diff --git a/src/core/or/crypt_path.c b/src/core/or/crypt_path.c
index 54f5623d32..975af6c16d 100644
--- a/src/core/or/crypt_path.c
+++ b/src/core/or/crypt_path.c
@@ -26,6 +26,17 @@
 #include "core/or/crypt_path_st.h"
 #include "core/or/cell_st.h"
 
+/** Initialize and return a minimal crypt_path_t */
+crypt_path_t *
+crypt_path_new(void)
+{
+  crypt_path_t *cpath = tor_malloc_zero(sizeof(crypt_path_t));
+  cpath->magic = CRYPT_PATH_MAGIC;
+  cpath->private = tor_malloc_zero(sizeof(struct crypt_path_private_t));
+
+  return cpath;
+}
+
 /** Add <b>new_hop</b> to the end of the doubly-linked-list <b>head_ptr</b>.
  * This function is used to extend cpath by another hop.
  */
@@ -49,12 +60,11 @@ onion_append_to_cpath(crypt_path_t **head_ptr, crypt_path_t *new_hop)
 int
 onion_append_hop(crypt_path_t **head_ptr, extend_info_t *choice)
 {
-  crypt_path_t *hop = tor_malloc_zero(sizeof(crypt_path_t));
+  crypt_path_t *hop = crypt_path_new();
 
   /* link hop into the cpath, at the end. */
   onion_append_to_cpath(head_ptr, hop);
 
-  hop->magic = CRYPT_PATH_MAGIC;
   hop->state = CPATH_STATE_CLOSED;
 
   hop->extend_info = extend_info_dup(choice);
@@ -158,6 +168,7 @@ circuit_free_cpath_node(crypt_path_t *victim)
   onion_handshake_state_release(&victim->handshake_state);
   crypto_dh_free(victim->rend_dh_handshake_state);
   extend_info_free(victim->extend_info);
+  tor_free(victim->private);
 
   memwipe(victim, 0xBB, sizeof(crypt_path_t)); /* poison memory */
   tor_free(victim);
diff --git a/src/core/or/crypt_path.h b/src/core/or/crypt_path.h
index e8455c6326..c6d1cd1400 100644
--- a/src/core/or/crypt_path.h
+++ b/src/core/or/crypt_path.h
@@ -3,6 +3,8 @@
  * \brief Header file for crypt_path.c.
  **/
 
+crypt_path_t *crypt_path_new(void);
+
 /* rename */
 void assert_cpath_layer_ok(const crypt_path_t *cp);
 
diff --git a/src/core/or/crypt_path_st.h b/src/core/or/crypt_path_st.h
index 833cfefad1..7da3c57f49 100644
--- a/src/core/or/crypt_path_st.h
+++ b/src/core/or/crypt_path_st.h
@@ -8,9 +8,6 @@
 #define CRYPT_PATH_ST_H
 
 #include "core/or/relay_crypto_st.h"
-struct crypto_dh_t;
-
-#define CRYPT_PATH_MAGIC 0x70127012u
 
 struct fast_handshake_state_t;
 struct ntor_handshake_state_t;
@@ -26,6 +23,8 @@ struct onion_handshake_state_t {
 
 #ifdef CRYPT_PATH_PRIVATE
 
+#define CRYPT_PATH_MAGIC 0x70127012u
+
 /* The private parts of crypt path that don't need to be exposed to all the
  * modules. */
 struct crypt_path_private_t {
diff --git a/src/feature/hs/hs_circuit.c b/src/feature/hs/hs_circuit.c
index a42228d362..3356db9d90 100644
--- a/src/feature/hs/hs_circuit.c
+++ b/src/feature/hs/hs_circuit.c
@@ -87,8 +87,7 @@ create_rend_cpath(const uint8_t *ntor_key_seed, size_t seed_len,
   }
 
   /* Setup the cpath */
-  cpath = tor_malloc_zero(sizeof(crypt_path_t));
-  cpath->magic = CRYPT_PATH_MAGIC;
+  cpath = crypt_path_new();
 
   if (circuit_init_cpath_crypto(cpath, (char*)keys, sizeof(keys),
                                 is_service_side, 1) < 0) {
diff --git a/src/feature/rend/rendclient.c b/src/feature/rend/rendclient.c
index f84d221b1a..c6e9dde878 100644
--- a/src/feature/rend/rendclient.c
+++ b/src/feature/rend/rendclient.c
@@ -16,6 +16,7 @@
 #include "core/or/circuituse.h"
 #include "core/or/connection_edge.h"
 #include "core/or/relay.h"
+#include "core/or/crypt_path.h"
 #include "feature/client/circpathbias.h"
 #include "feature/control/control_events.h"
 #include "feature/dirclient/dirclient.h"
@@ -194,9 +195,7 @@ rend_client_send_introduction(origin_circuit_t *introcirc,
   /* Initialize the pending_final_cpath and start the DH handshake. */
   cpath = rendcirc->build_state->pending_final_cpath;
   if (!cpath) {
-    cpath = rendcirc->build_state->pending_final_cpath =
-      tor_malloc_zero(sizeof(crypt_path_t));
-    cpath->magic = CRYPT_PATH_MAGIC;
+    cpath = rendcirc->build_state->pending_final_cpath = crypt_path_new();
     if (!(cpath->rend_dh_handshake_state = crypto_dh_new(DH_TYPE_REND))) {
       log_warn(LD_BUG, "Internal error: couldn't allocate DH.");
       status = -2;
diff --git a/src/feature/rend/rendservice.c b/src/feature/rend/rendservice.c
index 5c267f8e34..38da4cfe7a 100644
--- a/src/feature/rend/rendservice.c
+++ b/src/feature/rend/rendservice.c
@@ -2158,8 +2158,7 @@ rend_service_receive_introduction(origin_circuit_t *circuit,
   launched->build_state->service_pending_final_cpath_ref->refcount = 1;
 
   launched->build_state->service_pending_final_cpath_ref->cpath = cpath =
-    tor_malloc_zero(sizeof(crypt_path_t));
-  cpath->magic = CRYPT_PATH_MAGIC;
+    crypt_path_new();
   launched->build_state->expiry_time = now + MAX_REND_TIMEOUT;
 
   cpath->rend_dh_handshake_state = dh;
diff --git a/src/test/test_circuitpadding.c b/src/test/test_circuitpadding.c
index 8a2667e802..6fa790c40d 100644
--- a/src/test/test_circuitpadding.c
+++ b/src/test/test_circuitpadding.c
@@ -115,7 +115,7 @@ new_fake_orcirc(channel_t *nchan, channel_t *pchan)
 {
   or_circuit_t *orcirc = NULL;
   circuit_t *circ = NULL;
-  crypt_path_t tmp_cpath;
+  crypt_path_t *tmp_cpath;
   char whatevs_key[CPATH_KEY_MATERIAL_LEN];
 
   orcirc = tor_malloc_zero(sizeof(*orcirc));
@@ -144,13 +144,15 @@ new_fake_orcirc(channel_t *nchan, channel_t *pchan)
   circuit_set_p_circid_chan(orcirc, orcirc->p_circ_id, pchan);
   circuit_set_n_circid_chan(circ, circ->n_circ_id, nchan);
 
-  memset(&tmp_cpath, 0, sizeof(tmp_cpath));
-  if (circuit_init_cpath_crypto(&tmp_cpath, whatevs_key,
+  tmp_cpath = crypt_path_new();
+  if (circuit_init_cpath_crypto(tmp_cpath, whatevs_key,
                                 sizeof(whatevs_key), 0, 0)<0) {
     log_warn(LD_BUG,"Circuit initialization failed");
     return NULL;
   }
-  orcirc->crypto = tmp_cpath.private->crypto;
+  orcirc->crypto = tmp_cpath->private->crypto;
+  tor_free(tmp_cpath->private);
+  tor_free(tmp_cpath);
 
   return orcirc;
 }
@@ -1618,10 +1620,9 @@ simulate_single_hop_extend(circuit_t *client, circuit_t *mid_relay,
   circpad_cell_event_nonpadding_received((circuit_t*)client);
 
   // Add a hop to cpath
-  crypt_path_t *hop = tor_malloc_zero(sizeof(crypt_path_t));
+  crypt_path_t *hop = crypt_path_new();
   onion_append_to_cpath(&TO_ORIGIN_CIRCUIT(client)->cpath, hop);
 
-  hop->magic = CRYPT_PATH_MAGIC;
   hop->state = CPATH_STATE_OPEN;
 
   // add an extend info to indicate if this node supports padding or not.
diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c
index 607be339a9..9e1d73a855 100644
--- a/src/test/test_hs_client.c
+++ b/src/test/test_hs_client.c
@@ -39,6 +39,7 @@
 #include "feature/hs/hs_cache.h"
 #include "core/or/circuitlist.h"
 #include "core/or/circuitbuild.h"
+#include "core/or/crypt_path.h"
 #include "core/mainloop/connection.h"
 #include "core/or/connection_edge.h"
 #include "feature/nodelist/networkstatus.h"
@@ -145,9 +146,7 @@ helper_get_circ_and_stream_for_test(origin_circuit_t **circ_out,
 
   if (is_legacy) {
     /* Legacy: Setup rend data and final cpath */
-    or_circ->build_state->pending_final_cpath =
-      tor_malloc_zero(sizeof(crypt_path_t));
-    or_circ->build_state->pending_final_cpath->magic = CRYPT_PATH_MAGIC;
+    or_circ->build_state->pending_final_cpath = crypt_path_new();
     or_circ->build_state->pending_final_cpath->rend_dh_handshake_state =
       crypto_dh_new(DH_TYPE_REND);
     tt_assert(
diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c
index bfa66f551a..357db89040 100644
--- a/src/test/test_hs_service.c
+++ b/src/test/test_hs_service.c
@@ -38,6 +38,7 @@
 #include "core/or/circuitbuild.h"
 #include "core/or/circuitlist.h"
 #include "core/or/circuituse.h"
+#include "core/or/crypt_path.h"
 #include "core/or/connection_edge.h"
 #include "core/or/edge_connection_st.h"
 #include "core/or/relay.h"
@@ -218,8 +219,7 @@ helper_create_origin_circuit(int purpose, int flags)
 
   circ = origin_circuit_init(purpose, flags);
   tor_assert(circ);
-  circ->cpath = tor_malloc_zero(sizeof(crypt_path_t));
-  circ->cpath->magic = CRYPT_PATH_MAGIC;
+  circ->cpath = crypt_path_new();
   circ->cpath->state = CPATH_STATE_OPEN;
   circ->cpath->package_window = circuit_initial_package_window();
   circ->cpath->deliver_window = CIRCWINDOW_START;
diff --git a/src/test/test_relaycell.c b/src/test/test_relaycell.c
index 0623583511..b48c7ca8ac 100644
--- a/src/test/test_relaycell.c
+++ b/src/test/test_relaycell.c
@@ -16,6 +16,7 @@
 #include "lib/crypt_ops/crypto_rand.h"
 #include "core/or/circuitbuild.h"
 #include "core/or/circuitlist.h"
+#include "core/or/crypt_path.h"
 #include "core/or/connection_edge.h"
 #include "core/or/relay.h"
 #include "test/test.h"
@@ -90,8 +91,7 @@ helper_create_origin_circuit(int purpose, int flags)
 
   circ = origin_circuit_init(purpose, flags);
   tor_assert(circ);
-  circ->cpath = tor_malloc_zero(sizeof(crypt_path_t));
-  circ->cpath->magic = CRYPT_PATH_MAGIC;
+  circ->cpath = crypt_path_new();
   circ->cpath->state = CPATH_STATE_OPEN;
   circ->cpath->package_window = circuit_initial_package_window();
   circ->cpath->deliver_window = CIRCWINDOW_START;
diff --git a/src/test/test_relaycrypt.c b/src/test/test_relaycrypt.c
index b94ee07abc..1fe5df96ed 100644
--- a/src/test/test_relaycrypt.c
+++ b/src/test/test_relaycrypt.c
@@ -50,7 +50,7 @@ testing_circuitset_setup(const struct testcase_t *testcase)
   cs->origin_circ = origin_circuit_new();
   cs->origin_circ->base_.purpose = CIRCUIT_PURPOSE_C_GENERAL;
   for (i=0; i<3; ++i) {
-    crypt_path_t *hop = tor_malloc_zero(sizeof(*hop));
+    crypt_path_t *hop = crypt_path_new();
     relay_crypto_init(&hop->private->crypto, KEY_MATERIAL[i], sizeof(KEY_MATERIAL[i]),
                       0, 0);
     hop->state = CPATH_STATE_OPEN;