bodnarsoft / keepass-smart-certificate-key-provider

KeePass plugin that allows to use Smart Card certificates to encrypt database more securely.

KeePass Smart Certificate Key Provider

This KeePass 2.x plugin is used to protect a KeePass database with X.509 certificate that is:

• installed in Windows My User account Certificate Store
• stored on a Smart Card.

Features

What the plugin can do:

• allows to use X.509 certificate installed in Windows
• allows to use X.509 certificate installed on Smart Card
• remembers last used certificate for a particular KeePass database, so you don't have to choose it during each unlock of the database

Compatibility

It should be compatible with any Smart Card, but it was tested only with:

• YUBIKEY NEO
• Gold Key Tokens

How it works with Smart Cards

After inserting USB token into PC, Windows will automatically install drivers (if not, please refer to USB token manufacturer pages to download additional drivers) and registers available certificates into yours Windows from Smart Card.
This registration is more like a link between the Smart Card and Windows, because of the security.

The certificate will never leave Smart Card, but Windows will mark it as a "link" and when you would like to use the certificate you would need to enter a PIN of the Smart Card to access selected certificate.

Why to use Smart Cards

With Smart Cards you add an additional level of security, ensuring that the KeePass Key file would not be compromised or stolen by some virus or malware.
Also if you lose your Smart Card, your certificates are protected by PIN and after entering 3 times wrong PIN, the Smart Card will be locked.

How the plugin works

It is pretty simple. The plugin will use X.509 certificate to digitally sign some predefined phrase, that is specified in the plugin, with private key of the certificate and uses the output of the signature as "secret key" for the KeePass database.

The plugin doesn't work with private key of the certificate directly, just uses API to generate hashed / encrypted digital signature.

rsa.SignData("some text ...", HashAlgorithmName.SHA1, RSASignaturePadding.Pkcs1);

Also if you use Smart Card, you can't access the private key of the certificate by standard API, because you are not allowed to!

You can check for more details about digital RSA signatures on internet like http://www.paradigm.ac.uk/workbook/metadata/authenticity-signatures.html

Plugin installation

1. download lates plugin from Releases
2. close running KeePass application
3. copy SmartCertificateKeyProviderPlugin.dll into KeePass directory (by default C:\Program Files (x86)\KeePass Password Safe 2)
4. start KeePass application
5. in Open database dialog you will see Key File dropdown, where you can select Smart Certificate Key Provider. This also applies for creating or updating KeePass database

Plugin uses cache that stores information about selected certificate to particular opened database, so you don't have to select same certicate again after database lock. This cache is only in protected memory so after closing KeePass apllication, the cache is lost.

Development requirements

The plugin is written in Visual Studio 2017 with C# and Microsoft.NET Framework 4.7.1.
The KeePass application is included in repository Dependencies folder so the project can be build without installation of the KeePass.

Documentation

You can find more details on Wiki pages.

License

This plugin is under MIT license.

keepass-smart-certificate-key-provider's Issues

If have several certificates of same type, then using with Smart Certificate Key Provider, popup allows select only latest one

Windows 10 LTSC 2021 (21H2) x64, Safenet Authentication Client 10.8 R6, Keepass 2.54, SmartCertificateKeyProvider v.2.0.1

If have several certificates of same purpose (suggestion, I have several types of certs on card) on smartcard, then using with Smart Certificate Key Provider, Windows Security popup window shows and allows select only the latest one.

I have a lot of Secure Email certs on card, both expired (but usable to decrypt old messages or DBs), and current. I've used one to encrypt Keepass DB, and, only the latest one shown in popup after issuing new certificate, and, it's not the certificate used to encrypt KeePass database.

So if encrypted sometime with one some purpose cert, when new certificate of same purpose issued, you lost access to Keepass database.

And, if I invoke CertUtil -SCInfo command, popup shows 'certificate list' dialogue showing all certificates on smartcard.

One database, multiple smart cards?

Is it possible to allow multiple smart cards to unlock the database? I'm trying to set this up at work where we have multiple people that access one database, but I can only seem to add just the one smart card.

(Also, just as a side note, this plugin is working perfectly with NHS Identity Service smart cards.)

Multi-User setup

Hey, I'm currently using this plugin for myself and it works well, thanks! I was wondering whether I could encrypt a KeePass database for multiple keys? So that I could share a database with colleagues and they could all encrypt/decrypt it with their own smart card?

certificate with expiration date

Hi, thanks your work in the great plugin. We want to secure the keepass-database with Active-Directory certificates. Its al workink well. But, they are valid for 2 years. what happens, when the certificate is expired and did not do anything? THANKS

ECC certifacate surpport

Thanks for this great plugin, but it does not support ecc certificate yet.
Is this possible & any plan?

Same certificate on multiple Yubikey

Hi,
I tried to do the best thing and upload the same certificate to more Yubikeys. But opening the database with the backup key is not working, KeePass says:

Selected certificate can't be used!
Reason: At least on the of the given parameters can't be interpreted correctly.

There's no other messages, details, nothing. I have a Yubikey 5C Nano and a Yubikey 5C NFC. I generated the certificate on the Nano, exported it then imported to the NFC model into the same slot. Windows doesn't show any difference between the certificates, when the selector pops up, I can see the same. After typing the PIN, I get access to the certificate but KeePass / the plugin doesn't accept/work with it.

Yubikey reset

Hello,

I locked my yubi so i had to reset it.

I exported the cert before that.

After the reset, I reimported the cert but it's impossible to open my database anymore...
Because of a private key problem?

Is there any way to open my database by overriding the key auth?

Compatible with 2.52+

Im not sure if this project is maintained anymore but is there any chances of getting it compatible with the latest release?

Remember certificate choice between launches

Thank you for this plugin, it does a great job allowing me to only remember my smart card's PIN and not another long passphrase ;)
I have multiple cettificates available on the smartcard and in windows' store; when I choose the right one at the prompt everything goes well, I can unlock the database and use it; and if I lock it I can unlock it later without choosing the cert again.
However If I close the application, I need to select the correct certificate again at launch. It would be nice if the associated certificate was remembered also between launches.

Omnikey 3021 support

Hello, tnx for developing this plugin!

I'm trying to use it to encrypt KeePass db using a self-signed digital id stored on a smartcard.

I'm using Omnikey 3021 to read the sc and SafeSign Token Administration Utility to manage it. I used openssl following to https://www.scottbrady91.com/openssl/creating-rsa-keys-using-openssl to create the digital id (pfx) and successifully imported it to the sc.

But when I go on Browse certificate store, the sc is read (it blinks 3 times) but PIN isn't requested and the Windows Security dialog opens saying no certificate is available.

For testing, I also followed https://www.sonicwall.com/support/knowledge-base/how-can-i-import-certificates-into-the-ms-windows-local-machine-certificate-store/170504615105398/ to import the certificate do Windows local store. I imported it to Current User and then it was found.

Might I be doing anything wrong? Maybe Omnikey isn't supported?

TPM-VSCs support

See if it can be modified to support TPM-VSCs (documentation: https://download.microsoft.com/download/5/A/B/5ABDDED2-F56E-427D-88C1-411EA0DBFF42/Understanding%20and%20Evaluating%20Virtual%20Smart%20Cards.docx ) in the future