[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:19.28,0:00:26.45,Default,,0000,0000,0000,,Herald: So our next talk is "SIM card\Ntechnology from A to Z" and it's an in-
Dialogue: 0,0:00:26.45,0:00:34.81,Default,,0000,0000,0000,,depth introduction of SIM card technology\Nthat not a lot of people know much about.
Dialogue: 0,0:00:34.81,0:00:44.12,Default,,0000,0000,0000,,And our speaker, Harold, LeForge, as he's\Nbetter known, is the founder of the Open
Dialogue: 0,0:00:44.12,0:00:49.79,Default,,0000,0000,0000,,Source Mobile Communications Project. He\Nis also a Linux kernel hacker. He has a
Dialogue: 0,0:00:49.79,0:00:53.85,Default,,0000,0000,0000,,very long and impressive bio; and a\NWikipedia page.
Dialogue: 0,0:00:53.85,0:00:58.99,Default,,0000,0000,0000,,Harald (speaker): just means I'm old.\NHerald: So Harald Welte, please give him a
Dialogue: 0,0:00:58.99,0:01:03.60,Default,,0000,0000,0000,,round of applause.\N{\i1}Applause{\i0}
Dialogue: 0,0:01:03.60,0:01:13.06,Default,,0000,0000,0000,,Herald: All yours.\NHarald (speaker): Thanks a lot for the
Dialogue: 0,0:01:13.06,0:01:19.35,Default,,0000,0000,0000,,introduction. As you can see on the title\Nslide, I actually had to change the title
Dialogue: 0,0:01:19.35,0:01:23.17,Default,,0000,0000,0000,,slightly, because I couldn't find a single\Nacronym related to SIM cards that starts
Dialogue: 0,0:01:23.17,0:01:27.69,Default,,0000,0000,0000,,with z, so now it's from a to x, not from\Na to z anymore - the SIM card
Dialogue: 0,0:01:27.69,0:01:32.28,Default,,0000,0000,0000,,introduction. So the SIM card technology\Nfrom A(PDU) to X(RES) which are two
Dialogue: 0,0:01:32.28,0:01:38.66,Default,,0000,0000,0000,,acronyms in the context of SIM cards which\Nwe might get into or not. So, what are we
Dialogue: 0,0:01:38.66,0:01:44.39,Default,,0000,0000,0000,,going to talk about in the next 45 or so\Nminutes? What are the relevant
Dialogue: 0,0:01:44.39,0:01:49.07,Default,,0000,0000,0000,,specifications and specification bodies?\NWhat kind of interfaces and protocols
Dialogue: 0,0:01:49.07,0:01:53.98,Default,,0000,0000,0000,,relate to SIM cards? We're going to talk\Nabout the filesystem that exists in such
Dialogue: 0,0:01:53.98,0:02:00.81,Default,,0000,0000,0000,,SIM cards, as well as the evolution of SIM\Ncards from 2G to 5G. So that's basically
Dialogue: 0,0:02:00.81,0:02:10.90,Default,,0000,0000,0000,,from what, 91 to 19, er 2018. We will talk\Nabout SIM Toolkit, Over The Air, a little
Dialogue: 0,0:02:10.90,0:02:16.81,Default,,0000,0000,0000,,about about how to eSIMS as well, the\Nembedded SIMs. Introduction about myself
Dialogue: 0,0:02:16.81,0:02:23.90,Default,,0000,0000,0000,,was already given. So, yeah, people\Ncomplained sometimes that my slides are
Dialogue: 0,0:02:23.90,0:02:27.67,Default,,0000,0000,0000,,full of text and I need more diagrams. So\NI tried to improve.
Dialogue: 0,0:02:27.67,0:02:33.45,Default,,0000,0000,0000,,{\i1}laughter from the audience{\i0}\N{\i1}Harald laughs{\i0}
Dialogue: 0,0:02:33.45,0:02:38.81,Default,,0000,0000,0000,,{\i1}Applause{\i0}\NHarald: So this is actually, at one night
Dialogue: 0,0:02:38.81,0:02:43.01,Default,,0000,0000,0000,,I thought, OK, let's actually try to\Ncreate a DOTTY graph of all the specs and
Dialogue: 0,0:02:43.01,0:02:46.95,Default,,0000,0000,0000,,how they cross reference each other. And\Nthis is what I've come up with and this is
Dialogue: 0,0:02:46.95,0:02:51.39,Default,,0000,0000,0000,,only the SIM card relevant specs, not out\Nof context, other specs that they may
Dialogue: 0,0:02:51.39,0:02:57.73,Default,,0000,0000,0000,,refer to. So, yes, it's an interesting\Ngraph. The arrangement was done
Dialogue: 0,0:02:57.73,0:03:03.24,Default,,0000,0000,0000,,automatically by DOTTY. So don't complain\Nto me about that. Yeah.
Dialogue: 0,0:03:03.24,0:03:09.06,Default,,0000,0000,0000,,Nevertheless, I will switch back to text\Nand we will look at what kind of
Dialogue: 0,0:03:09.06,0:03:15.10,Default,,0000,0000,0000,,specifications there are and spec bodies.\NSo. Most importantly, probably about any
Dialogue: 0,0:03:15.10,0:03:20.01,Default,,0000,0000,0000,,kind of chip card technology. We have the\NISO, the International Standardization
Dialogue: 0,0:03:20.01,0:03:26.31,Default,,0000,0000,0000,,Organization, which has a series of\Nspecifications about what they call ICCs,
Dialogue: 0,0:03:26.31,0:03:31.77,Default,,0000,0000,0000,,which is integrated circuit cards. We also\Nhave the ITU, the International
Dialogue: 0,0:03:31.77,0:03:36.37,Default,,0000,0000,0000,,Telecommunication Union, which has a\Nseries of specs related to telecom charge
Dialogue: 0,0:03:36.37,0:03:42.16,Default,,0000,0000,0000,,cards. The title implies, that this is\Nthings that came before SIM cards. So we
Dialogue: 0,0:03:42.16,0:03:47.50,Default,,0000,0000,0000,,talk about the cards you put into pay\Nphones and things like that in the 80s.
Dialogue: 0,0:03:47.50,0:03:53.44,Default,,0000,0000,0000,,There is of course, the 3G. Oh, sorry,\Nthere is of course ETSI, the European
Dialogue: 0,0:03:53.44,0:03:58.62,Default,,0000,0000,0000,,Telecommunication Standardization\NInstitute, which is the entity where GSM
Dialogue: 0,0:03:58.62,0:04:08.31,Default,,0000,0000,0000,,was originally specified. GSM being the\Nfirst digital telephony system that used
Dialogue: 0,0:04:08.31,0:04:10.89,Default,,0000,0000,0000,,SIM cards.\NThe best of my knowledge, at least not a
Dialogue: 0,0:04:10.89,0:04:17.18,Default,,0000,0000,0000,,historian though. There's a 3GPP, the\NThird Generation Partnership Project,
Dialogue: 0,0:04:17.18,0:04:22.89,Default,,0000,0000,0000,,which is where the GSM specs have been\Nhanded over to. In the preparation of the
Dialogue: 0,0:04:22.89,0:04:27.39,Default,,0000,0000,0000,,3G specification process, because ETSI is\Na European entity and Chinese companies,
Dialogue: 0,0:04:27.39,0:04:31.25,Default,,0000,0000,0000,,for example, or Chinese government cannot\Nparticipate there, or Americans even, to
Dialogue: 0,0:04:31.25,0:04:35.17,Default,,0000,0000,0000,,the extent that European companies can do.\NSo it was lifted to an international new
Dialogue: 0,0:04:35.17,0:04:39.92,Default,,0000,0000,0000,,group called the Third Generation\NPartnership Project. And they of course
Dialogue: 0,0:04:39.92,0:04:44.09,Default,,0000,0000,0000,,inherited all the SIM card related\Nspecifications. And then we have like non-
Dialogue: 0,0:04:44.09,0:04:51.37,Default,,0000,0000,0000,,telecom standardization entities such as\Nthe Global Platform Card Specification.
Dialogue: 0,0:04:51.37,0:04:59.68,Default,,0000,0000,0000,,That's Global Platform is a body that\Nspecifies lots of aspects around Java
Dialogue: 0,0:04:59.68,0:05:04.50,Default,,0000,0000,0000,,cards, specifically around to applet\Nmanagement, installation and so on Java
Dialogue: 0,0:05:04.50,0:05:08.46,Default,,0000,0000,0000,,cards, which brings us to the next entity,\Nwhich is not really a standardization
Dialogue: 0,0:05:08.46,0:05:12.38,Default,,0000,0000,0000,,body, but it's a private company that used\Nto be called Sun and now it's part of
Dialogue: 0,0:05:12.38,0:05:18.04,Default,,0000,0000,0000,,Oracle, which defined the Java Card API\Nruntime and the virtual machine of Java
Dialogue: 0,0:05:18.04,0:05:20.78,Default,,0000,0000,0000,,cards.\NAnd last but not least, we have the GSM
Dialogue: 0,0:05:20.78,0:05:25.94,Default,,0000,0000,0000,,Association, which is the vendor club of\Nthe operators. That doesn't really have to
Dialogue: 0,0:05:25.94,0:05:33.46,Default,,0000,0000,0000,,do that much with SIM cards until the\NeSIM, where then suddenly a GSM A plays a
Dialogue: 0,0:05:33.46,0:05:39.56,Default,,0000,0000,0000,,big role in the related specs and\Ntechnology. So talking about these
Dialogue: 0,0:05:39.56,0:05:46.32,Default,,0000,0000,0000,,standardization bodies. What is the SIM,\Nactually? The SIM is the Subscriber
Dialogue: 0,0:05:46.32,0:05:52.74,Default,,0000,0000,0000,,Identity Module. I mean probably anyone in\Nhere has one, likely more or at least has
Dialogue: 0,0:05:52.74,0:05:58.69,Default,,0000,0000,0000,,had. It's quite ubiquitous. Every device\Nwith cellular connectivity during the last
Dialogue: 0,0:05:58.69,0:06:05.45,Default,,0000,0000,0000,,whatever 20 or so years has a SIM, whether\Nit's an actual card or whether it's
Dialogue: 0,0:06:05.45,0:06:11.49,Default,,0000,0000,0000,,soldered in these days. SIM card hacking\Nhas a tradition in the CCC since at least
Dialogue: 0,0:06:11.49,0:06:16.27,Default,,0000,0000,0000,,1998.\NI'm not sure how many people remember:
Dialogue: 0,0:06:16.27,0:06:23.19,Default,,0000,0000,0000,,there was the Vodafone Germany SIM card\Ncloning attack back then. It was in
Dialogue: 0,0:06:23.19,0:06:32.80,Default,,0000,0000,0000,,German. It was titled "Von d2 privat zu D2\Npirat". And that was an attack that used
Dialogue: 0,0:06:32.80,0:06:38.92,Default,,0000,0000,0000,,weaknesses and sort of brute forcing\Nagainst the authentication mechanism to
Dialogue: 0,0:06:38.92,0:06:44.46,Default,,0000,0000,0000,,recover the secret key, which is stored in\Nthe card. And then you could clone SIM
Dialogue: 0,0:06:44.46,0:06:47.65,Default,,0000,0000,0000,,cards back then.\NThat was then fixed in subsequent
Dialogue: 0,0:06:47.65,0:06:54.09,Default,,0000,0000,0000,,technology generations. And also around\Nthat time you can find on the FTP server
Dialogue: 0,0:06:54.09,0:07:01.99,Default,,0000,0000,0000,,of the CCC a SIM card simulator written in\NTurbo C using a season card. I'm not sure
Dialogue: 0,0:07:01.99,0:07:06.27,Default,,0000,0000,0000,,how many people remember season cards.\NThese were cards people used in the
Dialogue: 0,0:07:06.27,0:07:12.99,Default,,0000,0000,0000,,context of cracking satellite TV\Nencryption. Yeah, so. Meanwhile, of
Dialogue: 0,0:07:12.99,0:07:17.56,Default,,0000,0000,0000,,course, the SIM technology stack has\Nincreased and the complexity has increased
Dialogue: 0,0:07:17.56,0:07:22.23,Default,,0000,0000,0000,,like probably in any kind of technology.\NSo let's recap, basically from the
Dialogue: 0,0:07:22.23,0:07:28.55,Default,,0000,0000,0000,,beginning to today what SIM cards are and\Nwhat they do in some degree of detail. If
Dialogue: 0,0:07:28.55,0:07:34.40,Default,,0000,0000,0000,,we start historically with SIM cards,\Nactually the predecessor to the SIM cards
Dialogue: 0,0:07:34.40,0:07:40.14,Default,,0000,0000,0000,,that we know, is the chip card used in the\NC-Netz, which is an analog telephony
Dialogue: 0,0:07:40.14,0:07:45.58,Default,,0000,0000,0000,,system that used to operate in Germany.\NThere's actually an open source
Dialogue: 0,0:07:45.58,0:07:48.20,Default,,0000,0000,0000,,implementation these days as part of\NOsmocom-Analog.
Dialogue: 0,0:07:48.20,0:07:54.05,Default,,0000,0000,0000,,If you're interested in that, do check out\Na jolly at the vintage and retro
Dialogue: 0,0:07:54.05,0:08:01.57,Default,,0000,0000,0000,,computing area. And before 1988, they only\Nhad a magnetic stripe cards, but in 1988
Dialogue: 0,0:08:01.57,0:08:09.07,Default,,0000,0000,0000,,they introduced integrated circuit cards\Nin this analog telephony system and in GSM
Dialogue: 0,0:08:09.07,0:08:14.20,Default,,0000,0000,0000,,it was a chip card from the beginning. The\Nconcept of the SIM card means you store
Dialogue: 0,0:08:14.20,0:08:19.20,Default,,0000,0000,0000,,the identity of the subscriber outside of\Nthe phone, which is very opposite to what
Dialogue: 0,0:08:19.20,0:08:23.98,Default,,0000,0000,0000,,happened in the CDMA world in the US\Naround that time where it was basically
Dialogue: 0,0:08:23.98,0:08:28.15,Default,,0000,0000,0000,,inside the phone itself. But having the\Nidentity separate, of course, enables all
Dialogue: 0,0:08:28.15,0:08:33.56,Default,,0000,0000,0000,,kinds of use cases that were relevant at\Nthat time.
