[roy-basmacier]

AES Key Wrap (KW) and Key Wrap with Padding (KWP), NIST SP 800-38F Sec 6.2 and 6.3 (RFC 3394 / RFC 5649), over any 128-bit block permutation, on the key-object path of release/0.1.4alpha. Closes #150.

The first two commits are Roy's original traits and implementation. The rest is the port onto the key objects, the mode traits and the borrowed workers that landed in the meantime, one commit per crate, plus the review fixes.

core

• KeyWrapper / KeyUnwrapper are worker traits on the shape of MAC: &self methods over a worker that borrows the keyed permutation, no key parameter. They are separate so a policy can allow unwrapping without wrapping. AlgorithmInfo supertrait and Self: Sized fences on the const-generic one-shots keep the run-time-length half dyn-compatible, like every other worker trait.
• Fixed-length one-shots wrap_key / unwrap_key (provided over wrap_key_out / unwrap_key_out) reject an invalid (KEY_LEN, CT_LEN) pair with an inline const assertion, so a wrong length is a compile error. Run-time-length wrap_out / unwrap_out, sized by wrap_out_len (exact) and unwrap_out_max_len (upper bound), return InvalidInputLength outside SP 800-38F Table 1. Every _out method zeroizes its whole buffer first. The roles also provide the allocating wrap / unwrap under std, as the cipher roles do beside their _out forms.
• Unwrap output is a Secret, not a KeyMaterial: unwrapping says nothing about the type or provenance of the bytes. Every authenticity failure is the one DecryptionFailed.
• hazmat KeyWrapMode / KeyUnwrapMode hand the worker out from a key state; the role traits KeyWrappingKey / KeyUnwrappingKey in symmetric_key forward to them with the one-shots provided.
• SymmetricCipherError::InvalidInputLength.

core-test-framework

• key_wrap::TestFrameworkKeyWrap: test runs a key type through both roles and both workers (round trips, determinism, length helpers, buffer-too-small and invalid-length errors with the buffer checked for zeroing, tamper and wrong-KEK rejection); test_kat takes a published vector. An in-file mock (not cryptography) keeps the suite honest.

cipher

• KW / KWP mode types whose key state is the permutation; Kw<'k, P> / Kwp<'k, P> workers on the shape of Cmac. W and W⁻¹ (Algorithms 1 and 2) run in place in the RFC 3394 Sec 2.2.1 index form; KW-AE/AD are Algorithms 3 and 4, KWP-AE/AD Algorithms 5 and 6 with the single-block path, and the three KWP-AD checks are made unconditionally and combined bitwise. ModeNames gains KW_ALG_NAME / KWP_ALG_NAME (the open cipher PRs will need the two consts when this lands).

aes

• AES128Key<KW>, AES128Key<KWP> and the 192/256 forms implement the two roles; AES_KW_128 … AES_KWP_256 name the workers. Tests: all six RFC 3394 Sec 4 vectors and both RFC 5649 Sec 6 examples through test_kat, the framework at 26 payload lengths, the ACVP-AES-KW and -KWP sets from bc-test-data (1800 cases each, forgeries counted), the construction suite, alias names, and KW/KWP benches.

cli

• aes{128,192,256}-{kw,kwp} -d encrypt|decrypt, stdin to stdout, key loading shared with the other AES commands. Not streaming: all of stdin is read, then written in one go. cli/tests/test_aes_kw.sh replays the RFC vectors both ways and pins the length rules, the fail-closed unwrap and key loading.

TKW (TDEA) is not included; it needs the 64-bit-block engine of #139.

Mutants (apollo, scoped to the changed files, cipher + aes tests):

• bouncycastle-cipher, modes/kw.rs + modes/kwp.rs: 151 mutants, 111 caught, 38 unviable, 2 missed. Both misses replace 2 * SEMIBLOCK_LEN with 2 + SEMIBLOCK_LEN in a minimum-length check that runs after the 8-byte alignment test, so >= 16 and >= 10 agree on every length that reaches it: equivalent.
• bouncycastle-core, the key-wrap traits and roles in traits.rs + symmetric_key.rs (tests from cipher, aes and the framework): 46 mutants, 18 caught, 28 unviable, 0 missed.
• bouncycastle-aes, the two role impls in key.rs: 2 mutants, both unviable.

Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Assisted-by: Claude:claude-mythos-5-1

[ounsworth]

Why is this +65,000 lines, changing 354 files?

I suspect there's a bit branching issue here. Once we finish the release/0.1.3alpha, and fork a new release/0.1.4alpha branch and point this at it, maybe the diff will get smaller?

[dghgit]

I rebased this first. After that the only thing I found it seemed short was the lack of unwrap/wrap methods that returned the plain-test/cipher-text. I've added these.

This one is now approved and ready to go.

[dghgit]

Merged as squash 27b83ed on release/0.1.4alpha (author royb).