Re: Performance over RDP
Frank Morgner <[email protected]> Fri, 3 Jul 2026 13:11:09 +0200
| Newsgroups | gmane.comp.encryption.opensc.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============2715829135111018333==
Content-Type: multipart/alternative;
boundary="------------y0l3o7yH9zvMuE8e4vyI5ksl"
This is a multi-part message in MIME format.
--------------y0l3o7yH9zvMuE8e4vyI5ksl
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Hi Martin,
you may try the following:
* limit OpenSC to specific card drivers that are in your scope
* limit OpenSC to only probe the specific reader that you are
interested in
* Review OpenSC's file caching to suit your needs
* work with the latest version, in particular with
https://github.com/OpenSC/OpenSC/pull/3126 included
All the above points can be configured from a user/admin perspective.
Please let us know if some stuff is unclear, then we maybe update the
existing documentation.
Finally, you may optimize how a specific card driver interacts with the
token. That requires a developer's view, but can be very beneficial in
particular for the "default" configuration in most systems.
BR, Frank.
Am 03.07.26 um 12:20 schrieb Martin Vogt:
>
> Hello,
>
> I'm having a performance problem with OpenSC.
>
> The command:
>
> $ time pkcs11-tool --list-slots
>
> >Slot 0 (0x0): Alcorlink USB Smart Card Reader 0
> >Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1
> >Slot 2 (0x8): Windows Hello for Business 1
>
> takes 4 minutes (!). (see below)
>
> Of course my setup is a bit special, it's not a local card reader.
> I use OpenSC to access my smartcard on a windows laptop from a linux
> VM over
> a RDP connection. (protocol [MS-RDPESC] )
>
> For example, RDP intercepts the SCARD calls and forwards them over RDP.
>
> https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpesc/65c30c99-e816-48b6-9293-8d467b10cc39
>
> Listing these three slots over RDP takes around 4 minutes, which is
> far too
> slow.
>
> I have tried to figure out what the problem is, maybe:
>
> For me it looks like OpenSC checks each driver with each slot, and
> each driver
> issues an APDU command which fails.
>
> Every APDU call is, of course, rather expensive in this stack.
>
> Are there already any approaches, how this issue can be addressed?
>
> best regards,
>
> Martin
>
>
>
> $ time pkcs11-tool --list-slots
> Available slots:
> Slot 0 (0x0): Alcorlink USB Smart Card Reader 0
> (empty)
> Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1
> (token not recognized)
> Slot 2 (0x8): Windows Hello for Business 1
> token label : GIDS card
> token manufacturer : www.mysmartlogon.com <http://www.mysmartlogon.com>
> token model : PKCS#15 emulated
> token flags : login required, token initialized, PIN initialized
> hardware version : 0.0
> firmware version : 0.0
> serial num : 886c4338561347b7
> pin min/max : 4/15
> uri :
> pkcs11:model=PKCS%2315%20emulated;manufacturer=www.mysmartlogon.com
> <http://www.mysmartlogon.com>;serial=886c4338561347b7;token=GIDS%20card
>
> real 4m6.310s
> user 0m10.041s
> sys 0m8.720s
>
>
> $ export OPENSC_DEBUG=3
> using debug and then use the command again prints minute after minute
> similar
> messages. (usually with a different card-drvier.c)
> Here is a sample message, here with card-coolkey.c.
> [....]
> Outgoing APDU (12 bytes):
> 00 A4 04 00 07 62 76 01 FF 00 00 00 .....bv.....
