# Challenge-Response Pair Mechanisms and Multi-Factor Authentication Schemes to Protect Private Keys
## 6 Conclusions and Future Work  
The new protocols for PKI applications such as crypto wallets leverage three successive layers of security based on the randomly chosen numbers RN\({}_{1}\), RN\({}_{2}\), and RN\({}_{3}\) and the CRP mechanisms processing the MFA. The protocols open up the following features:  
Figure 15: Comparative analysis of a crypto wallet using the suggested technology against both competitive “Cold” and “Hot” crypto wallet solutions. * The enrollment process, token distribution, and recovery cycles can be managed by an independent Keystore corporation, which only has access to the first random number RN\({}_{1}\). Both the user and the Keystore independently generate from RN\({}_{1}\) (concatenated with a password) a combined reference table from multiple CRP mechanisms based on multiple factors of authentication. * The novel key pair generating scheme preserves the privacy of users. As the shared RN\({}_{1}\) enables verification of the validity of the public key Pk by the Keystore, the private keys are solely generated by the user with RN\({}_{2}\), which is never shared and erased after key generation. The method is compatible with current PKI infrastructures, and crypto wallets with NIST's standardized PQC. * During normal operation, the MFA is directly under the control of each user, and easy to operate. To obtain their private key and sign a crypto-transaction, the user enters the password, RN\({}_{1}\), and RN\({}_{3}\); inserts the token into one of the terminals pre-loaded with the app; obtains an image from the camera; and retrieves the virtual token. * On demand, the Keystore corporation can transmit to the user the reference table of the token CT-T. This allows the user to retrieve the private key when the token is lost. A new virtual enrollment using a new token is recommended. * The user can use multiple devices, thereby being protected against HW failure or loss of a single crypto wallet. With current technologies, the loss of a crypto wallet is catastrophic, and private keys are lost. The flexibility does not compromise the security, as the public keys are not stored in a single crypto wallet that can be stolen and hacked. In the experimental section, we demonstrate that an implementation with the standardized CRYSTALS Dilithium algorithm was fast and experienced extremely low error rates. The bulk of the anticipated future work resides in the need to submit the protocols to independent third parties' security assessments. We recognize that each factor of authentication has its own well-known vulnerabilities. For example, it is relatively easy to read the fingerprints of the SRAM PUFs used in the tokens when under the control of opponents. The user can mitigate this threat by keeping their computers stored in a safe place. Other nanomaterials such as ReRAM memories should be considered for future work because of their superior tamper resistance. An alternate path that we are considering is the use of arrays of sensors that can be integrated into a wearable device. Each sensor has fingerprints that can be exploited to generate a reference table compatible with other methods. They are more difficult to read than plain SRAM memories and can be used to monitor vital signs. The overall vulnerabilities of biometric authentication methods are another concern. The method presented in this paper would benefit from stronger liveness tests, and methods to prevent an AI-generated video from being successfully displayed in front of the camera of the terminal devices. The one-way-ness of the CRP mechanism would benefit from mathematical schemes such as Johnson-Lindenstrauss, which randomly projects the measurements extracted from visual images into higher dimensions [67; 68]. Our future work includes the investigation of such mathematical schemes, as well as the use of 3D biometric methods with photogrammetry. By enrolling the user in a multi-dimensional space, we can mitigate simplistic attacks by bringing two-dimensional information.