Ideas

Could the inclusion of a barcode image within an Advanced Electronic Signature help meet PSD2 segregation requirements?

  • Michael Adams profile
    Michael Adams
    4 January 2017 - updated 4 years ago
  • 4 comments
    Total votes: 1

Article 2.2b of the Draft RTS for SCA and CSC under PSD2 states  "The channel, device or mobile application through which the information linking the transaction to a specific amount and a specific payee is displayed shall be independent or segregated from the channel, device or mobile application used for initiating the electronic payment transaction"

In the case where payments are initiated via scanning a QR code on an invoice, if the captured image that was used to successfully scan the barcode could be retained, would this provide sufficient evidence of segregation?

The bitmap image could be included within the advanced electronic signature structure. In the event of a dispute, the barcode could be rescanned to confirm the origin of the payment details.

The Quali-Sign Banking app (Android version) now includes the ability to initiate payments via scanning an invoice. Here are some screenshots and a recording. However the Android API's don't appear to provide access to the image. I have therefore posted a feature request on the Android forum.

I would be very interested in people's opinons as to whether this idea has any merit.

Regards, Michael

 

 

 

 

 

Tags: 
PSD2 Segregation barcode

Comments

Log in to post comments
Lionel Antunes's picture
Lionel Antunes,
04/01/2017 17:11

Hello Michael,

In Luxembourg we have also been discussing the precise intent of this requirement, but unfortunately the sentence combines too many AND/OR to be perfectly unambiguous. Hopefully it will be rephrased/clarified in the final RTS, but with regard to your question and based on the screenshots you provided I would say that:

"The mobile application through which the information linking the transaction to a specific amount and a specific payee is displayed" is Quali-Sign
"The mobile application used for initiating the electronic payment transaction" is also Quali-Sign

Since the same mobile app is used for both purposes (and therefore is a single point of failure) there is no independence or segregation, and therefore the requirement is not fulfilled. Storing the image could be useful later as evidence in case of dispute, but I don't see how it helps for segregation/isolation during the payment itself.

best,
Lionel

Total votes: 0
Michael Adams's picture
Michael Adams,
04/01/2017 17:50

Hi Lionel, thanks for your thoughts and comments.

I do agree, the primary original purpose of the Quali-Sign app was merely to approve payments that had been previously initiated (via the EBICS distributed signatures capability). As you will have seen from the screenshots, in the case of a user initiating a payment via the Quali-Sign app, segregation can still be met via mandating dual approvals. This is fine for business users, but may be considered as overkill for lower value payments and especially for personal users.

If you consider the (I believe very valid) objective of the requirement is to make sure the app (e.g. Quali-Sign) cannot display a different amount/payee to that included in the payment initiation request, and also signed by the user.

The barcode is generated outside the domain of the app. The app will read and display the content of the barcode. If a copy of the barcode image (i.e. photo) could be preserved (and digitally signed), there may be a case to argue that this could constitute the display element. If the payment was subsequently disputed, the barcode could be re-scanned to determine whether the app had fraudulently tried to change the amount/payee details.

I too really hope the RTS are clarified.

Regards, Michael

Total votes: 0
Lionel Antunes's picture
Lionel Antunes,
05/01/2017 15:39

Hi Michael,

> If you consider the (I believe very valid) objective of the requirement is
> to make sure the app (e.g. Quali-Sign) cannot display a different amount/payee
> to that included in the payment initiation request, and also signed by the user.

I agree that this is the objective, and that the signed QR code will help against
forgery, but I don't see how it helps providing segregation or independence.

Maybe I have misunderstood how Quali-Sign works, but if only the app is
compromised, what prevents an attacker from both displaying something
and initiate a different transaction ?

> The barcode is generated outside the domain of the app. The app will read
> and display the content of the barcode. If a copy of the barcode image
> (i.e. photo) could be preserved (and digitally signed), there may be a
> case to argue that this could constitute the display element.

As stated in article 2.2.b, "display" actually means "display to the payer",
so I find it hard to argue that the payment details are not displayed to
the payer by the app itself :-)

best,
Lionel

Total votes: 0
Michael Adams's picture
Michael Adams,
05/01/2017 17:10

Hi Lionel

> Maybe I have misunderstood how Quali-Sign works, but if only the app is
> compromised, what prevents an attacker from both displaying something
> and initiate a different transaction ?

The Quali-Sign app displays the picture (photo) of the barcode and also displays the scanned data (payment details). If the app had been compromised, the app could potentially display the correct payment details (retrieved from the scan) but then replace these when preparing the payment instruction, which the user would then sign, unaware of the changes.

On receipt of the payment instruction and barcode photo (both signed and included in an e.g. enveloping advanced electronic signature), the bank could potentially rescan the barcode as part of its validation.

This leads to the question, could the compromised app swap out the barcode photo? I guess this is possible. My feedback to the consultation paper was to suggest that the (authentication code/signature) creation step be segregated as well as the display. This happens when using a handheld chip and pin device.

> As stated in article 2.2.b, "display" actually means "display to the payer",
> so I find it hard to argue that the payment details are not displayed to
> the payer by the app itself :-)

The app is displaying a photo containing the barcode, together with e.g. elements of the invoice which happened to be also captured in the photo. You could argue that segregation is achieved because the photo is proof that the barcode was also displayed on a paper invoice/bill or on a separate device's screen. If the barcode printed on the invoice was compromised, the user would spot this when reviewing the payment details within the app.

If there is a strict requirement for the segregated 'display' to contain human readable payment details, the EU could come up with a new barcode standard that combines human readable information (payee and amount) within the barcode. These details would then be captured within the image. This is probably starting to get complicated.

As previously discussed, a non-barcode option to achieve segregation is to make use of EBICS distributed signatures. I am convinced that this is the best approach for business/corporates. I did analyse how it could also fit a retail scenario. This would require the retailer to initiate the payment (which they do with card transactions today) and then their customer would subsequently approve it on their mobile device. I personally like this idea for the big retailers who can afford to configure EBICS connections to the banks. See the following doc:-
http://www.quali-sign.com/discussion/PSD2_Segregation_Quali-Sign_16-11-03.pdf

I believe there is a need for an approach that is simple / low tech / achievable and would be within reach of smaller retailers. Have you considered any other alternatives? I would be very interested to hear if you have.

regards, Michael

Total votes: 0