Questions tagged [key-wrap]
Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material.
42
questions
33
votes
2
answers
14k
views
Why do we need special key-wrap algorithms?
Wikipedia says:
Key Wrap constructions are a class of symmetric encryption algorithms designed to
encapsulate (encrypt) cryptographic key material.
We are using these algorithms to encrypt (and ...
- 22.5k
10
votes
1
answer
5k
views
What is the difference between "wrapping" a key and encrypting?
I wanted to implement a way to generate an RSA public/private key pair and protect the private key with a password.
Looking into the Web crypto api, I thought the ...
- 539
9
votes
2
answers
689
views
Is AES-Keywrap (NIST SP 800-38F) quantum-safe?
Having looked at the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", I'm unsure as to whether the AES-Keywrap as defined by NIST SP 800-38F is safe against the described attack ...
- 346
7
votes
1
answer
2k
views
How does a key wrapping like RFC 3394 secure my cryptographic keys?
So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it.
The problem I'm running into is how to store keys securely on a ...
- 823
6
votes
2
answers
6k
views
How much extra security does key wrapping provide?
Wikipedia says:
Key Wrap. Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. The Key Wrap algorithms are intended ...
- 508
6
votes
1
answer
532
views
Is it OK to use a data-encryption key for key wrapping, too?
Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, ...
- 61
5
votes
1
answer
1k
views
Changing the IV of the AES key wrap algorithm
The first 64-bit block to be encrypted is defined by the spec to be
A6A6A6A6A6A6A6A6
Is their any merit in changing this to another value eg. ...
- 195
5
votes
2
answers
309
views
Can RFC 5649 be used to wrap multiple keys with the same KEK?
I am unable to convince myself that RFC5649 is secure when storing multiple keys with the same KEK. My point is: RFC5649 uses AES-ECB, therefore the usual weakness of this method applies, namely an ...
- 53
5
votes
2
answers
2k
views
How is NIST's Key Wrap (using AES GCM) different than normal AES GCM Authenticated encryption?
From what I could gather, it seems like that NIST's key wrap (publication) provides similar security like AES-GCM Authenticated encryption. If this is true, why did we need a separate specification ...
- 71
4
votes
2
answers
2k
views
Encrypting 256 bit AES keys with AES ECB?
What are the pros/cons of using AES ECB mode to encrypt encryption keys (data encryption keys or DEKs)? Aware of the significant weaknesses when it come to encrypting low-entropy data that's greater ...
- 1,697
4
votes
1
answer
446
views
PKCS11: CKA_VALUE_LEN attribute and Unwrap key
In PKCS11 specification v2.40, we see some confusion with CKA_VALUE_LEN attribute and UnwrapKey behavior.
From PKCS11 spec 2.40 ...
3
votes
1
answer
613
views
AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?
The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form:
First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
- 547
3
votes
1
answer
200
views
Is it possible to wrap a RSA private key using a EC key pair?
In PKCS#11 documentation § 2.1.23 is described how to wrap and unwrap a target asymmetric key of any length and type using an RSA key, called CKM_RSA_AES_KEY_WRAP. ...
- 61
3
votes
1
answer
113
views
Signal's Key Wrap: is it safe and is it custom?
The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV.
It's used to encrypt your master key with your ...
- 161
3
votes
1
answer
2k
views
Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?
The RFC for AES-KW doesn't actually mention authentication. It only mentions integrity, where the unwrapping/decryption process should produce an identical IV of ...
- 237
3
votes
2
answers
1k
views
Tweakable encryption algorithms vs Key wrapping
I have read many articles about Key wrapping and tweakable cipher modes.
However, I don't understand the main difference between them?
What you recommend for Key storage and Key Archive.
- 125
3
votes
1
answer
177
views
Wrap-unwrap of private key using EC master key
I want to wrap a private key out of a HSM, using an external EC key pair (master key) and then verify that I can recover it.
The wrapping occurs as follows:
Generate a secret AES key in the HSM, ...
- 61
2
votes
2
answers
855
views
Key wrapping - encrypting many times with AES-GCM
When encrypting many short plaintexts with a single key, lets say about 2^64 total plaintexts at under 64 bytes each: (edit note - was 2^70 in the original question)
Is there a way to use AES-GCM, as ...
- 326
2
votes
1
answer
165
views
Question on PKCS11 2.40 spec and AES_CBC wrap
PKCS11 cryptoki version 2.40 Current mechanism specification (section 2.8.5), says below statement for AES CBC wrap:
For wrapping, the mechanism encrypts the value of the CKA_VALUE attribute of the ...
2
votes
1
answer
366
views
Security strength for encryption and authentication (wrapping) of cryptographic keys
Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ ...
- 121
2
votes
1
answer
862
views
Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD
There appears to be some inconsistencies between the PKCS#11 v2.40 Current Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F.
First, according to PKCS#11:
...
