# Challenge-Response Pair Mechanisms and Multi-Factor Authentication Schemes to Protect Private Keys
## 4 Experimental Section and Analysis
### Combination of Multiple Factors  
In the described protocol, the final reference table, or crypto table, is a combination of three components: the token table, the biometric table, and the virtual token table. Since the client side lacks information about ternary positions, the server sends the ternary table to the client. The client then superimposes this table onto its locally generated crypto table to produce a ternary state. Both the server and client utilize the same Random Number 2 (RN\({}_{2}\)) and password to generate identical challenges, which are used to produce a 256-bit seed for the ML-DSA44 digital signature, ultimately generating the public key. To ensure a 256-bit key comprising only \"0\" and \"1\", the protocol creates multiple times more challenges than are required for both the server and client crypto tables, which include ternary states. These ternary positions cannot be used directly for post-quantum digital signatures. Afterward, all \"X\" positions are filtered out, leaving only the stable \"0\" and \"1\" positions. Typically, the filtered list contains more than 256 stable cells. To resolve this, a random sampling technique is employed to select 256 elements without duplicates from the filtered list. The user's password serves as the seed for this sampling process, ensuring consistent selection of positions on both the server and client sides. Despite these measures, occasional errors may occur. To address this, a Response-Based Cryptography (RBC) error correction scheme is applied. RBC uses an exhaustive search to find the correct key, with a time limit of 5 s to prevent brute force attacks. This time constraint also acts as a security feature. Additionally, a fragmentation level is applied, splitting the 256-bit seed into smaller chunks (e.g., 2, 4, 8, or 16), and padding each chunk to make it 256 bits long (fragmentation level 1 means the whole seed is one chunk). The padding data are derived directly from RN\({}_{2}\). For example, at a fragmentation level of 4, the 256-bit seed is divided into four 64-bit chunks, each requiring an additional 192 bits. The first 192 bits of RN2 are extracted and used as padding before being hashed. Figure 10 illustrates the seed error distribution across different fragmentation levels. Figure 9: Kernel Density Estimation of “0” and “1” for server and client reference table CT-VT generated from virtual tokens. The 50-50% distribution is perfect, and none of the positions are fuzzy. These results highlight the robustness of the approach in generating secure keys while maintaining high efficiency. As the figure illustrates, most errors are concentrated around 1, 2, 3, 4 number of errors; therefore, our error correction scheme RBC can be slow to resolve 5- to 6-bit errors. Statistical analysis: The tests were conducted using an Intel(r) Core(tm) i9-9900K CPU @ 3.60 GHz processor. A total of 6000 AI-generated images were utilized, representing 400 individuals equally divided between 200 males and 200 females. The facial dataset was designed to be diverse, encompassing three distinct age ranges (20-34, 35-50, 51-65) and five skin tone levels to reflect various ethnicities; see Figure 11. Initially, 10,000 images were generated using a generative AI model with specific requirements and purchased from Generated Photos [66]. For the enrollment process or the generation of the biometric reference table, 15 images per individual were used. The tokenized PUF was built using an STM32F401 RBT microcontroller unit (MCU) and IS61 LV6416 SRAM. Each SRAM module consists of 65,536 words, providing access to 1,048,576 unique bits. For Response-Based Cryptography (RBC), we tested five different fragmentation levels. Each fragmentation level underwent 400 authentication cycles, resulting in a total of 2000 authentication cycles. As we have tried to verify both the real and wrong person for a test, our total test count would be 4000.