ISO/IEC 7816

ISO/IEC 7816 is an international standard related to electronic identification cards with contacts, especially smart cards, and more recently, contactless mobile devices, managed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

It is developed by ISO/IEC JTC 1 (Joint Technical Committee 1) / SC 17 (Subcommittee 17).^[1]

The following describes the different parts of this standard.

Note: abstracts and dates, when present, are mere quotations from the ISO website,^[2] and are neither guaranteed at the time of edition nor in the future.

Parts

ISO/IEC 7816-1:2011 Part 1: Cards with contacts—Physical characteristics
ISO/IEC 7816-2:2007 Part 2: Cards with contacts—Dimensions and location of the contacts
ISO/IEC 7816-3:2006 Part 3: Cards with contacts—Electrical interface and transmission protocols
ISO/IEC 7816-4:2013 Part 4: Organization, security and commands for interchange
ISO/IEC 7816-5:2004 Part 5: Registration of application providers
ISO/IEC 7816-6:2016 Part 6: Interindustry data elements for interchange
ISO/IEC 7816-7:1999 Part 7: Interindustry commands for Structured Card Query Language (SCQL)
ISO/IEC 7816-8:2016 Part 8: Commands and mechanisms for security operations
ISO/IEC 7816-9:2017 Part 9: Commands for card management
ISO/IEC 7816-10:1999 Part 10: Electronic signals and answer to reset for synchronous cards
ISO/IEC 7816-11:2017 Part 11: Personal verification through biometric methods
ISO/IEC 7816-12:2005 Part 12: Cards with contacts—USB electrical interface and operating procedures
ISO/IEC 7816-13:2007 Part 13: Commands for application management in a multi-application environment
ISO/IEC 7816-15:2016 Part 15: Cryptographic information application

7816-1: Cards with contacts — Physical characteristics

Created in 1987, updated in 1998, amended in 2003, updated in 2011.^[3]

This part describes the physical characteristics of the card, primarily by reference to ISO/IEC 7810 Identification cards — Physical characteristics, but also with other characteristics such as mechanical strength.

7816-2: Cards with contacts — Dimensions and location of the contacts

Four example SIM card sizes that use the ISO/IEC 7816 interface

Created in 1988, updated in 1999, amended in 2004, updated in 2007. The standard defines an eight (or six) pin interface; the first pin is located at the bottom-right corner for the image given. Pins 4 and 8 are occasionally omitted.^[4]

ISO/IEC 7816-2 pinout
Pin #	Name	Description
1	VCC	+5 V or 3.3 V DC
2	Reset	Card Reset (Optional)
3	CLOCK	Card Clock
4	AS	Application Specific
5	GND	Ground
6	VPP	+21 V DC [Programming], or NC
7	I/O	In/out [Data]
8	AS	Application Specific

7816-3: Cards with contacts — Electrical interface and transmission protocols

Created in 1989, amended in 1992 (addition of the T=1 protocol), amended in 1994 (revision of Protocol Type Selection), updated in 1997 (including addition of 3 volt operation), amended in 2002 (including addition of 1.8 nolt operation), last updated in 2006 (including removal of Vpp).^[5]

7816-4: Organization, security and commands for interchange

Created in 1995, updated in 2005, 2013 and 2020.^[6] Amended in 2023.^[7]

According to its abstract, it specifies:

contents of command-response pairs exchanged at the interface,
means of retrieval of data elements and data objects in the card,
structures and contents of historical bytes to describe operating characteristics of the card,
structures for applications and data in the card, as seen at the interface when processing commands,
access methods to files and data in the card,
a security architecture defining access rights to files and data in the card,
means and mechanisms for identifying and addressing applications in the card,
methods for secure messaging,
access methods to the algorithms processed by the card. It does not describe these algorithms.

It does not cover the internal implementation within the card or the outside world.

ISO/IEC 7816-4:2020 is independent of the physical interface technology, and applies equally to contact cards, proximity cards and vicinity cards.

7816-5: Registration of application providers

Created in 1995, updated in 2004.^[8] This part is maintained by Danish Standards.^[9]

According to its abstract, ISO/IEC 7816-5 defines how to use an application identifier to ascertain the presence of and/or perform the retrieval of an application in a card.

