# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 2 Related Work
### Technologies
Different schemes have used it to verify a user's identity, but it is not recommended as a standalone authentication approach. The biometric fingerprint system involves two distinct phases, i.e., enrollment and verification [48]. Three specific processes are performed in the enrollment phase, i.e., fingerprint acquisition, fingerprint feature extraction, and template storage in the database. While in the verification phase, three operations are performed, i.e., fingerprint acquisition, fingerprint feature extraction, matching the extracted fingerprint with the templates previously created and stored in a database [48]. Depending on whether it matches, the user will be authenticated or rejected, as shown in Figure 1 below. Fingerprint technology is widely used because of its convenience, higher security, better efficiency, stability, higher system reliability, distinctiveness, greater robustness, better anti-counterfeiting performance, ease of use, the small size of fingerprint templates, and its small amount of power consumption [50; 51; 52]. * Secure Hashing Algorithm-256 (SHA-256)  
SHA-2 is defined as a set of cryptographic hash functions designed by the United States National Security Agency (NSA) in association with the National Institute of Science and Technology (NIST), which was first published in 2001 as an enhancement to the SHA-1 algorithm [53]. [PERSON] et al. [54] added that SHA-2 is a one-way and collision-resistant cryptographic hash function used in cryptographic primitives to provide security to applications and protocols because they have variable digest lengths. SHA-2 follows the Merkle Darmstadt structure model and has six hash functions, such as SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256, and the bit size used for encrypting data differs though. The same algorithm is applied to different word lengths, with distinct constant parameters and values, and employs different initialization values [55; 56; 57; 53; 58]. The output length also differentiates them. The SHA-256 algorithm has increasingly become a reliable algorithm in SHA-2 when considering factors such as security, efficiency, and implementation. Therefore, it is broadly used in information encryption, digital signature, message authentication, and blockchain [53]. SHA-256 produces a 256-bit hash value from messages of any length up to \(2^{64}\) bits. The message to be hashed is processed in fixed-length 512-bit blocks known as padded data blocks (PDBs), and the result of the processing of each block is fed as input to the processing of the next block [59]. The irreversible mathematical properties of hashing make it a unique mechanism to conceal the information. The hash functions are deterministic, making them vital for authentication since it guarantees that the message will produce the same hash. With the help of the SHA-256, integrity, confidentiality, authentication, and security are achieved. It is also one-way and fast; a message of any size can be compressed to a fixed-length hash; and it is resistant to collisions, brute-force attacks, dictionary attacks, and MITM attacks [54; 55; 58; 60]. Figure 2 illustrates how messages are hashed using the SHA-256 algorithm to generate a unique fixed-length hash value. Figure 1: The fingerprint enrollment and verification phases [49]. * Fast IDentity Online (FIDO)  
FIDO is a piece of authentication technology that improves original hardware-based solutions by using the mathematics of public-key cryptography. It supports multi-factor authentication and public key cryptography, where universal second-factor authentication (U2F), the universal authentication framework (UAF), and the client-to-authenticator protocol (CTAP) protocols are developed [61; 62]. FIDO has two main phases, i.e., registration and authentication. The user is urged to pick an available FIDO authenticator (e.g., smartphone) that matches the online service acceptance policy during the registration phase. The user unlocks the smartphone by scanning the fingerprint using a fingerprint reader of the smartphone.