diff --git a/client/config_init.c b/client/config_init.c
index f44ac266..a500b56e 100644
--- a/client/config_init.c
+++ b/client/config_init.c
@@ -1153,7 +1153,7 @@ parse_rc_param(fko_cli_options_t *options, const char *var_name, char * val)
         if(options->resolve_url != NULL)
             free(options->resolve_url);
         tmpint = strlen(val)+1;
-        options->resolve_url = malloc(tmpint);
+        options->resolve_url = calloc(1, tmpint);
         if(options->resolve_url == NULL)
         {
             log_msg(LOG_VERBOSITY_ERROR,"Memory allocation error for resolve URL.");
@@ -2131,7 +2131,7 @@ config_init(fko_cli_options_t *options, int argc, char **argv)
             case RESOLVE_URL:
                 if(options->resolve_url != NULL)
                     free(options->resolve_url);
-                options->resolve_url = malloc(strlen(optarg)+1);
+                options->resolve_url = calloc(1, strlen(optarg)+1);
                 if(options->resolve_url == NULL)
                 {
                     log_msg(LOG_VERBOSITY_ERROR, "Memory allocation error for resolve URL.");
diff --git a/client/fwknop.c b/client/fwknop.c
index 762e49ef..ae6fc009 100644
--- a/client/fwknop.c
+++ b/client/fwknop.c
@@ -972,10 +972,10 @@ run_last_args(fko_cli_options_t *options, const char * const args_save_file)
             else
             {
                 arg_tmp[current_arg_ctr] = '\0';
-                argv_new[argc_new] = malloc(strlen(arg_tmp)+1);
+                argv_new[argc_new] = calloc(1, strlen(arg_tmp)+1);
                 if (argv_new[argc_new] == NULL)
                 {
-                    log_msg(LOG_VERBOSITY_ERROR, "[*] malloc failure for cmd line arg.");
+                    log_msg(LOG_VERBOSITY_ERROR, "[*] calloc failure for cmd line arg.");
                     fclose(args_file_ptr);
                     return 0;
                 }
diff --git a/lib/fko_decode.c b/lib/fko_decode.c
index 9aadf199..f314cf6b 100644
--- a/lib/fko_decode.c
+++ b/lib/fko_decode.c
@@ -125,7 +125,7 @@ parse_msg(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx)
     if(ctx->message != NULL)
         free(ctx->message);
 
-    ctx->message = malloc(*t_size+1); /* Yes, more than we need */
+    ctx->message = calloc(1, *t_size+1); /* Yes, more than we need */
 
     if(ctx->message == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
@@ -175,7 +175,7 @@ parse_nat_msg(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx)
         if(ctx->nat_access != NULL)
             free(ctx->nat_access);
 
-        ctx->nat_access = malloc(*t_size+1); /* Yes, more than we need */
+        ctx->nat_access = calloc(1, *t_size+1); /* Yes, more than we need */
         if(ctx->nat_access == NULL)
             return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -199,7 +199,7 @@ parse_server_auth(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx)
     if(ctx->server_auth != NULL)
         free(ctx->server_auth);
 
-    ctx->server_auth = malloc(*t_size+1); /* Yes, more than we need */
+    ctx->server_auth = calloc(1, *t_size+1); /* Yes, more than we need */
     if(ctx->server_auth == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -273,7 +273,7 @@ parse_version(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx)
     if(ctx->version != NULL)
         free(ctx->version);
 
-    ctx->version = malloc(*t_size+1);
+    ctx->version = calloc(1, *t_size+1);
     if(ctx->version == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -320,7 +320,7 @@ parse_username(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx)
     if(ctx->username != NULL)
         free(ctx->username);
 
-    ctx->username = malloc(*t_size+1); /* Yes, more than we need */
+    ctx->username = calloc(1, *t_size+1); /* Yes, more than we need */
     if(ctx->username == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -432,7 +432,7 @@ fko_decode_spa_data(fko_ctx_t ctx)
     /* Make a tmp bucket for processing base64 encoded data and
      * other general use.
     */
-    tbuf = malloc(FKO_ENCODE_TMP_BUF_SIZE);
+    tbuf = calloc(1, FKO_ENCODE_TMP_BUF_SIZE);
     if(tbuf == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -514,7 +514,7 @@ fko_decode_spa_data(fko_ctx_t ctx)
             if(ctx->server_auth != NULL)
                 free(ctx->server_auth);
 
