5 ms·

I'm a little confused about how UE authentication works with open source cellular. Are there re-programmable SIMs that you need to buy? Or it only works with vi

I'm a little confused about how UE authentication works with open source cellular. Are there re-programmable SIMs that you need to buy? Or it only works with virtual SIM cards written in software on non-commercial equipment. To ask simply; could I expect to easily connect my iPhone to one of these networks?

bserge 5y ago
Yes, programmable SIM cards. https://www.smartjac.biz/mobile-telecom/sim-cards/4g-lte-sim-cards https://www.smartjac.biz/mobile-telecom/sim-cards/4g-lte-sim... Buy pre-programmed or invest in a programmer + a bunch of blanks.
- toomuchtodo 5y ago
  Does this work with eSIMs?
  - mnd999 5y ago
    This would be super useful if it could me made to work on the secondary eSIM for iDevices.
    - deleted 5y ago
      [deleted]
  - g_p 5y ago
    Unfortunately not - eSim is a fairly closed-shop ecosystem. You can't easily type in the provisioning parameters into a QR code generator and get an eSim to use. You need to work with a GSMA-approved eSim issuer who has a special CA-signed certificate to authorise a handshake via some cellular standard protocols to do the eSim setup process. This process does prevent keying material being exchanged in plaintext, but also "locks in" the need for an intermediary in the process unfortunately. So while you could make eSims, you'd need to work with a GSMA-approved issuer.
    - grishka 5y ago
      That's unfortunate. Is it possible bypass this restriction on a rooted Android phone, or is it implemented in hardware?
      - bserge 5y ago
        Afaik, it has little to do with the user-facing software, you need access to the baseband modem part.
      - lxgr 5y ago
        As far as I know, eSIMs are usually implemented in physical hardware, close to (or maybe even on) the baseband, but independent from the baseband firmware. This is because they are considered a trusted execution environment; if they weren't, it would be possible to "clone" eSIM instances.
        grishka 5y ago
        Ah, right. "Trusted" in the modern dystopian sense that I physically own the thing but it's controlled by someone else.
        g_p 5y ago
        Exactly. The whole baseband in your phone is considered "trusted" by the network because you can't easily control it. Don't give the carriers ideas - if they thought they could move to a "ma Bell" style of you leasing the phone from them without ever gaining ownership rights of it, someone would try to! Look at carrier locking, and the world of CDMA, where your phone has to have its ESN (serial number) manually whitelisted to join the network... It's a whole different world from general purpose computing! The mobile standards are built around the assumption that the baseband does as it's told by the network - your phone's transmit slots get scheduled by the base station, and your phone sits quietly until those slots to speak. This extends to the wider architecture and design of the ecosystem - the user is not "meant" to be in charge of their device in the mobile ecosystem. With the split between AP and CP (application processor and cellular processor), if you put the CP on a suitable bus like USB which doesn't give DMA access, you can build a phone you have sufficient control of (see Pinephone etc). In the world of SIM, this is back to carrier thinking - they control the SIM as it's "theirs". The keys on the SIM are known only to them, not even to you. You're not trusted to know your own SIM authentication parameters. This can be helpful in some ways, as it makes the threat model different to other systems and you can't unwittingly disclose your keys to someone through social engineering... But it's less helpful as customers generally don't think like security architects who designed this, and end up just having their physical SIM stolen, or their carrier ports their number after social engineering...
  - bserge 5y ago
    You don't need hardware for that. Just need to be able to program your own carrier profile... which I guess is very hard to impossible for the average person.
    - lxgr 5y ago
      What do you mean by "carrier profile"? An eSIM profile?
X-Cubed 5y ago
I'm not sure about 4G, but certainly with some of the earlier variants it was relatively easy to make your local DIY network visible as 'foreign' roaming network to your phone with it's normal SIM.

bserge 5y ago

Yes, programmable SIM cards. https://www.smartjac.biz/mobile-telecom/sim-cards/4g-lte-sim-cards https://www.smartjac.biz/mobile-telecom/sim-cards/4g-lte-sim... Buy pre-programmed or invest in a programmer + a bunch of blanks.

toomuchtodo 5y ago
Does this work with eSIMs?
- mnd999 5y ago
  This would be super useful if it could me made to work on the secondary eSIM for iDevices.
  - deleted 5y ago
    [deleted]
- g_p 5y ago
  Unfortunately not - eSim is a fairly closed-shop ecosystem. You can't easily type in the provisioning parameters into a QR code generator and get an eSim to use. You need to work with a GSMA-approved eSim issuer who has a special CA-signed certificate to authorise a handshake via some cellular standard protocols to do the eSim setup process. This process does prevent keying material being exchanged in plaintext, but also "locks in" the need for an intermediary in the process unfortunately. So while you could make eSims, you'd need to work with a GSMA-approved issuer.
  - grishka 5y ago
    That's unfortunate. Is it possible bypass this restriction on a rooted Android phone, or is it implemented in hardware?
    - bserge 5y ago
      Afaik, it has little to do with the user-facing software, you need access to the baseband modem part.
    - lxgr 5y ago
      As far as I know, eSIMs are usually implemented in physical hardware, close to (or maybe even on) the baseband, but independent from the baseband firmware. This is because they are considered a trusted execution environment; if they weren't, it would be possible to "clone" eSIM instances.
      - grishka 5y ago
        Ah, right. "Trusted" in the modern dystopian sense that I physically own the thing but it's controlled by someone else.
        g_p 5y ago
        Exactly. The whole baseband in your phone is considered "trusted" by the network because you can't easily control it. Don't give the carriers ideas - if they thought they could move to a "ma Bell" style of you leasing the phone from them without ever gaining ownership rights of it, someone would try to! Look at carrier locking, and the world of CDMA, where your phone has to have its ESN (serial number) manually whitelisted to join the network... It's a whole different world from general purpose computing! The mobile standards are built around the assumption that the baseband does as it's told by the network - your phone's transmit slots get scheduled by the base station, and your phone sits quietly until those slots to speak. This extends to the wider architecture and design of the ecosystem - the user is not "meant" to be in charge of their device in the mobile ecosystem. With the split between AP and CP (application processor and cellular processor), if you put the CP on a suitable bus like USB which doesn't give DMA access, you can build a phone you have sufficient control of (see Pinephone etc). In the world of SIM, this is back to carrier thinking - they control the SIM as it's "theirs". The keys on the SIM are known only to them, not even to you. You're not trusted to know your own SIM authentication parameters. This can be helpful in some ways, as it makes the threat model different to other systems and you can't unwittingly disclose your keys to someone through social engineering... But it's less helpful as customers generally don't think like security architects who designed this, and end up just having their physical SIM stolen, or their carrier ports their number after social engineering...
- bserge 5y ago
  You don't need hardware for that. Just need to be able to program your own carrier profile... which I guess is very hard to impossible for the average person.
  - lxgr 5y ago
    What do you mean by "carrier profile"? An eSIM profile?

X-Cubed 5y ago

I'm not sure about 4G, but certainly with some of the earlier variants it was relatively easy to make your local DIY network visible as 'foreign' roaming network to your phone with it's normal SIM.