Subject: [KEYPROV] On-line provisioning of SIMs

From: Anders Rundgren <[email-masked]>
Date: Sat, 20 Nov 2010 14:46:22 +0100

http://www.gsmworld.com/newsroom/press-releases/2010/5726.htm

As I said a million times before, on-line provisioning of HW tokens
is the future.

How does DSKPP fit SIMs?  As far as I can tell DSKPP does not support
E2ES (End To End Security) as specified by GlobalPlatform.

So it seems that a *new* quest for a provisioning protocol is here!

My take on this subject is (still...) that since HW tokens with few
exceptions are firmware-based, you might as well define the protocol
and the container in one step.  Many containers will in fact allow
field upgrades of the firmware, making such schemes better match
the current computing paradigm where you automagically get a major
mobile OS upgrade every 4-6 months.

Getting a unified driver as "side-effect" isn't that bad either;
who (in their right mind...) *likes* smart card middleware?

What may not be entirely obvious is that there is no need changing
existing applications or cryptographic APIs if you consider on-line
provisioning as a distinct new task, having its own API.  Don't fix
things that aren't broken has been an engineer's motto since ages back!

thanx,
Anders