A method of accessing a recording of a digital service on a settop, the settop being in communication with a digital subscriber system having a headend, the method comprising the steps of: retrieving a given decryptor and a set of packets from a storage device, the set of packets carrying a portion of a digital service, wherein the storage device has multiple sets of packets and multiple decryptors stored therein, each decryptor associated with a particular set of packets, and the multiple sets of packets make up the digital service, wherein each decryptor includes at least temporal information defining a time-span during which the settop is entitled to access the digital service from the storage device; determining whether the settop is entitled to access the set of packets by processing at least a portion of the given decryptor including the temporal information, wherein the step of determining whether the settop is entitled further includes the steps of: receiving from the headend a time-message having a time indicator, a shared-secret identifier for identifying a shared-secret and a first authentication token included therein; and authenticating the time-message using at least the shared-secret and at least a portion of the time-message; retrieving from memory the shared secret using the shared secret identifier; determining whether the time-message is authentic using at least a portion of the time-message and at least a portion of the shared secret; and responsive to the time-message not being authentic, determining that the settop is not entitled to access the given set of packets, or, responsive to determining the time-message is authentic, using at least the time indicator to determine whether the settop is entitled to access the given set of packets; responsive to determining the settop is entitled to access the set of packets, further including the steps of: processing at least a portion of the given decryptor with a first key to generate a decryption-key therefrom; decrypting content included in the set of packets with the decryption-key; and providing the user with access to the decrypted content. retrieving a given decryptor and a set of packets from a storage device, the set of packets carrying a portion of a digital service, wherein the storage device has multiple sets of packets and multiple decryptors stored therein, each decryptor associated with a particular set of packets, and the multiple sets of packets make up the digital service, wherein each decryptor includes at least temporal information defining a time-span during which the settop is entitled to access the digital service from the storage device; determining whether the settop is entitled to access the set of packets by processing at least a portion of the given decryptor including the temporal information, wherein the step of determining whether the settop is entitled further includes the steps of: receiving from the headend a time-message having a time indicator, a shared-secret identifier for identifying a shared-secret and a first authentication token included therein; and authenticating the time-message using at least the shared-secret and at least a portion of the time-message; retrieving from memory the shared secret using the shared secret identifier; determining whether the time-message is authentic using at least a portion of the time-message and at least a portion of the shared secret; and responsive to the time-message not being authentic, determining that the settop is not entitled to access the given set of packets, or, responsive to determining the time-message is authentic, using at least the time indicator to determine whether the settop is entitled to access the given set of packets; receiving from the headend a time-message having a time indicator, a shared-secret identifier for identifying a shared-secret and a first authentication token included therein; and authenticating the time-message using at least the shared-secret and at least a portion of the time-message; retrieving from memory the shared secret using the shared secret identifier; determining whether the time-message is authentic using at least a portion of the time-message and at least a portion of the shared secret; and responsive to the time-message not being authentic, determining that the settop is not entitled to access the given set of packets, or, responsive to determining the time-message is authentic, using at least the time indicator to determine whether the settop is entitled to access the given set of packets; responsive to determining the settop is entitled to access the set of packets, further including the steps of: processing at least a portion of the given decryptor with a first key to generate a decryption-key therefrom; decrypting content included in the set of packets with the decryption-key; and providing the user with access to the decrypted content. processing at least a portion of the given decryptor with a first key to generate a decryption-key therefrom; decrypting content included in the set of packets with the decryption-key; and providing the user with access to the decrypted content.