To respect the 2FA philosophy, after a 1st factor of authentication (login/password), we need to request a 2nd factor of authentication.
But for a mobile app, I suppose we can't use SMS OTP, email OTP or TOTP (with another mobile app) because all of theses techniques could be accessed from the same mobile?
Thereby for a mobile app the only 2nd factor authorized are a separate device (eg: Yubikey, Nitrokey, etc)?
Is it enough if we request something we known (userID + hex PIN code) and something we have (this mobile device only)? There is a ECDSA private key installed on the device and the server can check it's the good mobile device with the signature.