# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 6 Performance Analysis
### Computational Cost  
[PERSON] et al. [94] defined computational cost as \"the time taken by the network entities to execute the different cryptographic techniques\" (p. 12). The total computational cost of each phase in the proposed secure and efficient multi-factor authentication algorithm is analyzed based on message exchange sequences described in Figure 5 and compared with the computational cost of the scheme proposed in [93], as shown in Table 4. It is assumed that the notation \(T_{h}\) is the time for one-way hashing operation, \(T_{Re}\) and \(T_{Rde}\) are the time \begin{table}
\begin{tabular}{c l c} \hline \hline
**Symbols** & **Meaning** & **Length (Bytes)** \\ \hline \(U_{i}\) & User & 8 \\ \(FN_{i}\) & User’s first name & 16 \\ \(LN_{i}\) & User’s last name & 16 \\ \(SIM_{stn}\) & SIM serial number & 16 \\ \(SD_{i}\) & Subscriber ID & 8 \\ \(PN_{i}\) & User’s phone number & 16 \\ \(PIN_{i}\) & User’s PIN & 8 \\ \(PIN_{j}\) & Re-entered PIN & 8 \\ \(OTP_{i}\) & User’s OTP & 8 \\ \(BF_{i}\) & User’s biometric fingerprint & 16 \\ \(B_{t}\) & Biometric template & 16 \\ \(P_{i}\) & User’s public key & 32 \\ \(F_{i}\) & User’s private key & 32 \\ \(SP_{i}\) & User’s smartphone & 8 \\ \(ID_{i}\) & User’s ID & 8 \\ \(ID_{sp}\) & Smartphone ID & 8 \\ \(h(.)\) & One-way hash & 32 \\  & function—SHA-256 & \\ \(E_{u}(.)/D_{u}(.)\) & Femet Encryption/Decryption & 16 \\  & with key \(u\) & \\ \(E(.)/D(.)\) & Public key & 256 \\  & Encryption/Decryption—RSA & 256 \\ \(DB_{m}\) & Main database & 256 \\ \(DB_{f4}\) & FIDO database & 256 \\ \(Bal_{i}\) & User’s electronic balance & 16 \\ \(A_{a}\) & Agent & 8 \\ \(QRcode_{a}\) & Agent QR code & 16 \\ \(Amt_{i}\) & Amount & 16 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Description and length in bytes of the different symbols used in the proposed algorithm. \begin{table}
\begin{tabular}{c l l} \hline \hline
**Phase** & **Message Content** & **Message Size (Bytes)** \\ \hline \multirow{4}{*}{Registration} & \{\(FN_{i}\), \(IN_{i}\), \(SIM_{stn}\), \(SD_{i}\), \(PN_{i}\)\} & \(16+16+16+8+16=72\) bytes \\  & \(\{PN_{i}\), \(PIN_{j}\)} & \(8+8=16\) bytes \\  & \(\{h(PIN_{k})\), \(P_{i}\), \(ID_{i}\), \(ID_{sp}\}\) & \(40+32+8\) \(8=88\) bytes \\  & \(\{FN_{i}\), \(IN_{i}\), \(SIM_{m}\), \(SD_{i}\), \(PN_{i}\), \(h(PIN_{k})\), \(P_{i}\), \(ID_{sp}\)} & \(16+16+8+16+40+32+8\) \\  & \(\{ID_{i}\), \(ID_{sp}\), \(DTP_{i}\}\) & \(8+8=16\) bytes \\ \multirow{4}{*}{Authentication} & \{\(ID_{i}\), \(ID_{sp}\), \(DTP_{i}\}\) & \(8+8=24\) bytes \\  & \(\{B_{t}(F_{i}\), \(B_{t})\}\) & \(16+32+16=64\) bytes \\  & \(\{ID_{i}\), \(ID_{sp}\), \(P_{i}\}\) & \(8+8+32=48\) bytes \\ \hline \multirow{4}{*}{Transaction} & \{\(ID_{i}\), \(Bal_{i}\)\} & \(8+16=24\) bytes \\  & \(\{ID_{i}\), \(Amt_{i}\}\) & \(8+16=24\) bytes \\ \multirow{4}{*}{Transaction} & \{\(BF_{i}(F_{i}\), \(B_{t})\}\) & \(16+32+16=64\) bytes \\  & \(\{ID_{i}\), \(ID_{sp}\), \(P_{i}\}\) & \(8+8+32=48\) bytes \\ \multirow{4}{*}{Transaction} & \{\(ID_{i}\), \(ID_{sp}\), \(QRcode_{i}\)} & \(8+16=24\) bytes \\  & \(\{ID_{i}\), \(ID_{sp}\), \(QRcode_{i}\)} & \(8+8+16=48\) bytes \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Calculation of message sizes for messages exchanged during user enrolment, authentication, and transaction. durations to encrypt and decrypt messages using RSA, and \(T_{F\epsilon}\) and \(T_{F\epsilon k}\) are the time durations to encrypt and decrypt the message using Fernet. \(T_{h}\) and \(T_{ECC}\) denote the times for a hash operation and the encryption/decryption operations in ECC-160, respectively, used in the algorithm proposed in [93]. It should be noted that the schemes [15; 16; 19; 20] never used any cryptographic techniques to secure the data. In addition, the algorithm in [93] is mainly selected for comparison with the proposed algorithm because it uses SHA-1 as a one-way hash function and ECC for encrypting/decrypting the data to achieve data security.