Hi :-)
Yesterday I updated my GnuPG version via homebrew to 2.3.1. After the update my Yubikey 5 NFC was broke :
➜ ~ gpg --card-status gpg: selecting card failed: Operation not supported by device gpg: OpenPGP card not available: Operation not supported by device
My version :
➜ ~ gpg --version gpg (GnuPG) 2.3.1 libgcrypt 1.9.3 [...]
scdaemon conf
➜ ~ cat ~/.gnupg/scdaemon.conf reader-port Yubico Yubi debug-all debug-level guru log-file /tmp/scd.log
Some log :
2021-05-19 12:16:35 scdaemon[581] listening on socket '/Users/user/.gnupg/S.scdaemon' 2021-05-19 12:16:35 scdaemon[581] handler for fd -1 started 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> OK GNU Privacy Guard's Smartcard server ready 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 <- GETINFO socket_name 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> D /Users/user/.gnupg/S.scdaemon 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> OK 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 <- OPTION event-signal=31 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> OK 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 <- GETINFO version 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> D 2.3.1 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> OK 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 <- SERIALNO 2021-05-19 12:16:35 scdaemon[581] DBG: apdu_open_reader: BAI=140301 2021-05-19 12:16:35 scdaemon[581] DBG: apdu_open_reader: new device=140301 2021-05-19 12:16:35 scdaemon[581] ccid open error: skip 2021-05-19 12:16:35 scdaemon[581] check permission of USB device at Bus 020 Device 003 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> ERR 100696144 Operation not supported by device <SCD> 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 <- RESTART 2021-05-19 12:16:35 scdaemon[581] DBG: chan_7 -> OK
After a quick search I found two possibility to get a workaround :
Add "disable-ccid" to scdaemon.conf.
The Yubikey works, but.... I use yubikey at large scale, and actually we use the "cardno:" to identify which SSH KEY is to which Yubikey (it is physically engraved on the Yubikey).
An image to better understand :
On GnuPG 2.2 without ccid disabled :
➜ ~ ssh-add -L ssh-rsa AAAA.... == cardno:xxxxxxxxxxxxxx
On GnuPG 2.3 with ccid disabled :
➜ ~ ssh-add -L ssh-rsa AAAA.... == cardno:FF7F00
Also we lose access to the serial number when ccid is disabled :
➜ ~ gpg --card-status Reader ...........: Yubico YubiKey OTP CCID Application ID ...: FF7F00 Application type .: OpenPGP Version ..........: .� Manufacturer .....: Yubico Serial number ....: �
When this work normally :
➜ ~ gpg --card-status Reader ...........: Yubico YubiKey OTP CCID Application ID ...: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX <- I hided that on purpose Application type .: OpenPGP Version ..........: 3.4 Manufacturer .....: Yubico Serial number ....: XXXXXXX <- I hided that on purpose
So .. I can't really disable CCID
RollBack to 2.2 me and all of my co-worker
This is the solution that works for me, but not the ideal in the long run.
I am using macOS Big Sur 11.2.3.
Does anyone have a solution to make it work with last version of GnuPG, without disabling CCID on macOs ? This is really important for me.
In the log I see check permission of USB device at Bus, how can I give the appropriate permissions ?
Sorry for my poor english.
Thank's