tag:gpgtools.tenderapp.com,2011-11-04:/discussions/problems/28634-gpg-agent-stops-working-after-osx-upgrade-to-yosemiteGPGTools: Discussion 2015-02-02T22:22:24Ztag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-17T16:23:57Z2015-01-17T16:23:57Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Hi Samuel,</p>
<p>is this the entire output you can find in your scdaemon.log
file?<br>
I'm curious because there was much more Info in Bartoszs</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-17T18:26:28Z2015-01-17T18:26:31Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>@Samuel Reed yes, my card is a Yubikey NEO</p>
<p>@Luke Le GPG doesn't seem to be defaulting to the internal CCID
driver in practice here. If it were, anyone with a natively
supported card wouldn't even notice PCSC issues. So if it's
supposed to be doing that, perhaps that is itself another bug that
would resolve some of the problems people are having? I assumed
that it was using PCSC by default for a reason, perhaps not.</p>
<p>Anyhow, I'm happy to report that my crude hack appears to be
working perfectly. 9 hours after I set it up, using the card via
GPG and SSH both still work. I've <strong>never</strong> seen the
system go 9 hours without needing to remove the card and kill
scdamon and friends. There are some downsides (read the end), but
at my company we are happy to accept them for now as we rely on
OpenPGPCards for a lot of things.</p>
<p><strong>This is a bit long, so here's the short version of the
hack if you know what you're doing: disable Apple's ifdhandler
service with launchctl, restart scdaemon & gpg-agent. This
leaves GPG no option but to use the internal driver instead of
Apple's PCSC. Please test and report back, but it seems to be
working great here with our Yubikey NEO's.</strong></p>
<p>My theory was that by default, GPG (or at least the GPGTools
version, on this platform) is actually trying to use the card via
PCSC first, and on a normal Yosemite system PCSC works well enough
that GPG finds and proceeds to use it that way. And soon afterward,
it stops working as everyone has now seen. The internal CCID driver
seems to only be used if it <strong>can't</strong> find the card
another way.</p>
<p>So I figured if I can ensure that GPG can't find the card via
Apple's broken PCSC, it should then try its internal CCID driver
and talk to the card directly using libusb (which GPGTools
includes).</p>
<p>To test my theory, I first setup verbose logging in
scdaemon.conf and inserted my card to see what it logs normally
when PCSC is being used:</p>
<pre>
<code>2015-01-17 01:02:49 scdaemon[69789] listening on socket `/tmp/gpg-VCNfMw/S.scdaemon'
2015-01-17 01:02:49 scdaemon[69789] handler for fd -1 started
2015-01-17 01:02:50 scdaemon[69789] pcsc_control failed: invalid parameter (0x80100004)
2015-01-17 01:02:50 scdaemon[69789] pcsc_vendor_specific_init: GET_FEATURE_REQUEST failed: 65538
2015-01-17 01:02:50 scdaemon[69789] reader slot 0: not connected
2015-01-17 01:02:50 scdaemon[69789] slot 0: ATR=3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
2015-01-17 01:02:50 scdaemon[69789] AID: D2 76 00 01 24 01 02 00 00 06 02 10 30 06 00 00
2015-01-17 01:02:50 scdaemon[69789] Historical Bytes: 00 73 00 00 80 00 00 00 00 00 00 00 00 00 00
...</code>
</pre>
<p>Note what it says about reader slot 0, for later. It finds the
card, the ATR is correct for this Yubikey NEO model (pre-3,000,000
serial number, no PIV/U2F applets).</p>
<p>Running <code>pcsctest</code> returns the following:</p>
<pre>
<code>MUSCLE PC/SC Lite Test Program
Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: Yubico Yubikey NEO OTP+CCID
Enter the reader number : 01
Waiting for card insertion
: Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : Yubico Yubikey NEO OTP+CCID
Current Reader State : 0x54
Current Reader Protocol : 0x1
Current Reader ATR Size : 20 (0x14)
Current Reader ATR Value : 3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.</code>
</pre>
<p>So PCSC works and anything using it can find the card that way
at the moment.</p>
<p>I then unplugged my card, killed scdaemon and gpg-agent, and
setup my crude hack: disabling Apple's ifdhandler.</p>
<p><em>Note: pidof comes from Homebrew, it's not a standard part of
OS X</em></p>
<pre>
<code>kill -9 `pidof scdaemon` && kill -9 `pidof gpg-agent`
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.ifdreader.plist</code>
</pre>
<p>This should prevent anything from being able to find and use a
card via Apple's PCSC implementation.</p>
<p>Running <code>pcsctest</code> confirmed this.</p>
<p>I then ran a GPG command to allow scdaemon and gpg-agent to
start again and try to find the card, and this is what scdaemon
logged (I've highlighted the important line):</p>
<pre>
