#Keepassxc synchronization password#
#Keepassxc synchronization series#
#Keepassxc synchronization free#

Activate Show expert options and select at least Key file / provider and choose Smartcard Encrypted Key File Provider.Eventually the Create Composite Master Key dialog will show: Open New wizzard as usual and choose a file name & location.Nothing special here, doesn't require the plugin to be installed at all:Ĭreate new database with encrypted key file

#Keepassxc synchronization password#

All done: Assuming the correct Master Password was entered, the database has finally been unlocked!.

YubiKeys like the one shown below will blink when the device is waiting for confirmation.

When using a YubiKey or similiar device, it might be necessary to confirm the private key operation by pressing a hardware button.

Therefore the following dialog might popup on your main screen:

It is likely that a PIN must be entered to unlock the smartcard.

#Keepassxc synchronization free#

Feel free to abort, else confirm the operation. Depending on the actual smartcard being used, this is likely to require user interaction and/or may take a few moments.

The previously chosen smartcard is used to decrypt the key file.

If more than one authorized smartcard is already connected, select the smartcard to be used and confirm the dialog. The dialog will close automatically once the smartcard is recognized.

Connect an authorized smartcard to the computer.

If no authorized smartcard or more than one authorized smartcard are connected to the computer, a selection dialog will appear:

Tick Key File option and select Smartcard Encrypted Key File Provider from the drop down menu.

Open database for the first time or unlock workspace.

Just copy the pre-built plgx file into the KeePass plugin folder. Thus the weakest point of the chain will usually be on the smartcard side and not the intermediate symmetric encryption.

Most smartcards implement weaker asymmetric encryption (used to encrypt the content encryption key) compared with the intermediate encryption using AES-256-CBC. It's not strictly needed for the purpose of this plugin, but assuming EnvelopedCms was properly implemented by Microsoft, it should be of no harm. The intermediate encryption of the payload using a random content encryption is generally needed to support arbitrary length content. This plugin selects AES-256-CBC as content encryption algorithm to be used by EnvelopedCms. Thus any authorized smartcard can decrypt the content encryption key and in turn permits decryption of the plaintext KeePass key. The single content encryption key is again encrypted using the public keys belonging to the list of authorized smartcards (recipients). A random content encryption key is used to protect the enveloped data (here: KeePass plaintext key). EnvelopedCms is the framework provided implementation of RFC 5652 Cryptographic Message Syntax (CMS): It permits encryption of arbitrary content to be decrypted by any authorized recipient. net framework class for encrypting the plaintext KeePass key file content. Other smartcards have not been tested yet.

#Keepassxc synchronization series#

YubiKey 5 series has been tested successfully. In theory, this plugin supports any PIV (Personal Identity Verification) compatible smartcard. Hence, access to the database is granted reliably, even if this plugin should not available. As alternative the user can also unlock the database using the plaintext key file without need for the corresponding plugin to be installed. When unlocking a database using the Smartcard Encrypted Key File Provider, the user is asked to insert/connect and unlock an authorized smartcard. The encrypted key file is saved next to the database file, while the user is given the possibility to save the corresponding plaintext key file in a safe location. This is implemented in a manner, that is fully compatibly with built-in key files: An existing or newly created key file is encrypted using public keys of one or many rsa smartcards. This plugin adds support for using (multiple) smartcards as second factor to unlock KeePass databases.

Smartcard Encrypted Key File Provider Plugin for KeePass