
Smart Cards Lab COMPGA12 University College London
14 GSM SIM Card Exploration
We mean a classical (2G) SIM card, what we present here also works on
many (but not all as it seems) 3G cards that are (not always?) backwards
compatible with 2G phones.
Quiz SIM stands for:
Standard ICC for Mobile (phones) Subscriber Identity Module
Bibliography: The exact specifications of how a mobile phone commu-
nicates with a SIM card can be found in the ETSI GSM 11-11 document.
14.1 GSM SIM Card During a Phone Call
We will perform the following sequence of operations:
1. Select the file DF
GSM
, which is one of the two main directories on
each SIM card, the second being DF
T ELEC OM
.
2. Verify the PIN (not needed if PIN inactive).
3. Run the GSM algorithm to obtain cryptographic keys for the authen-
tication and encryption during the current phone call.
This is the strict minimum that needs to be executed for each phone call
(the phone does NOT know the secret key of the card and therefore cannot
replace the SIM card in these 3 operations, it can however cache the PIN so
that the user does not have to enter it each time).
14.2 Accessing DF
GSM
First we execute the following:
GSM SELECT FILE (by FID)
CLA INS P1 P2 Le FID
A0 A4 00 00 02 7F 20
Where the FID of DF
GSM
is ’7F 20’.
The answer should be:
SW1 SW2
9F
Where is the length of the response data
that we will now recover with GET RESPONSE command:
c
Nicolas T. Courtois 2009-10
Comentarios a estos manuales