draft-ietf-smime-aes-keywrap-00.txt   rfc3394.txt 
S/MIME Working Group J. Schaad Network Working Group J. Schaad
Internet Draft Soaring Hawk Consulting Request for Comments: 3394 Soaring Hawk Consulting
Document: draft-ietf-smime-aes-keywrap-00.txt R. Housley Category: Informational R. Housley
Category: Informational RSA Laboratories RSA Laboratories
February 2002 September 2002
AES Key Wrap Algorithm Advanced Encryption Standard (AES) Key Wrap Algorithm
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This memo provides information for the Internet community. It does
all provisions of Section 10 of RFC2026. not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts. Internet-Drafts are draft documents valid for a maximum of
six months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet- Drafts
as reference material or to cite them other than as "work in
progress."
The list of current Internet-Drafts can be accessed at Copyright Notice
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Comments on this draft should be sent to ietf-smime@imc.org. Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract Abstract
The purpose of this document is to make the AES Key Wrap algorithm The purpose of this document is to make the Advanced Encryption
conveniently available to the Internet community. The United States Standard (AES) Key Wrap algorithm conveniently available to the
of America has adopted AES as the new encryption standard. The AES Internet community. The United States of America has adopted AES as
Key Wrap algorithm will probably be adopted by the USA for the new encryption standard. The AES Key Wrap algorithm will
encryption of AES keys. The authors took most of the text in this probably be adopted by the USA for encryption of AES keys. The
document from the draft AES Key Wrap posted by NIST. authors took most of the text in this document from the draft AES Key
Wrap posted by NIST.
Table of Contents
1. Introduction................................................ 2
2. Overview.................................................... 2
2.1 Notation and Definitions................................... 3
2.2 Algorithms................................................. 4
2.2.1 Key Wrap................................................. 4
2.2.2 Key Unwrap............................................... 5
2.2.3 Key Data Integrity -- the Initial Value.................. 6
2.2.3.1 Default Initial Value.................................. 7
2.2.3.2 Alternative Initial Values............................. 7
3. Object Identifiers.......................................... 8
4. Test Vectors................................................ 8
4.1 Wrap 128 bits of Key Data with a 128-bit KEK............... 8
4.2 Wrap 128 bits of Key Data with a 192-bit KEK............... 11
4.3 Wrap 128 bits of Key Data with a 256-bit KEK............... 14
4.4 Wrap 192 bits of Key Data with a 192-bit KEK............... 17
4.5 Wrap 192 bits of Key Data with a 256-bit KEK............... 24
4.6 Wrap 256 bits of Key Data with a 256-bit KEK............... 30
5. Security Considerations..................................... 39
6. References.................................................. 39
7. Acknowledgments............................................. 39
8. Authors' Addresses.......................................... 39
9. Full Copyright Statement.................................... 40
1. Introduction 1. Introduction
NOTE: Most of the following text is taken from [AES-WRAP], and the NOTE: Most of the following text is taken from [AES-WRAP], and the
assertions regarding the security of the AES Key Wrap algorithm are assertions regarding the security of the AES Key Wrap algorithm are
made by the US Government, not by the authors of this document. made by the US Government, not by the authors of this document.
This specification is intended to satisfy the National Institute of This specification is intended to satisfy the National Institute of
Standards and Technology (NIST) Key Wrap requirement to: Design a Standards and Technology (NIST) Key Wrap requirement to: Design a
cryptographic algorithm called a Key Wrap that uses the Advanced cryptographic algorithm called a Key Wrap that uses the Advanced
Encryption Standard (AES) as a primitive to securely encrypt Encryption Standard (AES) as a primitive to securely encrypt
plaintext key(s) with any associated integrity information and data, plaintext key(s) with any associated integrity information and data,
such that the combination could be longer than the width of the AES such that the combination could be longer than the width of the AES
block size (128-bits). Each ciphertext bit should be a highly non- block size (128-bits). Each ciphertext bit should be a highly non-
linear function of each plaintext bit, and (when unwrapping) each linear function of each plaintext bit, and (when unwrapping) each
Schaad & Housley Informational- July 2002 1
AES Key Wrap Algorithm February 2002
plaintext bit should be a highly non-linear function of each plaintext bit should be a highly non-linear function of each
ciphertext bit. It is sufficient to approximate an ideal ciphertext bit. It is sufficient to approximate an ideal
pseudorandom permutation to the degree that exploitation of pseudorandom permutation to the degree that exploitation of
undesirable phenomena is as unlikely as guessing the AES engine key. undesirable phenomena is as unlikely as guessing the AES engine key.
This key wrap algorithm needs to provide ample security to protect This key wrap algorithm needs to provide ample security to protect
keys in the context of prudently designed key management keys in the context of prudently designed key management
architecture. architecture.
Throughout this document, any data being wrapped will be referred to Throughout this document, any data being wrapped will be referred to
as the key data. It makes no difference to the algorithm whether as the key data. It makes no difference to the algorithm whether the
the data being wrapped is a key; in fact there is often good reason data being wrapped is a key; in fact there is often good reason to
to include other data with the key, to wrap multiple keys together, include other data with the key, to wrap multiple keys together, or
or to wrap data that isn't strictly a key. So, the term "key data" to wrap data that isn't strictly a key. So, the term "key data" is
is used broadly to mean any data being wrapped, but particularly used broadly to mean any data being wrapped, but particularly keys,
keys, since this is primarily a key wrap algorithm. The key used to since this is primarily a key wrap algorithm. The key used to do the
do the wrapping will be referred to as the key-encryption key (KEK). wrapping will be referred to as the key-encryption key (KEK).
In this document a KEK can be any valid key supported by the AES In this document a KEK can be any valid key supported by the AES
codebook. That is, a KEK can be a 128-bit key, a 192-bit key, or a codebook. That is, a KEK can be a 128-bit key, a 192-bit key, or a
256-bit key. 256-bit key.
2. Overview 2. Overview
The AES key wrap algorithm is designed to wrap or encrypt key data. The AES key wrap algorithm is designed to wrap or encrypt key data.
The key wrap operates on blocks of 64 bits. Before being wrapped, The key wrap operates on blocks of 64 bits. Before being wrapped,
the key data is parsed into n blocks of 64 bits. the key data is parsed into n blocks of 64 bits.
