Performance over RDP

--===============5199171782983145742==
Content-Type: multipart/alternative; boundary="00000000000014e0c30655b2462f"

--00000000000014e0c30655b2462f
Content-Type: text/plain; charset="UTF-8"

Hello,

I'm having a performance problem with OpenSC.

The command:

$ time pkcs11-tool --list-slots

>Slot 0 (0x0): Alcorlink USB Smart Card Reader 0
>Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1
>Slot 2 (0x8): Windows Hello for Business 1

takes 4 minutes (!). (see below)

Of course my setup is a bit special, it's not a local card reader.
I use OpenSC to access my smartcard on a windows laptop from a linux VM over
a RDP connection. (protocol [MS-RDPESC] )

For example, RDP intercepts the SCARD calls and forwards them over RDP.

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpesc/65c30c99-e816-48b6-9293-8d467b10cc39

Listing these three slots over RDP takes around 4 minutes, which is far too
slow.

I have tried to figure out what the problem is, maybe:

For me it looks like OpenSC checks each driver with each slot, and each
driver
issues an APDU command which fails.

Every APDU call is, of course, rather expensive in this stack.

Are there already any approaches, how this issue can be addressed?

best regards,

Martin



$ time pkcs11-tool --list-slots
Available slots:
Slot 0 (0x0): Alcorlink USB Smart Card Reader 0
  (empty)
Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1
  (token not recognized)
Slot 2 (0x8): Windows Hello for Business 1
  token label        : GIDS card
  token manufacturer : www.mysmartlogon.com
  token model        : PKCS#15 emulated
  token flags        : login required, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 886c4338561347b7
  pin min/max        : 4/15
  uri                : pkcs11:model=PKCS%2315%20emulated;manufacturer=
www.mysmartlogon.com;serial=886c4338561347b7;token=GIDS%20card

real    4m6.310s
user    0m10.041s
sys     0m8.720s


$ export OPENSC_DEBUG=3
using debug and then use the command again prints minute after minute
similar
messages. (usually with a different card-drvier.c)
Here is a sample message, here with card-coolkey.c.
[....]
Outgoing APDU (12 bytes):
00 A4 04 00 07 62 76 01 FF 00 00 00 .....bv.....

  11:37:33.235 [opensc-pkcs11] reader-pcsc.c:249:pcsc_internal_transmit:
called
  11:37:33.289 [opensc-pkcs11] reader-pcsc.c:282:pcsc_internal_transmit:
Microsoft UICC ISO Reader 699446e9 1:SCardTransmit/Control failed:
0x00000005
  11:37:33.289 [opensc-pkcs11] reader-pcsc.c:503:pcsc_detect_card_presence:
called
  11:37:33.289 [opensc-pkcs11] reader-pcsc.c:373:refresh_attributes:
Microsoft UICC ISO Reader 699446e9 1 check
  11:37:33.611 [opensc-pkcs11] reader-pcsc.c:412:refresh_attributes:
returning with: 0 (Success)
  11:37:33.611 [opensc-pkcs11] reader-pcsc.c:511:pcsc_detect_card_presence:
returning with: 5
  11:37:33.611 [opensc-pkcs11] reader-pcsc.c:503:pcsc_detect_card_presence:
called
  11:37:33.611 [opensc-pkcs11] reader-pcsc.c:373:refresh_attributes:
Microsoft UICC ISO Reader 699446e9 1 check
  11:37:33.937 [opensc-pkcs11] reader-pcsc.c:412:refresh_attributes:
returning with: 0 (Success)
  11:37:33.937 [opensc-pkcs11] reader-pcsc.c:511:pcsc_detect_card_presence:
returning with: 5
  11:37:33.937 [opensc-pkcs11] reader-pcsc.c:343:pcsc_transmit: unable to
transmit
  11:37:33.937 [opensc-pkcs11] apdu.c:380:sc_single_transmit: unable to
transmit APDU: -1107 (Transmit failed)
  11:37:33.937 [opensc-pkcs11] apdu.c:518:sc_transmit: transmit APDU
failed: -1107 (Transmit failed)
  11:37:33.937 [opensc-pkcs11] card.c:515:sc_unlock: called
  11:37:33.937 [opensc-pkcs11] reader-pcsc.c:759:pcsc_unlock: called
  11:37:33.964 [opensc-pkcs11] card-coolkey.c:995:coolkey_apdu_io: result
r=-1107 apdu.resplen=0 sw1=00 sw2=00
  11:37:33.965 [opensc-pkcs11] card-coolkey.c:1000:coolkey_apdu_io:
Transmit failed
  11:37:33.965 [opensc-pkcs11] card-coolkey.c:1023:coolkey_apdu_io:
returning with: -1107 (Transmit failed)
  11:37:33.965 [opensc-pkcs11] card.c:337:sc_connect_card: trying driver
'muscle'
  11:37:33.965 [opensc-pkcs11] apdu.c:550:sc_transmit_apdu: called
  11:37:33.965 [opensc-pkcs11] card.c:466:sc_lock: called
  11:37:33.965 [opensc-pkcs11] reader-pcsc.c:717:pcsc_lock: called
  11:37:34.021 [opensc-pkcs11]
card-muscle.c:844:muscle_card_reader_lock_obtained: called
  11:37:34.022 [opensc-pkcs11]
card-muscle.c:852:muscle_card_reader_lock_obtained: returning with: 0
(Success)
  11:37:34.022 [opensc-pkcs11] card.c:505:sc_lock: returning with: 0
(Success)
  11:37:34.022 [opensc-pkcs11] apdu.c:515:sc_transmit: called
  11:37:34.022 [opensc-pkcs11] apdu.c:363:sc_single_transmit: called
  11:37:34.022 [opensc-pkcs11] apdu.c:367:sc_single_transmit: CLA:0,
INS:A4, P1:4, P2:0, data(6) 0x7faed39fc070
  11:37:34.022 [opensc-pkcs11] reader-pcsc.c:336:pcsc_transmit: reader
'Microsoft UICC ISO Reader 699446e9 1'
  11:37:34.022 [opensc-pkcs11] reader-pcsc.c:337:pcsc_transmit:
Outgoing APDU (11 bytes):
00 A4 04 00 06 A0 00 00 00 01 01 ...........
[....]

