Ludovic Rousseau's blog (Posts about macOS bug)

In case of smart card issues on macOS

Ludovic Rousseau — Wed, 18 Jun 2025 11:34:25 GMT

If you have a problem with your smart card or smart card reader on macOS, the first step is to disable the CCID provided by Apple and enable my CCID driver.

Enable a good CCID driver

It is very simple. Just do, in a Terminal:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

If the problem is solved then there is no need to report it to me.

You will find more information in Apple's own CCID driver in Sonoma.

Update of my CCID driver

In macOS Sonoma 14.0 Apple provided version 1.5.1 of my CCID driver (macOS Sonoma and smart cards status) whereas the current version was 1.5.2.

In macOS Sequoia 15.0 my CCID driver was still version 1.5.1 whereas the current version was 1.6.1 (macOS Sequoia and smart cards status).

If you want/need a version of my CCID driver newer than 1.5.1, or a custom installer for macOS, you can contact me.

Conclusion

An issue was reported recently (MacOS NFC reader issue for large APDUs) and activating my CCID driver solved the problem.

First step is to use a good CCID driver.

macOS Sonoma bug: SCardControl() (part 2)

Ludovic Rousseau — Sun, 04 Feb 2024 20:58:16 GMT

In macOS Sonoma bug: SCardControl() returns SCARD_E_NOT_TRANSACTED I presented the problems with SCardControl() on macOS Sonoma. Then in Apple's own CCID driver in Sonoma we saw that macOS Sonoma provides two CCID drivers: one from Apple and one from me.

In Sonoma version 14.3 the situation evolved. The bug described in macOS Sonoma bug: SCardControl() returns SCARD_E_NOT_TRANSACTED is mostly fixed.

Switch CCID driver

It is easy to switch between Apple CCID driver and my CCID driver.

To enable my CCID driver you do:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

To enable Apple CCID driver you do:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool no

SCardControl

For my tests I used the sampe code scardcontrol included in my driver source code.

My CCID driver

$ ./scardcontrol
SCardControl sample code
V 1.4 © 2004-2010, Ludovic Rousseau [ludovic.rousseau@free.fr](mailto:ludovic.rousseau@free.fr)

THIS PROGRAM IS NOT DESIGNED AS A TESTING TOOL!
Do NOT use it unless you really know what you do.

SCardListReaders: OK
Available readers (use command line argument to select)
0: Gemalto Ezio Shield

Using reader: Gemalto Ezio Shield
Protocol: 1
SCardConnect: OK
SCardControl: OK
TLV (24): 06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 12 04 42 33 00 12
SCardControl(CM_IOCTL_GET_FEATURE_REQUEST): OK
Reader supports: FEATURE_VERIFY_PIN_DIRECT
Reader supports: FEATURE_MODIFY_PIN_DIRECT
Reader supports: FEATURE_IFD_PIN_PROPERTIES
Reader supports: FEATURE_GET_TLV_PROPERTIES

SCardControl(GET_TLV_PROPERTIES): OK
GET_TLV_PROPERTIES (59): 01 02 11 04 04 02 11 00 05 02 04 00 03 01 00 08 10 47 65 6D 43 78 30 30 2D 56 37 2E 30 34 2E 30 35 06 01 04 07 01 10 02 01 02 09 01 00 0B 02 E6 08 0C 02 C0 34 0A 04 00 00 00 00

Display all the properties:
wLcdLayout: 0x0411
Display with 4 lines of 17 columns
wLcdMaxCharacters: 0x0011
wLcdMaxLines: 0x0004
bTimeOut2: 0x00
sFirmwareID: GemCx00-V7.04.05
bMinPINSize: 0x04
bMaxPINSize: 0x10
bEntryValidationCondition: 0x02
Validation key pressed (2)
bPPDUSupport: 0x00
wIdVendor: 0x8E6
wIdProduct: 0x34C0
dwMaxAPDUDataSize: 0

Find a specific property:
wIdVendor: 0x08E6
wIdProduct: 0x34C0
PIN min size defined: 4
PIN max size defined: 16
Entry Validation Condition defined: 2

SCardControl(pin_properties_ioctl): OK
PIN PROPERTIES (4): 11 04 02 00
wLcdLayout: 0x0411
Display with 4 lines of 17 columns
bEntryValidationCondition: 2
Validation key pressed (2)
bTimeOut2: 0

Reader: Gemalto Ezio Shield (length 20 bytes)
State: 0x0054
Prot: 1
ATR (length 18 bytes): 3B 6E 00 00 80 31 80 65 B0 03 02 01 5E 83 00 00 90 00
SCardStatus: OK
Protocol: 1
SCardReconnect: OK
Select applet: 00 A4 04 00 06 A0 00 00 00 18 FF
SCardTransmit: OK
card response: 90 00

Secure verify PIN
command: 00 00 82 08 00 10 04 02 01 09 04 00 00 00 00 0D 00 00 00 00 20 00 00 08 30 30 30 30 00 00 00 00
Enter your PIN:
SCardControl: OK
card response [2 bytes]: 90 00: Success

verify PIN dump: 00 40 00 00 FF
SCardTransmit: OK
card response: 00 20 00 00 08 31 32 33 34 35 36 37 38 90 00

SCardDisconnect: OK

Apple driver

$ ./scardcontrol
SCardControl sample code
V 1.4 © 2004-2010, Ludovic Rousseau [ludovic.rousseau@free.fr](mailto:ludovic.rousseau@free.fr)

THIS PROGRAM IS NOT DESIGNED AS A TESTING TOOL!
Do NOT use it unless you really know what you do.

SCardListReaders: OK
Available readers (use command line argument to select)
0: Gemalto Ezio Shield Pro SC

Using reader: Gemalto Ezio Shield Pro SC
Protocol: 1
SCardConnect: OK
SCardControl: OK
TLV (30): 12 04 42 33 00 12 06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 13 04 42 00 00 01
SCardControl(CM_IOCTL_GET_FEATURE_REQUEST): OK
Reader supports: FEATURE_GET_TLV_PROPERTIES
Reader supports: FEATURE_VERIFY_PIN_DIRECT
Reader supports: FEATURE_MODIFY_PIN_DIRECT
Reader supports: FEATURE_IFD_PIN_PROPERTIES
Reader supports: FEATURE_CCID_ESC_COMMAND

SCardControl(GET_TLV_PROPERTIES): OK
GET_TLV_PROPERTIES (34): 01 02 11 04 03 01 00 09 01 01 0B 02 E6 08 0C 02 C0 34 0A 04 05 01 00 00 08 00 04 02 11 00 05 02 04 00

Display all the properties:
wLcdLayout: 0x0411
Display with 4 lines of 17 columns
bTimeOut2: 0x00
bPPDUSupport: 0x01
PPDU is supported over SCardControl using FEATURE_CCID_ESC_COMMAND
wIdVendor: 0x8E6
wIdProduct: 0x34C0
dwMaxAPDUDataSize: 261
sFirmwareID:
wLcdMaxCharacters: 0x0011
wLcdMaxLines: 0x0004

Find a specific property:
wIdVendor: 0x08E6
wIdProduct: 0x34C0

SCardControl(pin_properties_ioctl): OK
PIN PROPERTIES (4): 11 04 07 00
wLcdLayout: 0x0411
Display with 4 lines of 17 columns
bEntryValidationCondition: 7
Max size reached (1)
Validation key pressed (2)
Timeout occurred (4)
bTimeOut2: 0

Reader: Gemalto Ezio Shield Pro SC (length 27 bytes)
State: 0x0054
Prot: 1
ATR (length 18 bytes): 3B 6E 00 00 80 31 80 65 B0 03 02 01 5E 83 00 00 90 00
SCardStatus: OK
Protocol: 1
SCardReconnect: OK
Select applet: 00 A4 04 00 06 A0 00 00 00 18 FF
SCardTransmit: OK
card response: 90 00

Secure verify PIN
command: 00 00 82 08 00 08 04 07 01 09 04 00 00 00 00 0D 00 00 00 00 20 00 00 08 30 30 30 30 00 00 00 00
Enter your PIN:
SCardControl: OK
card response [0 bytes]::

verify PIN dump: 00 40 00 00 FF
SCardTransmit: OK
card response: 00 20 00 00 08 31 32 33 34 35 36 37 38 90 00

SCardDisconnect: OK

Diff

Here is the diff between the two outputs above:

--- libccid_pinpad      2024-02-04 15:02:41.673189176 +0100
+++ apple_pinpad        2024-02-04 15:02:18.149970763 +0100
@@ -7,54 +7,51 @@ Do NOT use it unless you really know wha

 SCardListReaders: OK
 Available readers (use command line argument to select)
-0: Gemalto Ezio Shield
+0: Gemalto Ezio Shield Pro SC

-Using reader: Gemalto Ezio Shield
+Using reader: Gemalto Ezio Shield Pro SC
  Protocol: 1
 SCardConnect: OK
 SCardControl: OK
- TLV (24): 06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 12 04 42 33 00 12
+ TLV (30): 12 04 42 33 00 12 06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 13 04 42 00 00 01
 SCardControl(CM_IOCTL_GET_FEATURE_REQUEST): OK
+Reader supports: FEATURE_GET_TLV_PROPERTIES
 Reader supports: FEATURE_VERIFY_PIN_DIRECT
 Reader supports: FEATURE_MODIFY_PIN_DIRECT
 Reader supports: FEATURE_IFD_PIN_PROPERTIES
-Reader supports: FEATURE_GET_TLV_PROPERTIES
+Reader supports: FEATURE_CCID_ESC_COMMAND

 SCardControl(GET_TLV_PROPERTIES): OK
-GET_TLV_PROPERTIES (59): 01 02 11 04 04 02 11 00 05 02 04 00 03 01 00 08 10 47 65 6D 43 78 30 30 2D 56 37 2E 30 34 2E 30 35 06 01 04 07 01 10 02 01 02 09 01 00 0B 02 E6 08 0C 02 C0 34 0A 04 00 00 00 00
+GET_TLV_PROPERTIES (34): 01 02 11 04 03 01 00 09 01 01 0B 02 E6 08 0C 02 C0 34 0A 04 05 01 00 00 08 00 04 02 11 00 05 02 04 00

 Display all the properties:
  wLcdLayout: 0x0411
   Display with 4 lines of 17 columns
- wLcdMaxCharacters: 0x0011
- wLcdMaxLines: 0x0004
  bTimeOut2: 0x00
- sFirmwareID: GemCx00-V7.04.05
- bMinPINSize: 0x04
- bMaxPINSize: 0x10
- bEntryValidationCondition: 0x02
-  Validation key pressed (2)
- bPPDUSupport: 0x00
+ bPPDUSupport: 0x01
+  PPDU is supported over SCardControl using FEATURE_CCID_ESC_COMMAND
  wIdVendor: 0x8E6
  wIdProduct: 0x34C0
- dwMaxAPDUDataSize: 0
+ dwMaxAPDUDataSize: 261
+ sFirmwareID:
+ wLcdMaxCharacters: 0x0011
+ wLcdMaxLines: 0x0004

 Find a specific property:
  wIdVendor: 0x08E6
  wIdProduct: 0x34C0
- PIN min size defined: 4
- PIN max size defined: 16
- Entry Validation Condition defined: 2

 SCardControl(pin_properties_ioctl): OK
-PIN PROPERTIES (4): 11 04 02 00
+PIN PROPERTIES (4): 11 04 07 00
  wLcdLayout: 0x0411
   Display with 4 lines of 17 columns
- bEntryValidationCondition: 2
+ bEntryValidationCondition: 7
+  Max size reached (1)
   Validation key pressed (2)
+  Timeout occurred (4)
  bTimeOut2: 0

- Reader: Gemalto Ezio Shield (length 20 bytes)
+ Reader: Gemalto Ezio Shield Pro SC (length 27 bytes)
  State: 0x0054
  Prot: 1
  ATR (length 18 bytes): 3B 6E 00 00 80 31 80 65 B0 03 02 01 5E 83 00 00 90 00
@@ -66,10 +63,10 @@ SCardTransmit: OK
  card response: 90 00

  Secure verify PIN
- command: 00 00 82 08 00 10 04 02 01 09 04 00 00 00 00 0D 00 00 00 00 20 00 00 08 30 30 30 30 00 00 00 00
+ command: 00 00 82 08 00 08 04 07 01 09 04 00 00 00 00 0D 00 00 00 00 20 00 00 08 30 30 30 30 00 00 00 00
 Enter your PIN:
 SCardControl: OK
- card response [2 bytes]: 90 00: Success
+ card response [0 bytes]::

 verify PIN dump: 00 40 00 00 FF
---

Some differences to note:

FEATURE_CCID_ESC_COMMAND

Apple driver reports it supports FEATURE_CCID_ESC_COMMAND.

