A method for carrying out a cryptographically secured authentication between a client and a relying party by means of an authenticator, having the steps of: - querying the authentication by the client at the relying party; - transmitting a first challenge message, a service identifier (AppID) of a service at which the client queries the authentication and at least one criterion for selecting an accepted authenticator type (AAID) from the relying party to the client; - checking by the client on the basis of the at least one transmitted criterion whether an authenticator of an accepted authenticator type (AAID) is present, wherein in the presence of an authenticator of an accepted authenticator type (AAID) the method is continued and otherwise an error routine is started; - supplying, through the user while employing the client, a password assigned by the user upon a prior registration; - requesting a second challenge message at a token server by the client and subsequent transmitting of the requested second challenge message from the token server to the client; - transmitting the second challenge message from the client to the authenticator; - creating authentication information units in dependence on the second challenge message by the authenticator; - transmitting the authentication information units from the authenticator to the client; - forwarding at least a selection of the transmitted authentication information units to the token server; - verifying the selection of the forwarded authentication information units by the token server; - computing in the token server a private user key, User Private Key, on the basis of data transmitted from the authenticator, the client and/or the relying party to the token server; - computing in the token server a response message while employing the computed user key; - sending the response message from the token server to the client and forwarding at least the response message to the relying party; and - verifying at least the response message by the relying party and positively authenticating upon a positive verification and executing the error routine upon a negative verification. - querying the authentication by the client at the relying party; - transmitting a first challenge message, a service identifier (AppID) of a service at which the client queries the authentication and at least one criterion for selecting an accepted authenticator type (AAID) from the relying party to the client; - checking by the client on the basis of the at least one transmitted criterion whether an authenticator of an accepted authenticator type (AAID) is present, wherein in the presence of an authenticator of an accepted authenticator type (AAID) the method is continued and otherwise an error routine is started; - supplying, through the user while employing the client, a password assigned by the user upon a prior registration; - requesting a second challenge message at a token server by the client and subsequent transmitting of the requested second challenge message from the token server to the client; - transmitting the second challenge message from the client to the authenticator; - creating authentication information units in dependence on the second challenge message by the authenticator; - transmitting the authentication information units from the authenticator to the client; - forwarding at least a selection of the transmitted authentication information units to the token server; - verifying the selection of the forwarded authentication information units by the token server; - computing in the token server a private user key, User Private Key, on the basis of data transmitted from the authenticator, the client and/or the relying party to the token server; - computing in the token server a response message while employing the computed user key; - sending the response message from the token server to the client and forwarding at least the response message to the relying party; and - verifying at least the response message by the relying party and positively authenticating upon a positive verification and executing the error routine upon a negative verification.