An apparatus, comprising: a communication interface; memory configured to store user specific credentials; and a cryptographic processing circuitry; wherein the cryptographic processing circuitry is configured to: receive a certificate via the communication interface from a certificate authority; cause storing of the certificate in the memory; cause storing of a private key and a public key in the memory; cause attempting of authenticating of the apparatus with public key encryption to a ticket reader for accessing a service, by transmission of one or more messages, wherein the messages contain an authenticator that comprises at least one of the following: the certificate or a cryptographic derivative thereof; and one or more data items contained by the certificate or a cryptographic derivative thereof; wherein the cryptographic processing circuitry is further configured to: prepare said messages such that the public key is not recoverable from outside of the authenticator; receive a challenge from the ticket reader and to responsively compute a signed response; the apparatus being characterized in that the cryptographic processing circuitry is further configured to cause, responsive to the receiving of the challenge, sending a previously computed signed response that was computed based on a previously received challenge. a communication interface; memory configured to store user specific credentials; and a cryptographic processing circuitry; wherein the cryptographic processing circuitry is configured to: receive a certificate via the communication interface from a certificate authority; cause storing of the certificate in the memory; cause storing of a private key and a public key in the memory; cause attempting of authenticating of the apparatus with public key encryption to a ticket reader for accessing a service, by transmission of one or more messages, wherein the messages contain an authenticator that comprises at least one of the following: the certificate or a cryptographic derivative thereof; and one or more data items contained by the certificate or a cryptographic derivative thereof; receive a certificate via the communication interface from a certificate authority; cause storing of the certificate in the memory; cause storing of a private key and a public key in the memory; cause attempting of authenticating of the apparatus with public key encryption to a ticket reader for accessing a service, by transmission of one or more messages, wherein the messages contain an authenticator that comprises at least one of the following: the certificate or a cryptographic derivative thereof; and one or more data items contained by the certificate or a cryptographic derivative thereof; the certificate or a cryptographic derivative thereof; and one or more data items contained by the certificate or a cryptographic derivative thereof; wherein the cryptographic processing circuitry is further configured to: prepare said messages such that the public key is not recoverable from outside of the authenticator; receive a challenge from the ticket reader and to responsively compute a signed response; the apparatus being characterized in that the cryptographic processing circuitry is further configured to cause, responsive to the receiving of the challenge, sending a previously computed signed response that was computed based on a previously received challenge. prepare said messages such that the public key is not recoverable from outside of the authenticator; receive a challenge from the ticket reader and to responsively compute a signed response; the apparatus being characterized in that the cryptographic processing circuitry is further configured to cause, responsive to the receiving of the challenge, sending a previously computed signed response that was computed based on a previously received challenge.