Show HN: YubiKey HMAC-SHA1 support for KeePassX

Re:Show HN: YubiKey HMAC-SHA1 support for KeePassX by ef4 on Monday May 26, 2014 @05:11PM (#7801643)

Thanks, this looks interesting. I'm not clear on how the master seed gets regenerated at every save.

Presumably the secret key used to generate the HMAC never leaves the YubiKey? So when you want to change the seed, you need to ask the YubiKey to sign the new seed? So saving the database requires pushing the button on the YubiKey again?

[ Parent | on HN ]

Re:Show HN: YubiKey HMAC-SHA1 support for KeePassX by 2bluesc on Monday May 26, 2014 @07:11PM (#7802085)

The secret is generated by a PC using Yubico's tools (see the screenshots in the PR). If you're truly paranoid you'd do this on an offline computer so that the secret doesn't some how leak to the Internet. This secret could then be programmed to other YubiKeys if desired (at least 2 are recommend for backup).

Every time the KeePass2 database is written, a new master seed is generated[1]. The master seed is stored raw in the header of the KeePass2 database so that it can be read later for decryption.

This pull request is a nutshell submits the master seed as a challenge to the YubiKey which replies with a deterministic response. We then use the response to generate the final key. The final key is the true encryption key and the file is written out. To decrypt[2], we do the same thing, but read the master seed from the header file. Commit that ties everything in to the final key[3].

[1] https://github.com/keepassx/keepassx/blob/master/src/format/... [2] https://github.com/keepassx/keepassx/blob/master/src/format/... [3] https://github.com/kylemanna/keepassx/commit/45d2add8a3037c3...

[ Parent | on HN ]

Re:Show HN: YubiKey HMAC-SHA1 support for KeePassX by ef4 on Monday May 26, 2014 @07:22PM (#7802118)

Right, that's what I was assuming. Good.

The only part I trying to confirm was that you issue a challenge to the yubikey at save time, not just at decryption time.

[ Parent | on HN ]