diff --git a/src/internal.c b/src/internal.c
index 86b1b792c..4f2ab78ac 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -4427,7 +4427,8 @@ static int SanityCheckCipherText(CYASSL* ssl, word32 encryptSz)
             minLength += ssl->specs.block_size;  /* explicit IV */
     }
     else if (ssl->specs.cipher_type == aead) {
-        minLength = ssl->specs.block_size; /* explicit IV + implicit IV + CTR */
+        minLength = ssl->specs.aead_mac_size + AEAD_EXP_IV_SZ;
+                                               /* explicit IV + authTag size */
     }
 
     if (encryptSz < minLength) {