check that the classification level of the requesting packet matches the classification level of the partition 204 of the requested key with a specified key location a key memory interface 132 couples to the partitioned key cache 116 to retrieve the requested key the sterile key is returned to a key buffer 308 a rule enforcement circuit 336 includes a sterile key validator 304 a key decoder 324 and a reconstituted key validator 328 multiple levels of checks are performed on the key before the key is provided to the cryptographic processor 120 the sterile key validator 304 checks the classification level of the sterile key against the classification level of the packet that precipitated the request of the key essentially the sterile key is checked to make sure it matches the type of processing being performed in the cryptographic processor 120 to provide high assurance the sterile key validator 304 could also match the algorithm and or state as further rule checks in some embodiments a crc checksum or other validity value is appended to the sterile key in this embodiment when stored in the partitioned key cache 116 the software determines the validity value when writing the sterile key into the partitioned key cache 116 a check of the validity value allows conformation that information stored by the processor 108 was delivered accurately to the sterile key validator 304 a key map database 316 holds information to validate the keys in their sterile or reconstituted.