If the SMG is setup in Federal Information Processing Standards (FIPS) mode, it will follow the FIPS standard.
SMG in a non-FIPS mode follows no rule specifiying a maximum length of password.
If you wish to use FIPS mode, please see the article
Turning FIPS mode on or off.