ISO/IEC 7816 is an international standard related to electronic identification cards with contacts, especially smart cards, and more recently, contactless mobile devices, managed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It is developed by ISO/IEC JTC 1 (Joint Technical Committee 1) / SC 17 (Subcommittee 17). The following describes the different parts of this standard.
Note: abstracts and dates, when present, are mere quotations from the ISO website, and are neither guaranteed at the time of edition nor in the future.
Parts ISO/IEC 7816-1:2011 Part 1: Cards with contacts—Physical characteristics ISO/IEC 7816-2:2007 Part 2: Cards with contacts—Dimensions and location of the contacts ISO/IEC 7816-3:2006 Part 3: Cards with contacts—Electrical interface and transmission protocols ISO/IEC 7816-4:2013 Part 4: Organization, security and commands for interchange ISO/IEC 7816-5:2004 Part 5: Registration of application providers ISO/IEC 7816-6:2016 Part 6: Interindustry data elements for interchange ISO/IEC 7816-7:1999 Part 7: Interindustry commands for Structured Card Query Language (SCQL) ISO/IEC 7816-8:2016 Part 8: Commands and mechanisms for security operations ISO/IEC 7816-9:2017 Part 9: Commands for card management ISO/IEC 7816-10:1999 Part 10: Electronic signals and answer to reset for synchronous cards ISO/IEC 7816-11:2017 Part 11: Personal verification through biometric methods ISO/IEC 7816-12:2005 Part 12: Cards with contacts—USB electrical interface and operating procedures ISO/IEC 7816-13:2007 Part 13: Commands for application management in a multi-application environment ISO/IEC 7816-15:2016 Part 15: Cryptographic information application
7816-1: Cards with contacts — Physical characteristics Created in 1987, updated in 1998, amended in 2003, updated in 2011. This part describes the physical characteristics of the card, primarily by reference to ISO/IEC 7810 Identification cards — Physical characteristics, but also with other characteristics such as mechanical strength.
7816-2: Cards with contacts — Dimensions and location of the contacts
Created in 1988, updated in 1999, amended in 2004, updated in 2007. The standard defines an eight (or six) pin interface; the first pin is located at the bottom-right corner for the image given. Pins 4 and 8 are occasionally omitted.
7816-3: Cards with contacts — Electrical interface and transmission protocols Created in 1989, amended in 1992 (addition of the T=1 protocol), amended in 1994 (revision of Protocol Type Selection), updated in 1997 (including addition of 3 volt operation), amended in 2002 (including addition of 1.8 volt operation), last updated in 2006 (including removal of Vpp).
7816-4: Organization, security and commands for interchange This part describes the smart card APDU protocol used by many smart card and contactless devices, like EMV payment cards, and forms the basis of CCID protocol for security token devices. Many devices operate within the proprietary part of the protocol, using the standardized part for establishing the initial communication before switching to application specific exchange of data. Created in 1995, updated in 2005, 2013 and 2020. Amended in 2023. According to its abstract, it specifies:
contents of command-response pairs exchanged at the interface, means of retrieval of data elements and data objects in the card, structures and contents of historical bytes to describe operating characteristics of the card, structures for applications and data in the card, as seen at the interface when processing commands, access methods to files and data in the card, a security architecture defining access rights to files and data in the card, means and mechanisms for identifying and addressing applications in the card, methods for secure messaging, access methods to the algorithms processed by the card. It does not describe these algorithms. It does not cover the internal implementation within the card or the outside world. ISO/IEC 7816-4:2020 is independent of the physical interface technology, and applies equally to contact cards, proximity cards and vicinity cards.
7816-5: Registration of application providers Created in 1995, updated in 2004. This part is maintained by Danish Standards. According to its abstract, ISO/IEC 7816-5 defines how to use an application identifier to ascertain the presence of and/or perform the retrieval of an application in a card. ISO/IEC 7816-5:2004 shows how to grant the uniqueness of application identifiers through the international registration of a part of this identifier, and defines
the registration procedure, the authorities in charge thereof, the availability of the register which links the registered parts of the identifiers and the relevant application providers.
7816-6: Interindustry data elements for interchange Created in 1996, updated in 2004, amended in 2006, updated in 2016 and 2023. This part is maintained by Deutsches Institut für Normung (DIN). According to its abstract, it specifies the Data Elements (DEs) used for interindustry interchange based on integrated circuit cards (ICCs) both with contacts and without contacts. It gives the identifier, name, description, format, coding and layout of each DE and defines the means of retrieval of DEs from the card.
7816-7: Interindustry commands for Structured Card Query Language (SCQL) Created in 1999. According to its abstract, it specifies the concept of a Structured Card Query Language (SCQL) data base, based on the SQL standard ISO 9075 and the related interindustry enhanced commands.
7816-8: Commands and mechanisms for security operations Created in 1995, updated in 2004, 2016, 2019, and 2021. According to its abstract, it specifies interindustry commands for integrated circuit cards (either with contacts or without contacts) that may be used for cryptographic operations. These commands are complementary to and based on the commands listed in ISO/IEC 7816-4. Annexes are provided that give examples of operations related to digital signatures, certificates and the import and export of asymmetric keys. The choice and conditions of use of cryptographic mechanisms may affect card exportability. The evaluation of the suitability of algorithms and protocols is outside the scope of ISO/IEC 7816-8.
… excerpt ends here. Continue reading the full article.
