What algorithm for AES key wrapping to choose in an embedded environment

Question

In an embedded environment, what AES key wrap algorithm is best, in terms of performance and security coverage?

We are using RSA PKI asymmetric encryption.

Answer 1

AES with ECB and CBC mode

AES-ECB could well directly leak information, especially if it is used over multiple keys. The start of the private values within an encoded key are likely not precisely on a block boundary, so looking for repetition of blocks may for instance indicate that a key contains a smaller private exponent value than other keys. This will not likely leak enough information for a break, but telling auditors that parts of the key may be leaked is not recommended.

AES-CBC can be used, but it doesn't offer any integrity protection. Furthermore, it is vulnerable to padding oracle attacks and will directly leak data if the IV is predictable (distinguishable from random by an attacker). You may directly leak information about the RSA components if the IV is set to a static value for the same reason as for AES-ECB. Both will require some kind of padding, and a description on how to unpad (PKCS#11 often simply uses the encoding of the RSA key itself for that). This makes it perfectly valid to use zero padding.

Unfortunately many HSM's use ECB or CBC with a zero based IV to wrap keys. I'm not sure that those cryptographers were thinking at the time. Not recommended.

The AES-KW mode

AES-KW seems to be mainly concerned with symmetric keys and will probably not be very efficient for RSA keys. It requires input that is a multiple of the block size so just like ECB and CBC it will require padding. Otherwise it will be more secure than ECB and CBC. Still, AES-KW is probably not a good idea.

The AES-(GCM-)SIV mode

Static IV or SIV mode was specifically created with unique input messages in mind. As each RSA private key is (or should be) different from the next, SIV mode is especially useful for key wrapping; it is one of the stated goals for SIV.

Most cryptographers here will probably choose AES in SIV mode for encryption. This mode does expand the wrapped key compared to an unwrapped key, but it doesn't require an IV, and it protects the integrity of the key to boot. It also doesn't require padding, so that the expansion is just the authentication tag size (which doubles as the static-IV).

AES-GCM-SIV is a useful, fast alternative to SIV mode. It is probably a good idea to keep the authentication tag / IV size to 128 bits, especially when using GCM mode. Probably you don't need the GCM speedup for RSA key encryption, so normal SIV mode might be a better choice, if available.

One thing that slightly irks me is that the SIV is usually placed in front of the wrapped key. This makes in-place encryption impossible. However, the mode is just as secure if you place the SIV at the end (but that breaks compatibility with the description).

---

Unfortunately, I think that the order of availability is the exact reverse to the security provided by the various modes.