RFC 5649

RFC 5649: AES Key Wrap with Padding Algorithm 🎀✨

Okay bestie, this one is the Informational RFC from August 2009 by Russ Housley (Vigil Security) and Morris Dworkin (NIST) 💅. It doesn't obsolete or update anything, and it's not an Internet standard, just info for the community 🌸. Its whole mission is to fix the annoying rule that AES Key Wrap only works on keys that are a multiple of 64 bits, by adding a padding convention 🫶.

The abstract is basically the TL;DR: this document specifies a padding convention for use with the AES Key Wrap algorithm from RFC 3394 💖. It removes the requirement that the key being wrapped be a multiple of 64 bits, so a key of any practical length can be wrapped 🦋.

Status of This Memo ✨

This memo gives info to the Internet community. It doesn't specify an Internet standard of any kind, and distribution is unlimited 🌈.

Copyright and License Notice 💜

Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved 🎀.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please review those documents carefully, because they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they are provided without warranty as described in the BSD License 🫶.

1. Introduction 🦋

Okay so managing crypto keys often means one symmetric key is used to encrypt and integrity-protect another key. That other key can be symmetric or asymmetric 🔐. This operation is usually called key wrapping ✨.

This document extends the AES Key Wrap algorithm [AES-KW1, AES-KW2] 💅. Without this extension, the input to AES Key Wrap (the key data) must be a sequence of two or more 64-bit blocks. Ngl, that's a lot of rules 🙈.

With the AES Key Wrap with Padding algorithm, you can wrap a key of any practical size using an AES key. The AES key-encryption key (KEK) must be 128, 192, or 256 bits 🔥. The input key data can be as short as one octet, which gives an output of two 64-bit blocks (or 16 octets) 🧚. AES Key Wrap doesn't put a maximum on the size of key data, but this extension does. A 32-bit fixed field carries the octet length of the key data, so the input is bounded at 2^32 octets. Most systems have other factors that limit the practical size of key data to much less than 2^32 octets 🌸.

A message length indicator (MLI) is defined as part of an "Alternative Initial Value." This follows what Section 2.2.3.2 of [AES-KW1] says 💖:

Also, if the key data is not just an AES key, it may not always be a multiple of 64 bits. Alternative definitions of the initial value can be used to address such problems.

2. Notation and Definitions 🎀

Here's the notation used in the algorithm descriptions 📝:

   MSB(j, W)   Return the most significant j bits of W
   LSB(j, W)   Return the least significant j bits of W
   ENC(K, B)   AES Encrypt the 128-bit block B using key K
   DEC(K, B)   AES Decrypt the 128-bit block B using key K
   V1 | V2     Concatenate V1 and V2
   K           The key-encryption key
   m           The number of octets in the key data
   n           The number of 64-bit blocks in the padded key data
   Q[i]        The ith plaintext octet in the key data
   P[i]        The ith 64-bit plaintext block in the padded key data
   C[i]        The ith 64-bit ciphertext data block
   A           The 64-bit integrity check register

3. Alternative Initial Value 🌈

The Alternative Initial Value (AIV) this spec requires is a 32-bit constant concatenated with a 32-bit MLI 🧚. The constant is (in hex) A65959A6 and sits in the high-order half of the AIV. This is different from the high-order 32 bits of the default IV in Section 2.2.3.1 of [AES-KW1], so there's no mix-up between the two 💅.

The 32-bit MLI sits in the low-order half. It's an unsigned binary integer equal to the octet length of the plaintext key data, in network order, meaning most significant octet first 🦋. When the MLI isn't a multiple of 8, the key data gets padded on the right with the fewest octets needed to make the length a multiple of 8. Each padding octet SHALL be 0 (eight binary zeros) 🫶.

Wait, here's the vibe check: for a given number of 64-bit plaintext blocks, only eight MLI values can produce that outcome 👑. For example, with four 64-bit plaintext blocks, the only valid MLI values are 32 (no padding octets), 31 (one padding octet), 30, 29, 28, 27, 26, and 25 (seven padding octets) 😭. When unwrapping gives n 64-bit blocks of output data and an AIV, the eight valid MLI values are 8*n, (8*n)-1, ..., and (8*n)-7. So checking the AIV, which lives in a 64-bit register called A, takes these steps 🔍:

1. Check that MSB(32,A) = A65959A6.
2. Check that 8*(n-1) < LSB(32,A) <= 8*n. If so, let MLI = LSB(32,A).
3. Let b = (8*n)-MLI, then check that the rightmost b octets of the output data are zero.

If all three checks pass, the AIV is valid 💖. If any check fails, the AIV is invalid and the unwrapping operation MUST return an error 🙅‍♀️.

