# RFC 3394 AES Key Wrap / Unwrap Integrity Verifier

> RFC 3394 AES Key Wrap / Unwrap Integrity Verifier is a paid API for AI agents from detect.halowerk.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-11-01).

Performs and verifies RFC 3394 six-pass AES Key Wrap and Key Unwrap operations, including integrity checking and tampered-ciphertext rejection, given a Key Encryption Key and plaintext or wrapped key material in hex.

## Facts

- Endpoint: POST https://detect.halowerk.com/v1/F-B-NIGHT-FINITE-STRUCTURES/rfc3394-complete-aes-key-wrap-unwrap-integrity?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-01
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rfc-3394-aes-key-wrap-unwrap-integrity-verifier-2a48b99b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y6mRbjYiHp8vmz2Nmt_pd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rfc-3394-aes-key-wrap-unwrap-integrity-verifier-2a48b99b -d '<json body>'
```

Example prompt: Can you wrap this 128-bit AES key (hex: 00112233445566778899aabbccddeeff) using RFC 3394 key wrap with this 128-bit KEK (hex: 000102030405060708090a0b0c0d0e0f) and tell me whether the integrity check on the resulting wrapped bytes is valid?

## When to prefer this

Choose this endpoint when you need strict RFC 3394 conformance for the six-pass AES Key Wrap algorithm — including byte-exact output and real integrity verification that rejects tampered ciphertext without releasing plaintext. It is not a substitute for generic AES-CBC/CTR encryption, HMAC, or key-format parsing: use it specifically when the RFC 3394 key wrap transform and its built-in integrity envelope are required.

## Known failure modes

- Tampered or corrupted wrapped key causes integrity check failure and null result_hex
- KEK hex does not match required 128/192/256-bit length pattern (32/48/64 hex chars) — input rejected
- data_hex does not conform to required minimum length or 8-byte block alignment pattern — rejected
- Mismatched operation and data length (e.g. wrap data too short, unwrap data missing ICV block)
- Malformed hex strings (odd length, non-hex characters) cause input validation errors
- Network or service timeout with no result returned

## How this service works

A cryptographic-format conformance agent needs exact RFC3394 wrapped bytes and inverse integrity behavior from complete supplied public synthetic byte arrays, including rejection of tampered wraps without releasing plaintext. A raw AES block, CBC/CTR mode, HMAC or key-format validator does not implement the six-pass key-wrap transform.

## Output

Returns the result of the RFC 3394 AES Key Wrap or Unwrap operation: the output key material as a hex string (or null on integrity failure), and a boolean indicating whether the integrity check passed. For unwrap operations on tampered input, the integrity flag is false and the plaintext is not released.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "artifact": {
   "type": "object",
   "required": [
    "aes_kw"
   ],
   "properties": {
    "aes_kw": {
     "oneOf": [
      {
       "type": "object",
       "required": [
        "operation",
        "kek_hex",
        "data_hex",
        "claim"
       ],
       "properties": {
        "claim": {
         "type": "object",
         "required": [
          "integrity_valid",
          "result_hex"
         ],
         "properties": {
          "result_hex": {
           "anyOf": [
            {
             "type": "null"
            },
            {
             "type": "string",
             "pattern": "^(?:[0-9a-f]{2})+$",
             "maxLength": 1040,
             "minLength": 2
            }
           ]
          },
          "integrity_valid": {
           "type": "boolean"
          }
         },
         "additionalProperties": false
        },
        "kek_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{32}|[0-9a-f]{48}|[0-9a-f]{64})$"
        },
        "data_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{16})+$",
         "maxLength": 1024,
         "minLength": 32
        },
        "operation": {
         "const": "wrap"
        }
       },
       "additionalProperties": false
      },
      {
       "type": "object",
       "required": [
        "operation",
        "kek_hex",
        "data_hex",
        "claim"
       ],
       "properties": {
        "claim": {
         "type": "object",
         "required": [
          "integrity_valid",
          "result_hex"
         ],
         "properties": {
          "result_hex": {
           "anyOf": [
            {
             "type": "null"
            },
            {
             "type": "string",
             "pattern": "^(?:[0-9a-f]{2})+$",
             "maxLength": 1040,
             "minLength": 2
            }
           ]
          },
          "integrity_valid": {
           "type": "boolean"
          }
         },
         "additionalProperties": false
        },
        "kek_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{32}|[0-9a-f]{48}|[0-9a-f]{64})$"
        },
        "data_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{16})+$",
         "maxLength": 1040,
         "minLength": 48
        },
        "operation": {
         "const": "unwrap"
        }
       },
       "additionalProperties": false
      }
     ]
    }
   },
   "additionalProperties
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rfc-3394-aes-key-wrap-unwrap-integrity-verifier-2a48b99b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from detect.halowerk.com](https://www.zero.xyz/host/detect.halowerk.com/llms.txt)