I should implement ISO 9797 MAC algorithm 3 with initial transformation 1, without truncation, and using DES as a block cipher.

I should add padding of 0x80, then enough zero bytes if the length is not multiple of 8.

  • I want to know what will happen if data is only 8 bytes?

  • I should feed data directly to 3DES algorithm or I should first feed it to des then feed to 3DES?

  • 1
    $\begingroup$ This is commonly called retail MAC, it requires DES CBC followed by decrypt with key 2, encrypt with key 1 or 3 depending on 2 or 3 key triple DES (2TDEA is assumed it seems). That means that the last vector & data perform a full triple DES block encrypt. $\endgroup$
    – Maarten Bodewes
    Jul 31, 2020 at 14:28
  • 1
    $\begingroup$ @Maarten Bodewes: BTW I always wondered if this is called retail MAC because it was designed for / used in retail applications, or because DES is done again in the tail! $\endgroup$
    – fgrieu
    Aug 1, 2020 at 9:23
  • 2
    $\begingroup$ @fgrieu As far as I understood it was the first option / banking, but that's hearsay. $\endgroup$
    – Maarten Bodewes
    Aug 1, 2020 at 10:20

1 Answer 1


I want to know what will happen if data is only 8 bytes?

If the data is already 8 bytes then you need an additional block that contains 8000000000000000 (15 0s) since the Padding method 2 is mandates adding 1 and necessary 0's.

Note that the Padding Mechanism 2 is not byte-oriented, it is bit-oriented. Whenever the data finishes you add 1 and add necessary zeros in minimal so that the data size is multiple of the chosen block cipher.

for 7 bytes

In this case, you just add 0x80. 7 zeroes are added after 1 to fit 64.

I should feed data directly to 3DES algorithm or I should first feed it to DES then feed it to 3DES?

This MAC is as known as

  • ANSI Retail-MAC
  • CBC-MAC-Y or
  • ISO/IEC 9797-1 algorithm 3.

With the DES it is also called the DES Retail MAC and uses two keys $K$ and $K'$.

Firstly it works as DES-CBC then the output performed like 3DES in Encrypt-Decrypt-Encrypt with two keys on the last block x-ored with $H_{q-1}$. One doesn't need a 3DES implementation to achieve this.

\begin{align} H_1 & = e_K(D_1) \\ H_i & = e_K(D_i \oplus H_{i-1}), \quad (2 \leq i \leq q)\\ MAC & = e_K(d_{K'}(H_q)). \end{align}

If we re-write the equation

\begin{align} H_1 & = e_K(D_1) \\ H_i & = e_K(D_i \oplus H_{i-1}), \quad (2 \leq i \leq q-1)\\ MAC & = e_K(d_{K'}(e_K((D_q \oplus H_{q-1}))). \end{align}

The Triple-DES (EDE) will appear in the end.

The attacks on DES Retail MAC

The attack on DES Retail MAC formalized as four tuple $[a,b,c,d]$ where

  • $a$ is the number of offline block cipher encipherments
  • $b$ denotes the number of known data string/MAC pairs
  • $c$ denotes the number of chosen data string/MAC pairs
  • $d$ denotes the number of on-line MAC verifications, and
  • $k$ is key size
  • $n$ is the block size
  • $m$ is the zeros of padding.
  1. On 1996, Preneel and Oorschot achieved $[2^{k+1},2^{n/2},0,0]$ on Key recovery attack on ANSI X9.19 retail MAC
  2. On 1998, Knudsen and Preneel achieved $[2^k,1,0,2^k]$ on MacDES: MAC algorithm based on DES
  3. On, 2002 Mitchell achieved $[2^{k+1},0,0,(\lceil n/m \rceil +1) 2^{(n+m)/2-1}]$ on A new key recovery attack on the ANSI retail MAC

Therefore, if there is no specific usage, don't use it.

  • $\begingroup$ Note that the bouncy castle has an implementation for it. $\endgroup$
    – kelalaka
    Jul 31, 2020 at 14:53
  • 1
    $\begingroup$ Impressive information! Besides, are there anywhere which I can access documentation of ISO/IEC 9797-1 algorithm 3 for free? Documents of ISO in PDF format are for purchase. I want to know how could you access these pieces of information? $\endgroup$
    – VSB
    Aug 19, 2020 at 13:17
  • $\begingroup$ I don't know. I've looked around but failed. $\endgroup$
    – kelalaka
    Aug 19, 2020 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.