Invalid composite key

2013-12-28
2013-12-30
  • Hi,
    after entering the password, Keepass only returns an "invalid composite key" message. The same is true for two backups, that were saved on other harddrives. (I just copy pasted the .kdbx file to a diff. location, once after the initial setup and then a few weeks after)

    The issue started occuring after updating from 2.22 to 2.23. However, even after deinstalling & reinstalling 2.22, or updating to 2.24 does it return the "invalid composite key" message.

    The password has to be correct, because I am using a 21-digit password that I copy paste from a diff. program into keepass.

    Since I only use keepass for non-email-accounts, I can reset all other passwords, however, without knowing why Keepass is randomly unable to open the database, I find it too risky to continue using.

    Anyone have an idea, where this "invalid composite key" error might come from?

     
  • Paul
    Paul
    2013-12-28

    KeePass cannot decrypt your database using the supplied key / master password. This could be because the password is wrong, or you are missing a key file, or you used Windows User Account, or a combination of the above. You could try searching for a key file - xxxxx.key.

    cheers, Paul

     
  • Thanks for the reply.

    Since I have never used a key file, nor Windows User Account, I went back to the password and noticed, that it had been altered since first generating it. I was able to restore the original password, which does open the KeePass database.

    Guess its time to find a different KeePass master password storing method.

     
  • develop1
    develop1
    2013-12-29

    Glad you were able to discover the corruptoin and reconstruct the correct password.
    You may wish to reconsider having a 21 digit master that you do not "know". The length seems like overkill and not knowing your master puts you at risk of losing access to your keepass database.

    It seems you would be much better served doing something else.
    One option is to create a sentence that is always true regardless of the passage of time/circumstances/likes/dislikes/births/deaths/marriages/politics.

    For example:
    "my sister Jenny was born 3 years before my bother Hank"
    this sentence is an easy way to construct the string:
    msJwb3ybmbH

    Most people would say 11 chars of "randomized" lowers/uppers/numbers is plenty strong and possibly faster than using another program to obtain your master key.

    If you use keepass often then you will end up repeating that sentence in your brain so much I doubt you will ever forget your sentence.

    You do want to make backups of your master key. You should be 100% sure that you never lose access. Do whatever can be done within in your circumstances. some might say that even masking tape to the underside of your bed frame is more preferable than losing access.

     
  • That seems to be a decent way of creating a password, without the risk of forgetting it, as it can be reconstructed by memory. Great advice.