Message Authentication Code (MAC)
PCIComplianceHubLast updated
A short piece of information used to authenticate a message and confirm its integrity. MACs are commonly used in conjunction with encryption to ensure the security of sensitive data, such as cardholder data, during transmission.
Applies to. PCI DSS v4.0.1 does not name message authentication codes in its requirement text; the Council's glossary folds the term into strong cryptography. The nearest requirement is 3.5.1.1, which requires hashes used to render stored PAN unreadable to be keyed cryptographic hashes with managed keys, a closely related construction. Beyond that, a MAC is one of the mechanisms an entity may use inside the security protocols that 4.2.1 requires for PAN in transit.
Example. A service provider sends settlement files to a merchant over a private link. Each file carries a MAC computed with a shared secret key, so the merchant can reject any file that was altered in transit or fabricated by a third party, and the provider manages the MAC key with the same care as its encryption keys.
Limits. A MAC proves integrity and origin to someone who holds the same secret key; it does not hide the message, so a MAC alone never renders PAN unreadable or satisfies 4.2.1. Because both parties share the key, a MAC cannot show which of them produced the message; that is what a digital signature, with a private key held by one party, provides. A MAC is not a bare hash of the data: without the key it is just a checksum anyone can recompute.