# Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?

The RFC for AES-KW doesn't actually mention authentication, only integrity, where the unwrapping/decryption process should produce an identical IV of A6A6A6A6A6A6A6A6. Is this integrity check effectively performing authentication, or is it possible for a third party to produce a key that will produce the same IV when unwrapped with an arbitrary key-encryption-key?

Yes, it does perform authentication.

AES-KW is essentially a keyed pseudo-random permutation on large blocks, and being a keyed PRP means 2 things:

1. Observing ciphertext and plaintext pairs gives no knowledge of the key.

2. Without knowledge of key, one cannot obtain any knowledge of plaintext from ciphertext or vice versa.

Therefore the knowledge of key (thus identity authenticity under the assumption of key secrecy) is a necessary condition for producing ciphertexts that yields recipient expected values (in this case, the IV) when decrypted.

Also, the wrapping algorithm W is unauthenticated and not approved for use in production as noted in NIST-SP-800-38F, and you may be interested in what exactly is key wrapping.