I've done a quick search and the topic doesn't seem to have come up before.

My question is prompted by the presence of wrap/unwrap functions in Azure (https://msdn.microsoft.com/en-us/library/dn878066.aspx).

The description Microsoft provide of the wrap operation is as follows :

The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault.

However, at the same time, they also provide "standard" encrypt/decrypt API operations. And, of course, I can also take the public key and encrypt my self locally.

So the question is what is the benefit of opting for wrap over RSA encryption and when would I want to choose one over the other?

My use-case is creating and protecting a symmetric key for AES encryption.


There are a few benefits of using RSA wrapping / unwrapping:

  1. the key may be kept in a secure location during wrapping / unwrapping, e.g. in a HSM the data to encrypt is supplied from the host PC, but a the key to wrap as well as the unwrapped key may be kept within a hardware module or otherwise protected location (the application gets passed a handle instead of the key value in unprotected / user memory);
  2. a specialized wrapping mechanisms may be used to provide additional security over standard modes of operation such as a block cipher in CBC mode;
  3. for development: the returned key may already be cast to the correct type, alleviating the need for the developer / application to perform the marshaling to/from binary.

It seems Microsoft Azure is able to use FIPS validated HSM's, so above would all good reasons to use an explicit wrap/unwrap method. Even if no HSM is used at the time, using an explicit wrap/unwrap would at least prepare you for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.