MAC Verification Process

Paydee’s MPI Server validates all the MAC (Message Authentication Code) signature it receives. Why? To ensure the payload wasn’t tampered mid transfer.

There are 3 important steps in MAC validation.

Step 1: Exchange of public RSA keys

Step 2: Generate MAC signature

Step 3: Validate MAC signature

Subsequent section will cover each step in details.

Step 1: Exchange Public Key

At the beginning of a new session, both endpoints must generate a pair of public and prive RSA keys. The public keys are then encoded and exchanged. Therefore, each endpoint get a copy of the other's public RSA key.

	Public RSA 2048 bit key
	Private RSA 2048 bit key
	Base64 Encoded Public RSA 2048 bit key ‘-’ converted to ‘+’ ‘/’ converted to ‘_’ ‘=” omitted

Download Example

Step 2: Generate MAC signature

A MAC signature can be regarded as the encrypted value of the whole message. Below is an example of a whole message:

A MAC is generated by concatenating all the message components, hashed with SHA256 and signed with own Private RSA key.

To send a message, the originating endpoint sends a message together with the MAC signature. The receiving endpoint must validate the message against the MAC signature. This ensures that message is authentic and has not been tampered with.

Step 3: Validate MAC signature

Follow these simple guides to validate a MAC signature.

i. Restore MAC signature by appending the missing ‘=’ symbol that has been omitted by the sender and decode using Base64 algorithm.

MAC signature
‘=” appended

+

Base64
Decode

ii. Concatenate the message received.

Base64 Decode Public RSA 2048 bit key
‘+’ converted to ‘-’
‘_’ converted to ‘/’
‘=’ appended

+

# SHA256

iii. Concatenate all message components received.

iv. Use OpenSSL library to load the key and verify the concatenated message against the restored MAC signature.