[Cryptech Tech] AES SIV mode for key wrapping?

[Russ Housley]

Paul:

>> SIV is seeing almost no uptake.  AES KEY-WRAP is preferred.
> 
> Uptake and technical value are not the same.
> 
> First, AES-SIV is being introduced into other non-IETF forums.
> 
> Second, AES-SIV is much more efficient that AES KEY-WRAP.
> 
> AES-SIV is also nonce insensitive.  A very nice property for an AEAD
> cipher.

I am aware of all of these properties, but I still recommend AES KEY-WRAP for two reasons.  First, I see little uptake.  I am aware of the places that Dan Harkins is pushing for its adoption, but they have not happened as yet.  Second, if someone wanted to use Cryptech to make a FIPS 140 module, they would need a FIPS validated mode for key wrapping.

Russ