AES-256-GCM and 600,000 PBKDF2 Rounds, Explained

Photo vault feature lists are full of numbers: AES-256, GCM, 600,000 rounds, PBKDF2. They are printed as if they settle the question, and most readers sensibly skip them. They are worth ten minutes. Knowing what each one does lets you tell a specific claim from an impressive-sounding one. This page explains each term in plain words. Then, in section 8, it sets out what encryption does not protect against. That second part is the one that changes decisions.

1. The short version

2. What AES-256 is

AES stands for Advanced Encryption Standard. It is an encryption method published by the US National Institute of Standards and Technology in 2001, after a public contest that ran for several years. It is not secret and nobody owns it. The design is public. Experts in universities and industry have studied it for more than twenty years and found no practical way to break the full method.

The 256 is the key size in bits. Trying every possible key of that size means searching 2 to the power 256 possibilities. That is not a matter of waiting for faster computers. It is far beyond anything ordinary computers could ever reach. In practice, this is why the method itself is almost never the part that fails.

That is exactly why "we use AES-256" tells you less than it seems to. It is close to the minimum. The interesting questions are what is encrypted, how it is used, and how the key is made.

3. What GCM adds

Encryption on its own keeps data secret: without the key, it cannot be read. On its own it does not promise the data is intact. It cannot tell you that what you are opening is what was put in.

That gap is real. With a method that does not check, someone who can change the stored file can alter the scrambled data. Opening it would produce different, wrong data, with no error. You get data back. It is just not the data that went in, and nothing tells you.

GCM adds the check. Alongside the scrambled data it produces a check value, and that value is verified every time the data is opened. From our own security paper:

This is the single most useful thing to look for in a feature list, because it is where precision shows. "AES-256" names a method. "AES-256-GCM" names a method and a way of using it, and that is where the tamper check either exists or does not.

4. Nonces, and the classic mistake

Every encryption in a GCM system uses a nonce, which means a number used once. It does not need to be secret. It needs to be unique for a given key.

Repeat a nonce with the same key and GCM's protection breaks down badly. This is not a rare edge case. It is the most common way real systems using GCM have been broken, and it comes from shortcuts in how they were built, not from any weakness in AES.

There are two sound ways to make sure it never repeats. One is a fresh random number for every encryption. That is what Obscura Photo Vault does for single files: a new 96-bit random number each time, with a 128-bit check value. The other is a counter that provably never repeats. That is what our format for large videos uses. It combines a random number chosen per file with the piece number, so no two pieces in any file share a nonce.

Neither approach is more correct than the other. What matters is that the app chose one on purpose. That is the kind of thing a published design document shows and a feature list cannot.

5. Your password is the weak link

A 256-bit key has 256 bits of randomness. Your password does not. Even a good passphrase has perhaps 60 to 80 bits, and a typical password far less. If the password were used directly as the key, the huge key size would not matter. An attacker would guess passwords, not keys.

The process that turns a password into a key is the bridge. PBKDF2 takes the password and a salt and runs them through a scrambling function again and again, a set number of times, to produce a key. The point of the repeating is cost. You make the key once per unlock and do not notice a fraction of a second. An attacker testing millions of guesses pays that cost on every single one.

This is the number to look for, and the one most often left out. An app can truthfully say it uses AES-256 while turning your password into a key in a single step. That would leave it open to exactly the offline guessing attack this process exists to prevent.

6. Why 600,000

The figure is not random, and it is not ours. The OWASP Password Storage Cheat Sheet is the most widely used public reference for this. It recommends PBKDF2 with HMAC-SHA-256 at 600,000 rounds or more. That is the number Obscura Photo Vault uses for vault passwords.

Two honest caveats belong with it.

It is a moving target. Recommended round counts go up as hardware gets faster. The current figure comes from testing against today's graphics chips. A number that was fine several years ago is not fine now, and today's will not be fine forever. Treat a published round count as a claim with a date attached.

It multiplies your password. It does not replace it. Rounds make each guess cost a lot more. They do not change how many guesses are needed. A password picked from a small set of options is still weak after 600,000 rounds, because an attacker only has to work through that small set. The process buys time in proportion to how hard your password already was to guess.

So the practical advice for any encrypted vault is dull and correct: use a long passphrase of unrelated words, and write it down somewhere safe. In an app where the key really is made from your password, that written copy is the only copy that exists. That is the subject of our guide on what happens if you forget your vault password.

