AES-256-CBC (Cipher Block Chaining), the algorithm used to encrypt Vault, is a standard cryptographic algorithm and is used by the US government and other government agencies worldwide to protect top-secret data. With proper implementation and strong enough Encryption Keys (from a user’s Master Password), the AES-256-CBC algorithm is proven unbreakable.
AES-256-CBC is an encryption system using AES specifications with key K of 256-bit length, and is in the CBC mode of operation. The input data is stretched and divided in to blocks Pi of fixed length, then
With block P1, perform XOR operation on P1 with initialization vector VI:
PP1=P1⊕VI
Encrypt the result PP1 from step 1 with AES and key K:
C1=AESE(PP1,K)
From block P2 onward, Pi is XOR-ed with the encrypted output of the previous block:
PPi=Pi⊕Ci−1
Ci=AESE(PPi,K)
The cipher text blocks Ci are concatenated into the final cipher text:
C=C1∣∣C2∣∣...
The decryption process has a reversed flow with cipher text C being divided into blocks Ci.
Decrypt block C1 with AES and key K:
PP1=AESD(C1,K)
Perform XOR operation on PP1 with initialization vector VI to retrieve plaintext block P1:
P1=PP1⊕VI
From block C2 onward, PPi is XOR-ed with the decrypted output of the previous block:
PPi=AESD(Ci,K)
Pi=PPi⊕Ci−1
The decrypted plaintext blocks Pi are concatenated to restore the original plaintext: