Key recovery attack on ANSI X9.19 retail MAC
Bart Preneel, Paul C. van Oorschot · Electronics Letters · 1996
The authors present a new divide and conquer key recovery attack on the retail MAC based on DES, which is a widely used algorithm to compute a message authentication code (MAC). The attack requires 232.5 known text-MAC pairs and 3·256 off-line computations to find the 112 bit key.