pub fn unwrap_sek(kek: &[u8], icv: &[u8; 8], wrapped: &[u8]) -> Result<Vec<u8>>Available on crate feature
crypto only.Expand description
Unwrap the SEK(s) with the KEK (inverse RFC 3394 AES key wrap —
draft-sharabayko-srt-01 §6.1.5/§6.3.1: SEK = AESkuw(KEK, Wrap)).
icv/wrapped are crate::packet::KeyMaterial’s icv/x_sek (or
o_sek) fields. A wrap-integrity failure — wrong KEK (wrong passphrase)
or corrupt wire data — is the spec’s “it does not have the SEK” case
(§6.1.5, L3799-3803/L3820-3823): a structured error, never a panic or
silently-wrong plaintext.
§Errors
Error::InvalidField if kek.len() is not 16, 24, or 32, if
wrapped.len() is not a multiple of 8 bytes, or if the RFC 3394
integrity check fails.