jedisct1/rust-aes-keywrap

AES Key Wrap construction for Rust.

AES Key Wrap for Rust

AES Key Wrap is a construction to encrypt secret keys using a master key.

This is an AES-KWP (NIST SP800-38F) implementation for Rust.

It is essentially a 5 round Feistel network using AES as the core function. One half of each AES block is used to encrypt the key, and the second half of the last permutation is used to compute a 64-bit MAC.

It doesn't require nonces, but still allows key reuse.

This is a NIST-blessed construction. Other than that, AES Key Wrap is inefficient and is generally not very useful.

rust-aes-keywrap's Issues

Does this crate implement RFC3394?

This is an AES-KW (RFC 3394 / RFC 5649) implementation for Rust.

I thought this crate had implemented RFC3394. I tested RFC3394 test-vectors, but the test got always AuthenticationFailed.
I compared this crate and the aes_keywrap module of Python. And I found out this crate implemented only RFC5649.

    let mut kek: [u8; 16] = [0; 16];
    hex::decode_to_slice("000102030405060708090A0B0C0D0E0F", &mut kek).expect("");
    let cipher = hex::decode("1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5").expect("");
    let plain = hex::decode("00112233445566778899AABBCCDDEEFF").expect("");
    let aes_kw = Aes128KeyWrap::new(&kek);
    assert_eq!(cipher, aes_kw.encapsulate(&plain).unwrap()); // Got assertion failed.
    assert_eq!(plain, aes_kw.decapsulate(&cipher, kek.len()).unwrap()); // Got authentication failed.

Could you check this out?

Trouble running NIST SP800-38F test vectors

I'm trying to run some NIST SP800-38F test vectors against this crate, but it's failing. Can you please tell me what I'm doing wrong?

The vectors come from: https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/mac/kwtestvectors.zip

For example, if I try this vector:

[PLAINTEXT LENGTH = 248]

COUNT = 0
K = e9bb7f44c7baafbf392ab912589a2f8db53268106eafb74689bb1833136e6113
P = ffe952604834bff899e63658f34246815c91597eb40a21729e0a8a959b61f2
C = 15b9f06fbc765e5e3d55d6b824616f21921d2a6918ee7bf1406b524274e170b4a78333ca5ee92af5

Against the implementation in aes_kw, and also in Python versus the cryptography.hazmat.primitives.keywrap import aes_key_wrap_with_padding implementation, I get a ciphertext that matches the test vector.

However, when I run this code:

    let key_vec = hex::decode("e9bb7f44c7baafbf392ab912589a2f8db53268106eafb74689bb1833136e6113").unwrap();
    let kwp = Aes256KeyWrap::new(&key_vec.try_into().unwrap());

    let p_vec = hex::decode("ffe952604834bff899e63658f34246815c91597eb40a21729e0a8a959b61f2").unwrap();
    let enc = kwp.encapsulate(&p_vec).unwrap();
    assert_eq!(enc, hex::decode("15b9f06fbc765e5e3d55d6b824616f21921d2a6918ee7bf1406b524274e170b4a78333ca5ee92af5").unwrap());

It doesn't work: the result is f80268cb6552342449a0e088b9846c061c6622249558ce1fddaf777783d8a480094857707e7d09d2 instead.

What am I doing wrong? thank you!