The only restriction the key wrap algorithm places on n is that n be The only restriction the key wrap algorithm places on n is that n be
at least two. (For key data with length less than or equal to 64 at least two. (For key data with length less than or equal to 64
bits, the constant field used in this specification and the key data bits, the constant field used in this specification and the key data
form a single 128-bit codebook input making this key wrap form a single 128-bit codebook input making this key wrap
unnecessary.) The key wrap algorithm accommodates all supported AES unnecessary.) The key wrap algorithm accommodates all supported AES
key sizes. However, other cryptographic values often need to be key sizes. However, other cryptographic values often need to be
wrapped. One such value is the seed of the random number generator wrapped. One such value is the seed of the random number generator
for DSS. This seed value requires n to be greater than four. for DSS. This seed value requires n to be greater than four.
Undoubtedly other values require this type of protection. Undoubtedly other values require this type of protection. Therefore,
Therefore, no upper bound is imposed on n. no upper bound is imposed on n.
The AES key wrap can be configured to use any of the three key sizes The AES key wrap can be configured to use any of the three key sizes
supported by the AES codebook. The choice of a key size affects the supported by the AES codebook. The choice of a key size affects the
overall security provided by the key wrap, but it does not alter the overall security provided by the key wrap, but it does not alter the
description of the key wrap algorithm. Therefore, in the description of the key wrap algorithm. Therefore, in the description
description that follows, the key wrap is described generically; no that follows, the key wrap is described generically; no key size is
key size is specified for the KEK. specified for the KEK.
2.1 Notation and Definitions 2.1 Notation and Definitions
The following notation is used in the description of the key The following notation is used in the description of the key wrapping
wrapping algorithms: algorithms:
AES(K, W) Encrypt W using the AES codebook with key K AES(K, W) Encrypt W using the AES codebook with key K
AES-1(K, W) Decrypt W using the AES codebook with key K AES-1(K, W) Decrypt W using the AES codebook with key K
MSB(j, W) Return the most significant j bits of W MSB(j, W) Return the most significant j bits of W
LSB(j, W) Return the least significant j bits of W LSB(j, W) Return the least significant j bits of W
Schaad & Housley Informational - July 2002 2
AES Key Wrap Algorithm February 2002
B1 ^ B2 The bitwise exclusive or (XOR) of B1 and B2 B1 ^ B2 The bitwise exclusive or (XOR) of B1 and B2
B1 | B2 Concatenate B1 and B2 B1 | B2 Concatenate B1 and B2
K The key encryption key K K The key-encryption key K
n The number of 64-bit key data blocks n The number of 64-bit key data blocks
s The number of steps in the wrapping process, s = 6n s The number of steps in the wrapping process, s = 6n
P[i] The ith plaintext key data block P[i] The ith plaintext key data block
C[i] The ith ciphertext data block C[i] The ith ciphertext data block
A The 64-bit integrity check register A The 64-bit integrity check register
R[i] An array of 64-bit registers where R[i] An array of 64-bit registers where
i = 0, 1, 2, ..., n i = 0, 1, 2, ..., n
A[t], R[i][t] The contents of registers A and Ri after encryption A[t], R[i][t] The contents of registers A and R[i] after encryption
step t. step t.
IV The 64-bit initial value used during the wrapping IV The 64-bit initial value used during the wrapping
process. process.
In the key wrap algorithm, the concatenation function will be used In the key wrap algorithm, the concatenation function will be used to
to concatenate 64-bit quantities to form the 128-bit input to the concatenate 64-bit quantities to form the 128-bit input to the AES
AES codebook. The extraction functions will be used to split the codebook. The extraction functions will be used to split the 128-bit
128-bit output from the AES codebook into two 64-bit quantities. output from the AES codebook into two 64-bit quantities.
2.2 Algorithms 2.2 Algorithms
The specification of the key wrap algorithm requires the use of the The specification of the key wrap algorithm requires the use of the
AES codebook [AES]. The next three sections will describe the key AES codebook [AES]. The next three sections will describe the key
wrap algorithm, the key unwrap algorithm, and the inherent data wrap algorithm, the key unwrap algorithm, and the inherent data
integrity check. integrity check.
2.2.1 Key Wrap 2.2.1 Key Wrap
The inputs to the key wrapping process are the KEK and the plaintext The inputs to the key wrapping process are the KEK and the plaintext
to be wrapped. The plaintext consists of n 64-bit blocks, to be wrapped. The plaintext consists of n 64-bit blocks, containing
containing the key data being wrapped. The key wrapping process is the key data being wrapped. The key wrapping process is described
described below. below.
Inputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}, and Inputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}, and
Key, K (the KEK). Key, K (the KEK).
Outputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}. Outputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}.
1) Initialize variables. 1) Initialize variables.
Set A0 to an initial value (see 2.2.3) Set A0 to an initial value (see 2.2.3)
For i = 1 to n For i = 1 to n
R[0][i] = P[i] R[0][i] = P[i]
skipping to change at line 171 skipping to change at page 4, line 39
2) Calculate intermediate values. 2) Calculate intermediate values.
For t = 1 to s, where s = 6n For t = 1 to s, where s = 6n
A[t] = MSB(64, AES(K, A[t-1] | R[t-1][1])) ^ t A[t] = MSB(64, AES(K, A[t-1] | R[t-1][1])) ^ t
For i = 1 to n-1 For i = 1 to n-1
R[t][i] = R[t-1][i+1] R[t][i] = R[t-1][i+1]
R[t][n] = LSB(64, AES(K, A[t-1] | R[t-1][1])) R[t][n] = LSB(64, AES(K, A[t-1] | R[t-1][1]))
3) Output the results. 3) Output the results.
Schaad & Housley Informational - July 2002 3
AES Key Wrap Algorithm February 2002
Set C[0] = A[t] Set C[0] = A[t]
For i = 1 to n For i = 1 to n
C[i] = R[t][i] C[i] = R[t][i]
The motion of the key wrap is shown below.
An alternative description of the key wrap algorithm involves An alternative description of the key wrap algorithm involves
indexing rather than shifting. This approach allows you to indexing rather than shifting. This approach allows one to calculate
calculate the wrapped key in place, avoiding the rotation in the the wrapped key in place, avoiding the rotation in the previous
previous description. This produces identical results and is more description. This produces identical results and is more easily
easily implemented in software. implemented in software.
Inputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}, and Inputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}, and
Key, K (the KEK). Key, K (the KEK).
Outputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}. Outputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}.
1) Initialize variables. 1) Initialize variables.
