diff --git a/nts_ntp_auth.c b/nts_ntp_auth.c
index 2f502bb..b92c406 100644
--- a/nts_ntp_auth.c
+++ b/nts_ntp_auth.c
@@ -115,6 +115,7 @@ NNA_GenerateAuthEF(NTP_Packet *packet, NTP_PacketInfo *info, SIV_Instance siv,
                    plaintext, plaintext_length, ciphertext, ciphertext_length)) {
     DEBUG_LOG("SIV encrypt failed");
     info->length = assoc_length;
+    info->ext_fields--;
     return 0;
   }
 
diff --git a/test/unit/nts_ntp_auth.c b/test/unit/nts_ntp_auth.c
index 207ebeb..c3a7432 100644
--- a/test/unit/nts_ntp_auth.c
+++ b/test/unit/nts_ntp_auth.c
@@ -87,11 +87,13 @@ test_unit(void)
         r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, SIV_GetMinNonceLength(siv) - 1,
                                plaintext, plaintext_length, 0);
         TEST_CHECK(!r);
+        TEST_CHECK(info.ext_fields == 0);
       }
       if (SIV_GetMaxNonceLength(siv) <= sizeof (nonce)) {
         r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, SIV_GetMaxNonceLength(siv) - 1,
                                plaintext, plaintext_length, 0);
         TEST_CHECK(!r);
+        TEST_CHECK(info.ext_fields == 0);
       }
       r = NNA_GenerateAuthEF(&packet, &info, siv, nonce, nonce_length, plaintext,
                              plaintext_length, sizeof (packet) - info.length + 1);