diff --git a/crypto/ecies/ecies.go b/crypto/ecies/ecies.go
index a86c735f07..c7169a770e 100644
--- a/crypto/ecies/ecies.go
+++ b/crypto/ecies/ecies.go
@@ -146,7 +146,7 @@ var (
 // NIST SP 800-56 Concatenation Key Derivation Function (see section 5.8.1).
 func concatKDF(hash hash.Hash, z, s1 []byte, kdLen int) []byte {
 	counterBytes := make([]byte, 4)
-	k := make([]byte, 0, kdLen+hash.Size())
+	k := make([]byte, 0, roundup(kdLen, hash.Size()))
 	for counter := uint32(1); len(k) < kdLen; counter++ {
 		binary.BigEndian.PutUint32(counterBytes, counter)
 		hash.Write(counterBytes)
@@ -158,6 +158,11 @@ func concatKDF(hash hash.Hash, z, s1 []byte, kdLen int) []byte {
 	return k[:kdLen]
 }
 
+// roundup rounds size up to the nearest multiple of blocksize.
+func roundup(size, blocksize int) int {
+	return size + blocksize - (size % blocksize)
+}
+
 // messageTag computes the MAC of a message (called the tag) as per
 // SEC 1, 3.5.
 func messageTag(hash func() hash.Hash, km, msg, shared []byte) []byte {