The first 64-bit block to be encrypted is defined by the spec to be


Is their any merit in changing this to another value eg. B0B0B0B0B0B0B0B0?

You retain the strong integrity check although maybe at the cost of interoperability, but does changing the value make the wrapping more secure as potential attackers will not have the knowledge of the unencrypted value of the first block?


1 Answer 1


No, not really.

If you change the IV to a secret value, you prevent the attacker from checking that the key is correct by comparing to the IV, but they can still check by actually using the key. And if you make it a secret value, you need to pass it to the decryptor somehow, so it can be checked by the legitimate user.

If you choose another constant, Kerckhoffs' principle would suggest assuming the attacker knows it. E.g. if you used it in some server software and the attacker got access to your server they would see it.

There is no convincing security advantage to changing it at all. Its precise value does not affect the security of the key-wrap algorithm. The only reasons you would change it are those mentioned by NIST (pdf,, like to accommodate key-lengths that are not multiples of 64 bits (e.g. unpadded 3DES keys).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.