The RFC for AES-KW doesn't actually mention authentication. It only mentions integrity, where the unwrapping/decryption process should produce an identical IV of A6A6A6A6A6A6A6A6. Is this integrity check effectively performing authentication, or is it possible for a third party to generate a key that will produce the same IV when unwrapped with an arbitrary key-encryption-key?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
Yes, it does perform authentication.
AES-KW is essentially a keyed pseudo-random permutation on large blocks, and being a keyed PRP means 2 things:
Observing ciphertext and plaintext pairs gives no knowledge of the key.
Without knowledge of the key, one cannot obtain any knowledge of the plaintext from the ciphertext or vice versa.
Therefore the knowledge of key (thus identity authenticity under the assumption of key secrecy) is a necessary condition for producing ciphertexts that yield recipient expected values (in this case, the IV) when decrypted.
Also, the wrapping algorithm W is unauthenticated and not approved for use in production as noted in NIST-SP-800-38F, and you may be interested in what exactly is key wrapping.
