PCI Watch

Tracking changes across the Payment Card Industry

SB n° 295 EMV® 3-D Secure Bridging Message Extension

v2.0 Specification Bulletins
3-D Secure

EMV® Specification Bulletin No. 295 November 2023 EMV® 3-D Secure Bridging Message Extension v2.0 This Specification Bulletin No. 295 provides the updates, clarifications and errata incorporated into the EMV® 3-D Secure Bridging Message Extension since version 1.0

Applicability

This Specification Bulletin applies to:

  • EMV® 3-D Secure Bridging Message Extension, Version 2.0 Updates are provided in the order in which they appear in the specification. Deleted text is identified using strikethrough, and red font is used to identify changed text. Unedited text is provided only for context.

Related Documents

EMV® 3-D Secure Bridging Message Extension, Version 1.0

Effective Date

  • November 2023 countries. Contents EMV® 3-D Secure Bridging Message Extension v2.0 countries. Throughout Specification Revisions added to improve grammar, consistency, clarity and readability without any effect on the meaning or interpretation of the specification are not included in this bulletin.

Introduction

This document describes the Bridging Message Extension and how existing EMV® 3-D Secure (3DS) v2.1.0 and v2.2.0 components can provide or consume additional data related to the EMV® 3-D Secure Protocol and Core Functions Specification (hereinafter referred to as the Core Specification) v2.3.1.1 and is designed to evolve to include additional v2.3 features. The EMV® 3-D Secure Protocol and Core Functions Specification v2.1.0, v2.2.0 and v2.3.1.0 is hereinafter referred to as the Core Specification v2.1, v2.2 and v2.3, respectively. The Bridging Message Extension enhances the existing v2.1.0 and v2.2.0 specifications by enabling the implementation of features that are incorporated in the v2.3.1.1 specification. In addition, during the migration to v2.3.1.1, support of the Bridging Message Extension will increase consistency of the key 3DS features provided in v2.1.0, v2.2.0 and v2.3.1.1. This The first version of the Bridging Message Extension carries (v1.0) defined the Recurring Transaction dData, Additional dData, Challenge Data and File URL data that are not present or Data, which is used to enable automation of the switching between the 3DS SDK and an out-of-band (OOB) authentication application, better support the processing of recurring transactions, and incorporate selected elements, values and requirements that were introduced in v2.3.1.0. The second version of the Bridging Message Extension (v2.0) continues support for the v1.0 capabilities and provides additional elements/values that were defined in the Core Specification v2.3.1.1. In the future, as new capabilities are added to the new 3DS specification versions, EMVCo will consider incorporating them, as appropriate, into a new version of the Bridging Message Extension. The Bridging Message Extension defines four sets of data:

