A computing device for enabling biometric multi-factor authentication comprising: an enrollment subsystem comprising: a transform selector value generator to generate a transform selector value; a transform module to generate a first instance of a salt using a transform function for a cryptographic hash function based on the transform selector value and a first instance of a biometric user identifier; and a cryptographic hash engine to supply the first instance of the salt and a first instance of a non-biometric user identifier to the cryptographic hash function to generate a first hash value; an authentication subsystem comprising: a transform submodule to generate a second instance of a salt for a cryptographic hash function based on the transform selector value received from the enrollment subsystem and a second instance of a biometric user identifier; a cryptographic hash engine to supply the second instance of the salt and a second instance of a non-biometric user identifier to the cryptographic hash function to generate a second hash value; wherein the transform selector value is associated with the user, and is randomly generated in accordance with requirements of the transform function used by the transform module to generate the first instance of the salt and is stored in a secure location in the enrollment subsystem; and wherein the salt is a fixed length string value. an enrollment subsystem comprising: a transform selector value generator to generate a transform selector value; a transform module to generate a first instance of a salt using a transform function for a cryptographic hash function based on the transform selector value and a first instance of a biometric user identifier; and a cryptographic hash engine to supply the first instance of the salt and a first instance of a non-biometric user identifier to the cryptographic hash function to generate a first hash value; a transform selector value generator to generate a transform selector value; a transform module to generate a first instance of a salt using a transform function for a cryptographic hash function based on the transform selector value and a first instance of a biometric user identifier; and a cryptographic hash engine to supply the first instance of the salt and a first instance of a non-biometric user identifier to the cryptographic hash function to generate a first hash value; an authentication subsystem comprising: a transform submodule to generate a second instance of a salt for a cryptographic hash function based on the transform selector value received from the enrollment subsystem and a second instance of a biometric user identifier; a cryptographic hash engine to supply the second instance of the salt and a second instance of a non-biometric user identifier to the cryptographic hash function to generate a second hash value; a transform submodule to generate a second instance of a salt for a cryptographic hash function based on the transform selector value received from the enrollment subsystem and a second instance of a biometric user identifier; a cryptographic hash engine to supply the second instance of the salt and a second instance of a non-biometric user identifier to the cryptographic hash function to generate a second hash value; wherein the transform selector value is associated with the user, and is randomly generated in accordance with requirements of the transform function used by the transform module to generate the first instance of the salt and is stored in a secure location in the enrollment subsystem; and wherein the salt is a fixed length string value.