>
> 11:37:33.235 [opensc-pkcs11]
> reader-pcsc.c:249:pcsc_internal_transmit: called
> 11:37:33.289 [opensc-pkcs11]
> reader-pcsc.c:282:pcsc_internal_transmit: Microsoft UICC ISO Reader
> 699446e9 1:SCardTransmit/Control failed: 0x00000005
> 11:37:33.289 [opensc-pkcs11]
> reader-pcsc.c:503:pcsc_detect_card_presence: called
> 11:37:33.289 [opensc-pkcs11] reader-pcsc.c:373:refresh_attributes:
> Microsoft UICC ISO Reader 699446e9 1 check
> 11:37:33.611 [opensc-pkcs11] reader-pcsc.c:412:refresh_attributes:
> returning with: 0 (Success)
> 11:37:33.611 [opensc-pkcs11]
> reader-pcsc.c:511:pcsc_detect_card_presence: returning with: 5
> 11:37:33.611 [opensc-pkcs11]
> reader-pcsc.c:503:pcsc_detect_card_presence: called
> 11:37:33.611 [opensc-pkcs11] reader-pcsc.c:373:refresh_attributes:
> Microsoft UICC ISO Reader 699446e9 1 check
> 11:37:33.937 [opensc-pkcs11] reader-pcsc.c:412:refresh_attributes:
> returning with: 0 (Success)
> 11:37:33.937 [opensc-pkcs11]
> reader-pcsc.c:511:pcsc_detect_card_presence: returning with: 5
> 11:37:33.937 [opensc-pkcs11] reader-pcsc.c:343:pcsc_transmit: unable
> to transmit
> 11:37:33.937 [opensc-pkcs11] apdu.c:380:sc_single_transmit: unable
> to transmit APDU: -1107 (Transmit failed)
> 11:37:33.937 [opensc-pkcs11] apdu.c:518:sc_transmit: transmit APDU
> failed: -1107 (Transmit failed)
> 11:37:33.937 [opensc-pkcs11] card.c:515:sc_unlock: called
> 11:37:33.937 [opensc-pkcs11] reader-pcsc.c:759:pcsc_unlock: called
> 11:37:33.964 [opensc-pkcs11] card-coolkey.c:995:coolkey_apdu_io:
> result r=-1107 apdu.resplen=0 sw1=00 sw2=00
> 11:37:33.965 [opensc-pkcs11] card-coolkey.c:1000:coolkey_apdu_io:
> Transmit failed
> 11:37:33.965 [opensc-pkcs11] card-coolkey.c:1023:coolkey_apdu_io:
> returning with: -1107 (Transmit failed)
> 11:37:33.965 [opensc-pkcs11] card.c:337:sc_connect_card: trying
> driver 'muscle'
> 11:37:33.965 [opensc-pkcs11] apdu.c:550:sc_transmit_apdu: called
> 11:37:33.965 [opensc-pkcs11] card.c:466:sc_lock: called
> 11:37:33.965 [opensc-pkcs11] reader-pcsc.c:717:pcsc_lock: called
> 11:37:34.021 [opensc-pkcs11]
> card-muscle.c:844:muscle_card_reader_lock_obtained: called
> 11:37:34.022 [opensc-pkcs11]
> card-muscle.c:852:muscle_card_reader_lock_obtained: returning with: 0
> (Success)
> 11:37:34.022 [opensc-pkcs11] card.c:505:sc_lock: returning with: 0
> (Success)
> 11:37:34.022 [opensc-pkcs11] apdu.c:515:sc_transmit: called
> 11:37:34.022 [opensc-pkcs11] apdu.c:363:sc_single_transmit: called
> 11:37:34.022 [opensc-pkcs11] apdu.c:367:sc_single_transmit: CLA:0,
> INS:A4, P1:4, P2:0, data(6) 0x7faed39fc070
> 11:37:34.022 [opensc-pkcs11] reader-pcsc.c:336:pcsc_transmit: reader
> 'Microsoft UICC ISO Reader 699446e9 1'
> 11:37:34.022 [opensc-pkcs11] reader-pcsc.c:337:pcsc_transmit:
> Outgoing APDU (11 bytes):
> 00 A4 04 00 06 A0 00 00 00 01 01 ...........
> [....]
