Hey gva, there's something else you need to know about your passwords, and that is, it is they, that get stretched to be the size of your key.
so if your password is 'abc' and its stretched using, say, md5, it becomes a key, a string like d41d8cd98f00b204e9800998ecf8427e which has those 128...