How deeply does Software Security for Developers cover key wrapping?

Explains the sender and recipient steps, algorithm choices, and RSA size guidance without covering implementation code or mathematical internals.

Key wrapping

As explained in Software Security for Developers

Key wrapping is the encryption of one cryptographic key with another key for secure transport or storage.

Key wrapping encrypts one cryptographic key with another key. In hybrid encryption, AES protects the content while RSA protects the AES content encryption key (CEK), combining performance with secure key exchange. section 6.3.2 section 6.6

Follow this sender-and-recipient pattern:

Generate a random AES CEK and encrypt the content with AES. section 6.3.2
Wrap the CEK by encrypting it with the recipient’s RSA public key, then send the encrypted CEK with the encrypted content. section 6.3.2
Unwrap the CEK with the RSA private key and use it to decrypt the content. section 6.3.2

Recommended configuration

Use AES-GCM with a 256-bit key for bulk encryption and RSA-OAEP with a key size of at least 2,048 bits for wrapping. TLS, IPsec, JWE, and SSH use hybrid encryption. section 6.3.2 section 6.5

How Software Security for Developers covers it

Cover of Software Security for Developers

liveBook manning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Related concepts

cryptographic keyuses · A cryptographic key is a value supplied to a cryptographic algorithm to control operations such as encryption, decryption, signing, authentication, or verification.
hybrid encryptionpart of · Hybrid encryption combines asymmetric cryptography or key exchange for protecting a symmetric key with symmetric authenticated encryption for protecting data.
authenticated encryption with associated datacontrasts with · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.
ciphertextproduces · Ciphertext is data produced by encryption whose original content is intended to be unreadable without the required decryption capability.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.