AES-256-GCM: The Cipher Behind Every Inkrypt Note

The Advanced Encryption Standard is a symmetric block cipher selected by NIST in 2001, after an open international competition, from a design originally called Rijndael. Symmetric means the same key encrypts and decrypts. Block cipher means it operates on fixed 128-bit chunks of data.

It has been under sustained public analysis for over two decades. No practical break of full AES exists. Modern processors implement it directly in hardware, so it is both extremely well-studied and extremely fast — an unusual and valuable combination.

AES supports 128-, 192- and 256-bit keys. A common misreading is that 256-bit is "twice as strong" as 128-bit. It is not — the keyspace is 2^128 times larger.

Both are far beyond brute force. AES-128 is not breakable by any foreseeable classical computer. We use AES-256 partly for margin against future cryptanalysis, and partly because Grover's algorithm — a quantum search technique — would theoretically halve the effective key length, leaving AES-256 with a 128-bit security level and AES-128 with a 64-bit one. The cost of the larger key is negligible; the margin is worth having.

A block cipher alone only encrypts one 128-bit block. A mode of operation defines how to handle a message of arbitrary length — and the choice of mode has historically caused far more breakage than the cipher itself.

Older modes such as CBC provide confidentiality but not integrity. An attacker who cannot read your ciphertext can still modify it, and the recipient's decryption will happily produce altered plaintext without complaint. Padding-oracle attacks — which have broken real deployed systems — exploit precisely this gap.

Galois/Counter Mode is an authenticated mode. Alongside the ciphertext it produces a 128-bit authentication tag, computed over the encrypted data. On decryption, the tag is verified first. If even one bit of the ciphertext has changed, verification fails and decryption refuses to proceed rather than returning corrupted plaintext.

In practice this means a wrong password and a tampered note produce the same outcome: decryption simply fails. There is no state in which you read a note that is subtly not what the author wrote.

GCM requires an initialisation vector — 12 bytes, in the standard construction. The IV is not secret and is stored alongside the ciphertext. It exists so that encrypting the same plaintext twice produces different ciphertext.

GCM has one catastrophic failure mode: reusing an IV with the same key. Doing so does not merely weaken the encryption — it can allow an attacker to recover the authentication subkey and forge messages. This is not theoretical; it has broken production systems.

Inkrypt generates a fresh random IV for every encryption operation, including every re-save of an existing note, and a fresh salt with it — so each save derives a distinct key as well. The combination makes IV reuse under the same key structurally impossible in normal operation.