Warning – this is a rather technical post ;-) It’s only for those really interested in some of the inner workings of AxCrypt.
Actually, it’s more than that. Technically, an AxCrypt ID is a RSA-4096 key pair.
A key pair is a concept used in public key, or asymmetric, cryptography. In this type of cryptography there are two, related keys with the following properties:
When we encrypt any file using AxCrypt, we do so using AES-128/-256. This is a symmetrical strong encrypting algorithm, with a single key used for both encryption and decryption.
The process in principle when AxCrypt encrypts a file is as follows:
To decrypt a file, AxCrypt in principle does the following:
The key pair is typically generated on our server when an account is created. The private key is temporarily encrypted using our local system key. Once you sign on and set your password, we re-encrypt it using your password.
The private key, when encrypted, is actually encrypted as an AxCrypt file of course – but only using your password to encrypt the session key as above. We don’t use any public keys for this encryption.
Normally, then, the process is:
Changing your AxCrypt ID password in effect means that we take your private key, decrypt it using the old password and then re-encrypt it using the new password. This is how a password change will enable you to open old AxCrypt-encrypted files. Note that they will still in fact open using the old password as well! This is also why you are never dependent on our servers. If you know the original password, you can always open the file. If you have a synchronized copy of the encrypted private key available, you can open any file as long as you have the current password.
All of this key management is done automatically and behind the scenes by AxCrypt, entirely transparently as long as you allow AxCrypt to access our servers.
For advanced users who fully understand the above mechanisms, it is possible to do all of this without our servers. It’s possible to generate AxCrypt ID key pairs, export them, import them etc. We do not recommend anyone to actually do this, since a mistake or misunderstanding easily can lead to data loss or inability to use AxCrypt.
All of the above is simplified version of the process. Many additional details are actually included to ensure security, and to handle various synchronization scenarios, password reset events etc. For full details read the technical documentation.