diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index c22837d..2eb3438 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2492,8 +2492,6 @@ int ssl3_send_client_key_exchange(SSL *s)
 			 /* Otherwise, generate ephemeral key pair */
 					
 			EVP_PKEY_encrypt_init(pkey_ctx);
-			  /* Generate session key */	
-		    RAND_bytes(premaster_secret,32);
 			/* If we have client certificate, use its secret as peer key */
 			if (s->s3->tmp.cert_req && s->cert->key->privatekey) {
 				if (EVP_PKEY_derive_set_peer(pkey_ctx,s->cert->key->privatekey) <=0) {
@@ -2515,15 +2513,25 @@ int ssl3_send_client_key_exchange(SSL *s)
 				8,shared_ukm)<0) {
 					SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
 						SSL_R_LIBRARY_BUG);
+                    OPENSSL_cleanse(premaster_secret, sizeof (premaster_secret));
 					goto err;
 				}	
+			  /* Generate session key */
+		    if (0 > RAND_bytes(premaster_secret,32)){
+                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSL_R_LIBRARY_BUG);
+                OPENSSL_cleanse(premaster_secret, sizeof (premaster_secret));
+				goto err;
+            }
 			/* Make GOST keytransport blob message */
 			/*Encapsulate it into sequence */
 			*(p++)=V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED;
 			msglen=255;
+
 			if (EVP_PKEY_encrypt(pkey_ctx,tmp,&msglen,premaster_secret,32)<0) {
-			SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-					SSL_R_LIBRARY_BUG);
+                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSL_R_LIBRARY_BUG);
+                OPENSSL_cleanse(premaster_secret, sizeof (premaster_secret));
 				goto err;
 			}
 			if (msglen >= 0x80)
@@ -2548,6 +2556,8 @@ int ssl3_send_client_key_exchange(SSL *s)
 			s->session->master_key_length=
 				s->method->ssl3_enc->generate_master_secret(s,
 					s->session->master_key,premaster_secret,32);
+            OPENSSL_cleanse(premaster_secret, sizeof (premaster_secret));
+            
 			EVP_PKEY_free(pub_key);
 
 			}
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 514f72c..2e2430a 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -2647,6 +2647,7 @@ int ssl3_get_client_key_exchange(SSL *s)
 		gerr:
 			EVP_PKEY_free(client_pub_pkey);
 			EVP_PKEY_CTX_free(pkey_ctx);
+            OPENSSL_cleanse(premaster_secret, sizeof (premaster_secret));
 			if (ret)
 				return ret;
 			else