crypto::keywrap

AES Key Wrap, from RFC 3394.

How the group key reaches a station: handshake message 3 carries the GTK wrapped under the KEK (a slice of the pairwise key), and the station unwraps it. aes_wrap/aes_unwrap in the crypto table. The unwrap also authenticates — it recomputes the integrity value the wrap embedded and reports a mismatch rather than handing back garbage, so a tampered or wrong-key message is a clean failure, not a silently corrupt GTK.

Works over 64-bit half-blocks with the default RFC 3394 integrity constant. The KEK is 128 or 256 bits; both are here because WPA2 uses a 128-bit KEK and WPA3 a 256-bit one.

Enums

UnwrapError

enum UnwrapError {
    BadLength,
    Integrity,
}

Errors from [aes_unwrap].

Implements: Clone, Copy, Debug, Eq, PartialEq, StructuralPartialEq

Functions

aes_unwrap

fn aes_unwrap(kek: &[u8], wrapped: &[u8], out: &mut [u8]) -> Result<usize, UnwrapError>

Unwrap wrapped under kek, writing wrapped.len() - 8 plaintext bytes into out. Verifies the integrity value; on mismatch nothing usable is left in out and [UnwrapError::Integrity] is returned.

References: UnwrapError

aes_wrap

fn aes_wrap(kek: &[u8], plaintext: &[u8], out: &mut [u8]) -> Option<usize>

Wrap plaintext (a whole number of 8-byte blocks, at least one) under kek, writing plaintext.len() + 8 bytes into out. Returns the number of bytes written, or None if the sizes are wrong.