Like other networked systems CPS need to be secured by cryptographic architectures that ensure communication and platform security. The context of CPS brings about many challenges such as new settings for key establishment, realtime requirements, and resource-constrained environments. We devise novel cryptographic architectures driven by concrete CPS applications, and provide the methodology for their specification and verification; to make them certifiable to a high evaluation assurance level.