A method for authenticating a prover to a verifier, the prover being provided with a proving key paired to a verification key registered with the verifier, wherein The proving key is obtained by transforming a protected key and a secret (S) using a transformation (E), characterized in that the prover stores the protected key and does not store the corresponding proving key nor the corresponding verification key in clear, with the exception of storage in transient memory, wherein the transformation (E) is arranged such that - when the correct secret (S) is provided, it generates the proving key from the protected key and - when an incorrect secret (S') is provided, it generates a different proving key from the protected key; wherein the different proving key has a format of a potentially correct proving key; and where the transformation (E) is at least one of: a) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as key, b) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as data, c) a symmetric encryption algorithm using the secret as key and the protected key as data, or d) a symmetric encryption algorithm using the protected key as key and the secret as data; and wherein the transformation (E) is such that the inverse transformation (E') constructs the protected key directly from the proving key and the secret, wherein the inverse transformation is any of the transformations a) - d) wherein the protected key is replaced by the proving key. characterized in that the prover stores the protected key and does not store the corresponding proving key nor the corresponding verification key in clear, with the exception of storage in transient memory, wherein the transformation (E) is arranged such that - when the correct secret (S) is provided, it generates the proving key from the protected key and - when an incorrect secret (S') is provided, it generates a different proving key from the protected key; - when the correct secret (S) is provided, it generates the proving key from the protected key and - when an incorrect secret (S') is provided, it generates a different proving key from the protected key; wherein the different proving key has a format of a potentially correct proving key; and where the transformation (E) is at least one of: a) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as key, b) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as data, c) a symmetric encryption algorithm using the secret as key and the protected key as data, or d) a symmetric encryption algorithm using the protected key as key and the secret as data; and a) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as key, b) a symmetric encryption algorithm using any function of one or more of the secret, the protected key and additional data as data, c) a symmetric encryption algorithm using the secret as key and the protected key as data, or d) a symmetric encryption algorithm using the protected key as key and the secret as data; and wherein the transformation (E) is such that the inverse transformation (E') constructs the protected key directly from the proving key and the secret, wherein the inverse transformation is any of the transformations a) - d) wherein the protected key is replaced by the proving key. <EOS>