8

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes.
Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a money transfer.

These are widely supported by smartphone apps (e.g. Google Authenticator) and hardware tokens (e.g. Yubikeys), and used by many online services.


On the other hand, many financial institutions (particularly within the EU due to the recently adopted PSD2's Dynamic Linking requirement) are implementing schemes that tie the OTP generation to specific transaction data (such as amount and recipient in a money transfer) - to be verified by the user on their generator device/app.
Apart from SMS and push notification options, many institutions offer some kind of visual screen-to-device transfer method, such as flickering bar codes, or (sometimes proprietary) 2D matrix/QR codes.

Public documentation on banking mechanisms is notoriously scarce, so I have not been able to find any details on these presumably proprietary schemes.

I have so far found one documented way to use such a scheme for my own purposes, which is the TxOTP feature of the Authy app.
But this is a commercial service involving a remote API (Authy) that is hardly necessary from a technical standpoint.

Is there any public standard that defines such a Transactional OTP scheme with a visual transfer?
Preferrably one that has been implemented in smartphone apps similarly to TOTP and HOTP.

4

1 Answer 1

1

There are (at least) two open standards that satisfy the PSD2's Dynamic Linking requirement:

  1. SQRL
  2. WebAuthn

SQRL

SQRL is an open standard for auth released under the public domain by Steve Gibson and the SQRL team.

Prompt Titled "From: www.grc.com". Body: Please confirm that you are authorizing the transfer of One Hundred Thousand US Dollars ($100,000) from your account to the numbered account: 3405-5942-3327 in the Cayman Islands. [DO NOT TRANSFER!! Abortt!!] or [Yes - Transfer the Funds]
The 2019 SQRL "ask" facility predates the PSD2 "dynamic linking" requirement by 2 years. Source: https://www.grc.com/sqrl/SQRL_Explained.pdf

Originally released in October 2019, SQRL has included a robust "ask" feature that has satisfied the Dynamic Linking requirement 2 years before it was enforced by PSD2 (in 2021).

At the time of writing (2024), there are open-source client-side SQRL apps available for Windows, Linux, iOS, Android, Chromium, and Firefox. There are also server-side implementations available in .NET, Drupal, Wordpress, and OAuth2.

WebAuthn

WebAuthn is an open standard developed by the FIDO Alliance and W3C.

Prompt titled "Use Touch ID to verify and complete your purchase?". Store: merchant.com. Payment: Mastercard ****4444. Total: $20.00 USD. [Cancel] or [Verify]
WebAuthn was extended to support "dynamic linking" in 2021 with Secure Payment Confirmation. Source: https://github.com/w3c/secure-payment-confirmation

In 2021, WebAuthn was extended to include Secure Payment Confirmation, a Web API that was specifically created for the WebAuthn standard to support transaction confirmations that are compatible with the PSD2 dynamic linking requirements.

While it's expected that open-source, client-side hardware tokens (eg Nitrokeys) that implement the WebAuthn API will be capable to support transaction confirmations that satisfy the PSD2 "dynamic linking" requirement via Secure Payment Confirmation, it's currently not documented (as of 2024) how to confirm which devices (and user agents) are required.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .