Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. The Key Wrap algorithms are intended for applications such as (a) protecting keys while in untrusted storage, or (b) transmitting keys over untrusted communications networks. The constructions are typically built from standard primitives such as block ciphers and cryptographic hash functions.

What are the advantages of using AES Key wrapping instead of ordinary AES, for example CCM mode (Counter with CBC-MAC)? What are the pros and cons?

Could someone point me to good readings/papers about AES Key wrapping, other than my primary resource, NIST Key wrapping specification?

Or, could someone shortly explain how it works?

share|improve this question
    
I think key-wrapping algorithms are usually secure when used without a unique IV whereas many normal modes, whereas CCM totally breaks when you reuse a nonce. –  CodesInChaos Aug 5 '13 at 7:16
    
This might be better for crypto than security –  Lucas Kauffman Aug 5 '13 at 10:28
add comment

1 Answer

up vote 4 down vote accepted

The key wrap algorithm can be envisioned as an extended Feistel scheme which uses AES as the round function, combined with a running state which serves as a rough MAC. If you look at the algorithm definition, you will see that for each of the s rounds, one 64-bit block of data is updated, with a combination function which includes an AES invocation and another 64-bit block. The blocks are also "rotated" so that the next round updates another block, and so on. This really is akin to defining a big block cipher operating over the complete plaintext as a single "block".

As symmetric encryption systems go, this one is quite inefficient, because it involves an average of 1.5 AES invocation per input byte (12 AES invocation for a 64-bit block), whereas GCM would use only 0.0625 AES invocation per input byte (one AES every 128-bit block). It also needs to process each input byte several times, so the entire plaintext message must be fully buffered: this will be inadequate for bulk encryption.

The key wrap algorithm was designed to protect keys and suffers from some ritualistic overkill: a lot of accumulated AES invocations on the hope that it will make so much scrambling that the result will be strong. This is not a bad bet; if we look at it as an extended Feistel cipher, then there is some empirical data that many rounds will bring security. This should deserve some decent analysis, though, and, to my knowledge, this has not occurred yet. This is probably related to the fact that this key wrap algorithm appears not to be much used in the wild.

Good properties of the AES key wrap algorithm include the following:

  • It does not need randomness. Randomness is a scarce resource on many embedded systems, so having a scheme which is secure without it is nice.

  • It does not need state. No EEPROM or Flash bit to modify, if only to keep a counter.

  • It is deterministic. This means that wrapping the same plaintext with the same key will yield the same sequence of bytes. Determinism is mostly neutral, but occasionally useful in some protocols.

  • It uses a single primitive, which is "the AES": code size is also a scarce resource on embedded systems.

  • It has low size overhead: it adds only 64 bits to the input size, and includes a MAC, so that's about the smallest than can be achieved.

Bad properties are mostly these ones:

  • The algorithm is inefficient, with a high CPU cost per byte, and the need for full buffering. This is why the algorithm is meant for key wrapping, where "keys" are short entities, keeping the wrapping costs under reasonable limits.

  • Despite its 12 years, the AES key wrapping algorithm did not benefit from a lot of analysis or even attention from the cryptographic community, probably because of its restrictive use cases.

share|improve this answer
    
great answer thanks :) –  enigma Aug 5 '13 at 13:45
    
"This is probably related to the fact that this key wrap algorithm appears not to be much used in the wild." it is used on iOS devices to protect the keys which are used to encrypt the file content. If you are interested take a look at this whitepaper iOS Security especially the "Data Protection" section of the paper. –  enigma Aug 5 '13 at 14:12
    
Tom, I wouldn't label the properties "good" or "bad". Efficiency is just one of many qualities, all of which must be weighed together. Most important would be security, of course, followed closely by integrity. Size obviously would matter greatly on an embedded device, but would mean nothing on a server. In the highly specialized use case of key wrapping for export, I would argue that efficiency is one of the least important qualities, especially as it would likely be used only infrequently. –  John Deters Aug 5 '13 at 14:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.