Revisiting AES Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of NIST SP 800-38F

John Preuß Mattsson

Paper 2026/2636

Revisiting AES Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of NIST SP 800-38F

John Preuß Mattsson

, Ericsson Research

Abstract

NIST is revising SP~800-38F, which specifies the AES Key Wrap modes KW and KWP. This paper is an updated and expanded version of our technical comments to NIST. We show that the forgery probabilities stated in SP~800-38F do not account for adaptive attacks, give the resulting forgery probabilities for KW, KWP, and TKW, and show that checking the expected plaintext length can raise the security level of KWP considerably. Revisiting Kelsey's long-message observation, we correct the collision conditions, show that a successful forgery leaks a plaintext prefix, derive an encryption-only distinguisher, and conclude that KW does not have beyond-birthday-bound security. We explain the role of the step counter, analyse the single-semiblock path of KWP and the trade-off between the number of passes and the length limit, and give recommendations for the revision, for implementations, and for future key-wrap designs.

Metadata

Available format(s): PDF
Category: Secret-key cryptography
Publication info: Preprint.
Keywords: key wrapping AES Key Wrap KW KWP DAE deterministic authenticated encryption NIST SP~800-38F reforgeability
Contact author(s): john mattsson @ ericsson com
History: 2026-10-26: approved; 2026-10-25: received; See all versions
Short URL: https://ia.cr/2026/2636
License: CC BY

BibTeX

@misc{cryptoeprint:2026/2636,
      author = {John Preuß Mattsson},
      title = {Revisiting {AES} Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of {NIST} {SP} 800-{38F}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2636},
      year = {2026},
      url = {https://eprint.iacr.org/2026/2636}
}