diff --git a/lib/nfc/protocols/mrtd.h b/lib/nfc/protocols/mrtd.h
index 4c466c806..1e775f436 100644
--- a/lib/nfc/protocols/mrtd.h
+++ b/lib/nfc/protocols/mrtd.h
@@ -7,7 +7,6 @@
 typedef struct {
     FuriHalNfcTxRxContext* tx_rx;
     uint16_t file_offset;
-    uint8_t* kmrz;
     uint8_t ksenc[16];
     uint8_t ksmac[16];
     uint64_t ssc_long;
diff --git a/lib/nfc/protocols/mrtd_helpers.c b/lib/nfc/protocols/mrtd_helpers.c
index 97d9eb69a..fd6f201ae 100644
--- a/lib/nfc/protocols/mrtd_helpers.c
+++ b/lib/nfc/protocols/mrtd_helpers.c
@@ -1,5 +1,8 @@
 #include "mrtd_helpers.h"
 
+#include <mbedtls/sha1.h>
+#include <mbedtls/des.h>
+
 uint8_t mrtd_bac_check_digit(const uint8_t* input, const uint8_t length) {
     const uint8_t num_weights = 3;
     uint8_t weights[] = {7, 3, 1};
@@ -31,12 +34,6 @@ void mrtd_print_date(uint8_t* output, MrtdDate* date) {
     output[5] = (date->day % 10) + '0';
 }
 
-// Safe size: MRTD_DOCNR_MAX_LENGTH + 1 (CD) + 6 (DOB) + 1 (CD) + 6 (DOE) + 1 (CD) + 1 (0x00)
-// Test with:
-// - DOCNR of size 9
-// - DOCNR of size <9
-// - DOCNR of size >9
-// - DOCNR of size MRTD_DOCNR_MAX_LENGTH
 bool mrtd_bac_get_kmrz(MrtdAuthData* auth, uint8_t* output, uint8_t output_size) {
     uint8_t idx = 0;
     uint8_t docnr_length = strlen(auth->doc_number);
@@ -68,3 +65,35 @@ bool mrtd_bac_get_kmrz(MrtdAuthData* auth, uint8_t* output, uint8_t output_size)
     output[idx++] = '\x00';
     return true;
 }
+
+bool mrtd_bac_keys(const uint8_t kseed[16], uint8_t ksenc[16], uint8_t ksmac[16]) {
+    uint8_t hash[20];
+    mbedtls_sha1_context ctx;
+    mbedtls_sha1_init(&ctx);
+
+    do {
+        for(uint8_t i=1; i<=2; ++i) {
+            if(mbedtls_sha1_starts(&ctx)) break;
+            if(mbedtls_sha1_update(&ctx, kseed, 16)) break;
+            if(mbedtls_sha1_update(&ctx, "\x00\x00\x00", 3)) break;
+            if(mbedtls_sha1_update(&ctx, &i, 1)) break;
+            if(mbedtls_sha1_finish(&ctx, hash)) break;
+
+            switch(i) {
+                case 1:
+                    memcpy(ksenc, hash, 16);
+                    mbedtls_des_key_set_parity(ksenc);
+                    mbedtls_des_key_set_parity(ksenc+8);
+                    break;
+                case 2:
+                    memcpy(ksmac, hash, 16);
+                    mbedtls_des_key_set_parity(ksmac);
+                    mbedtls_des_key_set_parity(ksmac+8);
+                    break;
+            }
+        }
+    } while(false);
+
+    mbedtls_sha1_free(&ctx);
+    return true;
+}
diff --git a/lib/nfc/protocols/mrtd_helpers.h b/lib/nfc/protocols/mrtd_helpers.h
index 6ad283c68..d5d237319 100644
--- a/lib/nfc/protocols/mrtd_helpers.h
+++ b/lib/nfc/protocols/mrtd_helpers.h
@@ -35,3 +35,5 @@ uint8_t mrtd_bac_check_digit(const uint8_t* input, const uint8_t length);
 void mrtd_print_date(uint8_t* output, MrtdDate* date);
 
 bool mrtd_bac_get_kmrz(MrtdAuthData* auth, uint8_t* output, uint8_t output_size);
+
+bool mrtd_bac_keys(const uint8_t* kseed, uint8_t* ksenc, uint8_t* ksmac);
diff --git a/test_mrtd_helpers.c b/test_mrtd_helpers.c
index 633dd39c7..978c6071f 100644
--- a/test_mrtd_helpers.c
+++ b/test_mrtd_helpers.c
@@ -9,6 +9,12 @@
 #define COLOR_GREEN "\033[0;32m"
 #define COLOR_RESET "\033[0;0m"
 
