About eSim cards

[laforge]

A general update on the state of affairs in tems of sysmocom eUICCs, and open source software for SM-DP+ and LPA.

1. There is a really nice open source LPA for cosumer eSIM available from GitHub - estkme-group/lpac: C-based eUICC LPA - you can use this with a (test or production) eUICC in plastic form-factor in a pcsc-lite compatible card reader and download profiles from any SM-DP+ you can reach via IP / the internet
2. I’ve been working on a SM-DP+ implementation in the laforge/sm-dp branch of the pySim git repo: sim-card/pysim: python libraires and command line tools for SIM/UICC/USIM/ISIM card analysis and programming. - pysim - Osmocom gitea - by now it looks like 99% are working, but somehow the test-eUICC I have is claiming a scp03tSecurityError during configureISDP. I’ve validated each step of my crypto code using hex dumps from @mode51software and my implementation produces the same results for ECDSA, ECKA, KDF, BSP crypto and BSP MAC. It’s a real puzzle why it isn’t working yet.
3. sysmocom is meanwhile able to provide eUICCs with GSMA production certificates/keys. I’ve succesfully installed production eSIM profiles from several operators on it using lpac mentioned above. It supports SAIP (SimAlliance Interoperable Profile) v2.3.1 and is capable of profiles with DF.5GS and SUCI-on-card. If you are interested in purchasing samples, contact sales@sysmocom.de and mention symoEUICC1-C2G.
4. sysmocom test-eUICCs with custom certificates are stil WIP but will beceome available later on
5. The idea about sysmocom eUICC with multiple root CI certificates is still under investigation.

[laforge]

a small update regarding osmo-smdpp.py:

@laforge

It’s a real puzzle why it isn’t working yet.

It has meanwhile been fixed and it is installing eSIM profiles into test-eUICCs just fine.

[merakli]

@laforge

This also means that we (at sysmocom) should also be able to create such hybrid eUICC which would accept any combination of GSMA-production CA, GSMA-testing CA and/or private-root CA.

This would be great. But one question is whether a commerical phone can be made to use a profile downloaded using the private-root CA. So if I have a private-root CA into the ECADS and then download a eSIM profile with 999-99 PLMN. Can a commercial device use this eSIM or is there a check that the eSIM profile has been downloaded using GSMA-production CA? Thanks.

[laforge]

@merakli

This would be great. But one question is whether a commerical phone can be made to use a profile downloaded using the private-root CA. So if I have a private-root CA into the ECADS and then download a eSIM profile with 999-99 PLMN. Can a commercial device use this eSIM or is there a check that the eSIM profile has been downloaded using GSMA-production CA? Thanks.

If your “commercial device” use the described sysmcoom hybrid eUICC, then you can install both production GSMA eSIM profiles and those created within your private CA.

For the built-in/off-the-shelf eUICC of a normal commercial device, you can always only install eSIM profiles signed within those root CAs supported by that eUICC. Normally this is the GSMA consumer root CA; occasionally also some vendor or country specific root CA (see Certificate Issuers (CIs) | eUICC Manual). Only the eUICC manufacturer may be able to install additional certificates into the ECASD.