GPG 2.2.2 not recognizing card reader under Linux
Closed, ResolvedPublic

Description

Under OpenSUSE 42.2 and gpg 2.1, the smart card would be recognized by gpg 2.1.11. Now, under OpenSUSE 42.3 and with gpg 2.2.2, even though the card reader

manufacturer = "SCM Microsystems Inc."
product = "SCR3340 - ExpressCard54 Smart Card Reader"

is recognized by the system, as shown in Yast/Hardware, the command

gpg --card-status

gives the error message

gpg: selecting openpgp failed: Aucun périphérique de ce type
gpg: la carte OpenPGP n'est pas disponible : Aucun périphérique de ce type

However, as noted, before, with gpg 2.1.11 it worked, and it stills works (after downgrading under OpenSUSE 42.3): the command

gpg --card-status

correctly returns (without smartcard)

gpg --card-status
gpg: selecting openpgp failed: Erreur de carte

PS: This bug report was identified as an error of GPG 2.2.2 itself by

https://forums.opensuse.org/showthread.php/527877-gpg-2-2-not-recognizing-card-reader-anymore

enno created this task.Nov 16 2017, 9:55 AM
werner added a project: scd.EditedNov 16 2017, 11:20 AM
werner added a subscriber: werner.

Entering on the shell

lsusb | grep USB

should result in output similar to this:

Bus 001 Device 121: ID 04e6:5116 SCM Microsystems, Inc. SCR331-LC1 / SCR3310 SmartCard Reader

Now what does

ls -l /dev/bus/usb/001/121

give you.? (Replace 001 and 121 by the bus and device values printed by lsusb). Are you in the group listed for that device (on Debian it would be "scard")? Check with "id | grep THATGROUP".

Is pcscd running ("pgrep -l pcscd")?

enno added a comment.Nov 16 2017, 5:44 PM

Dear Werner,

Thanks for you assistance. The output is

--- ~ » lsusb                                                      1 ↵
Bus 002 Device 005: ID 04e6:5119 SCM Microsystems, Inc. SCR3340 - ExpressCard54 Smart Card Reader
--- ~ » ls -l /dev/bus/usb/002/005     
crw-rw-r-- 1 root root 189, 132 16 nov.  13:25 /dev/bus/usb/002/005
--- ~ » pgrep -l pcscd

That is, pcscd is not running.

So you either need to start pcscd or you fix the permission of the device so that GnuPG's scdaemon can access the card reader using its internal access method. There are probably some udev rules which need to be adjusted. For a quick check you can manually change the owner or group to your own user or one of your groups. Then it should work again.

enno added a comment.Nov 16 2017, 7:19 PM

But this does not explain why it works on the same system with GPG 2.1.11 instead of 2.2.2.
Here is what happens after applying the suggested quick fixes:

--- ~ » sudo pcscd
--- ~ » sudo chown enno /dev/bus/usb/002/005                        1 ↵
--- ~ » sudo chgrp users /dev/bus/usb/002/005                      2 ↵
--- ~ » ls -l /dev/bus/usb/002/005
crw-rw-r-- 1 enno users 189, 132 16 nov.  15:17 /dev/bus/usb/002/005
--- ~ » gpg --card-status
gpg: selecting openpgp failed: Aucun périphérique de ce type
gpg: la carte OpenPGP n'est pas disponible : Aucun périphérique de ce type

You may have other changes on your system as well.

Full debugging requires that you add this to scdaemon.conf:

log-file SOMEFILE
verbose
debug ipx,cardio
debug-ccid-driver

and "gpgconf --kill scdaemon". And please run gpg with

LC_ALL=C gpg ....

so that we can see the English error messages.

enno added a comment.Nov 18 2017, 11:50 AM

Ok, edited ~/.gnupg/scdaemon.conf to contain

log-file ~/scdaemon.log
verbose
debug ipx,cardio
debug-ccid-driver

Executed

--- ~ » sudo chown enno /dev/bus/usb/002/005
--- ~ » sudo chgrp users /dev/bus/usb/002/005
--- ~ » /usr/sbin/pcscd
--- ~ » gpgconf --kill scdaemon
--- ~ » LC_ALL=C gpg --card-status

and attached scdaemon.log

gniibe claimed this task.Nov 20 2017, 7:16 AM
gniibe triaged this task as Normal priority.
gniibe added a subscriber: gniibe.

