1

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn?

For the purposes of this question, I'm classifying all systems where an OTP has to be transmitted as "insecure".

It seems that the most common way to satisfy the PSD2's SCA requirement is with 3-D Secure. And it seems that the most common way to implement 3DS is by transmitting an OTP code via SMS. SMS is not a confidential form of communication, and vulnerabilities such as SIM Swap Attacks have resulted in enormous amounts of fraud. Similarly, messages sent over email are not confidential (eg downgrade attacks).

Fortunately, there's plenty of cryptographically superior, open-standards that completely avoid these risks by simply not transmitting the OTP. This is magnitudes safer. Examples include:

  1. TOTP (eg Google Authenticator)
  2. WebAuthn (eg Yubikey)

For the purpose of this question, I'm classifying open-standards (such as those above) where the OTP is not transmitted as "secure".

While I've seen many banks implement 2FA with TOTP and WebAuthn, I haven't seen any that use it for 3DS, which makes me wonder if [a] banks are, as usual, choosing the lower-friction-yet-less-secure option for their customers or [b] these technologies are actually incompatible with the regulatory requirements of the PSD2.

Is it possible to satisfy the regulatory requirements of PSD2's SCA with TOTP or WebAuthn?

6

1 Answer 1

1

TOTP is not compatible with the PSD2 "dynamic linking" requirement, but--since 2021 and if the device supports Secure Payment Confirmation then-- WebAuthn is compatible with the PSD2 "dynamic linking" requirement.

TOTP

According to the PSD2 regulations, transaction authorization requires a 2FA solution where the OTP is "dynamically linked" to two pieces of data:

  1. The transaction amount (eg "$123")
  2. The transaction payee (eg "Joe's Furniture Store")

This is a problem for TOTP because there is no way to generate an OTP somehow "dynamically linked" with the above two pieces of data. Therefore, TOTP does not meet the PSD2 SCA requirements, and it cannot be used by EU banks for authorizing transactions.

This is a very big problem because, since the regulators prevent banks from using more-secure, industry-standard auth 2FA solutions like TOTP, almost all of the banks satisfy the PSD2 SCA requirements for transaction authorization using a short message and OTP sent over less-secure SMS.

This is a very, very big problem because enormous fraud is caused by auth using OTPs sent over SMS.

I hope that the EU regulators will eventually prohibit any solution that requires sending OTPs at all -- even if encrypted. IMHO it's just better to eliminate that vector entirely and use [a] cryptography to generate the OTP independently on both ends. Or, better, use [b] public-key cryptography to sign a message.

[a] A proprietary solution to adapt TOTP to be PSD2 compliant was developed by Twilio using a private Authy API back-end. The solution (called "Transactional TOTP") allows the user to scan a transaction-specific QR code and uses this information in addition to the TOTP shared key for the account to generate an OTP that's "dynamically linked" to the transaction details.

Unfortunately, I'm not aware of any implementations of "Transactional TOTP" that are open and available without a thrid party.

[b] WebAuthn

WebAuthn is an open standard developed by the FIDO Alliance and W3C.

Prompt titled "Use Touch ID to verify and complete your purchase?". Store: merchant.com. Payment: Mastercard ****4444. Total: $20.00 USD. [Cancel] or [Verify]
WebAuthn was extended to support "dynamic linking" in 2021 with Secure Payment Confirmation. Source: https://github.com/w3c/secure-payment-confirmation

In 2021, WebAuthn was extended to include Secure Payment Confirmation, a Web API that was specifically created for the WebAuthn standard to support transaction confirmations that are compatible with the PSD2 dynamic linking requirements.

In Sep 2021, EVMCo's release announcement for 3DS v2.3, stated that WebAuthn SPC (Secure Payment Confirmation) support was added to the the 3DS specification.

While it's expected that open-source, client-side hardware tokens (eg Nitrokeys) that implement the WebAuthn API will be capable to support transaction confirmations that satisfy the PSD2 "dynamic linking" requirement via Secure Payment Confirmation, it's currently not documented (as of 2024) how to confirm which devices (and user agents) are required.

[b] SQRL

SQRL is an open standard for auth released under the public domain by Steve Gibson and the SQRL team.

Prompt Titled "From: www.grc.com". Body: Please confirm that you are authorizing the transfer of One Hundred Thousand US Dollars ($100,000) from your account to the numbered account: 3405-5942-3327 in the Cayman Islands. [DO NOT TRANSFER!! Abortt!!] or [Yes - Transfer the Funds]
The 2019 SQRL "ask" facility predates the PSD2 "dynamic linking" requirement by 2 years. Source: https://www.grc.com/sqrl/SQRL_Explained.pdf

Originally released in October 2019, SQRL has included a robust "ask" feature that has satisfied the Dynamic Linking requirement 2 years before it was enforced by PSD2 (in 2021).

At the time of writing (2024), there are open-source client-side SQRL apps available for Windows, Linux, iOS, Android, Chromium, and Firefox. There are also server-side implementations available in .NET, Drupal, Wordpress, and OAuth2.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .