Package: scdaemon
Version: 2.4.8-3
Severity: normal

Hi,

I recently moved my smartcard setup from a custom OpenPGP smartcard
(using SmartPGP applet [1]) to a Yubikey 5. Like a lot of people using that
kind of setup, I have issues here and there when using the other
features of the Yubikey (FIDO for hardware-backed ssh keys or 2FA),
where gnupg/scdaemon can't access the card.

Following the great blog posts [2,3,4] by Ludovic I added `pcsc-shared`
to my .scdaemon.conf (`disable-ccid` was already there). Now I don't
have issues with the sharing, but I then discovered that everytime I
need to use a key (whether for SSH using my authentication key, or for
my password manager using the encryption key) I need to provide the PIN.

Indeed, scdaemon won't cache the PIN in shared mode [5]. I can
understand the rationale but it makes it really painful to use the keys.

Some things puzzle me though:

- I had the impression that the PIN was cached by the smartcard itself,
  not by scdaemon (inside gpg-agent), but the source code seems to imply
  the opposite.
- there is a discrepancy (I think) between the various levels of
  abstraction: pcscd will allow access to all the smartcard features,
  but only scdaemon will talk to the OpenPGP application

In my opinion, if caching is not done anymore in pcsc_shared mode, it
would be helpful then to implement the card-timeout or similar features
in exclusive mode. This way the PIN cache would be useful during a
specific duration but not prevent working with other features all the
time.

Regards,

Another option would be to use the PC/SC transactions models as highlighted at
the end of
https://blog.apdu.fr/posts/2024/12/gnupg-and-pcsc-conflicts-episode-3/

Regards,