Class AesKeyWrapPad

Namespace

CryptoHives.Foundation.Security.Cryptography.Cipher

Assembly

CryptoHives.Foundation.Security.Cryptography.dll

AES Key Wrap with Padding as specified in RFC 5649 (and AES Key Wrap per RFC 3394).

public class AesKeyWrapPad : IDisposable

Inheritance

object

AesKeyWrapPad

Implements

IDisposable

Inherited Members

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

Remarks

AES Key Wrap with Padding (KWP) extends RFC 3394 AES Key Wrap to support arbitrary-length key material (1 byte minimum), adding zero-padding and a message length indicator to the integrity check value.

Algorithm overview:

• Uses AES ECB as the underlying block cipher
• Supports 128, 192, and 256-bit key encryption keys (KEKs)
• Wrap output is input length rounded up to 8-byte boundary + 8 bytes overhead
• Deterministic: same input always produces the same output

Example usage:

using var kwp = new AesKeyWrapPad(kek);
// Wrap a key
byte[] wrapped = kwp.WrapKey(keyToProtect);
// Unwrap a key
byte[] unwrapped = kwp.UnwrapKey(wrapped);

References:

• RFC 5649 — AES Key Wrap with Padding
• RFC 3394 — AES Key Wrap
• NIST SP 800-38F

Constructors

AesKeyWrapPad(ReadOnlySpan<byte>)

Initializes a new instance of the AesKeyWrapPad class.

public AesKeyWrapPad(ReadOnlySpan<byte> kek)

Parameters

kek ReadOnlySpan<byte>

The key encryption key (16, 24, or 32 bytes).

Exceptions

ArgumentException

Thrown when kek is not 16, 24, or 32 bytes.

Methods

Dispose()

Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.

public void Dispose()

Dispose(bool)

Releases resources used by this instance.

protected virtual void Dispose(bool disposing)

Parameters

disposing bool

True if called from Dispose(), false if from finalizer.

UnwrapKey(ReadOnlySpan<byte>)

Unwraps key material using AES Key Wrap with Padding (RFC 5649).

public byte[] UnwrapKey(ReadOnlySpan<byte> wrappedKey)

Parameters

wrappedKey ReadOnlySpan<byte>

The wrapped key to unwrap (minimum 16 bytes, multiple of 8).

Returns

byte[]

The original key material.

Exceptions

ArgumentException

Thrown when wrappedKey has invalid length.

CryptographicException

Thrown when integrity check fails.

ObjectDisposedException

Thrown when the instance has been disposed.

UnwrapKeyNoPad(ReadOnlySpan<byte>)

Unwraps key material using AES Key Wrap (RFC 3394) without padding.

public byte[] UnwrapKeyNoPad(ReadOnlySpan<byte> wrappedKey)

Parameters

wrappedKey ReadOnlySpan<byte>

The wrapped key to unwrap. Must be a multiple of 8 bytes and at least 24 bytes.

Returns

byte[]

The original key material (wrapped key length - 8 bytes).

Exceptions

ArgumentException

Thrown when wrappedKey has invalid length.

CryptographicException

Thrown when integrity check fails.

ObjectDisposedException

Thrown when the instance has been disposed.

WrapKey(ReadOnlySpan<byte>)

Wraps key material using AES Key Wrap with Padding (RFC 5649).

public byte[] WrapKey(ReadOnlySpan<byte> keyToWrap)

Parameters

keyToWrap ReadOnlySpan<byte>

The key material to wrap (1 or more bytes).

Returns

byte[]

The wrapped key. Length is input length rounded up to 8-byte boundary + 8 bytes.

Exceptions

ArgumentException

Thrown when keyToWrap is empty.

ObjectDisposedException

Thrown when the instance has been disposed.

WrapKeyNoPad(ReadOnlySpan<byte>)

Wraps key material using AES Key Wrap (RFC 3394) without padding.

public byte[] WrapKeyNoPad(ReadOnlySpan<byte> keyToWrap)

Parameters

keyToWrap ReadOnlySpan<byte>

The key material to wrap. Must be a multiple of 8 bytes and at least 16 bytes.

Returns

byte[]

The wrapped key (input length + 8 bytes).

Exceptions

ArgumentException

Thrown when keyToWrap is less than 16 bytes or not a multiple of 8.

ObjectDisposedException

Thrown when the instance has been disposed.