# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 2 Related Work
### Technologies
A new public/private key pair unique for the smartphone, online service, and user's account is created. The public key is encrypted and sent to the online service, associated with the user's account, and saved in a Keystore. The private key and biometric templates are encrypted and stored in the user's smartphone in a cryptographic Keystore. The online service challenges users to log in with a previously registered smartphone that matches the service's acceptance policy during the authentication phase. The user unlocks the smartphone using the biometric fingerprint. The smartphone uses the user's account identifier to select the correct key and sign the service's challenge. The user's smartphone sends the signed challenge to the service, verifying it with the stored public key, and the user is logged in. FIDO architecture has been widely used in easy payment, money transfer, ATM withdrawal and savings, single sign-on, healthcare and insurance, enterprise organizations, government, etc. The FIDO service uses RSA, a standard public-key cryptography technique. [PERSON], [PERSON], and [PERSON] invented RSA encryption in 1977. It is a public-key cryptosystem widely used to maintain a high level of security [63; 64]. Key generation, encryption, and decryption are the three (3) steps involved in RSA [65]. RSA needs a pair of public and private keys, where a message is encrypted using the recipient's public key and decrypted using the recipient's private key [65]. Two large secret prime numbers together with an auxiliary value are used to create a public key. It uses an adjustable encryption block size and key size [65]. Figure 3 shows message encryption using the public key and decryption using the private key in RSA. Figure 3: Illustrates message encryption and decryption in RSA. Figure 2: Illustrates how the message is hashed using the SHA-256 algorithm. RSA is used as the encryption algorithm because it is trusted as the most robust asymmetric encryption system that provides a high level of security, preserves data privacy, non-repudiation, data confidentiality, and data reliability. It also has quick encryption and authentication processes [63; 64; 65; 66; 67]. FIDO authentication helps establish a simple, robust, and secure authentication channel by creating a public-private cryptographic key pair, allowing a private key unique to each user to be stored on the smartphone. It offers convenience, scalability, universality, persistence and uniqueness, and it improves user experience and performance. FIDO also provides a uniform user login experience; mitigates phishing attacks, sniffing attacks, replay attacks, and MITM attacks; and creates a secure communication channel between the application server and the users using public-key cryptography [62; 68; 69; 70; 71]. * Fernet Encryption  
Fernet encryption is a symmetric encryption method that ensures that the encrypted message cannot be read or updated without the key. Fernet encryption uses 128-bit advanced encryption standard (AES) symmetric encryption in cipher block chaining (CBC) mode with public-key cryptography standards 7 (PKCS7) padding and a hash-based message authentication code (HMAC) using SHA-256 for authentication [72]. It provides a secure means of generating keys, selects a secure encryption algorithm, randomly allocates a secure \"salt\" value to make the encryption safer, timestamps the ciphertext, and signs the message to detect any attempts to change it. Python was chosen to implement the Fernet encryption because it supports a cryptography package that helps encrypt and decrypt data in the database. It provides libraries that facilitate the generation of keys, and HMAC supports data integrity. The Fernet module of the cryptography package has inbuilt functions for key generation, encryption, and decryption using the encrypt and decrypt methods, respectively [72]. The Fernet encryption method has been chosen because of the multiple security mechanisms provided by its utilization [73].