F64—MESSAGE AUTHENTICATION CODE (MAC): Verifies the origin and text of the message between the sender and the receiver.
How does MAC work?
A MAC (Message Authentication Code) is a value calculated from the content of the message and a secret key known to both parties. The sender calculates the MAC value using certain fields of the message and adds it to the message. The receiver repeats the same calculation on its side. If the two values match, it is understood that the message was not changed in transit and really came from the party that knows the key.
What does it protect, and what doesn't it?
MAC verifies the integrity and origin of the message. That is, if a field such as the amount or card number is changed during transmission, it is detected thanks to the MAC. However, MAC does not hide the content of the message. Encryption is also needed to prevent the message from being read.
Key management
The key used in the MAC calculation is shared securely between the terminal and the bank, or between two institutions, and is changed at regular intervals. Key exchange is done with network management messages (08xx). An HSM (Hardware Security Module) is usually used to generate and store the keys securely.
F64 and F128
If the ISO 8583 message uses only the primary bitmap, the MAC value is sent in the F64 field. If the message has a secondary bitmap, that is, if fields 65–128 are also used, the MAC value is placed in F128, the last field of the message. This way, the MAC is always the last field of the message.