-            ctx->server_auth = malloc(t_size+1); /* Yes, more than we need */
+            ctx->server_auth = calloc(1, t_size+1); /* Yes, more than we need */
             if(ctx->server_auth == NULL)
             {
                 free(tbuf);
diff --git a/lib/fko_digest.c b/lib/fko_digest.c
index 64007a0e..c2ef56e0 100644
--- a/lib/fko_digest.c
+++ b/lib/fko_digest.c
@@ -114,7 +114,7 @@ set_digest(char *data, char **digest, short digest_type, int *digest_len)
     switch(digest_type)
     {
         case FKO_DIGEST_MD5:
-            md = malloc(MD_HEX_SIZE(MD5_DIGEST_LEN)+1);
+            md = calloc(1, MD_HEX_SIZE(MD5_DIGEST_LEN)+1);
             if(md == NULL)
                 return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -124,7 +124,7 @@ set_digest(char *data, char **digest, short digest_type, int *digest_len)
             break;
 
         case FKO_DIGEST_SHA1:
-            md = malloc(MD_HEX_SIZE(SHA1_DIGEST_LEN)+1);
+            md = calloc(1, MD_HEX_SIZE(SHA1_DIGEST_LEN)+1);
             if(md == NULL)
                 return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -134,7 +134,7 @@ set_digest(char *data, char **digest, short digest_type, int *digest_len)
             break;
 
         case FKO_DIGEST_SHA256:
-            md = malloc(MD_HEX_SIZE(SHA256_DIGEST_LEN)+1);
+            md = calloc(1, MD_HEX_SIZE(SHA256_DIGEST_LEN)+1);
             if(md == NULL)
                 return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -144,7 +144,7 @@ set_digest(char *data, char **digest, short digest_type, int *digest_len)
             break;
 
         case FKO_DIGEST_SHA384:
-            md = malloc(MD_HEX_SIZE(SHA384_DIGEST_LEN)+1);
+            md = calloc(1, MD_HEX_SIZE(SHA384_DIGEST_LEN)+1);
             if(md == NULL)
                 return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -154,7 +154,7 @@ set_digest(char *data, char **digest, short digest_type, int *digest_len)
             break;
 
         case FKO_DIGEST_SHA512:
-            md = malloc(MD_HEX_SIZE(SHA512_DIGEST_LEN)+1);
+            md = calloc(1, MD_HEX_SIZE(SHA512_DIGEST_LEN)+1);
             if(md == NULL)
                 return(FKO_ERROR_MEMORY_ALLOCATION);
 
diff --git a/lib/fko_encode.c b/lib/fko_encode.c
index a9cece8a..77c1a5c4 100644
--- a/lib/fko_encode.c
+++ b/lib/fko_encode.c
@@ -47,7 +47,7 @@ append_b64(char* tbuf, char *str)
     if(len >= MAX_SPA_ENCODED_MSG_SIZE)
         return(FKO_ERROR_INVALID_DATA_ENCODE_MESSAGE_TOOBIG);
 
-    bs = malloc(((len/3)*4)+8);
+    bs = calloc(1, ((len/3)*4)+8);
     if(bs == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
diff --git a/lib/fko_encryption.c b/lib/fko_encryption.c
index 3e5fdb8d..f71a9a16 100644
--- a/lib/fko_encryption.c
+++ b/lib/fko_encryption.c
@@ -114,7 +114,7 @@ _rijndael_encrypt(fko_ctx_t ctx, const char *enc_key, const int enc_key_len)
 
     /* Now make a bucket for the base64-encoded version and populate it.
     */
-    b64ciphertext = malloc(((cipher_len / 3) * 4) + 8);
+    b64ciphertext = calloc(1, ((cipher_len / 3) * 4) + 8);
     if(b64ciphertext == NULL)
     {
         if(zero_free((char *) ciphertext, pt_len+32) == FKO_SUCCESS
@@ -182,7 +182,7 @@ _rijndael_decrypt(fko_ctx_t ctx,
     /* Create a bucket for the (base64) decoded encrypted data and get the
      * raw cipher data.
     */
-    cipher = malloc(ctx->encrypted_msg_len);
+    cipher = calloc(1, ctx->encrypted_msg_len);
     if(cipher == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -212,7 +212,7 @@ _rijndael_decrypt(fko_ctx_t ctx,
     /* Create a bucket for the plaintext data and decrypt the message
      * data into it.
     */
-    ctx->encoded_msg = malloc(cipher_len);
+    ctx->encoded_msg = calloc(1, cipher_len);
     if(ctx->encoded_msg == NULL)
     {
         if(zero_free((char *)cipher, ctx->encrypted_msg_len) == FKO_SUCCESS)
@@ -309,7 +309,7 @@ gpg_encrypt(fko_ctx_t ctx, const char *enc_key)
     /* Make a bucket big enough to hold the enc msg + digest (plaintext)
      * and populate it appropriately.
     */
-    plain = malloc(ctx->encoded_msg_len + ctx->digest_len + 2);
+    plain = calloc(1, ctx->encoded_msg_len + ctx->digest_len + 2);
     if(plain == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
@@ -354,7 +354,7 @@ gpg_encrypt(fko_ctx_t ctx, const char *enc_key)
 
