Expand description
The key-wrap primitive kind: dedicated key-wrapping algorithms —
deterministic, integrity-checked encryption whose input domain is key
material, never messages (NIST SP 800-38F).
This interface is algorithm-agnostic. Per-algorithm interfaces (such
as aes-kw) mint kw-key resources bound to their algorithm; the
wrap and unwrap operations hang off the key, as everywhere in this
package.
Security:
- Wrapping is deterministic: no nonce is drawn, and the same key and
material yield the same wrapped bytes, so an observer can tell when
two wrapped payloads are equal. That is sound for high-entropy key
material and unsound for general data — which is why
wrapaccepts onlywrap-input: there is no direct bytes path. The restriction is friction, not a guarantee: arbitrary bytes can still arrive through an extractable import, as on the platform. - The integrity check is the algorithm’s (AES-KW’s 64-bit ICV), with
a correspondingly weaker forgery bound than an AEAD tag. Prefer an
aeadkey for wrapping when no fixed format requires KW.
Structs§
- KwKey
- A key-wrapping key: an unforgeable capability, bound to one
algorithm at creation. The extractability and getter contracts in
README.mdapply. - KwKey
Options - Mint-time policy for a
kw-key. Grants nothing by default; seeREADME.md, “Key-options contract”. The vocabulary is the W3C Web Cryptography API’s usage pair for AES-KW keys, which serve no other operations.