  • Recurring Data;
  • Additional Data;
  • Challenge Data; and
  • File URL Data. Recurring Data, Additional Data and File URL Data contain new data or new values for existing data in the AReq/ARes, PReq/PRes or RReq messages for v2.1.0 and v2.2.0. Challenge Data is only provided in CReq/CRes messages for the App-based flow when the Message Version Number is 2.2.0 (not 2.1.0). The EMV® 3-D Secure Bridging Message Extension should be used in conjunction with the Core Specification v2.3.1.1 and the EMV® 3-D Secure Specifications—Frequently Asked Questions, available on the EMVCo website. countries. For differences between v1.0 and v2.0 of the EMV® 3-D Secure Bridging Message Extension, please refer to EMV® Specification Bulletin No. 295, available on the EMVCo website. Bridging Message Extension Support and Implementation In addition, the The 3DS Server sending component builds the 3DS v2.1.0 or v2.2.0 message assuming with the assumption that the ACS 3DS receiving component does not support the Bridging Message Extension, so the 3DS transaction can complete without the Bridging Message Extension. Then it the sending component provides the additional information in the Bridging Message Extension. The 3DS v2.3.1.1 data elements present in the message extension may duplicate existing data elements from the 3DS v2.1.0 and v2.2.0 messages but contain new or different values. According to the Core Specification v2.3, the The data element values are set in the message extension according to the Core Specification v2.1 and v2.2, they are set in v2.3.1.1, while the core part of the 3DS messages. is set according to the Core Specification v2.1.0 and v2.2.0. In such cases, the data element value in the message extension overrides the data element value in the core part of the 3DS message. If the Bridging Message Extension is supported, then the 3DS component shall fully support at least one of the data objects (Recurring dData, Challenge dData, Additional dData or File URL dData) of the message extension and implement the related requirements of the Core Specification v2.3.1.1, as shown below in Table 1. Table 1 follows unchanged. Some These four data objects have are Optional or Conditional presence in the Bridging Message Extension messages, but at least one data object should be present to use the Bridging Message Extension. The data elements inside these data objects may also have presence conditions (Required/Optional/Conditional). The presence condition of) related to:
  • the other data elements in an applies only when the same data object is present; or
  • the data element in the 3DS message (AReq, ARes, …), but not related to the other data objects in the Bridging Message Extension. For example, in the Recurring Data object, the Recurring Date presence depends on the value of the Recurring Indicator. Another example is the Authentication Method presence that depends on the Transaction Status in the ARes or RReq message. Bridging Message Extension Version The Extension Version Number should be kept the same across all message exchanges in a 3DS transaction. When responding, the recipient of the Bridging Message Extension shall use the same Extension Version Number for the message pair (AReq/ARes, CReq/CRes, PReq/PRes) as the one received. If the recipient does not support that Extension Version Number, it shall not include the Bridging Message Extension in its response. countries. Recurring Data With the Recurring Data object, the 3DS Requestor and the 3DS Server can provide additional information to the ACS regarding recurring transactions, such as frequency, end date, etc. If the Recurring Data object (see Table 4 for data elements) is present in the Bridging Message Extension, the ACS shall ignore the recurring transaction-related data (Recurring Expiry, Recurring Frequency) that may be present in the AReq message. Challenge Data With the Challenge Data object, the ACS and the 3DS SDK may automate the switching between the 3DS SDK and an OOB Authentication App during an OOB challenge. The 3DS SDK indicates that it supports automatic switching in the OOB App URL Indicator. If supported, the ACS provides to the 3DS SDK the OOB App URL and OOB App Label in the Challenge Data object. The 3DS SDK displays a button that invokes the switching to the OOB Authentication App. The ACS may also use the Challenge Data object to request that the 3DS SDK mask the data entered by the Cardholder during a challenge. The Challenge Data object shall only be provided if the Message Version Number of the CReq/CRes message is 2.2.0. Challenge Flow with OOB Authentication Requirements These requirements refer to Section 3.2 of the Core Specification v2.3.1.1. The message extension support of OOB challenge-related data is limited to ACS UI Type = 04 (OOB). ACS UI Type = 06 (HTML OOB) is NOT supported in the 3DS Bridging Message Extension. For the ACS and 3DS SDK that support the OOB App URL:
  • the ACS shall implement Req 401, limited to ACS UI Type = 04,
  • the 3DS SDK shall implement Req 399, Req 400, Req 403, Req 404, Req 406, Req 407, Req 408 and Req 409, limited to ACS UI Type = 04, and. Challenge Flow with Data Entry Masking Requirements The ACS requests the Challenge Data Entry to be masked by setting Challenge Data Entry Masking to Y (limited to ACS UI Type = 01). The 3DS SDK shall implement Challenge Data Entry Masking (Figures 44 and 45, Table A.26). Additional Data With the Additional Data object, the 3DS Server, the ACS and the DS can share additional information from the 3DS v2.3.1.1 during the 3DS Authentication, for example:
  • whether the OOB Authentication App used by the ACS supports the 3DS Requestor App URL;
  • the Acquirer Country Code;
  • the Authentication Method used by the ACS;
  • the Card Security Code; countries.
  • the Device Information Version supported by the ACS;
  • the Transaction Challenge Exemption applied by the ACS;
  • the Challenge Error Reporting: detailed information in case of error in the CReq/CRes messages; or
  • the reason for cancelling the Challenge. Challenge Cancelation Indicator Requirements In order to provide the Challenge Cancelation Indicator, Tthe ACS shall implement Req 45 and the updates to Section 5.9.5 (ACS CReq Message Error Handling—01-APP) of in the Core Specification. File URL Data By using the File URL Data object, the 3DS Server may retrieve the Card Range Data in a file downloaded from the DS rather than from the PRes messages. To use the file download, both the 3DS Server and the DS shall implement all the requirements from Section 5.6 (PReq/PRes Message Handling Requirements) in the Core Specification v2.3.1.1. The Card Range Data in the file is provided in the format defined in the 3DS specification and corresponding to the protocol version of the PReq message. countries. Bridging Message Extension Data Elements Table 2: Bridging Message Extension Data Elements Data Element/ Field Name

