AES Key Wrap (KW)

← Back to glossary

What key wrapping solves

Storing or transmitting a symmetric key alongside the data it protects creates an obvious problem: anyone who can read the file metadata can read the key. Key wrapping protects the symmetric key by encrypting it with a different (usually higher-privilege) symmetric key — the wrap key. The wrapped key is safe to store with the file metadata; only a holder of the wrap key can recover the data key.

Why AES Key Wrap specifically

Most "encrypt a key with a key" patterns require an IV. AES Key Wrap is deterministic and IV-free — you cannot accidentally weaken it by reusing an IV. It is FIPS-approved (SP 800-38F) and used throughout NIST cryptographic standards. SkyeConnex's choice of AES-KW is partly about correctness-by-construction: there's no IV mistake to make.

SkyeConnex's wrap chain

Every file's Data Encryption Key (DEK) is wrapped with AES Key Wrap using the User Master Key (UMK). The wrapped DEK is stored with file metadata; it is recoverable only by a holder of the unwrapped UMK. The UMK itself is derived on the client from the user's password (via scrypt) or recovery key. On the Sovereign tier, the wrapping is composed with ML-KEM-1024 for hybrid post-quantum protection.

Why hybrid wrap matters

A pure post-quantum wrap relies entirely on the security of the new lattice-based algorithms. A pure classical wrap relies entirely on AES surviving quantum computers. The hybrid composition — AES Key Wrap combined with ML-KEM-1024 — means an adversary must defeat both to recover the wrapped key. A quantum break against ML-KEM still leaves AES standing.

Operationally

AES Key Wrap is fast — at typical key sizes (256 bits), wrapping is a single-digit microsecond operation. It does not appear in any read-path latency budget. The complexity SkyeConnex manages is around when wraps are computed, not how fast they are.

Related terms

• Data Encryption Key (DEK)
• User Master Key (UMK)
• ML-KEM-1024

See also

• SkyeConnex Architecture
• Cryptographic Posture
• Whitepaper v1.2