Two keys, generated for two different jobs
"Generate KEK" creates a real 2048-bit RSA-OAEP key pair, marked wrapKey/unwrapKey only — standing in for a KMS's master key. "Generate DEK" creates a real AES-256-GCM key, marked extractable, standing in for the fast, local, per-object data key the envelope-encryption use case describes.
Wrapping: one Web Crypto call, not a manual RSA step
"Wrap DEK" calls crypto.subtle.wrapKey directly — it exports the DEK's raw bytes and RSA-OAEP-encrypts them in a single atomic operation, so the DEK's plaintext bytes never separately exist in a variable your own code could accidentally log or leak. The result is exactly the size the RSA & public-key module's arithmetic predicts: a 2048-bit modulus produces a 256-byte wrapped output, regardless of the 256-bit DEK's own size.
Encrypting data locally, and unwrapping to read it back
"Encrypt" runs ordinary AES-256-GCM with the plaintext DEK, exactly like the AES-GCM tool. "Unwrap & decrypt" reverses the whole path: crypto.subtle.unwrapKey RSA-OAEP-decrypts the wrapped bytes and reconstructs a usable AES-GCM CryptoKey in one step, which then decrypts the stored ciphertext — the KMS-equivalent key (the KEK) never touches the actual data at any point.
What tampering the wrapped DEK actually breaks
"Tamper with wrapped DEK" flips one byte of the wrapped bytes before unwrapping. RSA-OAEP's own structural checks (covered in the RSA-OAEP tool) fail on the corrupted decryption output, and unwrapKey throws outright — there's no partial or garbled key recovered, just a clean failure.
The symmetric alternative: AES Key Wrap
The second panel wraps the same kind of AES key using AES-KW (RFC 3394) instead of RSA-OAEP — a completely different Web Crypto algorithm, requiring a shared symmetric wrapping key rather than a public/private pair. Watch the byte count: a 256-bit (32-byte) key wrapped this way always comes out exactly 40 bytes, the fixed 8-byte integrity-check overhead the key-wrapping use case describes, verified live rather than just asserted.