Overview
ISO/IEC TS 23465-2:2023 specifies the programming interface (API) definition between a client application and a proxy for card and security devices for personal identification. Part 2 of the ISO/IEC 23465 series formalizes a generic API, state and security models for use cases, and class/API definitions that map to existing chip card interfaces (for example, functionality defined in the ISO/IEC 7816 series). The technical specification aims to simplify integration of integrated circuit cards (ICC) and other security devices in environments such as mobile, IoT and constrained devices by abstracting APDU-level complexity.
Key topics and technical requirements
- Generic API definition: a graduated set of API calls to access credential storage, cryptographic services and secure applications through a proxy layer.
- State and security models: standardized models for session, authentication and authorization related to common use cases.
- Class and data model definitions: object classes like SecurityDeviceApplication, SensitiveContainer, DataContainer, CertificateContainer, Key, PublicKey, PrivateKey, Password and Authenticator are defined with attributes, methods and references.
- API structure and prerequisites: description language, function formats, addressing, parameters, return values and callback semantics.
- Error handling: standardized exceptions and error-reporting mechanisms for API functions.
- Device identification & discoverability: attributes and registry entries for enumerating and identifying security devices (e.g., methods such as isoIec23465_getSecurityDeviceList and isoIec23465_connectSecurityDevice are examples of device management functions).
- Cryptographic operation APIs: interfaces for symmetric/asymmetric operations and key management, with class extensions for key types and usage.
- Annexes and implementation guidance: informative material including the Open Mobile API and IDL examples to aid integration.
Applications and who uses it
ISO/IEC TS 23465-2 is aimed at implementers and integrators who need a consistent, low-footprint API for security devices:
- System and firmware developers (mobile OS, secure elements, embedded devices) implementing proxy drivers or lightweight middleware.
- Card and secure element vendors mapping APDU-based chips to higher-level APIs.
- Security architects and PKI integrators deploying credential storage, certificate management and cryptographic services.
- IoT and M2M solution designers that require secure identity and cryptographic operations on constrained devices.
Benefits include reduced APDU complexity for application developers, improved portability of ICC functionality, and smaller middleware footprint for resource-constrained platforms.
Related standards
- ISO/IEC 23465-1:2023 - Introduction and architecture description (normative).
- ISO/IEC 7816 series - APDU and ICC-related functionality referenced and mapped by this API definition.
- ISO/IEC 24727 - referenced as a more complex discoverability framework; 23465-series aims to simplify discoverability and usage.
Keywords: ISO/IEC TS 23465-2:2023, programming interface, API definition, security device API, smart card API, proxy, ICC, APDU abstraction, cryptographic API, credential storage.