4. Specification of the AES Key Wrap with Padding Algorithm 💅

This algorithm has a wrapping process and an unwrapping process, and both are based on the AES codebook [AES] 🔐. It extends the AES Key Wrap algorithm [AES-KW1, AES-KW2] so the key being wrapped doesn't need to be a multiple of 64 bits 🎀. The next two sections cover the wrapping and unwrapping processes, called the extended key wrapping process and the extended key unwrapping process. The names keep them separate from the ones in [AES-KW1] and [AES-KW2] ✨.

4.1. Extended Key Wrapping Process 🦋

The inputs are the KEK and the plaintext to wrap. The plaintext is between one and 2^32 octets long and holds the key data being wrapped 🧚. Here's how the wrapping process goes 💖.

Inputs:  Plaintext, m octets {Q[1], Q[2], ..., Q[m]}, and
         Key, K (the KEK).
Outputs: Ciphertext, (n+1) 64-bit values {C[0], C[1], ..., C[n]}.

1. Append padding

If m isn't a multiple of 8, pad the plaintext octet string on the right with octets {Q[m+1], ..., Q[r]} of zeros, where r is the smallest multiple of 8 greater than m. If m is a multiple of 8, there's no padding and r = m.

Set n = r/8, which is the same as CEILING(m/8).

For i = 1, ..., n j = 8*(i-1) P[i] = Q[j+1] | Q[j+2] | ... | Q[j+8].

2. Wrapping

If the padded plaintext has exactly eight octets, prepend the AIV from Section 3 to P[1] and encrypt the resulting 128-bit block using AES in ECB mode [Modes] with key K (the KEK). In this case the output is two 64-bit blocks, C[0] and C[1]:

C[0] | C[1] = ENC(K, A | P[1]).

Otherwise, apply the wrapping process from Section 2.2.1 of [AES-KW2] to the padded plaintext {P[1], ..., P[n]} with K (the KEK) and the AIV from Section 3 as the initial value. The result is n+1 64-bit blocks {C[0], C[1], ..., C[n]} 🌸.

4.2. Extended Key Unwrapping Process 🫶

The inputs are the KEK and (n+1) 64-bit ciphertext blocks holding a previously wrapped key. If the ciphertext is a validly wrapped key, unwrapping returns n 64-bit blocks of padded plaintext, which this extension maps to m octets of decrypted key data, as the MLI in the AIV says 👑.

Inputs:  Ciphertext, (n+1) 64-bit blocks {C[0], C[1], ..., C[n]}, and
         Key, K (the KEK).
Outputs: Plaintext, m octets {Q[1], Q[2], ..., Q[m]}, or an error.

1. Key unwrapping

When n is one (n=1), the ciphertext holds exactly two 64-bit blocks (C[0] and C[1]). They get decrypted as a single AES block using AES in ECB mode [Modes] with K (the KEK) to recover the AIV and the padded plaintext key:

A | P[1] = DEC(K, C[0] | C[1]).

Otherwise, apply Steps 1 and 2 of the unwrapping process from Section 2.2.2 of [AES-KW2] to the n+1 64-bit ciphertext blocks, {C[0], C[1], ..., C[n]}, and to the KEK, K. Define the padded plaintext blocks, {P[1], ..., P[n]}, as in Step 3 of that process, with A[0] as the A value. Heads up: checking "If A[0] is an appropriate value" gets delayed to Step 2 below, since the padded plaintext is needed for that verification when the AIV is used 🙈.

2. AIV verification

Perform the three checks from Section 3 on the padded plaintext and the A value. If any check fails, return an error 🚨.

3. Remove padding

Let m = the MLI value extracted from A.

Let P = P[1] | P[2] | ... | P[n].

For i = 1, ... , m Q[i] = LSB(8, MSB(8*i, P))

5. Algorithm Identifiers 🍓

Some security protocols use ASN.1 [X.680] and algorithm identifiers to name crypto algorithms. To support those protocols, AES Key Wrap with Padding has been assigned the following algorithm identifiers, one for each AES KEK size 💖. The AES Key Wrap (without padding) identifiers are also listed here for convenience ✨.

   aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16)
             us(840) organization(1) gov(101) csor(3)
             nistAlgorithm(4) 1 }

   id-aes128-wrap     OBJECT IDENTIFIER ::= { aes 5 }
   id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 }

   id-aes192-wrap     OBJECT IDENTIFIER ::= { aes 25 }
   id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 }

   id-aes256-wrap     OBJECT IDENTIFIER ::= { aes 45 }
   id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 }

In all cases, the AlgorithmIdentifier parameter field MUST be absent 🙅‍♀️.

6. Padded Key Wrap Examples 🧚

The examples in this section were generated with the index-based implementation of AES Key Wrap, plus the padding approach from Section 4 of this document. All values are in hex 🎀.

The first example wraps 20 octets of key data with a 192-bit KEK 🦋.