<code>2015-01-17 01:05:36 scdaemon[70971] listening on socket `/tmp/gpg-6oenRV/S.scdaemon'
2015-01-17 01:05:36 scdaemon[70971] handler for fd -1 started
-------------------------------------------------------------------------------------------------
2015-01-17 01:05:36 scdaemon[70971] reader slot 0: using ccid driver
-------------------------------------------------------------------------------------------------
2015-01-17 01:05:36 scdaemon[70971] slot 0: ATR=3B FA 13 00 00 81 31 FE 15 59 75 62 69 6B 65 79 4E 45 4F A6
2015-01-17 01:05:36 scdaemon[70971] AID: D2 76 00 01 24 01 02 00 00 06 02 10 30 06 00 00
2015-01-17 01:05:36 scdaemon[70971] Historical Bytes: 00 73 00 00 80 00 00 00 00 00 00 00 00 00 00
2015-01-17 01:05:36 scdaemon[70971] Version-2 ......: yes
2015-01-17 01:05:36 scdaemon[70971] Get-Challenge ..: yes (255 bytes max)
2015-01-17 01:05:36 scdaemon[70971] Key-Import .....: yes
2015-01-17 01:05:36 scdaemon[70971] Change-Force-PW1: yes
2015-01-17 01:05:36 scdaemon[70971] Private-DOs ....: no
2015-01-17 01:05:36 scdaemon[70971] Algo-Attr-Change: no
2015-01-17 01:05:36 scdaemon[70971] SM-Support .....: yes (3DES)
2015-01-17 01:05:36 scdaemon[70971] Max-Cert3-Len ..: 1216
2015-01-17 01:05:36 scdaemon[70971] Max-Cmd-Data ...: 255
2015-01-17 01:05:36 scdaemon[70971] Max-Rsp-Data ...: 255
2015-01-17 01:05:36 scdaemon[70971] Cmd-Chaining ...: yes
2015-01-17 01:05:36 scdaemon[70971] Ext-Lc-Le ......: no
2015-01-17 01:05:36 scdaemon[70971] Status Indicator: 00
2015-01-17 01:05:36 scdaemon[70971] GnuPG-No-Sync ..: no
2015-01-17 01:05:36 scdaemon[70971] GnuPG-Def-PW2 ..: no
2015-01-17 01:05:36 scdaemon[70971] Key-Attr-sign ..: RSA, n=2048, e=17, fmt=crt+n
2015-01-17 01:05:36 scdaemon[70971] Key-Attr-encr ..: RSA, n=2048, e=17, fmt=crt+n
2015-01-17 01:05:36 scdaemon[70971] Key-Attr-auth ..: RSA, n=2048, e=17, fmt=crt+n
2015-01-17 01:05:36 scdaemon[70971] updating slot 0 status: 0x0000->0x0007 (0->1)
2015-01-17 01:05:36 scdaemon[70971] sending signal 31 to client 70970
2015-01-17 01:05:48 scdaemon[70971] DBG: asking for PIN '||Please enter the PIN'
2015-01-17 01:05:52 scdaemon[70971] operation auth result: Success</code>
</pre>
<p>So despite crippling the system PCSC implementation, GPG still
found the card and can use it. If I then use the
<code>disable-ccid</code> config option in scdaemon.conf to turn
off GPG's internal driver and restart the daemon, the card stops
working again as expected, because it is the only thing left
allowing it to work.</p>
<p>There does not appear to be any obvious configuration setting
provided by GPG to make sure it tries the internal CCID driver
first (perhaps there's a good reason for that? are there downsides
to avoiding PCSC when it is available?), but I haven't looked very
hard either or tried anything else. So perhaps there is a better
way than what I have done, which has real and significant
downsides: PCSC no longer works <em>at all</em>, either with other
cards or even other applets on the card GPG is using, like the PIV
or U2F applets on a newer Yubikey NEO. If you <strong>only</strong>
need to use natively supported GPG cards as we do, then this is a
temporary solution that seems to work.</p>
<p>To undo the change and put the system back to its normal
configuration, just unplug your card, load ifdhandler again, and
kill scdaemon & gpg-agent:</p>
<pre>
<code>sudo launchctl load /System/Library/LaunchDaemons/com.apple.ifdreader.plist
kill -9 `pidof scdaemon` && kill -9 `pidof gpg-agent`</code>
</pre>
<p>That should return things to "normal", though other services
(<code>com.apple.ctkd</code> perhaps?) may need to be restarted
afterward too.</p></div>Stephen Olivertag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-17T18:46:25Z2015-01-17T18:46:26Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>@Luke Yes, that was the whole of the output.</p>
<p>@Stephen Absolutely fantastic post! I followed your instructions
and now <code>pscstest</code> fails as expected yet <code>gpg
--card-status</code> is still working. Let's see how it performs
long-term. Thankfully I as of yet have no need for other
applets.</p></div>Samuel Reedtag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-17T18:56:10Z2015-01-17T18:56:12Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>That should say <code>ifdreader</code> up there any place it
says <code>ifdhandler</code>, i'm so used to seeing ifdhandler at
the moment my eyes skipped right over the actual name of the
launchd service, sorry about that :)</p></div>Stephen Olivertag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-17T19:56:18Z2015-01-17T19:56:18Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Hi Stephen,</p>
<p>Thank you for this in depth explanation. What strikes me as odd
however is the fact that GPG should not default to the ccid driver.
