AES key wrapping (rfc3394) block size

Question

I am having a hard time understanding this concept as I am new to this world. AES key wrapping says it operates on blocks of 64-bit. I thought 64-bit blocks are not considered safe? Also, doesn’t AES only work on the basis of 128-bit blocks? Am I missing some concepts?

Answer 1

I'll change the order of the questions when answering, because it makes more sense to first explain the mode, and then describe the security.

... doesn’t AES only work on the basis of 128-bit blocks?

You've previously pointed to the RFC. This can be easily answered by looking at section 2.2.1. For developers the second definition is probably most useful:

   B = AES(K, A | R[i])
   A = MSB(64, B) ^ t where t = (n*j)+i
   R[i] = LSB(64, B)

Here the 64-bit R[i] is initialized using the plaintext blocks and the IV for this wrapping mode of operation. As you can see the full AES is executed, but the R[i] blocks are still 64-bit. So the block size of the mode is somewhat dependent on, but not the same as the block size of the underlying cipher.

This isn't that strange. Remember that counter mode turns the block cipher into a stream cipher, which basically has a block size of 1 bit (or one byte for most implementations due to computers having the byte as minimum data size that can be directly addressed in memory).

---

I thought 64-bit blocks are not considered safe?

Not considered secure for what?

The number of possible permutations ($2^n!$ with $n=64$) is still much larger than the key size ($2^l$ with $l=128$), see e.g. here for why this is.

That said, 64 bit blocks are for instance not so secure when used for counter mode encryption because the chance of collisions of the counter block, due to cycling when an incremental counter is used or collisions produced when trying to get a unique random value. For CBC there is the chance of repeated inputs to the block cipher when combined with the vector, i.e. the IV or the previous ciphertext block.

In this case the 64 bit blocks are secure because the wrapped key is small and therefore probably doesn't repeat blocks. I would not use key wrapping for larger amounts of data though; the mode was not designed for that purpose. It's pretty inefficient as well due to the call to AES for each 64 bit block; most modes of course require 1 call per 128 bits as they don't change the block size.