Home / Documentation / MAC Tools

MAC Tools

Generate and verify Message Authentication Codes used across payment systems — HMAC, CMAC, ISO 9797 variants, ANSI X9.19, Retail MAC, AS2805 MAC, and TDES CBC-MAC. Each tool offers hex inputs, configurable padding, and a step-by-step audit log.

Introduction

A Message Authentication Code (MAC) is a short tag computed from a message and a secret key. It lets a receiver verify that a message has not been altered and that it came from someone holding the same key. Payment networks rely on MACs heavily — on ISO 8583 messages, on terminal-host links, and on PIN-translation pipelines.

ISO8583Studio includes calculators for every MAC algorithm commonly seen in payment specifications, organised into two families: hash-based (HMAC) and block-cipher-based (CMAC, CBC-MAC and its variants).

Choosing a MAC

AlgorithmStandardBlock / CipherCommon Use
HMACRFC 2104, FIPS 198-1Hash (SHA-256, etc.)API authentication, JWS, payment APIs.
CMACNIST SP 800-38BAES / TDESEMV-like cryptograms, modern PIN translation.
TDES CBC-MACANSI X9.9 (legacy)3DESOlder banking integrations.
ANSI X9.19 MACANSI X9.19Single DES + 3DES finalizeU.S. retail / banking ISO 8583.
ISO 9797 MACISO/IEC 9797-1DES / 3DES / AESCross-network ISO 8583 MACs.
Retail MACISO 9797-1 Algorithm 33DESEuropean retail payments.
AS2805 MACAS 2805.43DESAustralian payment systems.

HMAC Calculator

Hash-based MAC defined by RFC 2104.

Inputs

FieldDescription
Hash TypeDrop-down: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, RIPEMD-160.
Key InputDrop-down: ASCII or Hexadecimal.
HMAC KeySingle-line text in the chosen format.
Data InputDrop-down: ASCII or Hexadecimal.
DataMulti-line text in the chosen format.

Walk-through

  1. Pick Hash Type — SHA-256 is a safe default for new work.
  2. Pick Key Input — ASCII or Hexadecimal.
  3. Enter HMAC Key in the format you selected.
  4. Pick Data Input — ASCII or Hexadecimal.
  5. Enter Data.
  6. Click Generate HMAC — Output is hex of the digest length (32 bytes for SHA-256, 64 for SHA-512, etc.) and is appended to the activity log.
Hash Type:  SHA-256
Key Input:  Hexadecimal
HMAC Key:   4A656665
Data Input: ASCII
Data:       what do ya want for nothing?

Output:     5BDCC146BF60754E6A042426089575C75A003F089D2739839DEC58B964EC3843
No SHA-3 / SM3

The current build does not expose SHA-3 or SM3. Use the supported algorithms above.

CMAC Calculator

Cipher-based MAC (NIST SP 800-38B). Uses AES or TDES as the underlying block cipher with subkey derivation to handle final-block padding cleanly.

Inputs

  • Cipher — AES-128, AES-192, AES-256, or TDES (2-key / 3-key).
  • Key — Hex key matching the chosen cipher.
  • Message — Hex data of any length (including zero-length).
  • MAC Length — Truncation length; defaults to full block size.
When to use CMAC

CMAC handles arbitrary-length messages correctly without padding ambiguities. Prefer it over plain CBC-MAC for new designs.

TDES CBC-MAC Calculator

Triple-DES CBC-MAC: encrypt the message under TDES in CBC mode and take the last block as the MAC. Common in legacy ISO 8583 implementations.

Inputs

  • Key — 32 or 48 hex chars (2-key or 3-key 3DES).
  • IV — 16 hex chars; usually all zeros.
  • Message — Hex; pad to an 8-byte multiple if required.
  • Padding — None, Zero, or ISO/IEC 9797-1 Padding Method 1 / 2.
Security note

Pure CBC-MAC is vulnerable to length-extension when the message length is variable. For variable-length messages, use ISO 9797-1 Algorithm 3 (Retail MAC) instead.

