A method of managing and recovering from the failure of cryptographic devices in a secure transaction processing system including a database, a plurality first cryptographic devices and a standby cryptographic device. Each of the first cryptographic devices periodically generates and sends to the database a total freshness counter record and generates and sends to another of the first cryptographic devices a digital signature and time stamp record. Upon failure of a first cryptographic device, the standby cryptographic device requests and receives the current total freshness counter record and digital signature and time stamp record for the failed first cryptographic device, and uses the digital signature and time stamp record to verify that the total freshness center record is most current. If so verified, the standby cryptographic device assumes the operation of the failed first cryptographic device.