Add Require PIN / Touch option to HMAC secrets

[tpikonen]

In the Passwords tab, when adding TOTP, HOTP or 'None' type passwords there are check boxes 'Require PIN' and 'Require touch'. The HMAC secret type ('HmacSlot2') does not allow these options to be set.

Requiring touch interaction (or PIN input) when retrieving the HMAC secret would be nice to have.

[kevin0t]

I think nitrokey3 firmware itself does not support touch or pin function for hmac challange-reponse function. So setting it from the nitrokeyapp2 won't do much.
I had checked with the cli nitropy package , which allowed setting a pin and touch confirmation but it does not really enforces it for the challenge-response function. Like when using it with keepassxc , it unlocked vault automatically without touch response required.
So i think this feature is not impelmented in firmware itself.
Also to note the client should also support pin entry or touch for hmac challenge-response function

Also personally I don't feel hmac-sha1 has that much use cases right now. Hopefully a more secure and open protocol called fido2-hmac-secret extension would replace this function in future software clients . Keepassxc is also working on implementing this.

[tpikonen]

I think nitrokey3 firmware itself does not support touch or pin function for hmac challange-reponse function.

Thanks for checking this, I kind of expected this to be the case.

I was thinking of using Nitrokey as an additional factor in Keepassxc, but if the touch or PIN confirmation is not supported, then it's not worth it. Hopefully the FIDO2-HMAC-secrets are implemented soon.