ANSI X9.19 MAC Calculator

ANSI X9.19 (financial institution retail message authentication) uses single-DES CBC-MAC across the message, with a final 3DES "finalize" step over the last block. Equivalent to ISO 9797-1 Algorithm 3 with a specific key arrangement.

Inputs

  • MAC Key (KL / KR) — Two 8-byte halves of a 3DES key, in hex.
  • Initial Vector — 16 hex chars; commonly zeros.
  • Message Data — Hex; padded with zeros to an 8-byte boundary if needed.

Algorithm Summary

  1. Split message into 8-byte blocks.
  2. CBC-encrypt each block under KL (single DES), feeding output into the next block.
  3. Decrypt the final intermediate value with KR.
  4. Encrypt that result with KL again. The output is the MAC.

ISO 9797 MAC Calculator

ISO/IEC 9797-1 standardises six MAC algorithms over block ciphers. The calculator exposes each variant by tab.

Algorithms

VariantDescriptionTypical Cipher
Algorithm 1Plain CBC-MAC. Single key. Last block is the MAC.DES / 3DES / AES
Algorithm 2Last-block encrypted with a derived key (K′).DES
Algorithm 3Retail MAC: single DES CBC-MAC, then 3DES finalize. Equivalent to ANSI X9.19.DES + 3DES
Algorithm 4CBC-MAC with two parallel CBC-MAC chains XOR-combined.DES / 3DES
Algorithm 5EMAC: CBC-MAC re-encrypted with a second key.AES
Algorithm 6MAC double-CBC encryption with separate keys.AES

Inputs

  • Algorithm — Pick 1 through 6.
  • Cipher — DES, 3DES, or AES (where applicable).
  • Key 1 / Key 2 — Hex keys; algorithm-dependent.
  • Padding Method — ISO Method 1 (zeros), Method 2 (0x80 + zeros), or Method 3 (length prefix + zeros).
  • Message — Hex.
Most common in payments

Algorithm 1 with TDES is widespread for ISO 8583 MAC fields (bit 64 / 128). Algorithm 3 (Retail MAC) is the European retail standard.

Example: Algorithm 1, TDES, Method 2 padding

Key:    0123456789ABCDEFFEDCBA9876543210
IV:     0000000000000000
Method: 2 (0x80 followed by zero bytes)
Data:   48656C6C6F     (ASCII "Hello")

Padded: 48656C6C6F800000
Output: B11FFC78A4FB1B5A

Retail MAC Calculator

A dedicated tab for ISO 9797-1 Algorithm 3 with the conventional retail-banking key arrangement. Equivalent to ANSI X9.19 in practice.

Inputs

  • Key A / Key B — Two 8-byte hex halves forming the 3DES key.
  • IV — 16 hex chars.
  • Padding — Method 1 or Method 2.
  • Message — Hex.

AS2805 MAC Calculator

The Australian Standard AS 2805.4 specifies its own MAC variant for inter-bank messaging. The calculator implements the "MAC" portion of AS 2805 with the expected key splits.

Inputs

  • MAC Key — 32 hex chars (2-key 3DES).
  • Message — Hex transaction data.
  • Padding — AS 2805 specifies its own padding rules; the tool applies them automatically.
AS2805 stack

For end-to-end AS 2805 testing, use the AS2805 Calculator under the Utility Tools section — it bundles MAC, OWF, PIN translation, and terminal key set generation.

Padding Methods (ISO 9797-1)

MethodRuleNotes
Method 1Append 00 bytes to next block boundary.Simple but ambiguous — cannot distinguish trailing zeros in plaintext.
Method 2Append a single 80 byte, then 00 bytes.Self-describing and unambiguous. Recommended.
Method 3Prefix message with its length, then pad with 00.Used in some legacy systems; rare in payments.

Tips

  • Always confirm the IV the host expects — many hosts default to all zeros, but some use the previous transaction’s MAC as a chaining vector.
  • Match the padding method to your host spec. A wrong padding method produces a deterministic but wrong MAC, which is one of the most common debugging traps.
  • For DUKPT-derived MAC keys, generate the session key in the DUKPT Tools first, then plug the result into the corresponding MAC calculator.