PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure AReq Browser Data Elements Recommendations

Best Practices
3-D Secure

EMV<sup>®</sup> 3-D Secure AReq Browser Data Elements Recommendations February 2019 EMV 3-D Secure AReq Browser Data Elements Recommendations

Legal Notice

Legal Notice

of 6 This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or noninfringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. EMV 3-D Secure AReq Browser Data Elements Recommendations Contents

3-D Secure Protocol and Core Functions Specification version 2.1.0 -D Secure Protocol and Core Functions Specification version 2.2.0

countries. EMV 3-D Secure AReq Browser Data Elements Recommendations

Introduction

Introduction

of 6 This document clarifies the presence of certain data elements in the 3-D Secure AReq message for Browser (02-BRW). In the EMV 3-D Secure Protocol and Core Functions Specification, there are five Browserspecific data elements, which are obtainable only if the browser has enabled JavaScript. This document clarifies the behaviour for a transaction originating from a Browser where JavaScript is not enabled. Supporting Documentation The following documents are specific to the EMV 3-D Secure protocol and should be used in conjunction with this specification. These documents as well as EMV 3-D Secure FAQs are located on the EMVCo website.

  • EMV<sup>®</sup> 3-D Secure—Protocol and Core Functions Specification, Version 2.1.0
  • EMV<sup>®</sup> 3-D Secure—Protocol and Core Functions Specification, Version 2.2.0 countries. EMV 3-D Secure AReq Browser Data Elements Recommendations Data Elements Data Elements of 6 The five data elements that are obtainable only if JavaScript is enabled:
  • Browser Java Enabled (browserJavaEnabled)
  • Browser Screen Color Depth (browserColorDepth)
  • Browser Screen Height (browserScreenHeight)
  • Browser Screen Width (browserScreenWidth)
  • Browser Time Zone (browserTZ) If JavaScript is not enabled, these five data elements need special handling. The handling depends on the version of the EMV 3DS protocol specification and the 3DS component. 3-D Secure Protocol and Core Functions Specification version 2.1.0 In the 3-D Secure Protocol and Core Functions Specification version 2.1.0, Table A.1 defines the data elements as Required (R). The setting and usage of these data elements are as follows: 3DS Component: 3DS Server For the 3DS Server, the values of the data elements shall be set as outlined in the following table only if JavaScript was not enabled in the Browser for the transaction. How the 3DS Server recognises that JavaScript was not enabled is implementation specific. Data Element/Field Name Browser Java Enabled Field Name: browserJavaEnabled Value False Browser Screen Color Depth 1 Field Name: browserColorDepth Browser Screen Height 0 Field Name: browserScreenHeight Browser Screen Width 0 Field Name: browserScreenWidth Browser Time Zone 0 Field Name: browserTZ countries. EMV 3-D Secure AReq Browser Data Elements Recommendations Data Elements of 6 3DS Component: ACS For the ACS, when JavaScript is not enabled, the values have no meaning, thus the ACS uses the values as follows: If the browserScreenHeight = 0 and/or the browserScreenWidth = 0, then the values of browserJavaEnabled, browserColorDepth, browserScreenHeight, browserScreenWidth, and browserTZ cannot be used for any processing—particularly in risk-based authentication processing. 3-D Secure Protocol and Core Functions Specification version 2.2.0 In 3-D Secure Protocol and Core Functions Specification version 2.2.0, a new data element: Browser JavaScript Enabled (browserJavascriptEnabled) is included and the five data elements identified in this Bulletin have Conditional (C) presence based on the value of this data element. Please refer to the EMV 3DS Protocol and Core Functions Specification version 2.2.0 for details. countries.