FIDO Alliance Paris Seminar 2024

1. 1 © FIDO Alliance 2023
Use of FIDO in the Payments and Identity Landscape
Henna Kapur
Director of Authentication Products, Visa
Co-Chair, FIDO Alliance European Workgroup
hwadhwan@visa.com
Sebastian Elfors
Senior Architect, IDnow
FIDO Alliance European Workgroup
sebastian.elfors@idnow.io

2. 2 © FIDO Alliance 2023
FIDO European Working Group
Who are we and what are we up-to?
Our Mission
• Facilitate communication and cooperation within the European market
• Improve FIDO awareness
• Two key workstreams for the working group - Identity and Payment Authentication

3. 3 © FIDO Alliance 2023
Identity and FIDO

4. 4 © FIDO Alliance 2023
eIDAS2 legislation
–What is it and Why it matters?
 eIDAS = electronic Identification, Authentication and Trust Services
 eIDAS regulation in force since 2014
 eIDAS2 is an amendment, will be in force during 2024
 Major topics for eIDAS2:
 eIDAS2 regulation and the implementing acts
 EUDI Wallet: Specified in Architecture and Reference Framework (ARF)
 Large Scale Pilots (LSPs): Four consortia with different use cases
 Consortia: DC4EU, EWC, NOBID, POTENTIAL
 Use cases: mobile driving license, payments, healthcare, education, travel, etc
 FIDO considered for use with DC4EU, EWC and NOBID cloud-based wallets

5. 5 © FIDO Alliance 2023
eIDAS2 timeline
2024 2025 2026
Feb 2024
EU parliament
vote
EUDI Wallet reference application evaluation
Implementing acts
Ongoing ARF updates based on LSP progress and feedback
Apr 2024
eIDAS2 in force
LSP development | LSP testing & piloting
National EUDI Wallet implementations and roll out
Apr 2025
Implementing
acts final
CEN/ETSI standardization

6. 6 © FIDO Alliance 2023
Roles in the EUDI Wallet eco-system (by the ARF)

7. 7 © FIDO Alliance 2023
7
FIDO use cases for eIDAS2

8. 8 © FIDO Alliance 2023
Other notable publications for reference
 FIDO eIDAS white paper 2020: https://fidoalliance.org/white-paper-using-fido-with-eidas-services/
 FIDO eIDAS white paper summary 2020: https://fidoalliance.org/white-paper-introduction-of-fido-eidas-services/
 FIDO eIDAS blog post 2021: https://fidoalliance.org/fido-recognition-for-european-digital-identity-systems-and-
eidas-grows/
 FIDO EUDI Wallet white paper 2023: https://fidoalliance.org/white-paper-using-fido-for-the-eudi-wallet/
 FIDO eIDAS2 blog post 2023: https://fidoalliance.org/the-eu-organizations-enisa-and-etsi-refer-to-fido-as-
authentication-standard-for-eidas2/

9. 9 © FIDO Alliance 2023
Payment Authentication and FIDO

10. 10 © FIDO Alliance 2023
In Europe, roughly 30% of all e-commerce goes through step-
up where cardholder 2FA is required
 FIDO authentication using Passkeys can simplify this journey with a more seamless, phishing resistant
authentication experience.
 Passkeys along with additional device identification/binding mechanism can create a compliant
authentication journey in Europe.

11. 11 © FIDO Alliance 2023
Cardholder – UX Journey
ID&Vfollowed by FIDOEnrollment
Confirmed cardholder
identity with bank
Establish chain of trust

12. 12 © FIDO Alliance 2023
Cardholder – UX Journey
Subsequentauthenticationusing FIDO
Reduced friction for
returning cardholder
Phishing resistant
authentication
Consistent experience on
browser and apps

13. 13 © FIDO Alliance 2023
Collaboration with EMVCo
 Continuous collaboration since 2016
 Two working groups that discuss FIDO related initiatives
 Work item at the EMV3DS Working Group
 Goal is to define how EMV3DS messages can be used to pass FIDO authentication data across the
EMV payments ecosystem i.e. between Merchants, PSP’s, banks in a 3DS transaction.
 Most recent white paper:
 https://fidoalliance.org/emvco-and-fido-alliance-provide-essential-guidance-on-use-of-fido-
with-emv-3ds/
 This paper calls out,
 a data structure that allows for a chain of trust to be established between cardholder
authentication, FIDO enrolments and FIDO authentication, hence giving issuers increased
control and insight into the authentication process
 Secure Remote Commerce working group
 Goal is to support FIDO as an authentication method as part of remote commerce transactions
 Specifications 1.3 have introduced FIDO2 as a card issuer verification method and as an
authentication method
 More use cases with FIDO under review

14. 14 © FIDO Alliance 2023
Collaboration with W3C and EMVCo
Secure Payment Confirmation
What is SPC and What are its benefits?
 Secure Payment Confirmation (SPC) is an extension to the WebAuthn
standard.
 It enhances the consumer experience when authenticating to a transaction
with a FIDO passkey through a standardized payment context screen.
 Cross origin authentication – it allows for credentials created in one domain
to be used in another domain based on input parameters (subject to
permission by the original Relying party).
Dependencies
 Requires EMV3DS 2.3 support to work with banks, when SPC is used in
the context of EMV 3DS
 Currently only supported on Chrome
Note: Upcoming publication by FIDO EU Working Group to further deep dive into SPC!

15. 15 © FIDO Alliance 2023
What about PSD3?
Commission proposals
on PSD3/PSR
June 2023
Agreement on
Final text
Q1/Q2 2025
EBA to update RTS
on SCA
12 months after
publication*
Publication of final
updated RTS on
SCA
2026/2027**
Political negotiations among EU institutions
(Commission, Parliament and Council)
2023 2024 2025 2026 2027 2028
Entry into force of
updated RTS on
SCA
2027/2028
Publication in
the Official
Journal
1-2 months
after political
agreement
* EBA supposed to update RTS on SCA 12 months after publication but given all the Level 2 (RTS and Guidance) they need to do this process could be delayed.
** Delay in publication of Draft RTS on SCA would delay the whole approval process. (RTS on SCA will include detail provisions on outsourcing requirements for SCA)
*** The EBA continues to work on its Q&A tool – At any point in time there can be new Q&As that clarify provisions of SCA.
Parliament vote on its
position April 2024
Recap on the current timeline
Engagement by FIDO EU Working group
As a working group, We intend to provide feedback when the RTS on SCA is drafted and open for consultation.

16. 16 © FIDO Alliance 2023
16 © FIDO Alliance 2023
Thank you for your interest!
Questions?