Questions tagged [key-wrap]
Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material.
43
questions
1
vote
1
answer
56
views
SIV Key wrapping with Libsodium
I'm trying to use LibSodium to implement Key Wrapping using SIV mode (Synthetic Initialization Vector). I'm using this answer as a guide, but I want be sure I understand it correctly. My biggest doubt ...
- 2,060
2
votes
1
answer
661
views
Can export of wrapped secret key to insecure storage be cryptographically secure?
I ask because some vendors of HSM try to avoid the export of wrapped secret key from HSM to insecure storage – storage that does not belong to these vendor’s HSM infrastructure.
For example, Thales ...
CommunityBot
- 1
3
votes
1
answer
363
views
Wrap-unwrap of private key using EC master key
I want to wrap a private key out of a HSM, using an external EC key pair (master key) and then verify that I can recover it.
The wrapping occurs as follows:
Generate a secret AES key in the HSM, ...
4
votes
1
answer
373
views
Why is s=6n in AES Key Wrap?
In AES Key Wrap, we apply 6n AES encryptions for an input of n 64-bit blocks. Informally speaking, we wrap the key 6 times. What is the motivation behind 6? Why not 4 or 10? Is there something like a ...
- 25.4k
0
votes
0
answers
192
views
AES-GCM with a fixed IV but a random "wrapped" key
It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
0
votes
0
answers
52
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
3
votes
1
answer
427
views
Is it possible to wrap a RSA private key using a EC key pair?
In PKCS#11 documentation § 2.1.23 is described how to wrap and unwrap a target asymmetric key of any length and type using an RSA key, called CKM_RSA_AES_KEY_WRAP. ...
- 463
2
votes
1
answer
285
views
Are there cryptographical flaws in this e2ee website chat widget? [closed]
For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom.
...
CommunityBot
- 1
3
votes
1
answer
152
views
Signal's Key Wrap: is it safe and is it custom?
The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV.
It's used to encrypt your master key with your ...
- 161
1
vote
0
answers
154
views
Wrap AES 256bit key with Argon2 without losing entropy
Given a random 256bit key used for data encryption with Streaming AES GCM
I would like to wrap it for backup with AES GCM.
Is it safe to use
...
- 123
1
vote
1
answer
180
views
Wrapping "stronger" keys with "weaker" ones?
I am looking at wrapping AES keys with RSA. In NIST SP 800-57 Part 1 Recommendation for Key Management, pg 55 it is estimated that the RSA security-strength equivalent of symmetric AES-256 key would ...
- 93.9k
1
vote
1
answer
27
views
How to make remote key storage
Is there any protocol for remote secret key storage without disclosure the key value for remote server administrator?
1
vote
0
answers
85
views
Generating Alternative Initial Value while wrapping keys with AES
Am following the instructions on https://datatracker.ietf.org/doc/html/rfc5649#section-3 ("AES Key Wrap with Padding Algorithm") and I have gotten to a point where I need to generate the <...
- 93.9k
4
votes
1
answer
591
views
PKCS11: CKA_VALUE_LEN attribute and Unwrap key
In PKCS11 specification v2.40, we see some confusion with CKA_VALUE_LEN attribute and UnwrapKey behavior.
From PKCS11 spec 2.40 ...
CommunityBot
- 1
0
votes
0
answers
119
views
Client-Side Encryption for a small app
I'm designing a small personal journal web application for my wife. I'm a crypto newb, but I want her to feel secure knowing only she will have access to her journal entries. I am thinking of the ...
- 1
3
votes
1
answer
3k
views
Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?
The RFC for AES-KW doesn't actually mention authentication. It only mentions integrity, where the unwrapping/decryption process should produce an identical IV of ...
CommunityBot
- 1
2
votes
1
answer
3k
views
RFC 4493 (AES-CMAC) algorithm with 256 bit key
I apologize for the newbie question. If I were to use a 256-bit key and AES256 (assuming I had the function instead of AES128, the length of the for loops in the functions xor_128, leftshift_bit, ...
CommunityBot
- 1
1
vote
0
answers
320
views
AES Keywrap implementation supporting 8 byte keys
NIST SP800-38F specifies key wrapping algorithms. An important distinction between KW (without padding) and KWP (with padding) seems to be that KW cannot be used to wrap keys of length 8 bytes i.e. 1 ...
- 267
1
vote
1
answer
127
views
AES key with DES3_CBC_PAD mechainsm
I am new to cryptography and have a question.
If I try to wrap some key using an AES key using DES3_CBC_PAD as a wrapping mechanism will this go to work?
I am doing this operation inside an HSM.