Dialogue: 0,0:08:33.56,0:08:39.38,Default,,0000,0000,0000,,We will get to that to some extent. In\Naddition to the identity, and the identity
Dialogue: 0,0:08:39.38,0:08:43.77,Default,,0000,0000,0000,,in this context means a cryptographic\Nidentity, there are all kinds of network
Dialogue: 0,0:08:43.77,0:08:48.62,Default,,0000,0000,0000,,related parameters that are stored in the\NSIM card. Some of those are static,
Dialogue: 0,0:08:48.62,0:08:54.54,Default,,0000,0000,0000,,meaning that they are provisioned or\Nwritten by the operator into the card, or
Dialogue: 0,0:08:54.54,0:08:59.02,Default,,0000,0000,0000,,of course by the SIM card manufacturer on\Nbehalf of the operator, but which are not
Dialogue: 0,0:08:59.02,0:09:03.48,Default,,0000,0000,0000,,writable by the user that effect \Naccess control classes, which
Dialogue: 0,0:09:03.48,0:09:07.77,Default,,0000,0000,0000,,means like, are you a normal user or are\Nyou an emergency service user which needs
Dialogue: 0,0:09:07.77,0:09:11.78,Default,,0000,0000,0000,,higher priority to access the network,\Nthings like that. And there are lots of
Dialogue: 0,0:09:11.78,0:09:17.43,Default,,0000,0000,0000,,dynamic parameters on the card, and\Ndynamic means they get rewritten and
Dialogue: 0,0:09:17.43,0:09:22.50,Default,,0000,0000,0000,,changed and modified and updated all the\Ntime. That's for example, the TIMSI, the
Dialogue: 0,0:09:22.50,0:09:27.37,Default,,0000,0000,0000,,temporary identity that gets allocated by\Nthe network every so often. Also the
Dialogue: 0,0:09:27.37,0:09:35.48,Default,,0000,0000,0000,,current actual air interface encryption\Nkey like KC and its successors in modern
Dialogue: 0,0:09:35.48,0:09:40.97,Default,,0000,0000,0000,,generation technology. So they get updated\Nand written all the time by the phone. And
Dialogue: 0,0:09:40.97,0:09:45.41,Default,,0000,0000,0000,,some of the files are even updated and\Nwritten by users, at least traditionally
Dialogue: 0,0:09:45.41,0:09:50.94,Default,,0000,0000,0000,,or historically, like the phone book and\Nthe SMS that are stored on the card. It
Dialogue: 0,0:09:50.94,0:09:56.73,Default,,0000,0000,0000,,was originally specified as a full credit\Ncard sized cards and it was intended to be
Dialogue: 0,0:09:56.73,0:10:01.03,Default,,0000,0000,0000,,used in radios in rental cars or company\Nshared cars.
Dialogue: 0,0:10:01.03,0:10:06.34,Default,,0000,0000,0000,,So basically when you leave the car, you\Nwould remove your SIM card, the full sized
Dialogue: 0,0:10:06.34,0:10:12.55,Default,,0000,0000,0000,,credit card sized card and somebody else\Nwould put their card in. And allegedly
Dialogue: 0,0:10:12.55,0:10:17.56,Default,,0000,0000,0000,,there even were, I think, public GSM\Nphones installed in German trains where
Dialogue: 0,0:10:17.56,0:10:21.18,Default,,0000,0000,0000,,you could plug in a SIM card or something\Nlike that. But I personally haven't
Dialogue: 0,0:10:21.18,0:10:28.26,Default,,0000,0000,0000,,witnessed that, since I was ignorant at\Nthat time, apparently, of that fact. So,
Dialogue: 0,0:10:28.26,0:10:35.66,Default,,0000,0000,0000,,let's get to the mother of all smartcard\Nspecs, which is in German DIN EN ISO/IEC 7816
Dialogue: 0,0:10:35.66,0:10:43.67,Default,,0000,0000,0000,,or short just ISO 7816 and maybe an\Nanecdote how these specs come around. So
Dialogue: 0,0:10:43.67,0:10:50.32,Default,,0000,0000,0000,,there's the ISO that specifies a certain\Nspec, it gets an ISO number and then EN,
Dialogue: 0,0:10:50.32,0:10:55.57,Default,,0000,0000,0000,,the European norm, whatever body, comes\Naround and says, "oh, we will elevate this
Dialogue: 0,0:10:55.57,0:11:00.09,Default,,0000,0000,0000,,international spec into a European\Nstandard". And they put an EN in front.
Dialogue: 0,0:11:00.09,0:11:04.35,Default,,0000,0000,0000,,And then DIN, the German standard body,\Ncomes around, says, oh, we will elevate
Dialogue: 0,0:11:04.35,0:11:10.36,Default,,0000,0000,0000,,this European norm into a German norm and\Nwe will put a DIN in front. So now in
Dialogue: 0,0:11:10.36,0:11:14.64,Default,,0000,0000,0000,,Germany, we have DIN EN ISO/IEC 7816.\NAnd if you get the actual copy from DIN
Dialogue: 0,0:11:14.64,0:11:20.25,Default,,0000,0000,0000,,it's quite funny. I didn't don't have it\Nhere, but actually you get a one page
Dialogue: 0,0:11:20.25,0:11:25.34,Default,,0000,0000,0000,,additional paper on top, which translates\Nthe key technical phrases from English to
Dialogue: 0,0:11:25.34,0:11:30.31,Default,,0000,0000,0000,,German. And that's the added value that\Nyou get from it become. Sorry. I mean,
Dialogue: 0,0:11:30.31,0:11:34.64,Default,,0000,0000,0000,,it's just hilarious. The entire spec is in\NEnglish, but then there's like this key
Dialogue: 0,0:11:34.64,0:11:39.13,Default,,0000,0000,0000,,translated terms. So you know, that file\Nmeans "Datei", for example, that's
Dialogue: 0,0:11:39.13,0:11:45.99,Default,,0000,0000,0000,,extremely beneficial to the reader of such\Nspecifications. Anyway, so the title is
Dialogue: 0,0:11:45.99,0:11:50.42,Default,,0000,0000,0000,,"Integrated Circuit Cards with contacts".\N{\i1}chuckles{\i0}\NI wonder, OK, they are contact
Dialogue: 0,0:11:50.42,0:11:56.71,Default,,0000,0000,0000,,less now, but at least back then,\Ncerainly, they didn't exist. And it has 15
Dialogue: 0,0:11:56.71,0:12:00.49,Default,,0000,0000,0000,,parts by now.\NThe most relevant parts are 1 through 4,
Dialogue: 0,0:12:00.49,0:12:03.51,Default,,0000,0000,0000,,starting from the physical\Ncharacteristics, going through the
Dialogue: 0,0:12:03.51,0:12:07.36,Default,,0000,0000,0000,,mechanical dimensions and the location of\Nthe contacts, of course, it's a separate
Dialogue: 0,0:12:07.36,0:12:10.99,Default,,0000,0000,0000,,part of the spec. And each of those specs\Nare sold as a separate document, of
Dialogue: 0,0:12:10.99,0:12:14.75,Default,,0000,0000,0000,,course. So the physical size you pay and\Nif you want to know the location of the
Dialogue: 0,0:12:14.75,0:12:19.82,Default,,0000,0000,0000,,contacts you have to pay to get another\Nspec. And then there's part 3, which
Dialogue: 0,0:12:19.82,0:12:23.43,Default,,0000,0000,0000,,covers the electronic signals and the\Ntransmission protocols. We will look at
Dialogue: 0,0:12:23.43,0:12:27.92,Default,,0000,0000,0000,,that in some detail. And then there's part\N4, which is the inter-industry commands
Dialogue: 0,0:12:27.92,0:12:32.13,Default,,0000,0000,0000,,for interchange, which I find very\Ninteresting. And I always thought they
Dialogue: 0,0:12:32.13,0:12:35.71,Default,,0000,0000,0000,,should have met the international inter-\Nindustry commands for inter-working
Dialogue: 0,0:12:35.71,0:12:39.35,Default,,0000,0000,0000,,information interchange. But apparently\Nthey didn't come up with that. And of
Dialogue: 0,0:12:39.35,0:12:44.55,Default,,0000,0000,0000,,course, this all predates the Internet, so\Nthere's no Internet in there. Yeah. The
Dialogue: 0,0:12:44.55,0:12:48.100,Default,,0000,0000,0000,,next relevant spec is GSM technical\Nspecification eleven dot eleven. Very easy
Dialogue: 0,0:12:48.100,0:12:54.55,Default,,0000,0000,0000,,to memorize that number, which is the\Nspecification of the subscriber identity
Dialogue: 0,0:12:54.55,0:13:00.16,Default,,0000,0000,0000,,module dash mobile equipment interface. So\Nin GSM there is what's called a mobile
Dialogue: 0,0:13:00.16,0:13:03.64,Default,,0000,0000,0000,,station, which is your phone, and it is\Ncomprised of two parts, the mobile
Dialogue: 0,0:13:03.64,0:13:08.18,Default,,0000,0000,0000,,equipment, which is the hardware and the\NSIM, which is the SIM next to the mobile
Dialogue: 0,0:13:08.18,0:13:12.12,Default,,0000,0000,0000,,equipment.\NAnd it interestingly, it doesn't just
Dialogue: 0,0:13:12.12,0:13:17.34,Default,,0000,0000,0000,,refer to these ISO specs that I mentioned\Nbefore, but it actually repeats like more
Dialogue: 0,0:13:17.34,0:13:23.08,Default,,0000,0000,0000,,or less carbon copies large portions of\Nthese ISO specs with some amendments or
Dialogue: 0,0:13:23.08,0:13:28.91,Default,,0000,0000,0000,,corrections or extensions. And again, it\Ngives you the location of the contacts and
Dialogue: 0,0:13:28.91,0:13:32.63,Default,,0000,0000,0000,,the mechanical size of the card and the\Nelectronic signals and the transmission
Dialogue: 0,0:13:32.63,0:13:38.25,Default,,0000,0000,0000,,protocols and so on. But beyond these ISO\Nstandards, it also actually specifies what
Dialogue: 0,0:13:38.25,0:13:42.11,Default,,0000,0000,0000,,makes the SIM a SIM and not any other\Ncontact card, which is the information
Dialogue: 0,0:13:42.11,0:13:48.38,Default,,0000,0000,0000,,model, the file system on the card and the\Ncommands and protocols that you use on
Dialogue: 0,0:13:48.38,0:13:56.42,Default,,0000,0000,0000,,this card. And last, with typo as usual on\Nmy slides, but not least, of course, how
Dialogue: 0,0:13:56.42,0:14:03.46,Default,,0000,0000,0000,,to execute the GSM algorithm to to perform\Ncryptographic authentication.
Dialogue: 0,0:14:03.46,0:14:08.45,Default,,0000,0000,0000,,The physical smartcard interface is\Ninteresting. I mean if you've worked with
Dialogue: 0,0:14:08.45,0:14:13.58,Default,,0000,0000,0000,,hardware or electronics or serial\Ninterfaces, I think it's rather exotic and
Dialogue: 0,0:14:13.58,0:14:20.21,Default,,0000,0000,0000,,exotics always means interesting. So we\Nhave four relevant pins. We have a supply
Dialogue: 0,0:14:20.21,0:14:27.26,Default,,0000,0000,0000,,voltage, not surprisingly. It can be 5, 3\Nor 1.8 volts. Interesting, it's not 3.3
Dialogue: 0,0:14:27.26,0:14:32.02,Default,,0000,0000,0000,,volt, it's 3.0 volts nominal.\NNot sure why. But anyway, that's how it
Dialogue: 0,0:14:32.02,0:14:36.79,Default,,0000,0000,0000,,is. We have a clock line that provides a\Nclock signal which initially needs to be
Dialogue: 0,0:14:36.79,0:14:42.27,Default,,0000,0000,0000,,between 1 and 5 megahertz. So the phone\Nprovides power and clock. We have a reset
Dialogue: 0,0:14:42.27,0:14:46.59,Default,,0000,0000,0000,,line which also makes sense; you want to\Nreset the card and then we have one IO
Dialogue: 0,0:14:46.59,0:14:49.34,Default,,0000,0000,0000,,line for bi-directional serial\Ncommunication.
Dialogue: 0,0:14:49.34,0:14:54.47,Default,,0000,0000,0000,,So you have RX and TX sharing one line and\Nthere is some nice diagrams about how
Dialogue: 0,0:14:54.47,0:15:00.53,Default,,0000,0000,0000,,exactly the sequencing happens when you\Npower it up, nothing really surprising.
Dialogue: 0,0:15:00.53,0:15:04.34,Default,,0000,0000,0000,,There's an activation sequence and after\Nthe card is activated, the card will
Dialogue: 0,0:15:04.34,0:15:09.25,Default,,0000,0000,0000,,unilaterally send what's called an ATR,\Nthe answer to reset. And that's just a
Dialogue: 0,0:15:09.25,0:15:13.39,Default,,0000,0000,0000,,series of bytes which give some\Ninformation about the card capabilities.
Dialogue: 0,0:15:13.39,0:15:18.74,Default,,0000,0000,0000,,What protocols, what voltages, what clock\Nrates beyond these initial activation ones
Dialogue: 0,0:15:18.74,0:15:25.35,Default,,0000,0000,0000,,are supported. Now, after we've powered up\Nthe card, we have the bit transmission
Dialogue: 0,0:15:25.35,0:15:29.52,Default,,0000,0000,0000,,level.\NAnd it's actually very much like a normal
Dialogue: 0,0:15:29.52,0:15:38.43,Default,,0000,0000,0000,,UART. If you ever looked at RS232 or\Nanother UART a serial port, rather simple:
Dialogue: 0,0:15:38.43,0:15:45.50,Default,,0000,0000,0000,,start byte, stop byte, parity, serial bit\Ntransmission. What's a bit interesting is
Dialogue: 0,0:15:45.50,0:15:51.90,Default,,0000,0000,0000,,that we have a clock and the baud rate is\Ndivided from that clock, but it's still an
Dialogue: 0,0:15:51.90,0:15:55.67,Default,,0000,0000,0000,,asynchronous transmission. So there is no\Nphase relationship between the clock
Dialogue: 0,0:15:55.67,0:15:59.79,Default,,0000,0000,0000,,signal and the baud rate that the data\Nuses, which lots of people get wrong,
Dialogue: 0,0:15:59.79,0:16:04.11,Default,,0000,0000,0000,,particularly lots of authors of Atmel\Nmicrocontroller data sheets which claim
Dialogue: 0,0:16:04.11,0:16:08.62,Default,,0000,0000,0000,,that it's a synchronous communication,\Nwhich it is not. Yeah.
