Computer-implemented method for securely evaluating at least part of a linear branching program, said program having a binary decision tree structure comprising one or more decision nodes and two or more end-label nodes, wherein a decision node is associated with a comparison operation between a user attribute and a threshold value, said method characterized in that it comprises: a processor in a secure server executing computer readable program code for transforming at least part of the comparison operations associated with said one or more decision node into one or more encrypted evaluation sequences on the basis of a first additive homomorphic cryptosystem, wherein an evaluation sequence of a decision node comprises a sequence of numbers in which an outcome of the comparison operation of a decision node is embedded; and, wherein said transforming further comprises - linking an encrypted user attribute [v j] to a node index α j in order to form an indexed encrypted user attribute; - combining the indexed encrypted user attribute [v αj] with its associated encrypted threshold value [t j] and a random blinding value [b j] into an encrypted blinded node value [v αj - t j + b j] on the basis of one or more homomorphic computations; - comparing said blinded node value [v αj - t j + b j] with a blinding value b j in the encrypted domain; wherein said comparing comprises using a DGK comparison protocol for comparing a bitwise encrypted blinded node value [[v αj - t j + b j]] B and a bitwise encrypted blinding value [[b j]] B and for generating an evaluation sequence that is associated with said comparison, wherein - said encrypted blinded node value [v αj - t j + b j] being decrypted into a blinded node value; - said bitwise encrypted blinded node value [[v αj - t j + b j]] B and said bitwise encrypted blinding value [[b j]] B being determined on the basis of said first additive homomorphic cryptosystem; And - a processor in a user device executing computer readable program code for evaluating said one or more evaluation sequences, said evaluating including detecting the presence of a predetermined number, said predetermined number being a zero in a first evaluation sequence of a first node and determining a second decision node for evaluation or an index of an end-label on the basis of the detection of said predetermined number. a processor in a secure server executing computer readable program code for transforming at least part of the comparison operations associated with said one or more decision node into one or more encrypted evaluation sequences on the basis of a first additive homomorphic cryptosystem, wherein an evaluation sequence of a decision node comprises a sequence of numbers in which an outcome of the comparison operation of a decision node is embedded; and, wherein said transforming further comprises - linking an encrypted user attribute [v j] to a node index α j in order to form an indexed encrypted user attribute; - combining the indexed encrypted user attribute [v αj] with its associated encrypted threshold value [t j] and a random blinding value [b j] into an encrypted blinded node value [v αj - t j + b j] on the basis of one or more homomorphic computations; - comparing said blinded node value [v αj - t j + b j] with a blinding value b j in the encrypted domain; - linking an encrypted user attribute [v j] to a node index α j in order to form an indexed encrypted user attribute; - combining the indexed encrypted user attribute [v αj] with its associated encrypted threshold value [t j] and a random blinding value [b j] into an encrypted blinded node value [v αj - t j + b j] on the basis of one or more homomorphic computations; - comparing said blinded node value [v αj - t j + b j] with a blinding value b j in the encrypted domain; wherein said comparing comprises using a DGK comparison protocol for comparing a bitwise encrypted blinded node value [[v αj - t j + b j]] B and a bitwise encrypted blinding value [[b j]] B and for generating an evaluation sequence that is associated with said comparison, wherein - said encrypted blinded node value [v αj - t j + b j] being decrypted into a blinded node value; - said bitwise encrypted blinded node value [[v αj - t j + b j]] B and said bitwise encrypted blinding value [[b j]] B being determined on the basis of said first additive homomorphic cryptosystem; And - a processor in a user device executing computer readable program code for evaluating said one or more evaluation sequences, said evaluating including detecting the presence of a predetermined number, said predetermined number being a zero in a first evaluation sequence of a first node and determining a second decision node for evaluation or an index of an end-label on the basis of the detection of said predetermined number. - said encrypted blinded node value [v αj - t j + b j] being decrypted into a blinded node value; - said bitwise encrypted blinded node value [[v αj - t j + b j]] B and said bitwise encrypted blinding value [[b j]] B being determined on the basis of said first additive homomorphic cryptosystem; - a processor in a user device executing computer readable program code for evaluating said one or more evaluation sequences, said evaluating including detecting the presence of a predetermined number, said predetermined number being a zero in a first evaluation sequence of a first node and determining a second decision node for evaluation or an index of an end-label on the basis of the detection of said predetermined number.