PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure Split-SDK Specification v2.3.0.0 DRAFT 4 Disposition of Comments

v1.0 Draft Specification
3-D Secure

Draft Specification & Bulletin Industry Feedback Form Company Name: Primary Contact Name: Working Group or Task Force: 3-D Secure Working Group Document: Split-SDK Specification Draft 4 Date: September 2021 EA/Sub1 Clause No./ Subclause No. /Annex) Paragraph/ Figure/Tabl e/Note Type of comment2 Comment (justification for change) Split-SDK Figure 3.1 Split-SDK Message Flow te In the sequence diagram the 3DS Requestor initiates an authentication request - the very first arrow on the diagram - by calling Split-SDK Server. Could the 3DS Requestor rather send that to the Split-SDK Client? The Split-SDK Client would then initiate a communication with its Split-SDK Server. It would drastically simplify the whole deal for Split-SDK developers - having a mobile SDK (Split-SDK Client) to call out the server is much simpler than having the server (Split-SDK Server) locate an SDK running on a mobile device - web-sockets, push notifications and possible some other future options could really complicate efforts and make it extremely difficult to develop, test, certify(!) and scale once in production. So, the question is whether the initial request from 3DS Requestor CAN go to Split-SDK Client? Note, the question applies to mobile SDKs because in Browser a direct call to Split-SDK Server can easily be implemented as a form submitted in an iFrame, similarly to 3DS Method. Proposed change Status (Accept, Reject, In progress) EMVCo Use Only EMVCo observations on each comment submitted Accept Variations on the flow are allowed as stated in Section 3.2. The flow is outlined for a specific implementation approach. However, implementation variations are allowed provided the result as seen from 3DS Requestor/3DS Server and ACS is indistinguishable (and the security requirements in section 4 are followed). 1 EA/Sub = EMVCo Associate or Subscriber company (enter a 2-3 letter abbreviation for commenting) 2 Type of comment: ge = general te = technical ed = editorial – For technical comments, please indicate whether your comment is a MAJOR or MINOR technical comment. Completed form should be forwarded to the appropriate Working Group or Task Force. Click on: http://www.emvco.com/subscriber/QueryAdd.aspx to submit feedback. 21-Sep-2021

of 4 Draft Specification & Bulletin Industry Feedback Form Company Name: Primary Contact Name: Working Group or Task Force: 3-D Secure Working Group Document: Split-SDK Specification Draft 4 Date: September 2021 EA/Sub1 Clause No./ Subclause No. /Annex) Paragraph/ Figure/Tabl e/Note Type of comment2 Comment (justification for change) Split-SDK Warning Split-SDK 3.2 te The removal of SW02 security warning The SW02 security warning - the one that tells that the integrity of the 3DS SDK has been tampered - has been removed in the EMV Draft Specification Bulletin No. 226 v2. What was the reason behind the removal? The warning seems beneficial and quite possible to implement as part of a mobile Split-SDK Client. te Step 6 Obtain SDK Client Device Data (BROWSER SDK case) It looks like browser SDK is going to be collecting device attributes just like the mobile SDKs do. The DeviceInfo 1.5 specification, however, does not mention any browser attributes. Is it a correct understanding that a list of browser attributes will be specified in the DeviceInfo spec before 2.3 is final? Proposed change Status (Accept, Reject, In progress) EMVCo Use Only EMVCo observations on each comment submitted Reject The security objectives have not changed. The Split-SDK Server shall not initiate the transaction if the Split-SDK client is compromised (refer to Req 55), so SW02 was not applicable, and therefore removed from the specification. Accept All Split-SDKs provide the D parameters. The Browser-Accept Headers and Browser-User-Agent are browser related device information. 1 EA/Sub = EMVCo Associate or Subscriber company (enter a 2-3 letter abbreviation for commenting) 2 Type of comment: ge = general te = technical ed = editorial – For technical comments, please indicate whether your comment is a MAJOR or MINOR technical comment. Completed form should be forwarded to the appropriate Working Group or Task Force. Click on: http://www.emvco.com/subscriber/QueryAdd.aspx to submit feedback. 21-Sep-2021

