ISO 7816 Complete Guide: Smart Card Standard Protocol Explained

1. What Is ISO 7816?

ISO 7816 is the international standard for integrated circuit cards (ICC) with contacts — commonly known as smart cards. Published by ISO/IEC JTC 1/SC 17, it defines everything from the physical dimensions of the plastic card to the application-layer security protocols. If you're developing for EMV payment cards, SIM/eSIM cards, electronic passports, or national ID cards, you're working on top of ISO 7816.

The standard spans 15 parts (ISO 7816-1 through 7816-15) covering the complete stack:

2. ISO 7816-1 & 2: Physical Characteristics & Contact Pins

Card Dimensions (7816-1)

Smart cards use the ID-1 format (ISO/IEC 7810): 85.60 mm x 53.98 mm x 0.76 mm — identical to a standard credit card. Mechanical requirements include bending resistance (20mm deflection), torsion (±15 degree, 1000 cycles), and operating temperature range of -35C to +50C.

Contact Pin Layout (7816-2)

The card surface has 8 electrical contacts positioned in the upper-left corner:

3. ISO 7816-3: Electrical Interface & Transmission Protocols

ISO 7816-3 defines how the terminal and card communicate electrically. It specifies three voltage classes, the ATR (Answer-To-Reset) sequence, and two asynchronous half-duplex protocols: T=0 and T=1.

ATR — Answer-To-Reset

When a card is powered up and receives a reset signal, it responds with an ATR byte sequence. The ATR conveys the card's communication parameters: supported protocols, clock rate conversion, bit rate adjustment, programming voltage, and historical bytes (manufacturing info).

# Example ATR (direct convention)
TS  = 3B        # Direct convention (L/H = logical 1)
T0  = 9F        # TA1+TB1+TC1+TD1 present, 15 historical bytes
TA1 = 96        # FI=9 (F=512), DI=6 (D=32) → baud rate divisor
TB1 = 80        # No VPP required
TC1 = 1F        # Extra guard time = 31 etu
TD1 = C7        # TD2 present, T=0 protocol (T=7 notation), TA2+TB2+TC2 pres.
# ... historical bytes follow ...
# TCK = XX     # Checksum byte (XOR of all bytes from T0 onwards)

T=0 Protocol

T=0 is a byte-oriented asynchronous half-duplex protocol. "0" refers to the fact that error handling is at the character level (parity bit per byte). Each byte on the I/O line consists of 1 start bit + 8 data bits + 1 parity bit. T=0 uses a procedure byte mechanism for flow control — the card sends back an ACK byte (INS) to acknowledge, a NULL byte (0x60) to signal busy, or SW1 to indicate completion. T=0 is the default protocol when no TD byte specifies otherwise.

T=1 Protocol

T=1 is a block-oriented asynchronous half-duplex protocol. "1" indicates block-level error detection using CRC16. Data is transmitted in blocks with prologue (NAD, PCB, LEN), information field, and epilogue (CRC) fields. T=1 supports chaining for large data transfers, node addressing (NAD) for multi-device busses, and WTX (Waiting Time Extension) for long operations.

4. ISO 7816-4: Organization, Security & APDU Commands

ISO 7816-4 is the most important part for application developers. It defines three interconnected subsystems:

File System Model

The smart card file system is a hierarchical tree with three node types:

• MF (Master File): The root directory. Exactly one per card. Selected implicitly after ATR.
• DF (Dedicated File): A directory/folder. Can contain EFs and child DFs. An ADF (Application DF) holds all data for one application (e.g., an EMV payment app).
• EF (Elementary File): The leaf node holding actual data. Two subtypes: Transparent EF (binary blob, random-access by offset) and Record EF (fixed or variable-length records).

APDU Protocol

All communication uses APDUs (Application Protocol Data Units) in command-response pairs:

# Command APDU (C-APDU)
CLA INS P1 P2 [Lc] [Data] [Le]

# Response APDU (R-APDU)
[Response Data] SW1 SW2

# Example: SELECT an EMV application by AID
# C-APDU: 00 A4 04 00 07 A0 00 00 00 03 10 10 00
# R-APDU: 6F 1A 84 07 A0 00 00 00 03 10 10 A5 0F ... 90 00

For complete APDU command reference including all INS codes and SW1/SW2 status words, see our APDU Commands Reference.

5. Parts 5-9: Application Layer

ISO 7816-5: AID Registration

An AID (Application Identifier) uniquely identifies each application on a card. It consists of a 5-byte RID (Registered Application Provider Identifier, assigned by ISO) and up to 11 bytes of PIX (Proprietary Identifier Extension). For example, Visa's RID is A0 00 00 00 03. Terminals use the SELECT command with an AID to activate a specific payment application from a multi-application card.

ISO 7816-6: Interindustry Data Elements

Defines BER-TLV encoded data objects for cross-industry use. Each data element is identified by a tag (e.g., 5F20 = Cardholder Name, 5F24 = Application Expiration Date). This is the encoding foundation that EMV builds upon for its tag dictionary.

ISO 7816-8: Security Operations

Commands for PKI operations directly on the card: PERFORM SECURITY OPERATION (digital signature, hash), GENERATE ASYMMETRIC KEY PAIR (RSA/ECC on-card key generation), and signature verification. Used by electronic ID cards, digital signature cards, and PKCS#11 tokens.

6. Parts 10-15: Extended Capabilities

ISO 7816-12: USB Interface

Repurposes the reserved C4/C8 contacts for USB 2.0 Full Speed (12 Mbps). The card negotiates between ISO 7816 serial mode and USB mode during ATR exchange. USB-capable smart cards can transfer large data (certificates, biometrics) at speeds orders of magnitude faster than T=0/T=1.

ISO 7816-13: Multi-Application Management

Defines logical channels (up to 4 simultaneous sessions with different applications) and application firewalls. A single card can run a payment app, a transit app, and an access control app simultaneously with strict isolation.

ISO 7816-15: Cryptographic Information Application

Uses PKCS#15 structures (defined in ASN.1) to store X.509 certificates, RSA/ECC keys, symmetric keys, PIN objects, and biometric templates on the card. The bridge between the smart card world and the PKI/X.509 world.

7. ATR Deep Dive

ATR Structure:
[TS] [T0] [TA1] [TB1] [TC1] [TD1] ... [Historical Bytes: 0-15 bytes] [TCK]

TS  = Initial character (3B = direct, 3F = inverse convention)
T0  = Y1 (bit7-4: TA1~TD1 presence) | K  (bit3-0: historical byte count)
TA1 = Fi/Di parameters (clock rate conversion, bit rate adjustment)
TB1 = Programming voltage requirements (bit7=VPP required, bit5-1=Iprog)
TC1 = Extra guard time (N etu)
TD1 = Y2 (next TD presence) | T (protocol type: 0/1/14)
...
TCK = XOR checksum (present when T=0 is NOT the only protocol)

Use our ATR Decoder to interactively parse any ATR byte sequence.

10. ISO 7816 in the Smart Card Ecosystem