A system 100 for securely storing digital data includes a data storage 110 and a physical uncloneable function 120 (PUF), including an input (122) for receiving a challenge and an output (124) for producing a response to the challenge. Means 130 determine an identifier associated with the data storage. Means 140 supply a representation of the identifier to the PUF as a challenge and retrieve a corresponding response from the PUF. A cryptographic unit 150 performs a cryptographic operation for securing or verifying a digital content item stored in the data storage, where the cryptographic operation is performed under control of a cryptographic key derived from the received response.