2
$\begingroup$

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping.

There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates without any supporting reference that both are "recommended".

Is there a practical or theoretical reason why one might choose GCM over KW and vice-versa?

$\endgroup$
  • 2
    $\begingroup$ Practical disadvantages of GCM mode encryption See KW section of the accepted answer $\endgroup$ – kelalaka Oct 17 '18 at 13:31
  • $\begingroup$ Thanks @kelalaka — I saw that answer. I noted the one advantage there is that an iv is not needed for AES-KW, however the examples for the API for WebCrypto seems to use an iv. The WebCrypto standard seems to indicate that wrapKey does not require any arguments. Does it look like an iv can safely be omitted? $\endgroup$ – Brian M. Hunt Oct 17 '18 at 13:43
  • 1
    $\begingroup$ @BrianM.Hunt Please point us to those examples, don't leave us guessing. $\endgroup$ – Maarten Bodewes Oct 17 '18 at 13:56
  • $\begingroup$ @MaartenBodewes They're in the question, in the text starting with "There are examples", the AES-KW and AES-GCM links go to those respective examples (please feel free to edit the question to make them more prominent) $\endgroup$ – Brian M. Hunt Oct 17 '18 at 14:16
  • $\begingroup$ 🚩 With the caveat that I misread the examples, and AES-KW wrapKey example linked do not use an `iv. The accepted answer may be from the link @kelalaka linked. $\endgroup$ – Brian M. Hunt Oct 17 '18 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.