of 4 Draft Specification & Bulletin Industry Feedback Form Company Name: Primary Contact Name: Working Group or Task Force: 3-D Secure Working Group Document: Split-SDK Specification Draft 4 Date: September 2021 EA/Sub1 Clause No./ Subclause No. /Annex) Paragraph/ Figure/Tabl e/Note Type of comment2 Comment (justification for change) Proposed change Split-SDK 3.2 Split-SDK [Req 311] Split-SDK Step 8 te Step 15 Establish DH Secure Channel & Step 18 Send First CReq Data It is not mentioned explicitly but implied that Browser Split-SDK will be performing AcsSignedContent validation, CEK generation as well as CReq encryption. Are there any recommended javascript/browser tools or libraries? Are there any samples similar to the ones given for Android and iOS in the 2.1 spec? ge The sdkType should be changed from "03" to "04" because "03" stands for Limited- SDK in the Core 2.3 spec. ed Section 5.3 mentions that SDK Type is set Correct the value to ‘04’ (Browser-SDK) to ‘03’. However, ‘03’ is defined in the Protocol and Core Functions specification as ‘Limited SDK’! Status (Accept, Reject, In progress) EMVCo Use Only EMVCo observations on each comment submitted Accept Accept Possible libraries: jsrsasign: https://github.com/kjur/jsrsasign Microsoft Research JavaScript Cryptography Library (msrCrypto): https://github.com/microsoft/MSRJavaScript-Crypto The 3DSWG is reviewing the need for an update to the SDK implementation guide. Typo corrected. Accept Typo corrected. 1 EA/Sub = EMVCo Associate or Subscriber company (enter a 2-3 letter abbreviation for commenting) 2 Type of comment: ge = general te = technical ed = editorial – For technical comments, please indicate whether your comment is a MAJOR or MINOR technical comment. Completed form should be forwarded to the appropriate Working Group or Task Force. Click on: http://www.emvco.com/subscriber/QueryAdd.aspx to submit feedback. 21-Sep-2021

of 4 Draft Specification & Bulletin Industry Feedback Form Company Name: Primary Contact Name: Working Group or Task Force: 3-D Secure Working Group Document: Split-SDK Specification Draft 4 Date: September 2021 EA/Sub1 Clause No./ Subclause No. /Annex) Paragraph/ Figure/Tabl e/Note Type of comment2 Comment (justification for change) Proposed change Split-SDK Table 1.2:

Definitions

Split-SDK Split-SDK Te Minor ed ed

  • Cross -origin resource sharing (CORS) protocol is an HTTP-header based mechanism that allows a server to declare resources can be shared with other origins (domains). "Cross-origin", "allows a server to declare resources can be shared with other origins (domains)." —> needs to be rephrased? Seems to not be a proper sentence
  • Content -Security-Policy Extra space before - (seems to be the case in multiple locations)
  • Figure 3-1 Epheremeral —> Ephemeral
  • Cross -origin resource sharing (CORS) protocol is an HTTP-header based mechanism that allows a server to declare resources that can be shared with other origins (domains). Status (Accept, Reject, In progress) EMVCo Use Only EMVCo observations on each comment submitted Accept Agree with the proposed change. The definition of CORS is updated in the Split-SDK specification. Accept Typo corrected. Accept Typo corrected. 1 EA/Sub = EMVCo Associate or Subscriber company (enter a 2-3 letter abbreviation for commenting) 2 Type of comment: ge = general te = technical ed = editorial – For technical comments, please indicate whether your comment is a MAJOR or MINOR technical comment. Completed form should be forwarded to the appropriate Working Group or Task Force. Click on: http://www.emvco.com/subscriber/QueryAdd.aspx to submit feedback. 21-Sep-2021 of 4