AES-256-GCM
Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode. NIST FIPS 197 (cipher) + SP 800-38D (mode of operation). AES-256-GCM provides both confidentiality and authentication in a single operation — the primary symmetric cipher across SkyeConnex's storage substrate.
What AES-256-GCM provides
AES-GCM combines a symmetric cipher (AES) with a Galois mode that produces an authentication tag alongside the ciphertext. The tag is computed over the ciphertext plus optional Additional Authenticated Data (AAD). On decryption, the tag is verified before plaintext is released — meaning any tampering with the ciphertext or AAD is detected.
Why the 256-bit variant
AES is defined for 128, 192, and 256-bit keys. The 256-bit variant provides 256 bits of classical security and approximately 128 bits of post-quantum security against Grover's algorithm — meaning AES-256 remains the conservative choice for data with multi-decade sensitivity, including under harvest-now-decrypt-later threat models.
How SkyeConnex uses AES-256-GCM
Every file frame (~5 MB) is encrypted with AES-256-GCM using a per-file unique data-encryption key. The IV is deterministic and bound to (file_id ‖ frame_index) — preventing IV reuse, which is the primary failure mode of GCM. The AAD binds ciphertext to (file_id, frame_idx, encrypted_size) — meaning shard substitution attacks are detected at decrypt time.
Hardware acceleration
All major CPU architectures since 2010 ship AES-NI or equivalent hardware acceleration. Modern Intel, AMD, ARM, and Apple Silicon CPUs decrypt AES-256-GCM at multiple GB/s per core. In SkyeConnex's stream pipeline, the cipher is never the bottleneck — provider I/O dominates.
The compliance position
AES-256-GCM is approved for use protecting classified national-security information up to TOP SECRET under the NSA's CNSA suite. It is FIPS 197 / SP 800-38D compliant — accepting AES-256-GCM is a defensible default for any compliance framework. The certification path through FIPS 140-3 is straightforward when no proprietary algorithms are introduced.