i'm trying to understand how the keys are shared on the 10Gbit passive optical network, and i've found that the keys are generated by ONUs or OLT and after shared with AES-ECB with KEK.
What is it this Key Encryption Key, and how is used with AES to share keys? Thank You
A Key Encryption Key or KEK is simply a key that is solely used to encrypt keys. The keys that are encrypted are usually keys that have a specific meaning such as domain specific keys. It could also be that the encrypted keys have shorter life time such a as session keys.
A KEK may be used in combination with ECB mode as the encrypted key material should be indistinguishable from random. This is one of the few places where ECB encryption does not leak information. Note that it is an extremely bad idea to encrypt structured information with ECB; this includes most asymmetric keys as they generally consist of multiple encoded components.
Currently I would advice a scheme such as AES-SIV or AES-GCM-SIV. This will create a randomized ciphertext if the key only differs by a single bit. The calculated synthetic IV in SIV mode double acts as an authentication tag. This means that any changes (deliberate or not) of the key value can be detected. Beware that it is still possible to e.g. swap encrypted key values though - this is something that the wrapping algorithm itself cannot provide protection for.
Key encryption is sometimes also called wrapping. The KEK is then called a wrapping key and the protected key is of course called the wrapped key.
