A method comprising: accessing a header of a block-based media device, the header including a data structure and a set of non-root hash values of a hierarchical hash tree; obtaining from the data structure a first root hash of the hierarchical hash tree; computing a second root hash from the set of non-root hash values included in the header; comparing the first root hash to the second root hash; if the first root hash and the second root hash match, obtaining an encrypted key from the data structure; securely decrypting the encrypted key; securely storing the key such that the key is not passed in the clear; providing a reference to the key; locating a data block requested by a block read request and a hash block associated with the data block; decrypting (618, 730) the data block with the reference to the key; loading authentication data from the hash block associated with the data block; identifying, in the authentication data, a first set of hash values associated with a first level of the hierarchical hash tree, the first level being a non-root level of the hierarchical hash tree; computing (620, 736) a cryptographic hash of a sub-block of the data block to determine a first hash value of the sub-block; comparing (622, 738) the first hash value to a corresponding value in the first set of hash values, the corresponding value corresponding to the sub-block of the data block; rejecting (624N, 744N) the block data request if the first hash value and the corresponding value in the first set of hash values do not match. accessing a header of a block-based media device, the header including a data structure and a set of non-root hash values of a hierarchical hash tree; obtaining from the data structure a first root hash of the hierarchical hash tree; computing a second root hash from the set of non-root hash values included in the header; comparing the first root hash to the second root hash; if the first root hash and the second root hash match, obtaining an encrypted key from the data structure; securely decrypting the encrypted key; securely storing the key such that the key is not passed in the clear; providing a reference to the key; locating a data block requested by a block read request and a hash block associated with the data block; decrypting (618, 730) the data block with the reference to the key; loading authentication data from the hash block associated with the data block; identifying, in the authentication data, a first set of hash values associated with a first level of the hierarchical hash tree, the first level being a non-root level of the hierarchical hash tree; computing (620, 736) a cryptographic hash of a sub-block of the data block to determine a first hash value of the sub-block; comparing (622, 738) the first hash value to a corresponding value in the first set of hash values, the corresponding value corresponding to the sub-block of the data block; rejecting (624N, 744N) the block data request if the first hash value and the corresponding value in the first set of hash values do not match. obtaining an encrypted key from the data structure; securely decrypting the encrypted key; securely storing the key such that the key is not passed in the clear; providing a reference to the key; locating a data block requested by a block read request and a hash block associated with the data block; decrypting (618, 730) the data block with the reference to the key; loading authentication data from the hash block associated with the data block; identifying, in the authentication data, a first set of hash values associated with a first level of the hierarchical hash tree, the first level being a non-root level of the hierarchical hash tree; computing (620, 736) a cryptographic hash of a sub-block of the data block to determine a first hash value of the sub-block; comparing (622, 738) the first hash value to a corresponding value in the first set of hash values, the corresponding value corresponding to the sub-block of the data block; rejecting (624N, 744N) the block data request if the first hash value and the corresponding value in the first set of hash values do not match.