and k₂) using the following algorithm (this is equivalent to multiplication by x and x² in a finite field GF(2^b)). Let << denote the standard left-shift operator and ? denote bit-wise exclusive or:

# Calculate a temporary value k₀ = E_k(0).
# If msb(k₀) = 0, then k₁ = k₀ << 1, else k₁ = (k₀ << 1) ? C; where C is a certain constant that depends only on b. (Specifically, C is the non-leading coefficients of the lexicographically first irreducible degree-b binary polynomial with the minimal number of ones: for 64-bit, for 128-bit, and for 256-bit blocks.)
# If , then , else .
# Return keys (k₁, k₂) for the MAC generation process.