# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 5 Security Analysis
* Resistance to replay attacks: In the current 2 FA scheme for mobile money, the adversaries delay or replay the authentication process several times to allow mobile money agents and users to enter their mobile money PIN several times until the attacker gets hold of the PIN. In the proposed algorithm, the researchers implemented a multi-factor authentication scheme where users must enter multiple identifiers, such as PIN, OTP, and biometric fingerprint, to verify themselves, which helps prevent replay attacks. In addition, the PIN and OTP are secured using SHA-256 and biometric fingerprints by FIDO, where the public/private key pair and biometric templates are encrypted using RSA, and the mobile money agent code stored in the QR code is secured by Fernet encryption. Protecting the authentication identifiers makes it difficult for the adversaries to perform replay attacks [62; 66; 68; 69; 70; 71; 93]. * Resistance to insider attacks: Insider attacks are perpetrated by the employees and former employees of the mobile money service providers since they have inside information about the mobile money systems and access to mobile money agents and users' PIN and transaction data. They take advantage of being within the organization to perform fraudulent transactions at the expense of users. The proposed algorithm mitigates this attack by using Fernet encryption to secure records in the database [66; 73]. * Resistance to impersonation attacks: This attack is easy because attackers are familiar with the current 2 FA scheme for mobile money. In the proposed algorithm, impersonation attacks are mitigated by (1) registering and identifying users with their phone number since no two persons will have the same phone number and (2) implementing multi-factor authentication involving PIN, OTP, and biometric fingerprints. Additionally, we secure the authentication identifiers, such as PIN and OTP, using SHA-256, biometric fingerprint by FIDO, a QR code, and records in the database using Fernet encryption [23; 66]. * Resistance to identity fraud: The current 2 FA scheme for mobile money is prone to identity fraud. However, this threat model is mitigated in the proposed algorithm by implementing a solid and robust multi-factor authentication scheme using the PIN, OTP, biometric fingerprint, and secure QR [13; 19; 21; 46]. Moreover, protecting the authentication identifiers, such as PIN and OTP, using SHA-256, biometric fingerprint by FIDO, a QR code, and records in the database using Fernet encryption helps to mitigate identity fraud [23; 66]. * Resistance to man-in-the-middle (MITM) attack: With the current 2 FA scheme for mobile money, attackers can intercept communication between mobile money agents, users, systems, and banks. Attackers secretly steal the authentication credentials, such as a PIN or personal transaction information, spy on the user, or interrupt communications. This attack is prevented in the proposed algorithm by securing the PIN and OTP using SHA-256, biometric fingerprint by FIDO, QR code, and records in the database by Fernet encryption [20; 68; 69; 70; 71; 72; 73; 74; 75; 76; 77; 78; 79; 80; 81; 82; 83; 84; 85; 86; 87; 88; 89; 93]. Likewise, the authentication identifiers, such as PIN and OTP, and public keys are hashed and encrypted before transmitting them online.