ETSI TS 102 226 V18.1.0 (2023-04)

Smart Cards; Remote APDU structure for UICC based applications (Release 18)

RTS/SET-T102226vi10

General Information

• Status: Not Published
• Technical Committee: SET TEC - SET-TEC
• Current Stage: 12 - Citation in the OJ (auto-insert)
• Due Date: 15-May-2023
• Completion Date: 28-Apr-2023

Standards Content (Sample)

ETSI TS 102 226 V18.1.0 (2023-04)






TECHNICAL SPECIFICATION
Smart Cards;
Remote APDU structure for UICC based applications
(Release 18)

---------------------- Page: 1 ----------------------
Release 18 2 ETSI TS 102 226 V18.1.0 (2023-04)

Reference
RTS/SET-T102226vi10
Keywords
protocol, smart card
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - APE 7112B
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° w061004871

Important notice
The present document can be downloaded from:
https://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
If you find a security vulnerability in the present document, please report it through our
Coordinated Vulnerability Disclosure Program:
https://www.etsi.org/standards/coordinated-vulnerability-disclosure
Notice of disclaimer & limitation of liability
The information provided in the present deliverable is directed solely to professionals who have the appropriate degree of
experience to understand and interpret its content in accordance with generally accepted engineering or
other professional standard and applicable regulations.
No recommendation as to products and services or vendors is made or should be implied.
No representation or warranty is made that this deliverable is technically accurate or sufficient or conforms to any law
and/or governmental rule and/or regulation and further, no representation or warranty is made of merchantability or fitness
for any particular purpose or against infringement of intellectual property rights.
In no event shall ETSI be held liable for loss of profits or any other incidental or consequential damages.

Any software contained in this deliverable is provided "AS IS" with no warranties, express or implied, including but not
limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property
rights and ETSI shall not be held liable in any event for any damages whatsoever (including, without limitation, damages
for loss of profits, business interruption, loss of information, or any other pecuniary loss) arising out of or related to the use
of or inability to use the software.
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and
microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.

© ETSI 2023.
All rights reserved.

ETSI

---------------------- Page: 2 ----------------------
Release 18 3 ETSI TS 102 226 V18.1.0 (2023-04)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 6
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 8
3 Definition of terms, symbols and abbreviations . 9
3.1 Terms . 9
3.2 Symbols . 9
3.3 Abbreviations . 9
4 Overview of remote management . 10
5 Remote APDU format . 11
5.1 Compact Remote Application data format . 11
5.1.1 Compact Remote command structure . 11
5.1.2 Compact Remote response structure . 12
5.2 Expanded Remote Application data format . 12
5.2.1 Expanded Remote command structure . 12
5.2.1.0 Structure overview . 12
5.2.1.1 C-APDU TLV . 13
5.2.1.2 Immediate Action TLV . 13
5.2.1.3 Error Action TLV . 14
5.2.1.4 Script Chaining TLV . 15
5.2.2 Expanded Remote response structure . 16
5.3 Automatic application data format detection . 19
6 Security parameters assigned to applications . 19
6.1 Minimum Security Level (MSL) . 19
6.2 Access domain . 19
7 Remote File Management (RFM) . 20
7.0 RFM basic principles. 20
7.1 Commands . 20
7.2 UICC Shared File System Remote File Management . 21
7.3 ADF Remote File Management . 21
7.4 RFM implementation over HTTPS . 21
8 Remote Application Management (RAM) . 22
8.0 RAM basic principles . 22
8.1 Remote application management application behaviour . 22
8.2 Command coding and description . 23
8.2.0 Basic rules . 23
8.2.1 Commands . 23
8.2.1.0 Application management commands overview. 23
8.2.1.1 DELETE . 23
8.2.1.2 SET STATUS . 23
8.2.1.3 INSTALL . 24
8.2.1.3.0 Basic requirements for INSTALL command . 24
8.2.1.3.1 INSTALL [for load] . 24
8.2.1.3.2 INSTALL [for install] . 24
8.2.1.4 LOAD . 32
8.2.1.5 PUT KEY . 33
8.2.1.5.0 Generic rules for PUT KEY command . 33
8.2.1.5.1 PUT KEY for AES . 33
8.2.1.5.2 PUT KEY for triple DES . 33
ETSI

