We want to wrap / encapsulate
- a symmetric key with an asymmetric keypair,
- a symmetric key with a symmetric key,
- a private key with a symmetric key.
In each case, we'd like to allow several keys to be wrapped / encapsulated with the same key (probably not needed in case 2, could be avoided in case 3). We also want to combine numbers 1 and 2; that is, wrap / encapsulate a key with both asymmetric keypair(s) and symmetric key(s).
Number 3 is the standard case for key encapsulation, while in cases 1 and 2 I believe key wrap is the preferred method.
We use Python, and pyNaCl ("Python binding to libsodium") seemed generally a decent library. I am open to other suggestions, though.
However, pyNaCl/libsodium does not seem to provide methods for key wrap or key encapsulation. I assume the latter to be used implicitly for "sealed boxes" (asymmetric encryption of large data). This does not suffice, because we want to encapsulate single keys for multiple asymmetric keypairs (and be able to add further keypairs later).
Should we attempt to build key encapsulation and key wrap ourselves based upon the given methods? If so, how?
- Key encapsulation seems(!) easy (we'd presumably get an additional implicit key encapsulation, though, as mentioned above).
- For key wrap, I am less sure what to do. Calculate a synthetic IV (SIV) to get AES-GCM-SIV?
- I'd prefer a key wrap algorithm that uses libsodium's preferred AE cipher, SXalsa20/Poly1305.
We could probably also use key encapsulation even with symmetric key encryption keys.
Generally, I would prefer to avoid writing my own methods for key encapsulation and key wrap.