[PATCH gnupg] scd: Add Nitrokey 3 to pcsc-shared interference detection

[Artemii Bigdan]

Hello,

(1) As far as I'm concerned, any solution is acceptable. I am not a GPG 
maintainer, so I don't have an opinion on whether or not we should 
remove the CARDTYPE_YUBIKEY condition.
If you recall, when I suggested my patch, I conservatively created a new 
CARDTYPE_NK3 so that these changes do not affect YubiKey.
Unfortunately I can't tell you if removing this condition will break 
stuff and I do not have a YubiKey to check.

(2) It's a shame that emulation diverges from the real thing. Maybe we 
should just share a physical Nitrokey stick over USB/IP? Of course, I 
can't use my personal key for obvious security reasons, but maybe Robin 
could host it? That way Nitrokey won't sacrifice a device and won't pay 
for shipping, as I suggested earlier with an R&D device. That seems much 
more wise than my initial suggestion :)

Worst-case scenario - I can buy a second Nitrokey and host it, although 
they are not exactly cheap.

Hope that clarifies,

- Artemii

On 23.07.2026 8:15, NIIBE Yutaka wrote:
> Hello,
>
> For merging your work, I think that there are two things:
>
> (1) PC/SC shared option and change of maybe_switch_app
>
> IIUC, you suggest to modify the maybe_switch_app function so that it can
> call fnc.reselect method when PC/SC shared is enabled and device is
> Yubikey/Nitrokey.
>
> (2) Nitrokey specific things
>
> That is: detecting Nitrokey and scdaemon's behavior tweaks when it's
> Nitrokey.
>
>
> For (1), let me confirm with no consideration of Nitrokey, firstly.
> The changes are like following.
>
> ==========================
> diff --git a/scd/app.c b/scd/app.c
> index 63eb84190..6f74e8c42 100644
> --- a/scd/app.c
> +++ b/scd/app.c
> @@ -1792,12 +1792,15 @@ maybe_switch_app (ctrl_t ctrl, card_t card, const char *keyref)
>     if (!card->app)
>       return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
>   
> -  if (card->maybe_check_aid && card->app->fnc.reselect
> +  if ((card->maybe_check_aid
> +       || (opt.pcsc_shared && card->cardtype == CARDTYPE_YUBIKEY))
> +      && card->app->fnc.reselect
>         && check_external_interference (card->app, ctrl))
>       {
>         if (DBG_APP)
> -        log_debug ("slot %d, app %s: forced re-select due to direct APDU use\n",
> -                   card->slot, xstrapptype (card->app));
> +        log_debug ("slot %d, app %s: forced re-select due to %s\n",
> +                   card->slot, xstrapptype (card->app),
> +                   card->maybe_check_aid? "direct APDU use" : "pcsc-shared");
>         err = card->app->fnc.reselect (card->app, ctrl);
>         if (err)
>           log_error ("slot %d, app %s: forced re-select failed: %s - ignored\n",
> ==========================
>
> I wonder if the condition
>
> 	card->cardtype == CARDTYPE_YUBIKEY
>
> is really needed or not.  If it's not strictly required, I'd prefer to
> change without this condition.  (Or else, we will need to add Nitrokey
> condition here.)
>
> If it is OK with no-cardtype condition, I will push the change firstly.
> Then, focus on (2).
>
>
> I struggle with (2), using USBIP emulation (found it's not exact
> emulation, at least ATR is different).  Tentative work is in
> https://dev.gnupg.org/T8331