Does password length affect AES encrypt/decrypt velocity?

Question

I'm implementing crypto in Node, following this article: https://lollyrock.com/articles/nodejs-encryption/

It defines:

var crypto = require('crypto');
var algorithm = 'aes-256-ctr';
var password = 'd6F3Efeq'; // AKA passphrase

Then, it uses the password/passphrase for encrypt and decrypt the strings. Now, here my question: Is the password length going to change the encrypt/decrypt velocity?

For example: is the password/passphrase d6F3Efeq going to take less time to encrypt/decrypt than d6F3Efeqd6F3Efeqd6F3Efeqd6F3Efeq?

Edit: This is the way that the password/passphrase is used:

function encrypt(text){
  var cipher = crypto.createCipher(algorithm,password)
  var crypted = cipher.update(text,'utf8','hex')
  crypted += cipher.final('hex');
  return crypted;
}

function decrypt(text){
  var decipher = crypto.createDecipher(algorithm,password)
  var dec = decipher.update(text,'hex','utf8')
  dec += decipher.final('utf8');
  return dec;
}

PS.: I know that using createCipher is a bad idea and I should use other non-deprecated functions (like http://www.levigross.com/2014/03/30/how-to-write-an-encrypt-and-decrypt-api-for-data-at-rest-in-nodejs/), but I'm not asking about which crypto algorithm is better. I'm asking only about velocity/performance.

Answer 1

No, password length does not perceptibly change encryption throughput. That's valid for overwhelmingly most password-based encryption schemes using AES-256, especially the secure ones.

More precisely,

• The time it will take to encipher an extra kilobyte of data is fully independent of the password length. That's because the password is first transformed into a 256-bit key, and then this key is used for encryption/decryption/authentication, and the throughput of that later step does not depend at all on the value of the AES key (that would be a weakness of the AES implementation).
• Even the time it takes to encipher/decipher/authenticate the first kilobyte does not perceptibly depend on the password length, for reasonable size thereof (say, up to 55-byte password, often much more). That's because the code that transforms the password into key falls into one of two categories:
  • Slow: for these, up to said limit at least, execution time depends almost only on parameters adjusted to slow things in order to make password search suitably difficult.
  • Fast, thus of negligible cost w.r.t. the rest. CAUTION: these are extremely vulnerable to password search.

Note: 55 bytes is a limit above which some common hash algorithms (SHA-256..) see their computation time abruptly increase, because they process their input data split into 64-byte blocks, and there's an overhead of 9 bytes.

Note: this answer is independent of the nodejs context. The linked page gives zero clue about how the password is changed to key, and this site is not about language-specific questions.