Dialogue: 0,0:16:08.62,0:16:12.100,Default,,0000,0000,0000,,So the direction changes every so often to\Nhave acknowledgements back and forth and
Dialogue: 0,0:16:12.100,0:16:17.02,Default,,0000,0000,0000,,to exchange data in both directions. And\Ninterestingly, a lot of the timings are
Dialogue: 0,0:16:17.02,0:16:20.98,Default,,0000,0000,0000,,not specified very well, but I guess\Nnobody cares about that, other than if you
Dialogue: 0,0:16:20.98,0:16:26.98,Default,,0000,0000,0000,,want to implement a card reader, which I\Nhappen to have gone through this year.
Dialogue: 0,0:16:26.98,0:16:32.87,Default,,0000,0000,0000,,Smart Card Communication: after we are\Nable to transmit bytes between the card
Dialogue: 0,0:16:32.87,0:16:37.64,Default,,0000,0000,0000,,and the reader, we have something called\NAPDUs. The Application Protocol Data Unit
Dialogue: 0,0:16:37.64,0:16:42.55,Default,,0000,0000,0000,,specified as per that ISO 7816-4. That's\Nthe inter-industry commands for
Dialogue: 0,0:16:42.55,0:16:50.98,Default,,0000,0000,0000,,interchange. And an APDU consists of a\Ncouple of bytes. There's a class byte that
Dialogue: 0,0:16:50.98,0:16:54.72,Default,,0000,0000,0000,,just specifies the class of command as an\Ninstruction byte which specifies the
Dialogue: 0,0:16:54.72,0:16:59.25,Default,,0000,0000,0000,,specific instruction like read a file,\Nwrite a file. We have some parameter bytes
Dialogue: 0,0:16:59.25,0:17:04.80,Default,,0000,0000,0000,,whose meaning is relevant or is specific\Nto the instruction, then we have a length
Dialogue: 0,0:17:04.80,0:17:09.27,Default,,0000,0000,0000,,of a command and command data. We have an\Nexpected response length and response data.
Dialogue: 0,0:17:09.27,0:17:13.77,Default,,0000,0000,0000,,And last but not least, a so-called status\Nword and the status word basically, the
Dialogue: 0,0:17:13.77,0:17:18.93,Default,,0000,0000,0000,,card tells whether the execution was\Nsuccessful or whether there was some error
Dialogue: 0,0:17:18.93,0:17:26.02,Default,,0000,0000,0000,,and what kind of error there was and\Nthings like that. The APDUs are then split
Dialogue: 0,0:17:26.02,0:17:31.18,Default,,0000,0000,0000,,into a lower layer transport protocol,\Nwhich are called TPDUs.
Dialogue: 0,0:17:31.18,0:17:36.00,Default,,0000,0000,0000,,There are two different commonly used\Nprotocols and two specific ones that are
Dialogue: 0,0:17:36.00,0:17:39.97,Default,,0000,0000,0000,,used in the context of SIM cards ore are\Nspecified in the context of SIM cards, as
Dialogue: 0,0:17:39.97,0:17:45.93,Default,,0000,0000,0000,,one called T=0. Which is most commonly\Nused for SIM cards. Actually, I've never
Dialogue: 0,0:17:45.93,0:17:53.02,Default,,0000,0000,0000,,seen anything else but T=0 used, but T=1\Nis another protocol which according to the
Dialogue: 0,0:17:53.02,0:17:59.77,Default,,0000,0000,0000,,specs, every phone needs to implement. And\Nthe card can choose if it does T=0 or T=1.
Dialogue: 0,0:17:59.77,0:18:04.93,Default,,0000,0000,0000,,As again, I've never seen a card that does\NT=1, or at least that has only T=1, but
Dialogue: 0,0:18:04.93,0:18:10.41,Default,,0000,0000,0000,,the specs would allow that. T=1 is more\Nused in banking and crypto smart cards.
Dialogue: 0,0:18:10.41,0:18:16.05,Default,,0000,0000,0000,,The difference mainly is T=1 is a block\Noriented transfer and T=0 is more a byte
Dialogue: 0,0:18:16.05,0:18:21.06,Default,,0000,0000,0000,,oriented transfer. And T=1 has the\Nadvantage that it has CRC and checksumming,
Dialogue: 0,0:18:21.06,0:18:24.88,Default,,0000,0000,0000,,so you get more protection\Nagainst transmission errors which you
Dialogue: 0,0:18:24.88,0:18:34.21,Default,,0000,0000,0000,,don't have in T=0. So the APDU gets mapped\Nto TPDUs. Details I'll skip here and this
Dialogue: 0,0:18:34.21,0:18:37.11,Default,,0000,0000,0000,,is just some examples, so you get an idea\Nhow this looks like.
Dialogue: 0,0:18:37.11,0:18:45.92,Default,,0000,0000,0000,,So we have A0 A4 00 00 02 3F 00. The A0\Nhere is the class byte and A0 is SIM card
Dialogue: 0,0:18:45.92,0:18:51.79,Default,,0000,0000,0000,,class. A4 is select file.\NSo you're selecting a certain file on
Dialogue: 0,0:18:51.79,0:18:56.66,Default,,0000,0000,0000,,which you want to operate. Two parameter\Nbytes are 0, 02 is the length of the
Dialogue: 0,0:18:56.66,0:19:02.41,Default,,0000,0000,0000,,command. And then you have two bytes of\Nthat length 3F 00, which is basically your
Dialogue: 0,0:19:02.41,0:19:06.55,Default,,0000,0000,0000,,slash, your root directory. You want to\Nchange to the root directory of the file
Dialogue: 0,0:19:06.55,0:19:11.82,Default,,0000,0000,0000,,system, is basically what that command\Nsays. And one hypothetical response is
Dialogue: 0,0:19:11.82,0:19:21.55,Default,,0000,0000,0000,,just a status word 90 00, which means\Nsuccess. Yeah. Selecting a file. So we
Dialogue: 0,0:19:21.55,0:19:28.18,Default,,0000,0000,0000,,have a file system on the card. Most smart\Ncards do that. It's not a file system in
Dialogue: 0,0:19:28.18,0:19:33.52,Default,,0000,0000,0000,,the context like you have a USB drive that\Nyou can mount, where you just have a block
Dialogue: 0,0:19:33.52,0:19:37.96,Default,,0000,0000,0000,,abstraction or something.\NBut the smart card filesystem itself runs
Dialogue: 0,0:19:37.96,0:19:42.64,Default,,0000,0000,0000,,inside the card and you just talk to the\Nfilesystem and give it instructions. So if
Dialogue: 0,0:19:42.64,0:19:47.26,Default,,0000,0000,0000,,you want to find an abstraction in PC\Ntechnology, it's more like MTP or PTP over
Dialogue: 0,0:19:47.26,0:19:52.86,Default,,0000,0000,0000,,USB where you don't have a block device,\Nbut you talk to another processor which
Dialogue: 0,0:19:52.86,0:19:57.97,Default,,0000,0000,0000,,manages a file system and you can instruct\Nit's like a remote file system access.
Dialogue: 0,0:19:57.97,0:20:02.50,Default,,0000,0000,0000,,You have some similarities to normal file\Nsystems. I mean, there's a master file
Dialogue: 0,0:20:02.50,0:20:07.14,Default,,0000,0000,0000,,which corresponds to a root directory in\NPC file systems. You have so called
Dialogue: 0,0:20:07.14,0:20:12.10,Default,,0000,0000,0000,,dedicated files, which are sub directories\Nand you have so called elementary files,
Dialogue: 0,0:20:12.10,0:20:17.61,Default,,0000,0000,0000,,which are actual data containing files as\Nwe know them. Beyond that, there are lots
Dialogue: 0,0:20:17.61,0:20:26.06,Default,,0000,0000,0000,,of specifics that we don't find PC file\Nsystems or operating system file systems.
Dialogue: 0,0:20:26.06,0:20:32.70,Default,,0000,0000,0000,,We have what's called a transparent EF.\NThat's an opaque stream of data like your
Dialogue: 0,0:20:32.70,0:20:36.46,Default,,0000,0000,0000,,normal binary file on on any random\Noperating system. But then we have
Dialogue: 0,0:20:36.46,0:20:42.32,Default,,0000,0000,0000,,concepts like a linear fixed EF which\Ncontains fixed size records and you can
Dialogue: 0,0:20:42.32,0:20:46.81,Default,,0000,0000,0000,,seek against it. Get me the 15th\Nrecord in that file and the file has a
Dialogue: 0,0:20:46.81,0:20:50.44,Default,,0000,0000,0000,,record size of whatever 24 bytes for\Nexample. And then you have something
Dialogue: 0,0:20:50.44,0:20:56.17,Default,,0000,0000,0000,,called a cyclic EF where they have a ring\Nbuffer of records and you have
Dialogue: 0,0:20:56.17,0:21:00.31,Default,,0000,0000,0000,,incrementable files which contain\Nmonotonically incrementing counters and
Dialogue: 0,0:21:00.31,0:21:05.00,Default,,0000,0000,0000,,things that are apparently important for\Ncharging or things like that.
Dialogue: 0,0:21:05.00,0:21:14.12,Default,,0000,0000,0000,,Each file has access control conditions\Nthat define who can read and or modify and
Dialogue: 0,0:21:14.12,0:21:20.14,Default,,0000,0000,0000,,or well, there's no delete, but there's\Nsomething called invalidate the file. And
Dialogue: 0,0:21:20.14,0:21:25.62,Default,,0000,0000,0000,,who is basically expressed in context of\Nwhich PIN was used to authenticate that
Dialogue: 0,0:21:25.62,0:21:29.88,Default,,0000,0000,0000,,entity, which performs the operation.\NSo as a user, you have a PIN1 and some
Dialogue: 0,0:21:29.88,0:21:35.62,Default,,0000,0000,0000,,people will remember you also have a PIN2,\Nthat probably nobody's used since the 90s.
Dialogue: 0,0:21:35.62,0:21:39.88,Default,,0000,0000,0000,,And the operator has something called an\NADM PIN, administrative pin, which gives
Dialogue: 0,0:21:39.88,0:21:46.88,Default,,0000,0000,0000,,better or higher privileges in terms of\Nfilesystem permissions on those files. The
Dialogue: 0,0:21:46.88,0:21:53.98,Default,,0000,0000,0000,,kind of commands we see, well, select file\Nfrom the example. We have read record,
Dialogue: 0,0:21:53.98,0:21:57.77,Default,,0000,0000,0000,,update records. I guess I don't need to\Nsay anything about that. Similarly, read
Dialogue: 0,0:21:57.77,0:22:04.78,Default,,0000,0000,0000,,binary, update binary. And then we have\Ncommands like CHV commands, where CHV is
Dialogue: 0,0:22:04.78,0:22:10.64,Default,,0000,0000,0000,,the cardholder verification which is ETSI\Nlanguage for a pin. Not sure why they
Dialogue: 0,0:22:10.64,0:22:17.34,Default,,0000,0000,0000,,don't call it PIN. So there's change PIN,\Ndisable PIN or enable PIN commands. Which
Dialogue: 0,0:22:17.34,0:22:20.96,Default,,0000,0000,0000,,is actually what your phone performs, if\Nyou, say, you disable the PIN or you
Dialogue: 0,0:22:20.96,0:22:24.91,Default,,0000,0000,0000,,change the PIN then exactly those commands\Nare issued to the card and last but not
Dialogue: 0,0:22:24.91,0:22:29.54,Default,,0000,0000,0000,,least, run GSM algorithm. Remember, this\Nis still the 2G only SIM. We haven't yet
Dialogue: 0,0:22:29.54,0:22:34.99,Default,,0000,0000,0000,,gone beyond 2G, yet at this point in the\Nslides. There is actually not that many
Dialogue: 0,0:22:34.99,0:22:40.96,Default,,0000,0000,0000,,more. That's that's really it. Now let's\Nlook at the file system hierarchy. We have
Dialogue: 0,0:22:40.96,0:22:45.61,Default,,0000,0000,0000,,the MF, the root file system and then we\Nhave something called DF_TELECOM. And the
Dialogue: 0,0:22:45.61,0:22:49.18,Default,,0000,0000,0000,,hex numbers in parentheses are the\Nidentifiers that are actually used on the
Dialogue: 0,0:22:49.18,0:22:53.59,Default,,0000,0000,0000,,protocol level. We have something called\NDF_GSM, which is the GSM directory
Dialogue: 0,0:22:53.59,0:23:01.70,Default,,0000,0000,0000,,containing GSM related parameters. And if\NEF_ICCID where ICCID is the card unique
Dialogue: 0,0:23:01.70,0:23:06.71,Default,,0000,0000,0000,,identifier that's stored on the card. And\Nif you expand that into more details, you
Dialogue: 0,0:23:06.71,0:23:10.67,Default,,0000,0000,0000,,get these kind of graphs. And this is one\Nis actually taken from one of the specs.
