diff --git a/dlls/bcrypt/bcrypt_internal.h b/dlls/bcrypt/bcrypt_internal.h
index 4caaf3307ef..079c743809d 100644
--- a/dlls/bcrypt/bcrypt_internal.h
+++ b/dlls/bcrypt/bcrypt_internal.h
@@ -257,7 +257,7 @@ NTSTATUS get_alg_property( const struct algorithm *, const WCHAR *, UCHAR *, ULO
 
 NTSTATUS key_set_property( struct key *, const WCHAR *, UCHAR *, ULONG, ULONG ) DECLSPEC_HIDDEN;
 NTSTATUS key_symmetric_init( struct key *, struct algorithm *, const UCHAR *, ULONG ) DECLSPEC_HIDDEN;
-NTSTATUS key_symmetric_set_vector( struct key *, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
+void     key_symmetric_vector_reset( struct key * ) DECLSPEC_HIDDEN;
 NTSTATUS key_symmetric_set_auth_data( struct key *, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
 NTSTATUS key_symmetric_encrypt( struct key *, const UCHAR *, ULONG, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
 NTSTATUS key_symmetric_decrypt( struct key *, const UCHAR *, ULONG, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
@@ -273,9 +273,6 @@ NTSTATUS key_export_ecc( struct key *, UCHAR *, ULONG, ULONG * ) DECLSPEC_HIDDEN
 NTSTATUS key_import_dsa_capi( struct key *, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
 NTSTATUS key_import_ecc( struct key *, UCHAR *, ULONG ) DECLSPEC_HIDDEN;
 
-BOOL is_zero_vector( const UCHAR *, ULONG ) DECLSPEC_HIDDEN;
-BOOL is_equal_vector( const UCHAR *, ULONG, const UCHAR *, ULONG ) DECLSPEC_HIDDEN;
-
 BOOL gnutls_initialize(void) DECLSPEC_HIDDEN;
 void gnutls_uninitialize(void) DECLSPEC_HIDDEN;
 
diff --git a/dlls/bcrypt/bcrypt_main.c b/dlls/bcrypt/bcrypt_main.c
index 30a1acfc0cb..b77cf67c461 100644
--- a/dlls/bcrypt/bcrypt_main.c
+++ b/dlls/bcrypt/bcrypt_main.c
@@ -891,7 +891,7 @@ BOOL key_is_symmetric( struct key *key )
     return builtin_algorithms[key->alg_id].class == BCRYPT_CIPHER_INTERFACE;
 }
 
-BOOL is_zero_vector( const UCHAR *vector, ULONG len )
+static BOOL is_zero_vector( const UCHAR *vector, ULONG len )
 {
     ULONG i;
     if (!vector) return FALSE;
@@ -899,13 +899,31 @@ BOOL is_zero_vector( const UCHAR *vector, ULONG len )
     return TRUE;
 }
 
-BOOL is_equal_vector( const UCHAR *vector, ULONG len, const UCHAR *vector2, ULONG len2 )
+static BOOL is_equal_vector( const UCHAR *vector, ULONG len, const UCHAR *vector2, ULONG len2 )
 {
     if (!vector && !vector2) return TRUE;
     if (len != len2) return FALSE;
     return !memcmp( vector, vector2, len );
 }
 