According to Interoperability Specification for ICCs and Personal Computer Systems, Part 10 IFDs with Secure PIN Entry Capabilities page 27:

2.6.15 FEATURE_CCID_ESC_COMMAND

This feature can be used to retrieve the control code to send a CCID escape command (PC_to_RDR_Escape see [4]) to the reader.

The input parameter for this feature is a pointer to the abData field (see [4]) containing the specific escape command.

The output parameter is a pointer to a buffer that will contain the reader response. Note that a CCID escape command is specific to a given reader, so before issuing this command, the application has to make sure it addresses the appropriate reader.

With my driver, for security reasons, this feature is active only if enabled in the Info.plist file for ifdDriverOptions option.

bPPDUSupport

Apple driver reports bPPDUSupport: 0x01.

According to Interoperability Specification for ICCs and Personal Computer Systems, Part 10 IFDs with Secure PIN Entry Capabilities page 25:

bPPDUSupport.

Bit0: If set to 1, PPDU is supported over SCardControl using FEATURE_CCID_ESC_COMMAND

Bit1: If set to 1, PPDU is supported over SCardTransmit

My driver does not support PPDU (Pseudo APDU) because SCardControl() works fine so not need of PPDUs.

dwMaxAPDUDataSize

Apple driver reports: dwMaxAPDUDataSize: 261.

According to Interoperability Specification for ICCs and Personal Computer Systems, Part 10 IFDs with Secure PIN Entry Capabilities page 26:

dwMaxAPDUDataSize

Maximal size of data the reader and its driver can support

0: short APDU only.

0<X<=256: forbidden values (RFU)

256 < X <= 0x10000: short and extended APDU of up to X bytes of data

0x10000 < X: invalid values (RFU)

261 is a very strange value. Even more strange if you know that this reader supports short APDU only. The correct value (as correctly reported by my driver) is 0 for this reader.

sFirmwareID

Apple driver reports: sFirmwareID:.

The firmware string is empty. This is not suprising since a proprietary command is used to get the firmware release string from a Gemalto reader.

My driver reports: sFirmwareID: GemCx00-V7.04.05.

Maybe the Apple driver should not report any sFirmwareID if no data is provided.

bEntryValidationCondition

Apple driver reports: bEntryValidationCondition: 7.

7 (00000111b in binary) should be the default value. But this specific reader does only supports "Validation key pressed" but not "Max size reached" or "Timeout occurred" as wrongly indicated by the Apple driver.

My driver reports the correct value bEntryValidationCondition: 2.

PIN min/max size defined

Apple driver does NOT report PIN min and max sizes.

This can be problematic if the application does not know what values to use with a specific reader. Not all readers support the same min and max values.

Secure Verify PIN comand

The most problematic issue is that the Secure Verify PIN command (FEATURE_VERIFY_PIN_DIRECT) using the Apple driver returns:

Secure verify PIN
command: 00 00 82 08 00 08 04 07 01 09 04 00 00 00 00 0D 00 00 00 00 20 00 00 08 30 30 30 30 00 00 00 00
Enter your PIN:
SCardControl: OK
card response [0 bytes]::

The SCardControl() returns SCARD_S_SUCCESS (i.e. no error) but the PIN is not asked by the pinpad reader, and of course not submitted and verified by the card.

This command just silently fails. A pinpad reader can't be used with the Apple CCID driver.

Conclusion

You may have problems if you use the Apple driver with the SCardControl() function.

My advice is to enable my CCID driver and not use the Apple driver. It is very easy to do since both drivers are provided with macOS Sonoma (see Switch CCID driver from above).

Apple's own CCID driver in Sonoma

Ludovic Rousseau — Mon, 13 Nov 2023 09:37:17 GMT

OS X has built-in support for USB CCID class-compliant SmartCard readers

From SmartCardServices(7) manpage in macOS Sonoma:

USB SMART CARD READER DRIVERS
OS X has built-in support for USB CCID class-compliant SmartCard readers. For other readers, install the reader driver in /usr/local/libexec/SmartCardServices/drivers. Each driver is a bundle. The bundle contains an XML file Info.plist which contains the device's USB vendor ID and product ID. For detailed description of the plist format and how to write a reader driver, see http://pcsclite.alioth.debian.org/api/group__IFDHandler.html

The built-in SmarCard reader driver is prefered by the System and it is possible to change the preference to the IFD CCID by setting the global preference:
sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

Check status

it is easy to check which CCID driver is enabled on macOS Sonoma.

Built-in (Apple) driver enabled

% defaults read /Library/Preferences/com.apple.security.smartcard.plist useIFDCCID
2023-09-29 13:38:28.133 defaults[1145:25704]
The domain/default pair of (/Library/Preferences/com.apple.security.smartcard.plist, useIFDCCID) does not exist

IFD CCID (my driver) enabled

% defaults read /Library/Preferences/com.apple.security.smartcard.plist useIFDCCID
1

The result is 1 so the "external" (non-Apple) CCID driver is enabled.

