From 951fa968480a861718371e25d7ca3f8106821100 Mon Sep 17 00:00:00 2001
From: Kyle Manna <kyle@kylemanna.com>
Date: Sun, 7 Sep 2014 16:43:04 -0700
Subject: [PATCH] YubiKey: Fix database locking

* Save the master seed upon first challenge so it can be used as a
  challenge at a later point.
* When verifyKey() is called, verify that the challenge is successful.
* Uncheck YubiKey box to not leak information about how the database is
  protected.

Signed-off-by: Kyle Manna <kyle@kylemanna.com>
---
 src/core/Database.cpp            | 17 +++++++++++++++++
 src/core/Database.h              |  1 +
 src/gui/UnlockDatabaseWidget.cpp |  1 +
 3 files changed, 19 insertions(+)

diff --git a/src/core/Database.cpp b/src/core/Database.cpp
index 5297c2ad3..22fc07230 100644
--- a/src/core/Database.cpp
+++ b/src/core/Database.cpp
@@ -183,6 +183,7 @@ QByteArray Database::challengeResponseKey() const
 
 bool Database::challengeMasterSeed(const QByteArray& masterSeed)
 {
+    m_data.masterSeed = masterSeed;
     return m_data.key.challenge(masterSeed, m_data.challengeResponseKey);
 }
 
@@ -256,6 +257,22 @@ bool Database::verifyKey(const CompositeKey& key) const
 {
     Q_ASSERT(hasKey());
 
+    /* If the database has challenge response keys, then the the verification
+     * key better as well */
+    if (!m_data.challengeResponseKey.isEmpty()) {
+        QByteArray result;
+
+        if (!key.challenge(m_data.masterSeed, result)) {
+            /* Challenge failed, (YubiKey?) removed? */
+            return false;
+        }
+
+        if (m_data.challengeResponseKey != result) {
+            /* Wrong response from challenged device(s) */
+            return false;
+        }
+    }
+
     return (m_data.key.rawKey() == key.rawKey());
 }
 
diff --git a/src/core/Database.h b/src/core/Database.h
index be022ae39..3f946a1cf 100644
--- a/src/core/Database.h
+++ b/src/core/Database.h
@@ -59,6 +59,7 @@ public:
         QByteArray transformedMasterKey;
         CompositeKey key;
         bool hasKey;
+        QByteArray masterSeed;
         QByteArray challengeResponseKey;
     };
 
diff --git a/src/gui/UnlockDatabaseWidget.cpp b/src/gui/UnlockDatabaseWidget.cpp
index a005d0e60..d6beb1339 100644
--- a/src/gui/UnlockDatabaseWidget.cpp
+++ b/src/gui/UnlockDatabaseWidget.cpp
@@ -33,6 +33,7 @@ void UnlockDatabaseWidget::clearForms()
     m_ui->comboKeyFile->clear();
     m_ui->checkPassword->setChecked(false);
     m_ui->checkKeyFile->setChecked(false);
+    m_ui->checkChallengeResponse->setChecked(false);
     m_ui->buttonTogglePassword->setChecked(false);
     m_db = nullptr;
 }