pySim-shell_test/euicc: ensure test-profile is enabled

When testing commands like get_profile_info, enable_profile, disable_profile or the commands to manage notifications, we should ensure that the correct profile is enabled before executing the actual testcase. Change-Id: Ie57b0305876bc5001ab3a9c3a3b5711408161b74
2026-03-17 19:08:35 +03:00 · 2026-02-10 11:34:31 +01:00
23 changed files with 110 additions and 1265 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,5 @@
 *.pyc
-.*.sw?
+.*.swp

 /docs/_*
 /docs/generated
--- a/contrib/smpp-ota-tool.py
+++ b/contrib/smpp-ota-tool.py
@@ -30,48 +30,6 @@ from pathlib import Path

 logger = logging.getLogger(Path(__file__).stem)

-option_parser = argparse.ArgumentParser(description='Tool to send OTA SMS RFM/RAM messages via SMPP',
-                                        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-option_parser.add_argument("--host", help="Host/IP of the SMPP server", default="localhost")
-option_parser.add_argument("--port", help="TCP port of the SMPP server", default=2775, type=int)
-option_parser.add_argument("--system-id", help="System ID to use to bind to the SMPP server", default="test")
-option_parser.add_argument("--password", help="Password to use to bind to the SMPP server", default="test")
-option_parser.add_argument("--verbose", help="Enable verbose logging", action='store_true', default=False)
-algo_crypt_choices = []
-algo_crypt_classes = OtaAlgoCrypt.__subclasses__()
-for cls in algo_crypt_classes:
-    algo_crypt_choices.append(cls.enum_name)
-option_parser.add_argument("--algo-crypt", choices=algo_crypt_choices, default='triple_des_cbc2',
-                           help="OTA crypt algorithm")
-algo_auth_choices = []
-algo_auth_classes = OtaAlgoAuth.__subclasses__()
-for cls in algo_auth_classes:
-    algo_auth_choices.append(cls.enum_name)
-option_parser.add_argument("--algo-auth", choices=algo_auth_choices, default='triple_des_cbc2',
-                           help="OTA auth algorithm")
-option_parser.add_argument('--kic', required=True, type=is_hexstr, help='OTA key (KIC)')
-option_parser.add_argument('--kic-idx', default=1, type=int, help='OTA key index (KIC)')
-option_parser.add_argument('--kid', required=True, type=is_hexstr, help='OTA key (KID)')
-option_parser.add_argument('--kid-idx', default=1, type=int, help='OTA key index (KID)')
-option_parser.add_argument('--cntr', default=0, type=int, help='replay protection counter')
-option_parser.add_argument('--tar', required=True, type=is_hexstr, help='Toolkit Application Reference')
-option_parser.add_argument("--cntr-req", choices=CNTR_REQ.decmapping.values(), default='no_counter',
-                           help="Counter requirement")
-option_parser.add_argument('--no-ciphering', action='store_true', default=False, help='Disable ciphering')
-option_parser.add_argument("--rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
-                           help="message check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
-option_parser.add_argument('--por-in-submit', action='store_true', default=False,
-                           help='require PoR to be sent via SMS-SUBMIT')
-option_parser.add_argument('--por-no-ciphering', action='store_true', default=False, help='Disable ciphering (PoR)')
-option_parser.add_argument("--por-rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
-                           help="PoR check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
-option_parser.add_argument("--por-req", choices=POR_REQ.decmapping.values(), default='por_required',
-                           help="Proof of Receipt requirements")
-option_parser.add_argument('--src-addr', default='12', type=str, help='SMS source address (MSISDN)')
-option_parser.add_argument('--dest-addr', default='23', type=str, help='SMS destination address (MSISDN)')
-option_parser.add_argument('--timeout', default=10, type=int, help='Maximum response waiting time')
-option_parser.add_argument('-a', '--apdu', action='append', required=True, type=is_hexstr, help='C-APDU to send')
-
 class SmppHandler:
    client = None

@@ -183,7 +141,7 @@ class SmppHandler:
                tuple containing the last response data and the last status word as byte strings
        """

-        logger.info("C-APDU sending: %s...", b2h(apdu))
+        logger.info("C-APDU sending: %s..." % b2h(apdu))

        # translate to Secured OTA RFM
        secured = self.ota_dialect.encode_cmd(self.ota_keyset, self.tar, self.spi, apdu=apdu)
@@ -209,28 +167,65 @@ class SmppHandler:
        return h2b(resp), h2b(sw)

 if __name__ == '__main__':
+    option_parser = argparse.ArgumentParser(description='CSV importer for pySim-shell\'s PostgreSQL Card Key Provider',
+                                   formatter_class=argparse.ArgumentDefaultsHelpFormatter)
+    option_parser.add_argument("--host", help="Host/IP of the SMPP server", default="localhost")
+    option_parser.add_argument("--port", help="TCP port of the SMPP server", default=2775, type=int)
+    option_parser.add_argument("--system-id", help="System ID to use to bind to the SMPP server", default="test")
+    option_parser.add_argument("--password", help="Password to use to bind to the SMPP server", default="test")
+    option_parser.add_argument("--verbose", help="Enable verbose logging", action='store_true', default=False)
+    algo_crypt_choices = []
+    algo_crypt_classes = OtaAlgoCrypt.__subclasses__()
+    for cls in algo_crypt_classes:
+        algo_crypt_choices.append(cls.enum_name)
+    option_parser.add_argument("--algo-crypt", choices=algo_crypt_choices, default='triple_des_cbc2',
+                               help="OTA crypt algorithm")
+    algo_auth_choices = []
+    algo_auth_classes = OtaAlgoAuth.__subclasses__()
+    for cls in algo_auth_classes:
+        algo_auth_choices.append(cls.enum_name)
+    option_parser.add_argument("--algo-auth", choices=algo_auth_choices, default='triple_des_cbc2',
+                               help="OTA auth algorithm")
+    option_parser.add_argument('--kic', required=True, type=is_hexstr, help='OTA key (KIC)')
+    option_parser.add_argument('--kic_idx', default=1, type=int, help='OTA key index (KIC)')
+    option_parser.add_argument('--kid', required=True, type=is_hexstr, help='OTA key (KID)')
+    option_parser.add_argument('--kid_idx', default=1, type=int, help='OTA key index (KID)')
+    option_parser.add_argument('--cntr', default=0, type=int, help='replay protection counter')
+    option_parser.add_argument('--tar', required=True, type=is_hexstr, help='Toolkit Application Reference')
+    option_parser.add_argument("--cntr_req", choices=CNTR_REQ.decmapping.values(), default='no_counter',
+                               help="Counter requirement")
+    option_parser.add_argument('--ciphering', default=True, type=bool, help='Enable ciphering')
+    option_parser.add_argument("--rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
+                               help="message check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
+    option_parser.add_argument('--por-in-submit', default=False, type=bool,
+                               help='require PoR to be sent via SMS-SUBMIT')
+    option_parser.add_argument('--por-shall-be-ciphered', default=True, type=bool, help='require encrypted PoR')
+    option_parser.add_argument("--por-rc-cc-ds", choices=RC_CC_DS.decmapping.values(), default='cc',
+                               help="PoR check (rc=redundency check, cc=crypt. checksum, ds=digital signature)")
+    option_parser.add_argument("--por_req", choices=POR_REQ.decmapping.values(), default='por_required',
+                               help="Proof of Receipt requirements")
+    option_parser.add_argument('--src-addr', default='12', type=str, help='TODO')
+    option_parser.add_argument('--dest-addr', default='23', type=str, help='TODO')
+    option_parser.add_argument('--timeout', default=10, type=int, help='TODO')
+    option_parser.add_argument('-a', '--apdu', action='append', required=True, type=is_hexstr, help='C-APDU to send')
    opts = option_parser.parse_args()

    logging.basicConfig(level=logging.DEBUG if opts.verbose else logging.INFO,
                        format='%(asctime)s %(levelname)s %(message)s',
                        datefmt='%Y-%m-%d %H:%M:%S')

-    if opts.kic_idx != opts.kid_idx:
-        logger.warning("KIC index (%s) and KID index (%s) are different (security violation, card should reject message)",
-                       opts.kic_idx, opts.kid_idx)
-
    ota_keyset = OtaKeyset(algo_crypt=opts.algo_crypt,
                           kic_idx=opts.kic_idx,
                           kic=h2b(opts.kic),
                           algo_auth=opts.algo_auth,
-                           kid_idx=opts.kid_idx,
+                           kid_idx=opts.kic_idx,
                           kid=h2b(opts.kid),
                           cntr=opts.cntr)
    spi = {'counter' : opts.cntr_req,
-           'ciphering' : not opts.no_ciphering,
+           'ciphering' : opts.ciphering,
           'rc_cc_ds': opts.rc_cc_ds,
-           'por_in_submit': opts.por_in_submit,
-           'por_shall_be_ciphered': not opts.por_no_ciphering,
+           'por_in_submit':opts.por_in_submit,
+           'por_shall_be_ciphered':opts.por_shall_be_ciphered,
           'por_rc_cc_ds': opts.por_rc_cc_ds,
           'por': opts.por_req}
    apdu = h2b("".join(opts.apdu))
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -48,7 +48,6 @@ pySim consists of several parts:
   sim-rest
   suci-keytool
   saip-tool
-   smpp-ota-tool


