Yubikey is only really useful for authentication with a trusted party, and not decryption. You can technically use store a secret key on it but then its two biggest advantages are gone, namely that you can’t copy the key and that it doesn’t use the limited storage on the device.
The yubikey can perform a hmac using a secret (supposedly) only available to the key’s internals. This is used in addition to the password, so that knowledge of the password without the key, or the key without knowledge of the password, can’t be used to decrypt the database. It’s kind of a half second factor (I know it’s not technically correct to call it that, but I hope you get the idea).
i use keepass to store all my passwords, the database file gets synced across my devices through Dropbox, i open it with a master password, i would like to improve this by also requiring the yubikey
i am kind of confused too as to what exactly the yubikey does in this scenario. my vague understanding is that it was somehow synchronized such that the yubikey would generate sequential random ‘passwords’ which would be checked against the database file (generating its own sequence in the same manner).
i think it stopped working due to some desynchronization between the yubikey and the database file.
Sync shouldn’t really matter, unless you’re using a hotp code as opposed to a certificate or TOTP code.
TOTP being temporal, is based on UNIX time, and a seed key. A certificate will be challenged, which will require a challenge and reply all cryptographically encrypted. It’s not something that’s necessarily stored in some kind of sync, or rolling codes.
I’m not familiar enough with keepass to say what it’s supposed to use with the yubikey in order to work. There’s a few other methods that I’m sure that keepass could leverage to perform the authentication, so I’m not entirely sure what could be the problem.
im definitely an idiot but i couldn’t figure out at all how to make a yubikey work with a keepass database on android
Yubikey is only really useful for authentication with a trusted party, and not decryption. You can technically use store a secret key on it but then its two biggest advantages are gone, namely that you can’t copy the key and that it doesn’t use the limited storage on the device.
The yubikey can perform a hmac using a secret (supposedly) only available to the key’s internals. This is used in addition to the password, so that knowledge of the password without the key, or the key without knowledge of the password, can’t be used to decrypt the database. It’s kind of a half second factor (I know it’s not technically correct to call it that, but I hope you get the idea).
It’s also in their doc (that they use challenge/response): https://keepassxc.org/docs/ and is even featured on yubico’s website, which is somewhat weird but why not: https://www.yubico.com/works-with-yubikey/catalog/keepassxc/#tech-specs
The issue GP had is probably that the keepass app does not support it on Android.
This works for me on KeepassXC / Keepass2Android, and it looks like Yubico has instructions for original Keepass.
thank you, ill give it another shot
I’m a bit confused. What are you trying to get the yubikey to do?
i use keepass to store all my passwords, the database file gets synced across my devices through Dropbox, i open it with a master password, i would like to improve this by also requiring the yubikey
i am kind of confused too as to what exactly the yubikey does in this scenario. my vague understanding is that it was somehow synchronized such that the yubikey would generate sequential random ‘passwords’ which would be checked against the database file (generating its own sequence in the same manner).
i think it stopped working due to some desynchronization between the yubikey and the database file.
Sync shouldn’t really matter, unless you’re using a hotp code as opposed to a certificate or TOTP code.
TOTP being temporal, is based on UNIX time, and a seed key. A certificate will be challenged, which will require a challenge and reply all cryptographically encrypted. It’s not something that’s necessarily stored in some kind of sync, or rolling codes.
I’m not familiar enough with keepass to say what it’s supposed to use with the yubikey in order to work. There’s a few other methods that I’m sure that keepass could leverage to perform the authentication, so I’m not entirely sure what could be the problem.
okay, i appreciate you taking the time to write a response, i have no idea what you’re saying though. maybe im wrong about why it didn’t work.