Overview - ISO/IEC 7816-8:2021 (Commands and mechanisms for security operations)
ISO/IEC 7816-8:2021 is part of the ISO/IEC 7816 series for identification cards and integrated circuit cards (ICCs / smart cards). This fifth edition specifies interindustry commands that cards and readers use for security operations and gives informative guidance on constructing security mechanisms using commands defined in ISO/IEC 7816‑4. It focuses on command-level behaviour (for example, key generation and cryptographic operations) and does not evaluate cryptographic algorithms nor cover internal card or external system implementations.
Key topics and technical requirements
- Interindustry security commands: Defines commands such as Generate Asymmetric Key Pair (INS = '46' or '47') and Perform Security Operation (PSO) for common security functions.
- Manage Security Environment (MSE): Describes how to set parameters (e.g., algorithm reference, key identifiers) before invoking key generation or use.
- Supported operations in PSO: Includes digital signature, cryptographic checksum, hash, certificate verification, encipher/decipher, key agreement and related control reference templates (CRTs).
- Response and data formats: Specifies formats for returned public keys and templates (e.g., DO'7F49' public key template), including options for element- or object-based encoding.
- Secure messaging and context switching: Notes use of secure messaging and logical channels; Annex D discusses alternatives to change security context.
- Normative scope limits: Leaves algorithm suitability and exportability considerations to implementers; internal card or external system implementations are out of scope.
Practical applications and who uses this standard
ISO/IEC 7816-8 is essential for system designers, product managers and integrators working with smart card-based security such as:
- Identity documents (e.g., eIDs, passports / MRTD)
- Payment cards and EMV-adjacent systems
- Secure access and PKI card deployments
- Government and enterprise credentialing systems
Typical uses:
- Generating/storing asymmetric key pairs on-card and extracting public keys
- Producing/verifying digital signatures and checksums on the card
- Implementing certificate handling and on-card cryptographic operations while maintaining interoperability across vendors
Related standards
- ISO/IEC 7816-4 - Organization, security and commands for interchange (normative reference)
- Other parts of ISO/IEC 7816 series (physical, transport and application lifecycle parts) that together define card interfaces and data elements
By following ISO/IEC 7816-8, implementers achieve interoperable command-level security operations for integrated circuit cards and maintain consistency with the broader ISO/IEC 7816 smart card ecosystem. Keywords: ISO/IEC 7816-8, smart cards, integrated circuit cards, security operations, generate asymmetric key pair, perform security operation, manage security environment, digital signature, certificate.
Open preview (PDF)Identification cards — Integrated circuit cards — Part 8: Commands and mechanisms for security operations