 Indices and tables
--- a/docs/put_key-tutorial.rst
+++ b/docs/put_key-tutorial.rst
@@ -1,842 +0,0 @@
-Guide: Managing GP Keys
-=======================
-
-Most of todays smartcards follow the GlobalPlatform Card Specification and the included Security Domain model.
-UICCs and eUCCCs are no exception here.
-
-The Security Domain acts as an on-card representative of a card authority or administrator. It is used to perform tasks
-like the installation of applications or the provisioning and rotation of secure channel keys. It also acts as a secure
-key storage and offers all kinds of cryptographic services to applications that are installed under a specific
-Security Domain (see also GlobalPlatform Card Specification, section 7).
-
-In this tutorial, we will show how to work with the key material (keysets) stored inside a Security Domain and how to
-rotate (replace) existing keys. We will also show how to provision new keys.
-
-.. warning:: Making changes to keysets requires extreme caution as misconfigured keysets may lock you out permanently.
-	     It also strongly recommended to maintain at least one backup keyset that you can use as fallback in case
-	     the primary keyset becomes unusable for some reason.
-
-
-Selecting a Security Domain
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-A typical smartcard, such as an UICC will have one primary Security Domain, called the Issuer Security Domain (ISD).
-When working with those cards, the ISD will show up in the UICC filesystem tree as `ADF.ISD` and can be selected like
-any other file.
-
-::
-   
-   pySIM-shell (00:MF)> select ADF.ISD
-   {
-      "application_id": "a000000003000000",
-      "proprietary_data": {
-         "maximum_length_of_data_field_in_command_message": 255
-      }
-   }
-
-When working with eUICCs, multiple Security Domains are involved. The model is slightly different from the classic
-model with one primary ISD. In the case of eUICCs, an ISD-R and an ISD-P exists.
-
-The ISD-R (Issuer Security Domain - Root) is indeed the primary ISD. Its purpose is to handle the installation of new
-profiles and to manage the already installed profiles. The ISD-R shows up as a `ADF.ISD-R` and can be selected normally
-(see above) The key material that allows access to the ISD-R is usually only known to the eUICC manufacturer.
-
-The ISD-P (Issuer Security Domain - Profile) is the primary ISD of the currently enabled profile. The ISD-P is
-comparable to the ISD we find on a UICC. The key material for the ISD-P should be known known to the ISP, which
-is the owner of the installed profile.
-
-Since the AID of the ISD-P is allocated during the profile installation and different for each profile, it is not known
-by pySim-shell. This means there will no `ADF.ISD-P` file show up in the file system, but we can simply select the
-ISD-R, request the AID of the ISD-P and switch over to that ISD-P using a raw APDU:
-``00a4040410`` + ``a0000005591010ffffffff8900001000`` + ``00``
-
-::
-
-    pySIM-shell (00:MF)> select ADF.ISD-R
-    {
-        "application_id": "a0000005591010ffffffff8900000100",
-        "proprietary_data": {
-            "maximum_length_of_data_field_in_command_message": 255
-        },
-        "isdr_proprietary_application_template": {
-            "supported_version_number": "020300"
-        }
-    }
-    pySIM-shell (00:MF/ADF.ISD-R)> get_profiles_info 
-    {
-        "profile_info_seq": {
-            "profile_info": {
-                "iccid": "8949449999999990023",
-                "isdp_aid": "a0000005591010ffffffff8900001000",
-                "profile_state": "enabled",
-                "service_provider_name": "OsmocomSPN",
-                "profile_name": "TS48V1-A-UNIQUE",
-                "profile_class": "operational"
-            }
-        }
-    }
-    pySIM-shell (00:MF/ADF.ISD-R)> apdu 00a4040410a0000005591010ffffffff890000100000
-    SW: 9000, RESP: 6f188410a0000005591010ffffffff8900001000a5049f6501ff
-    pySIM-shell (00:MF/ADF.ISD-R)>
-
-After that, the prompt will still show the ADF.ISD-R, but we are actually in ADF.ISD-P and the standard GlobalPlatform
-operations like `establish_scpXX`, `get_data`, and `put_key` should work. The same workaround can also be applied to any
-Supplementary Security Domain as well, provided that the AID is known to the user.
-
-
-Establishing a secure channel
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Before we can make changes to the keysets in the currently selected Security Domain we must first establish a secure channel
-with that Security Domain. The secure channel protocols commonly used for this are `SCP02` (see also GlobalPlatform Card
-Specification, section E.1.1) and `SCP03` (see also GlobalPlatform Card Specification – Amendment D). `SCP02` is slightly
-older and commonly used on UICCs. The more modern `SCP03` is commonly used on eUICCs. The main difference between the
-two is that `SCP02` uses 3DES while `SCP03` is based on AES.
-
-.. warning:: Secure channel protocols like `SCP02` and `SCP03` may manage an error counter to count failed login
-	     attempts. This means attempting to establish a secure channel with a wrong keyset multiple times may lock
-	     you out permanently. Double check the applied keyset before attempting to establish a secure channel.
-
-
-Example: `SCP02`
----------------
-
-In the following example, we assume that we want to establish a secure channel with the ISD of a `sysmoUSIM-SJA5` UICC.
-Along with the card we have received the following keyset:
-
-+---------+----------------------------------+
-| Keyname | Keyvalue                         |
-+=========+==================================+
-| ENC/KIC | F09C43EE1A0391665CC9F05AF4E0BD10 |
-+---------+----------------------------------+
-| MAC/KID | 01981F4A20999F62AF99988007BAF6CA |
-+---------+----------------------------------+
-| DEK/KIK | 8F8AEE5CDCC5D361368BC45673D99195 |
-+---------+----------------------------------+
-
-This keyset is tied to the key version number KVN 122 and is configured as a DES keyset. We can use this keyset to
-establish a secure channel using the SCP02 Secure Channel Protocol.
-
-::
-
-    pySIM-shell (00:MF/ADF.ISD)> establish_scp02 --key-enc F09C43EE1A0391665CC9F05AF4E0BD10 --key-mac 01981F4A20999F62AF99988007BAF6CA --key-dek 8F8AEE5CDCC5D361368BC45673D99195 --security-level 3
-    Successfully established a SCP02[03] secure channel
-
-
-Example: `SCP03`
----------------
-
-The establishment of a secure channel via SCP03 works just the same. In the following example we will establish a
-secure channel to the ISD-R of an eUICC. The SCP03 keyset we use is tied to KVN 50 and looks like this:
-
-+---------+------------------------------------------------------------------+
-| Keyname | Keyvalue                                                         |
-+=========+==================================================================+
-| ENC/KIC | 620ff456b0c0328b68dc0d7d5eb24e07dd749aa86c9ff1836a7263e1d8896510 |
-+---------+------------------------------------------------------------------+
-| MAC/KID | b38116a2c85f2c8f46bbdc0081d6e8a04b0a58087d0ce5ee0ccc4c945e4aeda6 |
-+---------+------------------------------------------------------------------+
-| DEK/KIK | d409486cbcb8092a8592ee46d8668dfa97bea5eb7ce9c2b5a3f3bb1db358a153 |
-+---------+------------------------------------------------------------------+
-
-We assume that ADF.ISD-R is already selected. We may now establish the SCP03 secure channel:
-
-::
-   
-   pySIM-shell (00:MF/ADF.ISD-R)> establish_scp03 --key-enc 620ff456b0c0328b68dc0d7d5eb24e07dd749aa86c9ff1836a7263e1d8896510 --key-mac b38116a2c85f2c8f46bbdc0081d6e8a04b0a58087d0ce5ee0ccc4c945e4aeda6 --key-dek d409486cbcb8092a8592ee46d8668dfa97bea5eb7ce9c2b5a3f3bb1db358a153 --key-ver 50 --security-level 3
-   Successfully established a SCP03[03] secure channel
-
-
-Understanding Keysets
-~~~~~~~~~~~~~~~~~~~~~
-
-Before making any changes to keysets, it is recommended to check the status of the currently installed keysets. To do
-so, we use the `get_data` command to retrieve the `key_information`. We cannot read back the key values themselves, but
-we get a summary of the installed keys together with their KVN numbers, IDs, algorithm and key length values.
-
-Example: `key_information` from a `sysmoISIM-SJA5`:
-
-::
-
-    pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> get_data key_information 
-    {
-        "key_information": [
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 112,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 112,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 112,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 1,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 1,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 1,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 2,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 2,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 2,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 47,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 47,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 47,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            }
-        ]
-    }
-
-Example: `key_information` from a `sysmoEUICC1-C2T`:
-
-::
-
-    pySIM-shell (SCP03[03]:00:MF/ADF.ISD-R)> get_data key_information
-    {
-        "key_information": [
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 50,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 50,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 50,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 64,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 64,
-                    "key_types": [
-                        {
-                            "type": "tls_psk",
-                            "length": 16
-                        }
-                    ]
-                }
-            }
-        ]
-    }
-
-The output from those two examples above may seem lengthy, but in order to move on and to provision own keys
-successfully, it is important to understand each aspect of it.
-
-Key Version Number (KVN)
------------------------
-
-Each key is associated with a Key Version Number (KVN). Multiple keys that share the same KVN belong to the same
