NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
There are the differences (whether they're con's vs pro's depends somewhat on what you're using it for):
Performance; the NIST key wrap is much slower than anything else on your list (and can't be parallized; some algorithms on your list can be). On one hand, if you're using it for key wrap, well, we typically don't wrap/unwrap keys so frequently that it really matters. On the other hand, you probably don't want to try to use it to encrypt packets on your 10Gbps link...
Integrity; if the attacker modifies a key wrapped ciphertext, there is a probability circa $2^{-64}$ that, on unwrap, it would be a valid (and effectively random) key; this probability is considerably higher than an authenticated encryption mode (but better than CBC or CTR without any integrity protection whatsoever).
Determinism; the key wrap algorithm is deterministic (based on the wrapping key and the plaintext); hence, if you wrap the same key twice with the same wrapping key, an attacker can detect that; the other modes you have listed are randomized. On the plus side, this means that the key wrap mechanism is not subject to 'algorithm substition attacks' (where the attacker doesn't use a truly random randomizer, but instead selects values that leak some information). In addition, you can make the key wrap randomized by the simple expedient of including some random data along with the key (and which is discarded after the unwrap).
Ciphertext overhead; the key wrap adds 64 bits to the plaintext length (assuming that the key you're wrapping is a multiple of 64 bits in length); this is less overhead than the other algorithms.
You might be wondering about differences in cryptographic strength. There is effectively no difference; as long as the wrapping key is secure, and everything is done properly, any of these methods listed is essentially immune to cryptanalysis.
-
$\begingroup$ Please explain the "Determinism" point. i couldn't understand it. also the algorithm substitution attack? $\endgroup$– cryptCommented Jun 6, 2017 at 18:23
-
$\begingroup$ @Raza: determinism means "if you encrypt the same plaintext with the same key, you'll always get the same ciphertext"; for (say) CBC or GCM, you include an IV; using different IVs generated different ciphertexts. As for algorithm substitution attacks (IMHO, lousy terminology, but it's what people use), we assume that the encryption engine is what's trying to leak data, and so instead of running the standard algorithm, it selects nonrandom IVs; you can show that it can always select IVs in a way to leak data; you can decrypt properly, but data is still leaked. $\endgroup$– ponchoCommented Jun 6, 2017 at 18:31
-
$\begingroup$ determinism i am clear now, ECB is deterministic and sementically not secure. but algorithm substitution attacks still not, any example or paper? $\endgroup$– cryptCommented Jun 6, 2017 at 18:33
-
$\begingroup$ @Raza: eprint.iacr.org/2014/438.pdf $\endgroup$– ponchoCommented Jun 6, 2017 at 18:35