eSIM Remote Provisioning (RSP) & LPA Security Audit

SIM & eSIMPCSC Ready

Overview & Audit Objective

eSIM and eUICC architectures rely on the GSMA SGP.22 Remote SIM Provisioning specification. This playbook demonstrates how to audit eSIM profiles, interrogate eUICC chips via standard PCSC readers using lpac and pySim-shell, verify CI Public Key certificates, and monitor APDU commands.

Execution Steps

  1. 1
    Detect Connected Smartcard Readers:

    Enumerate USB PCSC readers and verify card presence:

    Terminal — Enumerate Readers
    telcosec sim readers
telcosec doctor
  2. 2
    Inspect eUICC Information (EID & Profiles):

    Query the chip Identification Data (EID) and list installed operational profile packages:

    Terminal — LPA Profile List
    lpac chip info
lpac profile list
  3. 3
    Sniff ISO 7816 APDU Transactions:

    Capture real-time ATR and APDU exchanges between the host and smartcard using SIMtrace 2:

    Terminal — APDU Sniffer
    sudo telcosec sim trace sniff -o /tmp/esim-apdu-trace.pcap
  4. 4
    Interactive SIM File System Analysis:

    Explore 3GPP USIM/ISIM elementary files (EF.IMSI, EF.AD, EF.UST) in pySim-shell:

    Terminal — Launch pySim-shell
    telcosec sim shell -p 0

Evidence & Artifact Archiving

Bundle the resulting APDU PCAP traces and pySim output for your audit deliverables:

Terminal — Bundle Evidence
telcosec bundle-evidence esim-audit