A media access control (MAC) security apparatus for a local area network interface includes multiple independently controlled power domains, each of which enters and exits a reduced power state independent of others of the power domains. An encryption/decryption engine, located within a first of the power domains, generates encrypted data in response to received packets and cryptographic primitives. An authentication engine, located within a second of the power domains, performs authentication operations in response to the encrypted data. The encryption/decryption engine comprises an advanced encryption standard engine that forms the cryptographic primitives and is located within a third of the power domains. The third power domain enters the reduced power state for part of a period during which (i) the first power domain does not enter the reduced power state and (ii) the encryption/decryption engine is generating the encrypted data.