Add Yubikey Challenge-Request as 2FA

[TheZ3ro]

All the details in this PR keepassx/keepassx#52
Maybe @kylemanna can help

[droidmonkey]

Is YubiKey popular with KeePass users? I would much rather add something like Google Authenticator 2FA.

Perhaps this can be modularized such that multiple 2FA services can be incorporated into the interface.

[TheZ3ro]

Yubikey also works as OTP (TOTP as GoogleAuthenticator).
It Would be nice to select between 2FA method (OTP or Challenge-Response) to support both

[stmllr]

yubikey supports challenge/response, so 2fa would even work offline in opposite to Google Authenticator.

[TheZ3ro]

Google Authenticator works also offline because it's Time-based OTP (after the first sync online).
Here a guide to implement TOTP with GAuthenticator (maybe can help), but this will take some time to develop.
I'm a Challenge-Response fan

[kylemanna]

re: @TheZ3ro @stmllr

The YubiKey challenge response works completely offline. Google Authenticator and all TOTP mechanisms don't make any sense as they don't enhance the crypto key. They are usually used by a remote "trusted" third party (i.e. Google, Lastpass, etc) to control access to actual encrypted payload.

My implementation of the YubiKey challenge-response optionally adds strength to standalone key files and static passwords by hashing all the combinations together to generate a stronger key. This process occurs completely offline with just the YubiKey, supporting host libraries and KeePassX with this pull request.

[kylemanna]

To restate this:

TOTP controls access to the encrypted payload in the case of services like lastpass.

Challenge-Response makes the encrypted payload key stronger. If done right, challenge-reponse would force someone to attack the crypto cipher instead of brute forcing or guessing passwords that in standalone implementations are the basis for the key.

[TheZ3ro]

Can you rebase your PR on the KeePassX Reboot code? (On the develop branch, or in a feature/* branch) Thanks 👍

[kylemanna]

Honestly, I don't have the time in the near term. The most time consuming part is verifying that all the edge cases (that I can remember) work so that people don't lose their databases due to something silly like corruption since it does manipulate the way the crypto key is derived. Let's revisit it sometime down the road.

[TheZ3ro]

I will try to rebase your changes, If I need help I will ask you 😅

[droidmonkey]

@kylemanna great explanation and that makes perfect sense, thank you!

[Thynix]

@TheZ3ro Have you been able to rebase? Can I help?

[Thynix]

My bad, I now see that #127 is that rebased version.