- 85
2
votes
1
answer
2k
views
RFC 4493 (AES-CMAC) algorithm with 256 bit key
I apologize for the newbie question. If I were to use a 256-bit key and AES256 (assuming I had the function instead of AES128, the length of the for loops in the functions xor_128, leftshift_bit, ...
- 23
2
votes
1
answer
263
views
Double-CBC as AES-KW Substitute?
Background.
I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte ...
- 9,001
2
votes
1
answer
183
views
Simplified Key Wrapping to Achieve Only Confidentiality?
I'm looking for help in understanding why the algorithm described here would not deliver adequate protection of confidentiality. We don't care about other criteria such as authenticity or integrity. ...
- 21
2
votes
1
answer
395
views
Can export of wrapped secret key to insecure storage be cryptographically secure?
I ask because some vendors of HSM try to avoid the export of wrapped secret key from HSM to insecure storage – storage that does not belong to these vendor’s HSM infrastructure.
For example, Thales ...
- 81
2
votes
1
answer
281
views
Are there cryptographical flaws in this e2ee website chat widget? [closed]
For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom.
...
- 121
2
votes
0
answers
231
views
AES Keywrap implementation supporting 8 byte keys
NIST SP800-38F specifies key wrapping algorithms. An important distinction between KW (without padding) and KWP (with padding) seems to be that KW cannot be used to wrap keys of length 8 bytes i.e. 1 ...
- 167
1
vote
1
answer
97
views
AES key with DES3_CBC_PAD mechainsm
I am new to cryptography and have a question.
If I try to wrap some key using an AES key using DES3_CBC_PAD as a wrapping mechanism will this go to work?
I am doing this operation inside an HSM.
- 13
1
vote
1
answer
1k
views
What are the inputs of the AES key wrap algorithm?
I have trouble understanding inputs for AES key wrap algorithm as it is explained in section 2.2.1 of RFC3394.
Context:
I have a data encryption key (DEK) for AES-128 with CTR, which is used to ...
- 113
1
vote
1
answer
265
views
Can key-wrapping help to securely change passphrase used to generate encryption key?
I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
- 155
1
vote
1
answer
27
views
How to make remote key storage
Is there any protocol for remote secret key storage without disclosure the key value for remote server administrator?
1
vote
1
answer
803
views
Key-Agreement & Key-Transport for Symmetric Authentication System
Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme).
As I am aware there are several ...
- 47
1
vote
2
answers
188
views
How to check the integrity of a key received through mail using symmetric encryption?
I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
1
vote
0
answers
136
views
Wrap AES 256bit key with Argon2 without losing entropy
Given a random 256bit key used for data encryption with Streaming AES GCM
I would like to wrap it for backup with AES GCM.
Is it safe to use
...
- 123
1
vote
1
answer
141
views
Wrapping "stronger" keys with "weaker" ones?
I am looking at wrapping AES keys with RSA. In NIST SP 800-57 Part 1 Recommendation for Key Management, pg 55 it is estimated that the RSA security-strength equivalent of symmetric AES-256 key would ...
- 13
1
vote
0
answers
63
views
Generating Alternative Initial Value while wrapping keys with AES
Am following the instructions on https://datatracker.ietf.org/doc/html/rfc5649#section-3 ("AES Key Wrap with Padding Algorithm") and I have gotten to a point where I need to generate the <...
- 111
1
vote
0
answers
57
views
Did key-wrap modes see actual use?
Is there an IETF standard-track protocol have IANA-registered IDs for deterministic authenticated encryption yet? If not, what's preventing their adoption? What changes to protocols will DAEs likely ...
- 9,001
0
votes
1
answer
300
views
Properly securing a private key for remote storage
I am attempting to secure a private key for remote storage on an untrusted device. Here are the parameters and my assumptions, I'd like to confirm I'm correct with them.
The keypair that I wish to ...
- 157
0
votes
0
answers
104
views
AES-GCM with a fixed IV but a random "wrapped" key
It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
0
votes
0
answers
49
views
JSON Web Encryption (JWE) Key Wrapping Fundamentals - How To Encrypt Content Encryption Key?
The JSON Web Encryption RFC 7516 says:
Encrypt the CEK with the recipient's public key using the
RSAES-PKCS1-v1_5 [or RSAES-OAEP] algorithm to produce the JWE
Encrypted Key.
Assuming a client/server ...
- 101
0
votes
0
answers
48
views
Question about Asymmetric key wrapping using (limited) AES-GCM
assuming that I have an RSA key of length 4k bit which I'm interested to wrap using AES-GCM, and I have a (limited) AES-GCM cipher which can only encrypt limited input in size (say 256-bit/512-bit ...
- 1
0
votes
0
answers
116
views
Client-Side Encryption for a small app
I'm designing a small personal journal web application for my wife. I'm a crypto newb, but I want her to feel secure knowing only she will have access to her journal entries. I am thinking of the ...
- 1