There are two keys involved in this service: the unwrapping key and the target key (the new key created from the wrapped key).

• To use an unwrapping key that is a public object, the caller must have SO (READ) authority or USER (READ) authority (any access).
• To use an unwrapping key that is a private object, the caller must have USER (READ) authority (user access).
• To unwrap a target key that is a public object, the caller must have SO (READ) authority or USER (UPDATE) authority
• To unwrap a target key that is a private object, the caller must have SO (CONTROL) authority or USER (UPDATE) authority