+static NTSTATUS key_symmetric_set_vector( struct key *key, UCHAR *vector, ULONG vector_len )
+{
+    BOOL needs_reset = (!is_zero_vector( vector, vector_len ) ||
+                        !is_equal_vector( key->u.s.vector, key->u.s.vector_len, vector, vector_len ));
+
+    heap_free( key->u.s.vector );
+    key->u.s.vector = NULL;
+    key->u.s.vector_len = 0;
+    if (vector)
+    {
+        if (!(key->u.s.vector = heap_alloc( vector_len ))) return STATUS_NO_MEMORY;
+        memcpy( key->u.s.vector, vector, vector_len );
+        key->u.s.vector_len = vector_len;
+    }
+    if (needs_reset) key_symmetric_vector_reset( key );
+    return STATUS_SUCCESS;
+}
+
 static NTSTATUS key_import( BCRYPT_ALG_HANDLE algorithm, const WCHAR *type, BCRYPT_KEY_HANDLE *key, UCHAR *object,
                             ULONG object_len, UCHAR *input, ULONG input_len )
 {
diff --git a/dlls/bcrypt/gnutls.c b/dlls/bcrypt/gnutls.c
index 66c8f0f3e55..8b4d08f528b 100644
--- a/dlls/bcrypt/gnutls.c
+++ b/dlls/bcrypt/gnutls.c
@@ -520,27 +520,12 @@ static gnutls_cipher_algorithm_t get_gnutls_cipher( const struct key *key )
     }
 }
 
-NTSTATUS key_symmetric_set_vector( struct key *key, UCHAR *vector, ULONG vector_len )
+void key_symmetric_vector_reset( struct key *key )
 {
-    if (key->u.s.handle && (!is_zero_vector( vector, vector_len ) ||
-        !is_equal_vector( key->u.s.vector, key->u.s.vector_len, vector, vector_len )))
-    {
-        TRACE( "invalidating cipher handle\n" );
-        pgnutls_cipher_deinit( key->u.s.handle );
-        key->u.s.handle = NULL;
-    }
-
-    heap_free( key->u.s.vector );
-    key->u.s.vector = NULL;
-    key->u.s.vector_len = 0;
-    if (vector)
-    {
-        if (!(key->u.s.vector = heap_alloc( vector_len ))) return STATUS_NO_MEMORY;
-        memcpy( key->u.s.vector, vector, vector_len );
-        key->u.s.vector_len = vector_len;
-    }
-
-    return STATUS_SUCCESS;
+    if (!key->u.s.handle) return;
+    TRACE( "invalidating cipher handle\n" );
+    pgnutls_cipher_deinit( key->u.s.handle );
+    key->u.s.handle = NULL;
 }
 
 static NTSTATUS init_cipher_handle( struct key *key )
diff --git a/dlls/bcrypt/macos.c b/dlls/bcrypt/macos.c
index 8da67dc9933..0c5f968bc68 100644
--- a/dlls/bcrypt/macos.c
+++ b/dlls/bcrypt/macos.c
@@ -123,30 +123,16 @@ static CCMode get_cryptor_mode( struct key *key )
     }
 }
 
-NTSTATUS key_symmetric_set_vector( struct key *key, UCHAR *vector, ULONG vector_len )
+void key_symmetric_vector_reset( struct key *key )
 {
-    if (key->u.s.ref_encrypt && (!is_zero_vector( vector, vector_len ) ||
-        !is_equal_vector( key->u.s.vector, key->u.s.vector_len, vector, vector_len )))
-    {
-        TRACE( "invalidating cryptor handles\n" );
-        CCCryptorRelease( key->u.s.ref_encrypt );
-        key->u.s.ref_encrypt = NULL;
+    if (!key->u.s.ref_encrypt) return;
 
-        CCCryptorRelease( key->u.s.ref_decrypt );
-        key->u.s.ref_decrypt = NULL;
-    }
+    TRACE( "invalidating cryptor handles\n" );
+    CCCryptorRelease( key->u.s.ref_encrypt );
+    key->u.s.ref_encrypt = NULL;
 
-    heap_free( key->u.s.vector );
-    key->u.s.vector = NULL;
-    key->u.s.vector_len = 0;
-    if (vector)
-    {
-        if (!(key->u.s.vector = heap_alloc( vector_len ))) return STATUS_NO_MEMORY;
-        memcpy( key->u.s.vector, vector, vector_len );
-        key->u.s.vector_len = vector_len;
-    }
-
-    return STATUS_SUCCESS;
+    CCCryptorRelease( key->u.s.ref_decrypt );
+    key->u.s.ref_decrypt = NULL;
 }
 
 static NTSTATUS init_cryptor_handles( struct key *key )