Unlock DB by using Challenge-Response authentication

Initially I had proposed the one-time TOTP authentication system, but in both time-based and counter-based OTP (HOTP) there is a problem called synchronization, which, among other things, forces in case of problems to connect to the Internet to re-sync.

Wandering around the web I found this new authentication scheme called OCRA (One-time Challenge Response Authentication) which responds to RFC 6287.

What makes this new method particularly valuable?

Mainly it keeps security standards high and works without synchronization.

It will need to be equipped with some sort of external calculator (the token generator). If implemented in KeePass unlocking the database would work more or less like this:

1. The app (KeePassDX) queries the database which responds by proposing a challenge (typically 6 numeric digits).

2. From an already configured external generator I go to enter the challenge through the built-in button pad.

3. The generator "chews" and "spits out" another 6 pseudo-random digits.

Those six digits unlock the database. As soon as the session ends you will need to pass a new challenge. And the database will come up with more numbers...

That is all.


Here a conference about it:

https://www.youtube.com/watch?v=kBOhP7Hlvlg

Start by reading RFC 6287 and the issue's proposed challenge-response flow; no source file, test, or entry point is named. Map how KeePassDX currently unlocks the database and how an external OCRA calculator would interact with it. Done would require an agreed integration design and tests covering the challenge and response lifecycle.

Written by the indexing model from the issue text.