7. Salts

A salt is random data mixed with the password before it becomes a key. It is stored next to the encrypted data. It is not secret, and does not need to be.

Its job is to stop attackers preparing in advance. Without salts, an attacker could work out the keys for a list of common passwords once, then reuse that list against every user of an app. With a unique random salt per vault, that work has to be done again from scratch for each target. Shared effort across users stops being possible.

Obscura Photo Vault uses a 32-byte random salt per vault, stored in the vault file's own header.

8. What none of this protects against

Everything above is about data at rest: files sitting in storage, not being used. That is real, useful protection. It is also narrow. Section 11 of our security paper lists what falls outside it. In plain terms:

• A phone compromised while the vault is open. To show you a photo, the app has to unscramble it. So the key and the readable photo are in memory. Anything running inside the app at that moment can reach both. No app-level encryption fixes a broken phone.
• Anyone who has your password. Encryption cannot tell the owner from someone who watched them type, or who was told.
• Screenshots, screen recording and shoulder surfing. What is on screen has already been unscrambled. This is outside what encryption covers.
• Copies you made elsewhere. The original still in your camera roll, the version you sent in a message, the cloud backup made before you moved it. Encrypting one copy does nothing to the others.
• The fact that the app exists. Encryption hides contents. It does not hide that there is something to hide.

The reason to say all this on a page that is otherwise about how good the building blocks are: in a real failure, the encryption method is almost never what went wrong. It is usually one of the five above.

9. On "military-grade"

The phrase has no technical meaning. It usually points at AES, which is a public standard anyone can use and is not reserved for the military. Every major operating system, browser and messaging app uses it.

The problem is not that the phrase is false. It is that it promises nothing. It names no method, no way of using it, no key size, and no process for turning a password into a key. So an app that encrypts every file can use it truthfully, and so can one that encrypts only its settings.

This is not a complaint about other people's marketing. Our own App Store listing uses the phrase in its first sentence. What makes a claim useful to someone trying to check it is what comes after: the method, the mode, the key process, the round count and what is covered. A listing that stops at the phrase has promised nothing. One that goes on to name those things can be checked, whatever it opened with.

10. Common questions

What does AES-256-GCM mean?

AES is a published encryption method. AES-256 is the version with a 256-bit key. GCM is a way of using it that also checks the data has not been tampered with. That check is the part that matters most day to day. A file that has been altered fails to open, instead of opening as quietly wrong data.

What is the difference between AES-256 and AES-256-GCM?

The second one names how the method is used, not just the method. GCM adds a tamper check, so altered data is caught when you open it, instead of coming back silently wrong.

Why do photo vault apps use 600,000 PBKDF2 rounds?

A password is short and guessable. An encryption key is not. So the password has to be turned into a key by a process that is slow on purpose. Each round adds work to every guess an attacker makes. 600,000 rounds is the number the OWASP Password Storage Cheat Sheet recommends for this method, PBKDF2 with HMAC-SHA-256.

Is AES-256 encryption safe?

AES-256 is a public standard. Experts have studied it for over twenty years and found no practical way to break the full method. In real apps, the method is rarely the weak point. A mistake in how it is used, a guessable password, or someone getting at the phone while it is unlocked are all more likely problems.

Is AES-256 better than AES-128?

The bigger key gives more margin. Both are considered secure against trying every key with today's methods and hardware. In practice, the choice between them is very unlikely to decide whether an app holds up.

What does \"military-grade encryption\" mean?

It has no technical meaning. It usually points at AES, which is a public standard anyone can use and is not reserved for the military. Because the phrase names no method, no mode and no key size, an app that encrypts everything can use it, and so can one that encrypts almost nothing.

Can quantum computers break AES-256?

The known quantum shortcut, Grover's algorithm, roughly halves the strength of a key like this. For a 256-bit key that still leaves a very large margin. That is one reason 256-bit keys are seen as a sensible long-term choice. The kind of encryption used to exchange keys over the internet has a much bigger quantum problem than AES does.

Is 600,000 rounds slow to unlock?

It takes a fraction of a second on a modern iPhone, once per unlock. That lopsidedness is the point: barely noticeable done once, crippling done millions of times.

Does more iterations mean I can use a weaker password?

No, and this is the most common misunderstanding. More rounds make each guess cost more. They do not reduce how many guesses a weak password needs. A short password stays weak.