Overview
ISO/IEC 24727-4:2008/Amd 1:2014 is Amendment 1 to Part 4 of the ISO/IEC 24727 family: Identification cards - Integrated circuit card programming interfaces - Application programming interface (API) administration. Published in 2014, the amendment updates middleware stack configurations to improve interoperability between smart-card (ICC) applications and networked identity systems by introducing an XML representation of API/data structures, clarifying secure messaging, and adding lightweight registry support.
Key topics and technical requirements
- SAL API Lite: A constrained subset of the Service Access Layer (SAL) API that supplies pre-built interoperability data structures (DataSet, DSI, DID, ACL, etc.) to client applications. Supported requests include:
- CardApplicationConnect(), CardApplicationList(), CardApplicationServiceList(), CardApplicationServiceDescribe()
- DataSetList(), DataSetSelect()
- DSIList(), DSIRead()
- DIDList(), DIDGet()
- ACLList()
- ISO/IEC 7816-15 registry integration: The amendment standardizes locating an on-card (ISO/IEC 7816-15 based) registry processor in the local platform to parse the card registry and generate ISO/IEC 24727-3 data structures for discovery and interoperability.
- Registry operation constraints:
- Registry delegation to SAL API Lite on the client platform
- Registry bootstrap to preload interoperability structures
- Registry connection to expose on-card registry data (e.g., GUI)
- ICC-resident-stack exclusion (SAL API Lite is not intended for pure on-card agent stacks)
- Optional use of static/dynamic libraries for registry exploration (informative Annex E)
- Secure messaging clarification: The amendment details how SAL and SAL API Lite interact to establish end-to-end secure channels between client and card, including discovery (DataSetList), ACL inspection (ACLList), DID-based authentication (DIDAuthenticate), DSI mapping and secured DSIRead using APDUs protected by session keys.
- XML representation and bindings: Adds XML encodings to align with SAML/OpenID-style federated identity systems and includes C (normative) and Java (informative) bindings moved from Part 5.
Applications and practical value
- Enables consistent discovery and mapping of on-card objects (keys, files, ACLs) into interoperable data structures for applications such as eID, digital signatures, banking, and government ID services.
- Simplifies client-side middleware: SAL API Lite reduces workload by precomputing data structures and supporting GUI-driven exposure of on-card registries.
- Facilitates secure end-to-end transactions between networked services and smart-card applications by defining clear secure messaging flows and APDU handling.
Who should use this standard
- Smart-card middleware developers and integrators
- Identity management and eID system architects
- Card application developers and vendors
- Security architects implementing secure messaging and APDU-level interactions
- Governments, financial services, and federated identity providers working with ICCs
Related standards
Keywords: ISO/IEC 24727-4:2008/Amd 1:2014, identification cards, integrated circuit card, SAL API Lite, ISO/IEC 7816-15 registry, secure messaging, APDU, DataSet, DSI, DID, interoperability, middleware stack.
Open preview (PDF)Identification cards — Integrated circuit card programming interfaces — Part 4: Application programming interface (API) administration — Amendment 1
