diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+0.7.4
+-----
+
+* Stricter checking of AES key lengths when looking for a valid JWK to encode/decode an AES-KW JWT.
+
 0.7.3
 -----
 
diff --git a/Jose/Jwk.hs b/Jose/Jwk.hs
--- a/Jose/Jwk.hs
+++ b/Jose/Jwk.hs
@@ -28,6 +28,7 @@
 import           Data.Aeson (genericToJSON, Value(..), FromJSON(..), ToJSON(..), withText)
 import           Data.Aeson.Types (Parser, Options (..), defaultOptions)
 import           Data.ByteString (ByteString)
+import qualified Data.ByteString as B
 import           Data.Maybe (isNothing)
 import           Data.Text (Text)
 import qualified Data.Text.Encoding as TE
@@ -126,9 +127,9 @@
     case (jweAlg hdr, jwk) of
         (RSA1_5,   RsaPrivateJwk {}) -> True
         (RSA_OAEP, RsaPrivateJwk {}) -> True
-        (A128KW,   SymmetricJwk {})  -> True
-        (A192KW,   SymmetricJwk {})  -> True
-        (A256KW,   SymmetricJwk {})  -> True
+        (A128KW,   SymmetricJwk k _ _ _) -> B.length k == 16
+        (A192KW,   SymmetricJwk k _ _ _) -> B.length k == 24
+        (A256KW,   SymmetricJwk k _ _ _) -> B.length k == 32
         _                            -> False
 
 canEncodeJwe :: JweAlg -> Jwk -> Bool
@@ -139,9 +140,9 @@
         (RSA_OAEP, RsaPublicJwk {})  -> True
         (RSA1_5,   RsaPrivateJwk {}) -> True
         (RSA_OAEP, RsaPrivateJwk {}) -> True
-        (A128KW,   SymmetricJwk {})  -> True
-        (A192KW,   SymmetricJwk {})  -> True
-        (A256KW,   SymmetricJwk {})  -> True
+        (A128KW,   SymmetricJwk k _ _ _) -> B.length k == 16
+        (A192KW,   SymmetricJwk k _ _ _) -> B.length k == 24
+        (A256KW,   SymmetricJwk k _ _ _) -> B.length k == 32
         _                            -> False
 
 keyIdCompatible :: Maybe KeyId -> Jwk -> Bool
diff --git a/jose-jwt.cabal b/jose-jwt.cabal
--- a/jose-jwt.cabal
+++ b/jose-jwt.cabal
@@ -1,5 +1,5 @@
 Name:               jose-jwt
-Version:            0.7.3
+Version:            0.7.4
 Synopsis:           JSON Object Signing and Encryption Library
 Homepage:           http://github.com/tekul/jose-jwt
 Bug-Reports:        http://github.com/tekul/jose-jwt/issues
diff --git a/tests/Tests/JweSpec.hs b/tests/Tests/JweSpec.hs
--- a/tests/Tests/JweSpec.hs
+++ b/tests/Tests/JweSpec.hs
@@ -147,7 +147,7 @@
 jweRoundTrip :: RNG -> JWEAlgs -> [Word8] -> Bool
 jweRoundTrip g (JWEAlgs a e) msg = encodeDecode == Right (Jwe (defJweHdr {jweAlg = a, jweEnc = e}, bs))
   where
-    jwks = [a1jwk, a2jwk, a3jwk] >>= \j -> let Just jwk = decodeStrict' j in [jwk]
+    jwks = [a1jwk, a2jwk, a3jwk, aes192jwk, aes256jwk] >>= \j -> let Just jwk = decodeStrict' j in [jwk]
     bs = B.pack msg
     encodeDecode = fst (withDRG blinderRNG (decode jwks Nothing encoded))
     Right encoded = unJwt <$> fst (withDRG g (encode jwks (JweEncoding a e) (Claims bs)))
@@ -241,6 +241,11 @@
 a3Payload = a2Payload
 
 a3jwk = "{\"kty\":\"oct\", \"k\":\"GawgguFyGrWKav7AX4VKUg\"}"
+
+-- We need keys that are valid for AES192 and AES256 for quickcheck tests
+aes192jwk = "{\"kty\":\"oct\", \"k\":\"FatNm7ez26tyPGsXdaqhYHtvThX0jSAA\"}"
+aes256jwk = "{\"kty\":\"oct\", \"k\":\"1MeiHdxK8CQBsmjgOM8SCxg06MTjFzG7sFa7EnDCJzo\"}"
+
 
 a3cek = B.pack [4, 211, 31, 197, 84, 157, 252, 254, 11, 100, 157, 250, 63, 170, 106, 206, 107, 124, 212, 45, 111, 107, 9, 219, 200, 177, 0, 240, 143, 156, 44, 207]
 
diff --git a/tests/Tests/JwsSpec.hs b/tests/Tests/JwsSpec.hs
--- a/tests/Tests/JwsSpec.hs
+++ b/tests/Tests/JwsSpec.hs
@@ -77,11 +77,11 @@
           fstWithRNG (decode [k31] Nothing a31) @?= fmap Jws a31decoded
 
       context "when using an unsecured JWT" $ do
-        it "returns an error if alg is unset" $
+        it "returns an error if chosen alg is unset" $
           fstWithRNG (decode [] Nothing jwt61) @?= Left (BadAlgorithm "JWT is unsecured but expected 'alg' was not 'none'")
-        it "returns an error if alg is is not 'none'" $
+        it "returns an error if chosen alg is not 'none'" $
           fstWithRNG (decode [] (Just (JwsEncoding RS256)) jwt61) @?= Left (BadAlgorithm "JWT is unsecured but expected 'alg' was not 'none'")
-        it "decodes the JWT to the expected header and payload" $
+        it "decodes the JWT to the expected header and payload if chosen alg is 'none'" $
           fstWithRNG (decode [] (Just (JwsEncoding None)) jwt61) @?= Right (Unsecured jwt61Payload)