   KEK   :  5840df6e29b02af1 ab493b705bf16ea1 ae8338f4dcc176a8

   Key   :  c37b7e6492584340 bed1220780894115 5068f738

   Wrap  :  138bdeaa9b8fa7fc 61f97742e72248ee 5ae6ae5360d1ae6a
         :  5f54f373fa543b6a

The second example wraps 7 octets of key data with a 192-bit KEK 🌈.

   KEK   :  5840df6e29b02af1 ab493b705bf16ea1 ae8338f4dcc176a8

   Key   :  466f7250617369

   Wrap  :  afbeb0f07dfbf541 9200f2ccb50bb24f

---

Part 1 done, bestie 💖 Part 2 is coming with the rest of the doc, so stay tuned ✨.

7. Security Considerations 🔐💅

okay bestie, this section is SERIOUS and I'm not going to pretend it isn't 😭 but it's also my favourite part because it's all about keeping our keys safe, and that's giving main character energy 🦋

Implementations MUST protect the key-encryption key (KEK). 🛡️ If the KEK gets compromised, every key that was wrapped with it can be disclosed, and then all the traffic protected by those wrapped keys can be compromised too. 💀 Literally the domino effect from hell.

The KEK MUST be at least as good as the keying material it is protecting. 💪 No weak bodyguard for a precious key, ngl.

If the KEK and the wrapped key are associated with different cryptographic algorithms, the effective security for data protected with the wrapped key is set by the weaker of the two algorithms. 🥺 For example, if data is encrypted with 128-bit AES and that AES key is wrapped with a 256-bit AES key, then at most 128 bits of protection is provided to the data. Another example: if a 128-bit AES key is used to wrap a 4096-bit RSA private key, then at most 128 bits of protection is provided to any data that depends on that private key. 📉 So the takeaway is that implementers MUST ensure that key-encryption algorithms are at least as strong as the other cryptographic algorithms used in the overall system. 🫶

The AES Key Wrap and the AES Key Wrap with Padding algorithms use different constants in the initial value. 🎀 That difference means the recipient of padded key data can't successfully unwrap it as unpadded key data, or the other way around. ✨ This stays true even when the key data is wrapped with the AES Key Wrap with Padding algorithm but no padding is needed. Iconic 👑

The AES Key Wrap with Padding algorithm gives almost the same amount of integrity protection as the AES Key Wrap algorithm. 🌸

A previous padding technique was specified for wrapping Hashed Message Authentication Code (HMAC) keys with AES [OLD-KW]. 🧚 The technique in this document is more general, though: it isn't limited to wrapping HMAC keys. 🍓

In the design of some high assurance cryptographic modules, it's desirable to keep cryptographic keying material separate from other data. 🔒 Using a specific cryptographic mechanism only for protecting keying material can help with that goal. The AES Key Wrap and the AES Key Wrap with Padding are exactly those mechanisms. 🦋 System designers SHOULD NOT use these algorithms to encrypt anything other than cryptographic keying material. 🙈

⚠️ Quick reminder: these algorithms are for keys only. Don't go wrapping your grocery list with them, bestie 💀

---

8. References 📚

8.1. Normative References 💜

[AES] National Institute of Standards and Technology, FIPS Pub 197: Advanced Encryption Standard (AES), 26 November 2001.

[AES-KW1] National Institute of Standards and Technology, AES Key Wrap Specification, 17 November 2001. http://csrc.nist.gov/groups/ST/toolkit/documents/kms/ AES_key_wrap.pdf

[AES-KW2] Schaad, J. and R. Housley, "Advanced Encryption Standard (AES) Key Wrap Algorithm", RFC 3394, September 2002.

[Modes] Dworkin, M., "Recommendation for Block Cipher Modes of Operation -- Methods and Techniques", NIST Special Publication 800-38A, 2001.

[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002, Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation.

8.2. Informative References 🌈

[AES-CMS] Schaad, J., "Use of the Advanced Encryption Standard (AES) Encryption Algorithm in Cryptographic Message Syntax (CMS)", RFC 3565, July 2003.

[CMS-ASN] Schaad, J. and P. Hoffman, "New ASN.1 Modules for CMS and S/MIME", Work in Progress, August 2009.

[OLD-KW] Schaad, J. and R. Housley, "Wrapping a Hashed Message Authentication Code (HMAC) key with a Triple-Data Encryption Standard (DES) Key or an Advanced Encryption Standard (AES) Key", RFC 3537, May 2003.

[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-2:2002, Information Technology - Abstract Syntax Notation One: Information Object Specification.

[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-3:2002, Information Technology - Abstract Syntax Notation One: Constraint Specification.

[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-4:2002, Information Technology - Abstract Syntax Notation One: Parameterization of ASN.1 Specifications.

