KDBX 5 Standard

[droidmonkey]

Placeholder for KeePass Database (KDBX) standard discussion. This post will be edited to include a list of features and upgrades we would like to bring to Dominik for consideration in the next KDBX format update.

Must Haves:

• Standardize on Argon2id instead of Argon2d
• Add Password Modification Datetime
• Database/Entry Custom Data modification time
• Built-in Entry Layout Specification (Add support for customizable entry layouts #863 (comment))
• Built-in TOTP Specification (otp attribute)
• Built-in Hardware Key Specification
• Built-in Quick Unlock Specification
• Built-in favorites/pinned items
• Only support straight binary key files
• Multi-valued core and custom fields
• Proper storage format for and deduplication of BLOBs (SQLite can handle this)
• Transactional edits/global history on database level, not entry level (e.g., to undo deletes or moves and to ensure overall consistency)

Nice To Haves:

• Custom icon naming
• Graph instead of tree structure (one item can belong to multiple groups, makes tagging somewhat redundant)

Optional Extensions:
None so far

Long form discussions should be held here: #5819

[droidmonkey]

Looping in @keepassium @mmcguill @PhilippC
Original issue that spawned this conversation: #4293 (comment)

[mmcguill]

Might be worth adding the idea of "Favourites" or "Pinned" items, items that appear upfront when user opens the database. It's a pretty popular/handy feature in Strongbox and it would be great to have it standardised across the KeePass world.

[georgesnow]

Curious do all the variant apps support tags? If so why not just standardize on a tag? Maybe “Pinned” (case insensitive). And document it that way?

That would mean those apps that want to support it can and it wouldn’t matter to any other platform (or native KeePass, MacPass,KyPass etc)

[georgesnow]

And if someone happens to add it as tag the first time just prompt them explaining the use of the “Pinned” as a tag

[droidmonkey]

@georgesnow that's exactly the reason to make it part of the standard instead of just arbitrarily deciding on a tag and gaining application concurrence. Tags might not be the best choice anyway since they are user defined and can conflict.

[georgesnow]

I am certainly not disputing adding the standard, which is always a better solution for something like this. However, seeing as the native KeePass tends to be conservative in their approach to making such changes (and understandably so).

The suggestion was more of interim solution (should have been clearer about that). That is just based on is there any reference for how long features take to get integrated in the KeePass standard?

The interim solution could be easily revertible or convertible by an app at later time when the new standard is implementated. It provides the benefit to the users now, but doesn't force compliance and break anything in other KeePass ports. I am certainly not saying it's ideal as you said due to user conflict issues. Again was just a thought, but sounds like thinking is not to do an interim solution and just wait, which I get.

[droidmonkey]

Correct, I am trying to avoid implementing a multitude of "minor" interim solutions. That creates significant code bloat with exceptions and workarounds depending on which version of the standard you are on. The myriad of plugins made for KeePass over the years demonstrates why this is not a good thing. They all made their own unique standards.

[user858753257]

Example from Enpass for tags :

Here they are user defined and the developers from Enpass using a pre defined “Apple Watch” Tag to display all entries on the watch which get tagged with this .

In my eyes “pinning” should be in the standard and tags only for special things a developer decide

[funnym0nk3y]

Is there a plan, when those features could be introduced in the standard and into XC?

[droidmonkey]

This would be a keepassxc 3.0.0 type move. Ideally we'd get Dominik on board with this as a well.

[funnym0nk3y]

Hmm, I guess 3.0.0 is still far away. Thanks anyway! Is somebody in contact with Dominik?