A method of providing token security implemented by a network device in a network. The method includes encoding, into a signature mask, an identity of one or more token cells that have been signed; encoding, into the signature mask, an indication of which of the one or more token cells have been partially signed; and encoding, into the signature mask, an indication of which portion of the one or more partially signed token cells have been signed. A method of utilizing a scratchpad and a method of decomposing a contract clause are also disclosed.