# ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 [closed]

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 Algorithm 3 (padding mode 2).

In Appendix D-3, the MAC of E.IFD 72C29C2371CC9BDB65B779B8E8D37B29ECC154AA56A8799FAE2F498F76ED92F2 using K.MAC of 7962D9ECE03D1ACD4C76089DCE131543 is meant to return 5F1448EEA8AD90A7.

However, when I calculate the MAC, it returns AAE3F35132ED3465. This is the return when I run through the steps step-by-step using pyDes (ECB mode and manually xoring as appropriate) and when I use the code as written here.

I am clearly missing something - would love any help!

## closed as off-topic by e-sushiNov 16 '18 at 2:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

• A lot of passports also allow AES encryption / MAC by now. In that case you can simply use AES-CMAC, which is a lot more common. This ISO 9797-1 Algorithm 3 MAC is also known as Retail MAC (as it was defined by the financial industry) or ISO 7816-4 MAC (which is a bad name, as it is only used, not defined in that standard). – Maarten Bodewes Nov 14 '18 at 16:26

and the context makes references to 3DES (as confirmed by the 8-byte width of the result without mention of truncation, and the fact that all bytes of the test key 7962D9ECE03D1ACD4C76089DCE131543 have odd parity).
The standard has a Padding Method 2 (not "padding mode 2") where a single 1 bit is appended to the input, then just enough 0 bits (possibly none) to reach a multiple of the block width. Since the input is 32-byte, there are four 8-byte blocks and a last padding block mx of 8000000000000000.
We get F97B82EC7727D582 after the fourth encryption, then 797B82EC7727D582 after XOR of the padding block, then 5F1448EEA8AD90A7as the result.
Caution: there is an attack on this MAC Algorithm 3 recovering the key with the order of $$2^{32}$$ MAC queries of short messages to find a collision, followed by in the order of $$2^{57}$$ offline DES operations to recover K1, then K2.