Could anyone explain why the bolded part of the wrap key description?
Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key that
has previously been stored in an Azure Key Vault. The WRAP operation
is only strictly necessary for symmetric keys stored in Azure Key
Vault since protection with an asymmetric key can be performed using
the public portion of the key. This operation is supported for
asymmetric keys as a convenience for callers that have a key-reference
but do not have access to the public key material. This operation
requires the keys/wrapKey permission.
AFAIK, all the keys in Azure Key Vault are stored at rest in HSM modules. Why is key wrapping necessary for symmetric keys? What does ‘protection’ mean in this case? Using a public key to encrypt data?
If HSM are securing all the keys in Key Vault (using its built-in symmetric key), then why would encrypting a symmetric key be necessary as quoted?