This supports RFC 3394 and RFC 5649,
which is also described in NIST SP 800 38f.
I also have a mini analysis of the primitive:
If one cares about distinguishing attacks then
there is an attack with a somewhat smaller complexity
than what NIST claims in their standard:
https://docs.google.com/document/d/1oH36v6SNdff5tkydC75EnqRyqqgHbXR4hy_SMPzwqVU/edit?usp=sharing
But even if one cares about these attacks then the key
wrappings are nowhere comparable to the attacks possible against e.g.
AES-GCM.
PiperOrigin-RevId: 192747615
GitOrigin-RevId: 0bebc767022ba3053c1d0391378d5c0b32b7f5be
Daniel Bleichenbacher
933e2e10aa