Your proposal is malleable, so in particular, confidentiality does not hold against a chosen-W' attack, which is the key-wrap analogue of a [chosen-ciphertext attack](http://en.wikipedia.org/wiki/Adaptive_chosen-ciphertext_attack). $\:$ Also, the fact that your <br> proposal concatenates s with p suggests that H [can probably be evaluated too quickly](https://crypto.stackexchange.com/q/3196/991). <br> Although that may be typical, it shouldn't be, since the time needed to try passwords <br> in a known way scales linearly with the time needed to evaluate the password hash. <br> [This answer](https://security.stackexchange.com/a/31846) gives some better password-based key derivation functions. The "best reason that it is better for key wrapping" is that AES is hopefully non-malleable. <br> (Note that AES should replace xor, rather than replacing H.) <br><br>