{"action":"created","issue":{"url":"https://api.github.com/repos/brush701/keechallenge/issues/28","repository_url":"https://api.github.com/repos/brush701/keechallenge","labels_url":"https://api.github.com/repos/brush701/keechallenge/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/brush701/keechallenge/issues/28/comments","events_url":"https://api.github.com/repos/brush701/keechallenge/issues/28/events","html_url":"https://github.com/brush701/keechallenge/issues/28","id":266488983,"node_id":"MDU6SXNzdWUyNjY0ODg5ODM=","number":28,"title":"Why does this need to know the private key for challenge-response?","user":{"login":"Morthawt","id":8930966,"node_id":"MDQ6VXNlcjg5MzA5NjY=","avatar_url":"https://avatars3.githubusercontent.com/u/8930966?v=4","gravatar_id":"","url":"https://api.github.com/users/Morthawt","html_url":"https://github.com/Morthawt","followers_url":"https://api.github.com/users/Morthawt/followers","following_url":"https://api.github.com/users/Morthawt/following{/other_user}","gists_url":"https://api.github.com/users/Morthawt/gists{/gist_id}","starred_url":"https://api.github.com/users/Morthawt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Morthawt/subscriptions","organizations_url":"https://api.github.com/users/Morthawt/orgs","repos_url":"https://api.github.com/users/Morthawt/repos","events_url":"https://api.github.com/users/Morthawt/events{/privacy}","received_events_url":"https://api.github.com/users/Morthawt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-10-18T13:16:34Z","updated_at":"2018-06-23T03:51:11Z","closed_at":null,"author_association":"NONE","body":"Why on earth does it need this? If you send the Yubikey data, you get a result. I have a different variant of Keepass and it has built in Yubikey c/r feature. It does not require the private key.\r\n\r\nIn my imagination, I imagine the user enters a password, the program salt-hashes it and passes that to the Yubikey and gets the response and adds that to the salted hash, then salt hash all of that and use that for the encryption key. No secret key of the Yubikey needed. But yours asks for the secret and makes me feel uneasy using it. Can this be explained so that I understand it, or it be changed to not require the private key? The private key is not always accessible after the fact when you are already using your Yubikey all over the place. Nothing else I have used needs to know the key."},"comment":{"url":"https://api.github.com/repos/brush701/keechallenge/issues/comments/399628043","html_url":"https://github.com/brush701/keechallenge/issues/28#issuecomment-399628043","issue_url":"https://api.github.com/repos/brush701/keechallenge/issues/28","id":399628043,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTYyODA0Mw==","user":{"login":"whinis","id":7612064,"node_id":"MDQ6VXNlcjc2MTIwNjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/7612064?v=4","gravatar_id":"","url":"https://api.github.com/users/whinis","html_url":"https://github.com/whinis","followers_url":"https://api.github.com/users/whinis/followers","following_url":"https://api.github.com/users/whinis/following{/other_user}","gists_url":"https://api.github.com/users/whinis/gists{/gist_id}","starred_url":"https://api.github.com/users/whinis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whinis/subscriptions","organizations_url":"https://api.github.com/users/whinis/orgs","repos_url":"https://api.github.com/users/whinis/repos","events_url":"https://api.github.com/users/whinis/events{/privacy}","received_events_url":"https://api.github.com/users/whinis/received_events","type":"User","site_admin":false},"created_at":"2018-06-23T03:51:11Z","updated_at":"2018-06-23T03:51:11Z","author_association":"NONE","body":"@Morthawt I am just starting into keepass plugins because I rather like the added benefit of my yubikey. That being said if I had to guess why its not performed as you ask is likely because the plugin does not get passed the password or hash of the password even at any point.  From what I can tell from the code at https://github.com/dlech/KeePass2.x/blob/VS2017/KeePass/Util/KeyUtil.cs the password is calculated entirely separately and never get passed to any plugin. \r\n\r\nIn order to do what you ask the plugin would need to ask for another password since it doesn't get access to the user supplied master password. I am going to attempt to take over this project and am open to suggestions. I have currently forked the code, gotten it almost working in plgx format, and added slot auto-detect over at https://github.com/whinis/keechallenge"}}
{"actor":{"display_login":"whinis"}}