pwsafe
"missing" Yubikey secret key in database?
I have recently decided to create a backup for my Yubikey I use with pwsafe. Incidentally, I used for that a pwsafe app I freshly built on macOS.
Followed the procedure described here: https://pwsafe.org/help/pwsafeEN/html/manage_menu.html#%23yubikey All seemed fine except the "new" yubikey did not work.
Eventually I realized that the "Secret Key" which is normally "hidden" by asterisks, when unhidden, is not at all the secret I stored when I created my first yubikey, but seemed like some stack dump or something instead (lot of zeroes, similar non-zero combinations, etc.).
To be sure that my macOS build is not doing something wrong, I run the same procedure on pwsafe on Windows, but got a different result. When invoking the "Yubikey Configuration" dialog, with the database unlocked with the original yubikey, there was no "Yubikey Secret Key" displayed hidden or not - the edit box was empty.
So my conclusion was that possibly my pwsafe database does not have the secret stored (or it was corrupted?). The Windows not giving any value is at least hinting on that. The mac version giving some bogus value is however misleading because it makes the user to continue and personalize the key with a wrong value.
- Is it possible to not have the secret in the database?
- Why mac and Windows versions behave differently?
I had a similar incident when testing the change password dialog, I was repeatedly switching between using a Yubikey alone, with a PW, and PW only. Somewhere along the line, the secret key disappeared. I was never able to reproduce the problem or figure out what happened. I might suggest the following:
- make a copy of your database file.
- Using the copy, from the "Manage->Change Master Password" dialog: Remove the "old" Yubikey by setting a password only.
- Using the "new" Yubikey: go to the Manage->Yubikey..." dialog and initialize the new Yubikey from scratch following the procedure (Generate and Set)
- Change the master password to use the New Yubikey.
- At this point, you should have a new key saved in the DB.
CAUTION: don't do this last step if the Yubikey is used for more than one DB or there was a problem with the above steps. 6. When you are satisfied that the new key is working, you can follow the procedure to add the "old" key as a backup.
I hope this helps.
@nobugshere After giving it more thought lately, I believe I might have an explanation why my yubikey secret was not in the database. I have set it a long time ago (~7 years) and while I do not remember what was the recommended procedure back then (or if there was one), I believe it is possible that pwsafe either did not store the key in the database (yet), or I might have used other means to personalize the key. I have never removed the yubikey from the database since then.
The fact that I have a copy of a valid secret (verified by personalizing it on a new key) proves I had to personalize the key somehow myself and also thought it necessary to make a copy.
Anyway, I guess what is the actual issue coming from this is the bogus value displayed in macOS version, which, if you have not saved the secret for a comparison, may lead to some bad surprises down the road.
@risa2000 Thanks for the info. I don't know why it would be displaying a bogus value. But, I did figure out a sequence that likely explains what happened to me:
- Change from using a Yubikey to PW only
- Display the Yubikey... dialog - The secret is now blank
- Exit the program
- re-open the same DB, using the new PW
- Display the Yubikey dialog - The secret is still there
Between steps 2 and 3, while the secret is blank, make any change to the DB and save it; the key will be gone permanently. (Remember, at this point, the DB is protected with a PW only.) If I don't make any changes before exiting (step 3), I can re-open the file and make changes later and the key is still preserved. I haven't tried this on Windows yet.
It does make some sense to remove the secret when the key is no longer used, but the behavior isn't quite consistent.