KeepassXC didn't detect Nitrokey 3 for Challange response

Support Software & Applications
1

Hi,
I have a very strange behavior with my Nitrokey and KeePassXC where I need help.
Since KeePassXC 2.7.6 the Nitrokey is supported.

KeePassXC_before_logon
KeePassXC_before_logon741×383 29.4 KB

KeePassXC only detects the Nitrokey if is is plugged in before KeePassXC starts.
I can also unplug the stick and plug it back in, KeePass finds it again (sometimes only after the second search).

The pcsc_scan command always finds the Nitrokey, even if it was inserted after logging in.

V 1.6.2 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00
 
Wed Oct 18 12:27:10 2023
 Reader 0: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00
  Event number: 0
  Card state: Card inserted, Shared Mode, 
  ATR: 3B 8F 01 80 5D 4E 69 74 72 6F 6B 65 79 00 00 00 00 00 6A

ATR: 3B 8F 01 80 5D 4E 69 74 72 6F 6B 65 79 00 00 00 00 00 6A
+ TS = 3B --> Direct Convention
+ T0 = 8F, Y(1): 1000, K: 15 (historical bytes)
  TD(1) = 01 --> Y(i+1) = 0000, Protocol T = 1 
-----
+ Historical bytes: 80 5D 4E 69 74 72 6F 6B 65 79 00 00 00 00 00
  Category indicator byte: 80 (compact TLV data object)
    Tag: 5, len: D (card issuer's data)
      Card issuer data: 4E 69 74 72 6F 6B 65 79 00 00 00 00 00
+ TCK = 6A (correct checksum)

Possibly identified card (using /home/pierre/.cache/smartcard_list.txt):
3B 8F 01 80 5D 4E 69 74 72 6F 6B 65 79 00 00 00 00 00 6A
        Nitrokey Nitrokey 3 Mini (eID)
        https://shop.nitrokey.com/shop/product/nk3am-nitrokey-3a-mini-149

The command journalctl -b -f -u pcscd get following output:

Okt 18 12:25:19 my-pc systemd[1]: Started PC/SC Smart Card Daemon.
Okt 18 12:25:19 my-pc (pcscd)[2940]: pcscd.service: Referenced but unset environment variable evaluates to an empty string: PCSCD_ARGS
Okt 18 12:53:26 my-pc pcscd[2940]: 00000000 ccid_usb.c:899:WriteUSB() write failed (3/9): LIBUSB_ERROR_PIPE
Okt 18 12:53:26 my-pc pcscd[2940]: 00000056 ifdwrapper.c:364:IFDStatusICC() Card not transacted: 612
Okt 18 12:53:26 my-pc pcscd[2940]: 00000005 eventhandler.c:336:EHStatusHandlerThread() Error communicating to: Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00

I would like to test pcsc instead of ccid driver. As I see it, ccid is used.
As described in the Arch wiki, I have created the file ~/.gnupg/scdaemon.conf. With and without the configuration file I have the same behavior.

What do I do wrong?

2

I think this is how it should be for the device to be detected. Otherwise, I imagine wou would need to plug it in prior to KeepassXC starting. If you are starting KeepassXC at login, perhaps you could delay starting it until the Nitrokey has had sufficient time to be detected by the system. Possibly, adding a sleep period to the startup script, or the .desktop file, might achieve this.

sleep 30

… as an example.

3

I am currently still using KeePassXC with a Yubikey that I want to replace. I can plug the Yubikey into the computer at any time and it is recognized by KeePassXC. For the Nitrokey it must work as well.

4

I have nothing else to suggest. Good luck.