Ludovic Rousseau's blog (Posts about pcsc-lite)

New version of pcsc-lite: 2.5.1

Ludovic Rousseau — Wed, 10 Jun 2026 13:55:00 GMT

I have just released a new version of pcsc-lite 2.5.1.

pcsc-lite is a Free Software implementation of the PC/SC (also known as WinSCard) API for Unix systems. It provides an API for using smart cards and smart card readers.

This version contains a bug fix for multi-slots readers. The bug was introduced in the previous version 2.5.0 released 2 weeks ago.

Changes:

2.5.1: Ludovic Rousseau: 10 June 2026

Fix a bug (introduced in 2.5.0) with multi-slots readers
Add support of Haiku Operating System

No more limited to 16 readers

Ludovic Rousseau — Wed, 27 May 2026 15:25:41 GMT

pcsc-lite and my CCID driver are no longer limited to 16 readers. See New version of pcsc-lite: 2.5.0 and New version of libccid: 1.8.0.

History

Since the first version of pcsc-lite (in 2002 according to git history) the maximum number of readers has been set to 16. This number is defined by the PCSCLITE_MAX_READERS_CONTEXTS constant.

Since pcsc-lite was limited to 16 readers it was obvious to also limit the number of devices supported by the CCID driver to 16.

This limitation is problematic for some use cases. While it is possible to change the value of PCSCLITE_MAX_READERS_CONTEXTS and rebuild both pcsc-lite and the driver, this has side effects. See Fedora, flatpak and pcsc-lite for more information.

Changes

The request has been around since at least 2018. See https://salsa.debian.org/rousseau/CCID/-/work_items/4 and https://salsa.debian.org/rousseau/PCSC/-/work_items/4.

I had already calculated the amount of RAM that could be saved by using a list instead of a fixed-size array:

You can now use as many readers as you want.

In fact, no. There is still a limit of 256 readers due to the naming scheme used by pcsc-lite for readers. Readers will go from 00 to FF. See What is in a PC/SC reader name?.

Backward compatibility

In version 2.4.1 of pcsc-lite I introduced the ability to mix different versions of the internal communication protocol between the PC/SC daemon (pcscd) and the PC/SC library (libpcsclite). See pcsc-lite backward & forward compatible with itself.

In order to remove the limitation of the reader number, I had to update this internal communication protocol again. However, I tried to make it smart so that an old libpcsclite can communicate with a recent pcscd or vice versa. The application will still only recognise up to 16 readers, but at least it should work.

Conclusion

I hope you will benefit from this change:

Less RAM consumed when only 1 reader is used.
The possibility of using more than 16 readers.

New version of pcsc-lite: 2.5.0

Ludovic Rousseau — Wed, 27 May 2026 13:01:49 GMT

I have just released a new version of pcsc-lite 2.5.0.

pcsc-lite is a Free Software implementation of the PC/SC (also known as WinSCard) API for Unix systems. It provides an API for using smart cards and smart card readers.

The major change in this version is: no more limited to 16 smart card readers.

Changes:

2.5.0: Ludovic Rousseau: 27 May 2026

Do not limit to 16 readers only
Remove support of autotools
Fix a crash when rescanning serial configs
Fix a memory leak in Polkit
tokenparser: avoid a crash with corrupted Info.plist files
Some other minor improvements

pcsc-lite backward & forward compatible with itself

Ludovic Rousseau — Wed, 07 Jan 2026 15:55:10 GMT

pcsc-lite 2.4.1 now provides a backward & forward compatible mechanism that supports both the current and previous internal communication protocols.

The communication protocol we are talking about here is the one between the client (libpcsclite) and the server (pcscd) sides. It is an internal-only protocol that is specific to pcsc-lite.

Protocol negotiation

To ensure that the client and server are using the same protocol, they negotiate the procotol they know. If they are different, the server will refuse the connection. In the application (client side), the SCardEstablishContext() function will return the error code SCARD_E_SERVICE_STOPPED.

Up to version 2.4.0, both the server and the client only supported one protocol version (version 4:5).

Sandboxes

Flatpack, Snap, AppImage and other sandbox technologies are now used to distribute applications.

In some/many cases, the server (pcscd daemon) running on the host comes from a different version of pcsc-lite than the client used in the sandbox. If the internal communication protocol differs, the communication is not possible.

