Methods and apparatus are presented for encrypting and authenticating
data, wherein some data is encrypted and some data is not encrypted, but
all of the data is authenticated. Masking modules (410) are used in a
partial-block encryption mode to indicate which bits of a data block are
to be encrypted.