Set A = IV, an initial value (see 2.2.3) Set A = IV, an initial value (see 2.2.3)
For i = 1 to n For i = 1 to n
R[i] = P[i] R[i] = P[i]
skipping to change at line 227 skipping to change at page 5, line 46
Inputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}, and Inputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}, and
Key, K (the KEK). Key, K (the KEK).
Outputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}. Outputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}.
1) Initialize variables. 1) Initialize variables.
Set A[s] = C[0] where s = 6n Set A[s] = C[0] where s = 6n
For i = 1 to n For i = 1 to n
R[s][i] = C[i] R[s][i] = C[i]
Schaad & Housley Informational - July 2002 4
AES Key Wrap Algorithm February 2002
2) Calculate the intermediate values. 2) Calculate the intermediate values.
For t = s to 1 For t = s to 1
A[t-1] = MSB(64, AES-1(K, ((A[t] ^ t) | R[t][n])) A[t-1] = MSB(64, AES-1(K, ((A[t] ^ t) | R[t][n]))
R[t-1][1] = LSB(64, AES-1(K, ((A[t]^t) | R[t][n])) R[t-1][1] = LSB(64, AES-1(K, ((A[t]^t) | R[t][n]))
For i = 2 to n For i = 2 to n
R[t-1][i] = R[t][i-1] R[t-1][i] = R[t][i-1]
3) Output the results. 3) Output the results.
If A[0] is an appropriate initial value (see 2.2.3), If A[0] is an appropriate initial value (see 2.2.3),
Then Then
For i = 1 to n For i = 1 to n
P[i] = R[0][i] P[i] = R[0][i]
Else Else
Return an error Return an error
The unwrap algorithm can also be specified as an index based The unwrap algorithm can also be specified as an index based
skipping to change at line 281 skipping to change at page 6, line 47
If A is an appropriate initial value (see 2.2.3), If A is an appropriate initial value (see 2.2.3),
Then Then
For i = 1 to n For i = 1 to n
P[i] = R[i] P[i] = R[i]
Else Else
Return an error Return an error
2.2.3 Key Data Integrity -- the Initial Value 2.2.3 Key Data Integrity -- the Initial Value
Schaad & Housley Informational - July 2002 5
AES Key Wrap Algorithm February 2002
The initial value (IV) refers to the value assigned to A[0] in the The initial value (IV) refers to the value assigned to A[0] in the
first step of the wrapping process. This value is used to obtain an first step of the wrapping process. This value is used to obtain an
integrity check on the key data. In the final step of the integrity check on the key data. In the final step of the unwrapping
unwrapping process, the recovered value of A[0] is compared to the process, the recovered value of A[0] is compared to the expected
expected value of A[0]. If there is a match, the key is accepted as value of A[0]. If there is a match, the key is accepted as valid,
valid, and the unwrapping algorithm returns it. If there is not a and the unwrapping algorithm returns it. If there is not a match,
match, then the key is rejected, and the unwrapping algorithm then the key is rejected, and the unwrapping algorithm returns an
returns an error. error.
The exact properties achieved by this integrity check depend on the The exact properties achieved by this integrity check depend on the
definition of the initial value. Different applications may call definition of the initial value. Different applications may call for
for somewhat different properties; for example, whether there is somewhat different properties; for example, whether there is need to
need to determine the integrity of key data throughout its lifecycle determine the integrity of key data throughout its lifecycle or just
or just when it is unwrapped. This specification defines a default when it is unwrapped. This specification defines a default initial
initial value that supports integrity of the key data during the value that supports integrity of the key data during the period it is
period it is wrapped (2.2.3.1). Provision is also made to support wrapped (2.2.3.1). Provision is also made to support alternative
alternative initial values (in 2.2.3.2). initial values (in 2.2.3.2).
2.2.3.1 Default Initial Value 2.2.3.1 Default Initial Value
The default initial value (IV) is defined to be the hexadecimal The default initial value (IV) is defined to be the hexadecimal
constant: constant:
A[0] = IV = A6A6A6A6A6A6A6A6 A[0] = IV = A6A6A6A6A6A6A6A6
The use of a constant as the IV supports a strong integrity check on The use of a constant as the IV supports a strong integrity check on
the key data during the period that it is wrapped. If unwrapping the key data during the period that it is wrapped. If unwrapping
produces A[0] = A6A6A6A6A6A6A6A6, then the chance that the key data produces A[0] = A6A6A6A6A6A6A6A6, then the chance that the key data
is corrupt is 2^-64. If unwrapping produces A[0] any other value, is corrupt is 2^-64. If unwrapping produces A[0] any other value,
then the unwrap must return an error and not return any key data. then the unwrap must return an error and not return any key data.
2.2.3.2 Alternative Initial Values 2.2.3.2 Alternative Initial Values
When the key wrap is used as part of a larger key management When the key wrap is used as part of a larger key management protocol
protocol or system, the desired scope for data integrity may be more or system, the desired scope for data integrity may be more than just
than just the key data or the desired duration for more than just the key data or the desired duration for more than just the period
the period that it is wrapped. Also, if the key data is not just an that it is wrapped. Also, if the key data is not just an AES key, it
AES key, it may not always be a multiple of 64 bits. Alternative may not always be a multiple of 64 bits. Alternative definitions of
definitions of the initial value can be used to address such the initial value can be used to address such problems. NIST will
problems. NIST will define alternative initial values in future key define alternative initial values in future key management
management publications as needed. In order to accommodate a set of publications as needed. In order to accommodate a set of
alternatives that may evolve over time, key wrap implementations alternatives that may evolve over time, key wrap implementations that
that are not application-specific will require some flexibility in are not application-specific will require some flexibility in the way
the way that the initial value is set and tested. that the initial value is set and tested.
3 Object Identifiers 3. Object Identifiers
NIST has assigned the following object identifiers to identify the NIST has assigned the following object identifiers to identify the
key wrap algorithm with the default initial value specified in key wrap algorithm with the default initial value specified in
2.2.3.1. One object identifier is assigned for use with each of the 2.2.3.1. One object identifier is assigned for use with each of the
KEK AES key sizes. KEK AES key sizes.
aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16)
Schaad & Housley Informational - July 2002 6
AES Key Wrap Algorithm February 2002
us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 } us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 }
id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 } id-aes128-wrap OBJECT IDENTIFIER ::= { aes 5 }
id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 } id-aes192-wrap OBJECT IDENTIFIER ::= { aes 25 }
id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 } id-aes256-wrap OBJECT IDENTIFIER ::= { aes 45 }
4 Test Vectors 4. Test Vectors
The examples in this section were generated using the index-based The examples in this section were generated using the index-based
implementation of the key wrap algorithm. The use of this approach implementation of the key wrap algorithm. The use of this approach
allows a straightforward software implementation of the key wrap allows a straightforward software implementation of the key wrap
algorithm. algorithm.
