PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure Device Acknowledgement Message Extension

v3.0 Specifications
3-D Secure

EMV® 3-D Secure Device Acknowledgement Message Extension Version 3.0 August 2022

EMV 3-D Secure Device Acknowledgement Message Extension Legal Notice

of 14

Legal Notice

The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications.

Extension Contents

Extension Introduction

of 14

Introduction

This document provides the EMV® 3-D Secure Device Acknowledgement Message Extension v3.0 and describes, in the context of the EMV 3-D Secure Protocol and Core Functions Specification v2.1.0 and v2.2.0, how:

  • the 3DS Server that interfaces with a Split-SDK can provide the Split-SDK-related data to the ACS for use in risk-decisioning
  • the ACS can acknowledge data received in 3-D Secure Device Information, particularly for Device Information Data Version 1.3 or higher. The Device Acknowledgement Message Extension is only present in the AReq message version 2.1.0 or 2.2.0 when the 3DS Requestor uses a Split-SDK for the App flow. The Device Acknowledgement Message Extension is only present in the ARes message version 2.1.0 or 2.2.0 if the ACS:
  • acknowledges the supported Device Information, AND/OR
  • provides additional data to the Split-SDK in the case of a challenge (Transaction Status = C) Supporting Documentation The following documents are specific to the EMV 3-D Secure protocol and should be used in conjunction with this specification. These documents, as well as the EMV® 3-D Secure Frequently Asked Questions, are located on the EMVCo website.
  • EMV® 3-D Secure—Protocol and Core Functions Specification v2.3.1.0
  • EMV® 3-D Secure—Split-SDK Specification v2.3.1.0
  • EMV® Specification Bulletin No. 255—EMV® 3-D Secure Specification Version Configuration Extension Device Acknowledgement Message Extension Data Elements of 14 Device Acknowledgement Message Extension Data Elements Table 1: Device Acknowledgement Message Extension Data Elements Data Element/Field Name Assigned Extension Group Identifier Field Name: id Criticality Indicator Field Name: criticalityIndicator Data Field Name: data Extension Name Field Name: name

Description

A unique identifier for the extension. Source 3DS Server ACS A Boolean value indicating whether the recipient must understand the contents of the extension to interpret the entire message. 3DS Server ACS The data carried in the extension. 3DS Server ACS The name of the extension data set 3DS Server as defined by the extension owner. ACS Length/Format/Values Inclusion Length: 14 characters JSON Data Type: String Value accepted:

