diff --git a/src/post_modules/Nettle/aead.cmod b/src/post_modules/Nettle/aead.cmod
index 341fdc8095ea14907e1937a4b8af45212f72cf3e..676147023703555bacac4c626ef2adf91319202d 100644
--- a/src/post_modules/Nettle/aead.cmod
+++ b/src/post_modules/Nettle/aead.cmod
@@ -191,7 +191,7 @@ PIKECLASS AEAD
    *! Base class for AEAD contexts.
    */
   PIKECLASS State
-    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
   {
     DOCSTART() @decl inherit AEAD::State
     DOCEND()
diff --git a/src/post_modules/Nettle/cipher.cmod b/src/post_modules/Nettle/cipher.cmod
index 77e750cd41a8f6055fcc3d1edac10dd84ebf1200..e07f2f5f7ea26bfb04e06fe535dfb9703cb4ee2e 100644
--- a/src/post_modules/Nettle/cipher.cmod
+++ b/src/post_modules/Nettle/cipher.cmod
@@ -192,7 +192,7 @@ PIKECLASS Cipher
    *! Base class for cipher contexts.
    */
   PIKECLASS State
-    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
   {
     DOCSTART() @decl inherit Cipher::State
     DOCEND()
@@ -546,7 +546,7 @@ PIKECLASS BufferedCipher
      *!   @[BlockCipher.CBC], @[BlockCipher16.GCM]
      */
     PIKECLASS State
-      program_flags PROGRAM_NEEDS_PARENT|PROGRAM_USES_PARENT;
+      program_flags PROGRAM_NEEDS_PARENT|PROGRAM_USES_PARENT|PROGRAM_CLEAR_STORAGE;
     {
       CVAR struct object *object;
       CVAR int block_size;
@@ -2124,7 +2124,7 @@ PIKECLASS BlockCipher
      *! The state for a CTR instance.
      */
     PIKECLASS State
-      program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+      program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
     {
       DOCSTART() @decl inherit Cipher::State
 	DOCEND()
@@ -3607,7 +3607,7 @@ PIKECLASS BlockCipher16
     /*! @class State
      */
     PIKECLASS State
-      program_flags PROGRAM_NEEDS_PARENT|PROGRAM_USES_PARENT;
+      program_flags PROGRAM_NEEDS_PARENT|PROGRAM_USES_PARENT|PROGRAM_CLEAR_STORAGE;
     {
       PIKEVAR object object
 	flags ID_PRIVATE|ID_PROTECTED|ID_HIDDEN;
@@ -3617,7 +3617,7 @@ PIKECLASS BlockCipher16
       CVAR struct eax_key eax_key;
       CVAR struct eax_ctx eax_ctx;
 
-      /*! @decl inherit EAX::State
+      /*! @decl inherit AEAD::State
        */
 
       EXTRA
@@ -4069,7 +4069,7 @@ PIKECLASS BlockCipher16
      *! The state for a GCM instance.
      */
     PIKECLASS State
-      program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+      program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
     {
       DOCSTART() @decl inherit AEAD::State
 	DOCEND()
diff --git a/src/post_modules/Nettle/hash.cmod b/src/post_modules/Nettle/hash.cmod
index 94311074ff6d9fb88e3da9466811aad577dae10e..d700bfe7b397064e466ef77ca3e8fe3f8ed02012 100644
--- a/src/post_modules/Nettle/hash.cmod
+++ b/src/post_modules/Nettle/hash.cmod
@@ -452,7 +452,7 @@ PIKECLASS Hash
    *! Base class for hashing contexts.
    */
   PIKECLASS State
-    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
   {
     DOCSTART() @decl inherit Hash::State
     DOCEND()
diff --git a/src/post_modules/Nettle/hogweed.cmod b/src/post_modules/Nettle/hogweed.cmod
index bcbf790b4a4296ea56d456e44ae6301ac70535fd..e2c66f43cbedc39e70d6512d5fd4d04869d933cb 100644
--- a/src/post_modules/Nettle/hogweed.cmod
+++ b/src/post_modules/Nettle/hogweed.cmod
@@ -194,6 +194,7 @@ PIKEFUN array(object(Gmp.mpz))
  *! Diffie-Hellman Parameters.
  */
 PIKECLASS DH_Params
+program_flags PROGRAM_CLEAR_STORAGE;
 {
   CVAR struct dsa_params params;
 
@@ -546,7 +547,7 @@ PIKECLASS ECC_Curve
    *! Elliptic Curve Digital Signing Algorithm
    */
   PIKECLASS ECDSA
-    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
   {
     /*! @decl inherit __builtin.Nettle.Sign
      */
diff --git a/src/post_modules/Nettle/mac.cmod b/src/post_modules/Nettle/mac.cmod
index 000a8877c95f85705ca9ae807166026c2e012e66..3b6c9ed2247f912f3237276fb1af644f89ea9354 100644
--- a/src/post_modules/Nettle/mac.cmod
+++ b/src/post_modules/Nettle/mac.cmod
@@ -164,7 +164,7 @@ PIKECLASS MAC
    *! Base class for MAC contexts.
    */
   PIKECLASS State
-    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT;
+    program_flags PROGRAM_USES_PARENT|PROGRAM_NEEDS_PARENT|PROGRAM_CLEAR_STORAGE;
   {
     DOCSTART() @decl inherit MAC::State
     DOCEND()
diff --git a/src/post_modules/Nettle/nettle.cmod b/src/post_modules/Nettle/nettle.cmod
index b570541ca213f94d6e05094e002c967f72ab2f77..8f9c00018d19ad2c8cfe7ac5cfd17def701bf081 100644
--- a/src/post_modules/Nettle/nettle.cmod
+++ b/src/post_modules/Nettle/nettle.cmod
@@ -41,6 +41,7 @@ DECLARATIONS
  *! internal state of 256 bits.
  */
 PIKECLASS Yarrow
+program_flags PROGRAM_CLEAR_STORAGE;
 {
   CVAR struct yarrow256_ctx ctx;
   CVAR struct yarrow_source *sources;
@@ -255,6 +256,7 @@ PIKECLASS Yarrow
  *! and supply the @[reseed()] method with new entopy.
  */
 PIKECLASS Fortuna
+program_flags PROGRAM_CLEAR_STORAGE;
 {
   CVAR struct aes_ctx aes_ctx;
   CVAR struct sha256_ctx sha_ctx;