What is the CBC-MAC variant according to ISO 9797-1 (ANSI X9.19), and why does it use two key halves?

ISO 9797-1 enhances CBC-MAC by splitting the 128-bit key into two 64-bit halves and adding a decrypt-then-encrypt step at the end.

* The final decrypt-then-encrypt with a second key half patches the single-key CBC-MAC weakness. *

How it works:

1. Process all blocks using standard CBC-MAC with key $K$ (left 64 bits)
2. After the last block, decrypt the result with $K'$ (right 64 bits)
3. Then encrypt again with $K$

This is one of 6 variants defined in ISO 9797-1. The standard was also adopted as ANSI X9.19.

Why the extra steps?

• Standard CBC-MAC with a single key has theoretical weaknesses
• The decrypt-then-encrypt with a second key half provides additional security
• Using DES as the underlying cipher, the two 64-bit halves give effectively longer key material

Note: While DES is shown in the diagrams, any block cipher can be used. With AES (128/256-bit blocks), the key halves would be correspondingly larger.

Go deeper:

• CBC-MAC — retail MAC and variants (Wikipedia) — how the ISO/IEC 9797-1 algorithms strengthen the basic scheme.