Description

Assigned Extension Group Identifier Criticality Indicator Data Extension Name Source Length/Format/ Values 3DS SDK 3DS Server ACS DS 3DS SDK 3DS Server ACS DS 3DS SDK 3DS Server ACS DS 3DS SDK 3DS Server ACS DS Length: 15 8 characters Device Channel Message Category 01-APP 02-BRW 03-3RI 01-PA 02-NPA 01-APP 02-BRW 03-3RI 01-PA 02-NPA 01-APP 02-BRW 03-3RI 01-PA 02-NPA 01-APP 02-BRW 03-3RI 01-PA 02-NPA Message Inclusion

countries.

Data Table 3: Data Data Element/ Field Name Additional Data Challenge Data Extension Version Number File URL Data Recurring Data Description Source Length/Format/ Values 3DS SDK 3DS Server ACS DS Value accepted:

  • 1.0 2.0 Device Channel Message Category 01-APP 02-BRW 03-3RI 01-PA 02-NPA 01-APP 01-PA 02-NPA 01-APP 02-BRW 03-3RI 01-PA 02-NPA N/A 01-APP 02-BRW 03-3RI N/A 01-PA 02-NPA Message Inclusion countries. Recurring Data Table 4: Recurring Data Data Element/ Field Name Recurring Amount Recurring Currency Description Source Length/Format/ Values Device Channel Message Category Message Inclusion 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = C Required if:
  • [ 3DS Requestor Authentication Indicator = 02 or 03; OR 3RI Indicator = 01 or 02 ] AND Recurring Indicator/Amount Indicator = 01 in the Recurring Data object 01-APP 02-BRW 03-3RI 01-PA 02-NPA Required if the Recurring Amount is present in the Recurring Data object countries. Data Element/ Field Name Recurring Currency Exponent Recurring Date Description Recurring Expiry Date after which no further Field Name: recurringExpiry authorisations are performed. Recurring Frequency Recurring Indicator Source Length/Format/ Values 3DS Server Length: 8 characters JSON Data Type: String Date format accepted:
  • YYYYMMDD Device Channel 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI Message Category Message Inclusion 01-PA 02-NPA Required if the Recurring Amount is present in the Recurring Data object 01-PA 02-NPA Required if Recurring Indicator/ Frequency Indicator = 01 in the Recurring Data object 01-PA 02-NPA Required if there is an end date 01-PA 02-NPA 01-PA 02-NPA Required if Recurring Indicator/ Frequency Indicator = 01 in the Recurring Data object AReq = R if the Recurring Data object is present countries. Data Element/ Field Name Description Source Length/Format/ Values Device Channel Message Category Message Inclusion AReq = C Required if:
  • 3DS Requestor Authentication Indicator = 02 or 03; OR
  • 3RI Indicator = 01 or 02 Challenge Data Table 5: Challenge Data Note: Challenge Data is only provided if the Message Version Number of the CReq/CRes message is 2.2.0. Data Element/ Field Name Challenge Data Entry Masking OOB App Label Description Source Length/Format/ Values Device Channel Message Category Message Inclusion 01-APP 01-PA 02-NPA 01-APP 01-PA 02-NPA CRes = C Required if: the OOB App URL is available and for ACS UI Type = 04; AND if: countries. Data Element/ Field Name OOB App Status OOB App URL Description Source Status code indicating the type of problem type encountered when using the OOB App URL. Length/Format/ Values Device Channel Message Category Message Inclusion
  • OOB App URL Indicator = 01 in the CReq message Challenge Data object AND
  • the ACS uses the OOB Authentication App automatic switching feature for this transaction 01-APP 01-PA 02-NPA 01-APP 01-PA 02-NPA CRes = C Required for ACS UI Type = 04 if: the OOB App Label is present AND if: countries. Data Element/ Field Name OOB App URL Indicator OOB Continuation Indicator Description Source Length/Format/ Values Device Channel Length: Variable, 01-APP maximum 48 2 characters Message Category Message Inclusion
