Knowledge Base - SMAOT UICC Milenage: Quick guide
An example on how to personalize a Smartjac SMAOT 3G card with Milenage algorithm support, with Ki and OPc value, using Gemalto Card Admin.
Start Card Admin and put the USIM card in the smart card reader
Choose Generic UICC applet and click Select. Make sure the Card Type is correct! Note that for our Multi-application cards (USIM/ISIM/CSIM) the card should be recognized as 3G/GSM/CDMA Card.
If it's the first time you use the card with Card Admin, you may have to select the card type. Please look a this article on how to do it.
Open tree and scan 3G
Right-click on 3F00 - MF and select "Scan 3G"
Activate ADF-USIM
Right-click USIM - ADF USIM and choose "Activation"
Ki and OP/OPc files
Scroll down and you will find file 6FFC and file 6FFD. The Key Ki is put in 6FFC and the OPc is put in file 6FFD. in case you want to read the content of the files, you will need to change the access rights in file 6F06, in this case the records 16 and 17. (the column SE01 in Card Admin shows what security record the files uses)
Verifying Adm1 code
Click on the ikon for APDU exchange and then verify the Admin code as shown on the screen-shot. Click "Exchange" and you should get SW1=90 SW2=00 as a confirmation that the verification was succesful.
Change Access Rights
Open file 6F06. Go to tab 16 and 17, change Read/DeleteChild from "NEVER" to "ALWAYS" by editing the field and clicking "Check and Modify", Also change "Update/Create EF" in tab 17 to ALWAYS. Click "Update" when all changes are done. Tthe security record depends on the card. Please check what records the files in your card specifically uses).
Entering a new Ki and OPc
In this example we will update the Ki to 77777777777777777777777777777777 and OPc to DB46EEF88A1A4F3BB05B1AD880DA07F2. With SMAOT cards you will need to calculate a CRC value and add it to the end of the Ki and OPc value. If you have a CRC calculator or a tool to calculate CRC values then use CRC-CCITT (XModem) 16 bit calculations with CRC polynom 1021. In our case we will use online tools to calculate this.
Calculating CRC value for Ki
Go to http://depa.usst.edu.cn/chenjq/www2/software/crc/CRC_Javascript/CRCcalculation.htm and click button CCITT-16 and enter the Ki value. The checksum in our case is A033
Calculating CRC value for OPc
Fill Ki value + checksum in file 6FFC
Fill in value and click "Update"
Fill OPc value + checksum in file
Fill in the OPc value + checksum after the first byte "01". Click "Update"
Do Authentication
Right-click USIM - ADF USIM and select "Authenticate..." to check that your values was correctly set and your checksum values are correct.
Authentication
Choose algorithm Milenage and fill in your key and OPc value (this time without checksums) and click "Authenticate" to verify your values.
Tip! If you don't want to calculate the OPc value from the OP value...
...or you don't have the tools to do so, then you can actually use the OP value in file 6FFD. Change the first byte to "00" and enter the OP value after that. You still have to calculate the CRC checksum. In this case it is 47 85.
Note!
Don't forget to edit IMSI and ACC. Both most have values (ACC must be different from 00 00) in order for the card to succesfully register on the network.
Details
Created : 2016-05-02 11:11:59, Last Modified : 2017-06-15 13:47:43
Card Admin
Gemalto Telecom Card Admin tool is a tool to edit SIM & UICC cards. Card Admin provides all the necessary fundamentals to FULLY (Proprietary files, Proprietary commands etc.) administrate any 2G, 3G, LTE and CDMA card (Gemalto & Competition).
Module
The unit formed of a chip and a contact plate.
SMAOT
Smartjac OT series of UICC / SIM cards ranging from 2G SIM cards with XOR support, to advanced multi-application LTE UICC cards with Milenage support, NFC, USIM, ISIM and CSIM.
UICC
A high capacity smart card used in mobile terminals for GSM, UMTS/3G and now 4G/LTE networks.
Click for more info
CDMA
Code Division Multiple Access. A wireless communications technology that uses the spread spectrum communication to provide increased bandwidth.
Click for more info
Edge
A pre-3G digital mobile phone technology allowing improved data transmission rates.
Java
A network oriented programming language invented by Sun Microsystems and specificallt designed so that programs can be safely downloaded to remote devices.
USIM
Universal Subscriber Identity Module. A SIM with adbanced software that ensures continuity when migrating to 3G services.
HTTP
Hyper Text Transfer Protocol. A client-server communication protocol developed for World Wide Web. See IETF RFC2616, www.ietf.org.
