1

Currently I can use

$ gpg --expert --card-status

to interact with smartcards that run the OpenPGP applet. Through trial-and-error, it seems that only the first card reader will interact with gpg. Using options that pass to scdaemon seem to be deprecated:

$ gpg --reader-port  1 --card-status
gpg: WARNING: "--reader-port" is an obsolete option - it has no effect except on scdaemon

Is there a way to interact with an OpenPGP smartcard that is not connected to the first card reader?

Edit: After some more research, I found a blog post from the author of the libccid library https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html that mentions:

Tell GnuPG to use PC/SC

Another solution is to make GnuPG and pcscd collaborate to work together. Luckily it is possible to do that using the scdaemon option --disable-ccid

From the documentation:

--disable-ccid

  Disable the integrated support for CCID compliant readers. This  
  allows falling back to one of the other drivers even if the internal  
  CCID driver can handle the reader. Note, that CCID support is only  
  available if libusb was available at build time.

With this option scdaemon will use PC/SC to talk to the smart card and the conflict is solved.

It is possible to tell scdaemon to always use this option by editing the scdaemon configuration file. By default it is ~/.gnupg/scdaemon.conf and it should contain the line:

disable-ccid

Edit 2: With these configuration adjustments:

$HOME/.gnupg/scdaemon.conf

pcsc-driver /usr/lib/x86_64-linux-gnu/libpcsclite.so.1
disable-ccid
reader-port <reader-string>

I'm able to restart the agent with systemctl --user restart gpg-agent.service in order to use the different reader. This works!

Is there any way to pass the reader option to gpg or the scdaemon instead of editing a on-disk file & restarting? If a shell script is needed, is it possible to send a signal instead of file/restart workflow?

Improve this question

1 Answer 1

Reset to default
1

You should put this instruction into $HOME/.gnupg/scdaemon.conf, not pass it directly to gpg.

Improve this answer
2
  • On Ubuntu 20.04 LTS, this configuration file does not exist by default. In spite of that, I can connect to an OpenPGP card if it is in the first smartcard reader slot. (Not the second, or any other).
    – Jared
    Jun 29, 2020 at 0:05
  • I'm able to get the second reader accessed by editing the scdaemon.conf & restarting the agent. Is there way to pass this option at runtime using the CLI?
    – Jared
    Jul 1, 2020 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .