Questions tagged [key-wrap]

Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material.

Filter by
Sorted by
Tagged with
4 votes
1 answer
349 views

Why is s=6n in AES Key Wrap?

In AES Key Wrap, we apply 6n AES encryptions for an input of n 64-bit blocks. Informally speaking, we wrap the key 6 times. What is the motivation behind 6? Why not 4 or 10? Is there something like a ...
guestQWERTY's user avatar
0 votes
0 answers
152 views

AES-GCM with a fixed IV but a random "wrapped" key

It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
pogoya9172's user avatar
0 votes
0 answers
97 views

JSON Web Encryption (JWE) Key Wrapping Fundamentals - How To Encrypt Content Encryption Key?

The JSON Web Encryption RFC 7516 says: Encrypt the CEK with the recipient's public key using the RSAES-PKCS1-v1_5 [or RSAES-OAEP] algorithm to produce the JWE Encrypted Key. Assuming a client/server ...
Ronnie Royston's user avatar
0 votes
0 answers
51 views

Question about Asymmetric key wrapping using (limited) AES-GCM

assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
Rami's user avatar
  • 1
3 votes
1 answer
317 views

Is it possible to wrap a RSA private key using a EC key pair?

In PKCS#11 documentation § 2.1.23 is described how to wrap and unwrap a target asymmetric key of any length and type using an RSA key, called CKM_RSA_AES_KEY_WRAP. ...
3ric-T's user avatar
  • 61
3 votes
1 answer
270 views

Wrap-unwrap of private key using EC master key

I want to wrap a private key out of a HSM, using an external EC key pair (master key) and then verify that I can recover it. The wrapping occurs as follows: Generate a secret AES key in the HSM, ...
3ric-T's user avatar
  • 61
3 votes
1 answer
145 views

Signal's Key Wrap: is it safe and is it custom?

The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV. It's used to encrypt your master key with your ...
Tim Shadel's user avatar
2 votes
1 answer
526 views

Can export of wrapped secret key to insecure storage be cryptographically secure?

I ask because some vendors of HSM try to avoid the export of wrapped secret key from HSM to insecure storage – storage that does not belong to these vendor’s HSM infrastructure. For example, Thales ...
Vlad's user avatar
  • 81
1 vote
0 answers
142 views

Wrap AES 256bit key with Argon2 without losing entropy

Given a random 256bit key used for data encryption with Streaming AES GCM I would like to wrap it for backup with AES GCM. Is it safe to use ...
zjmo's user avatar
  • 123
1 vote
1 answer
166 views

Wrapping "stronger" keys with "weaker" ones?

I am looking at wrapping AES keys with RSA. In NIST SP 800-57 Part 1 Recommendation for Key Management, pg 55 it is estimated that the RSA security-strength equivalent of symmetric AES-256 key would ...
Lajos Pajtek's user avatar
1 vote
1 answer
27 views

How to make remote key storage

Is there any protocol for remote secret key storage without disclosure the key value for remote server administrator?
Rinat Shakirov's user avatar
1 vote
0 answers
73 views

Generating Alternative Initial Value while wrapping keys with AES

Am following the instructions on https://datatracker.ietf.org/doc/html/rfc5649#section-3 ("AES Key Wrap with Padding Algorithm") and I have gotten to a point where I need to generate the <...
lulliezy's user avatar
  • 111
4 votes
1 answer
525 views

PKCS11: CKA_VALUE_LEN attribute and Unwrap key

In PKCS11 specification v2.40, we see some confusion with CKA_VALUE_LEN attribute and UnwrapKey behavior. From PKCS11 spec 2.40 ...
Brahmaji Kommanaboyina's user avatar
0 votes
0 answers
117 views

Client-Side Encryption for a small app

I'm designing a small personal journal web application for my wife. I'm a crypto newb, but I want her to feel secure knowing only she will have access to her journal entries. I am thinking of the ...
Wolt's user avatar
  • 1
2 votes
1 answer
3k views

RFC 4493 (AES-CMAC) algorithm with 256 bit key

I apologize for the newbie question. If I were to use a 256-bit key and AES256 (assuming I had the function instead of AES128, the length of the for loops in the functions xor_128, leftshift_bit, ...
PolarBear's user avatar
2 votes
1 answer
283 views

Are there cryptographical flaws in this e2ee website chat widget? [closed]

For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom. ...
adriaan's user avatar
  • 121
1 vote
0 answers
272 views

AES Keywrap implementation supporting 8 byte keys

NIST SP800-38F specifies key wrapping algorithms. An important distinction between KW (without padding) and KWP (with padding) seems to be that KW cannot be used to wrap keys of length 8 bytes i.e. 1 ...
sce's user avatar
  • 257
1 vote
1 answer
118 views

AES key with DES3_CBC_PAD mechainsm

I am new to cryptography and have a question. If I try to wrap some key using an AES key using DES3_CBC_PAD as a wrapping mechanism will this go to work? I am doing this operation inside an HSM.
Aamir's user avatar
  • 13
2 votes
1 answer
173 views

Question on PKCS11 2.40 spec and AES_CBC wrap

PKCS11 cryptoki version 2.40 Current mechanism specification (section 2.8.5), says below statement for AES CBC wrap: For wrapping, the mechanism encrypts the value of the CKA_VALUE attribute of the ...
Brahmaji Kommanaboyina's user avatar
1 vote
1 answer
879 views

Key-Agreement & Key-Transport for Symmetric Authentication System

Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme). As I am aware there are several ...
user67441's user avatar
1 vote
0 answers
57 views

Did key-wrap modes see actual use?

Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
DannyNiu's user avatar
  • 9,216
2 votes
1 answer
936 views

Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD

There appears to be some inconsistencies between the PKCS#11 v2.40 Current Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F. First, according to PKCS#11: ...
Mike's user avatar
  • 85
3 votes
1 answer
2k views

Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?

The RFC for AES-KW doesn't actually mention authentication. It only mentions integrity, where the unwrapping/decryption process should produce an identical IV of ...
Shruggie's user avatar
  • 237
5 votes
2 answers
2k views

How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?

From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
Akash's user avatar
  • 71
6 votes
2 answers
6k views

How much extra security does key wrapping provide?

Wikipedia says: Key Wrap. Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. The Key Wrap algorithms are intended ...
Saptarshi Basu's user avatar
5 votes
2 answers
332 views

Can RFC 5649 be used to wrap multiple keys with the same KEK?

I am unable to convince myself that RFC5649 is secure when storing multiple keys with the same KEK. My point is: RFC5649 uses AES-ECB, therefore the usual weakness of this method applies, namely an ...
cassisbonbon's user avatar
2 votes
2 answers
888 views

Key wrapping - encrypting many times with AES-GCM

When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question) Is there a way to use AES-GCM, as ...
orip's user avatar
  • 326
2 votes
1 answer
377 views

Security strength for encryption and authentication (wrapping) of cryptographic keys

Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ ...
s7amuser's user avatar
  • 121
9 votes
2 answers
710 views

Is AES-Keywrap (NIST SP 800-38F) quantum-safe?

Having looked at the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", I'm unsure as to whether the AES-Keywrap as defined by NIST SP 800-38F is safe against the described attack ...
thera's user avatar
  • 346
0 votes
1 answer
319 views

Properly securing a private key for remote storage

I am attempting to secure a private key for remote storage on an untrusted device. Here are the parameters and my assumptions, I'd like to confirm I'm correct with them. The keypair that I wish to ...
Samuel Horwitz's user avatar
12 votes
1 answer
6k views

What is the difference between "wrapping" a key and encrypting?

I wanted to implement a way to generate an RSA public/private key pair and protect the private key with a password. Looking into the Web crypto api, I thought the ...
Vlad's user avatar
  • 569
1 vote
1 answer
1k views

What are the inputs of the AES key wrap algorithm?

I have trouble understanding inputs for AES key wrap algorithm as it is explained in section 2.2.1 of RFC3394. Context: I have a data encryption key (DEK) for AES-128 with CTR, which is used to ...
matm's user avatar
  • 113
1 vote
1 answer
269 views

Can key-wrapping help to securely change passphrase used to generate encryption key?

I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
jnemecz's user avatar
  • 155
2 votes
1 answer
274 views

Double-CBC as AES-KW Substitute?

Background. I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte ...
DannyNiu's user avatar
  • 9,216
5 votes
1 answer
1k views

Changing the IV of the AES key wrap algorithm

The first 64-bit block to be encrypted is defined by the spec to be A6A6A6A6A6A6A6A6 Is their any merit in changing this to another value eg. ...
err's user avatar
  • 195
4 votes
2 answers
2k views

Encrypting 256 bit AES keys with AES ECB?

What are the pros/cons of using AES ECB mode to encrypt encryption keys (data encryption keys or DEKs)? Aware of the significant weaknesses when it come to encrypting low-entropy data that's greater ...
DeepSpace101's user avatar
  • 1,697
3 votes
1 answer
614 views

AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?

The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form: First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
Neil Madden's user avatar
1 vote
2 answers
191 views

How to check the integrity of a key received through mail using symmetric encryption?

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
khathyaayinisk's user avatar
2 votes
1 answer
184 views

Simplified Key Wrapping to Achieve Only Confidentiality?

I'm looking for help in understanding why the algorithm described here would not deliver adequate protection of confidentiality. We don't care about other criteria such as authenticity or integrity. ...
beewoolie's user avatar
3 votes
2 answers
1k views

Tweakable encryption algorithms vs Key wrapping

I have read many articles about Key wrapping and tweakable cipher modes. However, I don't understand the main difference between them? What you recommend for Key storage and Key Archive.
Gev_sedrakyan's user avatar
6 votes
1 answer
544 views

Is it OK to use a data-encryption key for key wrapping, too?

Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, ...
StoverFlo's user avatar
33 votes
2 answers
14k views

Why do we need special key-wrap algorithms?

Wikipedia says: Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. We are using these algorithms to encrypt (and ...
Paŭlo Ebermann's user avatar
7 votes
1 answer
2k views

How does a key wrapping like RFC 3394 secure my cryptographic keys?

So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it. The problem I'm running into is how to store keys securely on a ...
hobeau's user avatar
  • 823