One feature provides a method for granting authenticated access to off-line, limited-resource mobile devices. A public-private key pair is generated by a service provider and the public key is used to digitally sign a username and (possibly) access privileges to obtain a password for technician. The public key is securely distributed to mobile devices. When off-line, a mobile device may authenticate access to restricted functions of the mobile device by a technician. The technician provides its username, access privileges and password to the mobile device. The mobile device then uses the public key, username and access privileges to verify the password. To invalidate an old username and password, the service provider replaces the public-private key pair with a new public-private key pair.