/src/openssl/providers/implementations/ciphers/cipher_aes_wrp.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | /* |
11 | | * This file uses the low level AES functions (which are deprecated for |
12 | | * non-internal use) in order to implement provider AES ciphers. |
13 | | */ |
14 | | #include "internal/deprecated.h" |
15 | | |
16 | | #include <openssl/proverr.h> |
17 | | #include "cipher_aes.h" |
18 | | #include "prov/providercommon.h" |
19 | | #include "prov/implementations.h" |
20 | | |
21 | | /* AES wrap with padding has IV length of 4, without padding 8 */ |
22 | 0 | #define AES_WRAP_PAD_IVLEN 4 |
23 | | #define AES_WRAP_NOPAD_IVLEN 8 |
24 | | |
25 | | #define WRAP_FLAGS (PROV_CIPHER_FLAG_CUSTOM_IV) |
26 | | #define WRAP_FLAGS_INV (WRAP_FLAGS | PROV_CIPHER_FLAG_INVERSE_CIPHER) |
27 | | |
28 | | typedef size_t (*aeswrap_fn)(void *key, const unsigned char *iv, |
29 | | unsigned char *out, const unsigned char *in, |
30 | | size_t inlen, block128_f block); |
31 | | |
32 | | static OSSL_FUNC_cipher_encrypt_init_fn aes_wrap_einit; |
33 | | static OSSL_FUNC_cipher_decrypt_init_fn aes_wrap_dinit; |
34 | | static OSSL_FUNC_cipher_update_fn aes_wrap_cipher; |
35 | | static OSSL_FUNC_cipher_final_fn aes_wrap_final; |
36 | | static OSSL_FUNC_cipher_freectx_fn aes_wrap_freectx; |
37 | | static OSSL_FUNC_cipher_set_ctx_params_fn aes_wrap_set_ctx_params; |
38 | | |
39 | | typedef struct prov_aes_wrap_ctx_st { |
40 | | PROV_CIPHER_CTX base; |
41 | | union { |
42 | | OSSL_UNION_ALIGN; |
43 | | AES_KEY ks; |
44 | | } ks; |
45 | | aeswrap_fn wrapfn; |
46 | | |
47 | | } PROV_AES_WRAP_CTX; |
48 | | |
49 | | |
50 | | static void *aes_wrap_newctx(size_t kbits, size_t blkbits, |
51 | | size_t ivbits, unsigned int mode, uint64_t flags) |
52 | 0 | { |
53 | 0 | PROV_AES_WRAP_CTX *wctx; |
54 | 0 | PROV_CIPHER_CTX *ctx; |
55 | |
|
56 | 0 | if (!ossl_prov_is_running()) |
57 | 0 | return NULL; |
58 | | |
59 | 0 | wctx = OPENSSL_zalloc(sizeof(*wctx)); |
60 | 0 | ctx = (PROV_CIPHER_CTX *)wctx; |
61 | 0 | if (ctx != NULL) { |
62 | 0 | ossl_cipher_generic_initkey(ctx, kbits, blkbits, ivbits, mode, flags, |
63 | 0 | NULL, NULL); |
64 | 0 | ctx->pad = (ctx->ivlen == AES_WRAP_PAD_IVLEN); |
65 | 0 | } |
66 | 0 | return wctx; |
67 | 0 | } |
68 | | |
69 | | static void *aes_wrap_dupctx(void *wctx) |
70 | 0 | { |
71 | 0 | PROV_AES_WRAP_CTX *ctx = wctx; |
72 | 0 | PROV_AES_WRAP_CTX *dctx = wctx; |
73 | |
|
74 | 0 | if (!ossl_prov_is_running()) |
75 | 0 | return NULL; |
76 | | |
77 | 0 | if (ctx == NULL) |
78 | 0 | return NULL; |
79 | 0 | dctx = OPENSSL_memdup(ctx, sizeof(*ctx)); |
80 | |
|
81 | 0 | if (dctx != NULL && dctx->base.tlsmac != NULL && dctx->base.alloced) { |
82 | 0 | dctx->base.tlsmac = OPENSSL_memdup(dctx->base.tlsmac, |
83 | 0 | dctx->base.tlsmacsize); |
84 | 0 | if (dctx->base.tlsmac == NULL) { |
85 | 0 | OPENSSL_free(dctx); |
86 | 0 | dctx = NULL; |
87 | 0 | } |
88 | 0 | } |
89 | 0 | return dctx; |
90 | 0 | } |
91 | | |
92 | | static void aes_wrap_freectx(void *vctx) |
93 | 0 | { |
94 | 0 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; |
95 | |
|
96 | 0 | ossl_cipher_generic_reset_ctx((PROV_CIPHER_CTX *)vctx); |
97 | 0 | OPENSSL_clear_free(wctx, sizeof(*wctx)); |
98 | 0 | } |
99 | | |
100 | | static int aes_wrap_init(void *vctx, const unsigned char *key, |
101 | | size_t keylen, const unsigned char *iv, |
102 | | size_t ivlen, const OSSL_PARAM params[], int enc) |
103 | 0 | { |
104 | 0 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; |
105 | 0 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; |
106 | |
|
107 | 0 | if (!ossl_prov_is_running()) |
108 | 0 | return 0; |
109 | | |
110 | 0 | ctx->enc = enc; |
111 | 0 | if (ctx->pad) |
