According to the invention, each program offering sold by a software vendor is encrypted with a unique file key and then written on the diskette. A user who purchases a diskette containing an encrypted program must first obtain a authorization number and password from the software vendor. This password will allow the encrypted program to be recovered at a prescribed, designated computer having a properly implemented and initialized encryption feature which may be stored in Read Only Memory (ROM), for example. As part of an initialization process, when the program is first loaded, it polls the user to input the password. The password is written by the program in the header record of the file, and once written in the header record, the program will not prompt the user to input his or her password on subsequent uses of the program. When the diskette is loaded at the proper computer, the encrypted program or a controlling portion of it is automatically decrypted and written into a protected memory from which it can only be executed and not accessed for non-execution purposes. In an alternative embodiment, the user is not confined to a prescribed, designated computer but may use the program on other, different computers with a smart card. A smart card as defined here is one having a crypto capability, typically implemented by incorporating a micro-circuit on the card. The smart card is issued to the user when the user purchases a computer. The smart card is preinitialized by the computer manufacturer with a secret parameter unique to that card. The procedure is similar except that in this case, the password used in conjunction with the smart card allows the user to decrypt and execute the program on any computer having a properly implemented and initialized encryption feature. The smart card embodiment can be further modified to allow portability with a combination of both a Public Key (PK) algorithm and the Data Encryption Standard (DES) algorithm. In this case, the designated public registry (key distribution center) additionally personalizes the card with the public key of the computer manufacturer as well as a unique secret card key (the DES key). When a customer buys software, s/he automatically gets a personalized intelligent secure card (smart card). Each different program recorded on the diskette is encrypted under a different file key designated by the supplier of the software. The customer then obtains an authorization number and password from the software vendor, as before. The password is written in the header of the file on the diskette. The computer is also personalized with a unique key pair, a public computer key and a secret computer key. However, the public computer key is first decrypted under the secret key of the computer manufacturer and stored in the computer in that form. When the program diskette is used, there is a handshake protocol between the smart card and the computer which, in effect, recovers the file key and enciphers it under the public key of the computer. This protocol is such that the handshake will work only at a suitable computer with a public key algorithm and a properly installed key pair; i.e., a secret computer key and a public computer key decrypted under the secret key of the designated public registry. The advantage to this approach is that the file key can be encrypted using a public key, and it is not necessary for a universal secret DES key to be stored on each smart card. The protocol for password generation and distribution is unaffected by the modification to the internal protocol; i.e., it is the same for the DES only smart card as for the DES/PK smart card.