How to use HMAC-SHA1 Challenge Response with NK3

[orolhawion]

Hi,

I just updated my NK3 to 1.5.0 and could not find any instructions on how to use HMAC-SHA1 Challenge Response? I thought the secrets app was the app to use for it, but I could not find anything in the docs. How do you guys do it?

I use nitropy 0.4.37.

[szszszsz]

Hi!

This new feature is aimed to support KeepassXC and other compatible applications, so no CLI was added to pynitrokey for it. To set it up a new pynitrokey release is needed, which should be published this week. The specific code is here:

• Better UI for Secrets App pynitrokey#393
• Tests for the KeepassXC support using Nitrokey 3 pynitrokey#384
• https://github.com/Nitrokey/pynitrokey/pull/384/files#diff-14ed97e044b77d5d114423e67ad4e61014cc657aed7d252d3114a10c596c4d48R1406-R1431 (low level tests)

Setup for HMAC slot 2 will look like this:

$ nitropy nk3 secrets add-challenge-response 2 (echo 1234567890123456789 |  base32)

Do you have any specific use case for this Yubikey's protocol? Just a reminder, that it is already possible to use HMAC challenge response through FIDO2, though I think this might be broken in the current nitropy 0.4.37:

$ nitropy fido2 challenge-response  --help

[orolhawion]

I basically use it to unlock KeepassXC and to not type a password when I use sudo.

I didn't know about challenge-response through FIDO2, thanks for the hint.

[scholzri]

Hi,
I compiled keepassxc with keepassxreboot/keepassxc#9397 an pynitrokey with Nitrokey/pynitrokey#393
Then, I added a secret to the second HMAC slot with nitropy nk3 secrets add-challenge-response 2 $(echo 20-byte-secret | base32)
I can list it with nitropy nk3 secrets list but cannot get it to be detected in keepassxc.

Am I missing something here?

[szszszsz]

Hi @AdmerStroh,

1. Make sure you are building KeepassXC with Yubikey support - WITH_XC_YUBIKEY switch. This covers all devices implementing this protocol. You can use ccmake to configure the build in a TUI.
2. The communication happens over pcscd - check if it is not blocked by other application. Perhaps try to restart pcscd service.

[scholzri]

Hey @szszszsz ,
for me, pcscd was not started at boot. Starting it manually fixed my problem and the Nitrokey 3 gets detected in keepassxc.

Thank you for that hint in the right direction! :)

[szszszsz]

Thank you for testing!

[szszszsz]

For the completeness I have added to my original reply a link to the low-level tests in case anyone would like to use the response in his custom solutions. The solution is generic enough to support virtually infinite Yubikey's-like HMAC slots.
However the recommended way is to use FIDO2's HMAC challenge-response, as a more standardized and flexible tool.

Closing as done. Transforming this into actionable task.

[orolhawion]

I would just like to confirm that challenge response through fido2 is broken in nitropy 0.4.37 as assumed by @szszszsz in an earlier post.

[orolhawion]

With nitropy 0.4.38 I can use the secrets app to create an HMAC-SHA1 challenge response credential. Why is the secret limited to 20 bytes? I use a secret with 40 bytes with my yubikeys and would like to do so with NK3.

The FIDO2 way is still broken.

[szszszsz]

Just for the final note, the KeepassXC support for Nitrokey 3 was just released.

@orolhawion I've registered your request for longer secrets at Nitrokey/trussed-secrets-app#89

[bhmarscheck]

The release notes for 1.6.0 states that it "Remove challenge response authentication method". Does this mean I can't use my nk3 for unlocking my KeepassXC if I update my firmware?

[robin-nitrokey]

No, these are two different things:

• The challenge-response authentication that is “removed” in 1.6.0 was used for authentication towards the device, i. e. unlocking data that is protected with a PIN. It used a challenge-response mechanism instead of sending the user PIN to the device. Actually, this feature was already disabled in previous releases, this release just completely removes the code that was used for it. So the changelog is somewhat misleading here. I will remove the line.
• The HMAC challenge-response used for KeepassXC is a special credential type and is not affected by this change.

[bhmarscheck]

Thank you for clearing that up and responding so fast. I almost had a heart attack reading that line when I was about to do a firmware upgrade.