Encryption and privacy glossary

Advanced Data Protection is an iCloud setting introduced in iOS 16.2 (December 2022). When enabled, iCloud Backup, iCloud Drive, Notes, Photos, Reminders, Safari bookmarks, Wallet passes and other categories become end-to-end encrypted, so Apple, served with a legal request, can only hand over ciphertext for those categories.

ADP is off by default. Turning it on requires a recovery contact or a recovery key, because Apple can no longer help you recover that data. iCloud Mail, Contacts and Calendar stay outside ADP so they keep working with other services. For third-party apps, Apple says ADP covers only data the app stores in iCloud Backup or in CloudKit fields it marks as encrypted.

AES-128 is the 128-bit-key variant of the Advanced Encryption Standard, the block cipher ratified by NIST in 2001 (FIPS-197). It performs ten rounds of substitution and permutation on 128-bit blocks of plaintext and is still considered cryptographically unbroken for most threat models.

Most consumer apps use AES-256 instead of AES-128, not because AES-128 is weak, but because the larger key size gives a comfortable margin against future cryptanalysis and against the theoretical key-recovery speedup that a sufficiently large quantum computer would offer via Grover's algorithm.

AES-256 is the 256-bit-key variant of the Advanced Encryption Standard. It runs fourteen rounds on 128-bit blocks and is the cipher behind iOS file-system encryption, Android storage encryption, iCloud data protection and most encrypted-notes apps. Secure Notes uses it for its encrypted backup files on iPhone (from version 3.8.1) and for the whole vault on Android.

The 256-bit key gives a key space of 2^256, large enough that brute-forcing it would require more energy than the observable universe contains. AES-256 is approved by the U.S. NSA for Top Secret information under CNSA. Its security depends entirely on how the key is derived and stored, not on the cipher itself.

AES-256-GCM combines the AES block cipher with Galois/Counter Mode, an authenticated-encryption construction. Each encryption produces both a ciphertext and an authentication tag; decryption fails loudly if the ciphertext has been tampered with or if the wrong key is used.

GCM is widely used in TLS 1.3 and Apple's CryptoKit, and it is the cipher Secure Notes uses for its encrypted backup files on iPhone (from version 3.8.1). It requires a unique nonce per message: reusing a nonce with the same key destroys the integrity guarantee, which is why modern implementations generate a fresh nonce for every encryption.

AEAD stands for Authenticated Encryption with Associated Data. It is a class of ciphers (AES-GCM and ChaCha20-Poly1305 are the two dominant examples) that produce a ciphertext and an integrity tag together, and let you bind that tag to extra context (the “associated data”) that travels in the clear but must not be tampered with.

Modern encrypted apps use AEAD by default. The alternative, encrypting with AES-CBC and then computing an HMAC separately, is error-prone and has historically led to padding-oracle attacks. AEAD eliminates that whole class of bugs by making integrity inseparable from confidentiality.

Before First Unlock (BFU) is the state your iPhone is in between a cold boot and the first successful passcode entry. In BFU, the keys that unwrap your file-system encryption are not yet in memory, so iOS cannot decrypt most of your data, and neither can any extraction tool plugged into the Lightning or USB-C port.

After you enter the passcode once, the device transitions to AFU (After First Unlock). From that point on, even when locked, iOS keeps a number of decryption keys live in RAM for biometric unlock and background tasks. Forensic tooling is far more effective against AFU devices, which is why turning your iPhone off (not just locking it) before a border crossing is the well-known privacy move.

A biometric template is the numerical feature vector your phone derives from a face scan or fingerprint read. It is not a photo and not a print; it is a one-way projection optimized for matching. On Apple devices, the template lives only inside the Secure Enclave and is never exposed to iOS, to apps, or to Apple's servers.

Templates are encrypted and bound to the device, so the template on your iPhone is useless on any other device. This is why every well-designed biometric system is described as “authenticate, don't store.”

BIP-39 defines a way to encode a cryptographic seed as a sequence of dictionary words (typically twelve or twenty-four) drawn from a fixed wordlist of 2,048 entries. Each word carries 11 bits of entropy, so a 12-word phrase encodes 132 bits (128 bits of seed plus 4 bits of checksum).

BIP-39 was written for Bitcoin wallets and is used by most hardware and software crypto wallets. Secure Notes for Android uses BIP-39 English words for its 12 recovery words; the iPhone app uses its own word list. The BIP-39 list is built so that the first four letters of each word are unique, which makes handwritten transcription forgiving of bad penmanship.

A brute-force attack is exhaustive key search: enumerate every possible key, try each one against the ciphertext, stop when the plaintext looks valid. For AES-256, the search space is 2^256 keys (roughly 10^77), which is why direct brute-forcing the cipher is not a realistic threat.

