A method for authenticating a user of at least a first user electronic device and a second user electronic device using a network node, the method comprising: receiving, at the network node, from the first user electronic device, at a first moment in time, communication protocol information comprising: a restricted enrollment input, wherein the restricted enrollment input has been produced by restricting an unrestricted enrollment input with an enrollment biometric template indicative of user enrollment biometrics of the user captured at an enrollment moment in time that is prior to the first moment in time; an unrestricted authentication input that has been encrypted; and a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using two inputs; receiving, at the network node, from the second user electronic device, at a second moment in time after the first moment in time, a restricted authentication input, wherein the restricted authentication input has been produced by restricting the unrestricted authentication input with an authentication biometric sample indicative of user authentication biometrics of the user captured at an authentication moment in time that is after the first moment in time but that is prior to the second moment in time; after the receiving the restricted authentication input, evaluating, at the network node, the transformed matching function using the restricted enrollment input and the restricted authentication input; and when the evaluating is successful, using, at the network node, the success key output by the transformed matching function to enable a secure operation, wherein: the enrollment biometric template is not accessible to the network node; the authentication biometric sample is not accessible to the network node; the user enrollment biometrics are not accessible to the network node; and the user authentication biometrics are not accessible to the network node. receiving, at the network node, from the first user electronic device, at a first moment in time, communication protocol information comprising: a restricted enrollment input, wherein the restricted enrollment input has been produced by restricting an unrestricted enrollment input with an enrollment biometric template indicative of user enrollment biometrics of the user captured at an enrollment moment in time that is prior to the first moment in time; an unrestricted authentication input that has been encrypted; and a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using two inputs; a restricted enrollment input, wherein the restricted enrollment input has been produced by restricting an unrestricted enrollment input with an enrollment biometric template indicative of user enrollment biometrics of the user captured at an enrollment moment in time that is prior to the first moment in time; an unrestricted authentication input that has been encrypted; and a transformed matching function that is operative to output a success key in response to successfully evaluating the transformed matching function using two inputs; receiving, at the network node, from the second user electronic device, at a second moment in time after the first moment in time, a restricted authentication input, wherein the restricted authentication input has been produced by restricting the unrestricted authentication input with an authentication biometric sample indicative of user authentication biometrics of the user captured at an authentication moment in time that is after the first moment in time but that is prior to the second moment in time; after the receiving the restricted authentication input, evaluating, at the network node, the transformed matching function using the restricted enrollment input and the restricted authentication input; and when the evaluating is successful, using, at the network node, the success key output by the transformed matching function to enable a secure operation, wherein: the enrollment biometric template is not accessible to the network node; the authentication biometric sample is not accessible to the network node; the user enrollment biometrics are not accessible to the network node; and the user authentication biometrics are not accessible to the network node. the enrollment biometric template is not accessible to the network node; the authentication biometric sample is not accessible to the network node; the user enrollment biometrics are not accessible to the network node; and the user authentication biometrics are not accessible to the network node.