I just checked the source and the first that is tried is always the
ccid driver unless disable-ccid is given. After that I started
getting curious if there might be a problem with our scdaemon,
since there is one other case where ccid driver isn't the first to
be checked and that is if GPG is compiled without libusb support
which our version should be. So I disassembled the scdaemon binary
from Beta 4 and the code which tries the ccid driver First is
clearly and correctly there.</p>
<p>Not sure what is going on at the moment but we'll keep
looking.</p></div>Luke Letag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-20T06:47:06Z2015-01-20T06:47:07Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>When I unload
<code>/System/Library/LaunchDaemons/com.apple.ifdreader.plist</code>
then:<br></p>
<pre>
<code>$ gpg --card-status
gpg: selecting openpgp failed: Card error
gpg: OpenPGP card not available: Card error</code>
</pre>
<p><code>pcsctest</code> result:</p>
<pre>
<code>MUSCLE PC/SC Lite Test Program<br><br>
<br>Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange</code>
</pre>
and it hangs.
<p>I use Yubikey NEO 3.0.4.</p></div>bartosz.malkowskitag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-21T15:20:45Z2015-01-21T15:20:46Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Bartosz,</p>
<p>Which version of OS X and GPGTools are you using? I'm testing
with OS X 10.10.1 and GPGTools nightly builds on a NEO with 3.1.2
firmware (and OpenPGPApplet 1.0.8 but that shouldn't affect
anything here). GPGTools betas should be fine though.</p>
<p>Which mode is the NEO in at the moment? If you haven't changed
it, it shouldn't be a factor here either so don't worry about
it.</p>
<p>I do see <code>gpg --card-status</code> say card error when I
first plug in the card, but the 2nd time it works and then
continues to work for as long as I leave it plugged in (multiple
days at this point). Everything that actually <em>uses</em> the
card works immediately after the card is plugged in though.</p>
<p>If Apple's PCSC isn't working, <code>pcsctest</code> should give
you a result like this:</p>
<pre>
<code>MUSCLE PC/SC Lite Test Program
Testing SCardEstablishContext : Service not available.</code>
</pre>
<p>So something isn't quite right there.</p>
<p>Take the card out for a few seconds, then make sure there aren't
any <code>com.apple.ifdreader</code> or <code>scdaemon</code>
processes running in Activity Monitor (kill any if you find them),
then plug your card in and see if another
<code>com.apple.ifdreader</code> process starts. If not, test
<code>gpg</code> again and let me know what happens :)</p></div>Stephen Olivertag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-22T06:19:56Z2015-01-22T06:19:56Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>I use OSX 10.10.1.<br>
GPGTools Beta 4.</p>
<p>After few plog off&in it seems to work. <code>gpg</code>
shows card status.<br>
I have no idea if it is important or not, but <code>pcsctest</code>
says <code>Command successful.</code> instead of <code>Service not
available.</code>.<br>
<code>ps aux</code> doesn't shows anything matching to
<code>ifd</code>..</p></div>bartosz.malkowskitag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-26T23:00:56Z2015-01-26T23:00:56Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Hi all,</p>
<p>this issues should be fixed. Could you please download and
install our latest <a href=
"https://releases.gpgtools.org/nightlies/">nightly build</a> and
see if the problem persists. That page also has sig and SHA1 to
verify the download.</p>
<p>All the best, steve</p>
<p>Disclaimer: This is a development version which has not been
thoroughly tested yet - bugs or crashes are to be expected. Thanks
for helping us test.</p></div>Stevetag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-29T15:08:44Z2015-02-02T21:39:41Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Steve,</p>
<p>I can confirm this works now! Thank you so much!</p></div>Yubkikey Neo-Ntag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-01-30T16:01:12Z2015-01-30T16:01:15Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>I re-enabled Apple's ifdreader, killed <code>gpg-agent</code>
and <code>scdaemon</code>, and manually downloaded the newest
nightly build (there's a note in the update window about the
automatic update potentially failing, and it did 100% of the
time).</p>
<p>The newest nightly builds do allow my card to continue working
12+ hours after the GPGTools update is installed, even with
scdaemon using PCSC rather than the internal CCID driver +
libusb.</p>
<p><code>gpg --card-status</code> and ssh connections are working,
and I haven't had to kill <code>gpg-agent</code> and friends or
remove my card since the update.</p></div>Stephen Olivertag:gpgtools.tenderapp.com,2011-11-04:Comment/350042652015-02-02T22:22:22Z2015-02-02T22:22:22Zgpg-agent stops working after OSX Upgrade to Yosemite<div><p>Hey Stephen and N,</p>
<p>thank you both for the update. Closing, make sure to get in
touch should you encounter further hickups.</p>
<p>All the best,<br>
steve</p></div>Steve