ISO/IEC 7816-5:2004 shows how to grant the uniqueness of application identifiers through the international registration of a part of this identifier, and defines

the registration procedure,
the authorities in charge thereof,
the availability of the register which links the registered parts of the identifiers and the relevant application providers.

7816-6: Interindustry data elements for interchange

Created in 1996, updated in 2004, amended in 2006, updated in 2016 and 2023.^[10] This part is maintained by Deutsches Institut für Normung (DIN).^[9]

According to its abstract, it specifies the Data Elements (DEs) used for interindustry interchange based on integrated circuit cards (ICCs) both with contacts and without contacts. It gives the identifier, name, description, format, coding and layout of each DE and defines the means of retrieval of DEs from the card.

7816-7: Interindustry commands for Structured Card Query Language (SCQL)

Created in 1999.^[11]

7816-8: Commands and mechanisms for security operations

Created in 1995, updated in 2004, 2016, 2019, and 2021.^[12]

According to its abstract, it specifies interindustry commands for integrated circuit cards (either with contacts or without contacts) that may be used for cryptographic operations. These commands are complementary to and based on the commands listed in ISO/IEC 7816-4.

Annexes are provided that give examples of operations related to digital signatures, certificates and the import and export of asymmetric keys.

The choice and conditions of use of cryptographic mechanisms may affect card exportability. The evaluation of the suitability of algorithms and protocols is outside the scope of ISO/IEC 7816-8.

7816-9: Commands for card management

Created in 1995, updated in 2004, updated in 2017.^[13]

According to its abstract, it specifies interindustry commands for integrated circuit cards (both with contacts and without contacts) for card and file management, e.g. file creation and deletion. These commands cover the entire life cycle of the card and therefore some commands may be used before the card has been issued to the cardholder or after the card has expired.

An annex is provided that shows how to control the loading of data (secure download) into the card, by means of verifying the access rights of the loading entity and protection of the transmitted data with secure messaging. The loaded data may contain, for example, code, keys and applets.

7816-10: Electronic signals and answer to reset for synchronous cards

Created in 1999.^[14]

This part specifies the power, signal structures, and the structure for the answer to reset between an integrated circuit card(s) with synchronous transmission and an interface device such as a terminal.

7816-11 Personal verification through biometric methods

Created in 2004, updated in 2017.^[15]

This part of ISO/IEC 7816 specifies security-related interindustry commands to be used for personal verification through biometric methods in integrated circuit cards. It also defines the data structure and data access methods for use of the card as a carrier of the biometric reference and/or as the device to perform the verification of the cardholder’s biometric probe (on-card biometric comparison). Identification of persons using biometric methods is outside the scope of this standard.

7816-12 Cards with contacts — USB electrical interface and operating procedures

Created in 2005.^[16]

According to its abstract, it specifies the operating conditions of an integrated circuit card that provides a USB interface. An integrated circuit card with a USB interface is named USB-ICC.

ISO/IEC 7816-12:2005 specifies:

the electrical conditions when a USB-ICC is operated by an interface device – for those contact fields that are not used, when the USB interface is applied;
the USB standard descriptors and the USB-ICC class specific descriptor;
the data transfer between host and USB-ICC using bulk transfers or control transfers;
the control transfers which allow two different protocols named version A and version B;
the (optional) interrupt transfers to indicate asynchronous events;
status and error conditions.

ISO/IEC 7816-12:2005 provides two protocols for control transfers. This is to support the protocol T=0 (version A) or to use the transfer on APDU level (version B). ISO/IEC 7816-12:2005 provides the state diagrams for the USB-ICC for each of the transfers (bulk transfers, control transfers version A and version B). Examples of possible sequences which the USB-ICC must be able to handle are given in an informative annex.

The USB CCID device class defines a standard for communicating with ISO/IEC 7816 smart cards over USB.