112 | 0 | wctx->wrapfn = enc ? CRYPTO_128_wrap_pad : CRYPTO_128_unwrap_pad; |
113 | 0 | else |
114 | 0 | wctx->wrapfn = enc ? CRYPTO_128_wrap : CRYPTO_128_unwrap; |
115 | |
|
116 | 0 | if (iv != NULL) { |
117 | 0 | if (!ossl_cipher_generic_initiv(ctx, iv, ivlen)) |
118 | 0 | return 0; |
119 | 0 | } |
120 | 0 | if (key != NULL) { |
121 | 0 | int use_forward_transform; |
122 | |
|
123 | 0 | if (keylen != ctx->keylen) { |
124 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); |
125 | 0 | return 0; |
126 | 0 | } |
127 | | /* |
128 | | * See SP800-38F : Section 5.1 |
129 | | * The forward and inverse transformations for the AES block |
130 | | * cipher—called “cipher” and “inverse cipher” are informally known as |
131 | | * the AES encryption and AES decryption functions, respectively. |
132 | | * If the designated cipher function for a key-wrap algorithm is chosen |
133 | | * to be the AES decryption function, then CIPH-1K will be the AES |
134 | | * encryption function. |
135 | | */ |
136 | 0 | if (ctx->inverse_cipher == 0) |
137 | 0 | use_forward_transform = ctx->enc; |
138 | 0 | else |
139 | 0 | use_forward_transform = !ctx->enc; |
140 | 0 | if (use_forward_transform) { |
141 | 0 | AES_set_encrypt_key(key, keylen * 8, &wctx->ks.ks); |
142 | 0 | ctx->block = (block128_f)AES_encrypt; |
143 | 0 | } else { |
144 | 0 | AES_set_decrypt_key(key, keylen * 8, &wctx->ks.ks); |
145 | 0 | ctx->block = (block128_f)AES_decrypt; |
146 | 0 | } |
147 | 0 | } |
148 | 0 | return aes_wrap_set_ctx_params(ctx, params); |
149 | 0 | } |
150 | | |
151 | | static int aes_wrap_einit(void *ctx, const unsigned char *key, size_t keylen, |
152 | | const unsigned char *iv, size_t ivlen, |
153 | | const OSSL_PARAM params[]) |
154 | 0 | { |
155 | 0 | return aes_wrap_init(ctx, key, keylen, iv, ivlen, params, 1); |
156 | 0 | } |
157 | | |
158 | | static int aes_wrap_dinit(void *ctx, const unsigned char *key, size_t keylen, |
159 | | const unsigned char *iv, size_t ivlen, |
160 | | const OSSL_PARAM params[]) |
161 | 0 | { |
162 | 0 | return aes_wrap_init(ctx, key, keylen, iv, ivlen, params, 0); |
163 | 0 | } |
164 | | |
165 | | static int aes_wrap_cipher_internal(void *vctx, unsigned char *out, |
166 | | const unsigned char *in, size_t inlen) |
167 | 0 | { |
168 | 0 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; |
169 | 0 | PROV_AES_WRAP_CTX *wctx = (PROV_AES_WRAP_CTX *)vctx; |
170 | 0 | size_t rv; |
171 | 0 | int pad = ctx->pad; |
172 | | |
173 | | /* No final operation so always return zero length */ |
174 | 0 | if (in == NULL) |
175 | 0 | return 0; |
176 | | |
177 | | /* Input length must always be non-zero */ |
178 | 0 | if (inlen == 0) { |
179 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH); |
180 | 0 | return -1; |
181 | 0 | } |
182 | | |
183 | | /* If decrypting need at least 16 bytes and multiple of 8 */ |
184 | 0 | if (!ctx->enc && (inlen < 16 || inlen & 0x7)) { |
185 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH); |
186 | 0 | return -1; |
187 | 0 | } |
188 | | |
189 | | /* If not padding input must be multiple of 8 */ |
190 | 0 | if (!pad && inlen & 0x7) { |
191 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH); |
192 | 0 | return -1; |
193 | 0 | } |
194 | | |
195 | 0 | if (out == NULL) { |
196 | 0 | if (ctx->enc) { |
197 | | /* If padding round up to multiple of 8 */ |
198 | 0 | if (pad) |
199 | 0 | inlen = (inlen + 7) / 8 * 8; |
200 | | /* 8 byte prefix */ |
201 | 0 | return inlen + 8; |
202 | 0 | } else { |
203 | | /* |
204 | | * If not padding output will be exactly 8 bytes smaller than |
205 | | * input. If padding it will be at least 8 bytes smaller but we |
206 | | * don't know how much. |
207 | | */ |
208 | 0 | return inlen - 8; |
