How safe is cryptomator? How strong its encryption?

[Rahulkumar2020]

@SailReal bro, police claim that it can unbreak any security system. Can decrypt any data. So my question is suppose i provide them a folder encrypted by cryptomator in a pendrive. Then can anyone in this world decrypt that data without knowing password? **

Can data encrypted using cryptomator be decrypted? Any chances and required time ?

** I am a already a cryptomator pro user so please be honest.

[Michael]

You might be interested in this thread:

Master password entropy

Lets say that i’m very happy with the security of the vault protected by its 256 bits keys. Lets also say i do not really understand the intricacies of cryptographic keys, entropie and such. Let say further i have no need for a simple master password because a password manager is used. Lastly lets say i would like to have a master password complex enough that a brute force attack on the master key is as difficult as a brute force attack directly on the vault (i.e. without using the informatio…

There are some maths in it which will answer your question about „time & effort“ to bruteforce a Cryptomator encrypted vault.

PS: from my experience the statements in this Board are also for „non pro users“ always honest.
So what do you want to say with this hint?
I find this very presumptuous as it suggests “non-pro users” would be treated differently. That is not the case.

[SailReal]

There are even further discussions in this community about this topic:

I'm a future author and have some questions

You have to assume, that attackers are economically reasonable. This holds true for both, the digital and the real world. If a bank vault is known to contain $100, no sane robber would even attempt to get into it, since his expenses for planning the robbery would exceed the loot. So the real question is: How much is access to your data worth to the adversary? So you should choose your defensive means appropriately to make it economically unfeasible to attack you. I have done the calculations i…

Master-Key in der Cloud?!

Hallo @thoko111! Schön, dass du das kritisch hinterfragst. Lass es mich mal mit einem Beispiel beantworten: Der Trick liegt in der sogenannten Key Derivation Function (KDF). Wir setzen hier auf Scrypt mit einem Cost Factor von 2^15 (ehemals 2^14). Dies ist eine Funktion, die bewusst mathematisch so konstruiert wurde, dass sie eine gewisse Menge CPU-Zyklen und eine bestimmte Menge RAM benötigt. Nehmen wir zunächst einmal an, dass der Angreifer einen single-threaded Offlinebruteforceangriff (d.h…

@Michael

“non-pro users” would be treated differently. That is not the case.

Thanks Michael for pointing this out and it is absolutely true!

[Rahulkumar2020]

@Michael bro, this line is just to make myself assure. It doesn’t to raise question on anyone’s integrity. You can say i genuinely need answer of this question and by adding this line i am making sure myself that answer will be reliable 100%. Human tendency you can say. So please don’t take this as a question mark on your integrity.

[wormwood]

Let me ask this… where do you store your password? If found by the attacker, there would be little need for brute force.

And the keyfile? Do you store it unencrypted with the vault?

[marc123]

Let me give you a hint on how police will try to crack your vault.

Look how law enforcement circumvents end to end encryption in other apps!

If you are in an advanced industrial nation, there are other ways too if your data is sufficiently important.

By the way, is your password saved in the app or in your computer?!