Renewable and private biometrics

A method of authenticating an individual at an authenticating device, comprising:

• storing, at the authenticating device, at least one data structure comprising a value based on an identifier (RAN) pertaining to the individual and an encrypted identifier (PK[RAN]), wherein an encryption key (PK) is based on a secret of the individual;
• receiving, at the authenticating device, a request from the individual to attain the encrypted identifier;
• sending, from the authenticating device to the individual, the requested encrypted identifier;
• receiving, at the authenticating device from the individual proof that the individual knows the identifier, which has been obtained at the individual by decrypting the encrypted identifier using a corresponding secret decryption key (SK);
• and
• verifying the proof, wherein the proof is verified by employing a zero-knowledge protocol between the individual and the authentication device.