void-linux / void-linux/void-packages

pcscd - GnupG - HW-Smartcard dont work as expected

Open
#62,408 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
3.4k
Forks
2.8k
Avg merge
2d 5h
Merged PRs (30d)
299

Description

Hello,

I have the following problem (should I move this to "Void packages?":
GPG-Key on smartcard. worked in terminal. worked in thunderbird. but:
when I unplug the smartcard and replugin the thunderbird I cannot decrypt the message anymore (no PIN asking...)

if i run in terminal for example "gpg --list-packets ~/.gpg-wakeup.asc" (and i get a PIN-ask), then thunderbird works immediately decrypting messages. suprising: a "gpg --card-status" (as i suspected is enough) didnt work.

The problem is most likely due to the "initialization of the smart card service (pcscd)" and how it communicates with the gpg-agent.

experimentet with scdaemon.conf:

disable-ccid
and
pcsc-shared

no luck.

summary of the problem (maybe):
under GnuPG 2.4.9, a gpg --card status after a card change is not sufficient to initialize the hardware for external clients (such as thunderbird), whereas a call to gpg --list-packets with an encrypted file does.

(I switched from Debian to voidlinux and all worked before)

regards

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the smartcard reconnect failure in Thunderbird and compare gpg --card-status with gpg --list-packets ~/.gpg-wakeup.asc. Then inspect the interaction among pcscd, gpg-agent, and scdaemon.conf, including the tried disable-ccid and pcsc-shared settings. Done means identifying a Void Linux-specific cause or configuration change that lets Thunderbird decrypt after reinserting the card without the workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.