An encryption apparatus (14) includes an integrated circuit (34) having a secure processing section (30). A plaintext reset epoch key (154) is stored in the secure processing section (30) and configured to have a short life. A plaintext master key (160) is stored in the secure processing section (30) and configured to have a long life. A multiplicity of active keys (172) are generated, encrypted using a weaker but faster cryptographic algorithm (68) and the reset epoch key (154), then stored in a high-capacity key magazine (86) portion of unsecured memory (16, 18, 28). Some keys and data are also encrypted using a stronger but slower cryptographic algorithm (70) and the master key (160), then stored in unsecured memory (16, 18, 28). Keys (272, 372) may be converted between weaker, faster encryption and stronger, slower encryption.