The realistic version of brute-forcing is attacking the password rather than the key. A weak passphrase can be guessed offline using GPU clusters or specialized hardware, which is why modern apps run passwords through a slow key-derivation function (PBKDF2, scrypt, or Argon2) before they ever touch the cipher.

Cipher Block Chaining (CBC) is one of the original AES operating modes. Each block of plaintext is XORed with the previous ciphertext block before being encrypted, so identical plaintext blocks produce different ciphertext blocks, solving the obvious weakness of ECB mode.

CBC is no longer recommended on its own because it does not provide integrity. Used naively, CBC mode is vulnerable to padding-oracle attacks such as POODLE. Modern apps either use authenticated modes like GCM instead, or carefully combine CBC with an HMAC under the encrypt-then-MAC discipline.

Ciphertext is what comes out of an encryption function. It is the scrambled, indistinguishable-from-random bytes that result from running plaintext through a cipher with a key. Without the key, ciphertext should be statistically indistinguishable from random noise.

The point of end-to-end encrypted apps is that the bytes on the provider's servers and crossing the network are always ciphertext the provider cannot decrypt. Ordinary transport and storage encryption also produces ciphertext, but the provider holds the key.

CloudKit is the framework Apple gives third-party developers to read and write data in a user's iCloud account. Each app gets a public database shared across users and a private database scoped to one Apple Account. The developer cannot read a user's private database. Secure Notes for iPhone syncs (Pro) through the private database only.

For ordinary CloudKit fields, Apple holds the encryption keys. Fields an app marks as encrypted, and assets, are end-to-end encrypted. Secure Notes for iPhone does not yet mark the note text as an encrypted field, so synced note text is protected by Apple's standard iCloud encryption, with keys Apple holds.

A cold-boot attack exploits the fact that DRAM contents persist for seconds to minutes after power is removed, especially if the chips are cooled. Decryption keys that were live in memory can sometimes be recovered by quickly transplanting the RAM into an attacker's machine.

iPhones are hard targets. The Secure Enclave keeps the device's root keys out of main memory, and keys for the most sensitive Data Protection classes are discarded shortly after the device locks. The realistic cold-boot scenario today is a laptop rather than a phone.

A cryptographic hash function takes input of arbitrary length and produces a fixed-length output (the digest) such that the same input always produces the same digest, but the digest reveals nothing useful about the input. SHA-256 produces a 256-bit digest; SHA-512 produces a 512-bit one.

Hashes are everywhere in encrypted apps: they're used inside HMAC for integrity, inside HKDF and PBKDF2 for key derivation, inside Merkle trees for sync, and inside the signature verification that proves an iOS app hasn't been tampered with since Apple signed it.

End-to-end encryption means the encryption and decryption both happen on user-controlled endpoints, never on a server in the middle. The server stores and forwards opaque ciphertext but never holds the keys that would decrypt it.

E2EE is the form of encryption that survives a server breach: if the provider is hacked, compelled or betrayed by an insider, your plaintext does not leak, because the server never had it. Apple Notes is E2EE in iCloud only when Advanced Data Protection is on. Secure Notes does not offer E2EE sync: the iPhone app keeps notes on the device (optionally syncing through iCloud with Apple-held keys) and the Android app does not sync at all.

Entropy quantifies unpredictability. A coin flip has one bit of entropy. A six-sided die roll has about 2.58 bits. A random 256-bit key has 256 bits of entropy, assuming the random number generator did its job.

Entropy is the input that makes encryption work. A 256-bit key derived from a four-digit PIN has at most about 13 bits of entropy, not 256, which is why a slow KDF and a strong password matter more than the cipher's nominal key size. BIP-39 12-word seeds have 128 bits of entropy, which is well past any practical brute-force horizon.

FIPS-197 is Federal Information Processing Standard 197, the 2001 NIST publication that formally defined the Advanced Encryption Standard. It specifies AES-128, AES-192, and AES-256, all using the Rijndael algorithm selected after a five-year open competition.

FIPS-197 is the standard you'll see referenced in compliance documents (FedRAMP, FIPS 140-3, CNSA). Apple submits its corecrypto modules for FIPS 140 validation. NIST updated FIPS-197 editorially in 2023, but the algorithm itself has not changed.

GCM is an AES operating mode that combines counter-mode encryption with a Galois-field MAC. The result is authenticated encryption: every ciphertext comes with a 128-bit tag that decryption verifies before returning any plaintext.