-keyset. In the first example above we can see that four keysets with KVN numbers 112, 1, 2 and 47 are provisioned.
-In the second example we see two keysets. One with KVN 50 and one with KVN 64.
-
-The term "Key Version Number" is misleading as this number is not really a version number. It's actually a unique
-identifier for a specific keyset that also defines with which Secure Channel Protocol a key can be used. This means
-that the KVN is not just an arbitrary number. The following (incomplete) table gives a hint which KVN numbers may be
-used with which Secure Channel Protocol.
-
-+-----------+-------------------------------------------------------+
-| KVN range | Secure Channel Protocol                               |
-+===========+=======================================================+
-| 1-15      | reserved for `SCP80` (OTA SMS)                        |
-+-----------+-------------------------------------------------------+
-| 17        | reserved for DAP specified in ETSI TS 102 226         |
-+-----------+-------------------------------------------------------+
-| 32-47     | reserved for `SCP02`                                  |
-+-----------+-------------------------------------------------------+
-| 48-63     | reserved for `SCP03`                                  |
-+-----------+-------------------------------------------------------+
-| 112       | Token key (RSA public or DES, also used with `SCP02`) |
-+-----------+-------------------------------------------------------+
-| 113       | Receipt key (DES)                                     |
-+-----------+-------------------------------------------------------+
-| 115       | DAP verifiation key (RS public or DES)                |
-+-----------+-------------------------------------------------------+
-| 116       | reserved for CASD                                     |
-+-----------+-------------------------------------------------------+
-| 117       | 16-byte DES key for Ciphered Load File Data Block     |
-+-----------+-------------------------------------------------------+
-| 129-143   | reserved for `SCP81`                                  |
-+-----------+-------------------------------------------------------+
-| 255       | reserved for ISD with SCP02 without SCP80 support     |
-+-----------+-------------------------------------------------------+
-
-With that we can now understand that in the first example, the first and the last keyset is intended to be used with
-`SCP02` and that the second and the third keyset is intended to be used with `SCP80` (OTA SMS). In the second example we
-can see that the first keyset is intended to be used with `SCP03`, wheres the second should be usable with `SCP81`.
-
-
-Key Identifier
--------------
-
-Each keyset consists of a number of keys, where each key has a different Key Identifier. The Key Identifier is usually
-an incrementing number that starts counting at 1. The Key Identifier is used to distinguish the keys within the keyset.
-The exact number of keys and their attributes depends on the secure channel protocol for which the keyset is intended
-for. Each secure channel protocol may have its specific requirements on how many keys of which which type, length or
-Key Identifier have to be present.
-
-However, almost all of the classic secure channel protocols (including  `SCP02`, `SCP03` and `SCP81`) make use of the
-following three-key scheme:
-
-+----------------+---------+---------------------------------------+
-| Key Identifier | Keyname | Purpose                               |
-+================+=========+=======================================+
-| 1              | ENC/KIC | encryption/decryption                 |
-+----------------+---------+---------------------------------------+
-| 2              | MAC/KID | cryptographic checksumming/signing    |
-+----------------+---------+---------------------------------------+
-| 3              | DEK/KIK | encryption/decryption of key material |
-+----------------+---------+---------------------------------------+
-
-In this case, all three keys share the same length and are used with the same algorithm. The key length is often used
-to implicitly select sub-types of an algorithm. (e.g. a 16 byte key of type `aes` is associated with `AES128`, where a 32
-byte key would be associated with `AES256`).
-
-That different schemes are possible shows the second example. The `SCP80` keyset from the second example uses a scheme
-that works with two keys:
-
-+----------------+---------+---------------------------------------+
-| Key Identifier | Keyname | Purpose                               |
-+================+=========+=======================================+
-| 1              | TLS-PSK | pre-shared key used for TLS           |
-+----------------+---------+---------------------------------------+
-| 2              | DEK/KIK | encryption/decryption of key material |
-+----------------+---------+---------------------------------------+
-
-It should also be noted that the order in which keysets and keys appear is an implementation detail of the UICC/eUICC
-O/S. The order has no influence on how a keyset is interpreted. Only the Key Version Number (KVN) and the Key Identifier
-matter.
-	
-
-Rotating a keyset
-~~~~~~~~~~~~~~~~~
-
-Rotating keys is one of the most basic tasks one might want to perform on an UICC/eUICC before using it productively. In
-the following example we will illustrate how key rotation can be done. When rotating keys, only the key itself may
-change. For example it is not possible to change the key length or the algorithm used (see also GlobalPlatform Card
-Specification, section 11.8.2.3.3). Any key of the current Security Domain can be rotated, this also includes the key
-that was used to establish the secure channel.
-
-In the following example we assume that the Security Domain is selected and a secure channel is already established. We
-intend to rotate the keyset with KVN 112. Since this keyset uses triple DES keys with a key length of 16, we must
-replace it with a keyset with keys of the same nature.
-
-The new keyset shall look like this:
-
-+----------------+---------+----------------------------------+
-| Key Identifier | Keyname | Keyvalue                         |
-+================+=========+==================================+
-| 1              | ENC/KIC | 542C37A6043679F2F9F71116418B1CD5 |
-+----------------+---------+----------------------------------+
-| 2              | MAC/KID | 34F11BAC8E5390B57F4E601372339E3C |
-+----------------+---------+----------------------------------+
-| 3              | DEK/KIK | 5524F4BECFE96FB63FC29D6BAAC6058B |
-+----------------+---------+----------------------------------+
-
-When passing the keys to the `put_key` commandline, we set the Key Identifier of the first key using the `--key-id`
-parameter. This Key Identifier will be valid for the first key (KIC) we pass. For all consecutive keys, the Key
-Identifier will be incremented automatically (see also GlobalPlatform Card Specification, section 11.8.2.2). To Ensure
-that the new KIC, KID and KIK keys get the correct Key Identifiers, it is crucial to maintain order when passing the
-keys in the `--key-data` arguments. It is also important that each `--key-data` argument is preceded by a `--key-type`
-argument that sets the algorithm correctly (`des` in this case).
-
-Finally we have to target the keyset we want to rotate by its KVN. The `--old-key-version-nr` argument is set to 112
-as this is identifies the keyset we want to rotate. The `--key-version-nr` is also set to 112 as we do not want to the
-KVN to be changed in this example. Changing the KVN while rotating a keyset is possible. In case the KVN has to change
-for some reason, the new KVN must be selected carefully to keep the key usable with the associated Secure Channel
-Protocol.
-
-The commandline that matches the keyset we had laid out above looks like this:
-::
-   
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> put_key --key-id 1 --key-type des --key-data 542C37A6043679F2F9F71116418B1CD5 --key-type des --key-data 34F11BAC8E5390B57F4E601372339E3C --key-type des --key-data 5524F4BECFE96FB63FC29D6BAAC6058B --old-key-version-nr 112 --key-version-nr 112
-
-After executing this put_key commandline, the keyset identified by KVN 122 is equipped with new keys. We can use
-`get_data key_information` to inspect the currently installed keysets. The output should appear unchanged as
-we only swapped out the keys. All other parameters, identifiers etc. should remain constant.
-
-.. warning:: It is technically possible to rotate a keyset in a `non atomic` way using one `put_key` commandline for
-	     each key. However, in case the targeted keyset is the one used to establish the current secure channel,
-	     this method should not be used since, depending on the UICC/eUICC model, half-written key material may
-	     interrupt the current secure channel.
-
-
-Removing a keyset
-~~~~~~~~~~~~~~~~~
-
-In some cases it is necessary to remove a keyset entirely. This can be done with the `delete_key` command. Here it is
-important to understand that `delete_key` only removes one specific key from a specific keyset. This means that you
-need to run a separate `delete_key` command for each key inside a keyset.
-
-In the following example we assume that the Security Domain is selected and a secure channel is already established. We
-intend to remove the keyset with KVN 112. This keyset consists of three keys.
-
-::
-
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> delete_key --key-ver 112 --key-id 1
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> delete_key --key-ver 112 --key-id 2
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> delete_key --key-ver 112 --key-id 3
-
-To verify that the keyset has been deleted properly, we can use the `get_data key_information` command to inspect the
-current status of the installed keysets. We should see that the key with KVN 112 is no longer present.
-
-
-Adding a keyset
-~~~~~~~~~~~~~~~
-
-In the following we will discuss how to add an entirely new keyset. The procedure is almost identical with the key
-rotation procedure we have already discussed and it is assumed that all details about the key rotation are understood.
