Ambimat GroupAmbimatAmbiSecureV2XeSIM & eUICCAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
ASAmbiSecureHardware-rooted security
Contact

ISO/IEC 7816 is the foundational standard family for contact smart cards. Part 4 defines the APDU — the command/response unit exchanged with the card. A command APDU begins with a four-byte header: CLA (class), INS (instruction), and P1/P2 (parameters), optionally followed by Lc, a data field, and Le (expected response length). This reference collects the common CLA/INS values and interindustry commands (SELECT, READ BINARY, GET RESPONSE, VERIFY, and the rest).

ISO 7816-4

ISO 7816 CLA Values

Common ISO/IEC 7816-4 CLA byte values. Interindustry, proprietary, GlobalPlatform, secure-messaging variants. Pair with the CLA decoder to walk bit-fields.

14 / 14 entries
CLADescriptionClassUsage
00 #First interindustry, channel 0, no SM, no chainingInterindustryISO/IEC 7816-4 standard form. Most common.
01–03 #First interindustry, logical channels 1–3Interindustryb2–b1 carry the channel number; channels are opened with MANAGE CHANNEL.
04 #First interindustry, channel 0, proprietary SM formatInterindustryb4–b3 = 01: secure messaging in a format the application defines.
08 #First interindustry, channel 0, SM, command header not processedInterindustryb4–b3 = 10: ISO secure messaging; the header is not authenticated.
0C #First interindustry, channel 0, SM, command header authenticatedInterindustryb4–b3 = 11: ISO secure messaging with the header in the MAC. The most common SM CLA.
10 #First interindustry, command chaining (not the last command)Interindustryb5 (0x10) is set on every command of a chain except the last, which clears it.
20–3F #Reserved for future useReservedBit pattern 001x xxxx is not assigned; do not send it.
40–4F #Further interindustry, logical channels 4–19, no SMInterindustryb4–b1 hold the channel number minus 4; b5 is the chaining bit.
60–6F #Further interindustry, logical channels 4–19, SMInterindustryb6 set: ISO secure messaging, command header not processed.
80 #Proprietary classProprietaryGlobalPlatform commands without secure messaging on channel 0 (80–83 for channels 0–3).
84 #Proprietary class with SM indicationProprietaryGlobalPlatform commands inside a secure channel (SCP02 / SCP03) on channel 0 (84–87 for channels 0–3).
C0–CF #Proprietary, GlobalPlatform logical channels 4–19ProprietaryGlobalPlatform's encoding for supplementary channels 4–19 without secure messaging.
E0–EF #Proprietary, GlobalPlatform logical channels 4–19 with SMProprietaryGlobalPlatform's encoding for supplementary channels 4–19 inside a secure channel.
FF #Invalid as a CLA (PPS)Reserved0xFF starts an ISO/IEC 7816-3 PPS request, so it is never a valid APDU CLA.

What this reference covers

Spec

ISO/IEC 7816-4 §5.4.1.

Companion tool

CLA decoder · APDU script validator

Reading

APDU from first principles · ISO 7816 quick reference (APDU structure and INS bytes)

Primary sources

ISO/IEC 7816-4:2020 · ISO/IEC 7816-3:2006 · GlobalPlatform Card Specification 2.3.1

How the CLA byte is divided

ISO/IEC 7816-4 numbers the bits b8 (most significant) to b1. The top bits select one of four ranges:

  • 000x xxxx (00–1F): first interindustry values. b5 marks command chaining, b4–b3 the secure-messaging indication, and b2–b1 logical channels 0–3.
  • 001x xxxx (20–3F): reserved for future use.
  • 01xx xxxx (40–7F): further interindustry values. b6 marks secure messaging, b5 chaining, and b4–b1 logical channels 4–19.
  • 1xxx xxxx (80–FE): proprietary class, defined by the application or platform. GlobalPlatform card management uses 80 and 84. FF is invalid.

To decode a specific byte bit by bit, use the CLA decoder.

Usage notes

The four command cases describe whether data is sent, expected, both, or neither: Case 1 (header only), Case 2 (expect response, Le), Case 3 (send data, Lc), and Case 4 (both). Short-length encoding uses one byte for Lc/Le; extended length uses three. The CLA byte also signals secure messaging and logical-channel selection.

  • 0x00 A4 is SELECT; 0x00 B0 is READ BINARY; 0x00 C0 is GET RESPONSE — the command you issue after a 0x61xx status word.
  • Proprietary classes (CLA with the top bits set) fall outside the interindustry set and follow the card's own specification.
  • Decode the status word a command returns with the APDU status-word reference, and build or inspect commands with the APDU parser.