AES_KW.md

AES-KW

W3 specification

Operations

Operation	Parameters	Result
generateKey	AesKeyGenParams	CryptoKey
importKey	None	CryptoKey
exportKey	None	JsonWebKey or BufferSource
wrapKey	None	ArrayBuffer
unwrapKey	None	CryptoKey

Generate key

const key = await crypto.subtle.generateKey(
  {
    name: "AES-KW",
    length: 128, // 128, 192, or 256
  },
  false, // extractable
  ["wrapKey", "unwrapKey"], // key usages
);

Import key

const key = await crypto.subtle.importKey(
  "raw", // raw or jwk
  new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6]), // raw data
  "AES-KW",
  false, // extractable
  ["encrypt", "decrypt"],
);

Export key

const raw = await crypto.subtle.exportKey(
  "raw", // raw or jwk
  key,
);

Wrap key

const iv = crypto.getRandomValues(new Uint8Array(16));

const wrappedKey = await crypto.subtle.wrapKey(
  "pkcs8",   // raw, pkcs8, spki, or jwk
  anyKey,    // Crypto key
  key,       // AES key
  "AES-KW",
);

Unwrap key

const unwrappedKey = await crypto.subtle.unwrapKey(
  "pkcs8",    // raw, pkcs8, spki, or jwk
  wrappedKey, // BufferSource
  key,        // AES key
  "AES-KW",
  {
    name: "RSA-PSS",
    hash: "SHA-256",
  }
  false,      // extractable
  ["sign", "verify"],
);