USB Card Reader (Gemalto) fails after updating to El Capitan

Question

Level 1

8 points

USB Card Reader (Gemalto) fails after updating to El Capitan

Really annoying 😟

I Had my Gemalto USB Card reader perfectly working with my installed Firefox and now it does not appear any more as a security device.

Tried desperately to reboot the iMac with the usb card reader plugged but no way 😟 Gooooood ! urgently need to have it back working

As it was before this failing update to El Capitan, Gemalto says at http://support.gemalto.com/?id=pc_usb_sl#.Vic2JhDhAUF that PKCS#11 / CCID Drivers are supossed to be already at the OSx .....no need to install it from outside.

Please help !

ALl I see at sytem log when I plug the reader :

Oct 21 09:02:47 herri01 Finder[522]: osascript(1037) System Policy: deny scripting-addition-send 'HUBC'/'load'

Oct 21 09:02:52 herri01 Finder[522]: osascript(1038) System Policy: deny scripting-addition-send 'HUBC'/'load'

Oct 21 09:02:52 herri01 com.apple.SecurityServer[80]: Token reader Gemalto PC Twin Reader inserted into system

Oct 21 09:02:52 herri01 com.apple.SecurityServer[80]: reader Gemalto PC Twin Reader: state changed 0 -> 18

Oct 21 09:02:57 herri01 Finder[522]: osascript(1039) System Policy: deny scripting-addition-send 'HUBC'/'load'

Oct 21 09:03:02 herri01 Finder[522]: osascript(1040) System Policy: deny scripting-addition-send 'HUBC'/'load'

iMac, OS X El Capitan (10.11)

Posted on Oct 21, 2015 12:04 AM

Reply

Answer 1

Oct 23, 2015 4:27 PM in response to urbinasol

Seeing a similar issue with a corporate Gemalto device. Worked on Yosemite and stopped after upgrading to El Capitan. OS X appears to see reader but cannot read certificate / token on card. Try pcsctest in a Terminal session to confirm whether reader is seen.

Following up with Apple and Gemalto to try to get a resolution

Reply

Answer 2

urbinasol Author

Level 1

8 points

Oct 23, 2015 8:49 PM in response to Ed Newman

Sure pcstest sees the reader, as it could be expected (I guess) because system.log already shows so.

The output for pcsctest (and input asking #reader)

herri01:~ lvr$ pcsctest

MUSCLE PC/SC Lite Test Program

Testing SCardEstablishContext : Command successful.

Testing SCardGetStatusChange

Please insert a working reader : Command successful.

Testing SCardListReaders : Command successful.

Reader 01: Gemalto PC Twin Reader

Enter the reader number : 0

Invalid Value - try again

Enter the reader number : 1

Waiting for card insertion

: Command successful.

Testing SCardConnect : Command successful.

Testing SCardStatus : Command successful.

Current Reader Name : Gemalto PC Twin Reader

Current Reader State : 0x54

Current Reader Protocol : 0x1

Current Reader ATR Size : 25 (0x19)

Current Reader ATR Value : 3B FF 18 00 00 81 31 FE 45 00 6B 11 05 07 00 01 21 01 43 4E 53 10 31 80 4A

Testing SCardDisconnect : Command successful.

Testing SCardReleaseContext : Command successful.

Testing SCardEstablishContext : Command successful.

Testing SCardGetStatusChange

Please insert a working reader : Command successful.

Testing SCardListReaders : Command successful.

Reader 01: Gemalto PC Twin Reader

Enter the reader number :

So, from here, which is the next step to get the token working ?

Reply

Answer 3

Oct 25, 2015 5:50 AM in response to urbinasol

Believe this is either Apple / Gemalto updating the drivers for the token.

Reply

Answer 4

xes13

Level 1

4 points

Nov 4, 2015 12:04 PM in response to Ed Newman

I can confirm this. Running El Capitan 10.11.1 and Gemalto IDK30 usb token will not work. Worked well in Mavericks and Yosemite, so it is definitely El Capitan problem.

Reply

Answer 5

Nov 4, 2015 12:53 PM in response to xes13

Gemalto USB reader functions. Issue appears to be with Axalto Cryptoflex .Net card. ATR appears to be unknown on El Capitan. Have tickets in with Apple and Gemalto on this

Reply

Answer 6

ludovic1

Level 1

0 points

Nov 12, 2015 11:21 AM in response to urbinasol

Hello,

The problem is not with the reader or the reader driver. The reader is working fine and you can access your smart card.