GCM is fast, parallelizable, and widely supported in hardware (Intel AES-NI, ARM Crypto Extensions). It is the default mode for TLS 1.3 cipher suites and for iOS CryptoKit's symmetric APIs. Its main sharp edge is nonce reuse: every encryption must use a unique nonce per key, or the integrity guarantee collapses.

HKDF (RFC 5869) is a key-derivation function used to expand and split key material. Given a master secret, HKDF lets you derive any number of subkeys for distinct purposes (one for AES, one for HMAC, one per file) without those subkeys being correlatable to each other or to the master.

HKDF is used in TLS 1.3 and Signal. It's the right tool when you already have high-entropy input. For low-entropy input like a user password, you reach for PBKDF2, scrypt or Argon2 first, then HKDF to split that output into specific keys. Secure Notes' iPhone backup encryption does exactly this: Argon2id on your backup password, then HKDF.

iCloud Keychain is Apple's password manager, built into every Apple device. It stores passwords, passkeys, Wi-Fi credentials, and credit cards, and syncs them between devices that share an Apple ID. iCloud Keychain was end-to-end encrypted long before Advanced Data Protection existed; it does not need ADP.

The keys derive from your device passcodes plus an iCloud Security Code, with recovery handled by a constellation of HSM-backed escrow servers Apple cannot read. For most users it's a good default for passwords; a notes app is for free-form text, voice and photos that do not fit a password manager.

An initialization vector is a public, per-message value mixed into the start of an encryption operation. Its job is to ensure that encrypting the same plaintext twice with the same key produces two different ciphertexts.

For CBC mode, the IV must be unpredictable. For CTR and GCM modes, the IV (often called a nonce there) must be unique per key but does not need to be unpredictable. Reusing an IV is one of the classic implementation failures: it broke WEP, broke stream ciphers, and broke every implementer who learned the hard way that “random” and “unique” are not the same word.

A key derivation function takes weak, low-entropy input (a passphrase) and stretches it into a high-entropy cryptographic key. The defining property is that the function is intentionally slow: milliseconds on legitimate hardware, slow enough that an attacker running billions of guesses on a GPU farm hits a wall.

PBKDF2 is the older standard, configured by iteration count. Argon2 is the newer winner, tunable by time, memory, and parallelism. Both serve the same purpose: make each password guess expensive. Secure Notes uses Argon2id, on iPhone (from version 3.8.1) for encrypted backup passwords and on Android for the PIN that protects the vault key.

Legacy Contact is an Apple ID feature that lets you designate one or more people who, after your death, can request access to your account data by presenting a death certificate and an access key you generated for them. Apple says the data might include photos, messages, notes, files and device backups; iCloud Keychain and purchased media are excluded.

Legacy Contact restores access to your iCloud account, not to every secret inside it. Locked notes still need the password used to lock them, and third-party apps with their own passcode (Secure Notes included) still need that passcode or the app's recovery words. Plan inheritance explicitly.

The master password is the human-memorable secret a user types to unlock an encrypted vault. Behind the scenes, the app runs it through a KDF to derive an AES key; that key decrypts the rest of the system. The master password itself is never stored on disk.

Master-password strength dominates the security of the whole stack. A 256-bit AES key derived from “password1” gives you the security of “password1.” The right discipline is a long, novel passphrase: five random words from a large word list give more than 60 bits of entropy, well into the “not realistically guessable” range when combined with a slow KDF.

A MAC is a cryptographic tag computed over a message with a secret key. The recipient, who also knows the key, can recompute the tag and verify it matches, proving both authenticity (the sender knew the key) and integrity (nothing in transit was changed).

HMAC, built on top of a hash function like SHA-256, is the canonical MAC. Authenticated-encryption modes like AES-GCM include a MAC implicitly via their authentication tag, which is why those modes are now preferred over the older encrypt-then-MAC patterns.

Nonce stands for “number used once.” In modern AEAD ciphers like AES-GCM and ChaCha20-Poly1305, the nonce is a per-message value (typically 96 or 192 bits) that combines with the key to produce a unique keystream for that message.

Nonce uniqueness is non-negotiable. Reusing a nonce with the same key in GCM mode badly damages both confidentiality and integrity: it leaks the XOR of the two plaintexts and lets attackers forge tags. Implementations either use a counter or pick from a large enough random space (XChaCha20's 192-bit nonce is sized exactly for this) to make reuse statistically impossible.

PBKDF2 (RFC 8018) is a key derivation function that applies a pseudorandom function (typically HMAC-SHA-256) to the password and salt, iterated many thousands of times. The iteration count is the cost knob: higher means slower, which means more expensive to brute-force.

