10. A client device, comprising: a receiver for receiving and demodulating an encrypted transport stream over a content distribution network, wherein the encrypted transport stream was encrypted using a first control word that serves as an encryption/decryption key, wherein the receiver is configured to receive a variable control word over the content delivery network; and a decryptor coupled to the receiver and configured to receive a multiple bit fixed control word over a communication path that is different than the content delivery network, the decryptor for decrypting the encrypted transport stream using a mathematically constrained second control word that is mathematically constrained with respect to the variable control word, wherein the decryptor is configured to derive the mathematically constrained second control word in part using an algorithm that is locally accessible to the decryptor, wherein the algorithm forms the mathematically constrained second control word by using the variable control word, wherein a first plurality of bits of the second control word are equal to corresponding bits of the variable control word, and a second plurality of bits of the second control word are formed using bits of the fixed control word; and a decoder for decoding the decrypted transport stream.
15. The client device of claim 10 wherein the variable control word is encapsulated in an entitlement control message (ECM).