  • OOB App URL Indicator = 01 in the CReq message; AND Challenge Data object; AND
  • the ACS utilises the OOB Authentication App automatic switching feature for this transaction 01-PA 02-NPA CReq = R if the Challenge Data object is present 01-APP 01-PA 02-NPA CReq = C Required if: ACS UI Type = 04; OR in the 3DS SDK sends a CReq CRes message unless Challenge Additional Code = Y. countries. Additional Data Table 6: Additional Data Data Element/ Field Name 3DS Requestor App URL Indicator 3DS Requestor Authentication Indicator 3RI Indicator Description Source Length/Format/ Values Values accepted:
  • 17 = FIDO credential deletion
  • 18 = FIDO credential registration
  • 19 = Decoupled Authentication Fallback Device Channel 01-APP 01-APP 02-BRW 03-3RI Message Category Message Inclusion 01-PA 02-NPA AReq = R C AND Required if Message Version Number = 2.2.0 01-PA 02-NPA AReq = C Required if 3DS Requestor Authentication Indicator = 08 or 09 or 10 Otherwise, Optional 01-PA 02-NPA ARes = R AND AReq = C Required if:
  • Message Version Number = 2.2.0 AND countries. Data Element/ Field Name Acquirer Country Code Acquirer Country Code Source Authentication Method Description Source Length/Format/ Values
  • 20–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo) Device Channel Message Category Message Inclusion
  • 3RI Indicator = 14, 15, 16, 17 or 18 Otherwise, Optional Values accepted:
  • ISO 3166-1 numeric three-digit country codes, other than exceptions listed in Table A.5 of the Core Specification v2.3.1.1. 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = R if the Additional Data object is present 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = R if the Additional Data object is present Values accepted:
  • 16 = Electronic ID
  • 17–79 = Reserved for EMVCo future use (values invalid until defined by EMVCo) 01-APP 02-BRW 03-3RI 01-PA 02-NPA countries. Data Element/ Field Name Browser Screen Color Depth Card Security Code Card Security Code Status Card Security Code Status Source Challenge Cancelation Indicator Description Source Length/Format/ Values Device Channel For a list of possible values, refer to https://www.w3schools.co m/jsref/prop_screen_color _depth.asp 02-BRW 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI 01-APP 02-BRW 03-3RI Note: The Additional Data object is not valid for the CReq/CRes messages. Therefore, the Challenge Cancelation Indicator may only be present in the RReq message. 3DS SDK ACS 01-APP 02-BRW 03-3RI Message Category 01-PA 02-NPA Message Inclusion 01-PA 02-NPA 01-PA 02-NPA 01-PA 02-NPA 01-PA 02-NPA Required if the Card Security Code Status is present in the Additional Data object CReq = C RReq = C countries. Data Element/ Field Name Challenge Error Reporting Description Source Length/Format/ Values Device Channel Message Category Message Inclusion
  • Required in CReq for 01APP if the authentication transaction was cancelled by user interaction with the cancellation button in the UI or for other reasons as indicated
  • Required in RReq if the ACS identifies that the authentication transaction was cancelled for reasons as indicated Value of 04 or 05 is required if Transaction Status Reason = 14 01-APP 02-BRW 01-PA 02-NPA countries. Data Element/ Field Name Description Source Length/Format/ Values Device Channel Message Category Message Inclusion Device Information Recognised Version Values accepted:
