Probably a silly question but I'm no expert ...

In the past I have set up an OpenVPN server behind my router and dialled in from my Android phone with the OpenVPN client which uses a pre-shared key.

Now I have set up an SSL VPN server on my Vigor 2760 with the SmartVPN client on my phone, but it doesn't use a key.

So how does encryption between phone and router work?

AFAIK it is an SSL VPN so uses same mechanism as when visiting a secure web page (https) - SSL certificate is on the router.

When I look at SmartVPN statistics it says Encryption Type is AES256-GCM-SHA384

Ah, OK.

So the difference between SmartVPN and OpenVPN would appear to be that the former relies on username and password and the latter on having a pre-shared key?

Not necessarily - mine is SSL VPN and authentication is configured with a time based token so the password changes every thirty seconds and this is calculated from a PIN and pre-shared secret.

I presume you're not using an Android phone then as I don't get those options on my SmartVPN client.

My primary concern is security of the login rather than the data, although with a decent enough password I should be OK.

No - I am using iPhone and Windows PC to remotely access the router.