ISO 7816

ISO 7816 -- The Foundation of Contact Smart Cards

ISO/IEC 7816 is a multi-part international standard that defines the physical, electrical, and logical specifications for contact smart cards. Published by ISO/IEC JTC 1/SC 17, the standard covers everything from the position of the contact pad on the card surface to the structure of APDU commands exchanged between card and reader. Virtually every contact-based smart card in circulation -- payment cards, SIM cards, government IDs, and JavaCard applets -- relies on ISO 7816ISO 7816StandardPrimary standard for contact smart cards.Click to view → as its foundational specification.

Key Parts of the Standard

ISO 7816 is organized into over 15 parts. Part 1 defines the physical characteristics of the card bodycard bodyHardwarePlastic substrate forming the card physical structure.Click to view →, including flexural strength and UV resistance. Part 2 specifies the dimensions and assignment of the eight contact pads (C1 through C8) used for power, clock, reset, I/O, and ground. Part 3 defines the electrical interface, ATR sequence, and the T=0 and T=1 transmission protocols. Part 4 is the most widely referenced, establishing the APDUAPDUProtocolCommunication unit between card and reader.Click to view → command/response structure, file system organization (MF, DF, EF), and secure messaging mechanisms.

File System and Security Architecture

ISO 7816-4 defines a hierarchical file system with a Master File (MF) at the root, Dedicated Files (DF) for applications, and Elementary Files (EF) for data storage. Access conditions on each file are enforced by the card operating system, typically requiring PIN verification or cryptographic authentication before granting read or write access. This file-based architecture remains central to ePassport and eID implementations, where biometric templates and certificate chains are stored as EFs under specific DFs.

Modern Relevance

While contactless interfaces defined by ISO 14443 have grown in prominence, ISO 7816 remains indispensable. Dual-interface modules implement both standards on a single chip, and the APDU layer from 7816-4 is reused even in contactless transactions. The GlobalPlatform card management framework and SCP03 secure channels are built on top of the 7816 APDU structure, ensuring backward compatibility across generations of smart card technology.