Add support for Windows Hello

* Special thanks to @HexF and @smlu for their contributions towards this feature.

* Add MVP support for Windows Hello as a Quick Unlock solution using the WinRT API. This works by signing a random challenge vector with the Windows Hello protected key store (typically from TPM). The signed challenge is hashed using SHA-256 and then used as the encryption key to encrypt the database credentials. Credentials are encrypted using AES-256/GCM. This ensures the database password can only be decrypted following a successful authentication with Windows Hello in the future.

* Unify Touch ID and Windows Hello behavior under the Quick Unlock branding. Remove all timeout features of Touch ID as they are unnecessary and complicate the feature for no security gain.

* Quick Unlock is automatically reset only when the database key is changed vice whenever database settings are modified.

* Don't set database unlock dialog as always on top. This allows Touch ID and Windows Hello prompts to appear above the dialog properly.

* Prevent quick unlock when using AutoOpen or opening from the command line.

1 files changed, 55 insertions, 28 deletions

diff --git a/share/translations/keepassxc_en.ts b/share/translations/keepassxc_en.ts
index 71649a3e8..92d8de75d 100644
--- a/share/translations/keepassxc_en.ts
+++ b/share/translations/keepassxc_en.ts
@@ -509,14 +509,6 @@
         <translation>Lock databases after inactivity of</translation>
     </message>
     <message>
-        <source> min</source>
-        <translation> min</translation>
-    </message>
-    <message>
-        <source>Forget TouchID after inactivity of</source>
-        <translation>Forget TouchID after inactivity of</translation>
-    </message>
-    <message>
         <source>Convenience</source>
         <translation>Convenience</translation>
     </message>
@@ -525,10 +517,6 @@
         <translation>Lock databases when session is locked or lid is closed</translation>
     </message>
     <message>
-        <source>Forget TouchID when session is locked or lid is closed</source>
-        <translation>Forget TouchID when session is locked or lid is closed</translation>
-    </message>
-    <message>
         <source>Lock databases after minimizing the window</source>
         <translation>Lock databases after minimizing the window</translation>
     </message>
@@ -553,10 +541,6 @@
         <translation type="unfinished"></translation>
     </message>
     <message>
-        <source>Touch ID inactivity reset</source>
-        <translation type="unfinished"></translation>
-    </message>
-    <message>
         <source>Database lock timeout seconds</source>
         <translation type="unfinished"></translation>
     </message>
@@ -589,6 +573,10 @@
         <source>Enable double click to copy the username/password entry columns</source>
         <translation type="unfinished"></translation>
     </message>
+    <message>
+        <source>Enable database quick unlock (Touch ID / Windows Hello)</source>
+        <translation type="unfinished"></translation>
+    </message>
 </context>
 <context>
     <name>AutoType</name>
@@ -1475,10 +1463,6 @@ Backup database located at %2</source>
         <translation type="unfinished"></translation>
     </message>
     <message>
-        <source>TouchID for Quick Unlock</source>
-        <translation type="unfinished"></translation>
-    </message>
-    <message>
         <source>Unlock failed and no password given</source>
         <translation type="unfinished"></translation>
     </message>
@@ -1502,10 +1486,6 @@ To prevent this error from appearing, you must go to &quot;Database Settings / S
         <translation type="unfinished"></translation>
     </message>
     <message>
-        <source>?</source>
-        <translation type="unfinished"></translation>
-    </message>
-    <message>
         <source>Cannot use database file as key file</source>
         <translation type="unfinished"></translation>
     </message>
@@ -1577,6 +1557,26 @@ We recommend you update your KeePassXC installation.</source>
         <source>Database unlock canceled.</source>
         <translation type="unfinished"></translation>
     </message>
+    <message>
+        <source>Unlock</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to authenticate with Windows Hello</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Unlock Database</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Cancel</source>
+        <translation type="unfinished">Cancel</translation>
+    </message>
+    <message>
+        <source>Failed to authenticate with Touch ID</source>
+        <translation type="unfinished"></translation>
+    </message>
 </context>
 <context>
     <name>DatabaseSettingWidgetMetaData</name>
@@ -6838,10 +6838,6 @@ Kernel: %3 %4</source>
         <translation type="unfinished"></translation>
     </message>
     <message>
-        <source>TouchID</source>
-        <translation type="unfinished"></translation>
-    </message>
-    <message>
         <source>None</source>
         <translation type="unfinished"></translation>
     </message>
@@ -7770,6 +7766,18 @@ Please consider generating a new key file.</source>
         <source>Browser Statistics</source>
         <translation type="unfinished"></translation>
     </message>
+    <message>
+        <source>Quick Unlock</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to create Windows Hello credential.</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to sign challenge using Windows Hello.</source>
+        <translation type="unfinished"></translation>
+    </message>
 </context>
 <context>
     <name>QtIOCompressor</name>
@@ -8763,6 +8771,25 @@ Example: JBSWY3DPEHPK3PXP</source>
     </message>
 </context>
 <context>
+    <name>WindowsHello</name>
+    <message>
+        <source>Failed to init KeePassXC crypto.</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to encrypt key data.</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to get Windows Hello credential.</source>
+        <translation type="unfinished"></translation>
+    </message>
+    <message>
+        <source>Failed to decrypt key data.</source>
+        <translation type="unfinished"></translation>
+    </message>
+</context>
+<context>
     <name>YubiKey</name>
     <message>
         <source>%1 No interface, slot %2</source>