A method for a device to securely receive configuration data, the method performed by the device, the method comprising: a) recording in a protected memory, a first device private key for an elliptic curve Diffie-Hellman (ECDH) key exchange algorithm, a second device private key for a digital signature algorithm, a certificate authority public key, and a first set of cryptographic parameters, wherein the first device private key corresponds to a first device public key, and wherein the second device private key corresponds to a second device public key; b) establishing a wireless connection, wherein the wireless connection is encrypted; c) receiving via the wireless connection, (i) a first server public key for a server (ii) a second set of cryptographic parameters, and (iii) a random number; d) authenticating (i) the server using at least the certificate authority public key, and (ii) the device using at least the received random number and the second device private key; e) deriving a first symmetric ciphering key using at least (i) the first device private key and the first server public key, (ii) the ECDH key exchange algorithm, and (iii) the first set of cryptographic parameters; f) deriving a third device private key and a third device public key using the second set of cryptographic parameters; g) generating a device digital signature over at least the third device public key using the second device private key; h) encrypting at least the derived third device public key into a first ciphertext using the derived first symmetric ciphering key; i) sending, via the wireless connection, the first ciphertext and the device digital signature to the server; and j) receiving, via the wireless connection, a second ciphertext of a first device configuration, wherein the device decrypts the second ciphertext using at least the first symmetric ciphering key. a) recording in a protected memory, a first device private key for an elliptic curve Diffie-Hellman (ECDH) key exchange algorithm, a second device private key for a digital signature algorithm, a certificate authority public key, and a first set of cryptographic parameters, wherein the first device private key corresponds to a first device public key, and wherein the second device private key corresponds to a second device public key; b) establishing a wireless connection, wherein the wireless connection is encrypted; c) receiving via the wireless connection, (i) a first server public key for a server (ii) a second set of cryptographic parameters, and (iii) a random number; d) authenticating (i) the server using at least the certificate authority public key, and (ii) the device using at least the received random number and the second device private key; e) deriving a first symmetric ciphering key using at least (i) the first device private key and the first server public key, (ii) the ECDH key exchange algorithm, and (iii) the first set of cryptographic parameters; f) deriving a third device private key and a third device public key using the second set of cryptographic parameters; g) generating a device digital signature over at least the third device public key using the second device private key; h) encrypting at least the derived third device public key into a first ciphertext using the derived first symmetric ciphering key; i) sending, via the wireless connection, the first ciphertext and the device digital signature to the server; and j) receiving, via the wireless connection, a second ciphertext of a first device configuration, wherein the device decrypts the second ciphertext using at least the first symmetric ciphering key.