A merchant payment computer comprising: a processor; and a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising: sending authentication information to a merchant management computer; receiving a signed digital certificate from a merchant management computer; sending the digital certificate and a device identifier to a key management computer; receiving, from the key management computer, an initial encryption key derived from a base derivation key and the device identifier for the merchant payment computer; receiving transaction data from a user for a transaction; encrypting the transaction data using the initial encryption key; sending the encrypted transaction data and data usable to derive the initial encryption key to a payment processing network; and receiving an indication of whether the transaction was approved or declined, wherein encrypting the transaction data using the initial encryption key includes: generating a plurality of future transaction encryption keys using the initial encryption key, each future transaction encryption key associated with a unique serial number, and encrypting the transaction data with one of the plurality of future transaction encryption keys, and the method further comprises sending, by the merchant payment computer, a serial number associated with the future transaction encryption key used to encrypt the transaction data to the payment processing network, whereby the encrypted transaction data is decryptable using the device identifier, the serial number, and a base derivation key stored by the payment processing network. a processor; and a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising: sending authentication information to a merchant management computer; receiving a signed digital certificate from a merchant management computer; sending the digital certificate and a device identifier to a key management computer; receiving, from the key management computer, an initial encryption key derived from a base derivation key and the device identifier for the merchant payment computer; receiving transaction data from a user for a transaction; encrypting the transaction data using the initial encryption key; sending the encrypted transaction data and data usable to derive the initial encryption key to a payment processing network; and receiving an indication of whether the transaction was approved or declined, sending authentication information to a merchant management computer; receiving a signed digital certificate from a merchant management computer; sending the digital certificate and a device identifier to a key management computer; receiving, from the key management computer, an initial encryption key derived from a base derivation key and the device identifier for the merchant payment computer; receiving transaction data from a user for a transaction; encrypting the transaction data using the initial encryption key; sending the encrypted transaction data and data usable to derive the initial encryption key to a payment processing network; and receiving an indication of whether the transaction was approved or declined, wherein encrypting the transaction data using the initial encryption key includes: generating a plurality of future transaction encryption keys using the initial encryption key, each future transaction encryption key associated with a unique serial number, and encrypting the transaction data with one of the plurality of future transaction encryption keys, generating a plurality of future transaction encryption keys using the initial encryption key, each future transaction encryption key associated with a unique serial number, and encrypting the transaction data with one of the plurality of future transaction encryption keys, and the method further comprises sending, by the merchant payment computer, a serial number associated with the future transaction encryption key used to encrypt the transaction data to the payment processing network, whereby the encrypted transaction data is decryptable using the device identifier, the serial number, and a base derivation key stored by the payment processing network.