I've done a quick search and the topic doesn't seem to have come up before.

My question is prompted by the presence of wrap/unwrap functions in Azure (https://msdn.microsoft.com/en-us/library/dn878066.aspx).

The description Microsoft provide of the wrap operation is as follows :

The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault.

However, at the same time, they also provide "standard" encrypt/decrypt API operations. And, of course, I can also take the public key and encrypt my self locally.

So the question is what is the benefit of opting for wrap over RSA encryption and when would I want to choose one over the other?

My use-case is creating and protecting a symmetric key for AES encryption.

1 Answer 1


There are a few benefits of using RSA wrapping / unwrapping:

  1. the key may be kept in a secure location during wrapping / unwrapping, e.g. in a HSM the data to encrypt is supplied from the host PC, but a the key to wrap as well as the unwrapped key may be kept within a hardware module or otherwise protected location (the application gets passed a handle instead of the key value in unprotected / user memory);
  2. a specialized wrapping mechanisms may be used to provide additional security over standard modes of operation such as a block cipher in CBC mode;
  3. for development: the returned key may already be cast to the correct type, alleviating the need for the developer / application to perform the marshaling to/from binary.

It seems Microsoft Azure is able to use FIPS validated HSM's, so above would all good reasons to use an explicit wrap/unwrap method. Even if no HSM is used at the time, using an explicit wrap/unwrap would at least prepare you for it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .