# MyCloudVault Backup Encryption

## Overview
End-to-end encryption using AES-256-GCM for secure backup storage.

## Key Generation
POST /api/encryption/generate-key
- Random key generation
- Password-based key derivation (PBKDF2, 100k iterations)

## Encrypted Upload
POST /api/backup/upload-encrypted
- Upload file with encryption key
- Server encrypts and stores
- Returns encryption metadata

## Encrypted Download
GET /api/backup/download-decrypted/:backupId
- Requires encryption key
- Server decrypts and streams
- Temporary decryption only

## Security
- 256-bit AES-GCM encryption
- Authenticated encryption
- Keys stored securely per device
- No server-side key access

## Android Integration
See BACKUP_UPLOAD_API.md and BACKUP_RESTORE_API.md for implementation examples.
