Properly use files that have keys

Question

Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep my PC regularly updated, and I have a good internet security program in addition to Malwarebytes.

Obviously, storing the key and password database together isn't recommended, what is the recommended way of storing the database key?

Would keeping the password database on my computer, and the key on a USB drive be secure? When I want to use the database I just plug in my USB, and point KeePass to the location of the key and enter my password.

Answer 1

Personally, I would recommend storing the file key on something that has protections in and of itself, such as an Apricorn FIPS 140-2 Level 3 validated flash drive, many of which allow you to set the brute-force protection, i.e. how many bad PINs entered until the drive erases itself.

The FIPS 140-2 Level 3 validation also indicates there are some protections against physically disassembling it to get at the critical security parameters.

Shove that in a nice safe, and you're as good as you can get, except for any file copies your own OS hosting KeePass/Veracrypt takes, of course, but that'll always be the case. Ideally have a KeePass machine be 100% offline, like a Raspberry Pi2 with the ethernet jack full of epoxy and no files moving out at all (again, Apricorn devices wiped via their physical keypad after they're unplugged work).

Answer 2

There are three methods used for authentication: something you know, something you have, and something you are. The first is generally a password. A key file is an instance of the second, something you have. The more of these methods you use together, the more secure your database.

Your issue would be an attacker stealing the key file. Having it on a separate USB is a good plan, but an attacker could still steal it. I always use a password as well a key file.

You might also want to invest in a hardware token, such as Yubikey, if you were really paranoid. That would make it very difficult for an attacker to extract that portion of the key, even if they stole the key itself.