I receive requests to solve this problem. See:

Protocol History

pcsc-lite version	Release Date	Protocol version	Compatible with
2.4.1	1 Jan 2026	4:5	4:4 & 4:5
2.4.0	19 Oct 2025	4:5	4:5
2.3.3	2 Apr 2025
2.3.2	26 Mar 2025
2.3.1	24 Dec 2024
2.3.0	3 Aug 2024
2.2.3	26 May 2024	4:4	4:4
...
1.8.24	12 Oct 2018
1.8.23	18 Dec 2017	4:3	4:3
...
1.8.9	16 Oct 2013
1.8.8	16 Jan 2012	4:2	4:2
...
1.6.5	12 Oct 2010

New protocol negotiation

From pcsc-lite 2.4.1 onwards, the protocol negotiation is smarter.

The daemon side will accept the current version and also the previous one. Versions 4:5 and 4:4 are accepted. It is straightforward, as the only change with version 4:5 is the addition of a new command (command CMD_GET_READER_EVENTS introduced in commit 53f57ed700bcd0bc47d970dc674ba3fd5ee5b387). Old clients will simply not use the new command.

The client side will also accept the current version and the previous one. These are versions 4:5 and 4:4. Using a recent client (protocol 4:5) with an old server (protocol 4:4) will have a small side effect. The SCardGetStatusChange() function will not include the number of reader events (see Improved SCardGetStatusChange() for "\\?PnP?\Notification" special reader).

Applications using pcsc-lite 2.4.1 can use a daemon as old as pcsc-lite version 1.8.24, released in October 2018.

A pcscd daemon from pcsc-lite 2.4.1 can handle clients as old as the same pcsc-lite version 1.8.24 from October 2018.

Supporting the (older) protocol version 4:3 may be possible but would require more efforts and be more complex. Contact me if you require this.

Conclusion

This change should help mix PC/SC servers and clients from more different versions.

This should prevent people from using ugly hacks.

New version of pcsc-lite: 2.4.1

Ludovic Rousseau — Wed, 07 Jan 2026 14:33:25 GMT

I have just released a new version of pcsc-lite 2.4.1.

pcsc-lite is a Free Software implementation of the PC/SC (also known as WinSCard) API for Unix systems. It provides an API for using smart cards and smart card readers.

This version offers backwards compatibility for both the client and server components. It should now be easier to mix and match different versions of pcscd and libpcsclite (and using different internal protocol versions).

Changes:

2.4.1: Ludovic Rousseau: 1 January 2026

Add backward version support on the client side
Add backward version support on the server side
hotplug libudev: rescan the USB bus with pcscd --hotplug
fix a value in pcscd.service systemd file
meson: install systemd files even if libsystemd is not used
Some other minor improvements

Outdated and broken PC/SC drivers with pcsc-lite 2.4.0

Ludovic Rousseau — Fri, 31 Oct 2025 16:59:51 GMT

Since pcsc-lite 2.4.0 and the fact that pcscd can now run as a normal user (see pcscd runs as pcscd user), the driver must configure the reader's device access rights. Otherwise, the pcscd process will not be able to use the device.

Unmaintained drivers

Some older, unmaintained drivers will no longer work with pcscd. I have requested their removal from Debian unstable.

They are:

libasedrive-serial & libasedrive-usb from asedriveiiie (see bug #1119077)
libgempc410 & libgempc430 from ifd-gempc (see bug #1119078)

I am the Debian maintainer of these packages, so it is my responsibility to open tickets to remove the packages.

I also filed a release critical bug #1119081 on libgcr410 so that this driver will not be included in the next version of Debian (unless the issue is fixed).

Old hardware

These drivers are intended for very old serial smart card readers (who still has a serial port on their computer?) or USB readers from the last century.

The advantage of Free Software is that if someone still has such a device, they can obtain the source code of the driver (still available online), adapt it and use it.

Old software

There has been no new version of the asedriveiiie software since September 2010. The source code is no longer available from the publisher (a commecial company).

The ifd-gempc software is maintained upstream by me. The latest major version dates from April 2012 and was mostly compiler warnings fixes. The source code is still available at https://ifd-gempc.apdu.fr/.

The libgcr410 software was also written by me. I wrote it before ifd-gempc and I am surprised to see it packaged in Debian, as it should be replaced by ifd-gempc. The Debian package has been abandonned by its Debian maintainer since March 2008. More recent Debian versions have been produced by the Debian Quality Assurance (QA) team.

Popularity

I have already published an article on the popularity of Debian packages for smart cards in 2020 in Smart card Usage in Debian: pcscd and drivers.

With updated graphics, we now have:

asedriveiiie

ifd-gempc

libgcr410

Very few people still have these packages installed. And even fewer use them.

Changes required

I also filed the bug #39 "Set group to pcscd in the udev rules file" on the upstream acsccid driver.

