ISO/IEC 7816-8:2021

Overview - ISO/IEC 7816-8:2021 (Commands and mechanisms for security operations)

ISO/IEC 7816-8:2021 is part of the ISO/IEC 7816 series for identification cards and integrated circuit cards (ICCs / smart cards). This fifth edition specifies interindustry commands that cards and readers use for security operations and gives informative guidance on constructing security mechanisms using commands defined in ISO/IEC 7816‑4. It focuses on command-level behaviour (for example, key generation and cryptographic operations) and does not evaluate cryptographic algorithms nor cover internal card or external system implementations.

Key topics and technical requirements

• Interindustry security commands: Defines commands such as Generate Asymmetric Key Pair (INS = '46' or '47') and Perform Security Operation (PSO) for common security functions.
• Manage Security Environment (MSE): Describes how to set parameters (e.g., algorithm reference, key identifiers) before invoking key generation or use.
• Supported operations in PSO: Includes digital signature, cryptographic checksum, hash, certificate verification, encipher/decipher, key agreement and related control reference templates (CRTs).
• Response and data formats: Specifies formats for returned public keys and templates (e.g., DO'7F49' public key template), including options for element- or object-based encoding.
• Secure messaging and context switching: Notes use of secure messaging and logical channels; Annex D discusses alternatives to change security context.
• Normative scope limits: Leaves algorithm suitability and exportability considerations to implementers; internal card or external system implementations are out of scope.

Practical applications and who uses this standard

ISO/IEC 7816-8 is essential for system designers, product managers and integrators working with smart card-based security such as:

• Identity documents (e.g., eIDs, passports / MRTD)
• Payment cards and EMV-adjacent systems
• Secure access and PKI card deployments
• Government and enterprise credentialing systems

Typical uses:

• Generating/storing asymmetric key pairs on-card and extracting public keys
• Producing/verifying digital signatures and checksums on the card
• Implementing certificate handling and on-card cryptographic operations while maintaining interoperability across vendors

Related standards

• ISO/IEC 7816-4 - Organization, security and commands for interchange (normative reference)
• Other parts of ISO/IEC 7816 series (physical, transport and application lifecycle parts) that together define card interfaces and data elements

By following ISO/IEC 7816-8, implementers achieve interoperable command-level security operations for integrated circuit cards and maintain consistency with the broader ISO/IEC 7816 smart card ecosystem. Keywords: ISO/IEC 7816-8, smart cards, integrated circuit cards, security operations, generate asymmetric key pair, perform security operation, manage security environment, digital signature, certificate.