Abstract: A method and apparatus for establishing security credentials for a user to access and subsequently use in secure on-line transactions begins when a service provider generates a registration secret for a user in response to a registration request. The registration request identifies user information of a particular user. Before a registration request can be provided to the service provider, the user must establish a relationship with the service provider. Having generated the registration secret, the service provider stores a user identifying secret, which includes the initialization data, the user information, the registration secret, and/or a security name in a mapping repository. The service provider provides the registration secret to the user in a trustworthy manner. Sometime thereafter, the user provides an on-line initialization request for the initialization data, where the initialization request is encoded based on at least a part of the user identifying secret.