Revisiting AES Key Wrap: Forgery Bounds, Structural Observations, and Recommendations for the Revision of NIST SP 800-38F

What it is

Paper 2026/2636 on the IACR Cryptology ePrint Archive, received 25 October 2026 and approved 26 October 2026. It is a preprint by John Preuß Mattsson (Ericsson contact address). It updates and expands the author's technical comments to NIST, which is revising SP 800-38F, the standard that specifies the AES Key Wrap modes KW and KWP. It is licensed CC BY.

How it works

The abstract makes these claims:

• The forgery probabilities stated in SP 800-38F do not account for adaptive attacks. The paper gives the resulting probabilities for KW, KWP and TKW.
• Checking the expected plaintext length can raise the security level of KWP considerably.
• The paper revisits Kelsey's long-message observation and corrects its collision conditions. It shows that a successful forgery leaks a plaintext prefix, and it derives an encryption-only distinguisher. From this it concludes that KW does not have beyond-birthday-bound security.
• It also explains the role of the step counter, analyses the single-semiblock path of KWP, and examines the trade-off between the number of passes and the length limit.

What to do

The abstract names one implementation-level action: have KWP callers check the expected plaintext length on unwrap. It also says the paper gives recommendations for the SP 800-38F revision, for implementations, and for future key-wrap designs. The recommendations themselves are not in the page text.

Caveats

The fetched page contains only the abstract and metadata. It gives no numeric bounds, no concrete length-check procedure, and no attack costs. An engineer who wants those has to read the full paper. It is a preprint with no stated peer review.