ISO 9797-1 MAC Algorithm 3 and Doc 9303-11 I am trying to write a python script to access the IC in an eMRTD as per ICAO Doc 9303. Everything is going swimmingly until I come to the part where I need to calculate a MAC using ISO 9797-1 Algorithm 3 (padding mode 2).

In Appendix D-3, the MAC of E.IFD 72C29C2371CC9BDB65B779B8E8D37B29ECC154AA56A8799FAE2F498F76ED92F2 using K.MAC of 7962D9ECE03D1ACD4C76089DCE131543 is meant to return 5F1448EEA8AD90A7. 

However, when I calculate the MAC, it returns AAE3F35132ED3465. This is the return when I run through the steps step-by-step using pyDes (ECB mode and manually xoring as appropriate) and when I use the code as written here.

I am clearly missing something - would love any help!
I need to calculate a MAC using ISO&nbsp;9797-1 Algorithm 3 (padding mode 2)


and the context makes references to 3DES (as confirmed by the 8-byte width of the result without mention of truncation, and the fact that all bytes of the test key 7962D9ECE03D1ACD4C76089DCE131543 have odd parity).

ISO/IEC&nbsp;9797-1:2011 (revising the 1999 edition) specifies MAC algorithms based on an iterated block cipher with CBC chaining, along the general structure of CBC-MAC. With Algorithm 3, the structure is:



The standard has a Padding Method 2 (not "padding mode 2") where a single 1 bit is appended to the input, then just enough 0 bits (possibly none) to reach a multiple of the block width. Since the input is 32-byte, there are four 8-byte blocks and a last padding block mx of 8000000000000000.

We get F97B82EC7727D582 after the fourth encryption, then 797B82EC7727D582 after XOR of the padding block, then 5F1448EEA8AD90A7as the result.

Caution: there is an attack on this MAC Algorithm 3 recovering the key with the order of $2^{32}$ MAC queries of short messages to find a collision, followed by in the order of $2^{57}$ offline DES operations to recover K1, then K2.