Passkeys & Dynamic Linking

Introduction

Dynamic linking, passkeys, and Secure Payment Confirmation (SPC) are revolutionizing digital payments. This blog post explores how these technologies enhance transaction security and user experience.

Read Full Blog Post Here

What is Dynamic Linking in PSD2?

Dynamic linking, mandated by the PSD2 directive, is a security requirement that ensures each electronic transaction is uniquely tied to its specific details using an authentication code. This process prevents fraud by invalidating the transaction if any detail changes post-authentication. Dynamic linking is crucial for securing online banking and credit card payments.

Requirements for Dynamic Linking

The Regulatory Technical Standards (RTS) under PSD2 outline key requirements for dynamic linking:

• Payer Awareness: Ensuring the payer is informed of the transaction details.
• Unique Authentication Code: Each transaction generates a unique, non-reusable code.
• Specificity: The code must be specific to the transaction amount and payee.
• Secure Transmission: Maintaining confidentiality and integrity during the transaction phases.

How Can Passkeys Be Used for Dynamic Linking?

Passkeys provide a robust method for dynamic linking by acting as cryptographic assertions in the authentication process. Here are two primary methods:

1. Standard Use of Passkeys: The passkey generates a unique, secure signature during the transaction, adhering to PSD2 requirements.
2. Enhanced Cryptographic Proof: This method integrates additional transaction details into the WebAuthn challenge, offering an extra layer of security by ensuring any tampering is detectable.

Limitations of Current Passkey Options

While passkeys enhance security, they face challenges:

• Payer Awareness: Ensuring the payer is aware of transaction details remains a challenge.
• First-Party vs. Third-Party Contexts: Passkeys work well within a single domain but face limitations in third-party contexts, such as during cross-origin transactions.

Future of Secure Payment Confirmation (SPC)

SPC aims to improve both security and user experience in online payments by leveraging browser-native UX and providing cryptographic evidence of user confirmation. Key features include:

• Browser-Native UX: Ensures a consistent, streamlined authentication experience.
• Third-Party Enrollment: Allows registration of passkeys from a cross-origin iframe, addressing common payment use cases.
• Cross-Origin Authentication: Facilitates seamless transactions across different domains without needing iframes, enhancing user experience.

Current Status and Adoption of SPC

As of now, Google Chrome supports SPC, while other major browsers like Safari and Firefox have yet to commit. The integration of SPC with WebAuthn poses challenges but also presents opportunities for refining payment processes. Broad adoption across browsers is crucial for SPC to become a standard in online payments.

Conclusion

Passkeys and SPC are set to transform payment authentication by enhancing security and user experience. While there are challenges, ongoing developments promise greater flexibility and efficiency in secure transactions. Financial institutions and merchants should monitor these advancements to stay ahead in the evolving landscape of digital payments.

For more detailed insights and updates on passkeys and SPC, take a lookg at the full blog post.