209 | 0 | } |
210 | 0 | } |
211 | | |
212 | 0 | rv = wctx->wrapfn(&wctx->ks.ks, ctx->iv_set ? ctx->iv : NULL, out, in, |
213 | 0 | inlen, ctx->block); |
214 | 0 | if (!rv) { |
215 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_CIPHER_OPERATION_FAILED); |
216 | 0 | return -1; |
217 | 0 | } |
218 | 0 | if (rv > INT_MAX) { |
219 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH); |
220 | 0 | return -1; |
221 | 0 | } |
222 | 0 | return (int)rv; |
223 | 0 | } |
224 | | |
225 | | static int aes_wrap_final(void *vctx, unsigned char *out, size_t *outl, |
226 | | size_t outsize) |
227 | 0 | { |
228 | 0 | if (!ossl_prov_is_running()) |
229 | 0 | return 0; |
230 | | |
231 | 0 | *outl = 0; |
232 | 0 | return 1; |
233 | 0 | } |
234 | | |
235 | | static int aes_wrap_cipher(void *vctx, |
236 | | unsigned char *out, size_t *outl, size_t outsize, |
237 | | const unsigned char *in, size_t inl) |
238 | 0 | { |
239 | 0 | PROV_AES_WRAP_CTX *ctx = (PROV_AES_WRAP_CTX *)vctx; |
240 | 0 | size_t len; |
241 | |
|
242 | 0 | if (!ossl_prov_is_running()) |
243 | 0 | return 0; |
244 | | |
245 | 0 | if (inl == 0) { |
246 | 0 | *outl = 0; |
247 | 0 | return 1; |
248 | 0 | } |
249 | | |
250 | 0 | if (outsize < inl) { |
251 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); |
252 | 0 | return 0; |
253 | 0 | } |
254 | | |
255 | 0 | len = aes_wrap_cipher_internal(ctx, out, in, inl); |
256 | 0 | if (len <= 0) |
257 | 0 | return 0; |
258 | | |
259 | 0 | *outl = len; |
260 | 0 | return 1; |
261 | 0 | } |
262 | | |
263 | | static int aes_wrap_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
264 | 0 | { |
265 | 0 | PROV_CIPHER_CTX *ctx = (PROV_CIPHER_CTX *)vctx; |
266 | 0 | const OSSL_PARAM *p; |
267 | 0 | size_t keylen = 0; |
268 | |
|
269 | 0 | if (ossl_param_is_empty(params)) |
270 | 0 | return 1; |
271 | | |
272 | 0 | p = OSSL_PARAM_locate_const(params, OSSL_CIPHER_PARAM_KEYLEN); |
273 | 0 | if (p != NULL) { |
274 | 0 | if (!OSSL_PARAM_get_size_t(p, &keylen)) { |
275 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); |
276 | 0 | return 0; |
277 | 0 | } |
278 | 0 | if (ctx->keylen != keylen) { |
279 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); |
280 | 0 | return 0; |
281 | 0 | } |
282 | 0 | } |
283 | 0 | return 1; |
284 | 0 | } |
285 | | |
286 | | #define IMPLEMENT_cipher(mode, fname, UCMODE, flags, kbits, blkbits, ivbits) \ |
287 | | static OSSL_FUNC_cipher_get_params_fn aes_##kbits##_##fname##_get_params; \ |
288 | | static int aes_##kbits##_##fname##_get_params(OSSL_PARAM params[]) \ |
289 | 24 | { \ |
290 | 24 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ |
291 | 24 | flags, kbits, blkbits, ivbits); \ |
292 | 24 | } \ cipher_aes_wrp.c:aes_256_wrap_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_192_wrap_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_128_wrap_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_256_wrappad_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_192_wrappad_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_128_wrappad_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_256_wrapinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_192_wrapinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_128_wrapinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_256_wrappadinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_192_wrappadinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
cipher_aes_wrp.c:aes_128_wrappadinv_get_params Line | Count | Source | 289 | 2 | { \ | 290 | 2 | return ossl_cipher_generic_get_params(params, EVP_CIPH_##UCMODE##_MODE,\ | 291 | 2 | flags, kbits, blkbits, ivbits); \ | 292 | 2 | } \ |
|
293 | | static OSSL_FUNC_cipher_newctx_fn aes_##kbits##fname##_newctx; \ |