For some reason, scdaemon.log is not yet available here. Please put it again.

enno added a comment.Nov 20 2017, 3:27 PM

This is the actual error message from your log file:

2017-11-18 07:45:15 scdaemon[8918] DBG: ccid-driver: idVendor: 04E6  idProduct: 5119  bcdDevice: 0525
[...]
2017-11-18 07:45:15 scdaemon[8918] DBG: ccid-driver:   bMaxCCIDBusySlots       1
2017-11-18 07:45:15 scdaemon[8918] DBG: ccid-driver: CCID submit transfer (83): 0
2017-11-18 07:45:15 scdaemon[8918] DBG: ccid-driver: CCID: card inactive/removed

To me this seems to be a low level USB problem. I leave it @gniibe for further debugging. However, you can help him by adding this to your current scdaemon.conf

debug reader
debug-ccid-driver

right, you will have debug-ccid-driver twice in the conf file - that is intended.

Thank you for scdamon.log. For the card reader, the interrupt transfer notifies no availability of the card before PC_to_RDR_IccPowerOn.
I fixed this issue in rG0bb7fd0cab2d: scd: Enable card removal check after select_application.. Let's see if it works well for the card reader.

enno added a comment.Nov 21 2017, 4:09 PM

Thank you. Do you still need the log files with the settings suggested by Werner? Would I have to compile the master branch to see if it works now?

Another log is not needed, as I located the issue. If you can try building GnuPG from Git repo (it's 2.2 branch now), it helps us a lot.

enno added a comment.Dec 23 2017, 4:08 PM

With latestes master, there still appears:

--- ~ » gpg --card-status                                          2 ↵
gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
gpg: It is only intended for test purposes and should NOT be
gpg: used in a production environment or with production keys!
gpg: selecting openpgp failed: Aucun périphérique de ce type
gpg: la carte OpenPGP n'est pas disponible : Aucun périphérique de ce type

Thanks for your testing. please give me scdaemon.log with updated scdaemon.

enno added a comment.Dec 24 2017, 12:35 PM

The file scdaemon.log is short and contains only:

2017-12-24 12:32:53 scdaemon[4347] écoute sur la socket « /run/user/1000/gnupg/S.scdaemon »
2017-12-24 12:32:53 scdaemon[4347] gestionnaire pour le descripteur -1 démarré
2017-12-24 12:32:53 scdaemon[4347] pcsc_establish_context failed: no service (0x8010001d)

Please enable all debug information in scdaemon.conf, like:

verbose
verbose
debug-level guru
debug-all
debug-ccid-driver
log-file /run/user/1000/scdaemon-verbose.log
enno added a comment.Dec 25 2017, 10:15 AM

Thanks. I think that you configured GnuPG without libusb, thus, ccid-driver is not enabled, and you don't have pcscd installed. In this situation, no way to access any smartcard reader.

Please install libusb-dev and build GnuPG or install pcscd.

enno added a comment.Dec 25 2017, 6:39 PM

After installing libusb-devel, and configure and make, this is the new log.

Thanks a lot for your testing. Please test this patch:

enno added a comment.Dec 26 2017, 11:07 AM

After

patch -i scdaemon-fix-for-inactive-start.diff scd/ccid-driver.c

the following log obtains.

Thanks (again). According to the status code (bStatus), the card reader said no card is available.
Could you please remove the card and re-insert it, and do 'gpg --card-status'?

enno added a comment.Dec 26 2017, 1:07 PM

Yes, thank you, the smartcard is being recognized now.

gniibe added a comment.EditedDec 27 2017, 12:44 AM

Thanks a lot. I'm going to push the fix to 2.2 (and then master).
In short, it was the bug in ccid-driver of scdaemon, which was introduced last year when I enhanced it to support multiple card readers at once.

Card readers (which I tested) automatically initialize its card as "ON" default. It has not been tested with a card reader which doesn't automatically initialize its card (default is "OFF").

gniibe changed the task status from Open to Testing.Dec 27 2017, 9:31 AM
gniibe closed this task as Resolved.Feb 26 2018, 7:54 AM