ISO/IEC 7816-4:2013
Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange
ISO/IEC 7816-4:2013 is intended to be used in any sector of activity. It specifies:
a) contents of command-response pairs exchanged at the interface,
b) means of retrieval of data elements and data objects in the card,
c) structures and contents of historical bytes to describe operating characteristics of the card,
d) structures for applications and data in the card, as seen at the interface when processing commands,
e) access methods to files and data in the card,
f) a security architecture defining access rights to files and data in the card,
g) means and mechanisms for identifying and addressing applications in the card,
h) methods for secure messaging,
i) access methods to the algorithms processed by the card. It does not describe these algorithms.
It does not cover the internal implementation within the card or the outside world.
ISO/IEC 7816-4:2013 is independent from the physical interface technology. It applies to cards accessed by one or more of the following methods: contacts, close coupling and radio frequency. If the card supports simultaneous use of more than one physical interface, the relationship between what happens on different physical interfaces is out of the scope of ISO/IEC 7816-4:2013.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$118.26 NZD
|
|
| HardCopy |
$152.17 NZD
|
|
| Networkable PDF |
Price varies
|
1 Scope
2 Normative references
3 Terms and definitions
4 Symbols and abbreviated terms
5 Command-Response pairs
5.1 Conditions of operation
5.2 Syntax
5.3 Chaining procedures
5.3.1 General
5.3.2 Payload fragmentation
5.3.3 Command chaining
5.3.4 Response chaining
5.4 Class byte
5.4.1 Coding
5.4.2 Logical channels
5.5 Instruction byte
5.6 Status bytes
6 Data objects
6.1 SIMPLE-TLV data objects
6.2 BER-TLV data objects
6.3 Constructed DOs versus primitive DOs
7 Structures for applications and data
7.1 Available structures
7.2 Validity area
7.2.1 Definitions and attributes
7.2.2 Basic rules for VA handling and use
7.3 Structure selection
7.3.1 Structure selection methods
7.3.2 File reference data element and DO
7.3.3 General reference data element and DO
7.3.4 Data referencing methods in elementary files
7.4 File and data control information
7.4.1 File control information retrieval
7.4.2 Data control information retrieval
7.4.3 Control parameters
7.4.4 Short EF identifier
7.4.5 File descriptor byte
7.4.6 Profile indicator
7.4.7 Data descriptor byte
7.4.8 DF and EF list data elements
7.4.9 Instance number data element
7.4.10 Life cycle status
7.4.11 Indirect referencing by short EF identifier using DO'A2'
7.4.12 Interface and life cycle status dependent security attribute template
7.4.12.1 Transport type descriptor
7.4.12.2 Indication of life cycle status
8 Specific use of DOs and related concepts
8.1 ber-tlv payloads and padding
8.1.1 Padding conditions
8.1.2 Padding procedure
8.2 Current template and data object generations
8.2.1 Current template and current DO
8.2.2 Template extension
8.2.3 Data object sub-tree
8.2.4 Data object life cycle
8.3 Identification of data elements and data objects
8.3.1 Principles
8.3.2 Tag interpretation in command and response data fields or payloads
8.3.3 Tag allocation
8.3.4 Standard tag allocation scheme
8.3.5 Compatible tag allocation scheme
8.3.6 Coexistent tag allocation scheme
8.3.7 Avoidance of independent tag allocation schemes
8.4 Referencing and retrieval of DOs and data elements
8.4.1 General
8.4.2 Element list
8.4.3 Tag list
8.4.4 Header list
8.4.5 Extended header and extended header list
8.4.6 Resolving an extended header
8.4.7 Resolving an extended header list
8.4.8 Wrapper
8.4.9 Tagged wrapper
9 Security architecture
9.1 General
9.2 Cryptographic mechanism identifier template
9.3 Security attributes
9.3.1 Security attributes targets
9.3.2 Compact format
9.3.3 Expanded format
9.3.3.1 General
9.3.3.2 Object status condition template
9.3.3.3 Object locator
9.3.3.4 Binary Filter value (optional)
9.3.3.5 Comparison data
9.3.4 Access rule references
9.3.5 Security attributes for data objects
9.3.6 Security parameters template
9.3.6.1 General properties
9.3.6.2 Extensions of the security attribute
9.3.6.3 Sequence number
9.3.6.4 Key usage constraints indicator
9.3.6.5 Number of tries
9.3.6.6 Number of uses
9.3.6.7 Non-repudiation
9.3.6.8 Security object numbering
9.3.6.9 Signature creation
9.3.6.10 Key generation
9.3.6.11 Boolean expression
9.3.6.12 Password properties template
9.3.7 Security attributes for logical channels
9.4 Security support data elements
10 Secure messaging