4.1 Wrap 128 bits of Key Data with a 128-bit KEK 4.1 Wrap 128 bits of Key Data with a 128-bit KEK
Input: Input:
KEK: 000102030405060708090A0B0C0D0E0F KEK: 000102030405060708090A0B0C0D0E0F
skipping to change at line 394 skipping to change at page 9, line 19
5 5
In 5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC In 5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC
Enc 93AEA71B258D90C3 25F5A3ADC2195401 07B2BD973E36A6FC Enc 93AEA71B258D90C3 25F5A3ADC2195401 07B2BD973E36A6FC
XorT 93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC XorT 93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC
6 6
In 93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC In 93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC
Enc E3EE986344D878F7 25F5A3ADC2195401 F14863BB1E9CA90A Enc E3EE986344D878F7 25F5A3ADC2195401 F14863BB1E9CA90A
XorT E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A XorT E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A
Schaad & Housley Informational - July 2002 7
AES Key Wrap Algorithm February 2002
7 7
In E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A In E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A
Enc 2BFC21B2C20E4006 B556D35ED8CEF052 F14863BB1E9CA90A Enc 2BFC21B2C20E4006 B556D35ED8CEF052 F14863BB1E9CA90A
XorT 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A XorT 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
8 8
In 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A In 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
Enc 4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB Enc 4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB
XorT 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB XorT 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB
skipping to change at line 450 skipping to change at page 10, line 24
XorT 93B71967EED41FFC AEF34BD8FB5A7B82 4FD3D2B7D74FBB42 XorT 93B71967EED41FFC AEF34BD8FB5A7B82 4FD3D2B7D74FBB42
Dec 5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42 Dec 5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42
10 10
In 5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42 In 5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42
XorT 5A9C7B1F5B1C3B46 BE114B343EB00981 4FD3D2B7D74FBB42 XorT 5A9C7B1F5B1C3B46 BE114B343EB00981 4FD3D2B7D74FBB42
Dec EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB Dec EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB
9 9
In EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB In EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB
Schaad & Housley Informational - July 2002 8
AES Key Wrap Algorithm February 2002
XorT EBE1CE91067024F3 BE114B343EB00981 64BAE5818D0570BB XorT EBE1CE91067024F3 BE114B343EB00981 64BAE5818D0570BB
Dec 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB Dec 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB
8 8
In 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB In 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB
XorT 4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB XorT 4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB
Dec 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A Dec 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
7 7
In 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A In 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
skipping to change at line 508 skipping to change at page 11, line 30
Output: Output:
Key Data: 00112233445566778899AABBCCDDEEFF Key Data: 00112233445566778899AABBCCDDEEFF
4.2 Wrap 128 bits of Key Data with a 192-bit KEK 4.2 Wrap 128 bits of Key Data with a 192-bit KEK
Input: Input:
KEK: 000102030405060708090A0B0C0D0E0F1011121314151617 KEK: 000102030405060708090A0B0C0D0E0F1011121314151617
Key Data: 00112233445566778899AABBCCDDEEFF Key Data: 00112233445566778899AABBCCDDEEFF
Schaad & Housley Informational - July 2002 9
AES Key Wrap Algorithm February 2002
Wrap: Wrap:
Step t A R1 R21 Step t A R1 R21
In A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF In A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
Enc DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF Enc DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
XorT DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF XorT DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
2 2
In DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF In DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
Enc 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D Enc 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
skipping to change at line 563 skipping to change at page 12, line 34
9 9
In 5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4 In 5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4
Enc 57ADA800299C2E85 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4 Enc 57ADA800299C2E85 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
XorT 57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4 XorT 57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
10 10
In 57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4 In 57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
Enc BF17BD6A9BC80163 4D5B3DFE7C04ABBA EB24CCFA52EA9078 Enc BF17BD6A9BC80163 4D5B3DFE7C04ABBA EB24CCFA52EA9078
XorT BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078 XorT BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078
Schaad & Housley Informational - July 2002 10
AES Key Wrap Algorithm February 2002
11 11
In BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078 In BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078
Enc B68BF270AE81544F F92B5B97C050AED2 EB24CCFA52EA9078 Enc B68BF270AE81544F F92B5B97C050AED2 EB24CCFA52EA9078
XorT B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078 XorT B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078
12 12
In B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078 In B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078
Enc 96778B25AE6CA439 F92B5B97C050AED2 468AB8A17AD84E5D Enc 96778B25AE6CA439 F92B5B97C050AED2 468AB8A17AD84E5D
XorT 96778B25AE6CA435 F92B5B97C050AED2 468AB8A17AD84E5D XorT 96778B25AE6CA435 F92B5B97C050AED2 468AB8A17AD84E5D
skipping to change at line 619 skipping to change at page 13, line 44
In 79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A In 79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A
XorT 79F849444F4B8AA8 D40B091CDBAC0340 05A2D8FB4DD5BD7A XorT 79F849444F4B8AA8 D40B091CDBAC0340 05A2D8FB4DD5BD7A
Dec AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A Dec AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A
6 6
In AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A In AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A
XorT AE2D0B76A6951EEA 429487269D3A0016 05A2D8FB4DD5BD7A XorT AE2D0B76A6951EEA 429487269D3A0016 05A2D8FB4DD5BD7A
Dec 15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919 Dec 15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919
5 5
Schaad & Housley Informational - July 2002 11
AES Key Wrap Algorithm February 2002
In 15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919 In 15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919
XorT 15D4B63F66583817 429487269D3A0016 05FC2D8F8FF4B919 XorT 15D4B63F66583817 429487269D3A0016 05FC2D8F8FF4B919
Dec 02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919 Dec 02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919
4 4
In 02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919 In 02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919
XorT 02A97C5897140595 BC164F51E20CC983 05FC2D8F8FF4B919 XorT 02A97C5897140595 BC164F51E20CC983 05FC2D8F8FF4B919
Dec 7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D Dec 7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D
3 3
In 7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D In 7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D
XorT 7B8E343CA51CF8AB BC164F51E20CC983 51F22F3286758A2D XorT 7B8E343CA51CF8AB BC164F51E20CC983 51F22F3286758A2D
Dec 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D Dec 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
2 2
In 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D In 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
XorT 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D XorT 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
