On this page
AES-256-GCM is the AES block cipher with a 256-bit key used in Galois/Counter Mode, an authenticated encryption method that keeps data confidential and lets the recipient detect if even one bit of the ciphertext was changed.
How it works
NIST standardizes GCM in SP 800-38D as authenticated encryption with associated data. Encryption takes four inputs:
- a secret key, here 256 bits;
- an initialization vector (IV), also called a nonce;
- the plaintext;
- optional associated data, which is authenticated but not encrypted, such as a header that says what the ciphertext is for.
It outputs ciphertext and an authentication tag. Decryption recomputes the tag. If the ciphertext, the IV or the associated data differs in any way, decryption fails instead of returning altered plaintext.
That second property matters as much as the first. Encryption without authentication can let an attacker flip bits in the ciphertext and change the decrypted result in predictable ways. GCM rejects such data outright.
The rule: never reuse an IV with the same key
SP 800-38D sets a strict uniqueness requirement for IVs under a given key. Reusing an IV with the same key can reveal the relationship between two plaintexts and allow forged messages. In practice, implementations generate a fresh random IV for every encryption and limit how much data one key encrypts.
How Crunu uses it
Crunu encrypts environment contents with AES-256-GCM, both in the browser through WebCrypto and in the crunu agent in Go. The two implementations are checked against the same shared test vectors, so a value encrypted in one opens in the other.
Before encryption, content is padded to a multiple of 4,096 bytes. This hides the exact size of small files, though the server still sees roughly how large each version is and when it was saved.
Each environment has its own key, which is sealed to every key holder with X25519. GCM's tag proves that the data was written by someone who held the key. To show which member wrote a version, Crunu adds an Ed25519 signature from the author on top. See how encryption works.
Sources
- NIST SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, checked October 27, 2026.
From the blog
Security
Why a vault vendor can’t reset your password
With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.