ISO/IEC 24727-2:2008

Overview

ISO/IEC 24727-2:2008 specifies the Generic Card Interface (GCI) for integrated circuit cards (smart cards). As Part 2 of the ISO/IEC 24727 family, it defines a command-level programming interface presented as command–response pairs and mechanisms for card and application capability description and determination. The standard is a concretization of core APDU and data-object concepts from ISO/IEC 7816‑4, ‑8, ‑9 and ‑15 and is intended to maximize interoperable, independent implementations for contact and contactless cards.

Key Topics and Requirements

• Command–response model (APDU-equivalent): Requests and confirmations at the GCI are logically equivalent to ISO/IEC 7816 APDUs. The document even defines a simple programmatic interface example (ExecuteCommand(sequence-of-bytes command) → sequence-of-bytes response).
• Interoperability organization: A standardized subset of ISO/IEC 7816 commands and data structures is prescribed to ensure portability between implementations while minimizing optional behavior.
• Class and instruction byte rules: CLA usage on the GCI is constrained (e.g., CLA = 'FF' for requests acted on by ISO/IEC 24727‑2 implementations). Command chaining is supported only for data strings too long for a single command, with constant INS, P1 and P2 across the chain.
• Supported command set: Many common ISO/IEC 7816 instructions are handled via the translation script or by the Part 2 implementation (e.g., SELECT, READ BINARY, UPDATE BINARY, GET/PUT DATA, VERIFY, AUTHENTICATE, CRYPTOGRAPHIC OPERATIONS).
• Capability descriptions: Definitions and procedures for Card Capability Description (CCD) and Application Capability Description (ACD), including how procedural elements and determination rules are used to evaluate card/application capabilities.
• Translation code concept: Procedural software (translation code) can map GCI commands to the physical card’s native commands or structures.
• Limitations at GCI: Short file identifiers, logical channels, and record-structured files cannot be exposed via the generic card interface (physical cards may still use them internally).

Applications and Users

ISO/IEC 24727-2 is practical for:

• Smart card middleware developers implementing interoperable card interfaces.
• Card manufacturers and integrators mapping physical card features to a generic API.
• Government eID, payment, and digital-signature systems that require vendor-independent smart card access.
• Application developers and system architects building multi-vendor solutions that rely on standardized APDU-level interactions and capability discovery. Benefits include improved interoperability, predictable command semantics, and a standardized way to describe card and application capabilities (CCD/ACD).

Related Standards

• ISO/IEC 24727‑1 (Architecture), 24727‑3 (Application interface), 24727‑4 (API administration)
• ISO/IEC 7816‑4, 7816‑8, 7816‑9, 7816‑15 (base smart-card command and data object standards)
• ISO/IEC 20060 (Open Terminal Architecture reference)