Overview
ISO/IEC 24727-3:2008 - "Identification cards - Integrated circuit card programming interfaces - Part 3: Application interface" specifies a high-level, programming-language‑independent application interface for client applications interacting with integrated circuit cards (ICCs). It defines services as action requests and responses at the client-application service interface, supporting information storage and processing operations on card-applications as seen through the generic card interface. The standard promotes interoperability across multiple application domains and aligns card organization and operation with ISO/IEC 7816‑4. It is positioned in the OSI model as the application interface (ISO/IEC 7498‑1) but does not mandate a specific implementation methodology.
Key topics and requirements
- Service-based model: Definitions of services (requests/responses) for the client‑application interface described in a language‑independent way.
- Organization for interoperability: Computation model, entity relationships, and a security model to enable multi‑sector ICC use.
- Card‑application lifecycle: Services for card‑application access, creation, deletion, description and listing.
- Connection and session services: Connect, disconnect, start/end session operations for robust client‑card interaction.
- Named data service: Dataset and DSI (Data Set Instance) management - create, select, read, write, delete.
- Cryptographic services: Encipher/decipher, random number generation, hashing, signing, signature verification and certificate validation.
- Differential‑identity service: Identity object management (create, get, update, delete, authenticate).
- Authorization service: Access control list (ACL) management and authorization checks.
- Security and authentication protocols: Normative Annex A contains multiple authentication protocols; Annex B covers cryptographic algorithm requirements; Annex C defines an ASN.1 representation for service messages.
Practical applications
- Enables interoperable smart card deployments in government eID, national identity, e‑passport, transport ticketing, access control, and multi‑application payment schemes.
- Standardizes how back‑end and client applications access and manage card‑resident applications, keys, credentials and protected data.
- Supports secure operations such as mutual authentication, digital signatures, key management, and protected data storage across different vendors and ecosystems.
- Facilitates integration between card operating systems, middleware providers, and application developers by providing a common application interface specification.
Who should use this standard
- Smart card OS vendors and card-application developers
- Middleware and API implementers for ICCs
- System integrators and solution architects for eID, payment, transport and access-control systems
- Security architects designing authentication, signing and key-management workflows
Related standards
- ISO/IEC 24727 (Parts 1–6) - overall architecture, generic card interface, API administration, testing, and registration procedures
- ISO/IEC 7816‑4 - ICC organization and commands
- ISO/IEC 7498‑1 - OSI Reference Model (application layer context)
Keywords: ISO/IEC 24727-3, integrated circuit card, ICC, application interface, smart card interoperability, cryptographic service, authentication protocols, ASN.1, ISO/IEC 7816-4.