---------------------- Page: 3 ----------------------
Release 18 4 ETSI TS 102 226 V18.1.0 (2023-04)
8.2.1.6 GET STATUS . 34
8.2.1.6.0 Basic rules . 34
8.2.1.6.1 Menu parameters . 34
8.2.1.7 GET DATA . 35
8.2.1.7.0 Basic rules . 35
8.2.1.7.1 Void . 35
8.2.1.7.2 Extended Card resources information . 35
8.2.1.8 STORE DATA . 36
8.3 RAM implementation over HTTPS . 36
9 Additional command for push . 37
9.0 Introduction . 37
9.1 Push command behaviour . 37
9.1.1 Request for open channel . 37
9.1.2 Request for CAT_TP link establishment . 37
9.1.3 Behaviour for responses . 37
9.1.4 Request for TCP connection . 37
9.1.5 Request for Identification Packet . 37
9.2 Commands coding . 37
9.2.0 Coding . 37
9.2.1 Data for BIP channel opening . 38
9.2.2 Data for CAT_TP link establishment. 38
9.2.3 Data for TCP connection opening . 39
9.2.4 Data for sending of Identification Packet . 39
9.3 Closing of the BIP channel . 40
10 Confidential application management . 40
10.0 Overview and basic requirements. 40
10.1 Confidential loading . 40
10.2 Additional application provider security . 41
10.3 Confidential setup of Security Domains . 42
10.4 Application personalization in an APSD . 42
Annex A (normative): BER-TLV tags . 43
Annex B (informative): RFM over HTTP Communication Flow . 44
Annex C (informative): Bibliography . 46
Annex D (informative): Change history . 47
History . 51

ETSI

---------------------- Page: 4 ----------------------
Release 18 5 ETSI TS 102 226 V18.1.0 (2023-04)
Intellectual Property Rights
Essential patents
IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The declarations
pertaining to these essential IPRs, if any, are publicly available for ETSI members and non-members, and can be
found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to
ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the
ETSI Web server (https://ipr.etsi.org/).
Pursuant to the ETSI Directives including the ETSI IPR Policy, no investigation regarding the essentiality of IPRs,
including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not
referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become,
essential to the present document.
Trademarks
The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.
ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no
right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does
not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.
DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its

Members. 3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and of the 3GPP
Organizational Partners. oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and of the
®
oneM2M Partners. GSM and the GSM logo are trademarks registered and owned by the GSM Association.
Foreword
This Technical Specification (TS) has been produced by ETSI Technical Committee Secure Element Technologies
(SET).
It is based on work originally done in the 3GPP in TSG-terminals WG3 and ETSI SMG.
The contents of the present document are subject to continuing work within TC SET and may change following formal
TC SET approval. If TC SET modifies the contents of the present document, it will then be republished by ETSI with
an identifying change of release date and an increase in version number as follows:
Version x.y.z
where:
x: the first digit:
0 early working draft;
1 presented to TC SET for information;
2 presented to TC SET for approval;
3 or greater indicates TC SET approved document under change control.
y: the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections,
updates, etc.
z: the third digit is incremented when editorial only changes have been incorporated in the document.
ETSI

---------------------- Page: 5 ----------------------
Release 18 6 ETSI TS 102 226 V18.1.0 (2023-04)
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
ETSI

