SRC use cases andrequirements
W3C FTF March/April 2021
April 1, 2021
Jonathan Grossar, Tomasz Blachowicz

Legal Disclaimer© 2021 Mastercard. The information contained in this document is proprietary and confidential to Mastercard International Incorporated, one ormore of its affiliated entities (collectively “Mastercard”), or both. This material is intended to be used internally within your organization, and may
not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of Mastercard.

The information, including all forecasts, projections, or indications of financial opportunities are provided to you on an "AS IS" basis for use atyour own risk. Mastercard will not be responsible for any action you take as a result of this presentation, or any inaccuracies, inconsistencies,
formatting errors, or omissions in this presentation. Mastercard makes no representations or warranties of any kind, express or implied, withrespect to the contents of this document. Without limitation, Mastercard specifically disclaims all representations and warranties with respect tothis document and any intellectual property rights subsisting therein or any part thereof, including but not limited to any and all implied
warranties of title, non-infringement, or suitability for any purpose (whether or not Mastercard has been advised, has reason to know, or isotherwise in fact aware of any information) or achievement of any particular result. Without limitation, Mastercard specifically disclaims all
representations and warranties that any practice or implementation of this document will not infringe any third party patents, copyrights, trade
secrets or other rights.

2©2021 Mastercard. Proprietary and ConfidentialInformation in this presentation or in any report or deliverable provided by Mastercard in connection herewith relating to the projected impact on
your financial performance, as well as the results that you may expect generally are estimates only. No assurances are given that any of theseprojections, estimates or expectations will be achieved, or that the analysis provided is error-free. You acknowledge and agree that inaccuracies
and inconsistencies may be inherent in both Mastercard’s and your data and systems, and that consequently, the analysis may itself besomewhat inaccurate or inconsistent.

Use of FIDO in Secure Remote Commerce (SRC)
Identity
FIDO can be a frictionless alternative to existing mechanisms that recognize a returning
consumer, before the list of cards is displayed for card selection.
Transaction authentication

Objective today is to focus on Transaction authentication:• Explore a few SRC use cases where SPC could be used, in which the SRC systems validate
FIDO authentication before generating an authenticated payload• Identify the requirements on SPC to facilitate those use cases
3

For illustrative purposes onlyAPRIL 1, 2021

©2021 Mastercard. Proprietary and Confidential

Consumer authentication during the transaction helps to further secure transactions and/or
meet regulatory requirements. FIDO provides Strong Customer Authentication (SCA) with ahigh level of security and minimizes the friction during the authentication process.

41.

SRC system is Relying Partyo Consumers enrolls into FIDO when they are on the network DCF
o An Identification and Verification (ID&V) process can be initiated, for the bank to authenticate
the consumer as the legitimate cardholder
o FIDO credentials (Credential ID, Public Key) and ID of Payment instrument are associated to theconsumer card in SRC system

2.

Issuing bank is Relying Partyo Consumer enrolls into FIDO when visiting the bank’s web site or app
o The bank authenticates the consumer as the legitimate cardholder, as part of their login process
o With consumer’s consent, the bank could share the consumer card and FIDO credentials(Credential ID and Public Key) and ID of Payment instrument with the appropriate SRC system

3.

Merchant is Relying Partyo Consumer enrolls into FIDO during embedded experience with the merchanto An ID&V process can be initiated, for the bank to authenticate the consumer as the legitimate
cardholder, and SRC system is made aware of the successful ID&V
o With consumer’s consent, the merchant could share the FIDO credentials (Credential ID andPublic Key) and ID of Payment instrument with the appropriate SRC system, for a particularcard
APRIL 1, 2021
For illustrative purposes only

©2021 Mastercard. Proprietary and Confidential

Possible consumer journey scenarios to enroll into FIDOConsumers can enroll in different places

SPC authentication during SRC checkout
Use of SPC where SRC systems validate FIDO authentication (no EMV 3DS flow)• After each of the previous enrollment scenarios, where FIDO credentials have been created by the SRCsystem, the Issuing bank or the merchant, the SRC system stores the FIDO Credential ID(s) and/orID(s) of the Payment Instrument, and Public Key(s) against a payment card
• During the checkout• SRCi/DCF retrieves the card profile, the associated ID(s) of the Payment instrument and a FIDO
Challenge from the SRC system• SRCi/DCF retrieves the FIDO assertion from the browser, submits the FIDO assertion to the SRCsystem, the SRC system validates the FIDO assertion and generates an authenticated payload

SPC can also be used by the SRCi/DCF with EMV 3DS (Stripe/Chrome demo), in which case theIssuer – not the SRC system – validates FIDO authentication

5For illustrative purposes only

APRIL 1, 2021

©2021 Mastercard. Proprietary and Confidential• SRCi/DCF uses SPC to authenticate the consumer, by providing ID(s) of the Payment instrument
and the FIDO challenge to the browser (along with the transaction amount)©2021 Mastercard. Proprietary and Confidential

Existing user recognition and card selection process (before SPC authentication)

6

For illustrative purposes only

APRIL 1, 2021

For illustrative purposes only
7

APRIL 1, 2021

©2021 Mastercard. Proprietary and Confidential

SPC
authentication

81.

There is a mechanism to understand whether the browser supports SPC

2.

Non-Relying Party origins can invoke FIDO and retrieve FIDO assertion data

3.

At enrollment, the Relying Party creating the FIDO credentials store the card metadata and the RP
ID in the browser. The browser generates the ID of the Payment Instrument.

4.

At checkout,– the browser’s transaction confirmation dialog displays the card metadata, the merchantidentification e.g. domain name retrieved by browser from top-level browsing context, and thetransaction amount provided in the SPC request– the browser performs authentication with the first matching FIDO credential – if no matching
FIDO credential can be found, it returns an error or opens a fallback URL.
• In any case, the messaging in the authentication dialog box should be optimized (in particular incase of error) and (ideally) consistent across browsers.
– the FIDO assertion data includes merchant URL/identifier and transaction amount in thesignature (enforcing dynamic linking)5.

FIDO challenge is not necessarily generated by the Relying Party (in SRC use case the SRC systemgenerates the challenge)
For illustrative purposes only

APRIL 1, 2021

©2021 Mastercard. Proprietary and Confidential

SPC authentication requirements