Dec DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF Dec DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
skipping to change at line 675 skipping to change at page 15, line 4
2 2
In 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF In 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
Enc D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8 Enc D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
XorT D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8 XorT D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
3 3
In D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8 In D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
Enc 85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8 Enc 85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8
XorT 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8 XorT 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8
Schaad & Housley Informational - July 2002 12
AES Key Wrap Algorithm February 2002
4 4
In 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8 In 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8
Enc 738C291128B7226D 5602001BFA07AD8B 58924F777C3F678C Enc 738C291128B7226D 5602001BFA07AD8B 58924F777C3F678C
XorT 738C291128B72269 5602001BFA07AD8B 58924F777C3F678C XorT 738C291128B72269 5602001BFA07AD8B 58924F777C3F678C
5 5
In 738C291128B72269 5602001BFA07AD8B 58924F777C3F678C In 738C291128B72269 5602001BFA07AD8B 58924F777C3F678C
Enc 2656A02DFFF054DC F4DF378183E3D5B2 58924F777C3F678C Enc 2656A02DFFF054DC F4DF378183E3D5B2 58924F777C3F678C
XorT 2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C XorT 2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C
skipping to change at line 726 skipping to change at page 16, line 4
Enc 78E40190807CC151 63E9777905818A2A 3472D5993D318FD2 Enc 78E40190807CC151 63E9777905818A2A 3472D5993D318FD2
XorT 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2 XorT 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
12 12
In 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2 In 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
Enc 64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7 Enc 64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7
XorT 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7 XorT 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7
Output: Output:
Ciphertext: 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7 Ciphertext: 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7
Unwrap: Unwrap:
Step t A R1 R2 Step t A R1 R2
12 12
In 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7 In 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7
Schaad & Housley Informational - July 2002 13
AES Key Wrap Algorithm February 2002
XorT 64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7 XorT 64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7
Dec 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2 Dec 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
11 11
In 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2 In 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
XorT 78E40190807CC151 63E9777905818A2A 3472D5993D318FD2 XorT 78E40190807CC151 63E9777905818A2A 3472D5993D318FD2
Dec 877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2 Dec 877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2
10 10
In 877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2 In 877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2
skipping to change at line 789 skipping to change at page 17, line 14
3 3
In 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8 In 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8
XorT 85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8 XorT 85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8
Dec D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8 Dec D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
2 2
In D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8 In D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
XorT D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8 XorT D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
Dec 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF Dec 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
Schaad & Housley Informational - July 2002 14
AES Key Wrap Algorithm February 2002
1 1
In 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF In 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
XorT 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF XorT 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
Output: Output:
Key Data: 00112233445566778899AABBCCDDEEFF Key Data: 00112233445566778899AABBCCDDEEFF
skipping to change at line 845 skipping to change at page 18, line 21
4 4
In 2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D In 2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D
FF540E514DE120A3 FF540E514DE120A3
Enc E727C7BDF822602E A08DAA041D17BBBA 51F22F3286758A2D Enc E727C7BDF822602E A08DAA041D17BBBA 51F22F3286758A2D
FF540E514DE120A3 FF540E514DE120A3
XorT E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D XorT E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
FF540E514DE120A3 FF540E514DE120A3
5 5
Schaad & Housley Informational - July 2002 15
AES Key Wrap Algorithm February 2002
In E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D In E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
FF540E514DE120A3 FF540E514DE120A3
Enc 15B61F7B25D51700 A08DAA041D17BBBA AE82BC1118A5DEA4 Enc 15B61F7B25D51700 A08DAA041D17BBBA AE82BC1118A5DEA4
FF540E514DE120A3 FF540E514DE120A3
XorT 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4 XorT 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
FF540E514DE120A3 FF540E514DE120A3
6 6
In 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4 In 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
FF540E514DE120A3 FF540E514DE120A3
skipping to change at line 902 skipping to change at page 19, line 26
ED5E8456E61BD295 ED5E8456E61BD295
XorT 9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3 XorT 9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
ED5E8456E61BD295 ED5E8456E61BD295
11 11
In 9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3 In 9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
ED5E8456E61BD295 ED5E8456E61BD295
Enc B1B9902C68E0EB52 98883EDC6B080FB5 63F6D88A0663FEF9 Enc B1B9902C68E0EB52 98883EDC6B080FB5 63F6D88A0663FEF9
ED5E8456E61BD295 ED5E8456E61BD295
XorT B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9 XorT B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
Schaad & Housley Informational - July 2002 16
AES Key Wrap Algorithm February 2002
ED5E8456E61BD295 ED5E8456E61BD295
12 12
In B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9 In B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
ED5E8456E61BD295 ED5E8456E61BD295
Enc FCE591D77709A6E0 98883EDC6B080FB5 63F6D88A0663FEF9 Enc FCE591D77709A6E0 98883EDC6B080FB5 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
XorT FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9 XorT FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
skipping to change at line 959 skipping to change at page 20, line 31
In ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4 In ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4
84943C8C67FCFD53 84943C8C67FCFD53
Enc E7CC8D8CEDE62BF7 68F24EC260743EDC E1C6C7DDEE725A93 Enc E7CC8D8CEDE62BF7 68F24EC260743EDC E1C6C7DDEE725A93
84943C8C67FCFD53 84943C8C67FCFD53
XorT E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93 XorT E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
84943C8C67FCFD53 84943C8C67FCFD53
18 18
In E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93 In E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
84943C8C67FCFD53 84943C8C67FCFD53
Schaad & Housley Informational - July 2002 17
AES Key Wrap Algorithm February 2002
Enc 031D33264E15D320 68F24EC260743EDC E1C6C7DDEE725A93 Enc 031D33264E15D320 68F24EC260743EDC E1C6C7DDEE725A93
6BA814915C6762D2 6BA814915C6762D2
XorT 031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93 XorT 031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93
6BA814915C6762D2 6BA814915C6762D2
Output: Output:
Ciphertext 031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93 Ciphertext 031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93
6BA814915C6762D2 6BA814915C6762D2
Unwrap: Unwrap:
