diff --git a/src/hci.c b/src/hci.c
index d0537dbf6..3bc71b2e2 100644
--- a/src/hci.c
+++ b/src/hci.c
@@ -149,6 +149,12 @@ int  hci_authentication_active_for_handle(hci_con_handle_t handle){
     return 1;
 }
 
+void hci_drop_link_key_for_bd_addr(bd_addr_t *addr){
+    if (hci_stack.remote_device_db) {
+        hci_stack.remote_device_db->delete_link_key(addr);
+    }
+}
+
 
 /**
  * count connections
@@ -376,12 +382,15 @@ static void event_handler(uint8_t *packet, int size){
                     
                     hci_emit_nr_connections_changed();
                 } else {
+                    
                     // connection failed, remove entry
-                    if (hci_stack.remote_device_db) {
-                        hci_stack.remote_device_db->delete_link_key(&addr);
-                    }
                     linked_list_remove(&hci_stack.connections, (linked_item_t *) conn);
                     free( conn );
+                    
+                    // if authentication error, also delete link key
+                    if (packet[2] == 0x05) {
+                        hci_drop_link_key_for_bd_addr(&addr);
+                    }
                 }
             }
             break;
diff --git a/src/hci.h b/src/hci.h
index 7e18ae1a5..87d829b52 100644
--- a/src/hci.h
+++ b/src/hci.h
@@ -248,6 +248,7 @@ uint8_t hci_number_outgoing_packets(hci_con_handle_t handle);
 uint8_t hci_number_free_acl_slots();
 int     hci_ready_to_send(hci_con_handle_t handle);
 int     hci_authentication_active_for_handle(hci_con_handle_t handle);
+void    hci_drop_link_key_for_bd_addr(bd_addr_t *addr);
 
 // 
 void hci_emit_state();