Repository navigation
Questions about Yubikey setup. #2563
|
Hello, I tried to configure Slot 2 on my Yubikey for challenge response but it asks for a secret key? What is that secret key? Without configuring the challenge response, I downloaded KeePassDX libre (does it matter if it is free or libre?) and the Key Driver app. I created a new database, selected the Yubikey challenge response, it prompted me to open the key driver app and then it fails with an error after a few seconds saying try again later. Am i supposed to setup the yubikey challenge on KeePassXC first or is this supported on KeePassDX? I'm not sure what the instructions are or what the problem is. I'm on a Private Space with no Google Play Services installed. Just out of curiosity, I also wanted to ask if there is a way to only have the Yubikey be the method of unlocking the database or should there be an established password as well. Thank you. |
Replies: 3 comments 5 replies
|
I'll answer my questions as I dug further and found out how to do it.
A secret you configure in the Yubico Authenticator desktop app or Yubico Manager CLI. It can be randomly generated in the aforementioned software as well. You need to save that secret and configure other Yubikeys with the same secret in the challenge response if you would like to use more than one key to unlock your database.
Does not appear to matter if you use the free or libre.
Yubikey challenege is setup on the relevant slot (1 for short touch or 2 for long touch) in the Yubico apps I mentioned before. No need to use KeePassXC for anything. Both USB and NFC work. You can setup "require touch" in the challenge response which means you need to long press for slot 2 or short press on the yubikey for slot 1. You can also choose to not set it up whereas just plugging it in is enough to authenticate you into the database.
Works well in Private Space without Google Play Services, no need for any apps other than the Key Driver and KeePassDX, KeePassDX doesn't even need to be set as credential provider. Both USB and NFC
Yes you can do that, no need for an established password but that is up to you. |
|
I wanted to answer you once I had been on the subject of Yubikey but I didn't have time, sorry. Very good if you found the answer. The topic is not yet documented because it is not finished, which is also why KeyDriver is in beta, for now it only manages Yubikey but there is no doc and it lacks the ability of hmac-secret because the implementation is very difficult. So these are advanced options until all the developments are completed. |
|
No need to apologise. This makes sense, I wish you luck with the implementation. P.S I really appreciate the great work you do on KeePassDX, i've been using it for years now and have bought the pro version! |
|
I did however want to ask if the functionality of the Key Driver is planned to be integrated in KeePassDX itself rather than requiring a seperate app. |
|
No, because it requires very specific code that isn't useful at all for people who don't want to use physical keys. There is integration with libraries related to hardware key protocols, but if you have any ideas for better integration of this second application, I'd love to hear them. |
|
I realised I haven't been able to use the FIDO2 HMAC option, only the proprietary challenge response. How do i get the other one to show up in KeePassDX as an option? |
|
Once development is complete |
|
Associated issue : #304 |
I wanted to answer you once I had been on the subject of Yubikey but I didn't have time, sorry. Very good if you found the answer.
The topic is not yet documented because it is not finished, which is also why KeyDriver is in beta, for now it only manages Yubikey but there is no doc and it lacks the ability of hmac-secret because the implementation is very difficult. So these are advanced options until all the developments are completed.