AES-256-GCM
AES-256-GCM is Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode. It provides confidentiality and authenticity in a single primitive and is the industry default for authenticated symmetric encryption.
How it works
AES-256 encrypts data in 128-bit blocks under a 256-bit key using 14 rounds of substitution-permutation. GCM turns the block cipher into a stream cipher by encrypting a counter, and computes an authentication tag using Galois-field multiplication over the ciphertext and associated data. Decryption is a single pass that also verifies the tag; a mismatch aborts decryption before any plaintext is returned. GCM requires a unique 96-bit nonce per encryption under the same key.
Why it matters
Authenticated encryption prevents attackers from silently mutating ciphertext. In a wallet, an attacker who could flip bits in an encrypted vault could steer decryption into revealing partial state or triggering unsafe code paths. AES-256-GCM makes any tampering visible: decryption fails cleanly and the app refuses to proceed.
Related concepts
- KEK (Key Encryption Key) — A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly.
- Argon2id — Argon2id is a memory-hard password-hashing function and the winner of the 2015 Password Hashing Competition.
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- Android StrongBox — StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore.
Frequently asked questions
Is AES-256-GCM quantum-safe?
Grover’s algorithm halves the effective key size, so AES-256 retains a 128-bit post-quantum security margin — still comfortably strong.
Why 256-bit and not 128-bit?
Both are secure today; 256-bit gives more headroom against future analytical and quantum improvements at negligible performance cost on modern hardware.
What if a nonce is reused?
GCM catastrophically fails under nonce reuse — the attacker can recover the authentication key. Veyrnox uses random nonces from a counter to guarantee uniqueness.
In Veyrnox
Veyrnox encrypts the on-device vault, Shamir shards, and cached session state with AES-256-GCM under Secure Enclave–bound KEKs. Every ciphertext carries a fresh nonce and an authenticated tag; any tampering blocks unlock.