According to the card ATR you are using an Oberthur card. https://smartcard-atr.appspot.com/parse?ATR=3BFF1800008131FE45006B11050700012101 434E531031804A

You should contact Oberthur to get a newer version of the middleware for your smart card.

Reply

Answer 7

xes13

Level 1

4 points

Dec 2, 2015 2:45 AM in response to ludovic1

Tried contacting gemalto and oberthur ... no answer... hopefully Apple will fix this mess in 10.11.2 release ...

Reply

Answer 8

xes13

Level 1

4 points

Dec 10, 2015 10:06 PM in response to xes13

No, still doesn't work after upgrading to 10.11.2 ... very very disappointed.

Reply

Answer 9

ludovic1

Level 1

0 points

Dec 11, 2015 12:56 AM in response to xes13

The reader is working fine.

The CCID driver (provided by Apple) is working fine.

The problem is with the PKCS#11 provided (I guess) by Oberthur. Apple can't help on this part.

Reply

Answer 10

xes13

Level 1

4 points

Dec 11, 2015 2:47 AM in response to ludovic1

Well, it worked in Yosemite .. and I did not need to install anything from Gemalto or Oberthur.

Reply

Answer 11

BDGNY

Level 1

0 points

Dec 18, 2015 9:50 AM in response to xes13

I'm having the same problem with a Gemalto USB Shell Token v2 and OpenPGP Smartcard v2.

I have a long thread on it at GPG Tools, with tech details.

No solution yet but maybe it will help someone here. All suggestions welcome!

Reply

Answer 12

ludovic1

Level 1

0 points

Dec 18, 2015 11:27 AM in response to BDGNY

Level 1 smart card support on Mac OS X

http://ludovicrousseau.blogspot.fr/2014/03/level-1-smart-card-support-on-mac-os- x.html

Reply

Answer 13

BDGNY

Level 1

0 points

Dec 18, 2015 1:10 PM in response to ludovic1

Thank you. Looks like I'm going to need Level 2 support ;-(

There are lots more details of my situation here, but in reference to your post the most relevant part is:

$ pcsctest
MUSCLE PC/SC Lite Test Program
Testing SCardEstablishContext : Command successful.

Testing SCardGetStatusChange Please insert a working reader : Command successful.

Testing SCardListReaders : Command successful.

Reader 01: Gemalto USB Shell Token V2

Enter the reader number : 1

Waiting for card insertion : Command successful.

Testing SCardConnect : Card is unresponsive.

I don't know how to interpret that, other than that OS X 10.11x sees the Gemalto token, sees that a smart card is inserted but can't talk to the card. Again, I know for sure the card is good because it works on OS X 10.10.

I don't want to start installing things willy nilly, but wonder whether this page on SmartCard Services, and the drivers therein, have any relevance. Does someone know?

Reply

Answer 14

BDGNY

Level 1

0 points

Dec 18, 2015 1:09 PM in response to BDGNY

You also suggested I look at system profiler.

$ system_profiler SPUSBDataType
2015-12-18 16:04:49.289 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01500000
2015-12-18 16:04:49.293 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01600000
2015-12-18 16:04:49.296 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01710000
2015-12-18 16:04:49.297 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01720000
2015-12-18 16:04:49.298 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01700000
2015-12-18 16:04:49.299 system_profiler[9783:161539] SPUSBDevice: IOServiceGetMatchingService did not return anything for location 0x01800000
USB:
[snip]
        VMware Virtual USB Hub:
          Product ID: 0x0002
          Vendor ID: 0x0e0f  (VMWare, Inc.)
          Version: 1.00
          Location ID: 0x01700000
            USB SmartCard Reader:
              Product ID: 0x3438
              Vendor ID: 0x08e6  (Gemalto SA)
              Version: 2.00
              Serial Number: 845C8DF0
              Manufacturer: Gemalto
              Location ID: 0x01720000

Reply

Answer 15

ludovic1

Level 1

0 points

Dec 19, 2015 5:17 AM in response to BDGNY

Using virtual machines is often the source of problems with USB smart card readers.

Try to use your smart card reader + card on a real Apple computer.

Also try your card on the host and not the guest system.

If the host is a GNU/Linux system follow http://ludovicrousseau.blogspot.fr/2014/03/level-1-smart-card-support-on-gnulinu x.html

Reply