Disclosed is a method for mutual authentication between a station, having a digital rights agent, and a secure removable media device. The digital rights agent is configured to initiate mutual authentication by sending a message to the secure removable media device. The secure removable media device is configured to encrypt at least a first random number using a public key associated with the digital rights agent. The digital rights agent is configured to decrypt the encrypted first random number, and encrypt at least a second random number and a first hash based on at least the first random number. The secure removable media device is configured to decrypt the encrypted second random number and the first hash, verify the first hash to authenticate the digital rights agent, and generate a second hash based on at least the second random number. The digital rights agent is configured to verify the second hash to authenticate the secure removable media device.