diff --git a/cng/tls1prf.go b/cng/tls1prf.go
index 30ef224..e8f5c90 100644
--- a/cng/tls1prf.go
+++ b/cng/tls1prf.go
@@ -48,6 +48,7 @@ func TLS1PRF(result, secret, label, seed []byte, h func() hash.Hash) error {
 	if err := bcrypt.GenerateSymmetricKey(alg, &kh, nil, secret, 0); err != nil {
 		return err
 	}
+	defer bcrypt.DestroyKey(kh)
 
 	buffers := make([]bcrypt.Buffer, 0, 3)
 	if len(label) > 0 {