7816-13: Commands for application management in multi-application environment

This part specifies commands for application management in a multi-application environment.^[17]

7816-15: Cryptographic information application

Created in 2004, amended in 2004, 2007, 2008, updated in 2016.^[18]

According to its abstract, it specifies a card application. This application contains information on cryptographic functionality. Further, ISO/IEC 7816-15:2016 defines a common syntax (in ASN.1) and format for the cryptographic information and mechanisms to share this information whenever appropriate.

ISO/IEC 7816-15:2016 supports the following capabilities:

storage of multiple instances of cryptographic information in a card;
use of the cryptographic information;
retrieval of the cryptographic information;
cross-referencing of the cryptographic information with DOs defined in ISO/IEC 7816 when appropriate;
different authentication mechanisms; and
multiple cryptographic algorithms.

References

^ "ISO/IEC JTC 1/SC 17 Cards and security devices for personal identification". Iso.org. Retrieved 2017-10-11.
^ "Browse by ICS". www.iso.org. Retrieved 19 April 2018.
^ "ISO/IEC 7816-1:2011 Identification cards — Integrated circuit cards — Part 1: Cards with contacts — Physical characteristics". Iso.org. 2011-01-31. Retrieved 2017-10-11.
^ "ISO/IEC 7816-2:2007 Identification cards — Integrated circuit cards — Part 2: Cards with contacts — Dimensions and location of the contacts". Iso.org. 2007-10-11. Retrieved 2017-10-11.
^ "ISO/IEC 7816-3:2006 Identification cards — Integrated circuit cards — Part 3: Cards with contacts — Electrical interface and transmission protocols". Iso.org. 2006-10-30. Retrieved 2017-10-11.
^ "ISO/IEC 7816-4:2020 Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange". Iso.org. May 2020. Retrieved 2020-08-05.
^ "ISO/IEC 7816-4:2020/Amd 1:2023 Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange — Amendment 1: Support of multiple logical security devices". Iso.org. 2023-10-01. Retrieved 2023-05-08.
^ "ISO/IEC 7816-5:2004 Identification cards — Integrated circuit cards — Part 5: Registration of application providers". Iso.org. 2010-03-17. Retrieved 2017-10-11.
^ ^a ^b "Maintenance agencies and registration authorities". ISO. Retrieved 2023-11-21.
^ "ISO/IEC 7816-6:2016 Identification cards — Integrated circuit cards — Part 6: Interindustry data elements for interchange". Iso.org. 2016-06-14. Retrieved 2017-10-11.
^ "ISO/IEC 7816-7:1999 Identification cards — Integrated circuit(s) cards with contacts — Part 7: Interindustry commands for Structured Card Query Language (SCQL)". Iso.org. 2010-06-17. Retrieved 2017-10-11.
^ "ISO/IEC 7816-8:2021 Identification cards — Integrated circuit cards — Part 8: Commands and mechanisms for security operations". Iso.org. 2021-08-01. Retrieved 2024-05-08.
^ "ISO/IEC 7816-9:2017 Identification cards — Integrated circuit cards — Part 9: Commands for card management". Iso.org. 2017-12-07. Retrieved 2018-01-04.
^ "ISO/IEC 7816-10:1999 Identification cards — Integrated circuit(s) cards with contacts — Part 10: Electronic signals and answer to reset for synchronous cards". Iso.org. 2010-06-17. Retrieved 2017-10-11.
^ "ISO/IEC 7816-11:2007 Identification cards — Integrated circuit cards — Part 11: Personal verification through biometric methods". Iso.org. 2017-12-01. Retrieved 2018-01-04.
^ "ISO/IEC 7816-12:2005 Identification cards — Integrated circuit cards — Part 12: Cards with contacts — USB electrical interface and operating procedures". Iso.org. 2011-03-17. Retrieved 2017-10-11.
^ "ISO/IEC 7816-13:2007 Identification cards — Integrated circuit cards — Part 13: Commands for application management in a multi-application environment". Iso.org. 2007-03-09. Retrieved 2017-10-11.
^ "ISO/IEC 7816-15:2016 Identification cards — Integrated circuit cards — Part 15: Cryptographic information application". Iso.org. 2016-05-09. Retrieved 2017-10-11.

