ISO/IEC 7816 Quick Reference
A condensed, bookmark-friendly view of the parts of ISO/IEC 7816 you reach for most often: APDU structure, common INS bytes, file/record types, and the secure-messaging bits in CLA.
APDU shape
A command APDU is a 4-byte header — CLA, INS, P1, P2 — plus optional Lc + data + Le.
| Case | Shape | Meaning |
|---|---|---|
| 1 | CLA INS P1 P2 | No data, no response body. |
| 2 | CLA INS P1 P2 Le | No data, expecting Le bytes. |
| 3 | CLA INS P1 P2 Lc Data | Sending data, no body expected. |
| 4 | CLA INS P1 P2 Lc Data Le | Both directions. |
Extended-length APDUs prefix Lc and Le with a 0x00 byte and use 2-byte values, allowing up to 65535 bytes per direction. Negotiated via T0 historical bytes / SELECT response.
CLA bits
| Bits | Meaning |
|---|---|
| b8..b5 = 0000 | Inter-industry, ISO 7816-4. |
| b8 = 1 | Proprietary range (e.g. 0x80–0xBF — GlobalPlatform uses 0x80). |
| b4..b3 = 00 | No secure messaging. |
| b4..b3 = 10 | Secure messaging — header authenticated. |
| b4..b3 = 11 | Secure messaging — full (cmd + body). |
| b2..b1 | Logical channel (0–3). |
Common INS bytes
| INS | Name |
|---|---|
| 20 | VERIFY (PIN/CHV) |
| 22 | MANAGE SECURITY ENVIRONMENT |
| 24 | CHANGE REFERENCE DATA |
| 2A | PERFORM SECURITY OPERATION |
| 2C | RESET RETRY COUNTER |
| 46 | GENERATE ASYMMETRIC KEY PAIR |
| 70 | MANAGE CHANNEL |
| 82 | EXTERNAL AUTHENTICATE |
| 84 | GET CHALLENGE |
| 86 | GENERAL AUTHENTICATE |
| 88 | INTERNAL AUTHENTICATE |
| A4 | SELECT (FILE / AID) |
| B0 | READ BINARY |
| B2 | READ RECORD |
| C0 | GET RESPONSE |
| CA | GET DATA |
| D0 | WRITE BINARY |
| D2 | WRITE RECORD |
| D6 | UPDATE BINARY |
| DA | PUT DATA |
| DC | UPDATE RECORD |
| E0 | CREATE FILE |
| E2 | APPEND RECORD |
| E4 | DELETE FILE / DELETE (GP) |
| E6 | TERMINATE DF / INSTALL (GP) |
| E8 | TERMINATE EF / LOAD (GP) |
| F2 | STATUS / GET STATUS (GP) |
Static reference — no input leaves your browser.
Standards in this family
ISO/IEC 7816 has 15+ parts; the ones smart-card developers reach for most: -3 (electrical, ATR), -4 (organisation, security, commands), -8 (commands for security operations), -9 (commands for card management), -15 (cryptographic information application).
Spec
ISO 7816-4 (the one to read first).