Qualcomm wants to replace eSIMs with iSIMs, has the first certified SoC

Everything else including the term "iSIM" just seems to be marketing cruft?

Perhaps I'm missing some detail but it seems the only people who would have any reason to care about this would be Qualcomm's customers in the mobile OEM space.

Of course they can, all they need to do is pass certification.

I haven't gone into the details but certification is a major undertaking. So yes the logical functionality of what goes into an eSIM may be almost identical to that of an iSIM but integrating that same logic into an SoC means a whole new certification process. In particular certification will consider resistance to physical attacks and the hardening employed will be effected by the SoC integration. You need to bury critical nets deep in the metal stack to help defeat probing attacks and add detectors for intrusions. Integrating these across the whole SoC could be a particular challenge so work may required to apply them only across the chip area used by the iSIM. New design work was likely required for the on-chip interfacing between the iSIM and the rest of the SoC, again needing to ensure it complied with certification requirements.

I don't think it's fair to describe this as a mere PR piece. Significant work will have been required by backend engineers to integrate the iSIM so it's suitable for certification plus all the work required to generate the collateral for certification.

Qualcomm haven't created a whole new piece of technology here but this doesn't mean integrating the existing technology wasn't a major amount of work and a milestone worth publicising (especially as it is the first instance of this).

Ars Technica does not do paid articles. They put a disclaimer to that effect on car reviews when a manufacturer pays for flight and hotel costs.

Also, another thing I hate about having an eSim is that it sorta forces you to install your carriers app, which for some cheap/mid-tier carriers is an ad-infested mess.

In theory, with an eSIM it's even easier to swap in your old SIM because you don't have to deal with the physical SIM card. Especially so if you don't have the physical SIM because it's lost or whatever. In my experience it's super frustrating to have to wait for a new SIM to arrive in the mail because you lost it or the old one is faulty!

Some carriers [1] also support "eSIM Quick Transfer" which allows you to swap eSIMs between devices instantly in the phone's carrier settings, with no need to contact the carrier or deal with their website/software.

[1] https://support.apple.com/en-gb/HT209096

eSIMs are a massive win when travelling, too. Instantly activate a data plan at cheap local rates in whatever country your travelling to, without having to first get your hands on a physical SIM...

You can have multiple eSIMs on the device and activate them when you need… for example travel SIM, or a SIM for your home country, etc. It’s way more convenient than physical SIM cards.

- AT&T makes transferring iPhone - to - iPhone trivial; offers to transfer automatically during setup

- Visible provides an example of a simple app that can install an eSIM on your new device without talking to a customer support rep or waiting for something to come in the mail;

- The previous also applies when moving between competitors - means one can switch carriers in an hour from your living room

- Traveling to Greece with the Airalo eSIM app was trivial to set up (open app, search country, pick data package) and while I'm sure I paid more than I could've if I'd found a local physical SIM, I was able to set it up before leaving the US so it worked instantly the moment we landed, and the app made it easy to track data usage and reload if needed without phone calls or local apps.

No, because the eSIM provisioning process, as well as eSIM profiles themselves, are standardized, down to how the activation code is represented in a QR code.

SIM-less CDMA phone provisioning was never that flexible, as far as I know.

Of course, providers can make this as easy or hard as they want to (e.g. by not allowing the reuse of activation codes, tying activation codes to an IMEI, having an allowlist of supported phone models despite eSIM being a standard etc.), but they can already do much of that for physical SIMs as well.

SIMs are smartcards - separate systems storing cryptographic material and performing trusted operations. A TPM that can be plugged and unplugged, basically, using the same standards as a chip-and-pin credit card.

Equivalent keystores haven't been available built in to cell phones until the last few years.

When you integrate it in the SoC, some of those requirements (tamper protection) will apply to the whole SoC, and you have to integrate the SIM module on the SoC without the company designing it, or the company manufacturing it, having the ability to compromise its security.

I'm guessing it has just taken time hash out the procedure for integrating the iSIM.

That really depends on the carrier. In my case, setting up a new iPhone to replace an old one means saying yes in the prompt displayed by the phone. Nothing else. This is more convenient than having to search for the SIM removal tool.

> -you can't just hand over your phone to someone else, you have to unroll yourself and enroll the other person

For me this is a big feature because I would never hand my phone to somebody else, but an attacker is very likely to remove the SIM card and put it into their phone. Now suddenly many 2FA accounts are protected by a 4 digit PIN rather than my 20 digit phone passphrase.

> -you don't have anonymity and privacy since is no longer possible to use a prepaid physical SIM

It works exactly the same way as it did with physical SIM cards only the physical card is replaced by a QR code displayed on a screen or a printed paper. If the carrier sells anonymous prepaid SIM cards, nothing prevents them from selling anonymous prepaid QR codes.

Imagine having to agree on a sale and then waiting for the changeover process to complete. Which knowing certain phone carriers would take at least 24 hours.

The procedure around integrating an iSIM into an SoC is ridiculously strict. The integration and simulation has to happen on a workstation in a special room, not connected to the rest of the network, with camera surveillance, etc.

> We're also supposed to trust Qualcomm that this is secure

I don't know if Qualcomm can do things differently. I don't know if they can design the iSIM themselves instead of integrating from a trusted third party. But I doubt that the security requirement is any less strict. Telecom operators seem to be extremely paranoid about this stuff.

Essentially, it seems like it's not that much different from eSIM, you're just putting a similar kind of trusted module on the SoC instead of on the PCB.

> together with it's anti-tampering design

I'd be very surprised if iSIM and the whole Qualcomm SoC isn't designed with anti-tampering mechanisms. Seems like anti-tampering is becoming a general requirement for SoCs (with upgradable firmware and root-of-trust) being designed now.

Just because a device is on the same package or die doesn't mean all features need to be exposed to everything else on that package or die. Imagine if you just took the design for a regular SIM card, and then essentially just directly connected it on the package or on the die. Its still the same interface, but instead of it being a separate package connecting to pins on a board that connect to other pins on a board and then to the SoC its just all in the same plastic package. Then go from instead of wiring it in the plastic package, you're not wiring it on the die itself.

Now, of course, this obviously isn't how these things work, since they can load cryptographic material from things like QR codes and apps. While older SIMs were mostly read only (usually a small amount of user memory like address book stuff and what not) these newer eSIMs and iSIMs allow for provisioning in the field. This does bring some attack surface to them, but once again these kind of interfaces could be locked down. It doesn't necessarily need to share logic with the main CPU or have its memory in system RAM, it can still hold all its cryptographic secrets in its own private non-accessible memory and do its functions with its own logic designs. The provisioning step is still potentially attackable, but if designed right its secret storage and management can still be highly isolated to the main processors in the same way older SIMs were.

In all of the interactions I've had, eSIM works without issue and right away. Most of the times I've needed a physical SIM card I've had to wait for it to be mailed or plan a trip to a physical store, or the old one is the wrong size and I need a new one or an adapter.

The only issue I can see is that I can't take that card out and put it in a USB modem to use in my router. But I have seperate SIM for that, that has cheaper data plan than my ordinary phone.

There are CDMA enabled phones that do not need a SIM card but they're a pain to transfer to another carrier. At least today.

https://www.oracle.com/java/java-card/

A possible attack vector? Perhaps if something's not coded correctly... which can easily be fixed with software update.

I'm sure there's more into this of course, but that should be the general motivation.

All phones on one "line" will ring at the same time, but only one will receive incoming texts, unfortunately, due to how SMS is implemented at the network level.