diff --git a/hostapd/ChangeLog b/hostapd/ChangeLog
index 382b869f1..f3c01559f 100644
--- a/hostapd/ChangeLog
+++ b/hostapd/ChangeLog
@@ -3,6 +3,8 @@ ChangeLog for hostapd
 ????-??-?? - v0.6.5
 	* added support for SHA-256 as X.509 certificate digest when using the
 	  internal X.509/TLSv1 implementation
+	* fixed EAP-FAST PAC-Opaque padding (0.6.4 broke this for some peer
+	  identity lengths)
 
 2008-08-10 - v0.6.4
 	* added peer identity into EAP-FAST PAC-Opaque and skip Phase 2
diff --git a/src/eap_server/eap_fast.c b/src/eap_server/eap_fast.c
index 6216d0938..3ac1929e5 100644
--- a/src/eap_server/eap_fast.c
+++ b/src/eap_server/eap_fast.c
@@ -685,7 +685,7 @@ static struct wpabuf * eap_fast_build_pac(struct eap_sm *sm,
 	}
 
 	pac_len = pos - pac_buf;
-	if (pac_len % 8) {
+	while (pac_len % 8) {
 		*pos++ = PAC_OPAQUE_TYPE_PAD;
 		pac_len++;
 	}