ISO/IEC 7816

ISO/IEC 7816
Title	ISO/IEC 7816
Status	Published
Version	Multiple parts
Domain	Smart cards
First published	1987

ISO/IEC 7816 is an international series of standards for integrated circuit cards and related devices. The standards define physical characteristics, electrical interfaces, communication protocols, application identifiers, file structures, security mechanisms, and test methods used across industries such as banking, telecommunications, healthcare, identification, and transport. Major stakeholders include standards organizations, manufacturing consortia, financial institutions, and governmental agencies.

Overview

The ISO/IEC 7816 series was developed by international bodies including International Organization for Standardization, International Electrotechnical Commission, and technical committees that collaborate with industry groups such as EMVCo, GlobalPlatform, European Committee for Standardization, and national bodies like British Standards Institution, Association Française de Normalisation, and Deutsches Institut für Normung. Influential implementers and adopters have included Mastercard, Visa, American Express, Deutsche Telekom, and public authorities such as United States Department of Homeland Security, European Commission, and Ministry of Internal Affairs and Communications (Japan). The series has evolved alongside technologies championed by companies like NXP Semiconductors, Infineon Technologies, STMicroelectronics, and standards for contactless interaction influenced by NFC Forum, Bluetooth Special Interest Group, and 3rd Generation Partnership Project.

Parts and Technical Scope

The multipart structure addresses diverse topics comparable to frameworks used by RFC 2119 in the Internet Engineering Task Force, with parts covering identification, commands, interfaces, and testing. Relevant parts correspond to specifications referenced by ecosystems such as EMV 4.3, ICAO Machine Readable Travel Documents, FIDO Alliance, and ISO/IEC 14443 contactless standards. Standards bodies coordinating updates include Joint Technical Committee 1, Technical Committee 68 (ISO/TC 68), and regional committees like CEN. Industry consortia such as PCI Security Standards Council and GSMA often map their profiles to parts of the series for payment and mobile scenarios. Academic institutions including Massachusetts Institute of Technology, ETH Zurich, and Tsinghua University have published research that references these parts in security and hardware studies.

Physical and Electrical Characteristics

Physical form factors and dimensions interoperating with devices designed by manufacturers such as Giesecke+Devrient, Idemia, Thales Group, and HID Global are specified to align with card readers deployed by operators like Deutsche Bahn, Transport for London, and Octopus Cards Limited. The specifications reference materials and processes used by suppliers such as 3M and DuPont and harmonize with slot designs from hardware vendors such as Gemalto and Zebra Technologies. Electrical interface definitions interact with testing equipment from Keysight Technologies, Tektronix, and Rohde & Schwarz; they are also considered by certification labs like Underwriters Laboratories and Bureau Veritas.

Command Set and Communication Protocols

Command sets including Application Protocol Data Units used by card applications interface with ecosystems maintained by EMVCo, GlobalPlatform, OpenSSL Project, and authentication systems developed by Microsoft, Google, and Apple. Protocol modes reference serial and asynchronous exchanges found in standards by IEEE 802.11, USB Implementers Forum, and ITU-T. Implementations in payment and ID systems integrate with backend services from SWIFT, Société Générale, Banco Santander, and identity frameworks administered by United Nations, European Union Agency for Law Enforcement Cooperation, and national registries. Research prototypes from Carnegie Mellon University, University of Cambridge, and University of California, Berkeley explore protocol variations and side-channel mitigations.

Security Features and Applications

Security controls specified across the series inform implementations used by financial institutions such as Barclays, Citigroup, and HSBC, by telecom operators like Vodafone, China Mobile, and AT&T, and by government identity programs including Aadhaar, e-Estonia, and Real ID Act deployments. Cryptographic mechanisms referenced align with recommendations from NIST, European Union Agency for Cybersecurity, and algorithms standardized by IETF working groups; they are implemented with co-processors supplied by ARM Holdings and RISC-V International-based vendors. Use cases include secure payment, electronic passports overseen by International Civil Aviation Organization, healthcare smart card initiatives linked to World Health Organization, and transit ticketing systems from Metropolitan Transportation Authority (New York) and MTA Metro-North Railroad.

Conformance Testing and Certification

Conformance frameworks are maintained by test houses such as Germanischer Lloyd, SGS, and Intertek, and by certification programs run by EMVCo, GlobalPlatform, and national accreditation bodies like UKAS and ANAB. Laboratories leverage protocols and test suites developed in cooperation with universities and suppliers like NXP Semiconductors and Infineon Technologies to validate interoperability for issuers including Banco do Brasil, Royal Bank of Scotland, and transport authorities such as Île-de-France Mobilités. Certification outcomes are tracked by industry registries and adopted by procurement bodies in organizations such as World Bank and European Investment Bank.

Category:Smart cards