4 ms·

Wasn't one of the benefits of a smart card model was having a totally isolated chip that could run minimal software and provide a limited surface for attack? If

Wasn't one of the benefits of a smart card model was having a totally isolated chip that could run minimal software and provide a limited surface for attack? If you add everything to the same chip then doesn't this reduce the advantages of having that separate smart card (together with it's anti-tampering design)? We're also supposed to trust Qualcomm that this is secure... Sounds totally legit. SIM cards aren't perfect but I feel like there is a benefit to them. Especially since they use the same tech as credit card chips, don't they (universal integrated circuit cards.) It's hard for me to want to trust this as much as a platform used by literally every consumer payment bank and carrier out there vs Qualcomms priority spec. I think anyone who does secure communication already doesn't want to touch Qualcomm products because you can't audit their designs. Unfortunately, that's usually what is shipped as the baseband modem in most phones... A single company making one of the most important communication products... Nope, no problem there...

audunw 4y ago
I haven't worked on iSIM myself, but I have colleagues that work on integrating iSIM onto an SoC. The procedure around integrating an iSIM into an SoC is ridiculously strict. The integration and simulation has to happen on a workstation in a special room, not connected to the rest of the network, with camera surveillance, etc. > We're also supposed to trust Qualcomm that this is secure I don't know if Qualcomm can do things differently. I don't know if they can design the iSIM themselves instead of integrating from a trusted third party. But I doubt that the security requirement is any less strict. Telecom operators seem to be extremely paranoid about this stuff. Essentially, it seems like it's not that much different from eSIM, you're just putting a similar kind of trusted module on the SoC instead of on the PCB. > together with it's anti-tampering design I'd be very surprised if iSIM and the whole Qualcomm SoC isn't designed with anti-tampering mechanisms. Seems like anti-tampering is becoming a general requirement for SoCs (with upgradable firmware and root-of-trust) being designed now.
zamadatix 4y ago
Ultimately the weakest link in SIM security is the support rep at your telephony provider.
vel0city 4y ago
I don't necessarily know how eSIMs or iSIMs are supposed to work, just throwing out some ideas here discussing how they could be implemented. Just because a device is on the same package or die doesn't mean all features need to be exposed to everything else on that package or die. Imagine if you just took the design for a regular SIM card, and then essentially just directly connected it on the package or on the die. Its still the same interface, but instead of it being a separate package connecting to pins on a board that connect to other pins on a board and then to the SoC its just all in the same plastic package. Then go from instead of wiring it in the plastic package, you're not wiring it on the die itself. Now, of course, this obviously isn't how these things work, since they can load cryptographic material from things like QR codes and apps. While older SIMs were mostly read only (usually a small amount of user memory like address book stuff and what not) these newer eSIMs and iSIMs allow for provisioning in the field. This does bring some attack surface to them, but once again these kind of interfaces could be locked down. It doesn't necessarily need to share logic with the main CPU or have its memory in system RAM, it can still hold all its cryptographic secrets in its own private non-accessible memory and do its functions with its own logic designs. The provisioning step is still potentially attackable, but if designed right its secret storage and management can still be highly isolated to the main processors in the same way older SIMs were.

audunw 4y ago

I haven't worked on iSIM myself, but I have colleagues that work on integrating iSIM onto an SoC. The procedure around integrating an iSIM into an SoC is ridiculously strict. The integration and simulation has to happen on a workstation in a special room, not connected to the rest of the network, with camera surveillance, etc. > We're also supposed to trust Qualcomm that this is secure I don't know if Qualcomm can do things differently. I don't know if they can design the iSIM themselves instead of integrating from a trusted third party. But I doubt that the security requirement is any less strict. Telecom operators seem to be extremely paranoid about this stuff. Essentially, it seems like it's not that much different from eSIM, you're just putting a similar kind of trusted module on the SoC instead of on the PCB. > together with it's anti-tampering design I'd be very surprised if iSIM and the whole Qualcomm SoC isn't designed with anti-tampering mechanisms. Seems like anti-tampering is becoming a general requirement for SoCs (with upgradable firmware and root-of-trust) being designed now.

zamadatix 4y ago

Ultimately the weakest link in SIM security is the support rep at your telephony provider.

vel0city 4y ago

I don't necessarily know how eSIMs or iSIMs are supposed to work, just throwing out some ideas here discussing how they could be implemented. Just because a device is on the same package or die doesn't mean all features need to be exposed to everything else on that package or die. Imagine if you just took the design for a regular SIM card, and then essentially just directly connected it on the package or on the die. Its still the same interface, but instead of it being a separate package connecting to pins on a board that connect to other pins on a board and then to the SoC its just all in the same plastic package. Then go from instead of wiring it in the plastic package, you're not wiring it on the die itself. Now, of course, this obviously isn't how these things work, since they can load cryptographic material from things like QR codes and apps. While older SIMs were mostly read only (usually a small amount of user memory like address book stuff and what not) these newer eSIMs and iSIMs allow for provisioning in the field. This does bring some attack surface to them, but once again these kind of interfaces could be locked down. It doesn't necessarily need to share logic with the main CPU or have its memory in system RAM, it can still hold all its cryptographic secrets in its own private non-accessible memory and do its functions with its own logic designs. The provisioning step is still potentially attackable, but if designed right its secret storage and management can still be highly isolated to the main processors in the same way older SIMs were.