Feature request: RFC 5649 padded AES key wrap (AES_wrap_key_padded / AES_unwrap_key_padded)

[MarkAtwood]

wolfSSL provides AES_wrap_key / AES_unwrap_key for RFC 3394 (standard integer key wrap) but does not implement RFC 5649 (padded key wrap, supporting non-block-multiple plaintext lengths).

The existing AES_unwrap_key cannot serve as a building block for RFC 5649 because wolfSSL validates the recovered A register against a caller-supplied IV before returning. RFC 5649 requires recovering the AIV — which encodes the plaintext length — and then validating it. wolfSSL's early validation rejects the RFC 5649 AIV format, so the entire RFC 3394 unwrap loop has to be reimplemented from AES-ECB primitives to support RFC 5649.

RFC 5649 is required for interoperability with JOSE (JSON Web Keys / RFC 7517), CMS (RFC 5652), and other systems that use padded key wrap for arbitrary-length key material.

Workaround in use: Full RFC 5649 wrap and unwrap implemented on top of wolfSSL's AES-ECB primitives. Single-block case uses wolfSSL_AES_ecb_encrypt directly; multi-block wrap uses wolfSSL_AES_wrap_key with a custom IV; multi-block unwrap reimplements the RFC 3394 loop with AES-ECB to recover the AIV before validation.

Requested fix: Add native wolfSSL_AES_wrap_key_padded / wolfSSL_AES_unwrap_key_padded per RFC 5649. OpenSSL exposes this as EVP_aes_128_wrap_pad (and 192/256 variants).

Migrated from internal tracking (ZD-21736).

[MarkAtwood]

Where this surfaces

This was discovered in wolfssl-rs, the Rust FFI wrapper for wolfCrypt.

~250 lines of hand-rolled crypto in wolfcrypt-rs/src/compat_shim.c (lines 444–700):

/* wolfSSL does not yet provide RFC 5649 (padded key wrap). It has
 * AES_wrap_key / AES_unwrap_key for RFC 3394 (standard) only.
 * Replace with native wolfSSL calls when they become available.
 *
 * These shims implement RFC 5649 on top of wolfSSL's AES ECB
 * encrypt/decrypt (for the single-block case) and an inline
 * RFC 3394 unwrap (for the multi-block case, since we need to
 * recover the AIV without wolfSSL's IV validation rejecting it). */

The Rust FFI declarations in wolfcrypt-rs/src/lib.rs (lines 1559–1575):

// wolfSSL does not provide the padded variants natively.
#[link_name = "wolfcrypt_AES_wrap_key_padded"]
pub fn AES_wrap_key_padded(...) -> c_int;
#[link_name = "wolfcrypt_AES_unwrap_key_padded"]
pub fn AES_unwrap_key_padded(...) -> c_int;

The Rust consumer is wolfcrypt-ring-compat/src/key_wrap.rs (lines 39–40, 365, 417).

This is the most concerning of the five issues — 250 lines of custom crypto shim code that reimplements RFC 3394's unwrap loop from AES-ECB primitives because wolfSSL's AES_unwrap_key validates the IV register too early (before the AIV can be recovered and checked per RFC 5649).