diff --git a/src/openpgp/piv.c b/src/openpgp/piv.c
index 5b895d1..17e1db9 100644
--- a/src/openpgp/piv.c
+++ b/src/openpgp/piv.c
@@ -1502,7 +1502,8 @@ static int cmd_import_asym(void) {
     else if (algo == PIV_ALGO_ECCP256 || algo == PIV_ALGO_ECCP384) {
         tlv_ctx_t a6 = {0};
         tlv_find_tag(&ctxi, 0x06, &a6);
-        if (tlv_len(&a6) <= 0) {
+        size_t scalar_size = algo == PIV_ALGO_ECCP256 ? 32 : 48;
+        if (tlv_len(&a6) != scalar_size) {
             return SW_WRONG_DATA();
         }
         mbedtls_ecp_group_id gid = algo == PIV_ALGO_ECCP256 ? MBEDTLS_ECP_DP_SECP256R1 : MBEDTLS_ECP_DP_SECP384R1;
diff --git a/tests/piv/test_060_regressions.py b/tests/piv/test_060_regressions.py
index af63a83..5270c01 100644
--- a/tests/piv/test_060_regressions.py
+++ b/tests/piv/test_060_regressions.py
@@ -112,3 +112,13 @@ def test_piv_rsa_general_authenticate_accepts_another_rsa_algorithm_id(managed_p
         assert response
     finally:
         delete_key(managed_piv, slot)
+
+
+def test_piv_ec_import_requires_the_field_length(managed_piv):
+    slot = SLOT.RETIRED1
+    try:
+        for key_type in (KEY_TYPE.ECCP256, KEY_TYPE.ECCP384):
+            body = Tlv(0x06, b"\x01")
+            assert_apdu_error(lambda: managed_piv.protocol.send_apdu(0, 0xFE, key_type, slot, body), SW.WRONG_DATA)
+    finally:
+        delete_key(managed_piv, slot)