Abstract: A user sets n=0, his mail account A and password S, then computes V.sub.0 =E(A,S), W.sub.0 =E(A,V.sub.0), V.sub.1 =E(A,A.sym.1), W.sub.1 =E(A,V.sub.1) and M.sub.0 =E(W.sub.1, V.sub.0), and initially registers W.sub.0, W.sub.1, M.sub.0 and A by e-mail in a mail server. At a visiting site the user sends a service request and A to the mail server form an arbitrary terminal connected to the Internet, and the mail server reads out the authentication session number n corresponding to the identifier A and sends it back to the user. The user computes V.sub.n-1 =E(A,S.sym.(n-1)), V.sub.n+1 =E(A,S.sym.(n+1)), W.sub.n+1 =E(A,V.sub.n+1). V.sub.n =E(A,S.sym.n) and M.sub.n =E(W.sub.n+1, V.sub.n) and sends V.sub.n-1, W.sub.n+1 and M.sub.n to the mail server. The mail server computes E(A,V.sub.n-1) and E(W.sub.n, V.sub.n-1) and if they agree with preregistered W.sub.n-1 and M.sub.n-1, respectively, the mail server accepts the user as valid and sends a mail message of the user.