skipping to change at line 1016 skipping to change at page 21, line 36
463437433A93EFE5 463437433A93EFE5
14 14
In 6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4 In 6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4
463437433A93EFE5 463437433A93EFE5
XorT 6AC861AB961DA578 C46965F34EFB2261 56E3CEE892BBEFC4 XorT 6AC861AB961DA578 C46965F34EFB2261 56E3CEE892BBEFC4
463437433A93EFE5 463437433A93EFE5
Dec 428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9 Dec 428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
Schaad & Housley Informational - July 2002 18
AES Key Wrap Algorithm February 2002
13 13
In 428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9 In 428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
XorT 428428D2BD88CF58 C46965F34EFB2261 63F6D88A0663FEF9 XorT 428428D2BD88CF58 C46965F34EFB2261 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
Dec FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9 Dec FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
463437433A93EFE5 463437433A93EFE5
12 12
In FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9 In FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
skipping to change at line 1072 skipping to change at page 22, line 41
XorT 864F408C8AB8CDCF 926ED65A9E853FD9 552A09E141D08AE3 XorT 864F408C8AB8CDCF 926ED65A9E853FD9 552A09E141D08AE3
D1E708FD13778787 D1E708FD13778787
Dec 5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4 Dec 5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
7 7
In 5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4 In 5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
XorT 5A994895D81644B7 926ED65A9E853FD9 AE82BC1118A5DEA4 XorT 5A994895D81644B7 926ED65A9E853FD9 AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
Schaad & Housley Informational - July 2002 19
AES Key Wrap Algorithm February 2002
Dec A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4 Dec A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
6 6
In A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4 In A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
XorT A187755AEA64719C A08DAA041D17BBBA AE82BC1118A5DEA4 XorT A187755AEA64719C A08DAA041D17BBBA AE82BC1118A5DEA4
D1E708FD13778787 D1E708FD13778787
Dec 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4 Dec 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
FF540E514DE120A3 FF540E514DE120A3
skipping to change at line 1129 skipping to change at page 23, line 46
1 1
In DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF In DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
0001020304050607 0001020304050607
XorT DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF XorT DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
0001020304050607 0001020304050607
Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
0001020304050607 0001020304050607
Plaintext A6A6A6A6A6A6A6A6 0011223344556677 Plaintext A6A6A6A6A6A6A6A6 0011223344556677
8899AABBCCDDEEFF 0001020304050607 8899AABBCCDDEEFF 0001020304050607
Schaad & Housley Informational - July 2002 20
AES Key Wrap Algorithm February 2002
Output: Output:
Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607 Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607
4.5 Wrap 192 bits of Key Data with a 256-bit KEK 4.5 Wrap 192 bits of Key Data with a 256-bit KEK
Input: Input:
KEK: KEK:
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607 Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607
skipping to change at line 1178 skipping to change at page 25, line 4
XorT 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8 XorT 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 6CA405593A3B5154
4 4
In 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8 In 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 6CA405593A3B5154
Enc F1D28EA6295891EC 0CC86A4D9B9C6A31 F60E0CDB7F429FE8 Enc F1D28EA6295891EC 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
6CA405593A3B5154 6CA405593A3B5154
XorT F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8 XorT F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
6CA405593A3B5154 6CA405593A3B5154
5 5
In F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8 In F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
6CA405593A3B5154 6CA405593A3B5154
Enc BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 Enc BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
6CA405593A3B5154 6CA405593A3B5154
XorT BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 XorT BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
Schaad & Housley Informational - July 2002 21
AES Key Wrap Algorithm February 2002
6CA405593A3B5154 6CA405593A3B5154
6 6
In BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 In BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
6CA405593A3B5154 6CA405593A3B5154
Enc 6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 Enc 6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
XorT 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 XorT 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
skipping to change at line 1242 skipping to change at page 26, line 15
In A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD In A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD
740A273461ED82C6 740A273461ED82C6
Enc B50C330616E7B1C7 FB1611A83BEB567F 73EDC8CB9322C34E Enc B50C330616E7B1C7 FB1611A83BEB567F 73EDC8CB9322C34E
740A273461ED82C6 740A273461ED82C6
XorT B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E XorT B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
740A273461ED82C6 740A273461ED82C6
12 12
In B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E In B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
740A273461ED82C6 740A273461ED82C6
Schaad & Housley Informational - July 2002 22
AES Key Wrap Algorithm February 2002
Enc FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E Enc FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
XorT FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E XorT FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
13 13
In FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E In FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
Enc 82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E Enc 82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
skipping to change at line 1299 skipping to change at page 27, line 20
C490C33642717146 C490C33642717146
18 18
In 39128CE5E435F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895 In 39128CE5E435F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895
C490C33642717146 C490C33642717146
Enc A8F9BC1612C68B2D F6E6F4FBE30E71E4 769C8B80A32CB895 Enc A8F9BC1612C68B2D F6E6F4FBE30E71E4 769C8B80A32CB895
8CD5D17D6B254DA1 8CD5D17D6B254DA1
XorT A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895 XorT A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895
8CD5D17D6B254DA1 8CD5D17D6B254DA1
Schaad & Housley Informational - July 2002 23
AES Key Wrap Algorithm February 2002
Ciphertext A8F9BC1612C68B3F F6E6F4FBE30E71E4 Ciphertext A8F9BC1612C68B3F F6E6F4FBE30E71E4
769C8B80A32CB895 8CD5D17D6B254DA1 769C8B80A32CB895 8CD5D17D6B254DA1
Unwrap: Unwrap:
Step t A/R3 R1 R2 Step t A/R3 R1 R2
18 18
In A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895 In A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895
8CD5D17D6B254DA1 8CD5D17D6B254DA1
skipping to change at line 1355 skipping to change at page 28, line 26
0B08CFDF48020F0D 0B08CFDF48020F0D
Dec 82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E Dec 82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
13 13
In 82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E In 82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
XorT 82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E XorT 82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
Dec FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E Dec FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
Schaad & Housley Informational - July 2002 24
AES Key Wrap Algorithm February 2002
0B08CFDF48020F0D 0B08CFDF48020F0D
12 12
In FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E In FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
XorT FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E XorT FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E
0B08CFDF48020F0D 0B08CFDF48020F0D
Dec B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E Dec B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