This driver is a fork of my CCID driver and is still actively maintained. The problem should therefore be resolved in a new version.

Conclusion

I don't have enough free time to maintain software that is no longer in use.

I haven't used these drivers for at least 10 years. And I don't plan on using them in the future, because I discovered that I no longer have the smart card readers.

New version of pcsc-lite: 2.4.0

Ludovic Rousseau — Sun, 19 Oct 2025 13:25:09 GMT

I just released a new version of pcsc-lite 2.4.0.

pcsc-lite is a Free Software implementation of the PC/SC (or WinSCard) API for Unix systems.

The major change in this release is that the pcscd daemon process now runs as a normal user instead of root (when systemd is used).

You must use drivers that configure the reader device access rights so that a user in the pcscd group can access it for reading and writing. That is the case for libccid 1.7.0. See New version of libccid: 1.7.0.

Changes:

2.4.0: Ludovic Rousseau: 19 October 2025

Run pcscd under a pcscd user instead of root when using systemd
Set PIDFile in systemd service file
Protect contextMapList modifications using a mutex
meson:
- Fix libpcsclite.pc file
- respect builtin meson default_library option
- build and install spy lib & tool only when needed
UnitaryTests/*.py: fix pylint warnings
Improve Doxygen documentation

New version of pcsc-lite: 2.3.3

Ludovic Rousseau — Wed, 02 Apr 2025 15:54:28 GMT

I just released a new version of pcsc-lite 2.3.3.

pcsc-lite is a Free Software implementation of the PC/SC (or WinSCard) API for Unix systems.

Polkit rules was broken. So it was no more possible to give access to remote users for example. See pcsc-lite and polkit.

Thanks to Mike Kazantsev for the very nice bug report in PrivateUsers=yes in systemd sandboxing options prevents polkit rules from getting user/group info.

Changes:

2.3.3: Ludovic Rousseau: 2 April 2025

Make polkit rules work again (bug introduced in 2.3.2)

Ignore readers using PCSCLITE_IGNORE udev property

Ludovic Rousseau — Wed, 02 Apr 2025 12:00:29 GMT

Version 2.3.2 of pcsc-lite (New version of pcsc-lite: 2.3.2) introduced a new way to ignore a smart card reader.

The patch included in pcsc-lite is from Valtteri Vuorikoski and I will quote his git commit message in this article.

Use case

"This is similar to the existing filtering support provided by PCSCLITE_FILTER_IGNORE_READER_NAMES (Remove and/or customize PC/SC reader names), but allows using the full range of udev rules to match specific devices. For example, if you have several Yubikeys and one is attached to a specific USB port that is being forwarded to a virtual machine (viz. it should not be touched by programs on the host machine), this facility allows setting a rule to keep pcscd away from that Yubikey. Yubikeys attached to other ports keep working normally."

udev

By default pcsc-lite uses libudev to detect readers events (plug or unplug of a USB reader). The idea is to use a flag set by udev to tell pcsc-lite to ignore a reader.

Example rule that targets a Yubikey attached to a specific USB port and causes pcscd to ignore that device:

ACTION!="remove|unbind", SUBSYSTEM=="usb", ATTR{idVendor}=="1050",
ATTR{idProduct}=="0406", KERNEL=="1-2.3", ENV{PCSCLITE_IGNORE}="1"

The KERNEL match targets a USB device attached to port 3 of a hub on port 2 of USB bus 1, and rule sets property PCSCLITE_IGNORE to cause the device to be ignored.

The reader with idVendor=0x1050 and idProduct=0x0406 is the YubiKey FIDO+CCID from Yubico.

Or if you want to ignore any reader connected to USB port 1-3:

ACTION!="remove|unbind", SUBSYSTEM=="usb", KERNEL=="1-3", ENV{PCSCLITE_IGNORE}="1"

You put the above rule is a file /etc/udev/rules.d/foobar.rules and voila.

Config

To know what value for KERNEL= to use you can run udevadm monitor and connect a USB reader. You will get something like:

$ udevadm monitor
monitor will print the received events for:
UDEV - the event which udev sends out after rule processing
KERNEL - the kernel uevent

KERNEL[2022.067560] add      /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
KERNEL[2022.069016] change   /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
KERNEL[2022.069332] add      /devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.0 (usb)
KERNEL[2022.069416] bind     /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
UDEV  [2022.690370] add      /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
UDEV  [2022.695881] change   /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
UDEV  [2022.700310] add      /devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.0 (usb)
UDEV  [2022.728691] bind     /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)

You can see the "1-3" information to use in the .rules file.

