A method for mitigation of denial of service attacks in a data network, comprising: generating with a processor in a server computing device a first plurality of puzzles; transmitting with the processor and a network device in the server computing device the first plurality of puzzles through the data network to a plurality of client computing devices (240A - 240N); generating with the processor in the server computing device a second plurality of puzzles; generating with the processor in the server computing device a plurality of encrypted puzzles from the second plurality of puzzles using a first cryptographic key; receiving with the processor and the network device in the server computing device a request from one client computing device in the plurality of client computing devices (240A - 240N) that includes a solution to one puzzle in the first plurality of puzzles, the request from the one client computing device being received without a communication from the one client computing device requesting a puzzle; verifying with the processor in the server computing device correctness of the solution to the one puzzle and from the one client computing device with reference to data corresponding to the one puzzle and stored in a memory in the server computing device; continuing to process the request with the processor in the server computing device only in response to verification that the solution from the one client computing device is correct, transmitting with the processor and the network device in the server computing device the encrypted plurality of puzzles through the data network to the plurality of client computing devices at a first time; and transmitting with the processor and the network device in the server computing device a second cryptographic key through the data network to the plurality of client computing devices (240A - 240N) at a second time, the second time being later than the first time, the second cryptographic key enabling the plurality of client computing devices (240A - 240N) to decrypt the encrypted plurality of puzzles and to generate solutions for the second plurality of puzzles after the second time, wherein said first plurality of puzzles, said one puzzle, and said second plurality of puzzles are cryptographic puzzles, wherein said plurality of encrypted puzzles are encrypted cryptographic puzzles, and wherein the first cryptographic key is a public key and the second cryptographic key is a private key, the private key being different than the public key. generating with a processor in a server computing device a first plurality of puzzles; transmitting with the processor and a network device in the server computing device the first plurality of puzzles through the data network to a plurality of client computing devices (240A - 240N); generating with the processor in the server computing device a second plurality of puzzles; generating with the processor in the server computing device a plurality of encrypted puzzles from the second plurality of puzzles using a first cryptographic key; receiving with the processor and the network device in the server computing device a request from one client computing device in the plurality of client computing devices (240A - 240N) that includes a solution to one puzzle in the first plurality of puzzles, the request from the one client computing device being received without a communication from the one client computing device requesting a puzzle; verifying with the processor in the server computing device correctness of the solution to the one puzzle and from the one client computing device with reference to data corresponding to the one puzzle and stored in a memory in the server computing device; continuing to process the request with the processor in the server computing device only in response to verification that the solution from the one client computing device is correct, transmitting with the processor and the network device in the server computing device the encrypted plurality of puzzles through the data network to the plurality of client computing devices at a first time; and transmitting with the processor and the network device in the server computing device a second cryptographic key through the data network to the plurality of client computing devices (240A - 240N) at a second time, the second time being later than the first time, the second cryptographic key enabling the plurality of client computing devices (240A - 240N) to decrypt the encrypted plurality of puzzles and to generate solutions for the second plurality of puzzles after the second time, wherein said first plurality of puzzles, said one puzzle, and said second plurality of puzzles are cryptographic puzzles, wherein said plurality of encrypted puzzles are encrypted cryptographic puzzles, and wherein the first cryptographic key is a public key and the second cryptographic key is a private key, the private key being different than the public key.