-In this section we will go into more detail and and illustrate how to provision new 3DES, `AES128` and `AES256` keysets.
-
-It is important to keep in mind that storage space on smartcard is a precious resource. In many cases the amount of
-keysets that a Security Domain can store is limited. In some situations you may be forced to sacrifice one of your
-existing keysets in favor of a new keyset.
-
-The main difference between key rotation and the adding of new keys is that we do not simply replace an existing key.
-Instead an entirely new key is programmed into the Security Domain. Therefore the `put_key` commandline will have no
-`--old-key-version-nr` parameter. From the commandline perspective, this is already the only visible difference from a
-commandline that simply rotates a keyset. Since we are writing an entirely new keyset, we are free to chose the
-algorithm and the key length within the parameter range permitted by the targeted secure channel protocol. Otherwise
-the same rules apply.
-
-For reference, it should be mentioned that it is also possible to add or rotate keyset using multiple `put_key`
-commandlines. In this case one `put_key` commandline for each key is used. Each commandline will specify `--key-id` and
-`--key-version-nr` and one `--key-type` and `--key-data` tuple. However, when rotating or adding a keyset step-by-step,
-the whole process happens in a `non-atomic` way, which is less reliable. Therefore we will favor the `atomic method`
-
-In the following examples we assume that the Security Domain is selected and a secure channel is already established.
-
-
-Example: `3DES` key for `SCP02`
-------------------------------
-
-Let's assume we want to provision a new 3DES keyset that we can use for SCP02. The keyset shall look like this:
-
-+----------------+---------+----------------------------------+
-| Key Identifier | Keyname | Keyvalue                         |
-+================+=========+==================================+
-| 1              | ENC/KIC | 542C37A6043679F2F9F71116418B1CD5 |
-+----------------+---------+----------------------------------+
-| 2              | MAC/KID | 34F11BAC8E5390B57F4E601372339E3C |
-+----------------+---------+----------------------------------+
-| 3              | DEK/KIK | 5524F4BECFE96FB63FC29D6BAAC6058B |
-+----------------+---------+----------------------------------+
-
-The keyset shall be a associated with the KVN 46. We have made sure before that KVN 46 is still unused and that this
-KVN number is actually suitable for SCP02 keys. As we are using 3DES, it is obvious that we have to pass 3 keys with 16
-byte length.
-
-To program the key, we may use the following commandline. As we can see, this commandline is almost the exact same as
-the one from the key rotation example where we were rotating a 3DES key. The only difference is that we didn't specify
-an old KVN number and that we have chosen a different KVN.
-
-::
-   
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> put_key --key-id 1 --key-type des --key-data 542C37A6043679F2F9F71116418B1CD5 --key-type des --key-data 34F11BAC8E5390B57F4E601372339E3C --key-type des --key-data 5524F4BECFE96FB63FC29D6BAAC6058B --key-version-nr 46
-
-In case of success, the keyset should appear in the `key_information` among the other keysets that are already present.
-
-::
-
-    pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> get_data key_information
-    {
-        "key_information": [
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 46,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 46,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 46,
-                    "key_types": [
-                        {
-                            "type": "des",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            ...
-        ]
-    }
-
-
-Example: `AES128` key for `SCP80`
---------------------------------
-
-In this example we intend to provision a new `AES128` keyset that we can use with SCP80 (OTA SMS). The keyset shall look
-like this:
-
-+----------------+---------+----------------------------------+
-| Key Identifier | Keyname | Keyvalue                         |
-+================+=========+==================================+
-| 1              | ENC/KIC | 542C37A6043679F2F9F71116418B1CD5 |
-+----------------+---------+----------------------------------+
-| 2              | MAC/KID | 34F11BAC8E5390B57F4E601372339E3C |
-+----------------+---------+----------------------------------+
-| 3              | DEK/KIK | 5524F4BECFE96FB63FC29D6BAAC6058B |
-+----------------+---------+----------------------------------+
-
-In addition to that, we want to associate this key with KVN 3. We have inspected the currently installed keysets before
-and made sure that KVN 3 is still unused. We are also aware that for SCP80 we may only use KVN values from 1 to 15.
-
-For `AES128`, we specify the algorithm using the `--key-type aes` parameter. The selection between `AES128` and `AES256` is
-done implicitly using the key length. Since we want to use `AES128` in this case, all three keys have a length of 16 byte.
-
-::
-
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> put_key --key-id 1 --key-type aes --key-data 542C37A6043679F2F9F71116418B1CD5 --key-type aes --key-data 34F11BAC8E5390B57F4E601372339E3C --key-type aes --key-data 5524F4BECFE96FB63FC29D6BAAC6058B --key-version-nr 3
-
-In case of success, the keyset should appear in the `key_information` among the other keysets that are already present.
-
-::
-
-    pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> get_data key_information
-    {
-        "key_information": [
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 3,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 3,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 3,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            ...
-        ]
-    }
-
-
-Example: `AES256` key for `SCP03`
---------------------------------
-
-Let's assume we want to provision a new `AES256` keyset that we can use for SCP03. The keyset shall look like this:
-
-+----------------+---------+------------------------------------------------------------------+
-| Key Identifier | Keyname | Keyvalue                                                         |
-+================+=========+==================================================================+
-| 1              | ENC/KIC | 542C37A6043679F2F9F71116418B1CD5542C37A6043679F2F9F71116418B1CD5 |
-+----------------+---------+------------------------------------------------------------------+
-| 2              | MAC/KID | 34F11BAC8E5390B57F4E601372339E3C34F11BAC8E5390B57F4E601372339E3C |
-+----------------+---------+------------------------------------------------------------------+
-| 3              | DEK/KIK | 5524F4BECFE96FB63FC29D6BAAC6058B5524F4BECFE96FB63FC29D6BAAC6058B |
-+----------------+---------+------------------------------------------------------------------+
-
-In addition to that, we assume that we want to associate this key with KVN 51. This KVN number falls in the range of
-48 - 63 and is therefore suitable for a key that shall be usable with SCP03. We also made sure before that KVN 51 is
-still unused.
-
-With that we can go ahead and make up the following commandline:
-::
-   
-   pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> put_key --key-id 1 --key-type aes --key-data 542C37A6043679F2F9F71116418B1CD5542C37A6043679F2F9F71116418B1CD5 --key-type aes --key-data 34F11BAC8E5390B57F4E601372339E3C34F11BAC8E5390B57F4E601372339E3C --key-type aes --key-data 5524F4BECFE96FB63FC29D6BAAC6058B5524F4BECFE96FB63FC29D6BAAC6058B --key-version-nr 51
-
-In case of success, we should see the keyset in the `key_information`
-   
-::
-
-    pySIM-shell (SCP02[03]:00:MF/ADF.ISD)> get_data key_information
-    {
-        "key_information": [
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 51,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 51,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 3,
-                    "key_version_number": 51,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 32
-                        }
-                    ]
-                }
-            },
-            ...
-        ]
-    }
-
-
-Example: `AES128` key for `SCP81`
---------------------------------
-
-In this example we will show how to provision a new `AES128` keyset for `SCP81`. We will provision this keyset under
-KVN 64. The keyset we intend to apply shall look like this:
-
-+----------------+---------+----------------------------------+
-| Key Identifier | Keyname | Keyvalue                         |
-+================+=========+==================================+
-| 1              | TLS-PSK | 000102030405060708090a0b0c0d0e0f |
-+----------------+---------+----------------------------------+
-| 2              | DEK/KIK | 000102030405060708090a0b0c0d0e0f |
-+----------------+---------+----------------------------------+
-
-With that we can put together the following command line:
-
-::
-
-    put_key --key-id 1 --key-type tls_psk --key-data 000102030405060708090a0b0c0d0e0f --key-type aes --key-data 000102030405060708090a0b0c0d0e0f --key-version-nr 64
-
-In case of success, the keyset should appear in the `key_information` as follows:
-
-::
-
-    pySIM-shell (SCP03[03]:00:MF/ADF.ISD-R)> get_data key_information
-    {
-        "key_information": [
-            ...,
-            {
-                "key_information_data": {
-                    "key_identifier": 2,
-                    "key_version_number": 64,
-                    "key_types": [
-                        {
-                            "type": "aes",
-                            "length": 16
-                        }
-                    ]
-                }
-            },
-            {
-                "key_information_data": {
-                    "key_identifier": 1,
-                    "key_version_number": 64,
-                    "key_types": [
-                        {
-                            "type": "tls_psk",
-                            "length": 16
-                        }
-                    ]
-                }
-            }
-        ]
-    }
--- a/docs/shell.rst
+++ b/docs/shell.rst
@@ -68,7 +68,7 @@ Usage Examples