IMSI
International Mobile Subscriber Identity. A unique number associated with each mobile phone user. It is stored in the SIM inside the phone and is sent by the phone to the network. It is primarily intended for obtaining information on the use of the Public Land Mobile Network (PLMN) by subscribers. It is also used for other functions such as to compute the Paging Occasions (PO) in LTE. See 3GPP TS22.016 and TS23.003.
SIM
A subscriber identity module or subscriber identification module (SIM) is an integrated circuit chip that is intended to securely store the international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephony devices.
Click for more info
NFC
Near field communication (NFC)
Click for more info
3FF
3FF (3rd Form Factor) is a very small SIM card, also known as micro-SIM, for use in small mobile device.
Click for more info
GSM
Global System for Mobile Communications. A European standard for digital cellular phones that has now been widely adopted throughout the world.
NFC
Near-Field Communication. A wireless technology that enables communication over short distances (e.g. 4cm), typically between a mobile device and a reader.
PDA
Personal Digital Assistant. A mobile device that functions as a personal information manager, often with the ability to connect to the internet.
PIN
Personal Identification Number. A secret code required to confirm a user's identity.
CRC
Cyclic Redundancy Check. An error detecting code appended to a block of data to be transmitted. The value of the CRC is calculated only from the block of data itself. The length of the CRC determines the number of errors which can be detected in the block of data on reception. A CRC is not able to correct errors or determine which bits are erroneous.
Click for more info
IMS
Internet Protocol Multimedia Subsystem. An architectural framework for delivering Internet Protocol (IP) multimedia services via UTRAN and E- UTRAN. See 3GPP TS23.228 and TS23.406.
NDS
Network Domain Security. A security architecture for network domain Internet Protocol (IP) based control planes, which is applied to NDS/IP-networks (i.e. 3GPP and fixed broadband networks) to provide security in the Core Network (CN). See 3GPP TS33.210.
4FF
4FF (4th Form Factor) is a very small SIM card, also known as nano-SIM, for use in small mobile device.
Click for more info
3G
(Third Generation) The broadband telecommunications systems that combine high speed voice, data and multimedia.
Click for more info
DM
Device Management: Management of mobile phone configuration, updates and other managed objects of mobile devices over the entire life-cycle as defined by OMA DM. DM is also used generically to describe all methods and activities associated with mobile device management.
Click for more info
IM
Using text on a mobile handset to communicate in real time
IP
Internet Protocol. A protocol for communicating data accross a network
Click for more info
OS
Operating System. Software that runs on computers and other smart devices and that manages the way they function.
SE
Secure Element. A secure and personalised physical component added to a system to manage users rights and to host secure apps. SE typically consist of a Silicon Chip, a secure Operating System, application software and a secure protocol to communicate to the device. SE can be a removable device (such as UICC or µSD for mobile devices or MIM for M2M connected machines). SE can also be components inside the system.
BS
Base Station. The entity in a radio access network responsible for radio trans- mission and reception in one or more cells to and from the UE. In LTE the BS is known as the eNodeB.
Click for more info
CN
Core Network. The part of the 3GPP system which is independent of the connection technology (e.g. the Radio Access Technology (RAT)) of the terminals. The terminals connect to the core network via the access network (which is RAT-specific).
HE
Home Environment. The HE of a subscriber is responsible for the overall pro- vision and control of the personal service environment to the subscriber.Â
HO
HandOver. HO is a procedure by which a mobile terminal changes serving cells (within the same frequency or on different frequencies or even on different Radio Access Technologies (RAT)). See 3GPP TS36.133.
PS
Packet Switched. In PS communication each data packet is labelled with the destination address and routed over a shared transmission resource. In contrast with Circuit Switching (CS) where dedicated transmission resources are re- served between network nodes to deliver a reliable transmission rate and delay, in a PS connection the transmission rate and delay may vary depending on the traffic load and the medium capacity, with packets being buffered if necessary.
UE
User Equipment. The mobile unit which allows a user to access network services, connecting to the UTRAN or E-UTRAN via the radio interface. A UE can be subdivided into a Universal Integrated Circuit Card (UICC) and a Mo- bile Equipment (ME). See 3GPP TS21.905 Section 3.
SIM
A subscriber identity module or subscriber identification module (SIM) is an integrated circuit chip that is intended to securely store the international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephony devices.
Click for more info
SIM
A subscriber identity module or subscriber identification module (SIM) is an integrated circuit chip that is intended to securely store the international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephony devices.
Click for more info