     /* Now make a bucket for the base64-encoded version and populate it.
     */
-    b64cipher = malloc(((cipher_len / 3) * 4) + 8);
+    b64cipher = calloc(1, ((cipher_len / 3) * 4) + 8);
     if(b64cipher == NULL)
     {
         if(zero_free(plain, pt_len) != FKO_SUCCESS)
@@ -419,7 +419,7 @@ gpg_decrypt(fko_ctx_t ctx, const char *dec_key)
     /* Create a bucket for the (base64) decoded encrypted data and get the
      * raw cipher data.
     */
-    cipher = malloc(ctx->encrypted_msg_len);
+    cipher = calloc(1, ctx->encrypted_msg_len);
     if(cipher == NULL)
         return(FKO_ERROR_MEMORY_ALLOCATION);
 
diff --git a/lib/fko_rand_value.c b/lib/fko_rand_value.c
index 4a1c9803..4513f060 100644
--- a/lib/fko_rand_value.c
+++ b/lib/fko_rand_value.c
@@ -117,15 +117,13 @@ fko_set_rand_value(fko_ctx_t ctx, const char * const new_val)
     if(ctx->rand_val != NULL)
         free(ctx->rand_val);
 
-    ctx->rand_val = malloc(FKO_RAND_VAL_SIZE+1);
+    ctx->rand_val = calloc(1, FKO_RAND_VAL_SIZE+1);
     if(ctx->rand_val == NULL)
             return(FKO_ERROR_MEMORY_ALLOCATION);
-    memset(ctx->rand_val, 0, FKO_RAND_VAL_SIZE+1);
 
-    tmp_buf = malloc(FKO_RAND_VAL_SIZE+1);
+    tmp_buf = calloc(1, FKO_RAND_VAL_SIZE+1);
     if(tmp_buf == NULL)
             return(FKO_ERROR_MEMORY_ALLOCATION);
-    memset(tmp_buf, 0, FKO_RAND_VAL_SIZE+1);
 
     snprintf(ctx->rand_val, FKO_RAND_VAL_SIZE, "%u", rand());
 
diff --git a/lib/fko_util.c b/lib/fko_util.c
index 47814bf1..c012455b 100644
--- a/lib/fko_util.c
+++ b/lib/fko_util.c
@@ -518,7 +518,7 @@ char
 {
     char* ns = NULL;
     if(s) {
-        ns = malloc(len + 1);
+        ns = calloc(1, len + 1);
         if(ns) {
             ns[len] = 0;
             // strncpy to be pedantic about modification in multithreaded 
diff --git a/lib/gpgme_funcs.c b/lib/gpgme_funcs.c
index 3f2f40c6..eb50f6d7 100644
--- a/lib/gpgme_funcs.c
+++ b/lib/gpgme_funcs.c
@@ -397,7 +397,7 @@ gpgme_encrypt(fko_ctx_t fko_ctx, unsigned char *indata, size_t in_len,
     */
     tmp_buf = gpgme_data_release_and_get_mem(cipher, out_len);
 
-    *out = malloc(*out_len); /* This is freed upon fko_ctx destruction. */
+    *out = calloc(1, *out_len); /* This is freed upon fko_ctx destruction. */
     if(*out == NULL)
         res = FKO_ERROR_MEMORY_ALLOCATION;
     else
diff --git a/server/config_init.c b/server/config_init.c
index bb0d2a3b..6c1e51a6 100644
--- a/server/config_init.c
+++ b/server/config_init.c
@@ -92,7 +92,7 @@ set_config_entry(fko_srv_options_t *opts, const int var_ndx, const char *value)
     */
     space_needed = strlen(value) + 1;
 
-    opts->config[var_ndx] = malloc(space_needed);
+    opts->config[var_ndx] = calloc(1, space_needed);
 
     if(opts->config[var_ndx] == NULL)
     {
diff --git a/server/log_msg.c b/server/log_msg.c
index 14737bab..dafb197e 100644
--- a/server/log_msg.c
+++ b/server/log_msg.c
@@ -78,13 +78,13 @@ init_logging(fko_srv_options_t *opts) {
       && opts->config[CONF_SYSLOG_IDENTITY][0] != '\0')
     {
         my_name  = opts->config[CONF_SYSLOG_IDENTITY];
-        log_name = malloc(strlen(opts->config[CONF_SYSLOG_IDENTITY])+1);
+        log_name = calloc(1, strlen(opts->config[CONF_SYSLOG_IDENTITY])+1);
         is_syslog = 1;
     }
     else
     {
         my_name  = (char*)&MY_NAME;
-        log_name = malloc(strlen(MY_NAME)+1);
+        log_name = calloc(1, strlen(MY_NAME)+1);
     }
 
     if(log_name == NULL)
diff --git a/server/replay_cache.c b/server/replay_cache.c
index 638c46e0..5c423897 100644
--- a/server/replay_cache.c
+++ b/server/replay_cache.c
@@ -93,9 +93,9 @@ rotate_digest_cache_file(fko_srv_options_t *opts)
     log_msg(LOG_INFO, "Rotating digest cache file.");
 
 #if USE_FILE_CACHE
-    new_file = malloc(strlen(opts->config[CONF_DIGEST_FILE])+5);
+    new_file = calloc(1, strlen(opts->config[CONF_DIGEST_FILE])+5);
 #else
-    new_file = malloc(strlen(opts->config[CONF_DIGEST_DB_FILE])+5);
+    new_file = calloc(1, strlen(opts->config[CONF_DIGEST_DB_FILE])+5);
 #endif
 
     if(new_file == NULL)