Using Message Authentication Codes

To use message authentication when sending a message, an application generates a MAC for it using the MAC generate callable service and one of these methods:

The ANSI standard X9.9, option 1 with either a single-length MAC key or a single-length DATA key.
The X9.19 optional double key MAC procedure with a double-length MAC key.
The EMV padding rules with either a single-length or double-length MAC key.
The ISO 16609 CBC mode with a double-length MAC or double-length DATA key
The AES XCBC MAC algorithm from the IETF RFC 3566 which uses AES DATA key to produce a 96-bit result.
The AES XCBC PRF algorithm from the IETF RFC 3566 which uses AES DATA key to produce a 128-bit result.
The FIPS-198 Keyed-Hash Message Authentication Code (HMAC) algorithm with a variable length HMAC key.
The NIST SP 800-38B cipher message authentication code (CMAC) algorithm with AES MAC keys.

The originator of the message then sends the MAC with the message text.

When the receiver gets the message, an application program calls the MAC verification callable service. The service again encrypts the message text by using the same method that was used to compute the original MAC. The callable service then notifies the receiver whether the MAC has been verified or not. The callable service does not allow the receiver to have access to the MAC it generates. Because the sender and the receiver share secret cryptographic keys that are used in the MAC calculation, the MAC comparison also ensures the authenticity of the message.