diff --git a/src/commands.rs b/src/commands.rs
index cb81b1c..3e83e84 100644
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -197,6 +197,11 @@ impl TryFrom<ChangeReferenceArguments<'_>> for ChangeReference {
         } = arguments;
 
         use ChangeReferenceKeyReference::*;
+
+        if data.len() != 16 {
+            return Err(Status::IncorrectDataParameter);
+        }
+
         Ok(match (key_reference, data) {
             (GlobalPin, _) => return Err(Status::FunctionNotSupported),
             (ApplicationPin, data) => ChangeReference::ChangePin {
diff --git a/src/lib.rs b/src/lib.rs
index 3d50f01..ef3d268 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -453,6 +453,20 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
             response: tlv::get_do(&[0x82], input),
             exponentiation: tlv::get_do(&[0x85], input),
         };
+
+        error!(
+            "
+            witness: {}
+            challenge: {}
+            response: {}
+            exponentiation: {}
+        ",
+            &parsed.witness.is_some(),
+            &parsed.challenge.is_some(),
+            &parsed.response.is_some(),
+            &parsed.exponentiation.is_some(),
+        );
+
         match parsed {
             Auth {
                 witness: None,
@@ -662,7 +676,8 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
         message: &[u8],
         mut reply: Reply<'_, R>,
     ) -> Result {
-        info!("Request for sign");
+        error!("Request for sign, data length: {}, data:", message.len());
+        // error!("{}", delog::hexstr!(message));
 
         let Ok(key_ref) = auth.key_reference.try_into() else {
             warn!("Attempt to sign with an incorrect key");
@@ -698,6 +713,9 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
             reply.append_len(response.len())?;
             reply.expand(&response)?;
         }
+        error!("Signed data len: {}, Data:", response.len());
+        // error!("{}", delog::hexstr!(&response));
+
         reply.prepend_len(offset)?;
         Ok(())
     }
@@ -937,11 +955,14 @@ impl<'a, T: Client> LoadedAuthenticator<'a, T> {
                 reply.prepend_len(offset)?;
             }
             _ => {
-                if !ContainerStorage(container).load(
+                error!("Getting {container:?}");
+                let res = ContainerStorage(container).load(
                     self.trussed,
                     self.options.storage,
                     reply.lend(),
-                )? {
+                );
+
+                if !res? {
                     return Err(Status::NotFound);
                 }
             }
diff --git a/src/piv_types.rs b/src/piv_types.rs
index 909c23f..defe5b9 100644
--- a/src/piv_types.rs
+++ b/src/piv_types.rs
@@ -63,7 +63,28 @@ pub struct Pin(pub [u8; 8]);
 impl TryFrom<&[u8]> for Pin {
     type Error = ();
     fn try_from(padded_pin: &[u8]) -> Result<Self, Self::Error> {
-        Ok(Self(padded_pin.try_into().map_err(|_| ())?))
+        let arr = padded_pin.try_into().map_err(|_| ())?;
+
+        for (idx, b) in padded_pin.iter().enumerate() {
+            if !b.is_ascii_digit() {
+                // Value is not a digit, check that we have only padding remaining and that min length is good
+
+                // Check min length
+                if idx < 5 {
+                    return Err(());
+                }
+
+                // Check that only padding is left
+                for rem in &padded_pin[idx..] {
+                    if *rem != 0xFF {
+                        return Err(());
+                    }
+                }
+                break;
+            }
+        }
+
+        Ok(Self(arr))
     }
 }
 
diff --git a/tests/command_response.ron b/tests/command_response.ron
index aa80cc8..c4b74bc 100644
--- a/tests/command_response.ron
+++ b/tests/command_response.ron
@@ -3,7 +3,7 @@
         name: "Verify",
         cmd_resp: [
             VerifyApplicationPin(),
-            VerifyApplicationPin(pin: "FFEEDDCCBBAA9988", expected_status: RemainingRetries(2)),
+            VerifyApplicationPin(pin: "3131313131313131", expected_status: RemainingRetries(2)),
             VerifyGlobalPin(expected_status: FunctionNotSupported)
         ]
     ),
@@ -131,9 +131,9 @@
             Reset(
                 expected_status: ConditionsOfUseNotSatisfied,
             ),
-            VerifyApplicationPin(pin: "FFEEDDCCBBAA9988", expected_status: RemainingRetries(2)),
-            VerifyApplicationPin(pin: "FFEEDDCCBBAA9988", expected_status: RemainingRetries(1)),
-            VerifyApplicationPin(pin: "FFEEDDCCBBAA9988", expected_status: OperationBlocked),
+            VerifyApplicationPin(pin: "3131313131313131", expected_status: RemainingRetries(2)),
+            VerifyApplicationPin(pin: "3131313131313131", expected_status: RemainingRetries(1)),
+            VerifyApplicationPin(pin: "3131313131313131", expected_status: OperationBlocked),
             Reset(),
         ]
     ),
@@ -183,17 +183,26 @@
             ),
         ]
     ),
+    IoTest(
+        name: "Change reference with too short PIN",
+        cmd_resp: [
+            ChangePin(
+                new: "11223344556677",
+                expected_status: IncorrectDataParameter,
+            ),
+        ],
+    ),
     IoTest(
         name: "Pin and Puk",
         uuid_config: WithBoth("00112233445566778899AABBCCDDEEFF"),
         cmd_resp: [
             ChangePin(
-                new: "01020304FFFFFFFF",
+                new: "313131313131FFFF",
             ),
             ChangePuk(
                 new: "0102030405060708",
             ),
-            VerifyApplicationPin(pin: "0102030405060708", expected_status: RemainingRetries(2)),
+            VerifyApplicationPin(pin: "313233343536FFFF", expected_status: RemainingRetries(2)),
             ChangePuk(
                 old: "0102030405060708",
                 new: "AABBCCDDEEFF0011",