How In-Browser AES-256-GCM Cryptography Protects Your Data

The Advanced Encryption Standard (AES) with a 256-bit key operating in Galois/Counter Mode (GCM) is universally recognized by security agencies and cryptographic standards bodies as the world's most resilient symmetric block cipher. This paper details the inner mechanics of AES-256-GCM when executed through native browser hardware primitives.

1. Symmetric Block Cipher Fundamentals

Unlike asymmetric cryptography (e.g., RSA or ECC) which relies on separate public/private key pairs and high computational overhead, symmetric ciphers use the same secret key for both encryption and decryption operations.

AES operates on fixed blocks of 128 bits (16 bytes) arranged in a 4×4 matrix of bytes called the State. For a 256-bit key, the encryption algorithm executes 14 transformation rounds consisting of:

1. SubBytes: Non-linear byte substitution using the Rijndael S-box to resist differential and linear cryptanalysis.
2. ShiftRows: Cyclically shifting the last three rows of the State matrix.
3. MixColumns: Matrix multiplication over Galois Field $GF(2^8)$ to achieve rapid diffusion.
4. AddRoundKey: XORing each byte of the State with a subkey derived via the Rijndael Key Schedule.

2. Why Galois/Counter Mode (GCM) is Superior to CBC

Early web encryptors used Cipher Block Chaining (CBC) mode. CBC requires complex PKCS#7 padding and does not verify whether the ciphertext was modified in transit. This introduced catastrophic vulnerabilities such as the famous Padding Oracle Attack (POODLE).

Galois/Counter Mode (GCM) solves this by functioning as an Authenticated Encryption with Associated Data (AEAD) cipher:

• Counter Stream Generation: Encryption is performed by XORing plaintext with an encrypted counter stream, transforming the block cipher into a high-performance stream cipher.
• Galois Field (GHASH) Authentication Tag: As ciphertext blocks are computed, they are multiplied over binary Galois Field $GF(2^{128})$ to produce a 128-bit authentication tag. If any adversary alters even a single bit of ciphertext in transit, the GHASH tag mismatch causes decryption to instantly abort.

3. PBKDF2: Neutralizing GPU Dictionary Cracking

Human-selected passphrases rarely possess the full 256 bits of mathematical entropy required by AES. If a passphrase is used directly, attackers using GPU rigs can test hundreds of millions of guesses per second.

To counteract this, e204.store Vault Net utilizes PBKDF2 (Password-Based Key Derivation Function 2):

const key = await window.crypto.subtle.deriveKey(
  {
    name: 'PBKDF2',
    salt: crypto.getRandomValues(new Uint8Array(16)),
    iterations: 100000,
    hash: 'SHA-256'
  },
  keyMaterial,
  { name: 'AES-GCM', length: 256 },
  false,
  ['encrypt', 'decrypt']
);

By enforcing 100,000 iterations of SHA-256 combined with a unique 16-byte random cryptographic salt, each guess requires millions of hash calculations, making offline brute-force attacks economically and computationally infeasible.

4. The Web Crypto API Security Boundary

By utilizing window.crypto.subtle, cryptographic calculations are performed in native browser binary code rather than interpreted JavaScript loops. WebCrypto ensures constant-time execution for critical operations, protecting users from side-channel timing attacks.