RFC 3394

AES Key Wrap is designed specifically for protecting (encrypting) cryptographic keys. Unlike general-purpose encryption, it provides integrity protection without requiring a separate MAC — the wrapped output includes an integrity check value (ICV).

The algorithm wraps n 64-bit blocks of key material using AES, producing n+1 blocks of ciphertext. Unwrapping verifies the ICV (first block) before returning the plaintext key.

Unwrapping reverses the process and checks that A equals the expected IV. If the IV check fails, the key material has been tampered with and MUST be rejected.

  Inputs:
KEK (Key Encryption Key): 128, 192, or 256 bits
Plaintext Key: n × 64-bit blocks (P[1]...P[n])
Default IV: A6A6A6A6 A6A6A6A6 (64 bits)
Initialize:
A = IV
R[i] = P[i] for i = 1..n
For j = 0 to 5:
For i = 1 to n:
B = AES(KEK, A || R[i])      ← 128-bit AES encryption
A = MSB(64, B) ⊕ (n×j + i)   ← XOR with counter
R[i] = LSB(64, B)            ← update data block
Output:
C[0] = A                        ← integrity check value
C[1..n] = R[1..n]              ← wrapped key data
Total: 6n AES operations for n data blocks

• JWE (RFC 7516): A128KW, A192KW, A256KW key management algorithms
• CMS (RFC 3565): Key wrapping for S/MIME and other CMS-protected keys
• TLS: Key export/import mechanisms
• 3GPP: Key protection in provisioning and key management protocols

• AES Key Wrap provides both confidentiality and integrity — no separate MAC needed
• The IV check during unwrapping detects tampering with probability 1 - 2^-64
• KEK must be at least as strong as the key being wrapped (128-bit key → 128+ bit KEK)
• Not suitable for data larger than a few hundred bytes — designed for key material only