SIM Authentication Key File (Ki / OPc personalisation output)

SIM / USIM personalisation and key files exchanged between SIM vendors, mobile network operators and HSS/AuC provisioning: a header row naming subscriber key columns (Ki, OPc, ADM1, KIC1/KID1/KIK1, EKI) next to ICCID or IMSI, followed by populated rows that pair an ICCID (ITU-T E.118, MII 89, e.g. Australian issuer prefixes 8961 and 8967210 on the ACMA register) and an IMSI (3GPP TS 23.003, MCC + MNC + MSIN, at most 15 digits; Australia MCC 505) with 128-bit key values (32 hex characters, per 3GPP TS 35.206 K and OPc). The file layout is vendor-proprietary; the pySim card-key CSV and pysim-perso column sets are used only as shapes. Excludes the published 3GPP TS 35.208 test-set values, "Test Set" / "35.208" text, test networks (MCC 001) and pySim / Open5GS tutorial or documentation text.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High for 75/85: a single line pairing a 19-20 digit ICCID, a 15-digit IMSI and a standalone 32-hex value under a Ki/OPc header has no common benign explanation outside SIM test material, which is excluded explicitly. The ICCID Luhn check digit is not validated inside the row regex (Purview validators apply to whole matches), and the IMSI shape does not validate the MNC, so a malformed or non-issued ICCID/IMSI can still match. The 65 header tier also fires on vendor documentation and news about SIM key theft and is discovery-only. Test rows are synthetic; key values are random hex, not real keys and not 3GPP test vectors.
Jurisdictions: global
Regulations: GDPR, Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF
Data categories: credentials, security, device-id
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:\b(?:ICCID|IMSI)\b[^\n]{0,200}?\b(?:Ki|OPc|ADM1|KI[CDK]\d|EKI)\b|\b(?:Ki|OPc|ADM1|KI[CDK]\d|EKI)\b[^\n]{0,200}?\b(?:ICCID|IMSI)\b)

Corroborative evidence keywords

PIN1, PUK1, PIN2, PUK2, ADM1, transport key, batch, personalisation, HSS, AuC, MSISDN

Proximity: 1000 characters

Should match

Perso output file - Batch 2609-QX, quantity 2, transport key TK02 ICCID,IMSI,PIN1,PUK1,PIN2,PUK2,KI,OPC,ADM1 8961025100000000017,505021234500017,4829,71630495,9173,20586147,3F9A1C07D2E84B6590AC11F2E7B3D548,A07C5E91B2D4F63808E1C9A7B5D30F62,58302914 8961025100000000025,505021234500025,1375,49281736,6624,85017394,7B2E90D4C1A8F3651E0DB4C92A6F7E13,D5C1A83F0E7B29C46A9D02F15B8E7C34,58302914 — 85 - Australian SIM vendor output file (8961 02 Optus-range ICCIDs, IMSI 505 02) with header, two populated key rows and PIN/PUK/batch/transport key evidence
HSS bulk subscriber import (AuC keys) - order 7731 IMSI ICCID KI OPC 530011000000471 8964011000000004718 9C2E4A71B08D35F6E12A7C90D4B3F851 2F81D0C7A94E3B6C15D8E07A9B4C2F63 530011000000489 8964011000000004890 E47B1A0C92D5F83617A4C0E9B2D8F574 6A0D3C9F17E82B45D0C9A71E3F84B26D — 85 - IMSI-first whitespace-aligned HSS/AuC import (non-AU MCC) with two populated key rows
"id","imsi","iccid","acc","pin1","puk1","pin2","puk2","ki","opc","adm1" "1","505031000004821","8961030100000048215","0004","2741","98765431","5068","13572468","8C1F3A6E9B0D247C5E1A9F3B6D0C8E27","41E9C7A0B3D56F28E1C4A9D7B06F3E85","77112233" — 75 - card-key CSV (pySim column set) with one populated row (Vodafone-range 8961 03 ICCID, IMSI 505 03)
ICCID;IMSI;KI;OPC;KIC1;KID1;KIK1 8961230000000003157;505021100003157;B3E0A6C1D94F27851C3E9A0D7B62F4C8;19F4C2E7A0B85D63E91C4A7F0D2B86E3;5D0A7E3C91F2B84605C1E9D3A7F28B4E;C07E2B91A4D63F585E1A0C9D72B4F36E;2A9F6C0E3B7D14855F1C8A0E9D63B27C — 75 - OTA key file (Ki/OPc plus KIC1/KID1/KIK1) with one populated row

Should not match

ICCID,IMSI,KI,OPC 8961025100000000033,505021234500033,465B5CE8B199B49FAA5F0A2EE238A6BC,CD63CB71954A9F4E48A5994E37A02BAF — Lab card programmed with the 3GPP TS 35.208 test set 1 K and OPc values (explicitly excluded values)
3GPP TS 35.208 - 4.3 Test Set 1 K: 465b5ce8 b199b49f aa5f0a2e e238a6bc RAND: 23553cbe 9637a89d 218ae64d ae47bf35 OP: cdc202d5 123e20f6 2b6d676a c72cb318 OPc: cd63cb71 954a9f4e 48a5994e 37a02baf — 3GPP MILENAGE test-set text
The CSV card key provider reads a file whose first line is a header: "id","imsi","iccid","acc","pin1","puk1","pin2","puk2","ki","opc","adm1". Each following row supplies the keys for one card, looked up by ICCID or IMSI. — pySim card-key-provider documentation
ICCID,IMSI,PIN1,PUK1,KI,OPC,ADM1 <iccid>,<imsi>,<pin1>,<puk1>,<ki>,<opc>,<adm1> — Blank key-file template with placeholders
Open5GS tutorial: add a subscriber in the WebUI with IMSI 001010000000001, Ki 465B5CE8B199B49FAA5F0A2EE238A6BC and OPc CD63CB71954A9F4E48A5994E37A02BAF, then program the SIM with pySim-prog. — Open5GS / pySim tutorial using test network MCC 001 and TS 35.208 values
Investigators say the attackers stole Ki and OPc values for millions of SIM cards, which would let them decrypt calls if they could match each key to an ICCID. — News reporting on SIM key theft

Known false positives

SIM vendor, pySim and Open5GS documentation and news that name Ki/OPc next to ICCID/IMSI. Mitigation: The header alone is 65 discovery; enforce tiers need a populated ICCID + IMSI + 32-hex row. Documentation and tutorial text is also excluded.
Lab and test SIMs programmed with the 3GPP TS 35.208 test sets, and test networks using MCC 001. Mitigation: The TS 35.208 test set 1 K/OP/OPc values and "Test Set" / "35.208" text are excluded; the IMSI shape requires MCC 2xx-7xx, so 001-01 test IMSIs never form a row.
Real ICCID/IMSI inventory exports without key columns (activation lists, MVNO stock files). Mitigation: Not this classifier - no Ki/OPc header, so no primary. Those are covered by global-iccid and the IMSI/phone classifiers.