Symmetric-key

AES Key Wrap (RFC 3394) wrap & unwrap

Wrap a key under a key-encrypting key with real AES-KW, check the RFC 3394 answer, step through all 6·n AES operations, then flip one bit or use the wrong KEK and watch the integrity check fail.

What's happening under the hood →·Read the Symmetric-key cryptography & AES module for the full explanation →·See the Key wrapping and key exchange: moving keys without ever exposing them use case →·See the Envelope encryption: how a KMS actually protects your data use case →·See the BYOK and HYOK: who really controls your cloud encryption keys use case →

1. Wrap a key

Prefilled with RFC 3394 §4.3 (a 128-bit key under a 256-bit KEK), whose published answer is 64E8C3F9CE0F5BA263E9777905818A2A93C8191E7D6E8AE7.

KEK: key-encrypting key (hex)16 or 32 bytes (24 where the browser allows it)

Key data to wrap (hex)At least 16 bytes, in whole 8-byte blocks

2. Unwrap: change one bit, or use the wrong KEK, and watch the integrity check fail

KEK (hex)

Wrapped key (hex)