3

I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery.

How can I create a file that is printable on paper in such a way that I can use it to recover the keyfile? I surely have to take care that only printable characters are used, but are there more gotchas to this?

Edit: To rephrase the question, is there any difference between a paper key and a paper keyfile? I believe the used file system is transparent to the file and with redirecting the output on linux using > operator I should be able to create a file containing 1:1 what was read from my preferred source of entropy. In term of ease of recovery, QR-Code and similar (Data Matrix?) might be acceptable.

a) Am I missing something? b) In comments somebody linked a tool (thx!) are there more handy / widespread ones? I would prefer to not need to install a python environment to be able to create a paper keyfile.

BernB
  • 33
  • 4

2 Answers2

5

My suggestion would be to directly print Base64 and print a QR-code of the same Base64.

The plain base64 is a tedious fallback if all else fails. You could also print it using OCR fonts for better scanning.

The QR-code provides a simple paper to digital conversion format with built in error checks. If the base64 keyfile is too large for a single QR-code, split it into multiples.

This avoids proprietary tools.

Example:

#Make a 1KB (8K bits) file of random binary data to simulate a key

dd if=/dev/urandom of=binrand.bin bs=1K count=1

#Convert binary to Base64

base64 binrand.bin > binrand.mim

#Create a QR-code where -l {LMQH} specifie error correction level from L (lowest) to H (highest). (default=L)

qrencode -l Q -r binrand.mim -o qr.png

Print Page

Base64

HVLzBlR23pVoxpR1pAzoatQsblSEri35xIMrpSxBL2Sjcgy8slKeEtr6KaEevPjeMY/ZvlPcSxJA
G4cRt30ASAxQUIrLUyY/nAKLsWLUFqwUGQ2HJ/VIZ2PIcEDxNthq/LQJrSLeIiXfaGTFtGO7w1J2
qmPPzipXe4TS8PVz3yu0AiPPTrByv/JkkH0JFkld/llXJPK8ZK1lC8bKrrmfupzuckar7uF87WGU
lkkbcjwR0tPSRjk/MHcdDeX8fbvhECpGhlCcAD9IGa0otJRUfIoJ1QQh9ppZbdgEbuKwdbmYRaq4
uab4GlzAs8YDQsZifBrLf4eSZN9fdMIb35u7TFULYpUwqojRzehkUzPZWKscLGkP4PYPHYFnfo5k
Po6PPBpHypm8xkz+ZpCWCQl2MWRLUut9RoB9kFbDU6XdmIuFWGUHxGaVmYXWfDyYGnx3JMl4GEYO
EAlo/6e6haWr4YI7CB0E7rMjHvLVyPgWT0JHLNmN8a6PMZrkBDisINpGE0oyep7431Lt046urjzI
mU1c6NWVtIqw2dnn6Ps70pMtpFpoITl3CFtut7eGvmlnIVVOktv5po6i9C6QAC72LB4O7sCn9fLl
M7SX/YIY2hUC/9Nya+HZ7rVyw4YLy2HZ53stxEDxMKg4n7uZKxk3+zbnsXjZHiykooLa5s10rtpJ
dTxe32cvusdYWlDgJLyb5RqSSuG3PV8hhT9k6gYDrPG0ZvTaD4wBSrQivZNFCKnvbf8FOhEcMgfL
gvG2wSQ+TlE1Hh97+C1VxIcaqd+L4A8fFKVZ4qM6gnKNWbbZujqiCfFp0Azspd1DrOs0Ch1XJBEB
mfBeFPIcI5WFDNVp6eXdiS9xevPqlYjj+QEjYjrmfeDYEkEaYtSx5mL16kCpgd5m4FE2+FgwuYs4
H2ykqOi9zzDpPXiB3gvvXkhuw5dm8dP16ZDIg20ZAm4MqSSpwF/xiCyqw9eKNeIB+YDQ9I4hUpZ8
GWf/51pxbyUzB0cFgQ7uHut86CwEOMegjDwFZ5y46Loc5zgJCN04qk67srFA5/Jyd2uPJxJLd5Bh
VYbogQYPsOWBmx0yyXKzR5FyNBseSjOo7r5Q3HqHuwlGstS7MBwjnLWoUPOBjZfT/AwSAGqjhNUV
nliO7XqgfgCHXautAUBygZASj8Fqu5j5YDRUE7rLtrcBBoI8x9RIRwLpjkq3TydJ+x53bKmzS07P
stC2mLdmY+1iiKVp1Hc+dMGSghcdA5/HVCqrxfWktOCmd3utz8j0apWCCirznndgR63/fq4SihRt
c2irRgMxYBZPHKdjFZNCvNZMLg/R3j+3BWfOB3XLVg9WyqOeVH989Q/pGLecCZYqCIjBFho8FA==

QR-code

QR-code Example

user10216038
  • 8,123
  • 2
  • 18
  • 22
  • 1
    I'm upvoting because of portability and proven readability/reliability in the industry. It would be nice to add a reversible shell pipeline that cut the data into chunks, fed it into qrencode and merged the png's into a single PDF in this answer. Might do the edit myself if I find the time. – Albert Gomà Oct 23 '20 at 05:50
  • Awesome! That looks like what I have been looking for :). I think I will have no problem to figure out how to reverse the procedure, but for the sake of completeness and if others find this solution, would you mind to also show how to recover the keyfile from the qr code? – BernB Oct 23 '20 at 07:36
  • 1
    @BernB - Most QR-code applications can recover the data. I checked it by holding my smart phone in front of the screen image and selecting the QR App. You can also feed the image to a desktop based QR-code reader. – user10216038 Oct 23 '20 at 15:10
  • 1
    @BernB - A general purpose Linux barcode utility (including QR) is zbar, of which zbarimg will import a file image and decode it. – user10216038 Oct 23 '20 at 19:59
1

I still have the best Results using the PaperBack tool. It was able to automatically recover all data I printed until now, even a more than six year old copy printed using an inkjet printer that was bleached out a bit already.

I described my exact process here. I don't trust the included encryption, so I always encrypt the files with a different software.

The tool is windows only but open source and works fine using wine.

To your question "is there any difference between a paper key and a paper keyfile?":

A keyfile can contain arbitrary binary data. You cannot print that. Even if you where to only use basic ASCII, how would you get the difference between a space character or a tab character? How would you see the difference between a windows or a unix linebreak on paper? How would you see if there was just the end of the paper reached or an actual linebreak in the data? Even if you use just visible ASCII characters, you have to make sure to know which encoding was used in the file, if there is a linebreak at the end of the file (on Unix/Linux systems it's hard to create a file without one), if yes, which linebreak, is there a BOM marker at the start of the file, ... And you either need to write all of that down or remember it when entering the data again. So I wouldn't suggest that.

To not deal with that, you need to encode the file. You can encode it to text, e.g. Base64, or to something image based. The downside of simple base64 is, that you have to use OCR or type the letters and there is no redundancy and no error check. If you misread a letter, you get a keyfile. It is just not the correct one.

Better systems solve that by having error checking and even redundancy based error correction. So even if part of your printed key is unreadable, the error will be automatically corrected and you get the correct keyfile. And if too much is damaged, you get at least the information that the print is defective and not a wrong keyfile.

Josef
  • 5,973
  • 26
  • 34