ISO/IEC 7816-4:2020

Overview - ISO/IEC 7816-4:2020 (Identification cards, Part 4)

ISO/IEC 7816-4:2020 standardizes the interface-level behaviour of integrated circuit cards (smart cards). It is sector-agnostic and specifies the contents of command-response pairs, data object formats, file and application structures as seen at the card interface, access methods to files and algorithms, and a security architecture including access rights and secure messaging. The document is independent of the physical interface and applies to cards accessed via contacts, close coupling, or radio frequency. It explicitly does not define cryptographic algorithms or internal card implementations.

Key topics and technical requirements

• Command-response pairs: syntax, conditions of operation, payload fragmentation, chaining, class and instruction byte semantics, and status bytes.
• Data objects and TLV encoding: SIMPLE-TLV and BER-TLV structures; primitive vs. constructed data objects; tag allocation and interpretation.
• Application and file structures: available structures, validity areas, file control and data control information, file descriptors, life-cycle status and instance identification.
• Referencing and retrieval: methods to reference data elements and objects (tag lists, element lists, headers, wrappers) and resolution of extended headers.
• Security architecture: security attributes, access rules, cryptographic mechanism identifiers, security parameters templates and attributes for logical channels and data objects.
• Secure messaging (SM): mechanisms and DOs for confidentiality and authentication, protection of chained commands/responses, control reference templates and security environments.
• Logical channels and interface independence: coding of class byte, logical channel management, and rules when multiple physical interfaces are supported (note: inter-interface relationships are out of scope).

Practical applications and users

Who uses ISO/IEC 7816-4:

• Card manufacturers and IC designers implementing command parsing, file systems, and security attributes.
• Firmware and middleware developers building host-side drivers, card managers, and secure-channel implementations.
• Payment, telecom (SIM/eUICC), eID and access-control schemes that require standardized file access and secure messaging.
• Security architects and certification laboratories validating access rules, secure messaging, and TLV payload handling.
• System integrators and application providers ensuring interoperable application selection, addressing, and data retrieval from cards.

Benefits:

• Ensures interoperable command protocols and data formats across smart card ecosystems.
• Provides a standardized security model for access control and secure messaging without mandating specific cryptographic algorithms.

Related standards

• Part of the ISO/IEC 7816 series (physical characteristics, transmission protocols and other parts address complementary concerns).
• Applicable alongside national/regulatory specifications for payment, identity, and telecom applications.