An authentication method for authenticating a client (12, 12a, 12b) with a service over a network of peers (16a-16e), the method comprising: - storing encrypted enrolled authentication data for the client (12, 12a, 12b) as a reference sample in an authentication of the client (12, 12a, 12b) with the service (14, 14a, 14b), wherein the encrypted enrolled authentication data is enrolled as part of an enrollment process of the client (12, 12a, 12b), in a storage that is accessible by means of an access privilege derived from a consensus of the network of peers (16a-16e); - storing a decryption clue for the encrypted enrolled authentication data in a client data block chain; - receiving, by the network, authentication information from the client (12, 12a, 12b); - generating, by a server (24, 24a, 24b) and/or at least one peer (16a-16e) of the network connected to the client (12, 12a, 12b), a decryption key according to a contract executed by the server (24, 24a, 24b) and/or the at least one peer (16a-16e) of the network, respectively, and involving the decryption clue stored in the client data block chain; - receiving, by the network, the encrypted enrolled authentication data from the storage; - decrypting, by the network, the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data; - comparing, by the network, the decrypted enrolled authentication data with the authentication information received from the client (12, 12a, 12b) for obtaining a match score based on a consensus of the peers (16a-16e) of the network; and - storing the match score and a hash of a client identifier in a service data block chain. - storing encrypted enrolled authentication data for the client (12, 12a, 12b) as a reference sample in an authentication of the client (12, 12a, 12b) with the service (14, 14a, 14b), wherein the encrypted enrolled authentication data is enrolled as part of an enrollment process of the client (12, 12a, 12b), in a storage that is accessible by means of an access privilege derived from a consensus of the network of peers (16a-16e); - storing a decryption clue for the encrypted enrolled authentication data in a client data block chain; - receiving, by the network, authentication information from the client (12, 12a, 12b); - generating, by a server (24, 24a, 24b) and/or at least one peer (16a-16e) of the network connected to the client (12, 12a, 12b), a decryption key according to a contract executed by the server (24, 24a, 24b) and/or the at least one peer (16a-16e) of the network, respectively, and involving the decryption clue stored in the client data block chain; - receiving, by the network, the encrypted enrolled authentication data from the storage; - decrypting, by the network, the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data; - comparing, by the network, the decrypted enrolled authentication data with the authentication information received from the client (12, 12a, 12b) for obtaining a match score based on a consensus of the peers (16a-16e) of the network; and - storing the match score and a hash of a client identifier in a service data block chain.