Technical Features

Preconditions

The 3DS Requestor is able to identify the Cardholder and his Device, in order to operate a Split-SDK and provide reliable Device information.
The ACS may support the Device acknowledgement message extension to recognise that the authentication is initiated from a Split-SDK for a 3DS version 2.2 authentication.

3DS Data Elements Related to the Split-SDK

The data elements listed in Table 7.1 below are provided by 3DS Servers for authentications initiated from 3DS Requestor Apps based on a Split-SDK.

For additional information, refer to Table A.1 in the Core Specification and to the EMV 3-D Secure Device Acknowledgement Message Extension.

Table 7.1: 3DS Data Elements Related to the Split-SDK

Data Element

Description

Version

Split-SDK Type

Indicates the characteristics of a Split-SDK.

Split-SDK Variant: Implementation characteristics of the Split-SDK client.

Limited Split-SDK Indicator: If the Split-SDK client has limited capabilities.

2.3.1

2.2 + Device Acknowledgement

Split-SDK Server ID

DS assigned Split-SDK Server identifier.

Each DS can provide a unique ID to each Split-SDK Server on an individual basis.

2.3.1

2.2 + Device Acknowledgement

SDK Type

 

Indicates the type of 3DS SDK.

This data element provides additional information to the DS and ACS to determine the best approach for handling the transaction.

2.3.1

2.2 + Device Acknowledgement

SDK Signature Timestamp

Date and time indicating when the 3DS SDK generated the Split-SDK Server Signed Content converted into UTC.

2.3.1

2.2 + Device Acknowledgement

SDK Server Signed Content

 

Contains the JWS object (represented as a string) created by the Split-SDK Server for the AReq message.

The body of the JWS object (represented as a string) will contain the following data elements:

  • SDK Reference Number
  • SDK Signature Timestamp
  • SDK Transaction ID
  • Split-SDK Server ID

2.3.1

2.2 + Device Acknowledgement

Device Information

Device information gathered by the 3DS SDK from a Consumer Device. This is JSON name/value pairs that as a whole is Base64url-encoded.

This will be populated by the DS as unencrypted data to the ACS obtained from SDK Encrypted Data.

2.3.1

2.2

SDK Encrypted Data

 

JWE Object (represented as a string) as defined in Section 6.2.2.1 of the 3DS Specification containing data encrypted by the 3DS SDK for the DS to decrypt.

2.3.1

2.2

 

Default-SDK and Split-SDK Flow

The transaction flow is identical for a Default-SDK and a Split-SDK. The same messages (CReq/CRes) are exchanged with the ACS during a challenge. For additional information, refer to Section 3.1 – App-based Requirements in the Core Specification.
The Split-SDK may be implemented in 3 variants: Native, Browser and Shell.

 

Split-SDK Native

The Split-SDK Client functionality is implemented using native platform code of the Consumer Device and is embedded within a 3DS Requestor App (similarly to the Default-SDK).

 

Split-SDK Browser

The Split-SDK Client functionality is implemented using JavaScript running in a device Browser. The JavaScript is delivered from the Split-SDK Server to the 3-D Secure challenge window opened on the Browser during the authentication.

 

Split-SDK Shell

The Split-SDK Client functionality is implemented using JavaScript running in a secured WebView opened by the Split-SDK/Shell. The Split-SDK/Shell is a thin client embedded in the 3DS Requestor App (similarly to the Default-SDK). The JavaScript is delivered from the Split-SDK Server during the authentication.

 

Limited SDK

If the Client cannot securely encrypt the CReq message, then the Split-SDK is considered Limited, as defined in Section 3.3 of the EMV® 3-D Secure Split-SDK Specification. For a Limited Split-SDK, the range of allowed Authentication Methods is limited to those that are dynamic (static Authentication Methods like password are not supported).
The Limited option for the Split-SDK or Default-SDK applies to devices that are not capable of supporting cryptographic functions such as key generation and encryption of CReq messages.
The Split-SDK Limited option is only applicable to the Native Client.
For the Browser and Shell Client Split-SDK variants, the Client is coded as a JavaScript that executes in a Browser iframe or a WebView. These environments can support the 3DS cryptography functions of the 3DS SDK. Therefore, the Limited option is not applicable.

For additional information, refer to the EMV 3-D Secure Split-SDK Specification.