
+
 	opc = gen_opc_if_needed(aud, gen_opc);
 
 	rc = milenage_auts(opc, aud->u.umts.k, rand_auts, auts, sqn_out);
diff --git a/src/gsm/auth_xor.c b/src/gsm/auth_xor.c
index c94b02f..a506a03 100644
--- a/src/gsm/auth_xor.c
+++ b/src/gsm/auth_xor.c
@@ -55,9 +55,11 @@
 	/* Step 1: xdout = (ki or k) ^ rand */
 	if (aud->type == OSMO_AUTH_TYPE_GSM)
 		xor(xdout, aud->u.gsm.ki, _rand, sizeof(xdout));
-	else if (aud->type == OSMO_AUTH_TYPE_UMTS)
+	else if (aud->type == OSMO_AUTH_TYPE_UMTS) {
+		if (aud->u.umts.k_len != 16)
+			return -EINVAL;
 		xor(xdout, aud->u.umts.k, _rand, sizeof(xdout));
-	else
+	} else
 		return -ENOTSUP;
 
 	/**
@@ -141,9 +143,11 @@
 	/* Step 1: xdout = (ki or k) ^ rand */
 	if (aud->type == OSMO_AUTH_TYPE_GSM)
 		xor(xdout, aud->u.gsm.ki, _rand, sizeof(xdout));
-	else if (aud->type == OSMO_AUTH_TYPE_UMTS)
+	else if (aud->type == OSMO_AUTH_TYPE_UMTS) {
+		if (aud->u.umts.k_len != 16)
+			return -EINVAL;
 		xor(xdout, aud->u.umts.k, _rand, sizeof(xdout));
-	else
+	} else
 		return -ENOTSUP;
 
 	/* Step 2: ak = xdout[2-8] */