Abstract: A method of cryptographically labeling electronically stored data is provided as part of a security system for personal computers. In protecting sensitive files of data, the labeling method utilizes a plurality of key streams, which are long, relatively prime-length sequences of random-like bytes. The key streams are related in some way to individual user and machine identifiers. Protected files of data are encrypted and decrypted by combining the key streams with the data using a reversible function, such as Exclusive OR. Each protected file has a label prefixed to it as part of the file. The label contains information necessary for encrypting and decrypting the file, controlling access to the file, and verifying integrity of the label and file. The label is permanently prefixed to the protected file but is encrypted and decrypted separately from encryption and decryption of the file.