External links

Overview of ISO/IEC 7816 parts 1–4 Archived 2006-10-18 at the Wayback Machine
ISO/IEC JTC1/SC17 Working Groups Archived 2007-06-07 at the Wayback Machine
DS8007 and Smart Card Interface Fundamentals
Tutorial – Introduction to Smart Cards – David B Everett (1992) Archived 2021-01-21 at the Wayback Machine
read and write ISO 7816 smart cards using a PIC – Simple Operating System for Smartcard Education
Spelunking Credit Cards with Ruby // Speaker Deck – Sau Sheong Chang
Interface for ISO 7816 Smart Cards

[1] "ISO/IEC JTC 1/SC 17 Cards and security devices for personal identification". Iso.org. Retrieved 2017-10-11.

[2] "Browse by ICS". www.iso.org. Retrieved 19 April 2018.

[3] "ISO/IEC 7816-1:2011 Identification cards — Integrated circuit cards — Part 1: Cards with contacts — Physical characteristics". Iso.org. 2011-01-31. Retrieved 2017-10-11.

[4] "ISO/IEC 7816-2:2007 Identification cards — Integrated circuit cards — Part 2: Cards with contacts — Dimensions and location of the contacts". Iso.org. 2007-10-11. Retrieved 2017-10-11.

[5] "ISO/IEC 7816-3:2006 Identification cards — Integrated circuit cards — Part 3: Cards with contacts — Electrical interface and transmission protocols". Iso.org. 2006-10-30. Retrieved 2017-10-11.

[6] "ISO/IEC 7816-4:2020 Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange". Iso.org. May 2020. Retrieved 2020-08-05.

[7] "ISO/IEC 7816-4:2020/Amd 1:2023 Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange — Amendment 1: Support of multiple logical security devices". Iso.org. 2023-10-01. Retrieved 2023-05-08.

[8] "ISO/IEC 7816-5:2004 Identification cards — Integrated circuit cards — Part 5: Registration of application providers". Iso.org. 2010-03-17. Retrieved 2017-10-11.

[isoma-9] "Maintenance agencies and registration authorities". ISO. Retrieved 2023-11-21.

[10] "ISO/IEC 7816-6:2016 Identification cards — Integrated circuit cards — Part 6: Interindustry data elements for interchange". Iso.org. 2016-06-14. Retrieved 2017-10-11.

[11] "ISO/IEC 7816-7:1999 Identification cards — Integrated circuit(s) cards with contacts — Part 7: Interindustry commands for Structured Card Query Language (SCQL)". Iso.org. 2010-06-17. Retrieved 2017-10-11.

[12] "ISO/IEC 7816-8:2021 Identification cards — Integrated circuit cards — Part 8: Commands and mechanisms for security operations". Iso.org. 2021-08-01. Retrieved 2024-05-08.

[13] "ISO/IEC 7816-9:2017 Identification cards — Integrated circuit cards — Part 9: Commands for card management". Iso.org. 2017-12-07. Retrieved 2018-01-04.

[14] "ISO/IEC 7816-10:1999 Identification cards — Integrated circuit(s) cards with contacts — Part 10: Electronic signals and answer to reset for synchronous cards". Iso.org. 2010-06-17. Retrieved 2017-10-11.

[15] "ISO/IEC 7816-11:2007 Identification cards — Integrated circuit cards — Part 11: Personal verification through biometric methods". Iso.org. 2017-12-01. Retrieved 2018-01-04.

[16] "ISO/IEC 7816-12:2005 Identification cards — Integrated circuit cards — Part 12: Cards with contacts — USB electrical interface and operating procedures". Iso.org. 2011-03-17. Retrieved 2017-10-11.

[17] "ISO/IEC 7816-13:2007 Identification cards — Integrated circuit cards — Part 13: Commands for application management in a multi-application environment". Iso.org. 2007-03-09. Retrieved 2017-10-11.

