Elliptic Curve Digital Signature Algorithm dan Secure Hash Algorithm-256 untuk Autentikasi Transaksi Berbasis PIN pada Aplikasi Mobile Banking

Alvina Hardiyanti; Siti Fatimah; Rini Marwati

doi:10.35472/indojam.v6i2.2992

Alvina Hardiyanti
Siti Fatimah
Rini Marwati Universitas Pendidikan Indonesia

DOI: https://doi.org/10.35472/indojam.v6i2.2992

Keywords: Authentication, Digital Signature, ECDSA, Mobile Banking, PBKDF2, PIN, SHA-256

Abstract

Conventional security models in mobile banking applications remain vulnerable to the theft of Personal Identification Numbers (PINs) transmitted to the server. This research integrates the Elliptic Curve Digital Signature Algorithm (ECDSA) and Secure Hash Algorithm-256 (SHA-256) for more secure transaction authentication in mobile banking applications. The PIN is no longer sent to the server, but rather combined with the username and device ID to generate a private key using the Password-Based Key Derivation Function 2 (PBKDF2). The application prototype was built using the Python programming language with a client-server architecture. The client performs hashing on the transaction data using SHA-256 and signs it with ECDSA, while the server verifies the signature. The application's performance evaluation was conducted through three testing scenarios, namely normal transactions, access from unregistered devices, and transaction nominal manipulation. The test results indicate that the application is capable of executing signing and verification accurately across all scenarios. This proves that the applied method is effective in ensuring authentication security, data integrity, and non-repudiation in mobile banking transactions.
Keywords: Authentication, Digital Signature, ECDSA, Mobile Banking, PBKDF2, PIN, SHA-256.

Abstrak:

Model keamanan konvensional pada aplikasi mobile banking masih rentan terhadap pencurian Personal Identification Number (PIN) yang dikirimkan ke server. Penelitian ini mengintegrasikan Elliptic Curve Digital Signature Algorithm (ECDSA) dan Secure Hash Algorithm-256 (SHA-256) untuk autentikasi transaksi yang lebih aman pada aplikasi mobile banking. PIN tidak lagi dikirimkan ke server, melainkan digabungkan bersama username dan device ID untuk membangkitkan kunci privat menggunakan Password-Based Key Derivation Function 2 (PBKDF2). Prototipe aplikasi dibangun menggunakan bahasa pemrograman Python dengan arsitektur klien-server. Klien melakukan hashing data transaksi menggunakan SHA-256 dan menandatanganinya dengan ECDSA, sementara server memverifikasi tanda tangan tersebut. Evaluasi kinerja aplikasi dilakukan melalui tiga skenario pengujian, yaitu transaksi normal, akses dari perangkat tidak terdaftar, dan manipulasi nominal transaksi. Hasil pengujian menunjukkan bahwa aplikasi mampu mengeksekusi penandatanganan dan verifikasi secara akurat pada seluruh skenario. Hal ini membuktikan bahwa metode yang digunakan efektif dalam menjamin keamanan autentikasi, integritas data, dan nirsangkal pada transaksi mobile banking.

Downloads

Download data is not yet available.

References

T. A. Berutu, D. Lorena, R. Sigalingging, and G. Kasih, "Pengaruh Teknologi Digital terhadap Perkembangan Bisnis Modern," Neptunus: Jurnal Ilmu Komputer Dan Teknologi Informasi, vol. 2, no. 3, pp. 358-370, 2024.

H. Karjaluoto, A. A. Shaikh, H. Saarijärvi, and S. Saraniemi, "How Perceived Value Drives the use of Mobile Financial Services Apps," International Journal of Information Management, vol. 47, pp. 252-261, August 2019.

T. K. Yadav dan K. Seamons, "A Security and Usability Analysis of Local Attacks Against FIDO2," dalam Network and Distributed System Security (NDSS) Symposium 2024, San Diego, CA, USA, 2024, doi: 10.14722/ndss.2024.24327.

T. Chothia, F. Garcia, C. Heppel, dan C. McMahon Stone, "Why banker Bob (still) can't get TLS right: A Security Analysis of TLS in Leading UK Banking Apps," dalam Financial Cryptography and Data Security: 21st International Conference (FC 2017), Sliema, Malta, 2017, pp. 579-597, doi: 10.1007/978-3-319-70972-7_33.

V. Pongsitammu, A. R. Y. Simatupang, D. Annura, Y. Sari, Dachi, and D. R. Harries, "Keamanan Kriptosistem Modern Berdasarkan Algoritma Kriptografi Kunci Publik," Siteba, vol. 2, no. 1, 2023.

E. Barker, "Recommendation for Key Management: Part 1 – General," National Institute of Standards and Technology (NIST), Special Publication (SP) 800-57 Part 1 Rev. 5, May 2020.

V. Simangunsong, Y. R. Hutasoit, D. Siallagan, T. Rekayasa, P. Lunak, and I. T. Del, "Analisis Terhadap Keamanan Password Menggunakan Hash SHA-256," Jurnal Quancom, vol. 3, no. 1, pp. 13-17, 2025.

G. Ali, M. A. Dida, and A. E. Sam, "A Secure and Efficient Multi-factor Authentication Algorithm for Mobile Money Applications," Future Internet, vol. 13, no. 12, pp. 1-31, 2021.

H. Suseno, "Implementasi Elliptic Curve Digital Signature Algorithm dan Secure Hash Algorithm 256 pada Login Akun dengan Sistem Two-Factor Authentication," B.S. thesis, Universitas Pendidikan Indonesia, Bandung, Indonesia, 2025.

K. Moriarty, B. Kaliski, and A. Rusch, "PKCS #5: Password-Based Cryptography Specification Version 2.1," RFC 8018, Internet Engineering Task Force (IETF), 2017.

A. Visconti, O. Mosnáček, M. Brož, dan V. Matyáš, "Examining PBKDF2 security margin—Case study of LUKS," Journal of Information Security and Applications, vol. 46, pp. 296-306, 2019.

National Institute of Standards and Technology, "Secure Hash Standard (SHS)," Federal Information Processing Standards Publication (FIPS PUB) 180-4, Aug. 2015.

E. Barker, Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms, NIST Special Publication 800-175B Revision 1, National Institute of Standards and Technology, Mar. 2020. doi: 10.6028/NIST.SP.800-175Br1.

D. Eastlake 3rd, J. Schiller, dan S. Crocker, "Randomness Requirements for Security," RFC 4086, Jun. 2005.