A method comprising: detecting N authentication devices (110-112) on a client , wherein N > 1; generating N cryptographic keys, one for each of the N authentication devices (110-112); transmitting a single command from a server to the client to register each of the N cryptographic keys into each of the N authentication devices (110-112) and a first random challenge from the server to the client ; determining one of a plurality of privacy classes, wherein the privacy class is defined based on a probability that a client information uniquely identifies a user or the client; executing the command on the client and responsively registering each of the N cryptographic keys into each of the respective N authentication devices (110-112) on the client ; automatically detecting, at the client , that the first random challenge is no longer valid based on a timeout period associated with the first random challenge; responsively transmitting a request for a new random challenge from the client to the server , wherein transmitting is performed without user intervention; generating a new random challenge at the server and transmitting the new random challenge to the client ; transmitting the new random challenge back to the server with a single notification that all of the N authentication devices (110-112) are registered, wherein the server verifies that the new random challenge received is the same as the new random challenge transmitted; and subsequently using at least one of the authentication devices (110-112) and its associated cryptographic key for authenticating a user of the client with the server over a network. detecting N authentication devices (110-112) on a client , wherein N > 1; generating N cryptographic keys, one for each of the N authentication devices (110-112); transmitting a single command from a server to the client to register each of the N cryptographic keys into each of the N authentication devices (110-112) and a first random challenge from the server to the client ; determining one of a plurality of privacy classes, wherein the privacy class is defined based on a probability that a client information uniquely identifies a user or the client; executing the command on the client and responsively registering each of the N cryptographic keys into each of the respective N authentication devices (110-112) on the client ; automatically detecting, at the client , that the first random challenge is no longer valid based on a timeout period associated with the first random challenge; responsively transmitting a request for a new random challenge from the client to the server , wherein transmitting is performed without user intervention; generating a new random challenge at the server and transmitting the new random challenge to the client ; transmitting the new random challenge back to the server with a single notification that all of the N authentication devices (110-112) are registered, wherein the server verifies that the new random challenge received is the same as the new random challenge transmitted; and subsequently using at least one of the authentication devices (110-112) and its associated cryptographic key for authenticating a user of the client with the server over a network. <EOS>