   suci-tutorial
   cap-tutorial
-   put_key-tutorial
+

 Advanced Topics
 ---------------
--- a/docs/smpp-ota-tool.rst
+++ b/docs/smpp-ota-tool.rst
@@ -1,179 +0,0 @@
-smpp-ota-tool
-=============
-
-The `smpp-ota-tool` allows users to send OTA SMS messages containing APDU scripts (RFM, RAM) via an SMPP server. The
-intended audience are developers who want to test/evaluate the OTA SMS interface of a SIM/UICC/eUICC. `smpp-ota-tool`
-is intended to be used as a companion tool for :ref:`pySim-smpp2sim`, however it should be usable on any other SMPP
-server (such as a production SMSC of a live cellular network) as well.
-
-From the technical perspective `smpp-ota-tool` takes the role of an SMPP ESME. It takes care of the encoding, encryption
-and checksumming (signing) of the RFM/RAM OTA SMS and eventually submits it to the SMPP server. The program then waits
-for a response. The response is automatically parsed and printed on stdout. This makes the program also suitable to be
-called from shell scripts.
-
-.. note:: In the following we will we will refer to `SIM` as one of the following: `SIM`, `USIM`, `ISIM`, `UICC`,
-	  `eUICC`, `eSIM`.
-
-Applying OTA keys
-~~~~~~~~~~~~~~~~~
-
-Depending on the `SIM` type you will receive one or more sets of keys which you can use to communicate with the `SIM`
-through a secure channel protocol. When using the OTA SMS method, the SCP80 protocol is used and it therefore crucial
-to use a keyset that is actually suitable for SCP80.
-
-A keyset usually consists of three keys:
-
-#. KIC: the key used for ciphering (encryption/decryption)
-#. KID: the key used to compute a cryptographic checksum (signing)
-#. KIK: the key used to encrypt/decrypt key material (key rotation, adding of new keys)
-
-From the transport security perspective, only KIC and KID are relevant. The KIK (also referenced as "Data Encryption
-Key", DEK) is only used when keys are rotated or new keys are added (see also ETSI TS 102 226, section 8.2.1.5).
-
-When the keyset is programmed into the security domain of the `SIM`, it is tied to a specific cryptographic algorithm
-(3DES, AES128 or AES256) and a so called Key Version Number (KVN). The term "Key Version Number" is misleading, since
-it is actually not a version number. It is a unique identifier of a certain keyset which also identifies for which
-secure channel protocol the keyset may be used. Keysets with a KVN from 1-15 (``0x01``-``0x0F``) are suitable for SCP80.
-This means that it is not only important to know just the KIC/KID/KIK keys. Also the related algorithms and the KVN
-numbers must be known.
-
-.. note:: SCP80 keysets typically start counting from 1 upwards. Typical configurations use a set of 3 keysets with
-	  KVN numbers 1-3.
-
-Addressing an Application
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When communicating with a specific application on a `SIM` via SCP80, it is important to address that application with
-the correct parameters. The following two parameters must be known in advance:
-
-#. TAR: The Toolkit Application Reference (TAR) number is a three byte value that uniquely addresses an application
-   on the `SIM`. The exact values may vary (see also ETSI TS 101 220, Table D.1).
-#. MSL: The Minimum Security Level (MSL) is a bit-field that dictates which of the security measures encoded in the
-   SPI are mandatory (see also ETSI TS 102 225, section 5.1.1).
-
-A practical example
-~~~~~~~~~~~~~~~~~~~
-
-.. note:: This tutorial assumes that pySim-smpp2sim is running on the local machine with its default parameters.
-	  See also :ref:`pySim-smpp2sim`.
-
-Let's assume that an OTA SMS shall be sent to the SIM RFM application of an sysmoISIM-SJA2. What we want to do is to
-select DF.GSM and to get the select response back.
-
-We have received the following key material from the `SIM` vendor:
-
-::
-
-   KIC1: F09C43EE1A0391665CC9F05AF4E0BD10
-   KID1: 01981F4A20999F62AF99988007BAF6CA
-   KIK1: 8F8AEE5CDCC5D361368BC45673D99195
-   KIC2: 01022916E945B656FDE03F806A105FA2
-   KID2: D326CB69F160333CC5BD1495D448EFD6
-   KIK2: 08037E0590DFE049D4975FFB8652F625
-   KIC3: 2B22824D0D27A3A1CEEC512B312082B4
-   KID3: F1697766925A11F4458295590137B672
-   KIK3: C7EE69B2C5A1C8E160DD36A38EB517B3
-
-Those are three keysets. The enumeration is directly equal to the KVN used. All three keysets are 3DES keys, which
-means triple_des_cbc2 is the correct algorithm to use.
-
-.. note:: The key set configuration can be confirmed by retrieving the key configuration using
-	  `get_data key_information` from within an SCP02 session on ADF.ISD.
-
-In this example we intend to address the SIM RFM application on the `SIM`. Which according to the manual has TAR ``B00010``
-and MSL ``0x06``. When we hold ``0x06`` = ``0b00000110`` against the SPI coding chart (see also ETSI TS 102 225,
-section 5.1.1). We can deduct that Ciphering and Cryptographic Checksum are mandatory.
-
-.. note:: The MSL (see also ETSI TS 102 226, section 6.1) is assigned to an application by the `SIM` issuer. It is a
-	  custom decision and may vary with different `SIM` types/profiles. In the case of sysmoISIM-SJS1/SJA2/SJA5 the
-	  counter requirement has been waived to simplify lab/research type use. In productive environments, `SIM`
-	  applications should ideally use an MSL that makes the counter mandatory.
-
-In order to select DF.GSM (``0x7F20``) and to retrieve the select response, two APDUs are needed. The first APDU is the
-select command ``A0A40000027F20`` and the second is the related get-response command ``A0C0000016``. Those APDUs will be
-concatenated and are sent in a single message. The message containing the concatenated APDUs works as a script that
-is received by the SIM RFM application and then executed. This method poses some limitations that have to be taken into
-account when making requests like this (see also ETSI TS 102 226, section 5).
-
-With this information we may now construct a commandline for `smpp-ota-tool.py`. We will pass the KVN as kid_idx and
-kic_idx (see also ETSI TS 102 225, Table 2, fields `KIc` and `KID`). Both index values should refer to the same
-keyset/KVN as keysets should not be mixed. (`smpp-ota-tool` still provides separate parameters anyway to allow testing
-with invalid keyset combinations)
-
-::
-
-   $ PYTHONPATH=./ ./contrib/smpp-ota-tool.py --kic F09C43EE1A0391665CC9F05AF4E0BD10 --kid 01981F4A20999F62AF99988107BAF6CA --kid_idx 1 --kic_idx 1 --algo-crypt triple_des_cbc2 --algo-auth triple_des_cbc2 --tar B00010 --apdu A0A40000027F20 --apdu A0C0000016
-   2026-02-26 17:13:56 INFO Connecting to localhost:2775...
-   2026-02-26 17:13:56 INFO C-APDU sending: a0a40000027f20a0c0000016...
-   2026-02-26 17:13:56 INFO SMS-TPDU sending: 02700000281506191515b00010da1d6cbbd0d11ce4330d844c7408340943e843f67a6d7b0674730881605fd62d...
-   2026-02-26 17:13:56 INFO SMS-TPDU sent, waiting for response...
-   2026-02-26 17:13:56 INFO SMS-TPDU received: 027100002c12b000107ddf58d1780f771638b3975759f4296cf5c31efc87a16a1b61921426baa16da1b5ba1a9951d59a39
-   2026-02-26 17:13:56 INFO SMS-TPDU decoded: (Container(rpl=44, rhl=18, tar=b'\xb0\x00\x10', cntr=b'\x00\x00\x00\x00\x00', pcntr=0, response_status=uEnumIntegerString.new(0, 'por_ok'), cc_rc=b'\x8f\xea\xf5.\xf4\x0e\xc2\x14', secured_data=b'\x02\x90\x00\x00\x00\xff\xff\x7f \x02\x00\x00\x00\x00\x00\t\xb1\x065\x04\x00\x83\x8a\x83\x8a'), Container(number_of_commands=2, last_status_word=u'9000', last_response_data=u'0000ffff7f2002000000000009b106350400838a838a'))
-   2026-02-26 17:13:56 INFO R-APDU received: 0000ffff7f2002000000000009b106350400838a838a 9000
-   0000ffff7f2002000000000009b106350400838a838a 9000
-   2026-02-26 17:13:56 INFO Disconnecting...
-
-The result we see is the select response of DF.GSM and a status word indicating that the last command has been
-processed normally.
-
-As we can see, this mechanism now allows us to perform small administrative tasks remotely. We can read the contents of
-files remotely or make changes to files. Depending on the changes we make, there may be security issues arising from
-replay attacks. With the commandline above, the communication is encrypted and protected by a cryptographic checksum,
-so an adversary can neither read, nor alter the message. However, an adversary could still replay an intercepted
-message and the `SIM` would happily execute the contained APDUs again.
-
-To prevent this, we may include a replay protection counter within the message. In this case, the MSL indicates that a
-replay protection counter is not required. However, to extended the security of our messages, we may chose to use a
-counter anyway. In the following example, we will encode a counter value of 100. We will instruct the `SIM` to make sure
-that the value we send is higher than the counter value that is currently stored in the `SIM`.
-
-To add a replay connection counter we add the commandline arguments `--cntr-req` to set the counter requirement and
-`--cntr` to pass the counter value.
-
-::
-
-   $ PYTHONPATH=./ ./contrib/smpp-ota-tool.py --kic F09C43EE1A0391665CC9F05AF4E0BD10 --kid 01981F4A20999F62AF99988107BAF6CA --kid_idx 1 --kic_idx 1 --algo-crypt triple_des_cbc2 --algo-auth triple_des_cbc2 --tar B00010 --apdu A0A40000027F20 --apdu A0C0000016 --cntr-req counter_must_be_higher --cntr 100
-   2026-02-26 17:16:39 INFO Connecting to localhost:2775...
-   2026-02-26 17:16:39 INFO C-APDU sending: a0a40000027f20a0c0000016...
-   2026-02-26 17:16:39 INFO SMS-TPDU sending: 02700000281516191515b000103a4f599e94f2b5dcfbbda984761b7977df6514c57a580fb4844787c436d2eade...
-   2026-02-26 17:16:39 INFO SMS-TPDU sent, waiting for response...
-   2026-02-26 17:16:39 INFO SMS-TPDU received: 027100002c12b0001049fb0315f6c6401b553867f412cefaf9355b38271178edb342a3bc9cc7e670cdc1f45eea6ffcbb39
-   2026-02-26 17:16:39 INFO SMS-TPDU decoded: (Container(rpl=44, rhl=18, tar=b'\xb0\x00\x10', cntr=b'\x00\x00\x00\x00d', pcntr=0, response_status=uEnumIntegerString.new(0, 'por_ok'), cc_rc=b'\xa9/\xc7\xc9\x00"\xab5', secured_data=b'\x02\x90\x00\x00\x00\xff\xff\x7f \x02\x00\x00\x00\x00\x00\t\xb1\x065\x04\x00\x83\x8a\x83\x8a'), Container(number_of_commands=2, last_status_word=u'9000', last_response_data=u'0000ffff7f2002000000000009b106350400838a838a'))
-   2026-02-26 17:16:39 INFO R-APDU received: 0000ffff7f2002000000000009b106350400838a838a 9000
-   0000ffff7f2002000000000009b106350400838a838a 9000
-   2026-02-26 17:16:39 INFO Disconnecting...
-
-The `SIM` has accepted the message. The message got processed and the `SIM` has set its internal to 100. As an experiment,
-we may try to re-use the counter value:
-
-::
-
-   $ PYTHONPATH=./ ./contrib/smpp-ota-tool.py --kic F09C43EE1A0391665CC9F05AF4E0BD10 --kid 01981F4A20999F62AF99988107BAF6CA --kid_idx 1 --kic_idx 1 --algo-crypt triple_des_cbc2 --algo-auth triple_des_cbc2 --tar B00010 --apdu A0A40000027F20 --apdu A0C0000016 --cntr-req counter_must_be_higher --cntr 100
-   2026-02-26 17:16:43 INFO Connecting to localhost:2775...
-   2026-02-26 17:16:43 INFO C-APDU sending: a0a40000027f20a0c0000016...
-   2026-02-26 17:16:43 INFO SMS-TPDU sending: 02700000281516191515b000103a4f599e94f2b5dcfbbda984761b7977df6514c57a580fb4844787c436d2eade...
-   2026-02-26 17:16:43 INFO SMS-TPDU sent, waiting for response...
-   2026-02-26 17:16:43 INFO SMS-TPDU received: 027100000b0ab0001000000000000006
-   2026-02-26 17:16:43 INFO SMS-TPDU decoded: (Container(rpl=11, rhl=10, tar=b'\xb0\x00\x10', cntr=b'\x00\x00\x00\x00\x00', pcntr=0, response_status=uEnumIntegerString.new(6, 'undefined_security_error'), cc_rc=b'', secured_data=b''), None)
-   Traceback (most recent call last):
-   File "/home/user/work/git_master/pysim/./contrib/smpp-ota-tool.py", line 238, in <module>
-    resp, sw = smpp_handler.transceive_apdu(apdu, opts.src_addr, opts.dest_addr, opts.timeout)
-               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-   File "/home/user/work/git_master/pysim/./contrib/smpp-ota-tool.py", line 162, in transceive_apdu
-     raise ValueError("Response does not contain any last_response_data, no R-APDU received!")
-   ValueError: Response does not contain any last_response_data, no R-APDU received!
-   2026-02-26 17:16:43 INFO Disconnecting...
-
-As we can see, the `SIM` has rejected the message with an `undefined_security_error`. The replay-protection-counter
-ensures that a message can only be sent once.
-
-.. note:: The replay-protection-counter is implemented as a 5 byte integer value (see also ETSI TS 102 225, Table 3).
-	  When the counter has reached its maximum, it will not overflow nor can it be reset.
-
-smpp-ota-tool syntax
-~~~~~~~~~~~~~~~~~~~~
-
-.. argparse::
-   :module: contrib.smpp-ota-tool
-   :func: option_parser
-   :prog: contrib/smpp-ota-tool.py
--- a/docs/smpp2sim.rst
+++ b/docs/smpp2sim.rst
@@ -55,5 +55,3 @@ And once your external program is sending SMS to the simulated SMSC, it will log
  SMSPPDownload(DeviceIdentities({'source_dev_id': 'network', 'dest_dev_id': 'uicc'}),Address({'ton_npi': 0, 'call_number': '0123456'}),SMS_TPDU({'tpdu': '400290217ff6227052000000002d02700000281516191212b0000127fa28a5bac69d3c5e9df2c7155dfdde449c826b236215566530787b30e8be5d'}))
  INFO     root: ENVELOPE: d147820283818604001032548b3b400290217ff6227052000000002d02700000281516191212b0000127fa28a5bac69d3c5e9df2c7155dfdde449c826b236215566530787b30e8be5d
  INFO     root: SW 9000: 027100002412b000019a551bb7c28183652de0ace6170d0e563c5e949a3ba56747fe4c1dbbef16642c
-
-.. note:: for sending OTA SMS messages :ref:`smpp-ota-tool` may be used.
--- a/pySim/cdma_ruim.py
+++ b/pySim/cdma_ruim.py
@@ -128,7 +128,7 @@ class EF_AD(TransparentEF):
        cell_test = 0x04