10.1 SM fields and SM DOs
10.1.1 SM protection of command payloads
10.1.2 SM protection of chained commands and responses
10.1.3 SM DOs
10.2 Basic SM DOs
10.2.1 SM DOs for encapsulating plain values
10.2.2 SM DOs for confidentiality
10.2.3 SM DOs for authentication
10.2.3.1 Cryptographic checksum data element
10.2.3.2 Digital signature data element
10.3 Auxiliary SM DOs
10.3.1 Control reference templates
10.3.2 Control reference DOs in control reference templates
10.3.3 Security environments
10.3.4 Response descriptor template
10.4 SM impact on command-response pairs
11 Commands for interchange
11.1 Selection
11.1.1 select command
11.1.2 manage channel command
11.2 Data unit handling
11.2.1 Data units
11.2.2 General
11.2.3 read binary command
11.2.4 write binary command
11.2.5 update binary command
11.2.6 search binary command
11.2.7 erase binary command
11.2.8 compare binary function
11.3 Record handling
11.3.1 Records
11.3.2 General
11.3.3 read record (s) command
11.3.4 write record command
11.3.5 update record command
11.3.6 append record command
11.3.7 search record command
11.3.8 erase record (s) command
11.3.9 activate record (s) command
11.3.10 deactivate record (s) command
11.3.11 compare record function
11.4 Data object handling
11.4.1 General
11.4.1.1 Coding of P1-P2 for even INS codes
11.4.1.2 Coding of P1-P2 for odd INS codes
11.4.1.3 Data fields
11.4.1.4 Access to the extension of the current template
11.4.1.5 Execution or rejection conditions
11.4.2 select data command
11.4.2.1 General
11.4.2.2 Basic target definition
11.4.2.3 Referencing by masked tag DO and filter DO
11.4.2.4 get data control parameters function
11.4.2.5 dir function
11.4.2.6 view function
11.4.2.7 File-related functions
11.4.3 get data/get next data commands - even INS code
11.4.3.1 General
11.4.3.2 select function
11.4.3.3 get data control parameters function
11.4.3.4 Specific functions of get next data and pointer handling
11.4.4 get data/get next data command - odd INS codes
11.4.4.1 General
11.4.4.2 Mandatory argument
11.4.4.3 select function
11.4.4.4 dir and view functions
11.4.4.5 get data control parameters function
11.4.4.6 Specific functions of get next data (INS = 'CD')
11.4.5 General properties of put/put next/update data commands
11.4.6 put data command
11.4.7 put next data command
11.4.8 update data command
11.4.9 compare data function
11.5 Basic security handling
11.5.1 General
11.5.2 internal authenticate command
11.5.3 get challenge command
11.5.4 external authenticate command
11.5.5 general authenticate command
11.5.6 verify command
11.5.7 change reference data command
11.5.8 enable verification requirement command
11.5.9 disable verification requirement command
11.5.10 reset retry counter command
11.5.11 manage security environment command
11.6 Miscellaneous
11.6.1 compare command
11.6.2 get attribute command
11.7 Transmission handling
11.7.1 get response command
11.7.2 envelope command
12 Application-independent card services
12.1 Card identification
12.1.1 Historical bytes
12.1.1.1 Purpose and retrieval
12.1.1.2 Structure and compact-tlv data objects
12.1.1.3 Country or issuer indicator
12.1.1.4 Application identifier
12.1.1.5 Card service data
12.1.1.6 Initial access data
12.1.1.7 Card issuer's data
12.1.1.8 Pre-issuing data
12.1.1.9 Card capabilities
12.1.1.10 Application Family Identifier
12.1.1.11 Status indicator
12.1.2 Initial data string recovery
12.2 Application identification and selection
12.2.1 EF.DIR
12.2.2 EF.ATR/INFO
12.2.3 Application identifier
12.2.4 Application template and related data elements
12.2.5 Application selection
12.2.5.1 Implicit application selection
12.2.5.2 Application selection using AID as DF name
12.2.5.3 Application selection using EF.DIR or EF.ATR/INFO
12.3 Selection by path
12.4 Data retrieval
12.5 Card-originated byte strings
12.5.1 Triggering by the card
12.5.2 Queries and replies
12.5.3 Formats
12.6 General feature management
12.6.1 On-card services
12.6.2 Interface services
12.6.3 Profile services
12.6.4 Provision of additional information
12.7 APDU management
12.7.1 Extended length information
12.7.2 List of supported INS codes
Amendments
- ISO/IEC 7816-4:2013/Amd 1:2018. Published 24/07/2018
- ISO/IEC 7816-4:2013/Amd 2:2018. Published 23/08/2018
- ISO/IEC 7816-4:2013/AMD1:2018. Published 24/07/2018
- ISO/IEC 7816-4:2013/AMD2:2018. Published 23/08/2018
- ISO/IEC 7816-4:2013/Cor 1:2014. Published 14/08/2014
- ISO/IEC 7816-4:2013/COR1:2014. Published 14/08/2014
Previous versions
Keep me up-to-date
Register to receive notifications when updates are made to this standard.
