I see that some projects like KeepassXC use CR based OTP to provide some additional security. While this is discussed quite controversial my opinion is that - for quite some cases (e.g. most non-targeted attacks as of today) - it can provide additional security over having "only" a secure master password.
However: if at one point in time the attacker has access to both, the response and the version of the data encrypted with it, then obviously this adds no additional security to the encryption. So, for targeted attacks or speciallized tools any local OTP method I could find (CR based or certificate based) add no additional security. They all share the same design-flaw: if an attacker has access to all local data (including memory) at some point in time it's not much better then a simple secure master password. It only rises the attack complexity a bit.
I wonder if there are things in the works to eliminate this last ("design-wise") attack surface so even if a system is completely compromised we can rely on physical dongles like Yubikey to protect the most sensitive data and have features like physical presence dection for actual encryption (not only authentication) at hand.
Obviously I make alot of assumtions here e.g.: that the transport between the hardware dongle and the CPU as well as any memory in between is "secure". But that's not my question.
So, just out of interest: are there any projects that aim for such things? E.g. by implementing asymetric encryption for local files where the encryption and decryption is completely offloaded to a plug-and-play hw dongle like Yubikey, possibly even using a OTP derived from the private key on the dongle?
Are there other methods / areas of research that discuss this topic or even working solutions?
