Max length of the password/passphrase?

[swisstico]

Hello Team,

Following this post:

What happens exactly when I change password of a vault?

I know that the encryption and MAC keys are derived from the password using masterkey.cryptomator and these keys are used to decrypt/encrypt the files. But when I change password of a vault, what happens exactly? I am able to read old files and also create new files, but the old password is gone which means the old encryption and MAC keys are gone which means I shouldn’t be able to read the old files but I am. Thanks in advance.

I was interested to know 2 specific details.

1. What is the max length that Cryptomator accept or read for a password or passphrase?
   (For example, Nextcloud 13 let you to enter whatever the length you want but read only the 72 characters)

2. Does the fact to have a weak password at the beginning, and change it stronger later make a weak encryption for the “old files” (reference to the post above), or the fact that there is a KEK don’t change anything about the encryption itself?

Thanks

[overheadhunter]

There is no maximum length. The whole password will be passed to our KDF. That said, there is no security benefit of entering a password with more entropy than the 256 bit key that is used after key derivation, i.e. a hundred random ascii characters.

Please note, that when creating vaults with very long passwords the password strength indicator will no longer measure your password strength for passwords longer than 100 chars due to a fix for a former UI freeze.