|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Your KeePass database file is encrypted using a master key. This master key can consist of multiple components: a master password, a key file and/or a key that is protected using the current Windows user account. For opening a database file, all components of the master key are required. If you forget/lose any of the master key components (or forget the composition), all data stored in the database is lost. There is no backdoor and no universal key that can open your database. Master PasswordIf you use a master password, you only have to remember one password or passphrase (which should be good!) to open your database. KeePass features a protection against brute-force and dictionary attacks; see the security help page for details. Key FileA key file is a file that contains a key (and possibly additional data, e.g. a hash that allows to verify the integrity of the key). The file extension typically is 'keyx' or 'key'. A key file must not be modified, otherwise you cannot open your database anymore. If you want to use a different key file, open the dialog for changing the master key (via 'File' → 'Change Master Key') and create/select the new key file. Two-factor protection. A key file is something that you must have in order to be able to open the database (in contrast to a master password, which you must know). If you use both a key file and a master password, you have a two-factor protection: possession and knowledge. Location. As mentioned above, the idea of a key file is that you have something. If an attacker obtains both your database file and your key file, then the key file provides no protection. Therefore, the two files must be stored in different locations. For example, you could store the key file on a separate USB stick. Hiding the location. The key file content must be kept secret, not its location (file path/name). Trying to hide the key file (e.g. by storing it among a thousand other files, in the hope that an attacker does not know which file is the correct one) typically does not increase the security, because it is easy to find out the correct file (e.g. by inspecting the last access times of files, lists of recently used files of the operating system, file system auditing logs, anti-virus software logs, etc.). KeePass has an option for remembering the paths of key files, which is turned on by default; turning it off typically just decreases the usability without increasing the security. Backup. You should create a backup of your key file (onto an independent data storage device). If your key file is an XML file (which is the default), you can also create a backup on paper (KeePass 2.x provides a command for printing a key file backup in the menu 'File' → 'Print'). In any case, the backup should be stored in a secure location, where only you and possibly a few other people that you trust have access to. More details about backing up a key file can be found in the ABP FAQ. Formats. KeePass supports the following key file formats:
Reuse. You can use one key file for multiple database files. This can be convenient, but please keep in mind that when an attacker obtains your key file, you have to change the master keys of all database files protected with this key file. KeePass 1.x Only
In order to reuse an existing key file, click on the button with the
'Save' icon in the master key creation dialog and select the existing file.
After accepting the dialog, KeePass will ask you whether to
overwrite or reuse the file
(see screenshot).
KeePass 2.x Only
In order to reuse an existing key file, click on the 'Browse' button
in the master key creation dialog.
Windows User AccountKeePass 1.x Only
KeePass 1.x does not support encrypting databases using Windows user account
credentials. Only KeePass 2.x and higher support this.
KeePass 2.x Only
KeePass can make the database dependent on the current Windows user
account. If you enable this option, you can only open the database when
you are logged in as the same Windows user when creating the database.Be very careful with using this option. If your Windows user account gets deleted, you won't be able to open your KeePass database anymore. Also, when using this option at home and your computer breaks (hard disk damaged), it is not enough to just create a new Windows account on the new installation with the same name and password; you need to copy the complete account (i.e. SID, ...). This is not a simple task, so if you don't know how to do this, it is highly recommended that you don't enable this option. Detailed instructions how to recover a Windows user account can be found here: 'Recover Windows User Account Credentials' (a short technical tutorial can be found in a Microsoft TechNet article: 'How to recover a Vault corrupted by lost DPAPI keys'). You can change the password of the Windows user account freely; this does not affect the KeePass database. Note that changing the password (e.g. a user using the Control Panel or pressing Ctrl+Alt+Del and selecting 'Change Password') and resetting it to a new one (e.g. an administrator using a NET USER <User> <NewPassword>
command) are two different things.
After changing your password, you can still open your KeePass database.
When resetting the password to a new one, access usually is not possible
anymore (because the user's DPAPI keys are lost), but there are exceptions
(for example when the user is in a domain, Windows can retrieve the user's DPAPI keys
from a domain controller, or a home user can use a previously created
Password Reset Disk).
Details can be found in the MSDN article
'Windows Data Protection' and in the support article
'How to troubleshoot the Data Protection API (DPAPI)'.If you decide to use this option, it is highly recommended not to rely on it exclusively, but to additionally use one of the other two options (password or key file). Instead of backing up the Windows user account, you can alternatively create an unencrypted backup of the key using the 'Windows User Account Backup and Restore Utility'. As such a backup is not encrypted, it must be stored in a secure location. Protection using user accounts is unsupported on Windows 98 / ME. For Administrators: Specifying Minimum Properties of Master KeysAdministrators can specify a minimum length and/or the minimum estimated quality that master passwords must have in order to be accepted. You can tell KeePass to check these two minimum requirements by adding/editing appropriate definitions in the INI/XML configuration file. KeePass 1.x Only
The value of the KeeMasterPasswordMinLength key can contain
the minimum master password length in characters. For example, by specifying
KeeMasterPasswordMinLength=10 , KeePass will only accept
master passwords that have at least 10 characters.The value of the KeeMasterPasswordMinQuality key can contain
the minimum estimated quality in bits that master passwords must have. For example,
by specifying KeeMasterPasswordMinQuality=64 , only master passwords
with an estimated quality of at least 64 bits will be accepted.
KeePass 2.x Only
The value of the
Security/MasterPassword/MinimumLength node specifies
the minimum master password length (in characters). For example, by setting
it to 10 , KeePass will only accept
master passwords that consist of at least 10 characters.The value of the Security/MasterPassword/MinimumQuality node specifies
the minimum estimated quality (in bits) that master passwords must have.
For example, by setting it to 80 , only master passwords
with an estimated quality of at least 80 bits will be accepted.The Security/MasterKeyExpiryRec and Security/MasterKeyExpiryForce
nodes can be set to an XSD date or an XSD duration (see
XSD Date and Time Data Types).
If the master key has not been changed since the specified date or
if the time span between now and the last master key change exceeds
the specified duration, KeePass recommends/forces to change it.
These settings apply to all databases that are opened with this
KeePass instance; a master key expiry can also be configured for
each database individually (in 'File' → 'Database Settings' →
tab 'Advanced').By specifying KeyCreationFlags and/or KeyPromptFlags
(in the UI node), you can force states (enabled, disabled,
checked, unchecked) of key source controls in the master key creation and
prompt dialogs. These values can be bitwise combinations of one or more of
the following flags:
The values of KeyCreationFlags and KeyPromptFlags
must be specified in decimal notation.For example, if you want to enforce using the user account option, you could check and disable the control (such that the user can't uncheck it anymore) by specifying 263168 as value (0x40000 + 0x400 = 0x40400 = 263168). |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||