Related Information
Similar Standards
-
BS 7227:1990
Procedures for the application of ISO 7812 to allocate UK Issuer Identification Numbers (UK IINs) for use on identification cards
-
BS EN 1038:1996
Identification card systems. Telecommunications applications. Integrated circuit(s) card payphone
-
BS EN 1332-1:2009
Identification card systems. Human-machine interface, Design principles for the user interface
-
BS EN 1332-2:1998
Identification card systems. Man-machine interface, Dimensions and location of a tactile identifier for ID-1 cards
1 Scope
2 Normative references
3 Terms and definitions
4 Symbols and abbreviated terms
5 Command-Response pairs
5.1 Conditions of operation
5.2 Syntax
5.3 Chaining procedures
5.3.1 General
5.3.2 Payload fragmentation
5.3.3 Command chaining
5.3.4 Response chaining
5.4 Class byte
5.4.1 Coding
5.4.2 Logical channels
5.5 Instruction byte
5.6 Status bytes
6 Data objects
6.1 SIMPLE-TLV data objects
6.2 BER-TLV data objects
6.3 Constructed DOs versus primitive DOs
7 Structures for applications and data
7.1 Available structures
7.2 Validity area
7.2.1 Definitions and attributes
7.2.2 Basic rules for VA handling and use
7.3 Structure selection
7.3.1 Structure selection methods
7.3.2 File reference data element and DO
7.3.3 General reference data element and DO
7.3.4 Data referencing methods in elementary files
7.4 File and data control information
7.4.1 File control information retrieval
7.4.2 Data control information retrieval
7.4.3 Control parameters
7.4.4 Short EF identifier
7.4.5 File descriptor byte
7.4.6 Profile indicator
7.4.7 Data descriptor byte
7.4.8 DF and EF list data elements
7.4.9 Instance number data element
7.4.10 Life cycle status
7.4.11 Indirect referencing by short EF identifier using DO'A2'
7.4.12 Interface and life cycle status dependent security attribute template
7.4.12.1 Transport type descriptor
7.4.12.2 Indication of life cycle status
8 Specific use of DOs and related concepts
8.1 ber-tlv payloads and padding
8.1.1 Padding conditions
8.1.2 Padding procedure
8.2 Current template and data object generations
8.2.1 Current template and current DO
8.2.2 Template extension
8.2.3 Data object sub-tree
8.2.4 Data object life cycle
8.3 Identification of data elements and data objects
8.3.1 Principles
8.3.2 Tag interpretation in command and response data fields or payloads
8.3.3 Tag allocation
8.3.4 Standard tag allocation scheme
8.3.5 Compatible tag allocation scheme
8.3.6 Coexistent tag allocation scheme
8.3.7 Avoidance of independent tag allocation schemes
8.4 Referencing and retrieval of DOs and data elements
8.4.1 General
8.4.2 Element list
8.4.3 Tag list
8.4.4 Header list
8.4.5 Extended header and extended header list
8.4.6 Resolving an extended header
8.4.7 Resolving an extended header list
8.4.8 Wrapper
8.4.9 Tagged wrapper
9 Security architecture
9.1 General
9.2 Cryptographic mechanism identifier template
9.3 Security attributes
9.3.1 Security attributes targets
9.3.2 Compact format
9.3.3 Expanded format
9.3.3.1 General
9.3.3.2 Object status condition template
9.3.3.3 Object locator
9.3.3.4 Binary Filter value (optional)
9.3.3.5 Comparison data
9.3.4 Access rule references
9.3.5 Security attributes for data objects
9.3.6 Security parameters template
9.3.6.1 General properties
9.3.6.2 Extensions of the security attribute
9.3.6.3 Sequence number
9.3.6.4 Key usage constraints indicator
9.3.6.5 Number of tries
9.3.6.6 Number of uses
9.3.6.7 Non-repudiation
9.3.6.8 Security object numbering
9.3.6.9 Signature creation
9.3.6.10 Key generation
9.3.6.11 Boolean expression
9.3.6.12 Password properties template
9.3.7 Security attributes for logical channels
9.4 Security support data elements
10 Secure messaging
10.1 SM fields and SM DOs
10.1.1 SM protection of command payloads
10.1.2 SM protection of chained commands and responses
10.1.3 SM DOs
10.2 Basic SM DOs
10.2.1 SM DOs for encapsulating plain values
10.2.2 SM DOs for confidentiality
10.2.3 SM DOs for authentication
10.2.3.1 Cryptographic checksum data element
10.2.3.2 Digital signature data element
10.3 Auxiliary SM DOs
