A cryptographic processor for redundantly-processing cryptographic operations, the cryptographic processor comprising: a bi-directional plaintext interface; a bi-directional ciphertext interface; at least one additional bi-directional plaintext interface or bi-directional ciphertext interface, wherein each of the interfaces is bi-directional to include an input port and an output port, wherein at least one of the input ports is configured to receive a first plaintext data packet and a first ciphertext data packet, wherein at least one of the output ports is configured to send out a second ciphertext data packet and a second plaintext data packet; a first cryptographic engine coupled to the input ports of the interfaces; a second cryptographic engine coupled to the input ports of the interfaces, the first cryptographic engine and the second cryptographic engine being each configured to perform encryption of the first plaintext data packet to produce the second ciphertext data packet as an output and decryption of the first ciphertext data packet to produce the second plaintext data packet as an output; a first arbitration logic and a second arbitration logic configured to: receive a request to open the appropriate input port when one of the interfaces has a data packet to be routed through the first cryptographic engine and the second cryptographic engine, and open the appropriate input port (428 according to the request; receive a request to open the appropriate output port when the first cryptographic engine and the second cryptographic engine receive the data packet, and open the appropriate output port according to the request; and ensure that only one input port is opened at a time, and that only one output port is opened at a time, the first arbitration logic and the second arbitration logic being configured to be instructed to close all of the output ports when an entire data packet has been sent out of the output port, wherein a port (428-1, 428-2, 428-3, 428-4, 424-1, 424-3) is only opened if the first arbitration logic and the second arbitration logic are in agreement as to which port (428-1, 428-2, 428-3, 428-4, 424-1, 424-3) to open; and comparison logic (208, 210) configured to compare the redundant data packets as the packets leave the first cryptographic engine and the second cryptographic engine, to ensure that the first cryptographic engine and the second cryptographic engine produce a same output. a bi-directional plaintext interface; a bi-directional ciphertext interface; at least one additional bi-directional plaintext interface or bi-directional ciphertext interface, wherein each of the interfaces is bi-directional to include an input port and an output port, wherein at least one of the input ports is configured to receive a first plaintext data packet and a first ciphertext data packet, wherein at least one of the output ports is configured to send out a second ciphertext data packet and a second plaintext data packet; a first cryptographic engine coupled to the input ports of the interfaces; a second cryptographic engine coupled to the input ports of the interfaces, the first cryptographic engine and the second cryptographic engine being each configured to perform encryption of the first plaintext data packet to produce the second ciphertext data packet as an output and decryption of the first ciphertext data packet to produce the second plaintext data packet as an output; a first arbitration logic and a second arbitration logic configured to: receive a request to open the appropriate input port when one of the interfaces has a data packet to be routed through the first cryptographic engine and the second cryptographic engine, and open the appropriate input port (428 according to the request; receive a request to open the appropriate output port when the first cryptographic engine and the second cryptographic engine receive the data packet, and open the appropriate output port according to the request; and ensure that only one input port is opened at a time, and that only one output port is opened at a time, the first arbitration logic and the second arbitration logic being configured to be instructed to close all of the output ports when an entire data packet has been sent out of the output port, receive a request to open the appropriate input port when one of the interfaces has a data packet to be routed through the first cryptographic engine and the second cryptographic engine, and open the appropriate input port (428 according to the request; receive a request to open the appropriate output port when the first cryptographic engine and the second cryptographic engine receive the data packet, and open the appropriate output port according to the request; and ensure that only one input port is opened at a time, and that only one output port is opened at a time, the first arbitration logic and the second arbitration logic being configured to be instructed to close all of the output ports when an entire data packet has been sent out of the output port, wherein a port (428-1, 428-2, 428-3, 428-4, 424-1, 424-3) is only opened if the first arbitration logic and the second arbitration logic are in agreement as to which port (428-1, 428-2, 428-3, 428-4, 424-1, 424-3) to open; and comparison logic (208, 210) configured to compare the redundant data packets as the packets leave the first cryptographic engine and the second cryptographic engine, to ensure that the first cryptographic engine and the second cryptographic engine produce a same output.