# ISO 9797 MAC algorithm 3 for 7 bytes

I should implement ISO 9797 MAC algorithm 3 with initial transformation 1, without truncation, and using DES as a block cipher.

I should add padding of 0x80, then enough zero bytes if the length is not multiple of 8.

• I want to know what will happen if data is only 8 bytes?

• I should feed data directly to 3DES algorithm or I should first feed it to des then feed to 3DES?

• This is commonly called retail MAC, it requires DES CBC followed by decrypt with key 2, encrypt with key 1 or 3 depending on 2 or 3 key triple DES (2TDEA is assumed it seems). That means that the last vector & data perform a full triple DES block encrypt. Jul 31, 2020 at 14:28
• @Maarten Bodewes: BTW I always wondered if this is called retail MAC because it was designed for / used in retail applications, or because DES is done again in the tail!
– fgrieu
Aug 1, 2020 at 9:23
• @fgrieu As far as I understood it was the first option / banking, but that's hearsay. Aug 1, 2020 at 10:20

I want to know what will happen if data is only 8 bytes?

If the data is already 8 bytes then you need an additional block that contains 8000000000000000 (15 0s) since the Padding method 2 is mandates adding 1 and necessary 0's.

Note that the Padding Mechanism 2 is not byte-oriented, it is bit-oriented. Whenever the data finishes you add 1 and add necessary zeros in minimal so that the data size is multiple of the chosen block cipher.

for 7 bytes

In this case, you just add 0x80. 7 zeroes are added after 1 to fit 64.

I should feed data directly to 3DES algorithm or I should first feed it to DES then feed it to 3DES?

This MAC is as known as

• ANSI Retail-MAC
• CBC-MAC-Y or
• ISO/IEC 9797-1 algorithm 3.

With the DES it is also called the DES Retail MAC and uses two keys $$K$$ and $$K'$$.

Firstly it works as DES-CBC then the output performed like 3DES in Encrypt-Decrypt-Encrypt with two keys on the last block x-ored with $$H_{q-1}$$. One doesn't need a 3DES implementation to achieve this.

\begin{align} H_1 & = e_K(D_1) \\ H_i & = e_K(D_i \oplus H_{i-1}), \quad (2 \leq i \leq q)\\ MAC & = e_K(d_{K'}(H_q)). \end{align}

If we re-write the equation

\begin{align} H_1 & = e_K(D_1) \\ H_i & = e_K(D_i \oplus H_{i-1}), \quad (2 \leq i \leq q-1)\\ MAC & = e_K(d_{K'}(e_K((D_q \oplus H_{q-1}))). \end{align}

The Triple-DES (EDE) will appear in the end.

The attacks on DES Retail MAC

The attack on DES Retail MAC formalized as four tuple $$[a,b,c,d]$$ where

• $$a$$ is the number of offline block cipher encipherments
• $$b$$ denotes the number of known data string/MAC pairs
• $$c$$ denotes the number of chosen data string/MAC pairs
• $$d$$ denotes the number of on-line MAC verifications, and
• $$k$$ is key size
• $$n$$ is the block size
• $$m$$ is the zeros of padding.
1. On 1996, Preneel and Oorschot achieved $$[2^{k+1},2^{n/2},0,0]$$ on Key recovery attack on ANSI X9.19 retail MAC
2. On 1998, Knudsen and Preneel achieved $$[2^k,1,0,2^k]$$ on MacDES: MAC algorithm based on DES
3. On, 2002 Mitchell achieved $$[2^{k+1},0,0,(\lceil n/m \rceil +1) 2^{(n+m)/2-1}]$$ on A new key recovery attack on the ANSI retail MAC

Therefore, if there is no specific usage, don't use it.

• Note that the bouncy castle has an implementation for it. Jul 31, 2020 at 14:53
• Impressive information! Besides, are there anywhere which I can access documentation of ISO/IEC 9797-1 algorithm 3 for free? Documents of ISO in PDF format are for purchase. I want to know how could you access these pieces of information?
– VSB
Aug 19, 2020 at 13:17
• I don't know. I've looked around but failed. Aug 19, 2020 at 13:38