# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 5 Security Analysis  
The developed native G-MoMo applications were tested using a black-box testing approach. Both functional and non-functional testing was carried out to ensure that the applications met all functional and quality requirements to minimize the risk associated with the development process of the applications. After successfully testing the prototypes  
Figure 11: Records in the transaction table are encrypted using the Fermet encryption algorithm. Figure 10: (**a–f**) Shows the customer money withdrawal process. of native G-MoMo applications, the security analysis proves that our proposed algorithm is safe and secure against well-known security attacks, as discussed below. Provides secure and efficient authentication: The proposed multi-factor authentication algorithm uses a PIN, OTP, and biometric fingerprint. The security of the PIN and OTP are ensured by SHA-256 and the biometric fingerprint by FIDO, which provides secure and robust authentication [14; 17; 46; 62; 63; 65; 68; 69; 70; 71]. Besides, using a mobile money agent's secure QR code in authorizing money withdrawal guarantees authenticity [81; 83]. Provides data confidentiality: The proposed algorithm offers confidentiality by hashing PIN and OTP using SHA-256, securing the biometric fingerprint by FIDO that uses the RSA encryption algorithm, and Fernet encryption to secure the mobile money agent code and the records in the databases. At the same time, FIDO helps secure communication channels between the application server and the mobile money IT support staff, agent, and user using RSA. It helps to secure authentication credentials from being intercepted by attackers [21; 46; 63; 65; 66; 93]. Furthermore, using Fernet encryption to secure QR codes in G-MoMo applications ensures data confidentiality [46; 78]. Provides data integrity: The G-MoMo applications database records are protected using Fernet encryption. Likewise, the authentication credentials, such as PIN and OTP, are secured using SHA-256, and a biometric fingerprint using FIDO, which makes it difficult for the adversaries to modify or alter and insert new data and read their content both in storage and in transit, hence maintaining the integrity of the data [21; 46; 65]. Moreover, implementing secure QR codes in G-MoMo applications where the mobile money agent's serial number is encrypted using Fernet encryption to generate a mobile money agent code, which is then encoded in a QR code for the user to scan during money withdrawal, helps protect data integrity [46; 78]. Ensures non-repudiation: During mobile money registration, the IT support staff, agents, and users avail their biodata, phone number, SIM serial number, PIN, and biometric fingerprint. The phone numbers uniquely identify the subscriber. When OTP is sent to the user's phone number during authentication, he should not deny receiving the sent OTP because a copy of the sent OTP is saved in the user's table, linked to the phone number. Likewise, a phone number ensures that no mobile money user can deny performing transaction(s) since every transaction is traced [21; 65; 66; 93]. Still, using a secure QR code to store the mobile money agent code that the mobile money customer scans during mobile money withdrawal helps to ensure non-repudiation by the mobile money agent [46]. Ensures anonymity: Multi-factor authentication ensures user anonymity by entering a unique PIN and biometric fingerprints that uniquely identify them. There is no physical contact between mobile money agents and users and the mobile money service provider in mobile payments. Therefore, only the mobile money payment gateway has records that can trace and identify them [46; 65; 66]. Ensures privacy: The biometric fingerprint is protected using FIDO that uses RSA to protect public/private key pairs and biometric templates. The database records are also secured with Fernet encryption, thus protecting the credentials and transaction privacy and the privacy of the mobile money IT support staff, agents, and users [21; 63; 73].