To dump the complete configuration of com.apple.security.smartcard do:

% defaults read /Library/Preferences/com.apple.security.smartcard.plist
{
    CardsNeedsBaseFiDi =     (
        3B6E000080318065B00302015E8300009000,
        3BD518008131FE7D8073C82110F4
    );
    Logging = 0;
    useIFDCCID = 1;
}

Logs

You can use my script log_macOS_ifdbundle.sh to have some logs when you connect a reader:

% ./log_macOS_ifdbundle.sh -d
2023-09-28 14:49:11.678646+0200 0x22aa     Debug       0x0                  858    0    com.apple.ifdreader: [com.apple.CryptoTokenKit:smartcard] deviceRemovalHandler invoked (entryId=4294970735)
2023-09-28 14:49:11.678780+0200 0x22aa     Debug       0x0                  858    0    com.apple.ifdreader: [com.apple.CryptoTokenKit:smartcard] installed device removal notification
2023-09-28 14:49:11.680320+0200 0x22aa     Debug       0x0                  858    0    com.apple.ifdreader: (CoreFoundation) [com.apple.defaults:User Defaults] found no value for key useIFDCCID in CFPrefsPlistSource<0x14a906640> (Domain: com.apple.security.smartcard, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null), Contents Need Refresh: No)
2023-09-28 14:49:11.681744+0200 0x22aa     Info        0x0                  858    0    com.apple.ifdreader: [com.apple.CryptoTokenKit:smartcard] new device skipped: 0x0529/0x0620 100000 (entryId=4294970735)

The com.apple.ifdreader component is looking for the useIFDCCID key. Here the key is not found so the Apple driver will be used.

Enable my CCID driver

So it is possible to switch from the Apple driver to my CCID driver (also included in macOS Sonoma) using the command:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

Apple driver

The Apple own CCID driver is /System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd.

It contains typical CCID names:

% strings /System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd/Contents/MacOS/usbsmartcardreaderd | grep PC_
PC_to_RDR_IccPowerOn
PC_to_RDR_IccPowerOff
PC_to_RDR_GetSlotStatus
PC_to_RDR_XfrBlock
PC_to_RDR_GetParameters
PC_to_RDR_ResetParameters
PC_to_RDR_SetParameters
PC_to_RDR_Escape
PC_to_RDR_IccClock
PC_to_RDR_T0APDU
PC_to_RDR_Secure
PC_to_RDR_Mechanical
PC_to_RDR_Abort
PC_to_RDR_SetDataRateAndClockFrequency
RDR_to_PC_DataBlock
RDR_to_PC_SlotStatus
RDR_to_PC_Parameters
RDR_to_PC_Escape
RDR_to_PC_DataRateAndClockFrequency
RDR_to_PC_NotifySlotChange
RDR_to_PC_HardwareError

These names are the command names used in the USB CCID specification.

I note that this file was already present in the previous macOS version: Ventura. But this driver was not enabled by default.

I guess Apple now decided its own CCID driver was mature enough to enable it by default.

Source code?

I don't think Apple will publish the source code of its CCID driver. At least I was not able to find it at Open Source at Apple for the version of macOS Sonoma 14.0 or 14.1.

Apple already replaced pcsc-lite by their own version of the resource manager in macOS Yosemite in 2014 (OS X Yosemite and smart cards status). They now replace the Free Software CCID driver by their own version.

History

Since the source code is not public it will be difficult to know what are the changes in the Apple CCID driver.

In Sonoma 14.0 we had:

$ codesign --verbose=3 --verify --display /System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd
Executable=/System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd/Contents/MacOS/usbsmartcardreaderd
Identifier=com.apple.usbsmartcardreaderd
Format=bundle with Mach-O universal (x86_64 arm64e)
CodeDirectory v=20400 size=2102 flags=0x0(none) hashes=55+7 location=embedded
Platform identifier=15
Hash type=sha256 size=32
CandidateCDHash sha256=555a981af8457fcb972e0301c087361e410a52ef
CandidateCDHashFull sha256=555a981af8457fcb972e0301c087361e410a52ef76c7cea851f838ecb7393f62
Hash choices=sha256
CMSDigest=555a981af8457fcb972e0301c087361e410a52ef76c7cea851f838ecb7393f62
CMSDigestType=2
CDHash=555a981af8457fcb972e0301c087361e410a52ef
Signature size=4442
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Signed Time=15 Sep 2023 at 23:49:40
Info.plist entries=20
TeamIdentifier=not set
Sealed Resources version=2 rules=2 files=0
Internal requirements count=1 size=80

In Sonoma 14.1 we now have:

$ codesign --verbose=3 --verify --display /System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd
Executable=/System/Library/CryptoTokenKit/usbsmartcardreaderd.slotd/Contents/MacOS/usbsmartcardreaderd
Identifier=com.apple.usbsmartcardreaderd
Format=bundle with Mach-O universal (x86_64 arm64e)
CodeDirectory v=20400 size=2102 flags=0x0(none) hashes=55+7 location=embedded
Platform identifier=15
Hash type=sha256 size=32
CandidateCDHash sha256=b1723b968b6f316aca6172bea0ee75cc4c9de56a
CandidateCDHashFull sha256=b1723b968b6f316aca6172bea0ee75cc4c9de56a962ab2d8bc00659d000f860d
Hash choices=sha256
CMSDigest=b1723b968b6f316aca6172bea0ee75cc4c9de56a962ab2d8bc00659d000f860d
CMSDigestType=2
CDHash=b1723b968b6f316aca6172bea0ee75cc4c9de56a
Signature size=4442
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Signed Time=6 Oct 2023 at 05:45:18
Info.plist entries=20
TeamIdentifier=not set
Sealed Resources version=2 rules=2 files=0
Internal requirements count=1 size=80

The signature date changed from "15 Sep 2023" to "6 Oct 2023" and the SHA256 hash also changed.

I do not plan to reverse engineer the Apple driver.

My comments

Class driver

The Apple driver is a class driver. Any USB device declared with bInterfaceClass set to 0x0b (Smart Card) should work.

Tweaks

My CCID driver is now old (The first commit was in August 2003. My CCID driver: 20 years anniversary). And I added a lot of special patches to support specific readers.

If you have such a reader the Apple driver may not work for you. In that case you can install a custom driver, or enable my CCID driver 1.5.1 included in macOS Sonoma as seen above in Enable my CCID driver.

Can Apple reuse my tweaks to improve their driver?

