We’ve just released a new feature for our Pro users. Apple Watch Integration. You can now store your database entries on your Apple Watch. This is convenient for when you need a credential, note or 2FA Code and you’ve forgotten or not been able to take your phone with you. While we don’t recommend using your Apple Watch as the primary interface for Strongbox, it is a super handy backup, and you never know when it might save your day.
Our Apple Watch integration is a Pro feature, and we hope you’ll find it both beautiful and useful in your day to day tasks.
For more details and step by step instructions, take a look at our Apple Watch guide here. Please do drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.
We’ve just released a new feature for users of hardware keys. This feature is similar in some ways to our last, virtual hardware keys for Mac. It makes the use of hardware keys a bit more tolerable and convenient while maintaining a very high degree of security. Our new feature is a bit easier to manage, you don’t need to create a virtual key and/or know much about the secret stored within your hardware key.
What problem does this solve?
There are a few technical issues that make using a hardware key a bit more cumbersome than one might hope. First is the obvious physical requirement for the device itself, required for every unlock and usually for every update and edit. If there is a problem communicating with the device edits can be lost, or you can be locked out of your database for a while. Worse still, on iOS, AutoFill system limitations (e.g. no NFC access) and software impediments (e.g. poor third-party library support for AutoFill), make things difficult for us developers to provide a comfortable experience for our users.
What is Hardware Key Caching?
To explain what our new feature is, we must briefly explain how a hardware key is used to help secure your password database. Your hardware key can be programmed with a secret that is used in what’s called a “Challenge Response” function. For Strongbox and KeePass databases, this is the HMAC-SHA1 function, an open standard. This function takes an input, the “Challenge” and produces an output, the “Response”. The same challenge will always lead to the same response and is dependent on the “secret” hidden within your key or virtual key. It is computationally intractable/practically impossible to determine the response to a particular challenge without knowing the secret, and the devices are extremely resistant to anyone being able to extract that secret.
Strongbox and other clients (e.g. KeePassXC) that support hardware key protection via challenge response, use the response to help encrypt the database, along with a password if used, and/or a key file if provided. These individual factors (password, key file, and challenge response) are cryptographically combined to generate a composite key, which along with a transform key and a master seed is ultimately what generates the key that encrypts your database.
Hardware Key Caching works by intercepting the challenge & response used when unlocking the database, and then securely “caching” it. If Strongbox sees a subsequent request to encrypt or decrypt the database, it checks if it can provide the response from its cache, instead of requesting it from the physical hardware key. If so, it can help to alleviate multiple or overly frequent requests for the device. If it doesn’t know the response for a particular challenge, of course it falls back to requesting the physical device itself.
This simple strategy can make life surprisingly more comfortable for users with virtually no special technical ability required.
How to I enable Hardware Key Caching?
The most likely way you’ll enable hardware key caching is through our onboarding process which will ask you when you unlock your database whether you would like to turn this feature on. Below we describe how you can do that manually and also how you can adjust the settings or turn it off.
NB: You will need to be using a hardware key, be a Pro user and your database must be in KeePass 2.0 (KDBX 4.x) format to use hardware key caching.
On iOS
Unlock your Database
Tap the Settings button (Gear icon)
Tap Hardware Key (see screenshot)
Enable Challenge Response Caching
On macOS
Unlock your Database
Go to the Database Settings under Database > Database Settings menu item
Click on the Hardware Key tab (see screenshot)
Enable Challenge Response Caching
How is the challenge response securely cached?
Strongbox stores the challenge response pair securely using the Secure Enclave mechanism with a configurable expiry setting. As mentioned in previous articles the Secure Enclave provides exceptional protection for secret storage using a special separated and dedicated on chip device on your iPhone or Mac.
Conclusion
We hope this will encourage more users to give security keys a try, and make life easier for our existing users, especially when it comes to AutoFill. We would still recommend storing your hardware key secret somewhere very secure offline, e.g. in a physical safe. You can use this with our virtual hardware keys to recover from a device fault or loss. Drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.
