From c2f1a5959173417c8c19c9f14593a5d351846bf4 Mon Sep 17 00:00:00 2001 From: bleichen Date: Fri, 23 Aug 2019 06:45:37 -0700 Subject: [PATCH] Adding difference between NIST standard and RFC for KeyWrap. NOKEYCHECK=True PiperOrigin-RevId: 265045010 GitOrigin-RevId: e6a7420bac93cc3e0e610f8f511a3c5f36309f7f --- doc/key_wrap.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/doc/key_wrap.md b/doc/key_wrap.md index 1d591ff..749bd29 100644 --- a/doc/key_wrap.md +++ b/doc/key_wrap.md @@ -21,6 +21,14 @@ of an "ideal pseudorandom permutation" without a precise definition. ![Image of the pseudorandom function W](W.svg){style="display:block;margin:auto"} +# Ambiguities + +There are some minor differences between NIST SP 800 38f and the RFCs. +NIST does not define a KWP when the wrapped key is 64-bits long. RFC 3394 +specifies in Section 2, that the input for the key wrap algorithm must be at +least two blocks and otherwise the constant field and key are simply encrypted +with ECB as a single block. + # Padding oracles (KWP) Keys wrapped with KWP are padded before the wrapping. The padding of a key K has