740A273461ED82C6 740A273461ED82C6
skipping to change at line 1412 skipping to change at page 29, line 31
In D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9 In D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
XorT D532789E4E79D819 444F92BF78E77BB1 AEBE2D5C8BF747A9 XorT D532789E4E79D819 444F92BF78E77BB1 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
Dec 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 Dec 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
6 6
In 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 In 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
Schaad & Housley Informational - July 2002 25
AES Key Wrap Algorithm February 2002
XorT 6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 XorT 6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
39EBC1A1A53FF55B 39EBC1A1A53FF55B
Dec BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 Dec BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
6CA405593A3B5154 6CA405593A3B5154
5 5
In BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 In BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
6CA405593A3B5154 6CA405593A3B5154
XorT BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9 XorT BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
6CA405593A3B5154 6CA405593A3B5154
skipping to change at line 1469 skipping to change at page 30, line 36
0001020304050607 0001020304050607
Plaintext A6A6A6A6A6A6A6A6 0011223344556677 Plaintext A6A6A6A6A6A6A6A6 0011223344556677
8899AABBCCDDEEFF 0001020304050607 8899AABBCCDDEEFF 0001020304050607
Output: Output:
Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607 Key Data: 00112233445566778899AABBCCDDEEFF0001020304050607
4.6 Wrap 256 bits of Key Data with a 256-bit KEK 4.6 Wrap 256 bits of Key Data with a 256-bit KEK
Schaad & Housley Informational - July 2002 26
AES Key Wrap Algorithm February 2002
Input: Input:
KEK: KEK:
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
Key Data: Key Data:
00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F 00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F
Wrap: Wrap:
Step t A/R3 R1/R4 R2 Step t A/R3 R1/R4 R2
1 1
In A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF In A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
0001020304050607 08090A0B0C0D0E0F 0001020304050607 08090A0B0C0D0E0F
Enc 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF Enc 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
0001020304050607 08090A0B0C0D0E0F 0001020304050607 08090A0B0C0D0E0F
XorT 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF XorT 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
skipping to change at line 1521 skipping to change at page 32, line 4
XorT 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8 XorT 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
5 5
In 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8 In 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
Enc 4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8 Enc 4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
XorT 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8 XorT 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
6 6
In 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8 In 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
Schaad & Housley Informational - July 2002 27
AES Key Wrap Algorithm February 2002
Enc 963AAFFD96B223EC E7D1194D853E53F8 EFD48BA304945576 Enc 963AAFFD96B223EC E7D1194D853E53F8 EFD48BA304945576
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
XorT 963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576 XorT 963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
7 7
In 963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576 In 963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
Enc 66D7A8ADD086B9DD E7D1194D853E53F8 EFD48BA304945576 Enc 66D7A8ADD086B9DD E7D1194D853E53F8 EFD48BA304945576
C365B66943E2D760 E5923CB9FDB56FBC C365B66943E2D760 E5923CB9FDB56FBC
skipping to change at line 1573 skipping to change at page 33, line 4
XorT DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
C365B66943E2D760 73E3B6CBE5D05D74 C365B66943E2D760 73E3B6CBE5D05D74
11 11
In DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA In DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
C365B66943E2D760 73E3B6CBE5D05D74 C365B66943E2D760 73E3B6CBE5D05D74
Enc 0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA Enc 0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
XorT 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
12 12
In 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA In 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
Enc F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA Enc F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
XorT F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
Schaad & Housley Informational - July 2002 28
AES Key Wrap Algorithm February 2002
13 13
In F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA In F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
Enc 2E8E2B6BB2016696 4745856AF333F01F FBEC169FA5C0F6BA Enc 2E8E2B6BB2016696 4745856AF333F01F FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
XorT 2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA XorT 2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
14 14
In 2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA In 2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
skipping to change at line 1638 skipping to change at page 34, line 17
Enc F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36 Enc F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
XorT F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36 XorT F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
19 19
In F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36 In F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
Enc B422B444B87A190B 1BB8C765A84195E7 F7EDAD518C960D36 Enc B422B444B87A190B 1BB8C765A84195E7 F7EDAD518C960D36
1CFBF6B4C24CB982 40F68C91DB49702C 1CFBF6B4C24CB982 40F68C91DB49702C
Schaad & Housley Informational - July 2002 29
AES Key Wrap Algorithm February 2002
XorT B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36 XorT B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
1CFBF6B4C24CB982 40F68C91DB49702C 1CFBF6B4C24CB982 40F68C91DB49702C
20 20
In B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36 In B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
1CFBF6B4C24CB982 40F68C91DB49702C 1CFBF6B4C24CB982 40F68C91DB49702C
Enc D058823360F88A37 1BB8C765A84195E7 F7EDAD518C960D36 Enc D058823360F88A37 1BB8C765A84195E7 F7EDAD518C960D36
1CFBF6B4C24CB982 07DFE775B9687E73 1CFBF6B4C24CB982 07DFE775B9687E73
XorT D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36 XorT D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36
1CFBF6B4C24CB982 07DFE775B9687E73 1CFBF6B4C24CB982 07DFE775B9687E73
skipping to change at line 1695 skipping to change at page 35, line 22
Output: Output:
Ciphertext 28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326 Ciphertext 28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326
CBC7F0E71A99F43B FB988B9B7A02DD21 CBC7F0E71A99F43B FB988B9B7A02DD21
Unwrap: Unwrap:
Step t A/R3 R1/R4 R2 Step t A/R3 R1/R4 R2
24 24
In 28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326 In 28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326
Schaad & Housley Informational - July 2002 30
AES Key Wrap Algorithm February 2002
CBC7F0E71A99F43B FB988B9B7A02DD21 CBC7F0E71A99F43B FB988B9B7A02DD21
XorT 28C9F404C4B810EC CBCCB35CFB87F826 3F5786E2D80ED326 XorT 28C9F404C4B810EC CBCCB35CFB87F826 3F5786E2D80ED326
CBC7F0E71A99F43B FB988B9B7A02DD21 CBC7F0E71A99F43B FB988B9B7A02DD21
Dec 0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326 Dec 0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
CBC7F0E71A99F43B 07DFE775B9687E73 CBC7F0E71A99F43B 07DFE775B9687E73
23 23
In 0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326 In 0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
CBC7F0E71A99F43B 07DFE775B9687E73 CBC7F0E71A99F43B 07DFE775B9687E73
XorT 0AEB82AE3146A91B CBCCB35CFB87F826 3F5786E2D80ED326 XorT 0AEB82AE3146A91B CBCCB35CFB87F826 3F5786E2D80ED326
skipping to change at line 1753 skipping to change at page 36, line 28
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
