Question 1

What is Retail MAC?

Accepted Answer

Retail MAC is a widely-used MAC algorithm in payment and banking systems that uses DES or Triple DES encryption with ISO 9797-1 Method 2 padding (0x80 followed by zeros). It processes data in CBC mode and extracts the last block as the MAC value. Retail MAC is commonly used in POS terminals, ATMs, and financial message authentication where DES-based security is required for compatibility with legacy systems.

Question 2

Should I use 3DES finalization?

Accepted Answer

Yes, 3DES finalization is highly recommended for better security. Standard DES Retail MAC uses single DES throughout, which provides 56-bit effective security. With 3DES finalization enabled, the final MAC block is encrypted using Triple DES (112-bit effective security), making it significantly more resistant to brute force attacks while maintaining backward compatibility with systems expecting DES-based MACs. This is particularly important for high-value transactions or sensitive financial data.

Question 3

What is the difference between DES and 3DES algorithm selection?

Accepted Answer

When you select "DES" algorithm, the entire CBC-MAC chain uses single DES encryption (optionally with 3DES finalization on the last block). When you select "3DES" algorithm, the entire CBC-MAC chain uses Triple DES encryption, providing stronger security throughout the computation. 3DES mode requires either a 16-byte key (2-key TDES with K1=K3) or provides a second key K' for full 3-key TDES. Use DES mode for compatibility with legacy systems, and 3DES mode for modern secure implementations.

Question 4

What padding method does Retail MAC use?

Accepted Answer

Retail MAC uses ISO 9797-1 Method 2 padding: append 0x80 byte followed by zero bytes to reach the next 8-byte block boundary. For example, if your data ends mid-block at 5 bytes, padding adds 0x80 00 00 (3 bytes). If data is exactly block-aligned (8, 16, 24 bytes...), an entire padding block (0x80 00 00 00 00 00 00 00) is appended. This padding method ensures unambiguous message boundaries and prevents length extension attacks. The padding is mandatory and applied automatically before MAC calculation.

Question 5

What key lengths are supported?

Accepted Answer

For DES mode: Key K must be exactly 16 hex characters (8 bytes, 64 bits with parity). If 3DES finalization is enabled, Key K' should also be 16 hex characters for the final encryption step. For 3DES mode: Key K is 16 hex characters (2-key TDES where K1=K3), or you can provide both Key K and Key K' (16 hex characters each) for full 3-key Triple DES where all three keys are unique. Keys must be generated using cryptographically secure random number generators and stored securely in HSMs or key management systems.

Retail MAC

📖 How to Use Retail MAC Calculator

Retail MAC FAQ