# KeepassXC: HMAC mismatch after restoring new backup file

**URL:** <https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269>\
**Category:** Challenge-Response\
**Created:** [March 11, 2021, 4:29pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269 "2021-03-11T16:29:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZorgroZ](https://avatars.discourse-cdn.com/v4/letter/z/96bed5/32.png) [@ZorgroZ](https://onlykey.discourse.group/u/ZorgroZ)\
**Post date:** [March 11, 2021, 4:29pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269/1 "2021-03-11T16:29:56Z")

</div>

Suddenly I am getting an “HMAC mismatch” when trying to unlock my KeepassXC database with the same Onlykey that worked a few hours ago.

What could cause this?

Could reflashing the firmware or restoring a backup have an impact?

---

<div class="post-metadata">

**Author:** ![Extrawdw](https://yyz2.discourse-cdn.com/free1/user_avatar/onlykey.discourse.group/extrawdw/32/60_2.png) [@Extrawdw](https://onlykey.discourse.group/u/Extrawdw)\
**Post date:** [March 11, 2021, 5:09pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269/2 "2021-03-11T17:09:51Z")

</div>

I met the issues today, but I have a backup of the secret key used so I just re-loaded the secret key.

I’m not sure way this happened, I do re-flashed the firmware but it may also just because I forgot to save the KeePass database.

I will test it… soon…

---

<div class="post-metadata">

**Author:** ![ZorgroZ](https://avatars.discourse-cdn.com/v4/letter/z/96bed5/32.png) [@ZorgroZ](https://onlykey.discourse.group/u/ZorgroZ)\
**Post date:** [March 11, 2021, 5:32pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269/3 "2021-03-11T17:32:04Z")

</div>

> [@Extrawdw](#):
>
> I have a backup of the secret key used so I just re-loaded the secret key

How do you know the secret key for the HMAC challenge-response?

---

<div class="post-metadata">

**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\
**Post date:** [March 11, 2021, 5:43pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269/4 "2021-03-11T17:43:14Z")

</div>

Yes, if you restore a backup that would restore the HMAC key from your backup to your key.

---

<div class="post-metadata">

**Author:** ![ZorgroZ](https://avatars.discourse-cdn.com/v4/letter/z/96bed5/32.png) [@ZorgroZ](https://onlykey.discourse.group/u/ZorgroZ)\
**Post date:** [March 11, 2021, 5:46pm UTC](https://onlykey.discourse.group/t/keepassxc-hmac-mismatch-after-restoring-new-backup-file/269/5 "2021-03-11T17:46:52Z")

</div>

> [@t11](#):
>
> Yes, if you restore a backup that would restore the HMAC key from your backup to your key.

Just verified that, and that seems to work indeed:

I have set the HMAC secret key to a randomly generated 20-byte hex sequence via onlykey-cli, taken a backup, restored it on another key, and that key works as hardware key for the KeepassXC database.

Still not sure what happened – I’ll keep an eye on this and report back if there are issues with this in the future.