Overview
ISO 16609:2022 - Financial services: Requirements for message authentication using symmetric techniques - defines procedures for protecting the integrity and authenticity of financial messages and stored financial data using symmetric key Message Authentication Codes (MACs). The standard is transmission‑process independent, specifies how to generate, place and verify MACs, and identifies approved authentication mechanisms based on the ISO/IEC 9797 series. It is designed for use where sender and receiver share the same key; it does not specify key establishment methods.
Key topics and requirements
- Message Authentication Codes (MACs): Requirements for MAC generation, recomputation and verification to detect accidental or deliberate message alteration.
- Symmetric techniques: Uses shared-secret authentication keys (both parties hold the same key); key handling must follow ISO 11568 principles.
- Message elements to protect: Guidance on which data elements should be included in MAC calculation - for example, transaction amount, currency, key identifier (IDA), payer/beneficiary identifiers, message identifier (MID), date/time, and transaction disposition.
- MAC placement: Options include adding a dedicated MAC field in the message, appending the MAC to the data portion, or retaining the MAC in unambiguous association with stored data.
- Duplication, loss and sequencing detection: Recommendations to include unique transaction references or MIDs, date MAC computed (DMC), or key-derivation per transaction to detect replay, loss or out‑of‑order messages.
- Approved mechanisms: The standard references and approves specific MAC mechanisms and hash functions from the ISO/IEC 9797 series and provides a list of approved block ciphers for MAC calculation (see the standard for the authoritative list).
- Limitations: ISO 16609 does not define key establishment, and its application does not prevent internal fraud by sender/receiver or MAC forgery by a receiver.
Practical applications
- Ensuring message integrity and origin authentication for payment messages, interbank transfers, card transaction messages, ledger backups, and other stored financial data.
- Integrating MAC-based protection in banking gateways, payment processors, host-to-host financial APIs, and transaction logging systems.
- Creating interoperable implementations between institutions for secure transaction exchange.
Who should use this standard
- Financial institutions, payment scheme operators, core banking vendors, payment processors, and security architects responsible for transaction integrity.
- Developers and auditors implementing or reviewing MAC-based message protection in symmetric cryptography environments.
Related standards
For implementation, consult ISO 16609:2022 for approved algorithms, detailed procedures, and Annexes (including a tutorial and MID protection guidance).