Comprehensive technical knowledge base covering 12 GSMA eSIM specifications. 84+ articles on Remote SIM Provisioning — SGP.02, SGP.22, SGP.32, SGP.41, SGP.29, SGP.23, SGP.25, SGP.26 and more.
Your new safe has passed every test. The design is solid. The penetration testers gave up. But there’s one more step before banks will trust it: a site audit. Inspectors visit the factory, check the security cameras, interview the workers, and verify that every safe leaves the factory without being tampered with.
For eUICC chips, this is SAS-UP : the GSMA Security Accreditation Scheme for UICC Production. It’s the final seal of approval that says: “This chip was built right, in a secure facility, by trusted people.”
Getting an eUICC certified involves many players:
| Actor | Role |
|---|---|
| GSMA | Rulebook author: owns SGP.25 and runs the SAS programme |
| eSIM CA | Trust anchor: issues certificates to everyone else |
| EUM (eUICC Manufacturer) | Chip maker: develops the eUICC, hires the lab |
| Accredited Lab | Evaluator: runs all EAL4+ tests including AVA_VAN.5 |
| Certification Body | Issuer: reviews the lab’s report and grants the certificate |
| SAS Auditors | Site inspectors: verify physical and procedural security |
The eSIM CA (Certificate Authority) plays a special role: it’s the root of trust for the entire public key infrastructure. Its public key is stored in every eUICC’s ECASD. If the eSIM CA were compromised, every chip that trusts it would be at risk.
Not every chip manufacturer starts from the same place. SGP.25 offers three evaluation models:
┌─────────────────┐
│ Certified IC │ ← Already has [PP0084] certificate
├─────────────────┤
│ Certified OS │ ← Already has platform certificate
├─────────────────┤
│ Certified RE │ ← Already has [PP-JCS] certificate
├─────────────────┤
│ eUICC Software │ ← NEW: evaluated against SGP.25 on top
└─────────────────┘
The Security Target references existing certificates for the lower layers. Only the eUICC-specific software is evaluated. This is the most common path: most manufacturers use certified Java Card platforms on certified secure ICs.
┌─────────────────┐
│ IC + OS + RE + │ ← ONE big evaluation
│ eUICC Software │ from hardware to app
└─────────────────┘
Everything is evaluated at once. Larger scope, no dependencies on third-party certificates. Used by vertically integrated manufacturers or novel architectures.
┌─────────────────┐
│ Certified IC │ ← Already certified
├─────────────────┤
│ OS + RE + │ ← NEW: composite evaluation
│ eUICC Software │ of software on certified IC
└─────────────────┘
The IC is pre-certified; everything above is evaluated as a composite product.
The vendor writes a Security Target (ST) : a document that instantiates SGP.25 for their specific product:
The vendor hires a CC-accredited lab. The lab reviews:
The lab’s penetration testers go to work:
If they find a way in: you fail. Back to engineering. Fix it. Try again.
The lab produces an Evaluation Technical Report (ETR). The national certification body (e.g., BSI in Germany, ANSSI in France) reviews the ETR and issues:
31 countries recognise this certificate. One evaluation, global trust.
While SGP.25 certifies the product, SAS-UP certifies the factory:
| SAS-UP Audits | What It Checks |
|---|---|
| Physical security | Perimeter fencing, CCTV, access control, secure areas |
| Personnel security | Background checks, training, segregation of duties |
| Key management | Generation, injection, storage, destruction procedures |
| Production segregation | Separation between phases, clean rooms, anti-contamination |
| Audit logging | Who did what, when, where: with tamper-proof records |
| Secure transport | How products move between facilities and phases |
The personalisation phase (Phase d) : where the eUICC’s private key is injected: MUST occur at a SAS-accredited site. This is non-negotiable.
SGP.25 and SGP.23-1 work together:
| Aspect | SGP.23-1 (Testing) | SGP.25 (Security) |
|---|---|---|
| What it proves | The chip speaks the protocol correctly | The chip resists attacks |
| Methodology | Scripted test cases with known answers | Independent vulnerability analysis |
| Attacker model | Protocol misbehaviour | Sophisticated attacker with physical access |
| Output | Digital Letter of Approval (DLOA) | Common Criteria Certificate |
| Governance | GSMA Test Events + GlobalPlatform | National CC scheme + CCRA |
Both are required for production deployment. Protocol conformance without security is useless. Security without protocol conformance is also useless. You need both.
Certification isn’t “one and done”:
The SAS accreditation number for the factory is actually embedded in the eUICC’s data structure (EUICCInfo2). This means any operator receiving a profile notification can trace the chip back to the specific SAS-accredited facility that personalised it. Full traceability from deployment to factory floor: that’s trust you can verify!
Kid-friendly version of GSMA SGP.25 v2.1: Certification and SAS-UP