A method for secure operation of a software application, the method comprising: generating, on a trusted platform, a secret value from a source of entropy; binding, on the trusted platform, via a provisioning mechanism, the secret value to one or more portions of the software application so as to form a protected instance of the software application; and communicating, from the trusted platform, the secret value to a trusted signing authority, wherein the secret value is communicated to the trusted signing authority by way of a trusted communication session using a fixed-key whitebox implementation of a symmetric-key cryptographic algorithm; wherein the protected instance of the software application is arranged to use a property dependent transform equivalency context comprising one or more replacement operations inserted into the software application in place of original operations in the application, wherein the replacement operations behave just like the original operations unless a tampered condition exists, in which the equivalency of the following does not hold: (a) a message signature generated by the trusted signing authority signing, using the secret value, a challenge message directed to both the trusted signing authority and to the protected instance of the software application, wherein the message signature is generated using a fixed-key whitebox implementation of a public-key cryptographic algorithm, and (b) the challenge message. generating, on a trusted platform, a secret value from a source of entropy; binding, on the trusted platform, via a provisioning mechanism, the secret value to one or more portions of the software application so as to form a protected instance of the software application; and communicating, from the trusted platform, the secret value to a trusted signing authority, wherein the secret value is communicated to the trusted signing authority by way of a trusted communication session using a fixed-key whitebox implementation of a symmetric-key cryptographic algorithm; wherein the protected instance of the software application is arranged to use a property dependent transform equivalency context comprising one or more replacement operations inserted into the software application in place of original operations in the application, wherein the replacement operations behave just like the original operations unless a tampered condition exists, in which the equivalency of the following does not hold: (a) a message signature generated by the trusted signing authority signing, using the secret value, a challenge message directed to both the trusted signing authority and to the protected instance of the software application, wherein the message signature is generated using a fixed-key whitebox implementation of a public-key cryptographic algorithm, and (b) the challenge message. (a) a message signature generated by the trusted signing authority signing, using the secret value, a challenge message directed to both the trusted signing authority and to the protected instance of the software application, wherein the message signature is generated using a fixed-key whitebox implementation of a public-key cryptographic algorithm, and (b) the challenge message.