AES-256 encryption explained

What AES-256 is, what the 256 means, why GCM matters and why the secret protecting the key matters more than the cipher.

If you have looked at privacy apps for a while, you have seen AES-256 on every page. It is a good thing to see. It is also far from the whole story.

What the words mean

AES stands for Advanced Encryption Standard. NIST published it as FIPS 197. It takes blocks of data and scrambles them using a key.

256 is the length of the key in bits. NIST’s standard also allows 128 and 192.

A mode explains how the cipher handles a file longer than one block. GCM adds an authentication tag, which means a modified file fails instead of opening with damage.

Your iPhone itself uses 256-bit AES for data protection, per Apple.

Where things actually go wrong

• Weak secret. If your key comes from a 4-digit PIN, someone with the files may only need 10,000 guesses, however good the cipher.
• Key stored beside the data. Encryption means little if the key sits nearby in plain form.
• Key held by a server. Someone other than you can decrypt.
• Copies outside the vault. Originals in your library, thumbnails and temporary files all count.
• Wrong use of the cipher. Repeated nonces in GCM can break it badly. This is why outside reviews matter.

How Backroom uses it

Each vault has a random 256-bit key. Each file is encrypted with AES-256-GCM in chunks, using a key derived from the vault’s key. Your pattern goes through PBKDF2 with 1,000,000 iterations to unlock that vault key. A pattern has less entropy than a long random password, so read the limits too. No outside party has reviewed this design yet.