Daniel Bleichenbacher
933e2e10aa
This supports RFC 3394 and RFC 5649, which is also described in NIST SP 800 38f. I also have a mini analysis of the primitive: If one cares about distinguishing attacks then there is an attack with a somewhat smaller complexity than what NIST claims in their standard: https://docs.google.com/document/d/1oH36v6SNdff5tkydC75EnqRyqqgHbXR4hy_SMPzwqVU/edit?usp=sharing But even if one cares about these attacks then the key wrappings are nowhere comparable to the attacks possible against e.g. AES-GCM. PiperOrigin-RevId: 192747615 GitOrigin-RevId: 0bebc767022ba3053c1d0391378d5c0b32b7f5be