Dialogue: 0,0:23:10.67,0:23:18.02,Default,,0000,0000,0000,,And you see there's also an Iridium\Ndirectory or a, uh, whatever that one was,
Dialogue: 0,0:23:18.02,0:23:21.44,Default,,0000,0000,0000,,a Global Star directory.\NAnd all kinds of people operating
Dialogue: 0,0:23:21.44,0:23:26.06,Default,,0000,0000,0000,,different telephony system have basically\Ntheir own directories in that scheme. But
Dialogue: 0,0:23:26.06,0:23:33.02,Default,,0000,0000,0000,,on GSM, we find those two mainly, maybe\Nsome sub directories. Yeah, so when 3G
Dialogue: 0,0:23:33.02,0:23:41.60,Default,,0000,0000,0000,,came around something happened, as I said,\Nthe specifications were shifted from ETSI
Dialogue: 0,0:23:41.60,0:23:49.38,Default,,0000,0000,0000,,to a 3GPP. But of course, chip cards in\Nthe context of telecom have use cases
Dialogue: 0,0:23:49.38,0:23:55.27,Default,,0000,0000,0000,,outside of cellular telephony. So,\Nactually, the specs were split in that
Dialogue: 0,0:23:55.27,0:23:59.89,Default,,0000,0000,0000,,area. So there's something new called the\NUICC, the Universal Integrated Circuit
Dialogue: 0,0:23:59.89,0:24:05.87,Default,,0000,0000,0000,,Card, because the previous one was not\Nuniversal, apparently. And that part of
Dialogue: 0,0:24:05.87,0:24:10.21,Default,,0000,0000,0000,,the specs remained with ETSI and continues\Nto be developed. And there is the USIM
Dialogue: 0,0:24:10.21,0:24:18.17,Default,,0000,0000,0000,,application on top of the UICC, which is\Nwhat specifies the 3GPP relevant part and
Dialogue: 0,0:24:18.17,0:24:24.88,Default,,0000,0000,0000,,that gets implemented in something called\Nan ADF, an application dedicated file, ADF
Dialogue: 0,0:24:24.88,0:24:29.80,Default,,0000,0000,0000,,USIM.\NIn ADF you can also select or enter using
Dialogue: 0,0:24:29.80,0:24:35.63,Default,,0000,0000,0000,,a select command similar to a normal DF.\NThe difference mainly is that the
Dialogue: 0,0:24:35.63,0:24:40.13,Default,,0000,0000,0000,,identifiers on much longer and thus other\Ndetails, but from a user point of view
Dialogue: 0,0:24:40.13,0:24:45.50,Default,,0000,0000,0000,,that's how it looks like. So we have a\Nsplit of the core Universal ICC and on top
Dialogue: 0,0:24:45.50,0:24:52.30,Default,,0000,0000,0000,,an USIM application. And if you have a SIM\Ncard that can be used with 2G and with 3G,
Dialogue: 0,0:24:52.30,0:24:55.93,Default,,0000,0000,0000,,then you basically have the classic SIM\Ncard and in addition you have a USIM
Dialogue: 0,0:24:55.93,0:24:59.66,Default,,0000,0000,0000,,application on the card.\NAnd actually there are some cards that
Dialogue: 0,0:24:59.66,0:25:04.62,Default,,0000,0000,0000,,only work with 3G or later technology and\Ndon't have 2G mode, because the operator
Dialogue: 0,0:25:04.62,0:25:08.68,Default,,0000,0000,0000,,doesn't have a 2G network. So you only\Nhave a USIM application and you don't have
Dialogue: 0,0:25:08.68,0:25:15.77,Default,,0000,0000,0000,,the classic SIM anymore on the card. When\N4G/LTE came around, actually there was no
Dialogue: 0,0:25:15.77,0:25:20.47,Default,,0000,0000,0000,,strict requirement to change anything in\Nthe SIM card and you can just use a normal
Dialogue: 0,0:25:20.47,0:25:27.10,Default,,0000,0000,0000,,USIM, UMTS SIM, a 3G card on LTE networks.\NIt's the same authentication key agreement
Dialogue: 0,0:25:27.10,0:25:32.63,Default,,0000,0000,0000,,mechanism. They have added some additional\Nfiles that are completely optional. Mostly
Dialogue: 0,0:25:32.63,0:25:39.67,Default,,0000,0000,0000,,like optimizing some bits and there are\Nsome optional new IMS application. IMS is
Dialogue: 0,0:25:39.67,0:25:47.18,Default,,0000,0000,0000,,the IP multimedia system which is 3GPP\Nlanguage for voice over IP or VoLTE,
Dialogue: 0,0:25:47.18,0:25:52.92,Default,,0000,0000,0000,,right? So IMS is the IP multimedia system,\Nwhich is what is used to implement VoLTE
Dialogue: 0,0:25:52.92,0:25:58.14,Default,,0000,0000,0000,,where VoLTE is not a specification term\Nbut more a marketing term and that's
Dialogue: 0,0:25:58.14,0:26:01.41,Default,,0000,0000,0000,,optionally on the SIM card.\NYou can have an ISIM an application which
Dialogue: 0,0:26:01.41,0:26:05.43,Default,,0000,0000,0000,,stores parameters relevant to the IP\Nmultimedia system such as SIP user
Dialogue: 0,0:26:05.43,0:26:09.43,Default,,0000,0000,0000,,identities and SIP service and things like\Nthat. But if that ISIM application doesn't
Dialogue: 0,0:26:09.43,0:26:13.21,Default,,0000,0000,0000,,exist, there is a fallback mechanism by\Nwhich the identifiers are computed based
Dialogue: 0,0:26:13.21,0:26:16.77,Default,,0000,0000,0000,,on the IMSI and and so on and so on. So\Nit's not really necessary to have a
Dialogue: 0,0:26:16.77,0:26:25.68,Default,,0000,0000,0000,,specific 4G SIM, but it's possible to have\Nthat. Once we go to 5G, 5G actually reuses
Dialogue: 0,0:26:25.68,0:26:33.03,Default,,0000,0000,0000,,the existing 3G and 4G USIM cards. Again,\Nsome new optional files have been
Dialogue: 0,0:26:33.03,0:26:38.40,Default,,0000,0000,0000,,introduced and there is one feature which\NI guess everyone in here wants to have,
Dialogue: 0,0:26:38.40,0:26:43.82,Default,,0000,0000,0000,,which would require a new SIM card or\Nchange SIM card, which is that the SUCI,
Dialogue: 0,0:26:43.82,0:26:50.33,Default,,0000,0000,0000,,the Subscriber Concealed Identifier, can\Nbe computed inside the SIM card or by the
Dialogue: 0,0:26:50.33,0:26:55.17,Default,,0000,0000,0000,,phone.\NAnd if it is computed inside the SIM card,
Dialogue: 0,0:26:55.17,0:27:00.32,Default,,0000,0000,0000,,then the SIM of course has to have support\Nfor doing that computation and that is
Dialogue: 0,0:27:00.32,0:27:04.54,Default,,0000,0000,0000,,something that needs explicit SIM card\Nsupport. In absence of that, everything
Dialogue: 0,0:27:04.54,0:27:09.10,Default,,0000,0000,0000,,else you can use an existing 4G SIM card\Neven on 5G networks. Nothing really
Dialogue: 0,0:27:09.10,0:27:16.34,Default,,0000,0000,0000,,changed there, fundamentally.\NOK, now looking at the cards, more on the
Dialogue: 0,0:27:16.34,0:27:21.00,Default,,0000,0000,0000,,physical side and from the hardware and we\Nwill look at the software, the operating
Dialogue: 0,0:27:21.00,0:27:27.96,Default,,0000,0000,0000,,systems and so on and the various things\Nyou can do with SIM cards later on. We
Dialogue: 0,0:27:27.96,0:27:32.28,Default,,0000,0000,0000,,have, of course, the processor core that\Nmany different vendors and architectures,
Dialogue: 0,0:27:32.28,0:27:38.07,Default,,0000,0000,0000,,traditionally lots of 8051 derivatives\Ninside smart cards. These days we also
Dialogue: 0,0:27:38.07,0:27:44.59,Default,,0000,0000,0000,,actually find a lot ??? ARM cores, quite\Noften so-called SC cores. There's an SC000
Dialogue: 0,0:27:44.59,0:27:50.01,Default,,0000,0000,0000,,and then a SC100 and an SC300 and SC is\Nfor Secure Core.
Dialogue: 0,0:27:50.01,0:27:53.59,Default,,0000,0000,0000,,So it's not a normal Cortex core or\Nsomething like that, but it's a secure
Dialogue: 0,0:27:53.59,0:27:57.87,Default,,0000,0000,0000,,core and it's so secure that ARM doesn't\Neven disclose what is secure about it
Dialogue: 0,0:27:57.87,0:28:03.77,Default,,0000,0000,0000,,other than that it is secure. And so the\Ndocumentation for sure is securely kept
Dialogue: 0,0:28:03.77,0:28:11.64,Default,,0000,0000,0000,,away from anyone who would want to read\Nit. So, for these chips, the smartcard
Dialogue: 0,0:28:11.64,0:28:16.44,Default,,0000,0000,0000,,chips used in SIM cards or generally smart\Ncard chips themselves, often you cannot
Dialogue: 0,0:28:16.44,0:28:20.25,Default,,0000,0000,0000,,even find a similar thing, simple one page\Ndata sheet which tells you the main
Dialogue: 0,0:28:20.25,0:28:27.34,Default,,0000,0000,0000,,features. Even that is already under NDA.\NYou have built-in RAM and built-in ROM, at
Dialogue: 0,0:28:27.34,0:28:31.94,Default,,0000,0000,0000,,least a bootloader normally, but possibly\Nalso the OS or parts of the OS, but that
Dialogue: 0,0:28:31.94,0:28:36.55,Default,,0000,0000,0000,,is increasingly uncommon. So modern cards,\Nmost of them only have flash and the
Dialogue: 0,0:28:36.55,0:28:41.11,Default,,0000,0000,0000,,entire operating system is in flash, so\Nyou can update everything. And then
Dialogue: 0,0:28:41.11,0:28:44.85,Default,,0000,0000,0000,,applications on top of that and we will\Nlook at applications later when we talk
Dialogue: 0,0:28:44.85,0:28:49.64,Default,,0000,0000,0000,,about the software.\NAnd unfortunately, contrary to the crypto
Dialogue: 0,0:28:49.64,0:28:55.32,Default,,0000,0000,0000,,smartcards where it's possible to have\Nhigher prices and therefore have, you
Dialogue: 0,0:28:55.32,0:29:01.08,Default,,0000,0000,0000,,know, rather expensive products, SIM cards\Nare mostly selected purely by cost these
Dialogue: 0,0:29:01.08,0:29:06.38,Default,,0000,0000,0000,,days due to the prepaid boom. I mean, it\Nwas different when GSM was introduced. If
Dialogue: 0,0:29:06.38,0:29:10.06,Default,,0000,0000,0000,,you, if every subscriber has to get a\Nsubscription and there's going to be
Dialogue: 0,0:29:10.06,0:29:14.49,Default,,0000,0000,0000,,hundreds of Euros or Marks of whatever in\Nrevenue, then you can invest a lot of
Dialogue: 0,0:29:14.49,0:29:19.36,Default,,0000,0000,0000,,money in a SIM card, but prepaid cards\Nthat get thrown away on a daily basis you
Dialogue: 0,0:29:19.36,0:29:23.28,Default,,0000,0000,0000,,can only pay cents for the card and then\Nyou need to pay another a couple of cents
Dialogue: 0,0:29:23.28,0:29:29.31,Default,,0000,0000,0000,,for the Java card for the Java VM patent\Nroyalties and so on and so on. But
Dialogue: 0,0:29:29.31,0:29:35.14,Default,,0000,0000,0000,,basically you cannot afford to pay money\Nfor SIM cards anymore. So that also
Dialogue: 0,0:29:35.14,0:29:38.80,Default,,0000,0000,0000,,explains why a lot of SIM cards today,\Neven though it's technically available,
Dialogue: 0,0:29:38.80,0:29:42.75,Default,,0000,0000,0000,,they don't have hardware crypto, but they\Nactually implement it in software, because
Dialogue: 0,0:29:42.75,0:29:48.16,Default,,0000,0000,0000,,it's cheaper. And then of course, yeah,\Nwell, you have time of execution, things
Dialogue: 0,0:29:48.16,0:29:53.01,Default,,0000,0000,0000,,and whatnot.\NSo in terms of software, you have a Card
Dialogue: 0,0:29:53.01,0:29:58.83,Default,,0000,0000,0000,,Operating System. Cards that don't have an\Noperating system are memory cards which
Dialogue: 0,0:29:58.83,0:30:07.50,Default,,0000,0000,0000,,are not sufficient for SIM card use cases.\NAnd in the crypto smartcard area, it's the
Dialogue: 0,0:30:07.50,0:30:15.85,Default,,0000,0000,0000,,operating systems are typically well known\Nand documented to some part, at least. In
Dialogue: 0,0:30:15.85,0:30:19.51,Default,,0000,0000,0000,,SIM cards it's slightly different. So\Nalmost nobody ever mentions what kind of
Dialogue: 0,0:30:19.51,0:30:27.47,Default,,0000,0000,0000,,operating system is on the SIM card and\Neven the SIM card vendors. It's not very,
Dialogue: 0,0:30:27.47,0:30:31.69,Default,,0000,0000,0000,,you know, not something they would put on\Ntheir marketing, or on their homepage or
Dialogue: 0,0:30:31.69,0:30:34.64,Default,,0000,0000,0000,,something, what exactly kind of operating\Nsystems are on there.
Dialogue: 0,0:30:34.64,0:30:38.33,Default,,0000,0000,0000,,The SIM card offering system also from\Nthe central network point of view as an
Dialogue: 0,0:30:38.33,0:30:43.47,Default,,0000,0000,0000,,implementation detail, because all the\Nrelevant parts are specified standardised
Dialogue: 0,0:30:43.47,0:30:48.11,Default,,0000,0000,0000,,interfaces and what operating system\Npeople use on the card, well, it's the
Dialogue: 0,0:30:48.11,0:30:53.49,Default,,0000,0000,0000,,operator's choice. It doesn't really\Nmatter from that point of view. In early
Dialogue: 0,0:30:53.49,0:30:58.07,Default,,0000,0000,0000,,SIM cards, I presume they were rather\Nmonolithic, so you didn't really have a
Dialogue: 0,0:30:58.07,0:31:02.34,Default,,0000,0000,0000,,separation between an operating system and\NSIM application. Today the software's
Dialogue: 0,0:31:02.34,0:31:06.55,Default,,0000,0000,0000,,become more modular. We have this\Nabstraction between the operating system
Dialogue: 0,0:31:06.55,0:31:12.54,Default,,0000,0000,0000,,and applications. And traditionally, even\Nwhen that separation already existed, the
Dialogue: 0,0:31:12.54,0:31:15.64,Default,,0000,0000,0000,,operating system was very hardware\Ndependent, non-portable and the
Dialogue: 0,0:31:15.64,0:31:22.26,Default,,0000,0000,0000,,applications were very OS-dependent and\Nnon-portable. And that has changed a bit
Dialogue: 0,0:31:22.26,0:31:29.83,Default,,0000,0000,0000,,due to the introduction of Java cards into\Nthe SIM card area, which is not required.
Dialogue: 0,0:31:29.83,0:31:35.25,Default,,0000,0000,0000,,There there's no requirement anywhere that\Nthe SIM card must be a Java card, but in
Dialogue: 0,0:31:35.25,0:31:38.95,Default,,0000,0000,0000,,practice, most SIM cards are Java cards\Nbecause they have certain, at least
Dialogue: 0,0:31:38.95,0:31:45.19,Default,,0000,0000,0000,,perceived, advantages and are the norm by\Nnow. And the Java cards themselves have
Dialogue: 0,0:31:45.19,0:31:53.02,Default,,0000,0000,0000,,been independently developed of SIM cards.\NOf course, Java is a Sun technology, so
Dialogue: 0,0:31:53.02,0:31:58.51,Default,,0000,0000,0000,,Sun is behind that. And the first actual\Ncards that were produced in 96, so much
Dialogue: 0,0:31:58.51,0:32:05.25,Default,,0000,0000,0000,,later than SIM cards came out by\NSchlumberger which is now part of Gemalto.