With the release of 1.60.16, macOS users can now use virtual hardware keys in place of physical keys. This can help make their lives a little easier and also provide a disaster relief fallback. We’ve had virtual hardware keys available on iOS for a while now. This was largely driven by the need for an AutoFill solution. For technical reasons communicating with physical devices in AutoFill mode on iOS ranges from difficult to impossible. So, our iOS users have used virtual hardware keys to workaround this issue. There are a number of reasons why you might want to use virtual hardware keys on macOS.
Convenience and Hardware Compatibility Issues
On macOS, things are more straightforward in AutoFill mode, though you may have other kinds of issues which virtual hardware keys could solve. For example, if your Mac doesn’t have the right kind of USB port or if your YubiKey only uses NFC which is unavailable on Mac.
Another reason to use a virtual hardware key is the convenience it provides. It is essentially a secure functional clone of your physical key. This effectively turns your iPhone/iPad or Mac into a copy of your hardware key.
A more extreme or interesting use-case we’ve come across in the wild (literally) is from a user who has an emergency “bug-out” shelter way up in the remote backcountry of the Rocky Mountains. Out there he maintains some devices on which he has setup a virtual hardware key. This is just in case he has to bail out of civilisation (while forgetting his physical key), when the zombie apocalypse or whatever it may be occurs. We’re heartened to know Strongbox might survive the collapse!
Disaster Recovery
Another reason you might choose to setup a virtual hardware key is disaster recovery. If you were to somehow lose your physical key and your backup of that key (you do have a backup, right?) then you would be completely locked out of your database. However, you can use a virtual hardware key to recover from this situation. All you need is the secret you programmed your physical key with, you know, the one you stored in a secure offline location like your physical safe, just for this sort of emergency recovery scenario.
How to Setup a Virtual Hardware Key on macOS
Setting up a virtual hardware key on macOS is very straightforward and easily accessible from the standard lock screen:
macOS Lock Screen
Go to the Lock Screen of your database
Ensure you have checked Show Advanced
Under the Hardware Key section click the dropdown
Click New Virtual Hardware Key…
New Virtual Hardware Key Screen
Enter a name for your virtual hardware key e.g. ‘My Backup Key’
This key will now be available in the Hardware Key section of the lock screen for use with your databases.
How to delete a Virtual Hardware Key on Mac
This is very straightforward:
Go to the Lock Screen of your database
Ensure you have checked Show Advanced
Under the Hardware Key section click the dropdown
Hold down the Option (⌥) button and click on the key you’d like to delete
You will be asked to confirm. Click Yes.
Technical Security Considerations
We sometimes get asked about the security of virtual hardware keys and that’s understandable. The people using them have very high security demands and we can understand the anxiety. Short answer, these virtual keys are very, very secure. Long answer, the secret is protected by the on device Secure Enclave which provides an excellent industry leading level of security. In essence using virtual hardware keys turns your device into a secure functional clone of your physical key. Just as the secret is stored securely on your physical key, the secret is stored securely on your iPhone/iPad or Mac.
One could argue over the relative security provided by the physical key secure storage vs the Apple Secure Enclave storage but there’s no real question that both provide a very high degree of security for the secret stored within. We personally think for most if not all users the difference is academic and not something that should cause major concern.
As with all things security, it is rarely, if ever a binary, secure vs insecure, but rather a spectrum from less to more secure. Your threat model may vary, and you will need to decide on the security vs convenience trade-off that works for you. If you feel that there is some threat to the Secure Enclave technology that is realistic for your scenario then, absolutely, do not use it. We are not aware of any serious or practical attacks on the technology at the time of writing. Of course, there’s always the possibility the NSA or CIA or whomever has some kind of ability like this, though even there, we have our doubts, but if they’re in your threat model, then, sure, you’re probably going to want to avoid this convenience feature.
