Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
ASAmbiSecureHardware-rooted security
Contact

ISO/IEC 7816 is the foundational standard family for contact smart cards. Part 4 defines the APDU — the command/response unit exchanged with the card. A command APDU begins with a four-byte header: CLA (class), INS (instruction), and P1/P2 (parameters), optionally followed by Lc, a data field, and Le (expected response length). This reference collects the common CLA/INS values and interindustry commands (SELECT, READ BINARY, GET RESPONSE, VERIFY, and the rest).

ISO 7816-4

ISO 7816 CLA Values

Common ISO/IEC 7816-4 CLA byte values. Interindustry, proprietary, GlobalPlatform, secure-messaging variants. Pair with the CLA decoder to walk bit-fields.

What this reference covers

Spec

ISO/IEC 7816-4 §5.4.1.

Companion tool

CLA decoder · APDU script validator

Reading

APDU from first principles

Usage notes

The four command cases describe whether data is sent, expected, both, or neither: Case 1 (header only), Case 2 (expect response, Le), Case 3 (send data, Lc), and Case 4 (both). Short-length encoding uses one byte for Lc/Le; extended length uses three. The CLA byte also signals secure messaging and logical-channel selection.

  • 0x00 A4 is SELECT; 0x00 B0 is READ BINARY; 0x00 C0 is GET RESPONSE — the command you issue after a 0x61xx status word.
  • Proprietary classes (CLA with the top bits set) fall outside the interindustry set and follow the card's own specification.
  • Decode the status word a command returns with the APDU status-word reference, and build or inspect commands with the APDU parser.