Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The first 64-bit block to be encrypted is defined by the spec to be
A6A6A6A6A6A6A6A6
Is their any merit in changing this to another value eg. B0B0B0B0B0B0B0B0?
You retain the strong integrity check although maybe at the cost of interoperability, but does changing the value make the wrapping more secure as potential attackers will not have the knowledge of the unencrypted value of the first block?
No, not really.
If you change the IV to a secret value, you prevent the attacker from checking that the key is correct by comparing to the IV, but they can still check by actually using the key. And if you make it a secret value, you need to pass it to the decryptor somehow, so it can be checked by the legitimate user.
If you choose another constant, Kerckhoffs' principle would suggest assuming the attacker knows it. E.g. if you used it in some server software and the attacker got access to your server they would see it.
There is no convincing security advantage to changing it at all. Its precise value does not affect the security of the key-wrap algorithm. The only reasons you would change it are those mentioned by NIST (pdf, 2.2.3.2), like to accommodate key-lengths that are not multiples of 64 bits (e.g. unpadded 3DES keys).