- 93.9k
2
votes
1
answer
183
views
Question on PKCS11 2.40 spec and AES_CBC wrap
PKCS11 cryptoki version 2.40 Current mechanism specification (section 2.8.5), says below statement for AES CBC wrap:
For wrapping, the mechanism encrypts the value of the CKA_VALUE attribute of the ...
CommunityBot
- 1
1
vote
1
answer
950
views
Key-Agreement & Key-Transport for Symmetric Authentication System
Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme).
As I am aware there are several ...
- 623
1
vote
0
answers
57
views
Did key-wrap modes see actual use?
Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
- 9,672
3
votes
1
answer
617
views
AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?
The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form:
First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
CommunityBot
- 1
5
votes
2
answers
3k
views
How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?
From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
CommunityBot
- 1
2
votes
1
answer
1k
views
Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD
There appears to be some inconsistencies between the PKCS#11 v2.40 Current Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F.
First, according to PKCS#11:
...
- 46
33
votes
2
answers
14k
views
Why do we need special key-wrap algorithms?
Wikipedia says:
Key Wrap constructions are a class of symmetric encryption algorithms designed to
encapsulate (encrypt) cryptographic key material.
We are using these algorithms to encrypt (and ...
- 103
2
votes
2
answers
908
views
Key wrapping - encrypting many times with AES-GCM
When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question)
Is there a way to use AES-GCM, as ...
- 326
7
votes
2
answers
6k
views
How much extra security does key wrapping provide?
Wikipedia says:
Key Wrap. Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. The Key Wrap algorithms are intended ...
- 14.6k
5
votes
2
answers
340
views
Can RFC 5649 be used to wrap multiple keys with the same KEK?
I am unable to convince myself that RFC5649 is secure when storing multiple keys with the same KEK. My point is: RFC5649 uses AES-ECB, therefore the usual weakness of this method applies, namely an ...
CommunityBot
- 1
9
votes
2
answers
733
views
Is AES-Keywrap (NIST SP 800-38F) quantum-safe?
Having looked at the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", I'm unsure as to whether the AES-Keywrap as defined by NIST SP 800-38F is safe against the described attack ...
- 49.1k
2
votes
1
answer
379
views
Security strength for encryption and authentication (wrapping) of cryptographic keys
Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ ...
- 87.7k
0
votes
1
answer
337
views
Properly securing a private key for remote storage
I am attempting to secure a private key for remote storage on an untrusted device. Here are the parameters and my assumptions, I'd like to confirm I'm correct with them.
The keypair that I wish to ...
- 49.1k
12
votes
1
answer
6k
views
What is the difference between "wrapping" a key and encrypting?
I wanted to implement a way to generate an RSA public/private key pair and protect the private key with a password.
Looking into the Web crypto api, I thought the ...
CommunityBot
- 1
1
vote
1
answer
1k
views
What are the inputs of the AES key wrap algorithm?
I have trouble understanding inputs for AES key wrap algorithm as it is explained in section 2.2.1 of RFC3394.
Context:
I have a data encryption key (DEK) for AES-128 with CTR, which is used to ...
CommunityBot
- 1
4
votes
2
answers
2k
views
Encrypting 256 bit AES keys with AES ECB?
What are the pros/cons of using AES ECB mode to encrypt encryption keys (data encryption keys or DEKs)? Aware of the significant weaknesses when it come to encrypting low-entropy data that's greater ...
CommunityBot
- 1
2
votes
1
answer
282
views
Double-CBC as AES-KW Substitute?
Background.
I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte ...
- 9,672
1
vote
1
answer
271
views
Can key-wrapping help to securely change passphrase used to generate encryption key?
I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
- 93.9k
5
votes
1
answer
1k
views
Changing the IV of the AES key wrap algorithm
The first 64-bit block to be encrypted is defined by the spec to be
A6A6A6A6A6A6A6A6
Is their any merit in changing this to another value eg. ...
- 12.2k
6
votes
1
answer
562
views
Is it OK to use a data-encryption key for key wrapping, too?
Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, ...
CommunityBot
- 1
1
vote
2
answers
191
views
How to check the integrity of a key received through mail using symmetric encryption?
I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
- 93.9k
2
votes
1
answer
185
views
Simplified Key Wrapping to Achieve Only Confidentiality?
I'm looking for help in understanding why the algorithm described here would not deliver adequate protection of confidentiality. We don't care about other criteria such as authenticity or integrity. ...
CommunityBot
- 1
3
votes
2
answers
1k
views
Tweakable encryption algorithms vs Key wrapping
I have read many articles about Key wrapping and tweakable cipher modes.
However, I don't understand the main difference between them?
What you recommend for Key storage and Key Archive.
- 4,337
7
votes
1
answer
2k
views
How does a key wrapping like RFC 3394 secure my cryptographic keys?
So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it.
The problem I'm running into is how to store keys securely on a ...
CommunityBot
- 1