ISO/IEC 7816-4
Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange
Cartes d’identification — Cartes à circuit intégré — Partie 4: Organisation, sécurité et commandes pour les échanges

Any command of this group shall be aborted if applied to an EF not supporting records. It can be performed on an EF only if the security status satisfies the security attributes defined for the function, namely, read, write, append, update, search or erase.

Two commands of this group (read, update) may use an odd INS code (data fields encoded in BER-TLV) for initiating an action on a part of a given record (partial read, partial update). Then an offset shall reference each byte inside a record: from zero for the first byte of the record, the offset is incremented by one for each subsequent byte of the record. Reference to a byte not contained in the record is an error. As needed, the offset data element is binary encoded and referenced by tag ’54′. When present in a command or response data field, data shall be encapsulated in a discretionary data object with tag ’53′ or ’73′.

Each command of this group may use a short EF identifier. If the process is completed, then the identified EF becomes current and the record pointer is reset. If there is a current EF at the time of issuing the command, then the process may be completed without indicating the EF (by just setting the corresponding five bits to 0).

P1——Each record number or identifier is a number from one to 254, encoded by a value of P1 from ’01′ to ‘FE’. Zero (encoded ’00′) is reserved for special purposes. 255 (encoded ‘FF’) is reserved for future use.
P2——Bits 8 to 4 are a short EF identifier according to Table 47. Bits 3 to 1 depend upon the command.

Table 47 — Short EF identifier in P2
b8 b7 b6 b5 b4 b3 b2 b1 Meaning
0 0 0 0 0 - - - Current EF
  Not all equal   - - - Short EF identifier (a number from one to thirty)
1 1 1 1 1 - - - Reserved for future use

In this group of commands, SW1-SW2 set to ’63CX’ indicates a successful change of memory state, but after an internal retry routine; ‘X’ > ’0′ encodes the number of retries; ‘X’ = ’0′ means that no counter is provided.

READ RECORD (S) command
The response data field gives the [partial] contents of the specified record(s) [or the beginning part of one record] within an EF.
If INS = ‘B2′ and if the records are SIMPLE-TLV data objects (see 5.2.1), then Table 50 illustrates the response data field. The comparison of Nr with the TLV structure indicates whether the unique record (read one record) or the last record (read all records) is incomplete, complete or padded.
NOTE If the records are not data objects, then the read-all-records function results in receiving records without delimitation.
If INS = ‘B3′, then the command partially reads the record referenced by P1. The command data field shall contain an offset data object (tag ’54) indicating the first byte to be read in the record. The response data field shall contain a discretionary data object (tag ’53′) encapsulating the data read.

Table 48 READ RECORD (S) command-response pair
CLA INS P1 P2 As defined in 5.1.1 ‘B2′ or ‘B3′ Record number or record identifier (’00′ references the current record) See Table 49
Lcfield Absent for encoding Nc= 0, present for encoding Nc> 0 
Data field Absent (INS = ‘B2′), or offset data object (INS = ‘B3′)
Lefield Present for encoding Ne> 0
Data field Data read (INS = ‘B2′), or discretionary data object for encapsulating the data read (INS = ‘B3′)
SW1-SW2 See Tables 5 and 6 when relevant, e.g., ’6281, ’6282′, ’6700′, ’6981′, ’6982′, ’6A81, ’6A82′, ’6A83′, ’6CXX’


Table 49 P2
b8 b7 b6 b5 b4 b3 b2 b1 Meaning
x x x x x - - - Short EF identifier according to Table 47
—– —– —– —– —– 0 0 0 0 0 x 0 0 1 1 x 0 1 0 1 Record identifier in P1 —Read first occurrence —Read last occurrence —Read next occurrence —Read previous occurrence
—- —- —- —- —- 1 1 1 1 1 x 0 0 1 1 x 0 1 0 1 Record number in P1 —Read record P1 —Read all records from P1 up to the last —Read all records from the last up to P1 Reserved for future use

If the Le field contains only bytes set to ’00′, then the command should read completely either the single requested record, or the requested sequence of records, depending on bits 3, 2 and 1 of P2 and within the limit of 256 for a short Le field, or 65 536 for an extended Le field.

Table 50 — Response data fields with INS = ‘B2′

Mifare DESFire EV1 4K Clamshell Proximity Card,Mifare DESFire 4K Printing Card,Clamshell MIFARE DESFire EV1 Smart Card 4k byte/32k bit,