M2 MAC
Needs: Supporter
CBC-MAC, retail MAC, CMAC and HMAC: padding, truncation, what is MACed and with which key.
This is a supporter feature. Create a free account, then try every supporter feature free for 7 days.
What this module covers
You will be able to
- Compute ISO 9797-1 algorithm 1 and 3 (retail MAC) and CMAC
- Pick the padding
- Know what is MACed and how it is truncated
- Use DUKPT request and response MAC keys
The lesson
- Why it matters
- The concept
- Step by step: retail MAC
- Keys
- Common mistakes
- What to test
In the module
- The lesson, with diagrams, common mistakes and what to test
- A worked example you can change: The retail MAC, block by block
- Practice: 4 kinds of generated exercise, each with a step-by-step solution
- A quiz of 9 questions
Key terms
- CBC-MAC
- The last block of CBC encryption of the message, used as a MAC.
- CMAC
- The standard MAC mode for AES (and triple DES) that fixes CBC-MAC's weaknesses with subkeys for the last block.
- Field 64
- The MAC field when the message has only a primary bitmap; field 128 holds it when there is a secondary bitmap.
- MAC (Message authentication code)
- A short value computed over a message with a secret key, so the receiver can tell the message was not changed and came from a key holder.
- MAC truncation
- Sending only the leftmost bytes of the MAC, such as 4 or 8 bytes in field 64 or 128.
- Retail MAC (ISO 9797-1 algorithm 3, ANSI X9.19)
- CBC-MAC with single DES under K1, then the last block decrypted with K2 and encrypted with K1 again. The usual triple DES MAC in payments.
The lesson, worked example, practice and quiz open with a supporter pass, which you can try free for 7 days.