  • A000000802-001 JSON Data Type: Boolean Value accepted:
  • false AReq = R ARes = R AReq = R ARes = R Length: Variable, maximum 8059 characters JSON Data Type: Object Values accepted:
  • Refer to Table 2 for data elements AReq = R ARes =R Length: 19 characters JSON Data Type: String Value accepted:
  • Dev Ack - Split-SDK AReq = R ARes = R Extension Device Acknowledgement Message Extension Data Elements Table 2: Data Data Element/Field Name Extension Version Number Field Name: version Description Version number of the message extension. Source 3DS Server ACS Default-SDK Type Field Name: defaultSdkType Indicates the characteristics of a Default-SDK. SDK Variant: SDK implementation characteristics Wrapped Indicator: If the DefaultSDK is embedded as a wrapped component in the 3DS Requestor App Example: "defaultSdkType":{ "sdkVariant":"01", "wrappedInd":"Y" } 3DS Server Length/Format/Values Length: 3 characters JSON Data Type: String Value accepted:
  • 3.0 JSON Data Type: Object sdkVariant Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Native
  • 02–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use wrappedInd Length: 1 character JSON Data Type: String Value accepted:
  • Y = Wrapped Only present if value = Y of 14 Inclusion AReq = R ARes = R Required if SDK Type = 01 Extension Device Acknowledgement Message Extension Data Elements Data Element/Field Name SDK Authentication Type Field Name: sdkAuthenticationType Description Authentication methods preferred/supported by the 3DS SDK in order of preference. Source 3DS SDK of 14 Length/Format/Values Inclusion Size: 1–99 elements JSON Data Type: Array of String String: 2 characters Values accepted:
  • 01 = Static Passcode
  • 02 = SMS OTP
  • 03 = Key fob or EMV card reader OTP
  • 04 = App OTP
  • 05 = OTP Other
  • 06 = KBA
  • 07 = OOB Biometrics
  • 08 = OOB Login
  • 09 = OOB Other
  • 10 = Other
  • 11 = Push Confirmation
  • 12–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use Required if SDK Type = 02 Extension Device Acknowledgement Message Extension Data Elements of 14 Data Element/Field Name SDK Server Signed Content Field Name: sdkServerSignedContent SDK Signature Timestamp Field Name: sdkSignatureTimestamp SDK Type Field Name: sdkType Description Source Contains the JWS object (represented as a string) created by the Split-SDK Server for the AReq message. 3DS SDK Date and time indicating when the 3DS SDK generated the Split-SDK Server Signed Content converted into UTC. 3DS SDK Indicates the type of 3DS SDK. This data element provides additional information to the DS and ACS to determine the best approach for handling the transaction. 3DS Server Length/Format/Values Inclusion Length: Variable JSON Data Type: String Values accepted:
  • The body of the JWS object (represented as a string) will contain the following data elements as defined in Table A.1:
  • SDK Reference Number
  • SDK Signature Timestamp
  • SDK Transaction ID
  • Split-SDK Server ID Conditional based on DS rules. Only present if SDK Type = 02 Length: 14 characters JSON Data Type: String Date format accepted:
  • YYYYMMDDHHMMSS See SDK Server Signed Content Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Default-SDK
  • 02 = Split-SDK
  • 03–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use Extension Device Acknowledgement Message Extension Data Elements of 14 Data Element/Field Name Split-SDK Type Field Name: splitSdkType Description Indicates the characteristics of a Split-SDK. Split-SDK Variant: Implementation characteristics of the Split-SDK client Limited Split-SDK Indicator: If the Split-SDK client has limited capabilities Example: "splitSdkType":{ "sdkVariant":"01", "limitedInd":"Y" } Source 3DS Server Split-SDK Server ID Field Name: splitSdkServerID DS-assigned Split-SDK Server identifier. Each DS can provide a unique ID to each Split-SDK Server on an individual basis. Split-SDK Server Length/Format/Values Length: Variable JSON Data Type: Object sdkVariant Length: 2 characters JSON Data Type: String Values accepted:
  • 01 = Native Client
  • 02 = Browser
  • 03 = Shell
  • 04–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use limitedInd Length: 1 character JSON Data Type: String Value accepted:
  • Y = Limited Only present if value = Y Length: Variable, maximum 32 characters JSON Data Type: String Value accepted:
  • Any individual DS may impose specific formatting and character requirements on the contents of this field. Inclusion Required if SDK Type is present and = 02 See SDK Server Signed Content Extension Device Acknowledgement Message Extension Data Elements Authentication Method Field Name: authenticationMethod Indicates the authentication types that the Issuer will use to challenge the Cardholder when in the ARes message or what was used by the ACS when in the RReq message. ACS of 14 Size: Variable, 1–99 JSON Data Type: Array of String String: 2 characters Values accepted:
  • 01 = Static Passcode
  • 02 = SMS OTP
  • 03 = Key fob or EMV card reader OTP
  • 04 = App OTP
  • 05 = OTP Other
  • 06 = KBA
  • 07 = OOB Biometrics
  • 08 = OOB Login
  • 09 = OOB Other
  • 10 = Other
  • 11 = Push Confirmation
  • 12 = Decoupled
  • 13 = WebAuthn
  • 14 = SPC
  • 15 = Behavioural biometrics
  • 16–79 = Reserved for future EMVCo use (values invalid until defined by EMVCo)
  • 80–99 = Reserved for DS use If SDK Type = 02 and Split-SDK Type/Limited Indicator = Y, a value of 01 or 06 is not valid.
  • Required in the ARes message if Transactio n Status = C or D.
  • Required in the RReq message if Transactio n Status = Y or N. Extension Device Acknowledgement Message Extension Data Elements Data Element/Field Name Device Information Recognised Version Field Name: deviceInfoRecognisedVersi on Description Indicates the highest Data Version of the Device Information supported by the ACS. Source ACS Device User Interface Mode Field Name: deviceUserInterfaceMode Indicates the user interface mode that the ACS will present to the Cardholder for a challenge. ACS of 14 Length/Format/Values Inclusion Length: 3 characters JSON Data Type: String Value accepted:
  • Any active Device Information Data Version as defined in Table 2 of the EMV® Specification Bulletin No. 255—EMV® 3-D Secure Specification Version Configuration. Example:
  • 1.4 Length: 2 numeric characters JSON Data Type: String Values accepted:
  • 01 = Portrait
  • 02 = Landscape
  • 03 = Voice
  • 04 = Other ARes = R ARes = C Required if Transaction Status = C and if Data Version is greater than or equal to 1.3. Extension Message Format Message Format Table 3: AReq Message Extension Data Elements Data Element Assigned Extension Group Identifier Criticality Indicator Data Extension Name Extension Version Number Default-SDK Type SDK Authentication Type SDK Server Signed Content SDK Signature Timestamp SDK Type Split-SDK Server ID Split-SDK Type Field Name id criticalityIndicator data name version defaultSdkType sdkAuthenticationType sdkServerSignedContent sdkSignatureTimestamp sdkType splitSdkServerID splitSdkType of 14 Extension Message Format Table 4: ARes Message Extension Data Elements Data Element Assigned Extension Group Identifier Authentication Method Criticality Indicator Data Device Information Recognised Version Device User Interface Mode Extension Name Extension Version Number Field Name id authenticationMethod criticalityIndicator data deviceInfoRecognisedVersion deviceUserInterfaceMode name version of 14 Extension Device Acknowledgement Message Extension Samples of 14 Device Acknowledgement Message Extension Samples This is a sample extension that may be included in the AReq message by the 3DS Server. The ACS may consume this additional information as part of its risk evaluation process. "messageExtension":[{ "name":"Dev Ack - Split-SDK", "id":"A000000802-001", "criticalityIndicator":false, "data": { "sdkAuthenticationType":["02","03","04"], "sdkServerSignedContent":"xxxxxxxxx", "sdkSignatureTimestamp":"20200109185123", "sdkType": "02", "splitSdkType": { "sdkVariant":"01", "limitedInd":"Y" } "splitSdkServerID":"validId", "version": "3.0" } }] This is a sample extension that may be included in the ARes message by the ACS. The 3DS SDK may use this additional information as part of its challenge processing. "messageExtension":[{ "name":" Dev Ack - Split-SDK", "id":"A000000802-001", "criticalityIndicator":false, "data": { "authenticationMethod":["02","04"], "deviceInfoRecognisedVersion":"1.5", "deviceUserInterfaceMode":"02", "version":"3.0" } }] © 2020–2022 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.