  • Any active Active Device Information Data Version is considered a valid value. Refer to EMV® Specification Bulletin 255 for values. 01-APP 01-PA 02-NPA ARes = R if the Additional Data object is present Transaction Challenge Exemption 01-APP 02-BRW 03-3RI 01-PA 02-NPA Transaction Characteristics Field Name: transChar Indicates to the ACS specific transactions identified by the Merchant. Refer to Merchant Risk Indicator in the Core Specification v2.3.1.1. 3DS Server Size: Variable, 1–2 elements JSON Data Type: Array of string String: 2 characters Value accepted:
  • 01 = Cryptocurrency transaction
  • 02 = NFT transaction 01-APP 02-BRW 03-3RI 01-PA 02-NPA AReq = O countries. File URL Data Table 7: File URL Data Data Element/ Field Name Card Range Data Download Indicator Card Range Data File URL Description Source Length/Format/ Values Device Channel Message Category Message Inclusion N/A 01-PA PReq = C 02-NPA Present only if the 3DS Server supports the Card Range Data File download N/A 01-PA Present if Card 02-NPA Range Data Download Indicator = Y in the PReq message File URL Data object and the DS supports the Card Range Data File download countries. [This page intentionally left blank.] countries. Message Format Table 8: Message Extension Data Elements Recurring Data Data Element Field Name recurringData Recurring Expiry recurringExpiry Additional Data addData 3RI Indicator threeRIInd Transaction Characteristics transChar countries. Bridging Message Extension Samples Sample AReq Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "recurringData": { "recurringAmount":"1234", "recurringCurrency":"826", "recurringExponent":"2", "recurringExpiry":"20240405", "recurringFrequency":"30", "recurringDate":"20220405", "recurringInd":{"amountInd":"01","frequencyInd":"01"} }, "addData": { "acquirerCountryCode":"250", "acquirerCountryCodeSource":"01", "browserColorDepth":"24", "cardSecurityCode":"123", "cardSecurityCodeStatus":"Y", "cardSecurityCodeStatusSource":"01", "threeDSRequestorAuthenticationInd":"08", "transChar":["01"] } } }] Sample ARes Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "addData": { "authenticationMethod":["07","08"], "cardSecurityCodeStatus":"Y", "cardSecurityCodeStatusSource":"02", "deviceInfoRecognisedVersion":"1.5", "transChallengeExemption":"08", "threeDSRequestorAppURLInd":"Y" } }}] countries. Sample RReq Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "addData": { "authenticationMethod":["07","08"], "challengeCancel":"09", "challengeErrorReporting":{ "threeDSServerTransID": "8a880dc0-d2d2-4067-bcb1-b08d1690b26e", "errorCode":"203", … } } } }] Sample CReq Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "challengeData": { "oobAppStatus":"01", "oobAppURLInd":"01", "oobContinue":"02" }, "addData": { "challengeCancel":"09" } } }] countries. Sample CRes Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "challengeData": { "oobAppLabel":"OOB APP", "oobAppURL":"https://oobapp.com/here", "challengeDataEntryMasking":"N" } } }] Sample PReq Bridging Message Extension "messageExtension":[{ "name":"Bridging", "id":"A000000802-004", "criticalityIndicator":false, "data": { "version": "12.0", "data": { "fileURLData": { "cardRangeDataDownloadInd":"Y" } } }] Sample PRes Bridging Message Extension "messageExtension":[{ "name": "Bridging", "id": "A000000802-004", "criticalityIndicator": false, "data": { "version": "12.0", "data": { "fileURLData": { "cardRangeDataFileURL": "https://server.dsdomainname.com/cardfile.json" } } }] countries.

Legal Notice

The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications

countries.