    def __init__(self, fid='6f43', sfid=None, name='EF.AD',
-                 desc='Administrative Data', size=(3, None), **kwargs):
+                 desc='Service Provider Name', size=(3, None), **kwargs):
        super().__init__(fid, sfid=sfid, name=name, desc=desc, size=size, **kwargs)
        self._construct = Struct(
            # Byte 1: Display Condition
--- a/pySim/esim/init.py
+++ b/pySim/esim/init.py
@@ -54,8 +54,6 @@ def compile_asn1_subdir(subdir_name:str, codec='der'):
    __ver = sys.version_info
    if (__ver.major, __ver.minor) >= (3, 9):
        for i in resources.files('pySim.esim').joinpath('asn1').joinpath(subdir_name).iterdir():
-            if not i.name.endswith('.asn'):
-                continue
            asn_txt += i.read_text()
            asn_txt += "\n"
    #else:
--- a/pySim/esim/http_json_api.py
+++ b/pySim/esim/http_json_api.py
@@ -19,6 +19,7 @@ import abc
 import requests
 import logging
 import json
+from re import match
 from typing import Optional
 import base64
 from twisted.web.server import Request
@@ -210,7 +211,7 @@ class JsonHttpApiFunction(abc.ABC):
    # additional custom HTTP headers (server responses)
    extra_http_res_headers = {}

-    def __new__(cls, *args, role = 'legacy_client', **kwargs):
+    def __new__(cls, *args, role = None, **kwargs):
        """
        Args:
                args: (see JsonHttpApiClient and JsonHttpApiServer)
@@ -220,13 +221,14 @@ class JsonHttpApiFunction(abc.ABC):

        # Create a dictionary with the class attributes of this class (the properties listed above and the encode_
        # decode_ methods below). The dictionary will not include any dunder/magic methods
-        cls_attr = {attr_name: getattr(cls, attr_name) for attr_name in dir(cls) if not attr_name.startswith('__')}
+        cls_attr = { attr_name: getattr(cls, attr_name) for attr_name in dir(cls) if not match("__.*__", attr_name) }

        # Normal instantiation as JsonHttpApiFunction:
-        if len(args) == 0 and len(kwargs) == 0:
+        if len(args) == 0:
            return type(cls.__name__, (abc.ABC,), cls_attr)()

        # Instantiation as as JsonHttpApiFunction with a JsonHttpApiClient or JsonHttpApiServer base
+        role = kwargs.get('role', 'legacy_client')
        if role == 'legacy_client':
            # Deprecated: With the advent of the server role (JsonHttpApiServer) the API had to be changed. To maintain
            # compatibility with existing code (out-of-tree) the original behaviour and API interface and behaviour had
--- a/pySim/esim/saip/init.py
+++ b/pySim/esim/saip/init.py
@@ -151,8 +151,6 @@ class File:
        self.df_name = None
        self.fill_pattern = None
        self.fill_pattern_repeat = False
-        self.pstdo = None # pinStatusTemplateDO, mandatory for DF/ADF
-        self.lcsi = None # optional life cycle status indicator
        # apply some defaults from profile
        if self.template:
            self.from_template(self.template)
@@ -280,8 +278,6 @@ class File:
        elif self.file_type in ['MF', 'DF', 'ADF']:
            fdb_dec['file_type'] = 'df'
            fdb_dec['structure'] = 'no_info_given'
-            # pinStatusTemplateDO is mandatory for DF/ADF
-            fileDescriptor['pinStatusTemplateDO'] = self.pstdo
        # build file descriptor based on above input data
        fd_dict = {}
        if len(fdb_dec):
@@ -308,8 +304,6 @@ class File:
            # desired fill or repeat pattern in the "proprietaryEFInfo" element for the EF in Profiles
            # downloaded to a V2.2 or earlier eUICC.
            fileDescriptor['proprietaryEFInfo'] = pefi
-        if self.lcsi:
-            fileDescriptor['lcsi'] = self.lcsi
        logger.debug("%s: to_fileDescriptor(%s)" % (self, fileDescriptor))
        return fileDescriptor

@@ -329,8 +323,6 @@ class File:
        if efFileSize:
            self._file_size = self._decode_file_size(efFileSize)

-        self.pstdo = fileDescriptor.get('pinStatusTemplateDO', None)
-        self.lcsi = fileDescriptor.get('lcsi', None)
        pefi = fileDescriptor.get('proprietaryEFInfo', {})
        securityAttributesReferenced = fileDescriptor.get('securityAttributesReferenced', None)
        if securityAttributesReferenced:
--- a/pySim/esim/saip/personalization.py
+++ b/pySim/esim/saip/personalization.py
@@ -352,7 +352,6 @@ class SmspTpScAddr(ConfigurableParameter):
    strip_chars = ' \t\r\n'
    max_len = 21 # '+' and 20 digits
    min_len = 1
-    example_input = '+49301234567'

