I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key.

Now I trust the developer of this plug-in who is Dominik Reichl, who also signs the KeePass releases, so I doubt this is some sort of KeePass-only feature that won't actually increase file security.

How can we use HOTP to as a factor to derive a key suitable for file encryption?

This is especially puzzling as it claims support for any HOTP client that complies to RFC 4226, which advises to compute the shared-keyed HMAC of a counter and then convert this into a decimal number and I really don't understand how one could leverage this number into a good source for the key.

  • $\begingroup$ @CodesInChaos I don't know for sure because I didn't inspect the source code in-depth enough but my strong guess is that no server holds the high entropy secret (although explaining how to use this assumption would be a nice bonus for a good answer) $\endgroup$
    – SEJPM
    Commented Apr 16, 2016 at 20:24
  • $\begingroup$ 1) It only claims HOTP, not TOTP support. 2) It might hash several consecutive OTPs to form a high entropy secret. If you repeat that process with many starting points and encrypt the same master secret with all of these possible one-time-keys, (essentially forming 1 of n secret sharing) you could get something workable. $\endgroup$ Commented Apr 16, 2016 at 20:37
  • $\begingroup$ @CodesInChaos, I fixed the title accordingly, it was a leftover from the draft. $\endgroup$
    – SEJPM
    Commented Apr 16, 2016 at 20:42

1 Answer 1


I had only a quick read through the source, and I am not particularly fluent in C#, so I may have gotten something wrong. That said the process appears to be:

  1. Generate a random encryption key, encrypt the database with it.
  2. Generate (up to six) HOTP tokens, derive a key from those, use that to encrypt the database key.
  3. To read:

    1. Ask for the HOTP tokens, derive the key, check that it matches.
    2. Decrypt the database key, so it can be read.
    3. Generate new HOTP tokens, use those to re-encrypt the database key for next access.

So by hashing several HOTP tokens you get enough entropy for a strong key – up to ~160 bits if you use the full six tokens with eight decimals each. Additional computational entropy may be added by the iterated hashing process.

By always encrypting the key with a new set of tokens you ensure they are only used once.

The HOTP secret is stored in encrypted form, so it can only be used to derive tokens when a set of matching tokens has been received.

  • $\begingroup$ Any idea whether a recovery procedure is implemented that allows one to decrypt the key when one pushed the HOTP button one time to often? $\endgroup$
    – SEJPM
    Commented Apr 17, 2016 at 9:38
  • 2
    $\begingroup$ According to this documentation feature request, you should be configuration option. $\endgroup$
    – Jakuje
    Commented Apr 17, 2016 at 9:51
  • $\begingroup$ I think recovery is something handled within KeePass rather than the plugin, not sure how it works. (The HOTP secret would be a sufficient backup key I guess.) $\endgroup$
    – otus
    Commented Apr 17, 2016 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.