Authentication code

[orbano]

Hi, thanks for sharing this info, looks promising.
Just a remark regarding the unique 'authentication code' related to each SCA which is requested by PSD2 RTS (cf. article 4): I don't see how it's managed in your proposition. I would add such attribute in the P2Pay, next to the payment-id. One could argue that the payment-id is unique, and then the hash is unique, but the payment-id is not assigned by the authentication but prior to it; it's not the same purpose.
Without such info, the approach could be seen as not compliant with PSD2 RTS (and these requirements related to SCA are still applicable with PSD3 & PSR).
Or is there already a code which is automatically assigned to each VP in OpenID4VP protocol which could be used?

[senexi]

Hi @orbano , thanks for checking it out. Regarding the authentication code... It is done by hashing the original transaction_data json that is included in the authorization request. this hash is included in the vp. see https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-7.4

[orbano]

Hi @senexi, thx for reply.
I don't think it's the right approach. The hash of transaction data should be used for the dynamic linking only. The authentication code is conceptually related to the authentication itself, not just to the transaction data. What if there is two authentications for the same transaction data?

[yaron-zehavi]

I see @orbano's point, to distinguish 2 transactions with similar data entropy needs to be introduces. Perhaps this is achieved thru the OPENID4VP's nonce, so the entire vp_token would be the authentication code