V6 Cryptography - Key wrapping explanation

[danielcuthbert]

[danielcuthbert]

I totally agree with this and feel we should not only explain what key wrapping is, but also when it should be used. My attempt at this is as follows (please by all means give feedback on if you feel it is legitimate and usable)

Cryptographic key wrapping is a method of protecting keys by encrypting a key using symmetric encryption in order to encapsulate said keys/material. The key used to encrypt the other key is called the wrapping key. This is often performed when you want to protect keys in places deemed untrustworthy, or send sensitive keys over untrusted networks or within applications.

[james-bitherder]

Suggested edit:
Cryptographic key wrap (and corresponding key unwrap) is a method of protecting an existing key by encapsulating (i.e. wrapping) it by employing an additional encryption mechanism so that the original key is not obviously exposed, e.g. during a transfer. This additional key used to protect the original key is referred to as the the wrap key.
This operation may be performed when it is desirable to protect keys in places deemed untrustworthy, or to send sensitive keys over untrusted networks or within applications.
However, serious consideration should be given to understanding the nature (e.g. the identity and the purpose) of the original key prior to committing to a wrap/unwrap procedure as this may have repercussions for both source and target systems/applications in terms of security and especially compliance which may include audit trails of a key's function (e.g. signing) as well as appropriate key storage.

[randomstuff]

I (so far) do not really know/understand (but I shall do my homework and find the answer 😉) why key wrapping as a special construct is useful in contrast to encrypting the key with some general encryption method (with some authentication). Maybe this should be clarified here?

[danielcuthbert]

It should, I'm just not sure if this is an Appendix addition over a requirement.

[jmanico]

...is key wrapping the same as envelope encryption?

[danielcuthbert]

@jmanico related but not the same. Envelope encryption involves encrypting the data using a data encryption key (DEK) and encrypting the DEK using the key encryption key (KEK) hence the envelope analogy