diff --git a/library/arc4.c b/library/arc4.c
index d722c56..54e89ea 100644
--- a/library/arc4.c
+++ b/library/arc4.c
@@ -46,6 +46,24 @@
 
 #if !defined(POLARSSL_ARC4_ALT)
 
+/* Implementation that should never be optimized out by the compiler */
+static void polarssl_zeroize( void *v, size_t n ) {
+    volatile unsigned char *p = v; while( n-- ) *p++ = 0;
+}
+
+void arc4_init( arc4_context *ctx )
+{
+    memset( ctx, 0, sizeof( arc4_context ) );
+}
+
+void arc4_free( arc4_context *ctx )
+{
+    if( ctx == NULL )
+        return;
+
+    polarssl_zeroize( ctx, sizeof( arc4_context ) );
+}
+
 /*
  * ARC4 key schedule
  */
@@ -146,11 +164,13 @@
  */
 int arc4_self_test( int verbose )
 {
-    int i;
+    int i, ret = 0;
     unsigned char ibuf[8];
     unsigned char obuf[8];
     arc4_context ctx;
 
+    arc4_init( &ctx );
+
     for( i = 0; i < 3; i++ )
     {
         if( verbose != 0 )
@@ -166,7 +186,8 @@
             if( verbose != 0 )
                 polarssl_printf( "failed\n" );
 
-            return( 1 );
+            ret = 1;
+            goto exit;
         }
 
         if( verbose != 0 )
@@ -176,7 +197,10 @@
     if( verbose != 0 )
         polarssl_printf( "\n" );
 
-    return( 0 );
+exit:
+    arc4_free( &ctx );
+
+    return( ret );
 }
 
 #endif /* POLARSSL_SELF_TEST */