The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping.

There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates without any supporting reference that both are "recommended".

Is there a practical or theoretical reason why one might choose GCM over KW and vice-versa?

  • 2
    $\begingroup$ Practical disadvantages of GCM mode encryption See KW section of the accepted answer $\endgroup$
    – kelalaka
    Oct 17 '18 at 13:31
  • $\begingroup$ Thanks @kelalaka — I saw that answer. I noted the one advantage there is that an iv is not needed for AES-KW, however the examples for the API for WebCrypto seems to use an iv. The WebCrypto standard seems to indicate that wrapKey does not require any arguments. Does it look like an iv can safely be omitted? $\endgroup$ Oct 17 '18 at 13:43
  • 1
    $\begingroup$ @BrianM.Hunt Please point us to those examples, don't leave us guessing. $\endgroup$
    – Maarten Bodewes
    Oct 17 '18 at 13:56
  • $\begingroup$ @MaartenBodewes They're in the question, in the text starting with "There are examples", the AES-KW and AES-GCM links go to those respective examples (please feel free to edit the question to make them more prominent) $\endgroup$ Oct 17 '18 at 14:16
  • 1
    $\begingroup$ @BrianM.Hunt Well for one, if the live table is to be trusted, KW can't wrap as many key types on my current chrome. Not that I can get GCM to wrap my RSA-OAEP private key either, but at least the table says it should work. $\endgroup$ Aug 16 '19 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.