Hi,
In my first testing of Cryptomator I’ve discovered that if I make several Vaults, say V1, V2, V3, V4, and save the recovery keys, I can then use the recovery key from V4 to make a new password for V1; and so on.
In other words, I actually only need a single recovery key, and can make passwords for any of my Vaults from it.
Is this true? Can I depend on this?
I’m attempting to set up my system for future emergencies, and I will have several Vaults and need to know what’s important to keep and why.
While it’s true that you won’t see any errors, you still won’t be able to recover V1 if you use the recovery key from V4. You should’ve noticed after unlocking V1 that the vault is empty.
When a vault is being created, a new secure random masterkey is being generated. So each vault is unique and V1, V2, V3, V4 can be distinguished from each other with their own recovery keys.
So yes, you can accidentally recover a vault with the wrong recovery key but that’s basically the same as if you’d exchange the masterkey.cryptomator file between V1 and V4. It’s actually intended that a recovery key is able to recover a vault even if the masterkey.cryptomator file is missing. At least from a technical point of view, this is currently not possible via the GUI if I’m not mistaken.
I didn’t check the Vault contents; I assumed successfully opening V1 meant V1 would be intact. In fact in two of my test Vaults (V3, V4) I didn’t even put anything in them, just named them, so I couldn’t have noticed.
Perhaps there are technical reasons for this, but as an end-user it still seems strange that Cryptomator will make a new password and open V1, based on a V4 recovery key, and yet delete all V1s contents.
But anyway, now I know this and can plan accordingly, so thank you again.
I realise there’s one more detail I forgot to add to the original post, which might have changed your reply. It’s this:
I used the identical password in V1 and V2 tests.
I did this to see if I could use the same Vault password for all my Vaults.
What I discovered was that Cryptomator:
a) allows me to do this
b) generates a DIFFERENT recovery key for the SAME password in V1 and V2.
I’m going to assume from your answer that this doesn’t matter, and I’ll still need the V1 recovery key to recover V1, and the V2 recovery key to recover V2.
However, I will go and test to make sure this is true (and that the Vault is empty if I reverse them).
If not, I’ll come back and report here and ask for more assistance.
The password of a vault is not the masterkey. It’s used to derive the masterkey. That’s why you can use the same password for different vaults that have different masterkeys (and a recovery key is basically a specific representation of the masterkey).
