A method for authenticating a token by a server to prevent cloning and unauthorized use of an integrated circuit of the token, the integrated circuit comprising a Physically Unclonable Function (PUF) and the method providing both privacy and mutual identification between the server and the token, the method being characterized by comprising the steps of: measuring, by the PUF of the integrated circuit of the token, natural variations that occur in path delays of the PUF; digitizing, by the PUF of the integrated circuit of the token, the measured path delays; storing in a server database (Verifier Database) the digitized measured path delays; generating by the token both a token helper data bitstring (Token HelpD) and a token bitstring (Token StrongBS) from the digitized measured path delays; transmitting both the token helper data bitstring (Token HelpD) and the token bitstring (Token StrongBS) to the server; computing by the server helper data (Verifier HelpD) for each token stored in the server database (Verifier Database) and using stored digitized measured path delays, and performing an operation to bitwise AND the server helper data (Verifier HelpD) with the received token helper data bitstring (Token HelpD); constructing by the server a server bitstring (Verifier StrongBS) using the AND'ed server helper data (Verifier HelpD) while simultaneously eliminating strong bits from the token itstring (Token StrongBS) that correspond to the token helper data bitstring (Token HelpD) bits that were changed from '1' to '0' during the AND operation; comparing the server bitstring (Verifier StrongBS) and the token bitstring (Token StrongBS); and authenticating the token when the server bitstring (Verifier StrongBS) and the token bitstring (Token StrongBS) exactly match or most of the bits match. measuring, by the PUF of the integrated circuit of the token, natural variations that occur in path delays of the PUF; digitizing, by the PUF of the integrated circuit of the token, the measured path delays; storing in a server database (Verifier Database) the digitized measured path delays; generating by the token both a token helper data bitstring (Token HelpD) and a token bitstring (Token StrongBS) from the digitized measured path delays; transmitting both the token helper data bitstring (Token HelpD) and the token bitstring (Token StrongBS) to the server; computing by the server helper data (Verifier HelpD) for each token stored in the server database (Verifier Database) and using stored digitized measured path delays, and performing an operation to bitwise AND the server helper data (Verifier HelpD) with the received token helper data bitstring (Token HelpD); constructing by the server a server bitstring (Verifier StrongBS) using the AND'ed server helper data (Verifier HelpD) while simultaneously eliminating strong bits from the token itstring (Token StrongBS) that correspond to the token helper data bitstring (Token HelpD) bits that were changed from '1' to '0' during the AND operation; comparing the server bitstring (Verifier StrongBS) and the token bitstring (Token StrongBS); and authenticating the token when the server bitstring (Verifier StrongBS) and the token bitstring (Token StrongBS) exactly match or most of the bits match. <EOS>