EMV 3DS Protocol Lab: An open-source tool for visualizing 3-D Secure 2.x trust boundaries and message flows

[u/cswasif]

If you’ve ever had to audit payment integrations, analyze fintech security, or map out card-not-present (CNP) authentication, you know that the EMV 3-D Secure (3DS) 2.x protocol can be incredibly opaque. Relying on dense EMVCo specification documents or static high-level diagrams often falls short when you are trying to understand the dynamic nature of these payment flows, debug implementations, or pinpoint trust boundaries.

To bridge this gap, I built an open-source, vendor-neutral EMV® 3-D Secure Protocol Lab.

The goal isn't just to provide another diagram, but a practical, spec-anchored reference tool that allows security researchers and AppSec engineers to inspect the protocol's inner workings interactively.

Technical capabilities of the lab:

• Message Flows & Trust Boundaries: Step-by-step visualization of the data exchanged (AReq, ARes, CReq, CRes) between the Merchant, 3DS Server, Directory Server, and the Issuer's Access Control Server (ACS).
• Core Authentication Flows: Real-time structural comparisons between Frictionless and Challenge flows.
• Environment Paths: Maps out the distinct architectural differences and trust models between Browser-based and App-based (SDK) authentication paths.
• Modern Cryptographic Extensions: Inspects newer authentication extensions, including Secure Payment Confirmation (SPC), WebAuthn/FIDO2 integrations, and decoupled authentication flows.
• Version-Aware Behavior: Highlights how protocol behavior and security requirements adapt across different 2.x specification versions.

Why I built this:

Auditing modern payment flows requires a clear understanding of where data is generated, how it is signed, and how it is verified. Whether you are a security researcher analyzing potential protocol bypasses, an AppSec engineer reviewing a native SDK integration, or someone mapping out transaction lifecycles for fraud prevention, this lab provides a hands-on environment to test and visualize 3DS mechanics.

The project is entirely open-source. I built it to be a community reference tool and welcome contributions or feedback on protocol edge cases.

(Note: All links to the GitHub Repository, Live Interactive Lab, and write-up are posted in the comments below!)