If you look at modes designed for key wrapping or that list it as a key application, a common feature you see is that they are authenticated encryption modes that provide both message confidentiality and authenticity. See, e.g.:
One reason for this is that from the point of view of a malicious client, a key management system without message authentication provides:
- A decryption oracle: under the guise of asking for the decryption of a DEK, the client can request the decryption of adversarially-chosen ciphertexts with the master key;
- An encryption oracle, although depending on the design of the KMS, possibly only for randomly-chosen plaintexts:
- Some systems allow the client to submit adversarially-chosen DEKs to be encrypted, so these provide a full encryption oracle.
- Others only allow the client to obtain fresh random DEKs along with their encryptions, but this could well be useful to an adversary
Neither ECB nor CBC is secure against chosen-ciphertext attacks. So it seems prudent to use an authenticated encryption mode like GCM or SIV so that the KMS can reject malicious, client-forged encrypted DEKs.
