Security Analysis of the Consumer Remote SIM Provisioning Protocol

[ArpitxGit]

Discussed in https://github.com/orgs/Blockchain-Powered-eSIM/discussions/1

^{Originally posted by ArpitxGit October 9, 2024}
Observation from this great paper

RSP security is critical because, The Profile includes the credentials with which the mobile device will authenticate to the mobile network

a) Define eSIM as "process"? , downloading SIM Profiles into a secure element in a mobile device,

Security of the process,

i) Depends unnecessarily on it being encapsulated in a TLS tunnel,
ii) Lack of pre-established identifiers means that a compromised download server anywhere in the world or a compromised secure element can be used for attacks against RSP between honest participants.
iii) Lack of reliable methods for verifying user intent can lead to serious security failures.