--00000000000014e0c30655b2462f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><br>Hello,<br><br>I&#39;m having a performance proble=
m with OpenSC.<br><br>The command:<br><br>$ time pkcs11-tool --list-slots<b=
r><br>&gt;Slot 0 (0x0): Alcorlink USB Smart Card Reader 0<br>&gt;Slot 1 (0x=
4): Microsoft UICC ISO Reader 699446e9 1<br>&gt;Slot 2 (0x8): Windows Hello=
 for Business 1<br><br>takes 4 minutes (!). (see below)<br><br>Of course my=
 setup is a bit special, it&#39;s not a local card reader.<br>I use OpenSC =
to access my smartcard on a windows laptop from a linux VM over<br>a RDP co=
nnection. (protocol [MS-RDPESC] )<br><br>For example, RDP intercepts the SC=
ARD calls and forwards them over RDP.<br><br><a href=3D"https://learn.micro=
soft.com/en-us/openspecs/windows_protocols/ms-rdpesc/65c30c99-e816-48b6-929=
3-8d467b10cc39">https://learn.microsoft.com/en-us/openspecs/windows_protoco=
ls/ms-rdpesc/65c30c99-e816-48b6-9293-8d467b10cc39</a><br><br>Listing these =
three slots over RDP takes around 4 minutes, which is far too<br>slow.<br><=
br>I have tried to figure out what the problem is, maybe:<br><br>For me it =
looks like OpenSC checks each driver with each slot, and each driver<br>iss=
ues an APDU command which fails. <br><br>Every APDU call is, of course, rat=
her expensive in this stack.<br><br>Are there already any approaches, how t=
his issue can be addressed?<br><br>best regards,<br><br>Martin<br><br></div=
><div><br></div><div><br>$ time pkcs11-tool --list-slots<br>Available slots=
:<br>Slot 0 (0x0): Alcorlink USB Smart Card Reader 0<br>=C2=A0 (empty)<br>S=
lot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1<br>=C2=A0 (token not reco=
gnized)<br>Slot 2 (0x8): Windows Hello for Business 1<br>=C2=A0 token label=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0: GIDS card<br>=C2=A0 token manufacturer : <a h=
ref=3D"http://www.mysmartlogon.com">www.mysmartlogon.com</a><br>=C2=A0 toke=
n model =C2=A0 =C2=A0 =C2=A0 =C2=A0: PKCS#15 emulated<br>=C2=A0 token flags=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0: login required, token initialized, PIN initia=
lized<br>=C2=A0 hardware version =C2=A0 : 0.0<br>=C2=A0 firmware version =
=C2=A0 : 0.0<br>=C2=A0 serial num =C2=A0 =C2=A0 =C2=A0 =C2=A0 : 886c4338561=
347b7<br>=C2=A0 pin min/max =C2=A0 =C2=A0 =C2=A0 =C2=A0: 4/15<br>=C2=A0 uri=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: pkcs11:model=3DPK=
CS%2315%20emulated;manufacturer=3D<a href=3D"http://www.mysmartlogon.com">w=
ww.mysmartlogon.com</a>;serial=3D886c4338561347b7;token=3DGIDS%20card<br><b=
r>real =C2=A0 =C2=A04m6.310s<br>user =C2=A0 =C2=A00m10.041s<br>sys =C2=A0 =
=C2=A0 0m8.720s<br><br><br>$ export OPENSC_DEBUG=3D3<br>using debug and the=
n use the command again prints minute after minute similar<br>messages. (us=
ually with a different card-drvier.c)<br>Here is a sample message, here wit=
h card-coolkey.c.<br>[....]<br>Outgoing APDU (12 bytes):<br>00 A4 04 00 07 =
62 76 01 FF 00 00 00 .....bv.....<br></div><div><br></div><div>=C2=A0 11:37=
:33.235 [opensc-pkcs11] reader-pcsc.c:249:pcsc_internal_transmit: called<br=
>=C2=A0 11:37:33.289 [opensc-pkcs11] reader-pcsc.c:282:pcsc_internal_transm=
