5

I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 Algorithm 3 (padding mode 2).

In Appendix D-3, the MAC of E.IFD 72C29C2371CC9BDB65B779B8E8D37B29ECC154AA56A8799FAE2F498F76ED92F2 using K.MAC of 7962D9ECE03D1ACD4C76089DCE131543 is meant to return 5F1448EEA8AD90A7.

However, when I calculate the MAC, it returns AAE3F35132ED3465. This is the return when I run through the steps step-by-step using pyDes (ECB mode and manually xoring as appropriate) and when I use the code as written here.

I am clearly missing something - would love any help!

jjajangmyeon52
  • 53
  • 1
  • 3
  • 1
    A lot of passports also allow AES encryption / MAC by now. In that case you can simply use AES-CMAC, which is a lot more common. This ISO 9797-1 Algorithm 3 MAC is also known as Retail MAC (as it was defined by the financial industry) or ISO 7816-4 MAC (which is a bad name, as it is only used, not defined in that standard). – Maarten Bodewes Nov 14 '18 at 16:26

1 Answers1

4

I need to calculate a MAC using ISO 9797-1 Algorithm 3 (padding mode 2)

and the context makes references to 3DES (as confirmed by the 8-byte width of the result without mention of truncation, and the fact that all bytes of the test key 7962D9ECE03D1ACD4C76089DCE131543 have odd parity).

ISO/IEC 9797-1:2011 (revising the 1999 edition) specifies MAC algorithms based on an iterated block cipher with CBC chaining, along the general structure of CBC-MAC. With Algorithm 3, the structure is:

ISO/IEC 9797-1 Algorithm 3

The standard has a Padding Method 2 (not "padding mode 2") where a single 1 bit is appended to the input, then just enough 0 bits (possibly none) to reach a multiple of the block width. Since the input is 32-byte, there are four 8-byte blocks and a last padding block mx of 8000000000000000.

We get F97B82EC7727D582 after the fourth encryption, then 797B82EC7727D582 after XOR of the padding block, then 5F1448EEA8AD90A7as the result.

Caution: there is an attack on this MAC Algorithm 3 recovering the key with the order of $2^{32}$ MAC queries of short messages to find a collision, followed by in the order of $2^{57}$ offline DES operations to recover K1, then K2.

fgrieu
  • 140,762
  • 12
  • 307
  • 587