Dialogue: 0,0:32:05.25,0:32:13.45,Default,,0000,0000,0000,,And um, yeah, we have redundant lines in\Nthis presentation. And so, the Java cards,
Dialogue: 0,0:32:13.45,0:32:17.81,Default,,0000,0000,0000,,most of them implement a global platform\Nspecifications, which then specify vendor
Dialogue: 0,0:32:17.81,0:32:24.97,Default,,0000,0000,0000,,independent management of the cards and\Nthe applications on it. And the Java that
Dialogue: 0,0:32:24.97,0:32:29.43,Default,,0000,0000,0000,,you use to write such cards, don't ever\Nthink it is real Java! I mean, if you show
Dialogue: 0,0:32:29.43,0:32:33.50,Default,,0000,0000,0000,,that to any Java developer, he will\Nprobably disappear very quickly as we have
Dialogue: 0,0:32:33.50,0:32:38.04,Default,,0000,0000,0000,,a very weird constrained subset of Java\Nwith a special on-card virtual machine,
Dialogue: 0,0:32:38.04,0:32:41.100,Default,,0000,0000,0000,,which is not a normal virtual machine. You\Nhave a runtime environment that's not the
Dialogue: 0,0:32:41.100,0:32:46.22,Default,,0000,0000,0000,,normal runtime environment. You have a\Nspecial binary format which is not a char
Dialogue: 0,0:32:46.22,0:32:50.30,Default,,0000,0000,0000,,file.\NAnd the idea is that you have portability
Dialogue: 0,0:32:50.30,0:32:56.99,Default,,0000,0000,0000,,of card applications, which makes sense,\Nof course. But one could have done that
Dialogue: 0,0:32:56.99,0:33:02.24,Default,,0000,0000,0000,,with, you know, whatever other standards\Nas well. Wouldn't necessarily need a
Dialogue: 0,0:33:02.24,0:33:08.46,Default,,0000,0000,0000,,virtual machine for that. Yeah, I said\Nthere's no functional requirement that a
Dialogue: 0,0:33:08.46,0:33:11.98,Default,,0000,0000,0000,,SIM card must be a Java card, but in\Nreality that's the case. I think the
Dialogue: 0,0:33:11.98,0:33:15.93,Default,,0000,0000,0000,,portability is the driver here. So, if an\Noperator develops some application that
Dialogue: 0,0:33:15.93,0:33:21.04,Default,,0000,0000,0000,,runs on a SIM card, you know, every year\Nor so they do a new tender or they have a
Dialogue: 0,0:33:21.04,0:33:25.24,Default,,0000,0000,0000,,new SIM card supplier or something like\Nthat, they want to run their application
Dialogue: 0,0:33:25.24,0:33:32.26,Default,,0000,0000,0000,,on the current and the future and the next\Nfuture future SIM card and not rewrite all
Dialogue: 0,0:33:32.26,0:33:37.45,Default,,0000,0000,0000,,of that from scratch or have that\Nrewritten from scratch all the time.
Dialogue: 0,0:33:37.45,0:33:44.44,Default,,0000,0000,0000,,And interestingly, both 3GPP and ETSI\Nspecify Java APIs and Java packages, which
Dialogue: 0,0:33:44.44,0:33:48.35,Default,,0000,0000,0000,,are specifically available on Java cards\Nthat also are SIM cards. So basically you
Dialogue: 0,0:33:48.35,0:33:51.97,Default,,0000,0000,0000,,have SIM card specs and you have Java\Ncard specs and if you have both of them
Dialogue: 0,0:33:51.97,0:33:58.56,Default,,0000,0000,0000,,together, you also have SIM card Java API\Nspecs for what kind of additional API's
Dialogue: 0,0:33:58.56,0:34:04.95,Default,,0000,0000,0000,,applications on the card can use in order\Nto affect SIM relevant aspects of the
Dialogue: 0,0:34:04.95,0:34:12.27,Default,,0000,0000,0000,,card. Which brings us to one of the\Nstrange historic developments called SIM
Dialogue: 0,0:34:12.27,0:34:20.37,Default,,0000,0000,0000,,Toolkit or later Card Application Toolkit,\Nwhich is sort of an ability to offer
Dialogue: 0,0:34:20.37,0:34:23.62,Default,,0000,0000,0000,,applications with UI and menu on the\Nphone, right?
Dialogue: 0,0:34:23.62,0:34:30.46,Default,,0000,0000,0000,,I mean the card of course doesn't have any\Nuser interface, but the card can sort of
Dialogue: 0,0:34:30.46,0:34:35.52,Default,,0000,0000,0000,,request like show a menu and offer\Nmultiple choices and things like that.
Dialogue: 0,0:34:35.52,0:34:39.61,Default,,0000,0000,0000,,Some people will have seen it on some\Nphones. You have this SIM toolkit menu
Dialogue: 0,0:34:39.61,0:34:46.05,Default,,0000,0000,0000,,somewhere. And I mean, I think in Germany\Nnever really took off much in terms of
Dialogue: 0,0:34:46.05,0:34:50.32,Default,,0000,0000,0000,,actual applications. I mean, you could\Nprobably subscribe to some very expensive
Dialogue: 0,0:34:50.32,0:34:57.73,Default,,0000,0000,0000,,premium SMS services. If you were really\Nbored, but in other regions, this has been
Dialogue: 0,0:34:57.73,0:35:07.11,Default,,0000,0000,0000,,very successful and very organized, had a\Nreal impact on society. Kenya is always
Dialogue: 0,0:35:07.11,0:35:13.13,Default,,0000,0000,0000,,the, I think the prime example for that,\Nwhere MPESA, the mobile payment
Dialogue: 0,0:35:13.13,0:35:16.76,Default,,0000,0000,0000,,system, implemented at least initially\Nbased on card application toolkit
Dialogue: 0,0:35:16.76,0:35:22.09,Default,,0000,0000,0000,,applications, basically overtook the\Nbanking sector. At some point everybody
Dialogue: 0,0:35:22.09,0:35:25.95,Default,,0000,0000,0000,,did their wire transfers that way, even\Npeople who didn't even have a bank account
Dialogue: 0,0:35:25.95,0:35:30.96,Default,,0000,0000,0000,,and it basically replaced or substituted\Nlarge amounts of the everyday banking
Dialogue: 0,0:35:30.96,0:35:37.16,Default,,0000,0000,0000,,needs of people. So there are exceptions.\NSome additional instructions that we have
Dialogue: 0,0:35:37.16,0:35:43.85,Default,,0000,0000,0000,,in terms of APDUs, details I will not look\Ninto these. The next step after SIM
Dialogue: 0,0:35:43.85,0:35:48.98,Default,,0000,0000,0000,,toolkit is the so-called proactive SIM. If\Nwe look at the SIM card communication as
Dialogue: 0,0:35:48.98,0:35:52.42,Default,,0000,0000,0000,,it is specified, or smartcard\Ncommunication in general, it's always the
Dialogue: 0,0:35:52.42,0:35:57.73,Default,,0000,0000,0000,,reader, in this context the phone, that\Nsort of sends an instruction to the phone,
Dialogue: 0,0:35:57.73,0:36:02.15,Default,,0000,0000,0000,,to the card and the card responds. So the\Ncard is always the slave in the
Dialogue: 0,0:36:02.15,0:36:06.54,Default,,0000,0000,0000,,communication and it doesn't have any\Npossibility to trigger something by
Dialogue: 0,0:36:06.54,0:36:10.34,Default,,0000,0000,0000,,itself.\NAnd that was sort of worked around by the
Dialogue: 0,0:36:10.34,0:36:16.65,Default,,0000,0000,0000,,proactive SIM specifications where a\Ncommand or a request from the card is
Dialogue: 0,0:36:16.65,0:36:22.88,Default,,0000,0000,0000,,piggy-backed into responses to the\Ncommands from their phone to the card, and
Dialogue: 0,0:36:22.88,0:36:28.73,Default,,0000,0000,0000,,then basically that the SIM card can\Nrequest the phone to poll the card every
Dialogue: 0,0:36:28.73,0:36:32.92,Default,,0000,0000,0000,,so often, so the phone can ask for "do you\Nhave a new command for me now?" and the
Dialogue: 0,0:36:32.92,0:36:38.33,Default,,0000,0000,0000,,card can say yes or no. In this way, they\Nwork around this restriction.
Dialogue: 0,0:36:38.33,0:36:41.54,Default,,0000,0000,0000,,And it's not only polling that can be\Nrequested, but it can be event
Dialogue: 0,0:36:41.54,0:36:46.45,Default,,0000,0000,0000,,notifications. And event notifications can\Nbe loss of network coverage, registration
Dialogue: 0,0:36:46.45,0:36:53.52,Default,,0000,0000,0000,,to a new cell, opening of a web browser\Nand like are you making a mobile
Dialogue: 0,0:36:53.52,0:36:55.72,Default,,0000,0000,0000,,originated call, are you sending an SMS or\Nnot?
Dialogue: 0,0:36:55.72,0:37:00.11,Default,,0000,0000,0000,,So all these kind of events can be sent to\Nthe SIM card, so that the SIM card can do
Dialogue: 0,0:37:00.11,0:37:07.26,Default,,0000,0000,0000,,whatever with it. I think that not many\Nuseful applications beyond steering of
Dialogue: 0,0:37:07.26,0:37:11.68,Default,,0000,0000,0000,,roaming or roaming control, by basically\Ndepending on where you register and what
Dialogue: 0,0:37:11.68,0:37:15.94,Default,,0000,0000,0000,,kind of cells you have, and even the\Nmeasurement reports on what is the signal
Dialogue: 0,0:37:15.94,0:37:20.53,Default,,0000,0000,0000,,strength that can be fed into the SIM\Ncard, which then can basically decide what
Dialogue: 0,0:37:20.53,0:37:29.72,Default,,0000,0000,0000,,to do. But yeah, I think it's all rather\Nexotic and very few, like relevant or good
Dialogue: 0,0:37:29.72,0:37:35.79,Default,,0000,0000,0000,,use cases of this.\NThe next step is Over-The-Air-technology
Dialogue: 0,0:37:35.79,0:37:41.01,Default,,0000,0000,0000,,(OTA), which is the ability for the\Noperator to transparently communicate with
Dialogue: 0,0:37:41.01,0:37:45.48,Default,,0000,0000,0000,,the SIM card in the field. With the\Ntraditional non-OTA capable SIM card, the
Dialogue: 0,0:37:45.48,0:37:49.42,Default,,0000,0000,0000,,operator or the SIM card manufacturer\Nwrites at manufacturing time (at so-called
Dialogue: 0,0:37:49.42,0:37:53.25,Default,,0000,0000,0000,,personalization time of the card), and\Nthen it's with the subscriber. And if the
Dialogue: 0,0:37:53.25,0:37:57.06,Default,,0000,0000,0000,,operator ever wants to fix something or\Nchange something, they have to send a new
Dialogue: 0,0:37:57.06,0:38:03.45,Default,,0000,0000,0000,,plastic card. With OTA, they can be\Nupdated. It's based on proactive SIM
Dialogue: 0,0:38:03.45,0:38:12.85,Default,,0000,0000,0000,,technology and by now, there are many\Ndifferent communication channels how some
Dialogue: 0,0:38:12.85,0:38:16.65,Default,,0000,0000,0000,,back end system at the operator can can\Ninteract with a card inside the phone of
Dialogue: 0,0:38:16.65,0:38:22.17,Default,,0000,0000,0000,,the subscriber. The classic channel is\NSMS-PP, which is the SMS as you know, it
Dialogue: 0,0:38:22.17,0:38:28.54,Default,,0000,0000,0000,,just officially called SMS point-to-point.\NIt's also possible over SMS-CB, the cell-
Dialogue: 0,0:38:28.54,0:38:33.21,Default,,0000,0000,0000,,broadcast-SMS, which I find very\Ninteresting, bulk updates to SIM cards via
Dialogue: 0,0:38:33.21,0:38:38.87,Default,,0000,0000,0000,,cell broadcast, which also would mean that\Nthey all have a shared key for
Dialogue: 0,0:38:38.87,0:38:44.97,Default,,0000,0000,0000,,authenticating these updates. It's also\Nspecified for USSD from release 7 on most
Dialogue: 0,0:38:44.97,0:38:48.98,Default,,0000,0000,0000,,of the specs. And then there's something\Nnew, at that point, called BIP, the
Dialogue: 0,0:38:48.98,0:38:53.88,Default,,0000,0000,0000,,"bearer independent protocol" that works\Nover circuit-switch-data and GPRS. Here
Dialogue: 0,0:38:53.88,0:38:58.06,Default,,0000,0000,0000,,are some spec numbers if anyone is\Ninterested. And now, since release 9, that
Dialogue: 0,0:38:58.06,0:39:03.94,Default,,0000,0000,0000,,means since LTE is around, also over\NHTTPS. I'll get to that in a couple of
Dialogue: 0,0:39:03.94,0:39:07.34,Default,,0000,0000,0000,,separate slides. There's actually a TLS\Nimplementation in
Dialogue: 0,0:39:07.34,0:39:13.55,Default,,0000,0000,0000,,SIM cards these days, believe it or not.\NSo the cryptographic security mechanisms
Dialogue: 0,0:39:13.55,0:39:17.22,Default,,0000,0000,0000,,set are specified, but of course the\Ndetailed use is up to the operator so the
Dialogue: 0,0:39:17.22,0:39:21.15,Default,,0000,0000,0000,,operator may choose whether or not to use\Nmeasures of authentication, or whether or
Dialogue: 0,0:39:21.15,0:39:26.11,Default,,0000,0000,0000,,not to use encryption, or whether or not\Nto use counters for replay protection. And
Dialogue: 0,0:39:26.11,0:39:29.73,Default,,0000,0000,0000,,this is basically one area where a lot of\Nthe security research and the
Dialogue: 0,0:39:29.73,0:39:33.82,Default,,0000,0000,0000,,vulnerabilities published in the last\Ndecade or so have been happening, e.g.
