com.samsung.android.app.esimkeystring Copy

A Samsung system component labelled "esimkeystring" in every locale recorded here, signed by a Samsung OEM key that also signs the Android framework, a platform-level key. It has no launcher entry and is not user-facing in any observation here. Samsung documents neither the package nor what it does, so this note stays close to what can be observed. As above, the permissions this site records are the ones a package requests, aggregated across observations rather than per build. That list is short and pointed: com.samsung.euicc.LPA_SERVICE_ACCESS, a permission named for the Samsung eUICC service documented above; com.samsung.android.app.esimkeystring.permission.KEYSTRING in a namespace matching its own name; com.sec.factory.permission.SIMDETEC and com.sec.phone.permission.SEC_FACTORY_PHONE, both in Samsung factory namespaces; plus READ_PRIVILEGED_PHONE_STATE, ACCESS_NETWORK_STATE, WAKE_LOCK and RECEIVE_BOOT_COMPLETED. Note that ACCESS_NETWORK_STATE is visibility of connection state and not the ability to reach the network, which INTERNET would grant and which is not in its recorded list. "Keystring" is Samsung's own word for this family of components rather than ours: the Common Criteria mode application list cited below records a separate "DeviceKeystring" package, com.sec.android.app.factorykeystring, on the same device. Taken together that is a small, non-interactive component that can reach whatever the eSIM access permission gates and holds factory and SIM-detection permissions, which would fit a service or engineering hook around eSIM rather than anything a user opens. Nothing we read names it, so treat that as our reading rather than a Samsung statement, and note in particular that we cannot say whether it is reachable through a dialler code. Version note: this package does not appear in Samsung's Android 10 application list for the Galaxy Note20 Ultra 5G, which does record the eUICC service alongside it, and this site's earliest observation of it is at API 35 (Android 15), with the roll-ups running to API 37 (Android 17) and versions from 7.0.00.00 to 9.0.00.00. One device's list and one sample of devices cannot date its introduction, so read that as "recent on the devices recorded here" rather than as a release in which it appeared. No documented change of role across Android releases could be found, because no documentation of its role could be found. For Android Enterprise, EMM and kiosk use, no enrolment or policy role for it is identified in the sources cited here, and it presents nothing to the user. Because its purpose is unsourced and its permissions place it next to the eSIM service, the effect of disabling it could not be established: leave it in place. If you are hardening a fleet's eSIM handling, prefer a documented lever such as the Android Management API eSIM commands supported from Android 15, over disabling an undocumented package of this kind.

• Galaxy Note20 Ultra 5G (SM-N986B, Android 10) Common Criteria mode application list - Samsung Knox Documentation →
• Implement eSIM (LPA, EuiccService) - Android Open Source Project →
• enterprises.devices.issueCommand (ADD_ESIM, REMOVE_ESIM) - Android Management API →
• Package provenance for com.samsung.android.app.esimkeystring - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 14 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (580 packages, 11729 observations).
• Its largest observed manifest declares 9 permissions: 1 signature or system-level, 3 install-time and 5 vendor or uncatalogued.
• APK size ranges from 3.9 MB to 9.0 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.