A computer-implemented method for determining whether to grant a requested access to one or more computing resources, comprising: under the control of one or more computer systems configured with executable instructions, receiving, from an authenticating party, electronic information encoding a message, a signature for the message, and a set of one or more restrictions on keys derived from a secret credential shared with the authenticating party, the signature being determinable by applying a hash-based message authentication code function to the message, the secret credential, and the set of one or more restrictions, but also being undeterminable having only the hash-based message authentication code function but without having the set of one or more restrictions; obtaining a key generated by at least applying the hash-based message authentication code function to the secret credential and at least a subset of the set of one or more restrictions; calculating, by the one or more computer systems, a reference signature by at least applying the hash-based message authentication code function to at least the obtained key and the message; and providing access to the one or more computing resources when the calculated reference signature is equivalent to the received signature. under the control of one or more computer systems configured with executable instructions, receiving, from an authenticating party, electronic information encoding a message, a signature for the message, and a set of one or more restrictions on keys derived from a secret credential shared with the authenticating party, the signature being determinable by applying a hash-based message authentication code function to the message, the secret credential, and the set of one or more restrictions, but also being undeterminable having only the hash-based message authentication code function but without having the set of one or more restrictions; obtaining a key generated by at least applying the hash-based message authentication code function to the secret credential and at least a subset of the set of one or more restrictions; calculating, by the one or more computer systems, a reference signature by at least applying the hash-based message authentication code function to at least the obtained key and the message; and providing access to the one or more computing resources when the calculated reference signature is equivalent to the received signature. receiving, from an authenticating party, electronic information encoding a message, a signature for the message, and a set of one or more restrictions on keys derived from a secret credential shared with the authenticating party, the signature being determinable by applying a hash-based message authentication code function to the message, the secret credential, and the set of one or more restrictions, but also being undeterminable having only the hash-based message authentication code function but without having the set of one or more restrictions; obtaining a key generated by at least applying the hash-based message authentication code function to the secret credential and at least a subset of the set of one or more restrictions; calculating, by the one or more computer systems, a reference signature by at least applying the hash-based message authentication code function to at least the obtained key and the message; and providing access to the one or more computing resources when the calculated reference signature is equivalent to the received signature.