May 2006, Issue 190

Mobile Phone Book
M16C/62P-Based Data Backup System
Renesas M16C 2005 Honorable Mention

APDU PROTOCOL

The APDU protocol is an application-level protocol between a smart card and a host application. APDU messages comprise two structures. The host application on the external device side of the channel uses one structure to send commands to the card. The card uses the other structure to send responses back to the host application. The former is referred to as the command APDU (C-APDU). The latter is the response APDU (R-APDU). A C-APDU is always paired with a R-APDU.[1]

The C-APDU header consists of 4 bytes: instruction class (CLA), instruction code (UNS), and parameters 1 and 2 (P1 and P2). The class byte identifies a category of command and response APDUs. The instruction bytes specify the instruction of the command. The two parameter bytes provide further qualifications to the instruction.

The section after the header in a C-APDU is an optional body that varies in length. The Lc field in the body specifies the length of the data field (in bytes). The data field contains data that is sent to the card for executing the instruction specified in the APDU header. The last byte in the command APDU body is the Le field, which specifies the number of bytes expected by the host in the smart card’s response.

Sent by the smart card in response to a C-APDU, an R-APDU consists of an optional body and a mandatory trailer. The body consists of the data field. The Le field in the corresponding C-APDU determines the data field’s length. The trailer consists of two fields, SW1 and SW2, which together are called the status word. The status word denotes the processing state in the card after executing the C-APDU. For example, the status word 0x9000 means that a command was executed successfully and completely. The data field is optional in both command and response APDUs. Therefore, APDUs can be categorized into four cases that are based on whether a data field is contained in the C-APDU or R-APDU.

In case 1, no data is transferred to or from the card. Therefore, the C-APDU contains only the header. The R-APDU contains only the trailer status word.

In case 2, data isn’t transferred to the card, but it’s returned from the card. The body of the C-APDU contains 1 byte (Le field), which specifies the number of data bytes in the corresponding R-APDU.

In case 3, data is transferred to the card, but data isn’t returned from the card as a result of processing the command. The body of the C-APDU includes the Lc field and the data field. The Lc byte specifies the length of the data field. The response APDU contains only the trailer status word.

Finally, in case 4, data is transferred to the smart card, and data is returned from the card as a result of processing the command. The body of the command APDU includes the Lc field, the data field, and the Le field. The response APDU contains both the data and the trailer status word.