Dialogue: 0,0:39:33.82,0:39:37.06,Default,,0000,0000,0000,,cards were not properly configured, or\Nthey had implementation weaknesses, or you
Dialogue: 0,0:39:37.06,0:39:42.29,Default,,0000,0000,0000,,had some sort of oracles that you could\Nquery when interacting with those cards as
Dialogue: 0,0:39:42.29,0:39:49.74,Default,,0000,0000,0000,,an attacker. One of the use cases of Over-\NThe-Air is RFM, not RTFM, it's RFM,
Dialogue: 0,0:39:49.74,0:39:53.98,Default,,0000,0000,0000,,"Remote-File-Management". It was\Nintroduced in release 6 and the number of
Dialogue: 0,0:39:53.98,0:40:01.70,Default,,0000,0000,0000,,typos is embarrassing. A common use case\Nof Over-The-Air: It allows you to read or
Dialogue: 0,0:40:01.70,0:40:07.00,Default,,0000,0000,0000,,update files in the file system remotely,\Nand you can use that, for example, for the
Dialogue: 0,0:40:07.00,0:40:11.03,Default,,0000,0000,0000,,preferred or forbidden roaming operator\Nlists. That's a very legitimate use case
Dialogue: 0,0:40:11.03,0:40:15.07,Default,,0000,0000,0000,,for that. There's also an ancient example\Nthat I always like. I think Vodafone
Dialogue: 0,0:40:15.07,0:40:18.70,Default,,0000,0000,0000,,Netherlands once advertised that the\Noperator can take a backup of your phone
Dialogue: 0,0:40:18.70,0:40:24.95,Default,,0000,0000,0000,,book on the SIM card. I think it's an\Nearly manifestation of cloud computing
Dialogue: 0,0:40:24.95,0:40:32.56,Default,,0000,0000,0000,,before it even existed. In any case, it's\Ncertainly a feature that everyone in here
Dialogue: 0,0:40:32.56,0:40:38.12,Default,,0000,0000,0000,,would like to have. Of course it's\Nirrelevant by now because nobody has
Dialogue: 0,0:40:38.12,0:40:43.31,Default,,0000,0000,0000,,contacts on SIM cards anymore. The next is\NRAM which is not "Random Access Memory",
Dialogue: 0,0:40:43.31,0:40:48.21,Default,,0000,0000,0000,,it's "Remote Application Management". It\Nwas also introduced in the same release
Dialogue: 0,0:40:48.21,0:40:53.75,Default,,0000,0000,0000,,with the same typo, and it allows\Ninstallation and/or removal of
Dialogue: 0,0:40:53.75,0:40:57.53,Default,,0000,0000,0000,,applications on the card, and applications\Nin terms of Java card then means Java
Dialogue: 0,0:40:57.53,0:41:03.16,Default,,0000,0000,0000,,cardlets. For example, you could update or\Ninstall new multi IMSI-applications, which
Dialogue: 0,0:41:03.16,0:41:09.64,Default,,0000,0000,0000,,is one very creative way of using SIM\Ncards in more recent years, or new Sim-
Dialogue: 0,0:41:09.64,0:41:12.78,Default,,0000,0000,0000,,Toolkit-Applications.\NSo a multi-IMSI application, in case
Dialogue: 0,0:41:12.78,0:41:17.57,Default,,0000,0000,0000,,somebody hasn't heard of that yet, is\Nbasically a SIM card that changes its
Dialogue: 0,0:41:17.57,0:41:23.80,Default,,0000,0000,0000,,IMSI depending on where your currently\Nroam, in order to do a sort of least cost
Dialogue: 0,0:41:23.80,0:41:30.67,Default,,0000,0000,0000,,roaming agreement for the operator because\Nif he uses his is real own IMSI, then
Dialogue: 0,0:41:30.67,0:41:34.25,Default,,0000,0000,0000,,maybe the roaming costs would be more\Nextensive than if he used some kind of
Dialogue: 0,0:41:34.25,0:41:38.06,Default,,0000,0000,0000,,borrowed IMSI from another operator that\Nthen gets provisioned there, which has a
Dialogue: 0,0:41:38.06,0:41:41.74,Default,,0000,0000,0000,,better roaming agreement and would work\Naround ridiculous roaming charges - at
Dialogue: 0,0:41:41.74,0:41:46.56,Default,,0000,0000,0000,,least between the operators, of course,\Nnot towards the user. And now we get to
Dialogue: 0,0:41:46.56,0:41:58.41,Default,,0000,0000,0000,,the sort of premium feature of modern SIM\Ncards where, of course. you can still do
Dialogue: 0,0:41:58.41,0:42:03.78,Default,,0000,0000,0000,,SMS over LTE, but it's sort of this added-\Non kludge. USSD I think doesn't exist
Dialogue: 0,0:42:03.78,0:42:07.36,Default,,0000,0000,0000,,anymore because of the circuit-switch-\Nfeature. So you need some kind of new
Dialogue: 0,0:42:07.36,0:42:13.57,Default,,0000,0000,0000,,transport channel of how to talk to the\NSIM card. In release 9 they came up with
Dialogue: 0,0:42:13.57,0:42:19.12,Default,,0000,0000,0000,,something called over the air over HTTPS\Nwhich is specified in global platform 2.2
Dialogue: 0,0:42:19.12,0:42:24.64,Default,,0000,0000,0000,,amendment B. You have to get that specific\Namendment as a separate document, it's at
Dialogue: 0,0:42:24.64,0:42:34.02,Default,,0000,0000,0000,,least free of charge. Actually it uses\NHTTP, nice and good, and then it uses
Dialogue: 0,0:42:34.02,0:42:39.55,Default,,0000,0000,0000,,something called PSK-TLS, that I've never\Nheard of before, "pre-shared-keys with
Dialogue: 0,0:42:39.55,0:42:43.69,Default,,0000,0000,0000,,TLS". I mean, I'm not a TLS expert, as you\Ncan probably guess, but I don't think
Dialogue: 0,0:42:43.69,0:42:50.13,Default,,0000,0000,0000,,anyone ever with a normal browser would\Nwant to use pre-shared-keys. But it exists
Dialogue: 0,0:42:50.13,0:42:53.68,Default,,0000,0000,0000,,in the specs and there are several\Ndifferent cipher-modes that I've listed
Dialogue: 0,0:42:53.68,0:42:59.20,Default,,0000,0000,0000,,here which are permitted for Over-The-Air\Nof HTTPS. Which subset to use is of course
Dialogue: 0,0:42:59.20,0:43:03.13,Default,,0000,0000,0000,,up to the operator because it's his SIM\Ncard talking to his server so they can do
Dialogue: 0,0:43:03.13,0:43:08.41,Default,,0000,0000,0000,,whatever they want there. The interesting\Npart is that the IP in the TCP is
Dialogue: 0,0:43:08.41,0:43:14.07,Default,,0000,0000,0000,,terminated in the phone, and then whatever\Nis inside the TCP stream gets passed to
Dialogue: 0,0:43:14.07,0:43:18.82,Default,,0000,0000,0000,,the card which implements the TLS and the\NHTTP inside. Then, inside HTTP you
Dialogue: 0,0:43:18.82,0:43:23.88,Default,,0000,0000,0000,,actually have hex string representations\Nof the APDUs that the card normally
Dialogue: 0,0:43:23.88,0:43:28.69,Default,,0000,0000,0000,,processes. So you have this very\Ninteresting stack of different
Dialogue: 0,0:43:28.69,0:43:33.33,Default,,0000,0000,0000,,technologies and if you look at how\Nexactly they use HTTP, you ask yourself
Dialogue: 0,0:43:33.33,0:43:37.19,Default,,0000,0000,0000,,why did they bother with HTTP in the first\Nplace if they modify it beyond
Dialogue: 0,0:43:37.19,0:43:44.87,Default,,0000,0000,0000,,recognition? But we'll see. So the way how\Nthis is implemented, interestingly, is
Dialogue: 0,0:43:44.87,0:43:56.67,Default,,0000,0000,0000,,that the card implements and HTTP client\Nthat performs HTTP-POST. So your card
Dialogue: 0,0:43:56.67,0:44:01.18,Default,,0000,0000,0000,,somehow by some external mechanism gets\Ntriggered: "Oh, you must connect to your
Dialogue: 0,0:44:01.18,0:44:04.61,Default,,0000,0000,0000,,management server now because the\Nmanagement server wants something from
Dialogue: 0,0:44:04.61,0:44:10.63,Default,,0000,0000,0000,,you". And then the card does an HTTP-POST\Nover TLS with pre-shared-keys to the
Dialogue: 0,0:44:10.63,0:44:15.92,Default,,0000,0000,0000,,management server and then in the post\Nresponse there is a hex-encoded APDU for
Dialogue: 0,0:44:15.92,0:44:20.19,Default,,0000,0000,0000,,the card to be executed by the card. Then,\Nyou have tons of additional HTTP-headerrs
Dialogue: 0,0:44:20.19,0:44:25.04,Default,,0000,0000,0000,,I'm not going to explain. The CRLF is just\Na copy and paste error. But you see there
Dialogue: 0,0:44:25.04,0:44:31.89,Default,,0000,0000,0000,,is all kinds of X-Admin-headers and it\Nwill completely not work with normal HTTP. So why
Dialogue: 0,0:44:31.89,0:44:37.08,Default,,0000,0000,0000,,use HTTP in that context, I don't really\Nknow. Yeah, I thought I had an example
Dialogue: 0,0:44:37.08,0:44:41.82,Default,,0000,0000,0000,,here, but I didn't put it up, I thought\Nit's too much detail. But in the end, if
Dialogue: 0,0:44:41.82,0:44:50.04,Default,,0000,0000,0000,,you look at this, you'll need to write\Nyour own heavily modified HTTP-server
Dialogue: 0,0:44:50.04,0:44:58.07,Default,,0000,0000,0000,,anyway. but you have HTTP in there. Okay.\NAnother technology, it's sort of random, I
Dialogue: 0,0:44:58.07,0:45:01.99,Default,,0000,0000,0000,,didn't really know where to put it in\Nterms of ordering, is this S@T.
Dialogue: 0,0:45:01.99,0:45:07.38,Default,,0000,0000,0000,,technology, which is something really\Nstrange that's specified outside of the
Dialogue: 0,0:45:07.38,0:45:09.52,Default,,0000,0000,0000,,specification bodies that I mentioned\Nbefore.
Dialogue: 0,0:45:09.52,0:45:13.30,Default,,0000,0000,0000,,It's another.., I'm just mentioning it\Nbecause it's another vector that has more
Dialogue: 0,0:45:13.30,0:45:20.39,Default,,0000,0000,0000,,recently been exploited. Another\Nvulnerability. Where, actually, let's say
Dialogue: 0,0:45:20.39,0:45:26.60,Default,,0000,0000,0000,,you don't want to run. You don't want to\Nwrite a Java application to run on the
Dialogue: 0,0:45:26.60,0:45:32.36,Default,,0000,0000,0000,,card, but you still want to use SIM\NToolkit. So your card, most likely inside
Dialogue: 0,0:45:32.36,0:45:38.54,Default,,0000,0000,0000,,a Java VM implements a VM for another\Nbytecode, which is this S@T bytecode which
Dialogue: 0,0:45:38.54,0:45:41.73,Default,,0000,0000,0000,,gets basically pushed from the server into\Nthe card.
Dialogue: 0,0:45:41.73,0:45:47.41,Default,,0000,0000,0000,,So the card can then instruct your phone\Nto display some menu to you. Hmm. Okay.
Dialogue: 0,0:45:47.41,0:45:51.72,Default,,0000,0000,0000,,Uh. Very exciting technology. I'm sure\Nthere was a use case for it at some point.
Dialogue: 0,0:45:51.72,0:45:57.09,Default,,0000,0000,0000,,I haven't really figured it out. So there\Nis something called an S@T browser which
Dialogue: 0,0:45:57.09,0:46:00.86,Default,,0000,0000,0000,,runs inside the card. As I said, most\Nlikely that browser is implemented in Java
Dialogue: 0,0:46:00.86,0:46:04.59,Default,,0000,0000,0000,,running inside the Java VM. It's not a web\Nbrowser, of course. It just called a
Dialogue: 0,0:46:04.59,0:46:11.72,Default,,0000,0000,0000,,browser and it parses this binary format\Nwhich then creates SIM Toolkit menus or
Dialogue: 0,0:46:11.72,0:46:16.15,Default,,0000,0000,0000,,whatever. So yeah, I haven't really looked\Ninto detail. It's too strange even to look
Dialogue: 0,0:46:16.15,0:46:25.13,Default,,0000,0000,0000,,at it. Last but not least, we have\Nsomething called the eSIM and Which many
Dialogue: 0,0:46:25.13,0:46:31.69,Default,,0000,0000,0000,,people may know as a particular. How can I\Nsay particularly dominant in
Dialogue: 0,0:46:31.69,0:46:38.41,Default,,0000,0000,0000,,the Apple universe where the SIM card is\Nno longer a replaceable or exchangable
Dialogue: 0,0:46:38.41,0:46:43.91,Default,,0000,0000,0000,,plastic card with contacts. But it's\Nactually soldered into the device. This
Dialogue: 0,0:46:43.91,0:46:49.30,Default,,0000,0000,0000,,package, a form factor, is called MFF2,\Nthe machine form factor. Not sure why it's
Dialogue: 0,0:46:49.30,0:46:57.03,Default,,0000,0000,0000,,two, I've never seen a one before and it's\Na very small like 8 pin package SMD
Dialogue: 0,0:46:57.03,0:47:00.95,Default,,0000,0000,0000,,package that gets sold on a circuit board.\NAnd of course, at that point you have to
Dialogue: 0,0:47:00.95,0:47:05.04,Default,,0000,0000,0000,,have some mechanism by which the actual\Nprofile, meaning the user identity, the
Dialogue: 0,0:47:05.04,0:47:09.23,Default,,0000,0000,0000,,keys and all the configuration parameters\Nand so on can be updated or replaced
Dialogue: 0,0:47:09.23,0:47:14.28,Default,,0000,0000,0000,,remotely. And that in a way that will work\Nbetween different operators which are
Dialogue: 0,0:47:14.28,0:47:18.96,Default,,0000,0000,0000,,competing in the industry and which don't\Nreally want to, you know, replace those
Dialogue: 0,0:47:18.96,0:47:23.56,Default,,0000,0000,0000,,profiles, at least not inherently. And\Nthis is why this is managed by the GSMA as
Dialogue: 0,0:47:23.56,0:47:30.52,Default,,0000,0000,0000,,an umbrella entity of all the operators.\NAnd it specifies an amazing number of
Dialogue: 0,0:47:30.52,0:47:36.12,Default,,0000,0000,0000,,acronyms. And trust me if I say that it is\Nan amazing number of acronyms on how the
Dialogue: 0,0:47:36.12,0:47:39.71,Default,,0000,0000,0000,,cryptography and how the different\Nentities and how the different interfaces
Dialogue: 0,0:47:39.71,0:47:44.40,Default,,0000,0000,0000,,work and all the different roles and the\Nparties and each implementation of each
Dialogue: 0,0:47:44.40,0:47:49.87,Default,,0000,0000,0000,,party needs to be certified and approved\Nand so on and so on. And in the end, you
Dialogue: 0,0:47:49.87,0:47:53.58,Default,,0000,0000,0000,,have a system by which after a letter of\Napproval be
Dialogue: 0,0:47:53.58,0:47:59.41,Default,,0000,0000,0000,,tween operators and a new identity from a\Nnew operator can be downloaded in the card
Dialogue: 0,0:47:59.41,0:48:05.22,Default,,0000,0000,0000,,in a cryptographically secure way. So at\Nleast is the intent of the specification.
