Comprehensive technical knowledge base covering 12 GSMA eSIM specifications. 84+ articles on Remote SIM Provisioning — SGP.02, SGP.22, SGP.32, SGP.41, SGP.29, SGP.23, SGP.25, SGP.26 and more.
Three devices walk into a network.
First: a smartphone in your pocket. It has a gorgeous screen, a camera, and a human who taps “Install eSIM” after scanning a QR code.
Second: a smart electricity meter bolted to a basement wall. It has no screen. No buttons. Nobody will touch it for 15 years. It was installed in 2018 and hasn’t moved since.
Third: a soil sensor buried in a cornfield. It wakes up once a day, sends moisture data, and goes back to sleep. It’s one of ten thousand.
Same tiny security chip inside all three: the eUICC. But how each one gets its network keys? Completely different. The GSMA wrote three separate specifications, each for a different world.
| SGP.02 (The Factory | SGP.22) The Phone Shop | SGP.32. The Farm Field | |
|---|---|---|---|
| Nickname | M2M Push | Consumer Pull | IoT Pull |
| Born | 2013 | 2015 | 2023 |
| Built for | Meters, cars, industrial sensors | Phones, tablets, watches | Sensors, trackers, smart home |
| How keys arrive | PUSHED by the Commander | PULLED by the phone (you scan a QR) | PULLED by the device, or nudged by a manager |
| Who’s in charge? | The Fleet Owner (Operator) | You: the person holding the phone | You, or the IoT Manager (eIM) |
Fleet Owner: "Switch Meter #5001 to Network B!"
↓
Commander pushes command over the air
↓
Meter: "Command received. Switching."
No human. No screen. No scan. The Commander is always in charge. The device doesn’t ask for keys, it receives them. This is push delivery, and it works when the device can’t come to you.
You scan a QR code in a store
↓
Your phone: "Key Factory, I need my key!"
↓
Key Factory: "Here you go, enjoy your data plan!"
You decide. You scan. You tap “Install.” The phone drives everything. The key factory just waits to be asked. This is pull delivery: the device initiates the download.
IoT Manager: "Soil Sensor #8721, time for new keys. Check in when you wake up."
↓
Sensor wakes up at 06:00: "Oh, a message! Downloading now..."
↓
Or: You open an app and tap "Update sensors"
Flexible. Either the device pulls when it’s ready, or the IoT Manager sends a nudge. It’s like leaving a note on the fridge: the device reads it when it gets hungry.
| What Matters | SGP.02 (Factory) | SGP.22 (Phone Shop) | SGP.32 (Farm Field) |
|---|---|---|---|
| Server setup | Two servers: SM-DP + SM-SR (split roles) | One server: SM-DP+ (combined) | One server: SM-DP+ (combined) |
| Helper on device | None, ISD-R is passive | LPA app (full UI) | IPA (lightweight helper) |
| Fleet management | Operator via ES4 | Not built-in | eIM (IoT Manager) |
| Discovery | Not needed (push doesn’t discover) | SM-DS “post office” | SM-DS or eIM |
| OTA channel | Commander owns it | Key Factory owns it | Key Factory owns it |
| Screen? | Headless: no UI | Full screen, QR codes, menus | Minimal or none |
| Key exchange | ECKA-EG (ElGamal) | ECDH | ECDH |
| Spec size | 452 pages | ~296 pages | Still growing |
Quick decision guide:
Does a human hold this device and have a screen?
│
├── YES ──▶ SGP.22 (the phone shop)
│
└── NO ──▶ Can the device reach the internet on its own,
even occasionally?
│
├── YES, sometimes ──▶ SGP.32 (the farm field)
│
└── NO, truly unreachable ──▶ SGP.02 (the factory)
SGP.02 is from 2013. In tech years, that’s ancient. But it’s far from dead:
The M2M world moves at its own pace: the spec was designed for exactly that reality.
Here’s the part people miss: an operator can run all three at once. SGP.02 for the automotive fleet. SGP.22 for consumer subscribers. SGP.32 for smart home devices. Same core network, same SIM cards, different provisioning paths. The eUICC chip itself can potentially support multiple specs, it’s just a secure vault, after all.
SGP.02 was published in 2013 (years before the first eSIM iPhone shipped in 2018. When the GSMA started designing remote SIM provisioning in the early 2010s, nobody was thinking about smartphones. They were thinking about smart meters in basements, connected cars on highways, and industrial sensors in oil fields. Consumer eSIM) the one you scan with your phone, came after the robot network was already designed and deployed. The machines got there first.
Kid-friendly version, Cross-specification comparison of SGP.02, SGP.22, and SGP.32