10.3.1 Control reference templates
10.3.2 Control reference DOs in control reference templates
10.3.3 Security environments
10.3.4 Response descriptor template
10.4 SM impact on command-response pairs
11 Commands for interchange
11.1 Selection
11.1.1 select command
11.1.2 manage channel command
11.2 Data unit handling
11.2.1 Data units
11.2.2 General
11.2.3 read binary command
11.2.4 write binary command
11.2.5 update binary command
11.2.6 search binary command
11.2.7 erase binary command
11.2.8 compare binary function
11.3 Record handling
11.3.1 Records
11.3.2 General
11.3.3 read record (s) command
11.3.4 write record command
11.3.5 update record command
11.3.6 append record command
11.3.7 search record command
11.3.8 erase record (s) command
11.3.9 activate record (s) command
11.3.10 deactivate record (s) command
11.3.11 compare record function
11.4 Data object handling
11.4.1 General
11.4.1.1 Coding of P1-P2 for even INS codes
11.4.1.2 Coding of P1-P2 for odd INS codes
11.4.1.3 Data fields
11.4.1.4 Access to the extension of the current template
11.4.1.5 Execution or rejection conditions
11.4.2 select data command
11.4.2.1 General
11.4.2.2 Basic target definition
11.4.2.3 Referencing by masked tag DO and filter DO
11.4.2.4 get data control parameters function
11.4.2.5 dir function
11.4.2.6 view function
11.4.2.7 File-related functions
11.4.3 get data/get next data commands - even INS code
11.4.3.1 General
11.4.3.2 select function
11.4.3.3 get data control parameters function
11.4.3.4 Specific functions of get next data and pointer handling
11.4.4 get data/get next data command - odd INS codes
11.4.4.1 General
11.4.4.2 Mandatory argument
11.4.4.3 select function
11.4.4.4 dir and view functions
11.4.4.5 get data control parameters function
11.4.4.6 Specific functions of get next data (INS = 'CD')
11.4.5 General properties of put/put next/update data commands
11.4.6 put data command
11.4.7 put next data command
11.4.8 update data command
11.4.9 compare data function
11.5 Basic security handling
11.5.1 General
11.5.2 internal authenticate command
11.5.3 get challenge command
11.5.4 external authenticate command
11.5.5 general authenticate command
11.5.6 verify command
11.5.7 change reference data command
11.5.8 enable verification requirement command
11.5.9 disable verification requirement command
11.5.10 reset retry counter command
11.5.11 manage security environment command
11.6 Miscellaneous
11.6.1 compare command
11.6.2 get attribute command
11.7 Transmission handling
11.7.1 get response command
11.7.2 envelope command
12 Application-independent card services
12.1 Card identification
12.1.1 Historical bytes
12.1.1.1 Purpose and retrieval
12.1.1.2 Structure and compact-tlv data objects
12.1.1.3 Country or issuer indicator
12.1.1.4 Application identifier
12.1.1.5 Card service data
12.1.1.6 Initial access data
12.1.1.7 Card issuer's data
12.1.1.8 Pre-issuing data
12.1.1.9 Card capabilities
12.1.1.10 Application Family Identifier
12.1.1.11 Status indicator
12.1.2 Initial data string recovery
12.2 Application identification and selection
12.2.1 EF.DIR
12.2.2 EF.ATR/INFO
12.2.3 Application identifier
12.2.4 Application template and related data elements
12.2.5 Application selection
12.2.5.1 Implicit application selection
12.2.5.2 Application selection using AID as DF name
12.2.5.3 Application selection using EF.DIR or EF.ATR/INFO
12.3 Selection by path
12.4 Data retrieval
12.5 Card-originated byte strings
12.5.1 Triggering by the card
12.5.2 Queries and replies
12.5.3 Formats
12.6 General feature management
12.6.1 On-card services
12.6.2 Interface services
12.6.3 Profile services
12.6.4 Provision of additional information
12.7 APDU management
12.7.1 Extended length information
12.7.2 List of supported INS codes
Amendments
- ISO/IEC 7816-4:2013/Amd 1:2018. Published 24/07/2018
- ISO/IEC 7816-4:2013/Amd 2:2018. Published 23/08/2018
- ISO/IEC 7816-4:2013/AMD1:2018. Published 24/07/2018
- ISO/IEC 7816-4:2013/AMD2:2018. Published 23/08/2018
- ISO/IEC 7816-4:2013/Cor 1:2014. Published 14/08/2014
- ISO/IEC 7816-4:2013/COR1:2014. Published 14/08/2014