A method of authenticating a first messaging device to a second messaging device and establishing a session key for secure communications using a shared secret in a single message exchange, the method comprising: generating encrypted payload data from unencrypted payload data using a cryptographic key generated by a block cipher encryption operation from a root key, a random number, an initial value, and a plurality of identifiers using the first messaging device, wherein the root key is a shared secret between the first messaging device and the second messaging device; generating a cryptographic hash of the encrypted payload data to produce a first hash value using the first messaging device; generating an electronic signature of the encrypted payload data from the first hash value and plurality of identifiers using the block cipher encryption operation using the first messaging device; transmitting the plurality of identifiers, the electronic signature, and the encrypted payload data using the first messaging device to the second messaging device; receiving the plurality of identifiers, the electronic signature, and the encrypted payload data from the message using the second messaging device; generating a cryptographic hash of the encrypted payload to produce a second hash value using the second messaging device; verifying the received electronic signature by performing a block cipher decryption operation using at least a portion of the second hash value and the received plurality of identifiers using the second messaging device; decrypting the encrypted payload data using a cryptographic key generated by a block cipher decryption operation from the root key, the received identifiers and at least a portion of the received electronic signature using the second messaging device to recover the random number; and establishing a secure channel for subsequent communications by and between the first messaging device and second messaging device using the random number as key material for the session key to secure the channel. generating encrypted payload data from unencrypted payload data using a cryptographic key generated by a block cipher encryption operation from a root key, a random number, an initial value, and a plurality of identifiers using the first messaging device, wherein the root key is a shared secret between the first messaging device and the second messaging device; generating a cryptographic hash of the encrypted payload data to produce a first hash value using the first messaging device; generating an electronic signature of the encrypted payload data from the first hash value and plurality of identifiers using the block cipher encryption operation using the first messaging device; transmitting the plurality of identifiers, the electronic signature, and the encrypted payload data using the first messaging device to the second messaging device; receiving the plurality of identifiers, the electronic signature, and the encrypted payload data from the message using the second messaging device; generating a cryptographic hash of the encrypted payload to produce a second hash value using the second messaging device; verifying the received electronic signature by performing a block cipher decryption operation using at least a portion of the second hash value and the received plurality of identifiers using the second messaging device; decrypting the encrypted payload data using a cryptographic key generated by a block cipher decryption operation from the root key, the received identifiers and at least a portion of the received electronic signature using the second messaging device to recover the random number; and establishing a secure channel for subsequent communications by and between the first messaging device and second messaging device using the random number as key material for the session key to secure the channel.