---------------------- Page: 6 ----------------------
Release 18 7 ETSI TS 102 226 V18.1.0 (2023-04)
1 Scope
The present document defines the remote management of the UICC based on any of the secured packet structures
specified in ETSI TS 102 225 [1].
It specifies the APDU format for remote management.
Furthermore the present document specifies:
• A set of commands coded according to this APDU structure and used in the remote file management on the
UICC. This is based on ETSI TS 102 221 [2].
• A set of commands coded according to this APDU structure and used in the remote application management
on the UICC. This is based on the GlobalPlatform Card Specifications.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
• In the case of a reference to a TC SET document, a non-specific reference implicitly refers to the latest version
of that document in the same Release as the present document.
Referenced documents which are not found to be publicly available in the expected location might be found at
https://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI TS 102 225: "Smart Cards; Secured packet structure for UICC based applications".
[2] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".
[3] ETSI TS 102 223: "Smart Cards; Card Application Toolkit (CAT)".
[4] GlobalPlatform: "GlobalPlatform Card Specification Version 2.3.1".
[5] ETSI TS 101 220: "Smart Cards; ETSI numbering system for telecommunication application
providers".
[6] ETSI TS 102 241: "Smart Cards; UICC Application Programming Interface (UICC API) for Java
Card (TM)".
[7] Void.
[8] Void.
[9] ETSI TS 102 222: "Integrated Circuit Cards (ICC); Administrative commands for
telecommunications applications".
[10] ETSI TS 123 048: "Digital cellular telecommunications system (Phase 2+); Universal Mobile
Telecommunications System (UMTS); Security mechanisms for the (U)SIM application toolkit;
Stage 2 (3GPP TS 23.048 Release 5)".
[11] ETSI TS 102 127: "Smart Cards; Transport protocol for CAT applications; Stage 2".
ETSI

---------------------- Page: 7 ----------------------
Release 18 8 ETSI TS 102 226 V18.1.0 (2023-04)
[12] ETSI TS 143 019: "Digital cellular telecommunications system (Phase 2+); Subscriber Identity
Module Application Programming Interface (SIM API) for Java Card; Stage 2 (3GPP TS 43.019
Release 5)".
[13] FIPS-197 (2001): "Advanced Encryption Standard (AES)".
[14] NIST Special Publication 800-38A (2001): "Recommendation for Block Cipher Modes of
Operation - Methods and Techniques".
[15] NIST Special Publication 800-38B (May 2005 including updates as of 10-06-2016: PAGE II):
"Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication".
[16] GlobalPlatform: "Card UICC Configuration", Version 2.0.
[17] ETSI TS 102 588: "Smart Cards; Application invocation Application Programming Interface
(API) by a UICC webserver for Java Card™ platform".
[18] GlobalPlatform: "GlobalPlatform Card, Confidential Card Content Management Card
Specification v2.3 - Amendment A", Version 1.2.
[19] GlobalPlatform: "GlobalPlatform Card, Remote Application Management over HTTP, Card
Specification v2.2, Amendment B" Version 1.2.
[20] ETSI TS 102 483: "Smart cards; UICC-Terminal interface; Internet Protocol connectivity between
UICC and terminal".
[21] ISO/IEC 8825-1: "Information technology - ASN.1 encoding rules: Specification of Basic
Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules
(DER)".
[22] GlobalPlatform: "Card Specification Version 2.3, Amendment C: Contactless Services"
Version 1.3.
[23] ETSI TS 102 622: "Smart Card; UICC - Contactless Front-end (CLF) Interface; Host Controller
Interface (HCI)".
[24] GlobalPlatform: "Security Upgrade for Card Content Management - GlobalPlatform Card
Specification v2.3 - Amendment E", Version 1.1.
[25] GlobalPlatform: "Java Card API" (org.globalplatform) Version 1.7.1.
[26] GlobalPlatform: "Card Specification Version 2.3. - Amendment D: Secure Channel Protocol 03"
Version 1.2.
[27] GlobalPlatform: "GlobalPlatform Card, Common Implementation Configuration", Version 2.1.
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
• In the case of a reference to a TC SET document, a non-specific reference implicitly refers to the latest version
of that document in the same Release as the present document.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
Not applicable.
ETSI

