Envelope uses a Keystore to encrypt files and add noise to ciphers. The Keystore can contain an unlimited number of keys in theory (currently limited to 40,000 in software). Each key is made up of many components including an encryption key and randomly generated values for the noise insertion algorithm. The Keystore is protected by a user defined password and is generated using Java's built in keygenerator and Cryptographically Secure Random Number Generator that conforms with the FIPS-140-2 standard. This ensures that all keys within the Keystore are randomly generated and con't be predicted.

The Keystore is protected by a user defined password, This password is not stored. The password is hashed then used to create an encryption key. That encryption key is then used to encrypt the Keystore in 2 phases. The Keystore index is encrypted using a slower hashing algorithm with relevant error checking values appended to the index then the Keystore values are encrypted using a faster hashing algorithm with error checking values appended to the end of each key. This allows Envelope to load the Keystore index into memory, then loads each individual key when required. This has the benefit of minimising memory footprint and maximising security as all the keys are not held in RAM. AES 128 is used to encrypt the Keystore.

Although the Keystore is secured with a password it is recommended that it's treated as a SECRET asset; most people use weak passwords and Envelope Keystores are still vulnerable to brute force attacks. Envelope ciphers are extremely secure when a key from the keystore is used, it allows random noise to be injected into the cipher making brute force attacks impossible and it ensures that there's no relationship between the Keystore password and the key used to create the cipher. Even if you use a weak password to protect the Keystore the cipher will still be encrypted with a strong key.