We’ve just released a new feature for our Pro users. Apple Watch Integration. You can now store your database entries on your Apple Watch. This is convenient for when you need a credential, note or 2FA Code and you’ve forgotten or not been able to take your phone with you. While we don’t recommend using your Apple Watch as the primary interface for Strongbox, it is a super handy backup, and you never know when it might save your day.
Our Apple Watch integration is a Pro feature, and we hope you’ll find it both beautiful and useful in your day to day tasks.
For more details and step by step instructions, take a look at our Apple Watch guide here. Please do drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.
We’ve just released a new feature for users of hardware keys. This feature is similar in some ways to our last, virtual hardware keys for Mac. It makes the use of hardware keys a bit more tolerable and convenient while maintaining a very high degree of security. Our new feature is a bit easier to manage, you don’t need to create a virtual key and/or know much about the secret stored within your hardware key.
What problem does this solve?
There are a few technical issues that make using a hardware key a bit more cumbersome than one might hope. First is the obvious physical requirement for the device itself, required for every unlock and usually for every update and edit. If there is a problem communicating with the device edits can be lost, or you can be locked out of your database for a while. Worse still, on iOS, AutoFill system limitations (e.g. no NFC access) and software impediments (e.g. poor third-party library support for AutoFill), make things difficult for us developers to provide a comfortable experience for our users.
What is Hardware Key Caching?
To explain what our new feature is, we must briefly explain how a hardware key is used to help secure your password database. Your hardware key can be programmed with a secret that is used in what’s called a “Challenge Response” function. For Strongbox and KeePass databases, this is the HMAC-SHA1 function, an open standard. This function takes an input, the “Challenge” and produces an output, the “Response”. The same challenge will always lead to the same response and is dependent on the “secret” hidden within your key or virtual key. It is computationally intractable/practically impossible to determine the response to a particular challenge without knowing the secret, and the devices are extremely resistant to anyone being able to extract that secret.
Strongbox and other clients (e.g. KeePassXC) that support hardware key protection via challenge response, use the response to help encrypt the database, along with a password if used, and/or a key file if provided. These individual factors (password, key file, and challenge response) are cryptographically combined to generate a composite key, which along with a transform key and a master seed is ultimately what generates the key that encrypts your database.
Hardware Key Caching works by intercepting the challenge & response used when unlocking the database, and then securely “caching” it. If Strongbox sees a subsequent request to encrypt or decrypt the database, it checks if it can provide the response from its cache, instead of requesting it from the physical hardware key. If so, it can help to alleviate multiple or overly frequent requests for the device. If it doesn’t know the response for a particular challenge, of course it falls back to requesting the physical device itself.
This simple strategy can make life surprisingly more comfortable for users with virtually no special technical ability required.
How to I enable Hardware Key Caching?
The most likely way you’ll enable hardware key caching is through our onboarding process which will ask you when you unlock your database whether you would like to turn this feature on. Below we describe how you can do that manually and also how you can adjust the settings or turn it off.
NB: You will need to be using a hardware key, be a Pro user and your database must be in KeePass 2.0 (KDBX 4.x) format to use hardware key caching.
On iOS
Unlock your Database
Tap the Settings button (Gear icon)
Tap Hardware Key (see screenshot)
Enable Challenge Response Caching
On macOS
Unlock your Database
Go to the Database Settings under Database > Database Settings menu item
Click on the Hardware Key tab (see screenshot)
Enable Challenge Response Caching
How is the challenge response securely cached?
Strongbox stores the challenge response pair securely using the Secure Enclave mechanism with a configurable expiry setting. As mentioned in previous articles the Secure Enclave provides exceptional protection for secret storage using a special separated and dedicated on chip device on your iPhone or Mac.
Conclusion
We hope this will encourage more users to give security keys a try, and make life easier for our existing users, especially when it comes to AutoFill. We would still recommend storing your hardware key secret somewhere very secure offline, e.g. in a physical safe. You can use this with our virtual hardware keys to recover from a device fault or loss. Drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.
