GnuPG 1.4.1rc1 + Smart Card reader package for Knoppix/Kanotix
dany_list at natzo.com
Sun Feb 6 15:01:14 CET 2005
In a previous post (Any LiveCD with GnuPG 1.4?) I was asking about a
potential LiveCD that supports Gnupg 1.4 (at least).
Thanks everyone for the valuable comments you've provided.
I received a private email from David Lorch suggesting recompiling gpg
and associated libraries under Knoppix by mounting some ramdisk.
I kind of tried but it didn't go very far. Finally I found a way to get
gpg 1.4.1rc1 to run under Knoppix without much hassle (using a SCM
SCR331 reader which has a driver built-in gnupg). In fact it was as easy
as ./configure and make !
I then added additional drivers for various readers using the Klik
technology. In the end I had a handy package that contained gpg1.4.1rc1
as well as drivers that I could carry around and use with almost any
Knoppix/Kanotix LiveCD. This is very convenient when it comes to key
generation (on-card for example with off-card backup for example).
1) Boot from Knoppix CD (3.7 12/08) or even better from Kanotix BH X
IMPORTANT : for Knoppix I only used boot: knoppix26 .... I couldn't
get most of my USB peripherals to work with regule knoppix (2.4).
Kanotix is 2.6 by default so no problems.
2) Download and extract gnupg-1.4.1-rc from
example in your home directory (/home/knoppix)
3) Compile GnuPG
the executable is available in ~/gnupg-1.4.1rc1/g10
4) Smart Card Reader
a) CCID reader directly supported by gnupg (e.g. USB SCM SCR331)
Nothing to do ... just use it : ~/gnupg-1.4.1rc1/g10/gpg --card-status
b) CCID reader supported by libccid (see
http://pcsclite.alioth.debian.org/ccid.html for a list of supported readers)
I've used it with the Gemplus GemTwin USB.
In order to use libccid you need the pcscd which can be downloaded as a
"klik" application for Knoppix.
Knoppix users you need an extra step to get the klik client up and
running (Kanotix users... go to the next step):
# Press Alt-F2 and paste:
# wget klik.atekon.de/client/install -O -|sh
Go to the following address
"klik" to install
even faster open a web browser and enter : klik://pcscd
Now killall pcscd session that may have been opened during the
installation process. I noticed that the pcscd would only work if
launched with debug options.
This pcscd packages includes the libccid drivers by default so it's
ready to go.
Unfortunately gnupg is looking for libpcslite.so so a link has to be
Now it's time to start the pcscd from the command line (not the icon on
/tmp/klik/pcscd/wrapper pcscd -af
NB: this worked fine under Knoppix but not under Kanotix, sudo
/tmp/klik/pcscd/wrapper pcscd -af solved the problem
Before starting gpg you need to set the path to libpcsclite.so :
You can now start gnupg but remember that if you're using a CCID reader
not supported by GnuPG itself you must disable ccid when calling GnuPG
so it won't try to talk to the reader directly. For example the GemTwin
will fail if not started with the extra option.
~/gnupg-1.4.1rc1/g10/gpg --card-status --disable-ccid
NB: SCR331 can also be used with libccid (it's supported by both gnupg
c) Other Smart Card readers
If none of your reader is supported by the above solutions you need to
install an additional driver.
Klik provides a convenient way to download precompiled drivers. Below is
a list of available drivers:
- libasedrive-serial | PC/SC driver for the Athena ASEDrive IIIe serial
smart card reader
- libasedrive-usb | PC/SC driver for the Athena ASEDrive IIIe USB smart
- libcteco50000 | Orga Eco 5000 smartcard reader PCSC and CT-API driver
- libetoken | PC/SC Driver for Aladdin's eToken usb plug
- libgcr410 | PC/SC driver for GemPlus GCR410 serial SmartCard interface
- libgempc410 | PC/SC driver for the GemPC 410, 412, 413 and 415 smart
- libgempc430 | PC/SC driver for the GemPC 430, 432, 435 smart card readers
- libslbreflex2 | Reflex 62/64 smartcard reader PCSC and CT-API driver
- libtowitoko2 | Towitoko smartcard reader PCSC and CT-API driver
Example : USB Towitoko Chipdrive Micro 130
After "kliking" on libtowitoko2
you'll find a new directory under /temp/klik called towitoko2
The drivers files need to be placed under the pcscd directory and
according to a specific directory organization
and then start pcscd the same way :
/tmp/klik/pcscd/wrapper pcscd -af (with sudo if using Kanotix)
Don't forget to set the path to libpcsclite.so before running gnupg :
NB: Serial reader may also be used but they'll need a little bit more
tweaking for properly configuring the serial port and so on. I tried to
play a little bit with the GCR415 without success.
Now that you've got your reader up and running you probably don't want
to go to this process next time you're booting from Knoppix/Kanotix.
The only thing you need to save (on a USB drive for example) is the
/tmp/klik directory and gpg executable files
You can also use the convenient persistent home directory and just move
the klik to it so it will be available all the time. Don't forget to
adjust the export LD_LIBRARY_PATH accordingly !
I've packaged a pre-compiled gpg-1.4.1rc1, pcsd (including libccid) and
towitoko driver so you can just extract it under /home/knoppix and
follow the instructions found in the short readme file.
The file can be downloaded from http://natzo.com/klik-gpg1.4.1rc1.tar.gz
This should help users seeking to generate their keys on-card and save a
backup copy off-card. For more security you should probably recompile
gpg yourself (it doesn't take that long). One could also disable network
connections (Knoppix sets them up automatically) and use encrypted swap
file (especially if swap is mounted on a hdd).
More information about the Gnupg-users