294 | | static void *aes_##kbits##fname##_newctx(void *provctx) \ |
295 | 0 | { \ |
296 | 0 | return aes_##mode##_newctx(kbits, blkbits, ivbits, \ |
297 | 0 | EVP_CIPH_##UCMODE##_MODE, flags); \ |
298 | 0 | } \ Unexecuted instantiation: cipher_aes_wrp.c:aes_256wrap_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_192wrap_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_128wrap_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_256wrappad_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_192wrappad_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_128wrappad_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_256wrapinv_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_192wrapinv_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_128wrapinv_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_256wrappadinv_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_192wrappadinv_newctx Unexecuted instantiation: cipher_aes_wrp.c:aes_128wrappadinv_newctx |
299 | | const OSSL_DISPATCH ossl_##aes##kbits##fname##_functions[] = { \ |
300 | | { OSSL_FUNC_CIPHER_NEWCTX, \ |
301 | | (void (*)(void))aes_##kbits##fname##_newctx }, \ |
302 | | { OSSL_FUNC_CIPHER_ENCRYPT_INIT, (void (*)(void))aes_##mode##_einit }, \ |
303 | | { OSSL_FUNC_CIPHER_DECRYPT_INIT, (void (*)(void))aes_##mode##_dinit }, \ |
304 | | { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))aes_##mode##_cipher }, \ |
305 | | { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))aes_##mode##_final }, \ |
306 | | { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))aes_##mode##_freectx }, \ |
307 | | { OSSL_FUNC_CIPHER_DUPCTX, (void (*)(void))aes_##mode##_dupctx }, \ |
308 | | { OSSL_FUNC_CIPHER_GET_PARAMS, \ |
309 | | (void (*)(void))aes_##kbits##_##fname##_get_params }, \ |
310 | | { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ |
311 | | (void (*)(void))ossl_cipher_generic_gettable_params }, \ |
312 | | { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ |
313 | | (void (*)(void))ossl_cipher_generic_get_ctx_params }, \ |
314 | | { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ |
315 | | (void (*)(void))aes_wrap_set_ctx_params }, \ |
316 | | { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ |
317 | | (void (*)(void))ossl_cipher_generic_gettable_ctx_params }, \ |
318 | | { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ |
319 | | (void (*)(void))ossl_cipher_generic_settable_ctx_params }, \ |
320 | | OSSL_DISPATCH_END \ |
321 | | } |
322 | | |
323 | | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 256, 64, AES_WRAP_NOPAD_IVLEN * 8); |
324 | | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 192, 64, AES_WRAP_NOPAD_IVLEN * 8); |
325 | | IMPLEMENT_cipher(wrap, wrap, WRAP, WRAP_FLAGS, 128, 64, AES_WRAP_NOPAD_IVLEN * 8); |
326 | | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 256, 64, AES_WRAP_PAD_IVLEN * 8); |
327 | | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 192, 64, AES_WRAP_PAD_IVLEN * 8); |
328 | | IMPLEMENT_cipher(wrap, wrappad, WRAP, WRAP_FLAGS, 128, 64, AES_WRAP_PAD_IVLEN * 8); |
329 | | |
330 | | IMPLEMENT_cipher(wrap, wrapinv, WRAP, WRAP_FLAGS_INV, 256, 64, AES_WRAP_NOPAD_IVLEN * 8); |
331 | | IMPLEMENT_cipher(wrap, wrapinv, WRAP, WRAP_FLAGS_INV, 192, 64, AES_WRAP_NOPAD_IVLEN * 8); |
332 | | IMPLEMENT_cipher(wrap, wrapinv, WRAP, WRAP_FLAGS_INV, 128, 64, AES_WRAP_NOPAD_IVLEN * 8); |
333 | | IMPLEMENT_cipher(wrap, wrappadinv, WRAP, WRAP_FLAGS_INV, 256, 64, AES_WRAP_PAD_IVLEN * 8); |
334 | | IMPLEMENT_cipher(wrap, wrappadinv, WRAP, WRAP_FLAGS_INV, 192, 64, AES_WRAP_PAD_IVLEN * 8); |
335 | | IMPLEMENT_cipher(wrap, wrappadinv, WRAP, WRAP_FLAGS_INV, 128, 64, AES_WRAP_PAD_IVLEN * 8); |