+void print_hex(const uint8_t* data, size_t length) {
+    for(uint8_t i=0; i<length; ++i) {
+        printf("%02X", data[i]);
+    }
+}
+
 void test_mrtd_bac_check_digit(const uint8_t* input, const uint8_t exp_output) {
     uint8_t output = mrtd_bac_check_digit(input, strlen(input));
     if(output != exp_output) {
@@ -47,31 +53,63 @@ void test_sha1(const uint8_t* data, const uint8_t* exp_output) {
 
     if(memcmp(hash, exp_output, 20)) {
         printf(COLOR_RED "FAILED  - sha1 of %s, expected:\n", data);
-        for(uint8_t i=0; i<20; ++i) {
-            printf("%02X", exp_output[i]);
-        }
+        print_hex(exp_output, 20);
         printf(", result:\n");
     } else {
         printf(COLOR_GREEN "SUCCESS - sha1 of %s is: ", data);
     }
 
-    for(uint8_t i=0; i<20; ++i) {
-        printf("%02X", hash[i]);
-    }
+    print_hex(hash, 20);
     printf("\n" COLOR_RESET);
 }
 
+void test_mrtd_bac_keys(const uint8_t kseed[16], const uint8_t exp_ksenc[16], const uint8_t exp_ksmac[16]) {
+    uint8_t ksenc[16];
+    uint8_t ksmac[16];
+    if(!mrtd_bac_keys(kseed, ksenc, ksmac)) {
+        printf(COLOR_RED "FAILED  - mrtd_bac_keys returned FALSE for ");
+        print_hex(kseed, 16);
+        printf(COLOR_RESET "\n");
+        return;
+    }
+
+    if(memcmp(exp_ksenc, ksenc, 16)) {
+        printf(COLOR_RED "FAILED  - mrtd_bac_keys of ");
+        print_hex(kseed, 16);
+        printf(", expected ksenc:\n");
+        print_hex(exp_ksenc, 16);
+        printf(" is:\n");
+        print_hex(ksenc, 16);
+        return;
+    } else if(memcmp(exp_ksmac, ksmac, 16)) {
+        printf(COLOR_RED "FAILED  - mrtd_bac_keys of ");
+        print_hex(kseed, 16);
+        printf(", expected ksmac:\n");
+        print_hex(exp_ksmac, 16);
+        printf(" is:\n");
+        print_hex(ksmac, 16);
+        return;
+    } else {
+        printf(COLOR_GREEN "SUCCESS - mrtd_bac_keys of ");
+        print_hex(kseed, 16);
+        printf(" ksenc: ");
+        print_hex(ksenc, 16);
+        printf(" ksmac: ");
+        print_hex(ksmac, 16);
+        printf(COLOR_RESET "\n");
+    }
+}
+
 int main(int argc, char** argv) {
     test_mrtd_bac_check_digit("D23145890734", 9);
     test_mrtd_bac_check_digit("340712", 7);
     test_mrtd_bac_check_digit("950712", 2);
 
-    MrtdAuthData mad1 = {
+    test_bac_get_kmrz(&(MrtdAuthData){
         .doc_number = "D23145890734",
         .birth_date = {34, 7, 12},
         .expiry_date = {95, 7, 12},
-    };
-    test_bac_get_kmrz(&mad1, "D23145890734934071279507122");
+        }, "D23145890734934071279507122");
     test_bac_get_kmrz(&(MrtdAuthData){
         .doc_number = "L898902C",
         .birth_date = {69, 8, 6},
@@ -80,5 +118,10 @@ int main(int argc, char** argv) {
 
     test_sha1("L898902C<369080619406236", "\x23\x9a\xb9\xcb\x28\x2d\xaf\x66\x23\x1d\xc5\xa4\xdf\x6b\xfb\xae\xdf\x47\x75\x65");
 
+    test_mrtd_bac_keys(
+        "\x23\x9a\xb9\xcb\x28\x2d\xaf\x66\x23\x1d\xc5\xa4\xdf\x6b\xfb\xae",
+        "\xab\x94\xfd\xec\xf2\x67\x4f\xdf\xb9\xb3\x91\xf8\x5d\x7f\x76\xf2",
+        "\x79\x62\xd9\xec\xe0\x3d\x1a\xcd\x4c\x76\x08\x9d\xce\x13\x15\x43");
+
     return 0;
 }