Dialogue: 0,0:48:05.22,0:48:11.37,Default,,0000,0000,0000,,I am not the person to judge on that and\Nreplace the profile, but it's not that
Dialogue: 0,0:48:11.37,0:48:15.52,Default,,0000,0000,0000,,like you as the owner of the device can do\Nthat. But it's just all the operators that
Dialogue: 0,0:48:15.52,0:48:21.34,Default,,0000,0000,0000,,are part of the club and are approved and\Ncertified by GSMA. Can actually add and or
Dialogue: 0,0:48:21.34,0:48:26.06,Default,,0000,0000,0000,,remove profiles and thus facilitate the\Ntransition from operator A to operator B
Dialogue: 0,0:48:26.06,0:48:30.50,Default,,0000,0000,0000,,in those cards. They don't only exist in\Nthe soldered form factor. You can also
Dialogue: 0,0:48:30.50,0:48:34.85,Default,,0000,0000,0000,,actually buy plastic cards that allow\Nthat. It's mostly used in like IoT
Dialogue: 0,0:48:34.85,0:48:39.50,Default,,0000,0000,0000,,devices, which I still call machine to\Nmachine. The old marketing term for that.
Dialogue: 0,0:48:39.50,0:48:46.14,Default,,0000,0000,0000,,So some random cellularly interconnected\Ndevice that you want to remotely update.
Dialogue: 0,0:48:46.14,0:48:54.87,Default,,0000,0000,0000,,And as a final slide, the CCC event SIM\Ncards that are around here. If you use the
Dialogue: 0,0:48:54.87,0:48:59.44,Default,,0000,0000,0000,,cellular networks, they are Java SIM and\NUSIM cards. They support Over-The-Air and
Dialogue: 0,0:48:59.44,0:49:04.51,Default,,0000,0000,0000,,the, not the random update, but the\Nremote application management. The remote
Dialogue: 0,0:49:04.51,0:49:09.34,Default,,0000,0000,0000,,file management at least via SMS-PP\Nhaven't tested anything else. It did for
Dialogue: 0,0:49:09.34,0:49:13.87,Default,,0000,0000,0000,,sure do not support HTTPS yet. And if\Nyou're interested in playing with any of
Dialogue: 0,0:49:13.87,0:49:17.94,Default,,0000,0000,0000,,that and writing your own Java applet,\Nthere's even a Hello World one around for
Dialogue: 0,0:49:17.94,0:49:21.83,Default,,0000,0000,0000,,several years that you can use as a\Nstarting point. You can get the keys for
Dialogue: 0,0:49:21.83,0:49:26.63,Default,,0000,0000,0000,,your specific card from the GSM team and\Nthen you can play with all of this in a
Dialogue: 0,0:49:26.63,0:49:33.39,Default,,0000,0000,0000,,way that normally only the operator can do\Nwith the card. Some hyperlinks which are
Dialogue: 0,0:49:33.39,0:49:37.87,Default,,0000,0000,0000,,actually hyperlinks on those slides. So\Nyou have to look at the PDF to see them.
Dialogue: 0,0:49:37.87,0:49:43.66,Default,,0000,0000,0000,,Yeah. And that brings me to the last slide\Nand I'm very happy to see questions.
Dialogue: 0,0:49:43.66,0:49:54.45,Default,,0000,0000,0000,,Thanks.\NHerald: Thank you. Thank you so much.
Dialogue: 0,0:49:54.45,0:49:59.93,Default,,0000,0000,0000,,Actually, talks like this one is one of\Nthe main reasons I go to Congress, because
Dialogue: 0,0:49:59.93,0:50:06.57,Default,,0000,0000,0000,,sometimes I just take a dive into a topic\NI know nothing about and it's presented by
Dialogue: 0,0:50:06.57,0:50:10.88,Default,,0000,0000,0000,,a person with literally decades of\Nexperience in the field.
Dialogue: 0,0:50:10.88,0:50:16.40,Default,,0000,0000,0000,,So it's amazing. And we have time for\Nquestions. So keep them coming. And the
Dialogue: 0,0:50:16.40,0:50:21.39,Default,,0000,0000,0000,,first one is microphone number 4.\NMicrophone 4: What you say makes me want
Dialogue: 0,0:50:21.39,0:50:29.21,Default,,0000,0000,0000,,to have a firewall between my phone and my\NSIM card. Is there a firewall?
Dialogue: 0,0:50:29.21,0:50:34.34,Default,,0000,0000,0000,,Harald: Not to my knowledge, really. I\Nmean, there are some vendors of
Dialogue: 0,0:50:34.34,0:50:40.55,Default,,0000,0000,0000,,specifically secure telephones that say,\Nwell, we have a firewall sort of built-in.
Dialogue: 0,0:50:40.55,0:50:45.08,Default,,0000,0000,0000,,Not sure to what extent and what detail,\Nbut not as a separate product or a
Dialogue: 0,0:50:45.08,0:50:51.22,Default,,0000,0000,0000,,separate device. At some time people\Ndeveloped so-called interposer SIM cards,
Dialogue: 0,0:50:51.22,0:50:55.78,Default,,0000,0000,0000,,which you can slide between the SIM card\Nand the phone, but that doesn't really
Dialogue: 0,0:50:55.78,0:51:00.88,Default,,0000,0000,0000,,work with you know Nano-SIM cards and so\Non anymore. And those interposers those
Dialogue: 0,0:51:00.88,0:51:07.85,Default,,0000,0000,0000,,were mostly used to avoid, you know, SIM\Nlocking and so on. But of course with such
Dialogue: 0,0:51:07.85,0:51:12.97,Default,,0000,0000,0000,,a device you could of course implement a\Nfirewall. Keep in mind that almost all of
Dialogue: 0,0:51:12.97,0:51:16.98,Default,,0000,0000,0000,,the communication. I mean the OTA may be\Nencrypted, but all of the communication
Dialogue: 0,0:51:16.98,0:51:20.25,Default,,0000,0000,0000,,between the phone and the card is\Ncompletely unauthenticated and
Dialogue: 0,0:51:20.25,0:51:24.45,Default,,0000,0000,0000,,unencrypted. So you can actually intercept\Nand modify that as much as you want. And
Dialogue: 0,0:51:24.45,0:51:27.88,Default,,0000,0000,0000,,there's actually a project I forgot to\Nmention in more detail. That's the
Dialogue: 0,0:51:27.88,0:51:31.85,Default,,0000,0000,0000,,osmocon project called SIM Trace,\Nwhich is a device that you can actually
Dialogue: 0,0:51:31.85,0:51:36.15,Default,,0000,0000,0000,,put as a man in the middle to trace the\Ncommunication between card and phone.
Dialogue: 0,0:51:36.15,0:51:40.62,Default,,0000,0000,0000,,Herald: Thank you. Mic one.\NMicrophone 1: Could you please elaborate a
Dialogue: 0,0:51:40.62,0:51:47.74,Default,,0000,0000,0000,,little bit about the SIM Checker attack\Nbecause the telephone provider said it's
Dialogue: 0,0:51:47.74,0:51:54.29,Default,,0000,0000,0000,,only possible if you have S@T browser on\Nthe SIM card and most claim they don't
Dialogue: 0,0:51:54.29,0:52:04.00,Default,,0000,0000,0000,,have. So do you have a feeling how many of\NSIM cards have a S@T browser and which are
Dialogue: 0,0:52:04.00,0:52:10.22,Default,,0000,0000,0000,,attackable or which other applications are\Nattackable by the SIM Checker attack?
Dialogue: 0,0:52:10.22,0:52:16.79,Default,,0000,0000,0000,,Harald: I'm not involved in those attacks,\Nso I cannot really comment on that in
Dialogue: 0,0:52:16.79,0:52:21.70,Default,,0000,0000,0000,,detail. But I know there is a tool\Navailable, an open source tool that is
Dialogue: 0,0:52:21.70,0:52:26.24,Default,,0000,0000,0000,,made available by SR Labs, which allows\Nyou to test cards. So if you want to check
Dialogue: 0,0:52:26.24,0:52:30.19,Default,,0000,0000,0000,,different cards, you can use that SIM\Ntester. I think it's linked from the slide
Dialogue: 0,0:52:30.19,0:52:36.01,Default,,0000,0000,0000,,here. Yeah, the SR Labs SIM tester. That's\Na Java application. I don't have any
Dialogue: 0,0:52:36.01,0:52:41.81,Default,,0000,0000,0000,,figures or knowledge about this. In terms\Nof the figures you're asking for. Sorry.
Dialogue: 0,0:52:41.81,0:52:48.38,Default,,0000,0000,0000,,Herald: Thank you. Let's take a question\Nfrom the Internet next. Hi, Internet
Dialogue: 0,0:52:48.38,0:52:52.59,Default,,0000,0000,0000,,people.\NSignal Angel: There was a question, Can
Dialogue: 0,0:52:52.59,0:52:56.38,Default,,0000,0000,0000,,the eSIM can be seen as back to the roots,\Nespecially compared to what the U.S.
Dialogue: 0,0:52:56.38,0:53:03.38,Default,,0000,0000,0000,,market had in the early time?\NHarald: Um. Well, that refers to the
Dialogue: 0,0:53:03.38,0:53:08.34,Default,,0000,0000,0000,,situation that the identity is hardwired\Ninto the phone and not replaceable. And I
Dialogue: 0,0:53:08.34,0:53:14.64,Default,,0000,0000,0000,,think. No, not really, because it can be\Nreplaced and it can be replaced by any of
Dialogue: 0,0:53:14.64,0:53:19.04,Default,,0000,0000,0000,,the operate like the normal commercial\Noperators. Of course, it means you cannot
Dialogue: 0,0:53:19.04,0:53:27.94,Default,,0000,0000,0000,,use such a device in, let's say, a private\NGSM network or in a campus network for 5G,
Dialogue: 0,0:53:27.94,0:53:34.27,Default,,0000,0000,0000,,which apparently everybody needs these\Ndays now. So there are limitations for
Dialogue: 0,0:53:34.27,0:53:39.24,Default,,0000,0000,0000,,such use cases. But in terms of the normal\Nphones switching between operator A and
Dialogue: 0,0:53:39.24,0:53:46.07,Default,,0000,0000,0000,,operator B. That's exactly what the system\Nis trying to solve. It's just that if
Dialogue: 0,0:53:46.07,0:53:52.56,Default,,0000,0000,0000,,you're not part of the club, you've lost.\NHerald: Thank you. The person behind Mic 5
Dialogue: 0,0:53:52.56,0:53:57.60,Default,,0000,0000,0000,,has a very nice hat and we're all\Nabout fashion here. So the next question
Dialogue: 0,0:53:57.60,0:54:00.01,Default,,0000,0000,0000,,goes to you.\NHarald: Nobody told me that.
Dialogue: 0,0:54:00.01,0:54:06.10,Default,,0000,0000,0000,,Microphone 5: {\i1}not understandable{\i0}'s\Nmentor said not a Google one? And my
Dialogue: 0,0:54:06.10,0:54:12.75,Default,,0000,0000,0000,,question was answered, I think because I\Nwanted to know what prevents a POC from
Dialogue: 0,0:54:12.75,0:54:18.95,Default,,0000,0000,0000,,providing an eSIM.\NHarald: A profile for an eSIM. Yes, that's
Dialogue: 0,0:54:18.95,0:54:23.01,Default,,0000,0000,0000,,exactly the problem that it needs in order\Nto install it. It needs to be approved and
Dialogue: 0,0:54:23.01,0:54:26.88,Default,,0000,0000,0000,,signed and so on and so on. And you need\Nto be part of that GSMA process. So first
Dialogue: 0,0:54:26.88,0:54:30.60,Default,,0000,0000,0000,,of all, you would have to technically\Nimplement all of that, which is doable in
Dialogue: 0,0:54:30.60,0:54:34.09,Default,,0000,0000,0000,,all specs of public. But then you need to\Nget it certified, which is maybe
Dialogue: 0,0:54:34.09,0:54:38.56,Default,,0000,0000,0000,,less doable. And then finally since \Nyou're not a GSMA member and not an
Dialogue: 0,0:54:38.56,0:54:42.19,Default,,0000,0000,0000,,operator. You cannot become a GSMA member\Nand you don't have the funds for it
Dialogue: 0,0:54:42.19,0:54:47.32,Default,,0000,0000,0000,,anyway. So that is certainly not going to\Nwork. But the POC could provide an actual
Dialogue: 0,0:54:47.32,0:54:50.14,Default,,0000,0000,0000,,like a physical eSIM chip. So if somebody\Nwants to
Dialogue: 0,0:54:50.14,0:54:57.27,Default,,0000,0000,0000,,do a hot air rework. That's easy, and I\Nmean, you can buy them just like
Dialogue: 0,0:54:57.27,0:55:00.82,Default,,0000,0000,0000,,other SIM cards and then you have your\Nidentity inside. But of course, that
Dialogue: 0,0:55:00.82,0:55:02.97,Default,,0000,0000,0000,,doesn't really solve your problem, I\Nsuppose.
Dialogue: 0,0:55:02.97,0:55:07.02,Default,,0000,0000,0000,,Microphone 5: Okay.\NHerald: Thank you. No more people in cool
Dialogue: 0,0:55:07.02,0:55:10.83,Default,,0000,0000,0000,,hats. So you'll keep picking at random.\NMic 7, please.