[18] "ISO/IEC 7816-15:2016 Identification cards — Integrated circuit cards — Part 15: Cryptographic information application". Iso.org. 2016-05-09. Retrieved 2017-10-11.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

v t e ISO standards by standard number
List of ISO standards – ISO romanizations – IEC standards
1–9999	1 2 3 4 6 7 9 16 17 31 -0 -1 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 68-1 128 216 217 226 228 233 259 261 262 302 306 361 500 518 519 639 -1 -2 -3 -5 -6 646 657 668 690 704 732 764 838 843 860 898 965 999 1000 1004 1007 1073-1 1073-2 1155 1413 1538 1629 1745 1989 2014 2015 2022 2033 2047 2108 2145 2146 2240 2281 2533 2709 2711 2720 2788 2848 2852 2921 3029 3103 3166 -1 -2 -3 3297 3307 3601 3602 3864 3901 3950 3977 4031 4157 4165 4217 4909 5218 5426 5427 5428 5725 5775 5776 5800 5807 5964 6166 6344 6346 6373 6385 6425 6429 6438 6523 6709 6943 7001 7002 7010 7027 7064 7098 7185 7200 7498 -1 7637 7736 7810 7811 7812 7813 7816 7942 8000 8093 8178 8217 8373 8501-1 8571 8583 8601 8613 8632 8651 8652 8691 8805/8806 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9036 9075 9126 9141 9227 9241 9293 9314 9362 9407 9496 9506 9529 9564 9592/9593 9594 9660 9797-1 9897 9899 9945 9984 9985 9995
10000–19999	10006 10007 10116 10118-3 10160 10161 10165 10179 10206 10218 10279 10303 -11 -21 -22 -28 -238 10383 10585 10589 10628 10646 10664 10746 10861 10957 10962 10967 11073 11170 11172 11179 11404 11544 11783 11784 11785 11801 11889 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12052 12182 12207 12234-2 12620 13211 -1 -2 13216 13250 13399 13406-2 13450 13485 13490 13567 13568 13584 13616 13816 13818 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14617 14644 14649 14651 14698 14764 14882 14971 15022 15189 15288 15291 15398 15408 15444 -3 -9 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 15938 16023 16262 16355-1 16485 16612-2 16750 16949 (TS) 17024 17025 17100 17203 17369 17442 17506 17799 18004 18014 18181 18245 18629 18916 19005 19011 19092 -1 -2 19114 19115 19125 19136 19407 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600 19752 19757 19770 19775-1 19794-5 19831
20000–29999	20000 20022 20121 20400 20802 20830 21000 21001 21047 21122 21500 21827 22000 22275 22300 22301 22395 22537 23000 23003 23008 23009 23090-3 23092 23094-1 23094-2 23270 23271 23360 23941 24517 24613 24617 24707 24728 25178 25964 26000 26262 26300 26324 27000 series 27000 27001 27002 27005 27006 27729 28000 29110 29148 29199-2 29500
30000+	30170 31000 32000 37001 38500 39075 40500 42010 45001 50001 55000 56000 80000
Category

v t e IEC standards
IEC	60027 60034 60038 60062 60063 60068 60112 60228 60269 60297 60309 60320 60364 60446 60559 60601 60870 60870-5 60870-6 60906-1 60908 60929 60958 60980-344 61030 61131 61131-3 61131-9 61158 61162 61334 61355 61360 61400 61499 61508 61511 61784 61850 61851 61883 61960 61968 61970 62014-4 62026 62056 62061 62196 62262 62264 62304 62325 62351 62365 62366 62379 62386 62455 62680 62682 62700 63110 63119 63382
ISO/IEC	646 1989 2022 4909 5218 6429 6523 7810 7811 7812 7813 7816 7942 8613 8632 8652 8859 9126 9293 9496 9529 9592 9593 9899 9945 9995 10021 10116 10165 10179 10279 10646 10967 11172 11179 11404 11544 11801 12207 13250 13346 13522-5 13568 13816 13818 14443 14496 14651 14882 15288 15291 15408 15444 15445 15504 15511 15693 15897 15938 16262 16485 17024 17025 18004 18014 18181 19752 19757 19770 19788 20000 20802 21000 21827 22275 22537 23000 23003 23008 23270 23360 24707 24727 24744 24752 26300 27000 27000-series 27002 27040 29110 29119 33001 38500 39075 42010 80000 81346
Related	International Electrotechnical Commission