Abstract: Messages sent from an earth station to a satellite by a command link are authenticated within the satellite before being executed. Authentication is accomplished by comparing a codeword appended to the message to a codeword generated within the satellite. This codeword is a cryptographic function of the message data and a secret operating key. A key change command from the earth station causes the satellite authenticator to generate a new operating key based a secret master key, a supplemental private code, and a publicly available initialization vector. The codeword appended to the key change command is encrypted in the new key and, if it agrees with a codeword generated by the satellite authenticator, the new key becomes the operating key and the key change function is complete.