    @classmethod
    def validate_val(cls, val):
@@ -628,7 +627,7 @@ class MilenageRotationConstants(BinaryParam, AlgoConfig):
    name = 'MilenageRotation'
    algo_config_key = 'rotationConstants'
    allow_len = 5 # length in bytes (from BinaryParam)
-    example_input = '40 00 20 40 60'
+    example_input = '0a 0b 0c 0d 0e'

    @classmethod
    def validate_val(cls, val):
--- a/pySim/euicc.py
+++ b/pySim/euicc.py
@@ -181,7 +181,7 @@ class SeqNumber(BER_TLV_IE, tag=0x80):
 class NotificationAddress(BER_TLV_IE, tag=0x0c):
    _construct = Utf8Adapter(GreedyBytes)
 class Iccid(BER_TLV_IE, tag=0x5a):
-    _construct = PaddedBcdAdapter(GreedyBytes)
+    _construct = BcdAdapter(GreedyBytes)
 class NotificationMetadata(BER_TLV_IE, tag=0xbf2f, nested=[SeqNumber, ProfileMgmtOperation,
                                                           NotificationAddress, Iccid]):
    pass
--- a/pySim/global_platform/scp.py
+++ b/pySim/global_platform/scp.py
@@ -266,13 +266,11 @@ class SCP02(SCP):
        super().__init__(*args, **kwargs)

    def dek_encrypt(self, plaintext:bytes) -> bytes:
-        # See also GPC section B.1.1.2, E.4.7, and E.4.1
-        cipher = DES3.new(self.sk.data_enc, DES.MODE_ECB)
+        cipher = DES.new(self.card_keys.dek[:8], DES.MODE_ECB)
        return cipher.encrypt(plaintext)

    def dek_decrypt(self, ciphertext:bytes) -> bytes:
-        # See also GPC section B.1.1.2, E.4.7, and E.4.1
-        cipher = DES3.new(self.sk.data_enc, DES.MODE_ECB)
+        cipher = DES.new(self.card_keys.dek[:8], DES.MODE_ECB)
        return cipher.decrypt(ciphertext)

    def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes):
--- a/tests/card_sanitizer/card_backup_3b9f96801f878031e073fe211b674a357530350265f8_8949440000001155314.script
+++ b/tests/card_sanitizer/card_backup_3b9f96801f878031e073fe211b674a357530350265f8_8949440000001155314.script
@@ -2200,9 +2200,9 @@ update_record 6 fe0112ffb53e96e5ff99731d51ad7beafd0e23ffffffffffffffffffffffffff
 update_record 7 fe02101da012f436d06824ecdd15050419ff9affffffffffffffffffffffffffffffff
 update_record 8 fe02116929a373388ac904aff57ff57f6b3431ffffffffffffffffffffffffffffffff
 update_record 9 fe0212a99245a5dc814e2f4c1aa908e9946e03ffffffffffffffffffffffffffffffff
-update_record 10 fe03601111111111111111111111111111111111111111111111111111111111111111
-update_record 11 fe03612222222222222222222222222222222222222222222222222222222222222222
-update_record 12 fe03623333333333333333333333333333333333333333333333333333333333333333
+update_record 10 fe0310521312c05a9aea93d70d44405172a580ffffffffffffffffffffffffffffffff
+update_record 11 fe0311a9e45c72d45abde7db74261ee0c11b1bffffffffffffffffffffffffffffffff
+update_record 12 fe0312867ba36b5873d60ea8b2cdcf3c0ddddaffffffffffffffffffffffffffffffff
 #
 ################################################################################
 # MF/DF.SYSTEM/EF.SIM_AUTH_COUNTER                                             #
--- a/tests/pySim-shell_test/euicc/get_profiles_info.ok
+++ b/tests/pySim-shell_test/euicc/get_profiles_info.ok
@@ -15,7 +15,7 @@
        },
        {
            "profile_info": {
-                "iccid": "8949449999999990031",
+                "iccid": "8949449999999990031f",
                "isdp_aid": "a0000005591010ffffffff8900001200",
                "profile_state": "disabled",
                "service_provider_name": "OsmocomSPN",
--- a/tests/pySim-shell_test/euicc/test.py
+++ b/tests/pySim-shell_test/euicc/test.py
@@ -23,7 +23,7 @@ import os
 import json
 from utils import *

-# This testcase requires a sysmoEUICC1-C2T with the test prfile TS48V1-B-UNIQUE (ICCID 8949449999999990031)
+# This testcase requires a sysmoEUICC1-C2T with the test prfile TS48V1-B-UNIQUE (ICCID 8949449999999990031f)
 # installed, and in disabled state. Also the profile must be installed in such a way that notifications are
 # generated when the profile is disabled or enabled (ProfileMetadata)

--- a/tests/pySim-shell_test/euicc/test_gen_notif.script
+++ b/tests/pySim-shell_test/euicc/test_gen_notif.script
@@ -9,5 +9,5 @@ select ADF.ISD-R
 enable_profile --iccid 89000123456789012341

 # Generate two (additional) notifications by quickly enabeling the test profile
-enable_profile --iccid 8949449999999990031
+enable_profile --iccid 8949449999999990031f
 enable_profile --iccid 89000123456789012341
--- a/tests/pySim-smpp2sim_test/pySim-smpp2sim_test.cfg
+++ b/tests/pySim-smpp2sim_test/pySim-smpp2sim_test.cfg
@@ -0,0 +1,9 @@
+# Card parameter:
+ICCID="8949440000001155314"
+KIC='51D4FC44BCBA7C4589DFADA3297720AF'
+KID='0449699C472CE71E2FB7B56245EF7684'
+
+# Testcase: Send OTA-SMS that selects DF.GSM and returns the select response
+TAR='B00010'
+APDU='A0A40000027F20A0C0000016'
+EXPECTED_RESPONSE='0000ffff7f2002000000000009b106350400838a838a 9000'
--- a/tests/pySim-smpp2sim_test/pySim-smpp2sim_test.sh
+++ b/tests/pySim-smpp2sim_test/pySim-smpp2sim_test.sh
@@ -20,14 +20,13 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-PYSIM_SHELL=./pySim-shell.py
-PYSIM_SHELL_LOG=./pySim-shell.log
 PYSIM_SMPP2SIM=./pySim-smpp2sim.py
 PYSIM_SMPP2SIM_LOG=./pySim-smpp2sim.log
 PYSIM_SMPP2SIM_PORT=2775
 PYSIM_SMPP2SIM_TIMEOUT=10
 PYSIM_SMPPOTATOOL=./contrib/smpp-ota-tool.py
 PYSIM_SMPPOTATOOL_LOG=./smpp-ota-tool.log
+PYSIM_SHELL=./pySim-shell.py

 function dump_logs {
    echo ""
@@ -45,11 +44,12 @@ function dump_logs {
 function send_test_request {
    echo ""
    echo "Sending request to SMPP server:"
-    C_APDU=$1
-    R_APDU_EXPECTED=$2
+    TAR=$1
+    C_APDU=$2
+    R_APDU_EXPECTED=$3

    echo "Sending: $C_APDU"
-    COMMANDLINE="$PYSIM_SMPPOTATOOL --verbose --port $PYSIM_SMPP2SIM_PORT --kic $KIC --kid $KID --kic-idx $KEY_INDEX --kid-idx $KEY_INDEX --algo-crypt $ALGO_CRYPT --algo-auth $ALGO_AUTH --tar $TAR --apdu $C_APDU"
+    COMMANDLINE="$PYSIM_SMPPOTATOOL --verbose --port $PYSIM_SMPP2SIM_PORT --kic $KIC --kid $KID --tar $TAR --apdu $C_APDU"
    echo "Commandline: $COMMANDLINE"
    R_APDU=`$COMMANDLINE 2> $PYSIM_SMPPOTATOOL_LOG`
    if [ $? -ne 0 ]; then
@@ -57,7 +57,7 @@ function send_test_request {
 	dump_logs
 	exit 1
    fi
-    echo ""
+
    echo "Got response from SMPP server:"
    echo "Sent: $C_APDU"
    echo "Received: $R_APDU"
@@ -68,14 +68,16 @@ function send_test_request {
 	exit 1
    fi
    echo "Response matches the expected response -- success!"
+    echo ""
 }

 function start_smpp_server {
    PCSC_READER=$1
+
+    # Start the SMPP server
    echo ""
    echo "Starting SMPP server:"

-    # Start the SMPP server
    COMMANDLINE="$PYSIM_SMPP2SIM -p $PCSC_READER --smpp-bind-port $PYSIM_SMPP2SIM_PORT --apdu-trace"
    echo "Commandline: $COMMANDLINE"
    $COMMANDLINE > $PYSIM_SMPP2SIM_LOG 2>&1 &
@@ -100,117 +102,55 @@ function start_smpp_server {
    echo "SMPP server reachable (port=$PYSIM_SMPP2SIM_PORT)"
 }

-function stop_smpp_server {
-    echo ""
-    echo "Stopping SMPP server:"
-    kill $PYSIM_SMPP2SIM_PID
-    echo "SMPP server stopped (PID=$PYSIM_SMPP2SIM_PID)"
-    trap EXIT
-}
-
-function find_card_by_iccid_or_eid {
+function find_card_by_iccid {
+    # Find reader number of the card
    ICCID=$1
-    EID=$2
+
    echo ""
    echo "Searching for card:"
    echo "ICCID: \"$ICCID\""
-    if [ -n "$EID" ]; then
-	echo "EID: \"$EID\""
-    fi