The source code of my driver is available so Apple developers can read it.

My driver is protected by the GNU Lesser General Public License version 2.1+ (LGPL). So if Apple wants to reuse some of my code it has to use the same LGPL license for its code. My guess is that Apple worked on its own CCID driver in particular to avoid any use of a GPL or LGPL protected code in macOS.

So Apple will have to design its own tweaks, or do not support some readers.

Bugs reported in Sonoma

The bug macOS Sonoma bug: SCardControl() returns SCARD_E_NOT_TRANSACTED is now easy to understand.

The Apple driver does NOT support SCardControl(). And since it was enabled by default in Sonoma 14.0 all the applications that use SCardControl() failed to work.

What happened in Sonoma 14.1?

I started this article using Sonoma 14.0, the initial release of Sonoma. Apple now provides a first update of Sonoma with a version 14.1.

In this version the Apple CCID driver is no more enabled by default and my CCID driver is enabled instead.

$ defaults read /Library/Preferences/com.apple.security.smartcard.plist
{
    Logging = 0;
    useIFDCCID = 1;
}

I guess Apple received (too) many bug reports and decided to revert the change and keep using my CCID driver for now.

If your smart card application fails to work with Sonoma 14.0 the best thing to do is to upgrade to Sonoma 14.1.

Conclusion

Writing a CCID driver is not an easy task. It is even more complex if you want to support a many different models.

Apple tries to do that but is not ready yet.

macOS Sonoma: The reader name should include the USB serial number

Ludovic Rousseau — Sun, 15 Oct 2023 12:12:30 GMT

This is part of the series: macOS Sonoma and smart cards: known bugs.

If you have two identical smart card readers connected then it is hard to differentiate the readers.

Example

For example I have 2 Gemalto ID Bridge CT 30 readers.

I will use the tool pcsc_scan from pcsc-tools as this application works fine and is available for the 3 major plateforms.

On macOS Sonoma, I connect one reader and the PC/SC name is Gemalto USB SmartCard Reader. I connect the second reader and the PC/SC name is Gemalto USB SmartCard Reader 01.

The only difference is the 01 appended to the second reader name.

rousseau@MacBook-Pro-de-Ludovic pcsc-tools-1.7.0 % ./pcsc_scan
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Plug'n play reader name not supported. Using polling every 3600000 ms.
Scanning present readers...
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto USB SmartCard Reader

Fri Oct 13 15:55:38 2023
 Reader 0: Gemalto USB SmartCard Reader
  Event number: 0
  Card state: Card removed,
 Scanning present readers...
0: Gemalto USB SmartCard Reader 01
1: Gemalto USB SmartCard Reader

Fri Oct 13 15:55:44 2023
 Reader 0: Gemalto USB SmartCard Reader 01
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto USB SmartCard Reader
  Event number: 0
  Card state: Card removed,

Screenshot (with nice colors):

The reader (re)ordering is also visible if you insert a smart card in the first reader. You have:

rousseau@MacBook-Pro-de-Ludovic pcsc-tools-1.7.0 % ./pcsc_scan
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Plug'n play reader name not supported. Using polling every 3600000 ms.
Scanning present readers...
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto USB SmartCard Reader

Fri Oct 13 15:58:55 2023
 Reader 0: Gemalto USB SmartCard Reader
  Event number: 0
  Card state: Card inserted,
  ATR: 3B 6F 00 00 80 5A 28 13 02 10 12 2B 75 0D D3 82 82 90 00
 Scanning present readers...
0: Gemalto USB SmartCard Reader 01
1: Gemalto USB SmartCard Reader

Fri Oct 13 15:58:58 2023
 Reader 0: Gemalto USB SmartCard Reader 01
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto USB SmartCard Reader
  Event number: 0
  Card state: Card inserted,
  ATR: 3B 6F 00 00 80 5A 28 13 02 10 12 2B 75 0D D3 82 82 90 00
rousseau@MacBook-Pro-de-Ludovic pcsc-tools-1.7.0 %

The smart card is inserted in the reader connected first. But after the second reader is connected the reader with the smart card inserted becomes the second reader in the list. This should not be problematic for applications but it is a bit surprising.

Windows

On Windows I get results very similar to macOS.

PS C:\Users\Ludovic\Downloads> .\pcsc_scan.exe
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Press shift key to quit
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto USB Smart Card Reader 0

Sat Oct 14 10:59:42 2023
 Reader 0: Gemalto USB Smart Card Reader 0
  Event number: 0
  Card state: Card removed,
 Reader 1: \\?PnP?\Notification
  Event number: 1
  Card state:
 Scanning present readers...
0: Gemalto USB Smart Card Reader 0
1: Gemalto USB Smart Card Reader 1

Sat Oct 14 10:59:44 2023
 Reader 0: Gemalto USB Smart Card Reader 0
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto USB Smart Card Reader 1
  Event number: 0
  Card state: Card removed,
 Reader 2: \\?PnP?\Notification
  Event number: 2
  Card state:
PS C:\Users\Ludovic\Downloads>

The first reader name is Gemalto USB Smart Card Reader 0. The second reader name is Gemalto USB Smart Card Reader 1.

Screenshot:

GNU/Linux

On GNU/Linux I get:

[rousseau:~/Documents/sc/pcsc-tools] master* 2s ± ./pcsc_scan
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto PC Twin Reader (F8345B4A) 00 00

Fri Oct 13 11:46:11 2023
 Reader 0: Gemalto PC Twin Reader (F8345B4A) 00 00
  Event number: 0
  Card state: Card removed,
 Scanning present readers...
0: Gemalto PC Twin Reader (F8345B4A) 00 00
1: Gemalto PC Twin Reader (70D7E2EE) 01 00

Fri Oct 13 11:46:15 2023
 Reader 0: Gemalto PC Twin Reader (F8345B4A) 00 00
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto PC Twin Reader (70D7E2EE) 01 00
  Event number: 0
  Card state: Card removed,

Here the PC/SC reader name includes an hexadecimal number (F8345B4A or 70D7E2EE). This number is the USB device serial number.

