The guiding design principle for F-Secure KEY is to respect and protect the anonymity of our users, as well as their sensitive data.
F-Secure KEY uses the Advanced Encryption Standard with a key size of 256 bits (AES-256). This algorithm works in the CCM (Counter with CBC-MAC) mode. AES is the recommended standard for modern data encryption.
The master encryption key is derived from your master password using the Password-Based Key Derivation Function 2 (PBKDF2) algorithm specified in Public-Key Cryptography Standards (PKCS) #5; in the PBKDF2 algorithm, we use the Hash-based Message Authentication Code (HMAC) SHA256, random salts, and 20000 iterations. This makes it much more difficult to recover the keys through brute-force or dictionary attacks, even for weaker passwords.
Your master password and the master encryption key are never stored anywhere. The encryption keys exist only when you use the product. However, this also means that there is no way to for F-Secure to recover your password or data for you if you forget the master password. Furthermore, F-Secure does not track you when you synchronize your data across devices.
The F-Secure KEY servers are owned and operated by F-Secure within the European Union in compliance with Finnish law and applicable to EU rules.