{"uid":"cap_Y6mRbjYiHp8vmz2Nmt_pd","slug":"rfc-3394-aes-key-wrap-unwrap-integrity-verifier-2a48b99b","name":"RFC 3394 AES Key Wrap / Unwrap Integrity Verifier","description":"A cryptographic-format conformance agent needs exact RFC3394 wrapped bytes and inverse integrity behavior from complete supplied public synthetic byte arrays, including rejection of tampered wraps without releasing plaintext. A raw AES block, CBC/CTR mode, HMAC or key-format validator does not implement the six-pass key-wrap transform.","url":"https://detect.halowerk.com/v1/F-B-NIGHT-FINITE-STRUCTURES/rfc3394-complete-aes-key-wrap-unwrap-integrity?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"artifact":{"type":"object","required":["aes_kw"],"properties":{"aes_kw":{"oneOf":[{"type":"object","required":["operation","kek_hex","data_hex","claim"],"properties":{"claim":{"type":"object","required":["integrity_valid","result_hex"],"properties":{"result_hex":{"anyOf":[{"type":"null"},{"type":"string","pattern":"^(?:[0-9a-f]{2})+$","maxLength":1040,"minLength":2}]},"integrity_valid":{"type":"boolean"}},"additionalProperties":false},"kek_hex":{"type":"string","pattern":"^(?:[0-9a-f]{32}|[0-9a-f]{48}|[0-9a-f]{64})$"},"data_hex":{"type":"string","pattern":"^(?:[0-9a-f]{16})+$","maxLength":1024,"minLength":32},"operation":{"const":"wrap"}},"additionalProperties":false},{"type":"object","required":["operation","kek_hex","data_hex","claim"],"properties":{"claim":{"type":"object","required":["integrity_valid","result_hex"],"properties":{"result_hex":{"anyOf":[{"type":"null"},{"type":"string","pattern":"^(?:[0-9a-f]{2})+$","maxLength":1040,"minLength":2}]},"integrity_valid":{"type":"boolean"}},"additionalProperties":false},"kek_hex":{"type":"string","pattern":"^(?:[0-9a-f]{32}|[0-9a-f]{48}|[0-9a-f]{64})$"},"data_hex":{"type":"string","pattern":"^(?:[0-9a-f]{16})+$","maxLength":1040,"minLength":48},"operation":{"const":"unwrap"}},"additionalProperties":false}]}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_2aZeFRtyUvvts2jarrfmD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs and verifies RFC 3394 six-pass AES Key Wrap and Key Unwrap operations, including integrity checking and tampered-ciphertext rejection, given a Key Encryption Key and plaintext or wrapped key material in hex.","exampleAgentPrompt":"Can you wrap this 128-bit AES key (hex: 00112233445566778899aabbccddeeff) using RFC 3394 key wrap with this 128-bit KEK (hex: 000102030405060708090a0b0c0d0e0f) and tell me whether the integrity check on the resulting wrapped bytes is valid?","exampleUseCases":[{"title":"Key escrow wrap before storage","prompt":"I need to wrap this 256-bit session key (hex: 000102030405060708090a0b0c0d0e0fdeadbeefcafebabe0102030405060708) with my 256-bit KEK (hex: 6030a4f0b7e7ee2b1d3cf07b5e2e2a3c4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c) using RFC 3394 — give me the wrapped bytes and confirm integrity is valid."},{"title":"Detect tampered wrapped key material","prompt":"I have a wrapped key blob that I suspect has been tampered with. Can you try to unwrap it using RFC 3394 with my KEK (hex: 0102030405060708090a0b0c0d0e0f10) and tell me whether the integrity check fails — the wrapped data hex is 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f?"},{"title":"Conformance test RFC 3394 wrap output","prompt":"Run the RFC 3394 wrap operation on plaintext key hex 00112233445566778899aabbccddeeff with KEK hex 000102030405060708090a0b0c0d0e0f and verify the six-pass transform produces the expected result hex 1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5 with integrity_valid true."}],"resultDescription":"Returns the result of the RFC 3394 AES Key Wrap or Unwrap operation: the output key material as a hex string (or null on integrity failure), and a boolean indicating whether the integrity check passed. For unwrap operations on tampered input, the integrity flag is false and the plaintext is not released.","failureModes":["Tampered or corrupted wrapped key causes integrity check failure and null result_hex","KEK hex does not match required 128/192/256-bit length pattern (32/48/64 hex chars) — input rejected","data_hex does not conform to required minimum length or 8-byte block alignment pattern — rejected","Mismatched operation and data length (e.g. wrap data too short, unwrap data missing ICV block)","Malformed hex strings (odd length, non-hex characters) cause input validation errors","Network or service timeout with no result returned"],"whenToPreferThis":"Choose this endpoint when you need strict RFC 3394 conformance for the six-pass AES Key Wrap algorithm — including byte-exact output and real integrity verification that rejects tampered ciphertext without releasing plaintext. It is not a substitute for generic AES-CBC/CTR encryption, HMAC, or key-format parsing: use it specifically when the RFC 3394 key wrap transform and its built-in integrity envelope are required.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-01T06:30:19.807Z","isFirstParty":false,"canonicalSlug":"rfc-3394-aes-key-wrap-unwrap-integrity-verifier-2a48b99b"}