---------------------- Page: 8 ----------------------
Release 18 9 ETSI TS 102 226 V18.1.0 (2023-04)
3 Definition of terms, symbols and abbreviations
3.1 Terms
For the purposes of the present document, the terms given in ETSI TS 102 225 [1], ETSI TS 101 220 [5] and the
following apply:
Controlling Authority Security Domain (CASD): security domain providing cryptographic functions, as specified in
GlobalPlatform Card Specification Amendment A [18]
NOTE: It provides services to confidentially load or generate Secure Channel keys of an APSD.
3.2 Symbols
Void.
3.3 Abbreviations
For the purposes of the present document, the abbreviations given in ETSI TS 102 225 [1] and the following apply:
ACK ACKnowledge
ADD Access Domain Data
ADF Application Data File
ADP Access Domain Parameter
AES Advanced Encryption Standard
AFI Application Family Identifier
AID Application IDentifier
AM Authorized Management
AP Application Provider
APDU Application Protocol Data Unit
API Application Programming Interface
APSD Application Provider Security Domain
BER-TLV Basic Encoding Rules - Tag, Length, Value
BIP Bearer Independent Protocol
C-APDU Command Application Protocol Data Unit
CASD Controlling Authority Security Domain
CAT_TP Card Application Toolkit Transport Protocol
CBC Cell Broadcast Centre
CC Cryptographie Checksum
CL ContactLess
CLA Class
CLT Contactless Tunneling
CMAC Cipher-based Message Authentication Code
DAP Data Authentication Pattern
DEK Data Encryption Key
DES Data Encryption Standard
DF Directory File
DM Delegated Management
DS Digital Signature
ECB Electronic Code Book
ECKA Elliptic Curve Key Agreement algorithm
ECKA-EG ElGamal ECKA
EF Elementary File
HTTP HyperText Transfer Protocol
HTTPS HyperText Transfer Protocol Secure
ICCID Integrated Circuit Card IDentification
ICV Integrity Check Value
INS INStruction
ETSI

---------------------- Page: 9 ----------------------
Release 18 10 ETSI TS 102 226 V18.1.0 (2023-04)
IP Internet Protocol
ISD Issuer Security Domain
KIc Key and algorithm Identifier for ciphering
KID Key and algorithm IDentifier for RC/CC/DS
MAC Message Authentication Code
MF Management Field
MSL Minimum Security Level
MSLD Minimum Security Level Data
NIST National Institute of Standards and Technology
OTA Over The Air
PDU Packet Data Unit
PIN Personal Identification Number
RAM Remote Application Management
R-APDU Response Application Protocol Data Unit
RF Radio Frequency
RFM Remote File Management
RFU Reserved for Future Use
SCP02 Secure Channel Protocol 02
SCP03 Secure Channel Protocol 03
SD Security Domain
SDU Service Data Unit
SE Sending Entity
SMG Special Mobile Group
SP Special Publication
SPI Security Parameter Indication
TAR Toolkit Application Reference
TCP Transmission Control Protocol
TLS Transport Layer Security
TLV Tag Length Value
TPDU Transfer Protocol Data Unit
4 Overview of remote management
Sending Sending Receiving Receiving
Application Entity Entity Application
Secured
C-APDU
[Secured R-APDU]
Server UICC

Figure 4.1: Remote management
ETSI

---------------------- Page: 10 ----------------------
Release 18 11 ETSI TS 102 226 V18.1.0 (2023-04)
All data exchanged between the Sending Entity and Receiving Entity shall be formatted as "Secured data" according to
ETSI TS 102 225 [1]:
1) The parameter(s) (the command string) in the "Secured data" is either a single command, or a list of
commands, which shall be processed sequentially. Additional application provider security may be applied to
the "secured data" as specified in clause 10.2 of the present document.
2) The Remote Manageme
...