Screenshot:

So even if you change the order to connect the readers you will always have one reader name containing F8345B4A and the other reader name containing 70D7E2EE. You have a link between a physical reader and a PC/SC reader name.

USB serial number

The USB serial number is visible on macOS using the system_profiler command.

rousseau@MacBook-Pro-de-Ludovic ~ % system_profiler SPUSBDataType
USB:

        USB 3.1 Bus:

          Host Controller Driver: AppleT8103USBXHCI

                USB SmartCard Reader:

                  Product ID: 0x3437
                  Vendor ID: 0x08e6  (Gemalto SA)
                  Version: 2.01
                  Serial Number: F8345B4A
                  Speed: Up to 12 Mb/s
                  Manufacturer: Gemalto
                  Location ID: 0x00100000 / 1
                  Current Available (mA): 500
                  Current Required (mA): 50
                  Extra Operating Current (mA): 0

        USB 3.1 Bus:

          Host Controller Driver: AppleT8103USBXHCI

                USB SmartCard Reader:

                  Product ID: 0x3437
                  Vendor ID: 0x08e6  (Gemalto SA)
                  Version: 2.00
                  Serial Number: 70D7E2EE
                  Speed: Up to 12 Mb/s
                  Manufacturer: Gemalto
                  Location ID: 0x01100000 / 1
                  Current Available (mA): 500
                  Current Required (mA): 50
                  Extra Operating Current (mA): 0

Not all USB devices have a serial number.

For example with an older model of the same reader I have:

rousseau@MacBook-Pro-de-Ludovic ~ % system_profiler SPUSBDataType
USB:

        USB 3.1 Bus:

          Host Controller Driver: AppleT8103USBXHCI

                USB SmartCard Reader:

                  Product ID: 0x3437
                  Vendor ID: 0x08e6  (Gemalto SA)
                  Version: 1.00
                  Speed: Up to 12 Mb/s
                  Manufacturer: Gemplus
                  Location ID: 0x00100000 / 1
                  Current Available (mA): 500
                  Current Required (mA): 200
                  Extra Operating Current (mA): 0

No "Serial Number:" field is displayed.

My proposal to add the USB serial number in the PC/SC name will not work with all the smart card readers. But at least it will be usable with the USB devices providing the serial number.

Conclusion

It is not a bug in macOS Sonoma. It is not a regression compared to the previous macOS version, or compared to Windows.

But it would be nice to be have a strong link between a physical smart card reader and the corresponding PC/SC reader name.

See also What is in a PC/SC reader name? to know how a PC/SC reader name is generated by pcsc-lite on GNU/Linux.

macOS Sonoma bug: The reader name should include the CCID interface name

Ludovic Rousseau — Wed, 11 Oct 2023 13:58:13 GMT

This is part of the series: macOS Sonoma and smart cards: known bugs.

If you have a composite smart card reader (one USB device with 2 or more CCID interfaces) it is impossible to identify which interface is which since the reader names are the same (except for a number).

Example

For example with a composite device Gemalto Prox DU with 2 CCID interfaces:

% ./pcsc_scan
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Plug'n play reader name not supported. Using polling every 3600000 ms.
Scanning present readers...
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto Prox Dual USB PC Link Reader
1: Gemalto Prox Dual USB PC Link Reader 01

The problem is that I do not know what interface is the contact reader, and what interface is the contactless reader.

The situation is even worse since the order in which the interfaces are detected/listed is not stable.

To test that I insert a card in the contact reader. I get:

Scanning present readers...
0: Gemalto Prox Dual USB PC Link Reader
1: Gemalto Prox Dual USB PC Link Reader 01

Wed Oct 11 14:02:08 2023
 Reader 0: Gemalto Prox Dual USB PC Link Reader
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto Prox Dual USB PC Link Reader 01
  Event number: 0
  Card state: Card inserted,
  ATR: 3B 6F 00 00 80 5A 28 13 02 10 12 2B 75 0D D3 82 82 90 00

The first reader (Reader 0) is the contactless interface, the second reader (Reader 1) is the contact interface since that is where the contact card is reported as inserted.

Then I disconnect the USB device and connect it again. This time I get:

Waiting for the first reader... found one
Scanning present readers...
0: Gemalto Prox Dual USB PC Link Reader
1: Gemalto Prox Dual USB PC Link Reader 01

Wed Oct 11 14:02:20 2023
 Reader 0: Gemalto Prox Dual USB PC Link Reader
  Event number: 0
  Card state: Card inserted,
  ATR: 3B 6F 00 00 80 5A 28 13 02 10 12 2B 75 0D D3 82 82 90 00
 Reader 1: Gemalto Prox Dual USB PC Link Reader 01
  Event number: 0
  Card state: Card removed,

Note that the 2 reader names are the same as before Gemalto Prox Dual USB PC Link Reader and Gemalto Prox Dual USB PC Link Reader 01 but this second time the contact card is reported in the first reader instead of the second reader.

The contact reader was named Gemalto Prox Dual USB PC Link Reader 01 but is now named Gemalto Prox Dual USB PC Link Reader.

It looks like the ordering between the 2 interfaces is random.

pcsc-lite

On a GNU/Linux system I get:

$ pcsc_scan
PC/SC device scanner
V 1.6.2 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: Gemalto Prox Dual USB PC Link Reader [Prox-DU Contactless_10500231] 00 00
1: Gemalto Prox Dual USB PC Link Reader [Prox-DU Contact_10500231] 01 00

Wed Oct  4 10:08:20 2023
 Reader 0: Gemalto Prox Dual USB PC Link Reader [Prox-DU Contactless_10500231] 00 00
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto Prox Dual USB PC Link Reader [Prox-DU Contact_10500231] 01 00
  Event number: 0
  Card state: Card removed,

The CCID interface name (here Prox-DU Contactless_10500231 and Prox-DU Contact_10500231) is included in the reader names.

See What is in a PC/SC reader name? for more details about the reader name construction in pcsc-lite.

