diff --git a/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java b/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
index 4914b7628b47edf257dfd6fe7aafaf5eadd3b152..82491dc811cc807a5bb6baf4a22f098f3cc72195 100644
--- a/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
+++ b/router/java/src/net/i2p/router/transport/udp/EstablishmentManager.java
@@ -826,10 +826,10 @@ class EstablishmentManager {
         if (_transport.isTooClose(to.getIP()))
             return;
         DatagramPacket pkt = fromPacket.getPacket();
-        int off = pkt.getOffset();
         int len = pkt.getLength();
         if (len < MIN_LONG_DATA_LEN)
             return;
+        int off = pkt.getOffset();
         byte data[] = pkt.getData();
         int type = data[off + TYPE_OFFSET] & 0xff;
         if (type == SSU2Util.SESSION_REQUEST_FLAG_BYTE && len < MIN_SESSION_REQUEST_LEN)
diff --git a/router/java/src/net/i2p/router/transport/udp/InboundEstablishState2.java b/router/java/src/net/i2p/router/transport/udp/InboundEstablishState2.java
index 15555ca2c7784fc01f63c579519566b1e7355ac8..c4f8df7e6dfc3fb6c12a41ae4389bc45c6c52550 100644
--- a/router/java/src/net/i2p/router/transport/udp/InboundEstablishState2.java
+++ b/router/java/src/net/i2p/router/transport/udp/InboundEstablishState2.java
@@ -7,6 +7,7 @@ import java.net.InetSocketAddress;
 import java.net.SocketAddress;
 import java.net.UnknownHostException;
 import java.security.GeneralSecurityException;
+import java.util.Arrays;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -829,6 +830,11 @@ class InboundEstablishState2 extends InboundEstablishState implements SSU2Payloa
                        "\nGenerated header key 2 for A->B:  " + Base64.encode(h_ab) +
                        "\nGenerated header key 2 for B->A:  " + Base64.encode(h_ba));
        ****/
+        Arrays.fill(ckd, (byte) 0);
+        Arrays.fill(k_ab, (byte) 0);
+        Arrays.fill(k_ba, (byte) 0);
+        Arrays.fill(d_ab, (byte) 0);
+        Arrays.fill(d_ba, (byte) 0);
         _handshakeState.destroy();
         if (_createdSentCount == 1)
             _rtt = (int) ( _context.clock().now() - _lastSend );
diff --git a/router/java/src/net/i2p/router/transport/udp/OutboundEstablishState2.java b/router/java/src/net/i2p/router/transport/udp/OutboundEstablishState2.java
index 0e98bac85870703e632c1bd0796f8c53a10f1d9b..092e20337565fdd8c890bc9e213ca05606fbbe8e 100644
--- a/router/java/src/net/i2p/router/transport/udp/OutboundEstablishState2.java
+++ b/router/java/src/net/i2p/router/transport/udp/OutboundEstablishState2.java
@@ -6,6 +6,7 @@ import java.net.InetSocketAddress;
 import java.net.SocketAddress;
 import java.net.UnknownHostException;
 import java.security.GeneralSecurityException;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -766,6 +767,11 @@ class OutboundEstablishState2 extends OutboundEstablishState implements SSU2Payl
                            "\nGenerated header key 2 for A->B:  " + Base64.encode(h_ab) +
                            "\nGenerated header key 2 for B->A:  " + Base64.encode(h_ba));
             ****/
+            Arrays.fill(ckd, (byte) 0);
+            Arrays.fill(k_ab, (byte) 0);
+            Arrays.fill(k_ba, (byte) 0);
+            Arrays.fill(d_ab, (byte) 0);
+            Arrays.fill(d_ba, (byte) 0);
             _handshakeState.destroy();
             if (_requestSentCount == 1)
                 _rtt = (int) ( _context.clock().now() - _lastSend );