A computer-implemented method, comprising: determining, by a user device (101, 200), a one-time user public key; sending, by the user device (101, 200) to a provisioning server computer (105, 106, 300), a provisioning request message (1202, 1302) including the one-time user public key; receiving, by the user device (101, 200), an encrypted provisioning response message (1210, 1310) from the provisioning server computer (105, 106, 300), the encrypted provisioning response message (1210, 1310) comprising encrypted credential data (1220, 1320); determining, by the user device (101, 200), a response shared secret using a static server public key and a user private key corresponding to the one-time user public key; determining, by the user device (101, 200), a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message (1210, 1310); decrypting, by the user device (101, 200), the encrypted provisioning response message (1210, 1310) using the response session key to determine the encrypted credential data (1220, 1320); determining, by the user device (101, 200), a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data (1220, 1320); encrypting, by the user device (101, 200), the storage protection key with a key encryption key to generate an encrypted storage protection key; storing, by the user device (101, 200), the encrypted storage protection key; and storing, by the user device (101, 200), the encrypted credential data (1220, 1320). determining, by a user device (101, 200), a one-time user public key; sending, by the user device (101, 200) to a provisioning server computer (105, 106, 300), a provisioning request message (1202, 1302) including the one-time user public key; receiving, by the user device (101, 200), an encrypted provisioning response message (1210, 1310) from the provisioning server computer (105, 106, 300), the encrypted provisioning response message (1210, 1310) comprising encrypted credential data (1220, 1320); determining, by the user device (101, 200), a response shared secret using a static server public key and a user private key corresponding to the one-time user public key; determining, by the user device (101, 200), a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message (1210, 1310); decrypting, by the user device (101, 200), the encrypted provisioning response message (1210, 1310) using the response session key to determine the encrypted credential data (1220, 1320); determining, by the user device (101, 200), a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data (1220, 1320); encrypting, by the user device (101, 200), the storage protection key with a key encryption key to generate an encrypted storage protection key; storing, by the user device (101, 200), the encrypted storage protection key; and storing, by the user device (101, 200), the encrypted credential data (1220, 1320).