it: Microsoft UICC ISO Reader 699446e9 1:SCardTransmit/Control failed: 0x00=
000005<br>=C2=A0 11:37:33.289 [opensc-pkcs11] reader-pcsc.c:503:pcsc_detect=
_card_presence: called<br>=C2=A0 11:37:33.289 [opensc-pkcs11] reader-pcsc.c=
:373:refresh_attributes: Microsoft UICC ISO Reader 699446e9 1 check<br>=C2=
=A0 11:37:33.611 [opensc-pkcs11] reader-pcsc.c:412:refresh_attributes: retu=
rning with: 0 (Success)<br>=C2=A0 11:37:33.611 [opensc-pkcs11] reader-pcsc.=
c:511:pcsc_detect_card_presence: returning with: 5<br>=C2=A0 11:37:33.611 [=
opensc-pkcs11] reader-pcsc.c:503:pcsc_detect_card_presence: called<br>=C2=
=A0 11:37:33.611 [opensc-pkcs11] reader-pcsc.c:373:refresh_attributes: Micr=
osoft UICC ISO Reader 699446e9 1 check<br>=C2=A0 11:37:33.937 [opensc-pkcs1=
1] reader-pcsc.c:412:refresh_attributes: returning with: 0 (Success)<br>=C2=
=A0 11:37:33.937 [opensc-pkcs11] reader-pcsc.c:511:pcsc_detect_card_presenc=
e: returning with: 5<br>=C2=A0 11:37:33.937 [opensc-pkcs11] reader-pcsc.c:3=
43:pcsc_transmit: unable to transmit<br>=C2=A0 11:37:33.937 [opensc-pkcs11]=
 apdu.c:380:sc_single_transmit: unable to transmit APDU: -1107 (Transmit fa=
iled)<br>=C2=A0 11:37:33.937 [opensc-pkcs11] apdu.c:518:sc_transmit: transm=
it APDU failed: -1107 (Transmit failed)<br>=C2=A0 11:37:33.937 [opensc-pkcs=
11] card.c:515:sc_unlock: called<br>=C2=A0 11:37:33.937 [opensc-pkcs11] rea=
der-pcsc.c:759:pcsc_unlock: called<br>=C2=A0 11:37:33.964 [opensc-pkcs11] c=
ard-coolkey.c:995:coolkey_apdu_io: result r=3D-1107 apdu.resplen=3D0 sw1=3D=
00 sw2=3D00<br>=C2=A0 11:37:33.965 [opensc-pkcs11] card-coolkey.c:1000:cool=
key_apdu_io: Transmit failed<br>=C2=A0 11:37:33.965 [opensc-pkcs11] card-co=
olkey.c:1023:coolkey_apdu_io: returning with: -1107 (Transmit failed)<br>=
=C2=A0 11:37:33.965 [opensc-pkcs11] card.c:337:sc_connect_card: trying driv=
er &#39;muscle&#39;<br>=C2=A0 11:37:33.965 [opensc-pkcs11] apdu.c:550:sc_tr=
ansmit_apdu: called<br>=C2=A0 11:37:33.965 [opensc-pkcs11] card.c:466:sc_lo=
ck: called<br>=C2=A0 11:37:33.965 [opensc-pkcs11] reader-pcsc.c:717:pcsc_lo=
ck: called<br>=C2=A0 11:37:34.021 [opensc-pkcs11] card-muscle.c:844:muscle_=
card_reader_lock_obtained: called<br>=C2=A0 11:37:34.022 [opensc-pkcs11] ca=
rd-muscle.c:852:muscle_card_reader_lock_obtained: returning with: 0 (Succes=
s)<br>=C2=A0 11:37:34.022 [opensc-pkcs11] card.c:505:sc_lock: returning wit=
h: 0 (Success)<br>=C2=A0 11:37:34.022 [opensc-pkcs11] apdu.c:515:sc_transmi=
t: called<br>=C2=A0 11:37:34.022 [opensc-pkcs11] apdu.c:363:sc_single_trans=
mit: called<br>=C2=A0 11:37:34.022 [opensc-pkcs11] apdu.c:367:sc_single_tra=
nsmit: CLA:0, INS:A4, P1:4, P2:0, data(6) 0x7faed39fc070<br>=C2=A0 11:37:34=
.022 [opensc-pkcs11] reader-pcsc.c:336:pcsc_transmit: reader &#39;Microsoft=
 UICC ISO Reader 699446e9 1&#39;<br>=C2=A0 11:37:34.022 [opensc-pkcs11] rea=
der-pcsc.c:337:pcsc_transmit: <br>Outgoing APDU (11 bytes):<br>00 A4 04 00 =
06 A0 00 00 00 01 01 ...........<br>[....]<br></div></div>

--00000000000014e0c30655b2462f--


--===============5199171782983145742==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============5199171782983145742==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

--===============5199171782983145742==--