What is the CBC-MAC variant according to ISO 9797-1 (ANSI X9.19), and why does it use two key halves?
It runs a normal CBC-MAC with key $K$, then decrypts the result with a second key $K'$ and re-encrypts it with $K$. With DES this gives two 56-bit keys, so 112 effective key bits.
* The final decrypt-then-encrypt with a second key half patches the single-key CBC-MAC weakness. *
How it works:
- Process all blocks using standard CBC-MAC with DES key $K$
- After the last block, decrypt the result with the second DES key $K'$
- Then encrypt again with $K$
This is one of 6 variants defined in ISO 9797-1. The standard was also adopted as ANSI X9.19.
Why the extra steps?
- Standard CBC-MAC with a single key has theoretical weaknesses
- The decrypt-then-encrypt with a second key half provides additional security
- Using DES as the underlying cipher, the second key lifts the effective key length from 56 to 112 bits
Gotcha: a DES key is stored as 64 bits, but 8 of them are parity bits, so its effective length is only 56 bits. Two DES keys are therefore 112 bits, not 128. Diagrams found online often get this wrong.
Note: Any block cipher can replace DES. With AES the two keys would be correspondingly longer (2 × 128, 192 or 256 bits); the block size stays 128 bits.
Go deeper:
CBC-MAC — retail MAC and variants (Wikipedia) — how the ISO/IEC 9797-1 algorithms strengthen the basic scheme.