diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index fc767c0fa..60fbcd2ea 100644
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -862,7 +862,7 @@ static status_t process_key_exchange_dhe(private_tls_server_t *this,
 	group = this->dh->get_method(this->dh);
 	ec = key_exchange_is_ecdh(group);
 	if ((ec && !reader->read_data8(reader, &pub)) ||
-		(!ec && (!reader->read_data16(reader, &pub) || pub.len == 0)))
+		(!ec && !reader->read_data16(reader, &pub)) || pub.len == 0)
 	{
 		DBG1(DBG_TLS, "received invalid Client Key Exchange");
 		this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);