PBKDF2 is widely used, including by Apple and many password managers. Newer designs prefer Argon2id, which adds memory-hardness to resist GPU and ASIC attackers more effectively; Secure Notes uses Argon2id. Both are valid choices in 2026 when configured with a high enough cost.

Plaintext is data in the clear: the words you typed, the audio you recorded, the file you imported, before any encryption has been applied. Plaintext is the form information takes inside your head and inside your app's UI; it must not be the form it takes anywhere else.

A privacy-minded app tries to limit where plaintext appears. App switcher snapshots, notification previews, clipboard history and screenshots are common places for plaintext to leak, which is why apps hide previews and clear clipboards.

Quantum-resistant (or post-quantum) cryptography refers to algorithms believed to remain secure even against an adversary with a large-scale quantum computer. Shor's algorithm breaks RSA and elliptic-curve cryptography in polynomial time; Grover's algorithm halves the effective key length of symmetric ciphers.

For symmetric primitives like AES-256, the practical impact is modest: AES-256 against Grover gives 128 bits of effective security, still well past brute-force reach. Public-key cryptography is the harder problem. NIST finalized its first post-quantum standards in 2024 (ML-KEM, based on Kyber, and ML-DSA, based on Dilithium), and Apple's PQ3 protocol for iMessage uses Kyber-based key exchange.

In crypto wallets, a recovery seed (usually from the BIP-39 word list) encodes the key itself: anyone with the words controls the funds. In other apps, recovery words may simply prove you are the owner so you can reset a passcode, without being an encryption key.

Secure Notes shows 12 recovery words when you set your passcode. On iPhone they let you back into the app if you forget the passcode; they are not an encryption key. On Android they are BIP-39 words that, through Argon2id, can unwrap the key to the encrypted vault, so treat them like a wallet seed. Either way, write them down and keep them offline.

The Secure Enclave is a hardware-isolated coprocessor in modern Apple chips (A-series, M-series, S-series). It runs its own micro-OS, has its own boot ROM, and holds keys that the main CPU literally cannot read. Biometric templates, the device's UID key, and Apple Pay tokens all live here.

The Enclave is what makes Face ID and Touch ID safe to use. The biometric comparison happens inside the Enclave; apps just get a yes-or-no answer back. The kernel cannot read the Enclave's secret material directly.

SHA-256 is a member of the SHA-2 family standardized by NIST in 2001. It takes input of arbitrary length and outputs a 256-bit digest. As of 2026 there is no known attack faster than brute force, and brute-forcing a 256-bit hash is comfortably outside the realm of physical possibility.

SHA-256 is the hash used by Bitcoin's proof-of-work, by Apple's code signing, by the TLS certificate ecosystem, and inside HMAC and HKDF in countless apps. It is the boring, reliable choice, exactly what you want in a hash function.

Symmetric encryption uses one shared key for both encryption and decryption. AES, ChaCha20, and 3DES are all symmetric ciphers. Symmetric crypto is fast and efficient, orders of magnitude faster than public-key crypto, but it forces a key-distribution problem when more than one party is involved.

For a single-user encrypted vault, that key-distribution problem largely disappears: the key lives only on your device, protected by your password or PIN. Symmetric AES-256 is the usual tool for bulk encryption, as in the Secure Notes for Android vault.

TrueDepth is the front camera array on Face ID iPhones and iPads. It pairs a flood illuminator, a dot projector that paints ~30,000 invisible infrared dots on your face, and an IR camera that reads them back to build a depth map.

The depth map plus the IR image feed into a neural network running inside the Secure Enclave, which compares the result against your enrolled template. The whole pipeline never exposes a raw image to iOS, never sends it off-device, and adapts continuously to changes in your appearance.

XChaCha20-Poly1305 is an authenticated-encryption cipher that combines the XChaCha20 stream cipher with the Poly1305 MAC. The X variant extends the nonce to 192 bits, which lets you safely generate nonces at random without ever worrying about reuse.

It's the cipher of choice for libraries like libsodium and for cross-platform encrypted apps that can't rely on AES hardware acceleration. Some encrypted-notes apps, such as Notesnook, use it instead of AES-GCM; it's competitive on Apple Silicon and faster on older chips without AES instructions.

Zero-knowledge architecture means the service operator has structurally no ability to read user data. Keys are derived on-device from secrets the operator never sees; data is encrypted on-device before upload; recovery paths are designed so that even an internal compromise yields only ciphertext.

Zero-knowledge is stronger than “we promise we don't look.” A well-designed zero-knowledge service can be subpoenaed, breached or sold and the user's data remains private, because there is no decryption capability on the server side. Note that “we have no server” is a different claim: Secure Notes runs no server that stores notes, but its iPhone sync goes through iCloud, where Apple holds the keys to synced note text.