I'm trying to create a ISO8583 Rev93 message. What is the standard way of generating MAC key in ANSI X9.9
DES-CBC encryption algorithm is used to encrypt the message and generate the MAC.

  • How many bytes should I take from the encrypted byte array based on ANSI X9.9 standard? 8 or 16? I think I should take 4 bytes (8 ASCII characters) and place them on field 128 (MAC). But very doubtful about that.

  • The MAC key that the customer has provided me is 16 characters. (like 1234567890123456). Should I convert it to an 8 byte key? or a 16 byte key? (Based on ISO8583 Rev93 and ANSI X9.9)

Thank you.

  • $\begingroup$ I suspect your best path forward is going to be reading the relevant standard, or hiring a consultant who knows the standard. Given that this is a non-public standard, I don't know whether anyone here is going to be able to answer your questions off the top of their head. $\endgroup$
    – D.W.
    Commented Sep 4, 2011 at 4:20
  • $\begingroup$ I think the standard that the OP is referring to must be ISO 8583, second edition, 1993; perhaps with corrigenda 1 to the second edition, 1999. It is listed on the ISO site but is no longer for sale. $\endgroup$
    – fgrieu
    Commented Sep 4, 2011 at 16:44

2 Answers 2


ANSI X9.9 uses DES for its crypto - these keys are 56 bits long, or 112 bits for 3DES. The financial world mostly moved to 3DES a few years back so keys will generally be 112 bits. Normally they have parity bits added (1 per 7 bits of key), so are transmitted as 64 bit (single DES) or 128 bit (triple DES) values.

When presented in human-readable form, they are almost always shown as hexadecimal, so a typical 3DES key would show as 32 characters, from 0-9 and A-F. Whether you need to convert it back to binary depends on the crypto API you are using - read the documentation.

With ISO8583, usual practice is to calculate the full 64 bit MAC using 3DES in CBC mode, then put the first 4 bytes of the result into field 64 or 128 of the ISO8583 message - field 128 if any of the fields from 65-127 are present, field 64 if only fields 1-63 are in use. The final 4 bytes of the field are normally just padded with zeros.

In some legacy systems the full 64 bit MAC value may be transmitted.

I have also seen ancient systems (20+ years ago) which use ECB mode rather than CBC - basically just XOR every 8 byte block of the message together, then apply a single DES encryption to the result. This is highly insecure.


without doing your homework for you: did you check the open-source implementations of ISO 8583? is the answer somewhere in there?

Retrieved from wikipedia (strangely, the Spanish page, a good tip for finding more external references is changing the language tab)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.