Dialogue: 0,0:55:10.83,0:55:18.50,Default,,0000,0000,0000,,Microphone 7: Thanks for the amazing talk.\NUm, I have a question about the flash
Dialogue: 0,0:55:18.50,0:55:25.48,Default,,0000,0000,0000,,file system on the cards. I've already\Nworked with the cards on the file system
Dialogue: 0,0:55:25.48,0:55:31.70,Default,,0000,0000,0000,,level due for some files, you need to\Nspecify this. You would need to load. Do
Dialogue: 0,0:55:31.70,0:55:39.83,Default,,0000,0000,0000,,you need to do like a authentication tango\Nprovides a CH view like the PIN one and
Dialogue: 0,0:55:39.83,0:55:45.57,Default,,0000,0000,0000,,then you only have access to some of the\Nfiles. And since cheap flash is built into
Dialogue: 0,0:55:45.57,0:55:51.67,Default,,0000,0000,0000,,those devices, my question is whether they\Nare cheap hardware or software tricks to
Dialogue: 0,0:55:51.67,0:55:59.37,Default,,0000,0000,0000,,access the files or modify the files which\Nare usually locked behind the PIN.
Dialogue: 0,0:55:59.37,0:56:04.71,Default,,0000,0000,0000,,Harald: Not that I'm aware of. And if I\Nwould say they are rather specific to the
Dialogue: 0,0:56:04.71,0:56:10.57,Default,,0000,0000,0000,,given OS or whatever on the cards and as\Nso many out there. So I think it's
Dialogue: 0,0:56:10.57,0:56:15.51,Default,,0000,0000,0000,,unlikely in terms of write cycles, you can\Ntypically buy between one hundred thousand
Dialogue: 0,0:56:15.51,0:56:19.80,Default,,0000,0000,0000,,five hundred thousand write cycle flash in\NSIM card chips. That's sort of what the
Dialogue: 0,0:56:19.80,0:56:25.08,Default,,0000,0000,0000,,industry sells. But then of course you\Nhave all kinds of weird leveling and then
Dialogue: 0,0:56:25.08,0:56:29.60,Default,,0000,0000,0000,,there are algorithms and SIM card\Noperating systems even go as far as to
Dialogue: 0,0:56:29.60,0:56:35.49,Default,,0000,0000,0000,,like you can specify which files are more\Nlike the update frequencies. So it will
Dialogue: 0,0:56:35.49,0:56:39.34,Default,,0000,0000,0000,,use different algorithms for managing the\Nflash there. But an interesting anecdote
Dialogue: 0,0:56:39.34,0:56:45.69,Default,,0000,0000,0000,,for that if we have the minute. And I was\Ninvolved openmoko. Some people may
Dialogue: 0,0:56:45.69,0:56:52.87,Default,,0000,0000,0000,,remember that was an open source\Nsmartphone in 2007. And, um, there
Dialogue: 0,0:56:52.87,0:56:58.04,Default,,0000,0000,0000,,actually we had a bug in the baseband\Nwhich would constantly keep rewriting some
Dialogue: 0,0:56:58.04,0:57:04.57,Default,,0000,0000,0000,,files on the flash of the SIM card. And\Nactually we had some early adopters use us
Dialogue: 0,0:57:04.57,0:57:08.56,Default,,0000,0000,0000,,where the SIM cards got broken basically\Nby constantly hammering them with write
Dialogue: 0,0:57:08.56,0:57:17.87,Default,,0000,0000,0000,,access. So, um. Yeah. But nothing that\NI know about any kind of, um. Access
Dialogue: 0,0:57:17.87,0:57:22.69,Default,,0000,0000,0000,,class bypass or something like that.\NMicrophone 7: Thank you.
Dialogue: 0,0:57:22.69,0:57:27.64,Default,,0000,0000,0000,,Herald: Microphone 6, which I often\Nneglect because the lights are blinding me
Dialogue: 0,0:57:27.64,0:57:30.91,Default,,0000,0000,0000,,when I look that way.\NMicrophone 6: Um, thanks for the helpful
Dialogue: 0,0:57:30.91,0:57:38.07,Default,,0000,0000,0000,,talk. I have a twofold question. Um, so if\NI understand correctly your talk, it is
Dialogue: 0,0:57:38.07,0:57:42.95,Default,,0000,0000,0000,,impossible to know the code that's\Nrunning on the same, right? So I have this
Dialogue: 0,0:57:42.95,0:57:49.81,Default,,0000,0000,0000,,twofold question is about going further,\Nis there something buried in the specs to
Dialogue: 0,0:57:49.81,0:57:52.99,Default,,0000,0000,0000,,understand more concretely, this\Nprotocols?
Dialogue: 0,0:57:52.99,0:57:58.32,Default,,0000,0000,0000,,And is there any way to dump the code\Nthat's running on the SIMs?
Dialogue: 0,0:57:58.32,0:58:05.60,Default,,0000,0000,0000,,Harald: In terms of documentation, beyond\Nthe specs, there is one document that I
Dialogue: 0,0:58:05.60,0:58:09.44,Default,,0000,0000,0000,,always like very much to recommend, which\Nis also linked here. Yes, the so-called
Dialogue: 0,0:58:09.44,0:58:13.34,Default,,0000,0000,0000,,SIM Alliance Stepping Stones. No idea why\Nit's called that way, but that's how it's
Dialogue: 0,0:58:13.34,0:58:17.10,Default,,0000,0000,0000,,called, there's a hyperlink. So if you \Nwork on the slides, you can download it.
Dialogue: 0,0:58:17.10,0:58:20.12,Default,,0000,0000,0000,,That's a rather nice overview document
Dialogue: 0,0:58:20.12,0:58:22.81,Default,,0000,0000,0000,,about all the different specs\Nand how it ties together.
Dialogue: 0,0:58:22.81,0:58:30.32,Default,,0000,0000,0000,,So I can recommend that. And in\Nterms of towards to dump the code on the
Dialogue: 0,0:58:30.32,0:58:36.42,Default,,0000,0000,0000,,SIM card. I mean, yes, of course. Tools\Nexist, but those tools are highly specific
Dialogue: 0,0:58:36.42,0:58:41.94,Default,,0000,0000,0000,,to the given smartcard operating system\Nand or chip. And I'm not aware of any such
Dialogue: 0,0:58:41.94,0:58:47.32,Default,,0000,0000,0000,,tools ever having leaked. I mean, I get\Nsuch tools for the cards that I in the
Dialogue: 0,0:58:47.32,0:58:55.65,Default,,0000,0000,0000,,company that I work, I work with. But\Nyeah, of course, the SIM cards out in the
Dialogue: 0,0:58:55.65,0:59:00.21,Default,,0000,0000,0000,,field should be locked down from such\Ntools and they are highly specific to the
Dialogue: 0,0:59:00.21,0:59:03.46,Default,,0000,0000,0000,,given OS and SIM.\NMicrophone 6: OK.
Dialogue: 0,0:59:03.46,0:59:07.19,Default,,0000,0000,0000,,Herald: Thank you.\NHarald: So maybe one addition to that,
Dialogue: 0,0:59:07.19,0:59:16.34,Default,,0000,0000,0000,,it's normally made in a way that basically\Nif you want to sort of reset the card or
Dialogue: 0,0:59:16.34,0:59:20.29,Default,,0000,0000,0000,,something. So there's always sort of once\Nthe card is in the operational lifecycle
Dialogue: 0,0:59:20.29,0:59:24.85,Default,,0000,0000,0000,,state, which is when you use it normally\Nif you ever want to bypass some
Dialogue: 0,0:59:24.85,0:59:30.05,Default,,0000,0000,0000,,restriction or you want to sort of do\Nsomething that is not permitted by the
Dialogue: 0,0:59:30.05,0:59:33.97,Default,,0000,0000,0000,,spec, by the by the permissions anymore,\Nyou have to sort of recycle the card and
Dialogue: 0,0:59:33.97,0:59:37.99,Default,,0000,0000,0000,,get it back into the so-called\Npersonalization lifecycle state. And most
Dialogue: 0,0:59:37.99,0:59:41.82,Default,,0000,0000,0000,,often that is done with a complete wipe,\Nat least off the file system or with a
Dialogue: 0,0:59:41.82,0:59:45.76,Default,,0000,0000,0000,,complete wipe of the operating system. So\Nyou're back to the bootloader of the card
Dialogue: 0,0:59:45.76,0:59:48.33,Default,,0000,0000,0000,,and then you can basically start to\Nrecreate the card.
Dialogue: 0,0:59:48.33,0:59:52.59,Default,,0000,0000,0000,,But it's typically implemented in a way\Nthat it always is together with an erase.
Dialogue: 0,0:59:52.59,0:59:59.53,Default,,0000,0000,0000,,So they tried at least to make it safe.\NThere's a question there, but not at the
Dialogue: 0,0:59:59.53,1:00:03.02,Default,,0000,0000,0000,,microphone. Oh there is a microphone. Oh,\Nsorry. But yeah, your job. Sorry
Dialogue: 0,1:00:03.02,1:00:08.23,Default,,0000,0000,0000,,Herald: Yeah, I think the person behind\NMic 4 has been standing there for ages.
Dialogue: 0,1:00:08.23,1:00:14.65,Default,,0000,0000,0000,,Microphone 4: You mentioned that the\Ncard can instruct the phone to open the
Dialogue: 0,1:00:14.65,1:00:22.79,Default,,0000,0000,0000,,website, but I have never seen this and\NI've seen use cases where I think it would
Dialogue: 0,1:00:22.79,1:00:28.93,Default,,0000,0000,0000,,be useful to do this. So is this\Nnot supported in most OSes or why?
Dialogue: 0,1:00:28.93,1:00:36.00,Default,,0000,0000,0000,,Harald: It's a good question, actually. If\Nyou read all those specs, like especially
Dialogue: 0,1:00:36.00,1:00:40.96,Default,,0000,0000,0000,,these proactive SIM specs and so on. I\Nalways have the original: OK it's all very
Dialogue: 0,1:00:40.96,1:00:46.21,Default,,0000,0000,0000,,interesting, but I've never seen anything\Nlike that anywhere." So I completely agree
Dialogue: 0,1:00:46.21,1:00:52.20,Default,,0000,0000,0000,,with you. Whether or not it's supported by\Nthe phones is a good question. And I think
Dialogue: 0,1:00:52.20,1:00:55.97,Default,,0000,0000,0000,,without trying, there's no way to know. So\Nyou would actually have to write on a
Dialogue: 0,1:00:55.97,1:01:01.42,Default,,0000,0000,0000,,small extend a Hello World app and to to\Ndo that and see and do a testing with
Dialogue: 0,1:01:01.42,1:01:09.27,Default,,0000,0000,0000,,various phones. I would fear that since\Nit's a feature that's specified but rarely
Dialogue: 0,1:01:09.27,1:01:13.13,Default,,0000,0000,0000,,used, a lot of devices will not support it\Nor not support it properly because it's
Dialogue: 0,1:01:13.13,1:01:16.79,Default,,0000,0000,0000,,never tested, because nobody's ever asked\Nabout testing it. But that's just my
Dialogue: 0,1:01:16.79,1:01:22.71,Default,,0000,0000,0000,,guess.\NHerald: Thank you, Mic 1.
Dialogue: 0,1:01:22.71,1:01:29.13,Default,,0000,0000,0000,,Microphone 1: OK. Hello. Um, my question\Nis, when you have an eSIM and you want
Dialogue: 0,1:01:29.13,1:01:35.58,Default,,0000,0000,0000,,to provisioning it. Could it be done with\NTR-069 or something similar?
Dialogue: 0,1:01:35.58,1:01:42.52,Default,,0000,0000,0000,,Harald: No. That's a completely different\Nset of protocols that are used for that.
Dialogue: 0,1:01:42.52,1:01:48.74,Default,,0000,0000,0000,,And that's that relates to this,\Nglobal platform, 2.2 and XP, I think
Dialogue: 0,1:01:48.74,1:01:52.66,Default,,0000,0000,0000,,it was. Yeah, I don't find it right now.\NBut there's this spec that specifies all
Dialogue: 0,1:01:52.66,1:01:56.29,Default,,0000,0000,0000,,the different interfaces and protocols\Nthat are used between the elements and
Dialogue: 0,1:01:56.29,1:02:00.58,Default,,0000,0000,0000,,it's completely different. I think\Nalso the requirements are very different
Dialogue: 0,1:02:00.58,1:02:03.87,Default,,0000,0000,0000,,because you have these multiple\Nstakeholders. So you have the original
Dialogue: 0,1:02:03.87,1:02:09.01,Default,,0000,0000,0000,,card issuer, the original operator, then\Nyou have other operators. And it's not
Dialogue: 0,1:02:09.01,1:02:14.25,Default,,0000,0000,0000,,like a single entity that just wants to\Nprovision its devices, but it's sort of a
Dialogue: 0,1:02:14.25,1:02:18.93,Default,,0000,0000,0000,,multi stakeholder approach where you want\Nto make sure that even in like a
Dialogue: 0,1:02:18.93,1:02:22.90,Default,,0000,0000,0000,,competition between operators still this\Nis possible and that people for trust in
Dialogue: 0,1:02:22.90,1:02:27.29,Default,,0000,0000,0000,,the system, that even if the original\Nissuing operator doesn't like the other
Dialogue: 0,1:02:27.29,1:02:30.77,Default,,0000,0000,0000,,operator, it still will work and it will\Neven work in 10 years from now or
Dialogue: 0,1:02:30.77,1:02:35.00,Default,,0000,0000,0000,,something in where it's in the field. So I\Nthink the requirements are different.
Dialogue: 0,1:02:35.00,1:02:42.67,Default,,0000,0000,0000,,Herald: Thank you. That was the last\Nquestion of the last talk of the day.
Dialogue: 0,1:02:42.67,1:02:47.01,Default,,0000,0000,0000,,Harald: Luckily, not the last day.\NHerald: Not the last day, the first day.
Dialogue: 0,1:02:47.01,1:02:50.15,Default,,0000,0000,0000,,So there's three more days ahead of us.\NThank you.
Dialogue: 0,1:02:50.15,1:02:56.12,Default,,0000,0000,0000,,{\i1}Applause{\i0}
Dialogue: 0,1:02:56.12,1:03:17.84,Default,,0000,0000,0000,,{\i1}Music{\i0}