diff --git a/nts_ntp_client.c b/nts_ntp_client.c
index 10cf071..2f4b728 100644
--- a/nts_ntp_client.c
+++ b/nts_ntp_client.c
@@ -650,6 +650,7 @@ load_cookies(NNC_Instance inst)
                                             sizeof (inst->context.c2s.key));
 
   if (inst->context.s2c.length != SIV_GetKeyLength(algorithm) ||
+      inst->context.s2c.length <= 0 ||
       inst->context.c2s.length != inst->context.s2c.length)
     goto error;