A system for securely communicating with a mobile device including an embedded universal integrated circuit card, eUICC, , the system comprising: an eUICC subscription manager configured to: a) receive, from the mobile device , i) an eUICC identity and ii) an eUICC public key ; b) generate an eUICC subscription manager private key and an eUICC subscription manager public key ; c) derive a profile key using an elliptic curve Diffie Hellman, ECDH, key exchange with the eUICC subscription manager private key and the eUICC public key ; d) encrypt a first portion of an eUICC profile with the profile key , wherein the first portion includes network parameters ; and e) encrypt a second portion of the eUICC profile with a symmetric key , wherein the second portion includes a subscriber identity and a key K , and wherein the second portion is distinct from the first portion ; and a server configured to: a) send , to the mobile device , i) the encrypted first portion of the eUICC profile and ii) the encrypted second portion of the eUICC profile ; and b) after a mobile network operator authenticates a user associated with the mobile device , send , to the mobile device , the symmetric key . an eUICC subscription manager configured to: a) receive, from the mobile device , i) an eUICC identity and ii) an eUICC public key ; b) generate an eUICC subscription manager private key and an eUICC subscription manager public key ; c) derive a profile key using an elliptic curve Diffie Hellman, ECDH, key exchange with the eUICC subscription manager private key and the eUICC public key ; d) encrypt a first portion of an eUICC profile with the profile key , wherein the first portion includes network parameters ; and e) encrypt a second portion of the eUICC profile with a symmetric key , wherein the second portion includes a subscriber identity and a key K , and wherein the second portion is distinct from the first portion ; and a) receive, from the mobile device , i) an eUICC identity and ii) an eUICC public key ; b) generate an eUICC subscription manager private key and an eUICC subscription manager public key ; c) derive a profile key using an elliptic curve Diffie Hellman, ECDH, key exchange with the eUICC subscription manager private key and the eUICC public key ; d) encrypt a first portion of an eUICC profile with the profile key , wherein the first portion includes network parameters ; and e) encrypt a second portion of the eUICC profile with a symmetric key , wherein the second portion includes a subscriber identity and a key K , and wherein the second portion is distinct from the first portion ; and a server configured to: a) send , to the mobile device , i) the encrypted first portion of the eUICC profile and ii) the encrypted second portion of the eUICC profile ; and b) after a mobile network operator authenticates a user associated with the mobile device , send , to the mobile device , the symmetric key . a) send , to the mobile device , i) the encrypted first portion of the eUICC profile and ii) the encrypted second portion of the eUICC profile ; and b) after a mobile network operator authenticates a user associated with the mobile device , send , to the mobile device , the symmetric key . <EOS>