Re: [Cfrg] comments on AES Key Wrap with Pad

[Russ Housley <housley at vigilsec.com>]

Dan & Dave:

You have suggested things that should be added to the security 
considerations.  I'd prefer to back up a few hundred feet and see if 
some more general statements would be satisfactory.

Key Criteria:  I'd rather use the guidance that already appears in 
NIST description for the AES Key Wrap.  That is:

   The KEK must be at least as good as the keying material it is protecting.

AEAD: I'd rather explain why an algorithm dedicated to key wrapping 
is desirable.  That is:

   In the design of some high assurance cryptographic modules, it is
   desirable to segregate cryptographic keying material from other data.
   The use of a specific cryptographic mechanism solely for the
   protection of cryptographic keying material can assist in this goal.
   The AES Key Wrap and the AES Key Wrap with Pad are such mechanisms.
   System designers should not be tempted to use these algorithms to
   encrypt anything other than cryptographic keying material.

Russ