diff --git a/src/tpm2/crypto/openssl/CryptRsa.c b/src/tpm2/crypto/openssl/CryptRsa.c
index 51726ceb..0b49cf6a 100644
--- a/src/tpm2/crypto/openssl/CryptRsa.c
+++ b/src/tpm2/crypto/openssl/CryptRsa.c
@@ -482,7 +482,7 @@ RSAES_Decode(
     // Make sure that pSize has not gone over the end and that there are at least 8
     // bytes of pad data.
     fail = (pSize > coded->size) | fail;
-    fail = ((pSize - 2) < 8) | fail;
+    fail = ((pSize - 2) <= 8) | fail;
     if((message->size < (UINT16)(coded->size - pSize)) || fail)
 	return TPM_RC_VALUE;
     message->size = coded->size - pSize;