-    # Determine number of available PCSC readers
-    PCSC_READER_COUNT=`pcsc_scan -rn | wc -l`
-
-    # In case an EID is set, search for a card with that EID first
-    if [ -n "$EID" ]; then
-	for PCSC_READER in $(seq 0 $(($PCSC_READER_COUNT-1))); do
-	    echo "probing card (eID) in reader $PCSC_READER ..."
-	    RESULT_JSON=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e "select ADF.ISD-R" -e "get_eid" 2> /dev/null | tail -3`
-	    echo $RESULT_JSON | grep $EID > /dev/null
-	    if [ $? -eq 0 ]; then
-		echo "Found card (eID) in reader $PCSC_READER"
-		return $PCSC_READER
-	    fi
-	done
-    fi
-
-    # Search for card with the given ICCID
    if [ -z "$ICCID" ]; then
 	echo "invalid ICCID, zero length ICCID is not allowed! -- abort"
 	exit 1
    fi
+
+    PCSC_READER_COUNT=`pcsc_scan -rn | wc -l`
    for PCSC_READER in $(seq 0 $(($PCSC_READER_COUNT-1))); do
-	echo "probing card (ICCID) in reader $PCSC_READER ..."
-	RESULT_JSON=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e "select EF.ICCID" -e "read_binary_decoded" 2> /dev/null | tail -3`
-	echo $RESULT_JSON | grep $ICCID > /dev/null
+	echo "probing card in reader $PCSC_READER ..."
+	EF_ICCID_DECODED=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e 'select EF.ICCID' -e 'read_binary_decoded --oneline' 2> /dev/null | tail -1`
+	echo $EF_ICCID_DECODED | grep $ICCID > /dev/null
 	if [ $? -eq 0 ]; then
-	    echo "Found card (by ICCID) in reader $PCSC_READER"
+	    echo "Found card in reader $PCSC_READER"
 	    return $PCSC_READER
 	fi
    done

-    echo "Card not found -- abort"
+    echo "Card with ICCID \"$ICCID\" not found -- abort"
    exit 1
 }

-function enable_profile {
-    PCSC_READER=$1
-    ICCID=$2
-    EID=$3
-    if [ -z "$EID" ]; then
-	# This is no eUICC, nothing to enable
-	return 0
-    fi
-
-    # Check if the profile is already enabled
-    RESULT_JSON=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e "select EF.ICCID" -e "read_binary_decoded" 2> /dev/null | tail -3`
-    ICCID_ENABLED=`echo $RESULT_JSON | jq -r '.iccid'`
-    if [ $ICCID != $ICCID_ENABLED ]; then
-	# Disable the currentle enabled profile
-	echo ""
-	echo "Disabeling currently enabled profile:"
-	echo "ICCID: \"$ICCID\""
-	RESULT_JSON=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e "select ADF.ISD-R" -e "disable_profile --iccid $ICCID_ENABLED" 2> /dev/null | tail -3`
-	echo $RESULT_JSON | grep "ok" > /dev/null
-	if [ $? -ne 0 ]; then
-	    echo "unable to disable profile with \"$ICCID_ENABLED\""
-	    exit 1
-	fi
-	echo "profile disabled"
-
-	# Enable the profile we intend to test with
-	echo ""
-	echo "Enabeling profile:"
-	echo "ICCID: \"$ICCID\""
-	RESULT_JSON=`$PYSIM_SHELL -p $PCSC_READER --noprompt -e "select ADF.ISD-R" -e "enable_profile --iccid $ICCID" 2> /dev/null | tail -3`
-	echo $RESULT_JSON | grep "ok\|profileNotInDisabledState" > /dev/null
-	if [ $? -ne 0 ]; then
-	    echo "unable to enable profile with \"$ICCID\""
-	    exit 1
-	fi
-	echo "profile enabled"
-    fi
-}
-
 export PYTHONPATH=./

 echo "pySim-smpp2sim_test - a test program to test pySim-smpp2sim.py"
 echo "=============================================================="

-TESTCASE_DIR=`dirname $0`
-for TEST_CONFIG_FILE in $TESTCASE_DIR/testcase_*.cfg ; do
-    echo ""
-    echo "running testcase: $TEST_CONFIG_FILE"
-    . $TEST_CONFIG_FILE
-    find_card_by_iccid_or_eid $ICCID $EID
-    PCSC_READER=$?
-    enable_profile $PCSC_READER $ICCID $EID
-    start_smpp_server $PCSC_READER
-    send_test_request $APDU "$EXPECTED_RESPONSE"
-    stop_smpp_server
-    echo ""
-    echo "testcase ok"
-    echo "--------------------------------------------------------------"
-done
+# TODO: At the moment we can only have one card and one testcase. This is
+# sufficient for now. We can extend this later as needed.
+
+# Read test parameters from config from file
+TEST_CONFIG_FILE=${0%.*}.cfg
+echo "using config file: $TEST_CONFIG_FILE"
+if ! [ -e "$TEST_CONFIG_FILE" ]; then
+   echo "test configuration file does not exist! -- abort"
+   exit 1
+fi
+. $TEST_CONFIG_FILE
+
+# Execute testcase
+find_card_by_iccid $ICCID
+start_smpp_server $?
+send_test_request $TAR $APDU "$EXPECTED_RESPONSE"
+
+

-echo "done."
--- a/tests/pySim-smpp2sim_test/testcase_3des_cbc2_rfm.cfg
+++ b/tests/pySim-smpp2sim_test/testcase_3des_cbc2_rfm.cfg
@@ -1,17 +0,0 @@
-# Preparation:
-# This testcase executes against a sysmoISIM-SJA5 card. For the testcase, the
-# key configuration on the card may be used as it is.
-
-# Card parameter:
-ICCID="8949440000001155314" # <-- change to the ICCID of your card!
-EID=""
-KIC='51D4FC44BCBA7C4589DFADA3297720AF' # <-- change to the KIC1 of your card!
-KID='0449699C472CE71E2FB7B56245EF7684' # <-- change to the KID1 of your card!
-KEY_INDEX=1
-ALGO_CRYPT=triple_des_cbc2
-ALGO_AUTH=triple_des_cbc2
-TAR='B00010'
-
-# Testcase: Send OTA-SMS that selects DF.GSM and returns the select response
-APDU='A0A40000027F20A0C0000016'
-EXPECTED_RESPONSE='0000ffff7f2002000000000009b106350400838a838a 9000'
--- a/tests/pySim-smpp2sim_test/testcase_aes128_cbc_cmac_rfm.cfg
+++ b/tests/pySim-smpp2sim_test/testcase_aes128_cbc_cmac_rfm.cfg
@@ -1,19 +0,0 @@
-# Preparation:
-# This testcase executes against a sysmoEUICC1-C2T, which is equipped with the
-# TS48V1-B-UNIQUE test profile from https://test.rsp.sysmocom.de/ (Activation
-# code: 1$smdpp.test.rsp.sysmocom.de$TS48V1-B-UNIQUE). This testprofile must be
-# present on the eUICC before this testcase can be executed.
-
-# Card parameter:
-ICCID="8949449999999990031"
-EID="89049044900000000000000000102355" # <-- change to the EID of your card!
-KIC='66778899aabbccdd1122334455eeff10'
-KID='112233445566778899aabbccddeeff10'
-KEY_INDEX=2
-ALGO_CRYPT=aes_cbc
-ALGO_AUTH=aes_cmac
-TAR='b00120'
-
-# Testcase: Send OTA-SMS that selects DF.ICCID and returns the select response
-APDU='00a40004022fe200C000001d'
-EXPECTED_RESPONSE='621b8202412183022fe2a503d001408a01058b032f06038002000a8800 9000'
--- a/tests/pySim-smpp2sim_test/testcase_aes256_cbc_cmac_rfm.cfg
+++ b/tests/pySim-smpp2sim_test/testcase_aes256_cbc_cmac_rfm.cfg
@@ -1,28 +0,0 @@
-# Preparation:
-# This testcase executes against a sysmoISIM-SJA5 card. Since this card model is
-# shipped with a classic DES key configuration, it is necessary to provision
-# AES128 test keys before this testcase may be executed. The the following
-# pySim-shell command sequence may be used:
-#
-# verify_adm 34173960 # <-- change to the ADM key of your card!
-# select /DF.SYSTEM/EF.0348_KEY
-# update_record 10 fe03601111111111111111111111111111111111111111111111111111111111111111
-# update_record 11 fe03612222222222222222222222222222222222222222222222222222222222222222
-# update_record 12 fe03623333333333333333333333333333333333333333333333333333333333333333
-#
-# This overwrites one of the already existing 3DES SCP02 key (KVN 47) and replaces it
-# with an AES256 SCP80 key (KVN 3).
-
-# Card parameter:
-ICCID="8949440000001155314" # <-- change to the ICCID of your card!
-EID=""
-KIC='1111111111111111111111111111111111111111111111111111111111111111'
-KID='2222222222222222222222222222222222222222222222222222222222222222'
-KEY_INDEX=3
-ALGO_CRYPT=aes_cbc
-ALGO_AUTH=aes_cmac
-TAR='B00010'
-
-# Testcase: Send OTA-SMS that selects DF.GSM and returns the select response
-APDU='A0A40000027F20A0C0000016'
-EXPECTED_RESPONSE='0000ffff7f2002000000000009b106350400838a838a 9000'