What exactly happens when you use 2FA with "Password" + "Yubikey HMAC" Login in KeepassXC?

Question

Usecase: KeepassXC is configured with a Passward + Yubikey HMAC.

I am trying to understand the exact steps that happen.

I think the first five Steps are clear:

1. Open KeepassXC
2. Enter Password
3. Select Hardware Key
4. Click unlock
5. Yubikey is blinking

Now comes the Part I struggle to understand.

The next steps beginning with step six are pure guesses, please correct me.

6. Does the KeepassXC Application send something like a challenge based on the entered Password to the Yubikey?
7. Touch Yubikey
8. The Yubikey computes the Challenge with the stored HMAC Secret and sends the result back to the KeepassXC Application.

Or are there more or different inputs than the password involved in the generation of the challenge, that was created from KeePassXC.

Answer 1

Disclaimer: the following is based on my understanding of the process, which may be incomplete.
To be sure, ask Janek Bevendorff directly.

During 'registration',

KeePassXC stores a HMAC secret on the Yubikey.

During authentication/decryption:

1. KeePassXC sends a challenge (the database's master seed) to the Yubikey:

• src/keys/drivers/YubiKeyInterfaceUSB.cpp#L261
• src/keys/drivers/YubiKeyInterfacePCSC.cpp#L753

2. Yubikey transform the challenge and returns the reply.

3. Yubikey constructs a composite key from (transformed) your password and Yubikey's reply and (optionally) your key file.

4. Your database is opened using this composite key.

Every time you save the database:

1. A new random seed is generated

2. A new composite key is constructed, using a predicted response(?) using this random seed

3. The database is re-encrypted using this new key.