TOOLS / KEY MANAGEMENT

Key Encryption

Wrap and unwrap cryptographic keys under a KEK.

Operation
Algorithm

TDES-ECB, no padding. No integrity protection.

8/16/24/32 bytes.

16/24 bytes.

Calculator reference

Verification evidence and limitations →

What it calculates

Encrypts a working key under a separate key-encryption key.

Inputs and methods

TDES-ECB or AES-ECB; AES also supports RFC 3394 Key Wrap. Key and KEK are HEX.

Worked example

Select AES Key Wrap. KEK: 000102030405060708090A0B0C0D0E0F. Key: 00112233445566778899AABBCCDDEEFF.

1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5

Specification and limits

AES wrap checks integrity. ECB has no integrity check. Outputs are not TR-31 blocks.

RFC 3394 ↗