Windows

On a Windows system I get:

PS C:\Users\Ludovic\Downloads> .\pcsc_scan.exe
PC/SC device scanner
V 1.7.0 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Press shift key to quit
Using reader plug'n play mechanism
Scanning present readers...
0: Gemalto Prox-DU Contact_10500231 0
1: Gemalto Prox-DU Contactless_10500231 0

Sun Oct 15 09:35:48 2023
 Reader 0: Gemalto Prox-DU Contact_10500231 0
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto Prox-DU Contactless_10500231 0
  Event number: 0
  Card state: Card removed,
 Reader 2: \\?PnP?\Notification
  Event number: 2
  Card state:

This is similar to what I have on GNU/Linux.

Workaround

None known.

macOS Sonoma bug: Race condition in SCardGetStatusChange()?

Ludovic Rousseau — Wed, 04 Oct 2023 15:09:37 GMT

This is part of the series: "macOS Sonoma and smart cards: known bugs".

I found a problem when using a composite reader i.e. a reader with 2 (or more) smart card reader interfaces.

The PC/SC layer reports a smart card is present when no smart card is inserted.

Details

For my tests I use the Gemalto Prox DU reader. This reader is a single USB device with 2 CCID interfaces: one contact and one contactless interface.

I run the command: echo 1 | pcsctest. The idea is to select the reader 1 just after it is found.

I get the output:

% echo 1 | pcsctest

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext    : Command successful.
Testing SCardGetStatusChange
Please insert a working reader   :

Then I connect a composite reader (2 CCID interfaces) with or without a card inserted and I get:

[...]
Please insert a working reader   : Command successful.
Testing SCardListReaders         : Command successful.
Reader 01: Gemalto Prox Dual USB PC Link Reader
Enter the reader number          : Waiting for card insertion
                                                                 : Command successful.
Testing SCardConnect             : No smart card inserted.

The command is waiting after displaying Please insert a working reader :.
Then I connect my smart card reader. The reader is found.
Pcsctest displays Waiting for card insertion : Command successful.
But then the SCardConnect fails with No smart card inserted.

I note that NO smart card was inserted in the reader. So the Waiting for card insertion reported as a success but that is an error.

I have the same result if a smart card is inserted in the reader.

If I run again the same command I get the expected result:

% echo 1 | pcsctest

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext    : Command successful.
Testing SCardGetStatusChange
Please insert a working reader   : Command successful.
Testing SCardListReaders         : Command successful.
Reader 01: Gemalto Prox Dual USB PC Link Reader
Reader 02: Gemalto Prox Dual USB PC Link Reader 01
Enter the reader number          : Waiting for card insertion
                                                                 : Command successful.
Testing SCardConnect             : Command successful.
Testing SCardStatus              : Command successful.
Current Reader Name              : Gemalto Prox Dual USB PC Link Reader
Current Reader State             : 0x54
Current Reader Protocol          : 0x1
Current Reader ATR Size          : 13 (0xd)
Current Reader ATR Value         : 3B 88 80 01 00 00 00 00 33 71 71 00 3A
Testing SCardDisconnect          : Command successful.
Testing SCardReleaseContext      : Command successful.
Testing SCardEstablishContext    : Command successful.
Testing SCardGetStatusChange
Please insert a working reader   : Command successful.
Testing SCardListReaders         : Command successful.
Reader 01: Gemalto Prox Dual USB PC Link Reader
Reader 02: Gemalto Prox Dual USB PC Link Reader 01
Enter the reader number          : %

I do NOT have the problem with a reader with only 1 smart card slot. It looks like the problem is only with multi-slots and composite readers. It looks like a race condition somewhere in the PC/SC layer (or in the CryptoTokenKit layer bellow PC/SC) of macOS Sonoma.

I do not have the problem if I connect 2 "simple" smart card readers on a USB hub and then connect the hub to the Mac.

pcsc_scan

I note I do not have this problem if I use pcsc_scan from pcsc-tools.

With no reader connected I get:

% ./pcsc_scan
PC/SC device scanner
V 1.6.2 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Plug'n play reader name not supported. Using polling every 3600000 ms.
Scanning present readers...
Waiting for the first reader...

Then I connect the dual interface reader and I get the expected value:

[...]
Waiting for the first reader... found one
Scanning present readers...
0: Gemalto Prox Dual USB PC Link Reader
1: Gemalto Prox Dual USB PC Link Reader 01

Wed Oct  4 09:47:47 2023
 Reader 0: Gemalto Prox Dual USB PC Link Reader
  Event number: 0
  Card state: Card removed,
 Reader 1: Gemalto Prox Dual USB PC Link Reader 01
  Event number: 0
  Card state: Card removed,

Both interfaces are listed.
No card is wrongly found inserted.

Know workaround

None.

Just wait a bit after you detect a new reader is connected.

macOS Sonoma bug: SCardControl() returns SCARD_E_NOT_TRANSACTED

Ludovic Rousseau — Sat, 30 Sep 2023 14:38:27 GMT

This is part of the series: "macOS Sonoma and smart cards: known bugs".

SCardControl() fails and returns SCARD_E_NOT_TRANSACTED (i.e. 0x80100016).

Sample code

If you use the sample code:

2023_09_macOS_Sonoma_bug_SCardControl.c (Source)

//
//  main.c
//  scardcontrol
//
//  Created by Ludovic Rousseau on 28/07/2023.
//

#include <stdio.h>
#include <stdlib.h>
#include <PCSC/winscard.h>
#include <PCSC/wintypes.h>

#define SCARD_CTL_CODE(code) (0x42000000 + (code))
#define CM_IOCTL_GET_FEATURE_REQUEST SCARD_CTL_CODE(3400)
#define PCSC_ERROR_EXIT(rv, text) \
if (rv != SCARD_S_SUCCESS) \
{ \
        printf(text ": %s (0x%8X)\n", pcsc_stringify_error(rv), rv); \
        goto end; \
} \
else \
        printf(text ": OK\n");

int main(int argc, const char * argv[]) {
        LONG rv;
        SCARDCONTEXT hContext;
        DWORD dwReaders;
        LPSTR mszReaders = NULL;
        SCARDHANDLE hCard;
        unsigned char bRecvBuffer[MAX_BUFFER_SIZE];
        DWORD length;
        DWORD dwActiveProtocol;

        rv = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &hContext);
        if (rv != SCARD_S_SUCCESS)
        {
                printf("SCardEstablishContext: Cannot Connect to Resource Manager %s\n", pcsc_stringify_error(rv));
                return 1;
        }

