Free WiFi with EAP-SIM on a desktop computer

EAP-SIM on a mobile phone

Following its roll-out as a new authentication method to the WiFi community network of a major mobile operator in France in 2012, EAP-SIM has attracted quite some attention over there.

Yet the limited level of support of this technology in mobile devices available on the market has left many users struggling to get it to work effectively.

EAP-SIM is supported on the iPhone and the iPad since iOS 5 — and there are reports that it can be made to work on iOS 4.

On the other hand, it has taken Google 3 years to acknowledge and react to the lack of official EAP-SIM support on Android. After hundreds of sometimes infuriated messages, it looks like they started to work on implementing it in June 2013!
In Google’s defense, one can say that EAP-SIM can work on Android — as long as your phone manufacturer or mobile operator has implemented it in the phone’s software.
Still, it is unacceptable that Google’s Android flagship devices, the Nexus family, don’t support EAP-SIM natively.
Especially when there isn’t much work to do to implement properly.

Windows Phone 8+ and BlackBerry are reported to support EAP-SIM as far as I could gather.

EAP-SIM on a desktop computer

But this article isn’t about EAP-SIM on mobile devices. Instead it will show how to connect to a WiFi network using EAP-SIM on a desktop computer running Linux.

Hardware

The requirements are:

1. a SIM card of an operator supporting EAP-SIM (e.g. Free)
2. a computer with a WiFi adapter
3. a SIM card reader (or “smartcard reader”)

I suppose that items 1. and 2. are already in your possession.
Regarding the SIM card reader, many models can be used, ranging from high-end devices to dirt cheap readers.

Let’s say that we want to do this experiment on a shoestring: we’ll settle on a $2 SIM card reader that is just good enough.
Go to eBay and grab one of these transparent blue SIM readers (don’t know if the other models are compatible).

This is a very low-tech smartcard reader, based on the so-called Phoenix architecture. Because of — or in spite of — this simplicity, it can be quite tricky to get it to work at times. (Or is it the OpenCT driver that is at fault?)

Wait for a couple of weeks for the little package from eBay to arrive and now you’ve got everything needed to proceed 🙂

Software

First, we’ll set up the software for the SIM card reader:

1. Install the following packages (on Ubuntu):

   openct pcscd pcsc-tools libpcsclite-dev libnl-dev

2. Plug in the SIM reader and run dmesg to determine the associated TTY:

   [85418.604327] usb 7-2: new full-speed USB device number 2 using uhci_hcd
   [85419.040763] USB Serial support registered for pl2303
   [85419.040824] pl2303 7-2:1.0: pl2303 converter detected
   [85419.052517] usb 7-2: pl2303 converter now attached to ttyUSB0
   [85419.052552] usbcore: registered new interface driver pl2303
   [85419.052556] pl2303: Prolific PL2303 USB to serial adaptor driver

3. Add this piece of configuration to /etc/openct.conf (with the right TTY device):

   reader phoenix {
       driver = phoenix;
       device = serial:/dev/ttyUSB0;
   };

4. Restart OpenCT:

   /etc/init.d/openct restart

5. Insert the SIM card into the reader and check that it is correctly detected by OpenCT:

   root@desktop:~# openct-tool atr
   Detected Phoenix reader
   Card present, status changed
   ATR: 3b 9f 95 80 1f c7 80 31 e0 73 fe 21 1b 64 07 54 61 00 82 90 00 f0

6. Check that it is also correctly detected by PCSC-Lite:

   root@desktop:~# pcsc_scan 
   PC/SC device scanner
   V 1.4.18 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
   Compiled with PC/SC lite version: 1.7.4
   Using reader plug'n play mechanism
   Scanning present readers...
   0: OpenCT 00 00
   Wed Aug 28 17:55:25 2013
   Reader 0: OpenCT 00 00
    Card state: Card inserted, 
    ATR: 3B 9F 95 80 1F C7 80 31 E0 73 FE 21 1B 64 07 54 61 00 82 90 00 F0

At this point, you’ve confirmed that your $2 SIM reader works fine on your computer. Let’s continue to the core of the EAP-SIM set-up: the so-called “WPA supplicant”, which handles all the WiFi authentication phases.

1. Download the latest release of hostapd:

   user@desktop:~$ wget http://hostap.epitest.fi/releases/hostapd-2.0.tar.gz

2. Extract the archive and and go the the wpa_supplicant folder:

   user@desktop:wpa_supplicant$ cp defconfig .config

3. Edit the newly created .config file so that it contains:

   # EAP-SIM (enable CONFIG_PCSC, if EAP-SIM is used)
   CONFIG_EAP_SIM=y
   # PC/SC interface for smartcards (USIM, GSM SIM)
   # Enable this if EAP-SIM or EAP-AKA is included
   CONFIG_PCSC=y

4. Build the WPA supplicant program:

   user@desktop:wpa_supplicant$ make

5. Create a configuration file wpa_supplicant_eap-sim.conf, with the correct PIN number:

   cred={
     imsi="none" # anything but blank value
   }
   network={
     ssid="FreeWifi_secure"
     key_mgmt=WPA-EAP IEEE8021X
     eap=SIM
     pin="1234"
     pcsc=""
   }

6. Disconnect from any WiFi network, make sure that no other wpa_supplicant is running on your computer at the same time and run (wlan0 being the WiFi interface):

   root@desktop:wpa_supplicant# iwconfig wlan0 essid "FreeWifi_secure" && ./wpa_supplicant -i wlan0 -c wpa_supplicant_eap-sim.conf

7. On the output, you will see that it worked correctly if it says:

   Successfully initialized wpa_supplicant
   wlan0: Trying to associate with xx:xx:xx:xx:xx:xx (SSID='FreeWifi_secure' freq=2417 MHz)
   wlan0: Associated with xx:xx:xx:xx:xx:xx
   wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
   EAP: buildIdentity: identity configuration was not available
   wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=18
   wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 18 (SIM) selected
   wlan0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
   wlan0: WPA: Key negotiation completed with xx:xx:xx:xx:xx:xx [PTK=CCMP GTK=TKIP]
   wlan0: CTRL-EVENT-CONNECTED - Connection to xx:xx:xx:xx:xx:xx completed (auth) [id=0 id_str=]

8. On another terminal, run a DHCP client for the WiFi interface:

   root@desktop:~# dhclient wlan0

Ta da, success!

You’re now connected to the FreeWifi_secure network, with an IP address giving access to the Internet.
Total cost: $2 for the SIM reader + €2 per month for the mobile phone subscription.