diff --git a/library/psa_crypto_ecp.c b/library/psa_crypto_ecp.c
index 3f2ec23..20ef29c 100644
--- a/library/psa_crypto_ecp.c
+++ b/library/psa_crypto_ecp.c
@@ -41,6 +41,7 @@
     psa_status_t status;
     mbedtls_ecp_keypair *ecp = NULL;
     size_t curve_bytes = data_length;
+    size_t curve_bits_check;
     int explicit_bits = (curve_bits != 0);
 
     if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
@@ -84,7 +85,7 @@
 
     /* Load the group. */
     grp_id = mbedtls_ecc_group_from_psa(PSA_KEY_TYPE_ECC_GET_FAMILY(type),
-                                        curve_bits, !explicit_bits);
+                                        curve_bits);
     if (grp_id == MBEDTLS_ECP_DP_NONE) {
         /* We can't distinguish between a nonsensical family/size combination
          * (which would warrant PSA_ERROR_INVALID_ARGUMENT) and a
@@ -96,6 +97,17 @@
         goto exit;
     }
 
+    /* Get the exact number of bits which are necessary for this key. This is
+     * used to validate the "curve_bits" input parameter (only in case it was
+     * provided).
+     * Note: we intentionally ignore the return value of mbedtls_ecc_group_to_psa()
+     *       because we are only interested in the curve's bit size. */
+    mbedtls_ecc_group_to_psa(grp_id, &curve_bits_check);
+    if (explicit_bits && (curve_bits_check != curve_bits)) {
+        status = PSA_ERROR_NOT_SUPPORTED;
+        goto exit;
+    }
+
     status = mbedtls_to_psa_error(
         mbedtls_ecp_group_load(&ecp->grp, grp_id));
     if (status != PSA_SUCCESS) {
@@ -285,7 +297,7 @@
     psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
         attributes->core.type);
     mbedtls_ecp_group_id grp_id =
-        mbedtls_ecc_group_from_psa(curve, attributes->core.bits, 0);
+        mbedtls_ecc_group_from_psa(curve, attributes->core.bits);
 
     const mbedtls_ecp_curve_info *curve_info =
         mbedtls_ecp_curve_info_from_grp_id(grp_id);