9. Acknowledgments 🙏

Paul Timmel should be credited with the MLI and padding technique described in this document. 👑 Give this legend his flowers!! 💖

Appendix A. ASN.1 Modules 🧩

This appendix includes two ASN.1 modules. 🎀 The first one uses the 1988 syntax, and the second one uses the 2002 ASN.1 syntax.

Appendix A.1 provides the normative ASN.1 definitions for the algorithm identifiers included in this specification, using ASN.1 as defined in [X.680] with the 1988 ASN.1 syntax. 📜

Appendix A.2 provides informative ASN.1 definitions for the same algorithm identifiers, using ASN.1 as defined in [X.680], [X.681], [X.682], and [X.683] with the 2002 ASN.1 syntax. 🦋 It contains the same information as Appendix A.1, but Appendix A.1 takes precedence if there's ever a conflict. ✨ The content encryption and key wrap algorithm objects are defined in [CMS-ASN]. 💅

The id-aes128-wrap, id-aes192-wrap, and id-aes256-wrap algorithm identifiers are defined in [AES-CMS]. 🌸

A.1. 1988 ASN.1 Module 💖

AESKeyWrapWithPad-88 { iso(1) member-body(2) us(840) rsadsi(113549)
  pkcs(1) pkcs-9(9) smime(16) modules(0) 47 }

DEFINITIONS IMPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL --

-- IMPORTS NONE --

-- AES information object identifiers --

aes OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)
  csor(3) nistAlgorithms(4) 1 }

-- AES Key Wrap With Padding Algorithm Identifiers are to be used
-- with the Parameter field absent

id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 }
id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 }
id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 }

END

A.2. 2002 ASN.1 Module 🧚

AESKeyWrapWithPad-02 { iso(1) member-body(2) us(840) rsadsi(113549)
  pkcs(1) pkcs-9(9) smime(16) modules(0) 48 }

DEFINITIONS IMPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL --

IMPORTS
  AlgorithmIdentifier{}, CONTENT-ENCRYPTION, KEY-WRAP, SMIME-CAPS
  FROM AlgorithmInformation-2009  -- [CMS-ASN]
    { iso(1) identified-organization(3) dod(6) internet(1)
      security(5) mechanisms(5) pkix(7) id-mod(0)
      id-mod-algorithmInformation-02(58) };

AES-ContentEncryption CONTENT-ENCRYPTION ::= {
  cea-aes128-wrap-pad |
  cea-aes192-wrap-pad |
  cea-aes256-wrap-pad,
  ... }

AES-KeyWrap KEY-WRAP ::= {
  kwa-aes128-wrap-pad |
  kwa-aes192-wrap-pad |
  kwa-aes256-wrap-pad,
  ... }

SMimeCaps SMIME-CAPS ::= {
  cea-aes128-wrap-pad.&smimeCaps |
  cea-aes192-wrap-pad.&smimeCaps |
  cea-aes256-wrap-pad.&smimeCaps |
  kwa-aes128-wrap-pad.&smimeCaps |
  kwa-aes192-wrap-pad.&smimeCaps |
  kwa-aes256-wrap-pad.&smimeCaps,
  ... }

-- AES object identifier

aes OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840) organization(1)
  gov(101) csor(3) nistAlgorithms(4) 1 }

-- Content Encryption Algorithms

cea-aes128-wrap-pad CONTENT-ENCRYPTION ::= {
  IDENTIFIER id-aes128-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes128-wrap-pad } }

cea-aes192-wrap-pad CONTENT-ENCRYPTION ::= {
  IDENTIFIER id-aes192-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes192-wrap-pad } }

cea-aes256-wrap-pad CONTENT-ENCRYPTION ::= {
  IDENTIFIER id-aes256-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes256-wrap-pad } }

-- Key Wrap Algorithms

kwa-aes128-wrap-pad KEY-WRAP ::= {
  IDENTIFIER id-aes128-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes128-wrap-pad } }

id-aes128-wrap-pad OBJECT IDENTIFIER ::= { aes 8 }

kwa-aes192-wrap-pad KEY-WRAP ::= {
  IDENTIFIER id-aes192-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes192-wrap-pad } }

id-aes192-wrap-pad OBJECT IDENTIFIER ::= { aes 28 }

kwa-aes256-wrap-pad KEY-WRAP ::= {
  IDENTIFIER id-aes256-wrap-pad
  PARAMS ARE absent
  SMIME-CAPS { IDENTIFIED BY id-aes256-wrap-pad } }

id-aes256-wrap-pad OBJECT IDENTIFIER ::= { aes 48 }

END

---

Authors' Addresses 📮

Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA

EMail: housley@vigilsec.com


Morris Dworkin
National Institute of Standards and Technology
100 Bureau Drive, Mail Stop 8930
Gaithersburg, MD 20899-8930
USA

EMail: dworkin@nist.gov