Filter
Top Products
CCA Release 2.54
MAC Calculation Methods
With CCA Release 2.51, three variations of DES based message authentication are
supported by the MAC_Generate and MAC_Verify verbs:
ANSI X9.9
ANSI X9.19 optional Procedure 1
EMV post-padding of X'80'.
The Financial Institution (Wholesale) Message Authentication Standard (ANSI
X9.9-1986) defines a process for the authentication of messages from originator to
recipient. This process is called the Message Authentication Code (MAC)
calculation method.
1
Figure D-11 on page D-14 shows the MAC calculation for binary data. KEY is a
64-bit key, and T
1
through T
n
are 64-bit data blocks of text. If T
n
is less than 64
bits long, binary zeros are appended (padded) to the right of T
n
. Data blocks
T
1
...T
n
are DES CBC encrypted with all output discarded except for the final output
block, O
n
.
The Financial Institution (Retail) Message Authentication Standard, ANSI X9.19
Optional Procedure 1, specifies additional processing of the 64-bit O
n
MAC value.
The CCA “X9.19OPT” process employs a double-length DES key. After calculating
the 64-bit MAC as above with the left half of the double-length key, the result is
decrypted using the right half of the double-length key. This result is then
encrypted with the left half of the double-length key. The resulting MAC value is
processed according to other specifications supplied to the verb call.
The EMV smart card standards define MAC generation and verification processes
which are the same as ANSI X9.9 and ANSI X9.19 Optional Procedure 1 except
for padding added to the end of the message. Append one byte of X'80' to the
original message. Then append additional bytes, as required, of X'00' to form an
extended message which is a multiple of eight bytes in length.
In the X9.9 and X9.19 Optional Procedure 1 standards, the leftmost 32 bits (4
bytes) of (O
n
) are taken as the MAC. In the EMV standards, the MAC value is four
to eight bytes in length. CCA provides support for the leftmost 4, 6 and 8 bytes of
MAC value.
1
The ANSI X9.9 standard defines five options. The MAC_Generate and MAC_Verify verbs implement option 1, binary data.
Appendix D. Algorithms and Processes
D-13