Old password with old vault backup can decrypt current vault

Version

master

Source

GitHub

Vault encryption

Yes

Device

N/A

Android version

N/A

ROM

No response

Steps to reproduce

1. Create a new encrypted vault with a password
2. Add a vault entry called "BEFORE"
3. Setup vault backups and/or export encrypted vault
4. Change the vault password
5. Add a vault entry called "AFTER"
6. Backup/export the vault again
7. Use the old/original vault password to decrypt the master key on the first backup/export
8. Use that master key to decrypt the newer vault. Note that both "BEFORE" and "AFTER" are accessible without knowing the new password.

If a backup password is configured, either change the backup password instead of the vault password, or remove the backup password for this test.

What do you expect to happen?

An old vault and old password should not be sufficient to decrypt a newer or older version of the same vault that use a different password.

Changing the vault password should generate a new master key.

What happens instead?

An attacker with access to vault backups and an old vault password can decrypt newer and older versions of the same vault that use a different password.

Log

No response