What is the point of AES key wrap (with JSON Web Encryption)?

If you need to store a large amount of data, the advantage of wrapping the key within an encryption layer means that if you needed to change the key at a later time then you would not have to reencrypt all your data. You simply change the KEK (Key Encrypting Key) and reencrypt the CEK without having to transfer all the ciphertext again.

For example, say you were using JSON in order to transmit data to your server for safe storage. You could transmit all this data using A256KW and your server at the other end simply stores this.

That is, the following is transferred and then stored server-side:

Encrypted key (CEK):  66xZoxFI18zfvLMO6WU1zzqqX1tT8xu_qZzMQyPcfVuajPNkOJUXQA   
                 IV:  X5ZL8yaOektXmfny                                         
         Ciphertext:  brz-Lg                                                   
 Authentication Tag:  xG-EvM-9hrw0XRiuRW7HrA       

If you needed to change the key you could simply pull the CEK to the client, decrypt with the old KEK and encrypt the CEK with the new key and then send it back to the server to update all relevant records.

For short-term transmission purposes only, this is not important and it would be easier to use Direct for a smaller payload.


KW allows you to establish a long term secret but still use a different CEK for each message, this is important for some use cases, but not all.

In the case of using JWE to send a single message to multiple recipients who all have different long term keys, this is essential as you need to wrap the CEK multiple times once for each recipient.

JWE supports a number of advanced use cases, but the common use is to encrypt JWT between two parties using direct.

When we were developing JWE some people wanted to only support the KW option and drop the direct optimization. At the end of the day we wound up with two options depending on the use case. Direct creates smaller tokens and is easier to implement. If you don't need KW then don't sweat it.