diff --git a/components/wpa_supplicant/src/common/wpa_common.c b/components/wpa_supplicant/src/common/wpa_common.c
index a7532c47b9..adfc78330a 100644
--- a/components/wpa_supplicant/src/common/wpa_common.c
+++ b/components/wpa_supplicant/src/common/wpa_common.c
@@ -673,6 +673,16 @@ int wpa_cipher_put_suites(u8 *pos, int ciphers)
 	return num_suites;
 }
 
+unsigned int wpa_mic_len(int akmp)
+{
+    /* The following code is supposed to be used for 192 bit encryption support only
+	if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
+		return 24;
+    */
+
+	return 16;
+}
+
 #endif // ESP_SUPPLICANT
 
 
diff --git a/components/wpa_supplicant/src/common/wpa_common.h b/components/wpa_supplicant/src/common/wpa_common.h
index f88e8a6fac..322f55e010 100644
--- a/components/wpa_supplicant/src/common/wpa_common.h
+++ b/components/wpa_supplicant/src/common/wpa_common.h
@@ -335,4 +335,6 @@ int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
 
 int rsn_cipher_put_suites(u8 *pos, int ciphers);
 
+unsigned int wpa_mic_len(int akmp);
+
 #endif /* WPA_COMMON_H */
diff --git a/components/wpa_supplicant/src/rsn_supp/wpa.c b/components/wpa_supplicant/src/rsn_supp/wpa.c
index f2de646141..6e9cbe9c8a 100644
--- a/components/wpa_supplicant/src/rsn_supp/wpa.c
+++ b/components/wpa_supplicant/src/rsn_supp/wpa.c
@@ -1170,7 +1170,7 @@ int   ieee80211w_set_keys(struct wpa_sm *sm,
     
     os_bzero(null_rsc, WPA_KEY_RSC_LEN);
 
-    if (sm->proto == WPA_PROTO_RSN) {
+    if (sm->proto == WPA_PROTO_RSN && isptk) {
         key_rsc = null_rsc;
     } else {
         key_rsc = key->key_rsc;
@@ -1772,6 +1772,9 @@ int   wpa_sm_rx_eapol(u8 *src_addr, u8 *buf, u32 len)
     u16 key_info, ver;
     u8 *tmp;
     int ret = -1;
+    size_t mic_len;
+
+    mic_len = wpa_mic_len(sm->key_mgmt);
 
     if (len < sizeof(*hdr) + sizeof(*key)) {       
 #ifdef DEBUG_PRINT    
@@ -1928,7 +1931,18 @@ int   wpa_sm_rx_eapol(u8 *src_addr, u8 *buf, u32 len)
     extra_len = WPA_GET_BE16(key->key_data_length);
 
     if (sm->proto == WPA_PROTO_RSN &&
-        (key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) {
+        (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) {
+        /*
+         * Only decrypt the Key Data field if the frame's authenticity
+         * was verified. When using AES-SIV (FILS), the MIC flag is not
+         * set, so this check should only be performed if mic_len != 0
+         * which is the case in this code branch.
+         */
+        if (!(key_info & WPA_KEY_INFO_MIC)) {
+            wpa_printf(MSG_WARNING,
+                    "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data");
+            goto out;
+        }
         if (wpa_supplicant_decrypt_key_data(sm, key, ver))
             goto out;
         extra_len = WPA_GET_BE16(key->key_data_length);