Debug

To debug your configuration and check the new field PCSCLITE_IGNORE is correctly set you can use udevadm monitor --property and you get something like:

$ udevadm monitor --property
monitor will print the received events for:
UDEV - the event which udev sends out after rule processing
KERNEL - the kernel uevent

KERNEL[2265.405075] add      /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
ACTION=add
DEVPATH=/devices/pci0000:00/0000:00:14.0/usb1/1-3
SUBSYSTEM=usb
DEVNAME=/dev/bus/usb/001/015
DEVTYPE=usb_device
PRODUCT=8e6/3437/100
TYPE=0/0/0
BUSNUM=001
DEVNUM=015
SEQNUM=4692
MAJOR=189
MINOR=14

[...]

UDEV  [2266.066186] bind     /devices/pci0000:00/0000:00:14.0/usb1/1-3 (usb)
ACTION=bind
DEVPATH=/devices/pci0000:00/0000:00:14.0/usb1/1-3
SUBSYSTEM=usb
DEVNAME=/dev/bus/usb/001/015
DEVTYPE=usb_device
DRIVER=usb
PRODUCT=8e6/3437/100
TYPE=0/0/0
BUSNUM=001
DEVNUM=015
SEQNUM=4695
USEC_INITIALIZED=2265405122
ID_BUS=usb
ID_MODEL=USB_SmartCard_Reader
ID_MODEL_ENC=USB\x20SmartCard\x20Reader
ID_MODEL_ID=3437
ID_SERIAL=Gemplus_USB_SmartCard_Reader
ID_VENDOR=Gemplus
ID_VENDOR_ENC=Gemplus
ID_VENDOR_ID=08e6
ID_REVISION=0100
ID_USB_MODEL=USB_SmartCard_Reader
ID_USB_MODEL_ENC=USB\x20SmartCard\x20Reader
ID_USB_MODEL_ID=3437
ID_USB_SERIAL=Gemplus_USB_SmartCard_Reader
ID_USB_VENDOR=Gemplus
ID_USB_VENDOR_ENC=Gemplus
ID_USB_VENDOR_ID=08e6
ID_USB_REVISION=0100
ID_USB_INTERFACES=:0b0000:
ID_VENDOR_FROM_DATABASE=Gemalto (was Gemplus)
ID_MODEL_FROM_DATABASE=GemPC Twin SmartCard Reader
ID_PATH_WITH_USB_REVISION=pci-0000:00:14.0-usbv2-0:3
ID_PATH=pci-0000:00:14.0-usb-0:3
ID_PATH_TAG=pci-0000_00_14_0-usb-0_3
ID_SMARTCARD_READER=1
ID_FOR_SEAT=usb-pci-0000_00_14_0-usb-0_3
SYSTEMD_WANTS=smartcard.target
SYSTEMD_USER_WANTS=smartcard.target
PCSCLITE_IGNORE=1
MAJOR=189
MINOR=14
TAGS=:uaccess:security-device:seat:systemd:
CURRENT_TAGS=:uaccess:security-device:seat:systemd:

In pcscd logs I get:

04337722 [140613033731776] ../src/hotplug_libudev.c:656:HPEstablishUSBNotifications() USB Device add
00000411 [140613033731776] ../src/hotplug_libudev.c:299:get_driver() Looking for a driver for VID: 0x08E6, PID: 0x3437, path: /dev/bus/usb/001/016
00000303 [140613033731776] ../src/hotplug_libudev.c:417:HPAddDevice() Device Gemalto PC Twin Reader at /dev/bus/usb/001/016 (1-3:1.0) has PCSCLITE_IGNORE set: ignored

And I do not see the PC/SC reader with pcsc_scan command:

$ pcsc_scan -r
No reader found.

Conclusion

I am sure you will find other use cases for this new feature.

Thanks to Valtteri Vuorikoski for the patch. If you have ideas of changes or improvements for pcsc-lite do not hesitate to submit them.

New version of pcsc-lite: 2.3.2

Ludovic Rousseau — Wed, 26 Mar 2025 15:26:20 GMT

I just released a new version of pcsc-lite 2.3.2.

pcsc-lite is a Free Software implementation of the PC/SC (or WinSCard) API for Unix systems.

Changes:

2.3.2: Ludovic Rousseau: 26 March 2025

Hardening systemd pcscd.service file
pcscd.service: add missing Requires=polkit.service
pcsc-spy: add missing PCSCv2_PART10_PROPERTY_* definitions
Support udev PCSCLITE_IGNORE property to filter readers
debuglog: force use of colors when --color is used
Some other minor improvements