A method and system are disclosed to provide secure key selection using a secure device in a watercrypting environment. A license containing a product key of a watercrypted content and a client identifier is transmitted to a secure device for storage. An entitlement control message containing multiple content keys associated with the watercrypted content is further transmitted to the secure device, together with a request to provide a session content key from the multiple content keys, the session content key to be used to decrypt the watercrypted content. Finally, the session content key is received from the secure device in response to the request.