An access device for authenticating a user device comprising: a processor; and a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising: sending an access device public key to the user device , wherein the access device public key is associated with an access device private key; receiving a response message including a blinded user device public key and encrypted user device data from the user device , wherein the user device data comprises a cryptographic nonce and a user device certificate , the user device certificate comprising the user device public key and wherein the blinded user device public key is generated by the user device multiplying the user device public key by the cryptographic nonce, and wherein the encrypted user device data is encrypted by the user device using a session key generated using a shared secret, the shared secret being generated by the user device inputting the access device public key and a blinded user device private key to an elliptic curve Diffie-Hellman function, the blinded user device private key being generated by multiplying a user device private key by the cryptographic nonce, the user device private key being associated with the user device public key, the shared secret being known to the user device; generating the shared secret by inputting the access device private key and the blinded user device public key to the elliptic curve Diffie-Hellman function; generating the session key using the shared secret; decrypting the encrypted user device data using the session key; validating the user device certificate; generating a second blinded user device public key by multiplying the user device public key by the cryptographic nonce; comparing the second blinded user device public key with the received blinded user device public key, wherein the user device is authenticated if the second blinded user device public key matches the received blinded user device public key. a processor; and a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising: sending an access device public key to the user device , wherein the access device public key is associated with an access device private key; receiving a response message including a blinded user device public key and encrypted user device data from the user device , wherein the user device data comprises a cryptographic nonce and a user device certificate , the user device certificate comprising the user device public key and wherein the blinded user device public key is generated by the user device multiplying the user device public key by the cryptographic nonce, and wherein the encrypted user device data is encrypted by the user device using a session key generated using a shared secret, the shared secret being generated by the user device inputting the access device public key and a blinded user device private key to an elliptic curve Diffie-Hellman function, the blinded user device private key being generated by multiplying a user device private key by the cryptographic nonce, the user device private key being associated with the user device public key, the shared secret being known to the user device; generating the shared secret by inputting the access device private key and the blinded user device public key to the elliptic curve Diffie-Hellman function; generating the session key using the shared secret; decrypting the encrypted user device data using the session key; validating the user device certificate; generating a second blinded user device public key by multiplying the user device public key by the cryptographic nonce; comparing the second blinded user device public key with the received blinded user device public key, wherein the user device is authenticated if the second blinded user device public key matches the received blinded user device public key. <EOS>