18 18
In F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36 In F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
XorT F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36 XorT F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
Dec A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B Dec A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
Schaad & Housley Informational - July 2002 31
AES Key Wrap Algorithm February 2002
17 17
In A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B In A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
XorT A5382A26B47551F1 1BB8C765A84195E7 BCA418BBF7DCE60B XorT A5382A26B47551F1 1BB8C765A84195E7 BCA418BBF7DCE60B
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
Dec 5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B Dec 5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
C272E9466AAE98F9 40F68C91DB49702C C272E9466AAE98F9 40F68C91DB49702C
16 16
In 5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B In 5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
skipping to change at line 1809 skipping to change at page 37, line 33
XorT F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 3CF149E90E8C04D9 F56701DAF0388216 3CF149E90E8C04D9
Dec 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA Dec 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
11 11
In 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA In 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
XorT 0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT 0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA
Schaad & Housley Informational - July 2002 32
AES Key Wrap Algorithm February 2002
F56701DAF0388216 73E3B6CBE5D05D74 F56701DAF0388216 73E3B6CBE5D05D74
Dec DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA Dec DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
C365B66943E2D760 73E3B6CBE5D05D74 C365B66943E2D760 73E3B6CBE5D05D74
10 10
In DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA In DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
C365B66943E2D760 73E3B6CBE5D05D74 C365B66943E2D760 73E3B6CBE5D05D74
XorT DBA417FB51F9E3CB D6AE29ECE7192D43 FBEC169FA5C0F6BA XorT DBA417FB51F9E3CB D6AE29ECE7192D43 FBEC169FA5C0F6BA
C365B66943E2D760 73E3B6CBE5D05D74 C365B66943E2D760 73E3B6CBE5D05D74
Dec 1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576 Dec 1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576
skipping to change at line 1865 skipping to change at page 38, line 37
5 5
In 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8 In 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
XorT 4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8 XorT 4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
Dec 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8 Dec 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
4 4
Schaad & Housley Informational - July 2002 33
AES Key Wrap Algorithm February 2002
In 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8 In 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
XorT 564408FDD0DD2EA4 F661BD9F31FBFA31 F60E0CDB7F429FE8 XorT 564408FDD0DD2EA4 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 E5923CB9FDB56FBC 6CA405593A3B5154 E5923CB9FDB56FBC
Dec 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8 Dec 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 08090A0B0C0D0E0F 6CA405593A3B5154 08090A0B0C0D0E0F
3 3
In 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8 In 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
6CA405593A3B5154 08090A0B0C0D0E0F 6CA405593A3B5154 08090A0B0C0D0E0F
skipping to change at line 1907 skipping to change at page 39, line 27
Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF Dec A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
0001020304050607 08090A0B0C0D0E0F 0001020304050607 08090A0B0C0D0E0F
Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
0001020304050607 08090A0B0C0D0E0F 0001020304050607 08090A0B0C0D0E0F
Output: Output:
Key Data: Key Data:
00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F 00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F
5 Security Considerations 5. Security Considerations
The key wrap algorithm includes a strong integrity check on the key The key wrap algorithm includes a strong integrity check on the key
data. If unwrapping produces the expected check value in A[0], then data. If unwrapping produces the expected check value in A[0], then
the chance that the key data is corrupt is 2^-64. If unwrapping the chance that the key data is corrupt is 2^-64. If unwrapping
produces an unexpected value, then the algorithm implementation MUST produces an unexpected value, then the algorithm implementation MUST
return an error, and it MUST NOT return any key data. return an error, and it MUST NOT return any key data.
Implementations must protect the KEK from disclosure. Compromise of Implementations must protect the KEK from disclosure. Compromise of
the KEK may result in the disclosure of all key data protected with the KEK may result in the disclosure of all key data protected with
that KEK. that KEK.
6 References 6. References
AES National Institute of Standards and Technology.
Schaad & Housley Informational - July 2002 34
AES Key Wrap Algorithm February 2002
FIPS Pub 197: Advanced Encryption Standard (AES). AES National Institute of Standards and Technology. FIPS Pub
26 November 2001. 197: Advanced Encryption Standard (AES). 26 November 2001.
AES-WRAP National Institute of Standards and Technology. AES-WRAP National Institute of Standards and Technology. AES Key
AES Key Wrap Specification. 17 November 2001. Wrap Specification. 17 November 2001.
[http://csrc.nist.gov/encryption/kms/key-wrap.pdf] [http://csrc.nist.gov/encryption/kms/key-wrap.pdf]
7 Acknowledgments 7. Acknowledgments
Most of the text in this document is taken from [AES-WRAP]. The Most of the text in this document is taken from [AES-WRAP]. The
authors of that document are responsible for the development of the authors of that document are responsible for the development of the
AES key wrap algorithm. AES key wrap algorithm.
8 Author's Addresses 8. Authors' Addresses
Jim Schaad Jim Schaad
Soaring Hawk Consulting Soaring Hawk Consulting
Email: jimsch@exmsft.com EMail: jimsch@exmsft.com
Russell Housley Russell Housley
RSA Laboratories RSA Laboratories
918 Spring Knoll Drive 918 Spring Knoll Drive
Herndon, VA 20170 Herndon, VA 20170
USA USA
Email: rhousley@rsasecurity.com EMail: rhousley@rsasecurity.com
Schaad & Housley Informational - July 2002 35 9. Full Copyright Statement
AES Key Wrap Algorithm February 2002
Full Copyright Statement Copyright (C) The Internet Society (2002). All Rights Reserved.
"Copyright (C) The Internet Society 2002. All Rights Reserved. This document and translations of it may be copied and furnished to
others provided that the above copyright notice and this paragraph
are included on all such copies. However, this document itself may
not be modified in any way, such as by removing the copyright notice
or references to the Internet Society or other Internet
organizations, except as required to translate it into languages
other than English.
This document and translations of it may be copied and The limited permissions granted above are perpetual and will not be
furnished to others, and derivative works that comment on or revoked by the Internet Society or its successors or assigns.
otherwise explain it or assist in its implementation may be
prepared, copied, published and distributed, in whole or in
part, without restriction of any kind, provided that the above
copyright notice and this paragraph are included on all such
copies and derivative works. However, this document itself may
not be modified in any way, such as by removing the copyright
notice or references to the Internet Society or other Internet
organizations, except as needed for the purpose of developing
Internet standards in which case the procedures for copyrights
defined in the Internet Standards process must be followed, or
as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will This document and the information contained herein is provided on an
not be revoked by the Internet Society or its successors or assigns. "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Schaad & Housley Informational - July 2002 36 Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/