> Vishal Mahajan wrote:
>> Maybe I'll put my question again in other words --
>>
>> What's the difference between "wrapping a key" and "encrypting
>> a
>> key" :-\ ?
>
> Key wrapping algorithms are especially designed to provide extra
> security for encrypting and decrypting keys, as opposed to arbitrary
> data.
> See http://www.faqs.org/rfcs/rfc3394.html for example.
There are also two other "side benefits".
The first is the nature of key wrap algorithms - they embed some
information in the encrypted data that allows the decryptor to verify the
decrypt of the key worked correctly. That's important as normally when
you decrypt, context information (e.g. the decrypt should be plain text in
UTF-8 format) can tell you whether the decrypt worked. For a key, it's
supposed to be "random" garbage - it looks the same whether it decrypted
or not. So to have an embedded validity check is very useful.
The other benefit is a Java one. The call to unwrap (as apposed to
doFinal) puts the key immediately into a Key object, so you don't have to
work out how to import it into something the JCE will understand. Almost
a shorthand. Note that that's nothing to do with algorithms, just the way
the JCE handles unwrap.
Cheers,
Berin