        /* Retrieve the available readers list */
        rv = SCardListReaders(hContext, NULL, NULL, &dwReaders);
        PCSC_ERROR_EXIT(rv, "SCardListReaders")

        mszReaders = malloc(sizeof(char)*dwReaders);
        if (mszReaders == NULL)
        {
                printf("malloc: not enough memory\n");
                goto end;
        }

        rv = SCardListReaders(hContext, NULL, mszReaders, &dwReaders);
        if (rv != SCARD_S_SUCCESS)
                printf("SCardListReader: %8X\n", rv);

        /* connect to a reader (even without a card) */
        dwActiveProtocol = -1;
        printf("Using reader: %s\n", mszReaders);
        rv = SCardConnect(hContext, mszReaders, SCARD_SHARE_DIRECT,
                SCARD_PROTOCOL_T0 | SCARD_PROTOCOL_T1, &hCard, &dwActiveProtocol);
        PCSC_ERROR_EXIT(rv, "SCardConnect")

        /* get features */
        rv = SCardControl(hCard, CM_IOCTL_GET_FEATURE_REQUEST, NULL, 0,
                bRecvBuffer, sizeof(bRecvBuffer), &length);
        PCSC_ERROR_EXIT(rv, "SCardControl")

        printf("Received buffer (%d bytes)\n", length);
        for (int i=0; i<length; i++)
                printf("%02X ", bRecvBuffer[i]);
        printf("\n");

        /* disconnect */
        rv = SCardDisconnect(hCard, SCARD_UNPOWER_CARD);
        PCSC_ERROR_EXIT(rv, "SCardDisconnect")

end:
        /* We try to leave things as clean as possible */
        rv = SCardReleaseContext(hContext);
        if (rv != SCARD_S_SUCCESS)
                printf("SCardReleaseContext: %s (0x%8X)\n", pcsc_stringify_error(rv),
                        rv);

        /* free allocated memory */
        if (mszReaders)
                free(mszReaders);

        return 0;
}

you will get:

 SCardListReaders: OK
 Using reader: Gemplus USB GemPCPinpad SmartCard Reader
 SCardConnect: OK
 SCardControl: Transaction failed. (0x80100016)
 Program ended with exit code: 0

Instead of the expected output (I get it on macOS Ventura 13.5):

 SCardListReaders: OK
 Using reader: Gemalto USB GemPCPinpad SmartCard Reader
 SCardConnect: OK
 SCardControl: OK
 Received buffer (24 bytes)
 06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 12 04 42 33 00 12
 SCardDisconnect: OK
 Program ended with exit code: 0

Why is it important

This bug is important because if SCardControl() can't be used then you can't use the secure verify command of a pinpad reader for example (i.e. enter the PIN code on the pinpad keyboard and not on the PC keyboard).

Other commands are using SCardControl(). They are documented in PC/SC specification version 2 part 10 "Interoperability Specification for ICCs and Personal Computer Systems Part 10 IFDs with Secure PIN Entry Capabilities" from the PC/SC workgroup.

See List of SCardControl() commands supported by the CCID driver.

GET_FEATURE_REQUEST
secure PIN verify (FEATURE_VERIFY_PIN_DIRECT)
modify PIN entry (FEATURE_MODIFY_PIN_DIRECT)
reader PIN properties (FEATURE_IFD_PIN_PROPERTIES)
Multifunctional Card Terminal reader direct (FEATURE_MCT_READER_DIRECT)
retrieve reader properties in TLV form (FEATURE_GET_TLV_PROPERTIES)

Know workaround

If I install a new CCID driver (my CCID driver 1.5.2 for example) then the same sample code works on Sonoma and I get the expected results.

SCardListReaders: OK
Using reader: Gemalto USB GemPCPinpad SmartCard Reader
SCardConnect: OK
SCardControl: OK
Received buffer (24 bytes)
06 04 42 33 00 06 07 04 42 33 00 07 0A 04 42 33 00 0A 12 04 42 33 00 12
SCardDisconnect: OK
Program ended with exit code: 0

It looks like the problem is with the CCID driver provided by Apple and not in the macOS PC/SC or resource manager layer.

If you need a customer driver to solve this problem please contact me.

[UPDATE November 2023]

This problem is caused by the Apple CCID driver included in Sonoma. See Apple's own CCID driver in Sonoma.

An easy way to fix the problem is to upgrade to Sonoma 14.1, or to enable my CCID driver (also provided by Apple in Sonoma) by doing:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

[UPDATE February 2024]

Apple has worked on SCardControl() support. The issue FB12779458 is fixed in macOS Sonoma 14.3.

macOS Sonoma and smart cards: known bugs

Ludovic Rousseau — Fri, 29 Sep 2023 12:50:55 GMT

In Sonoma Apple did a (lot of) rework of the smart card layer. It is not explicit in my previous article macOS Sonoma and smart cards status.

I will try to document what I find in new blog posts.

Sonoma: macOS 14

Ad I did for previous versions of macOS I propose to maintain a list of know issues (bug, regression or missing feature) in PC/SC (WinSCard API) or CryptoTokenKit on macOS Sonoma 14.

Previous lists:

macOS High Sierra and smart cards: known bugs (2018)
OS X El Capitan and smart cards: known bugs (2015)
OS X Yosemite and smart cards: known bugs (2014)

I will only list new bugs in macOS Sonoma. Bugs or missing features that were already present in previous macOS versions will not be listed again here. See my previous "macOS xyz and smart cards: known bugs" blog articles listed above.

Bug list

I will list bugs known (by me) and will try to maintain the list in the future if/when the bugs are fixed.

If you have found a bug not listed here then please contact me so I can add it to the list.

Conclusion

The bugs listed above are not critical for many users. But they may surprise some developers when they try to understand why their code is working fine on GNU/Linux or macOS Ventura but has a strange behaviour when executed on macOS Sonoma.