[Defect]: Variant pattern AES[-(128|192|256)]-Wrap[-PKCS7] unclear

[meghsaha-ibm]

Describe the defect

#834 has been closed, but the variant pattern AES[-(128|192|256)]-Wrap[-PKCS7] is unclear. PKCS7 is a symmetric padding scheme. What does the literal Wrap represent here? The variant pattern AES[-(128|192|256)][-(ECB|CBC|CFB(1|8|64|128)|OFB|CTR|XTS|CTS)][-{padding}][-{ivlen}] already covers the padding scheme. Not sure if the variant pattern AES[-(128|192|256)]-Wrap[-PKCS7] is required.

Additional context

The issue is data-quality / naming defect in the Cryptography Registry and can be fixed without changing schema behavior or introducing new algorithms.

[bhess]

Hi @meghsaha-ibm, the AES-Wrap pattern for 'Key Wrap with Padding' refers to RFC 5649.

Reading the RFC, it explicitly defines its own specific padding mechanism. Since this padding is an integral part of the RFC 5649 algorithm itself, it doesn't need to be expressed as a variant. Furthermore, the optional suffix -PKCS7 is technically inaccurate because RFC 5649 does not use PKCS#7 padding.

Would you agree to changing the pattern to AES[-(128|192|256)]-Wrap and removing the optional PKCS7 part to avoid confusion? @meghsaha-ibm @jvdsn

[jvdsn]

@bhess RFC 5649 should already be covered by AES[-(128|192|256)][-(KW|KWP)] (that RFC became a NIST standard under SP 800-38F). I took the "AES[-(128|192|256)]-Wrap[-PKCS7]" to mean something like AES encryption with PKCS7 padding, but I'm not sure.