>
>
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
--------------y0l3o7yH9zvMuE8e4vyI5ksl
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Martin,</p>
<p>you may try the following:</p>
<ul>
<li>limit OpenSC to specific card drivers that are in your scope</li>
<li>limit OpenSC to only probe the specific reader that you are
interested in</li>
<li>Review OpenSC's file caching to suit your needs</li>
<li>work with the latest version, in particular with <a
moz-do-not-send="true"
href="https://github.com/OpenSC/OpenSC/pull/3126"
class="moz-txt-link-freetext">https://github.com/OpenSC/OpenSC/pull/3126</a>
included</li>
</ul>
<p>All the above points can be configured from a user/admin
perspective. Please let us know if some stuff is unclear, then we
maybe update the existing documentation.</p>
<p>Finally, you may optimize how a specific card driver interacts
with the token. That requires a developer's view, but can be very
beneficial in particular for the "default" configuration in most
systems.</p>
<p>BR, Frank.</p>
<div class="moz-cite-prefix">Am 03.07.26 um 12:20 schrieb Martin
Vogt:<br>
</div>
<blockquote type="cite"
cite="mid:CAOE8yMBMOQuCaEUwRFjhujp4NaDesmT8Go9SgrfL11B=4-k_DA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div><br>
Hello,<br>
<br>
I'm having a performance problem with OpenSC.<br>
<br>
The command:<br>
<br>
$ time pkcs11-tool --list-slots<br>
<br>
>Slot 0 (0x0): Alcorlink USB Smart Card Reader 0<br>
>Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1<br>
>Slot 2 (0x8): Windows Hello for Business 1<br>
<br>
takes 4 minutes (!). (see below)<br>
<br>
Of course my setup is a bit special, it's not a local card
reader.<br>
I use OpenSC to access my smartcard on a windows laptop from a
linux VM over<br>
a RDP connection. (protocol [MS-RDPESC] )<br>
<br>
For example, RDP intercepts the SCARD calls and forwards them
over RDP.<br>
<br>
<a
href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpesc/65c30c99-e816-48b6-9293-8d467b10cc39"
moz-do-not-send="true" class="moz-txt-link-freetext">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpesc/65c30c99-e816-48b6-9293-8d467b10cc39</a><br>
<br>
Listing these three slots over RDP takes around 4 minutes,
which is far too<br>
slow.<br>
<br>
I have tried to figure out what the problem is, maybe:<br>
<br>
For me it looks like OpenSC checks each driver with each slot,
and each driver<br>
issues an APDU command which fails. <br>
<br>
Every APDU call is, of course, rather expensive in this stack.<br>
<br>
Are there already any approaches, how this issue can be
addressed?<br>
<br>
best regards,<br>
<br>
Martin<br>
<br>
</div>
<div><br>
</div>
<div><br>
$ time pkcs11-tool --list-slots<br>
Available slots:<br>
Slot 0 (0x0): Alcorlink USB Smart Card Reader 0<br>
(empty)<br>
Slot 1 (0x4): Microsoft UICC ISO Reader 699446e9 1<br>
(token not recognized)<br>
Slot 2 (0x8): Windows Hello for Business 1<br>
token label : GIDS card<br>
token manufacturer : <a href="http://www.mysmartlogon.com"
moz-do-not-send="true">www.mysmartlogon.com</a><br>
token model : PKCS#15 emulated<br>
token flags : login required, token initialized, PIN
initialized<br>
hardware version : 0.0<br>
firmware version : 0.0<br>
serial num : 886c4338561347b7<br>
pin min/max : 4/15<br>
uri :
pkcs11:model=PKCS%2315%20emulated;manufacturer=<a
href="http://www.mysmartlogon.com" moz-do-not-send="true">www.mysmartlogon.com</a>;serial=886c4338561347b7;token=GIDS%20card<br>
<br>
real 4m6.310s<br>
user 0m10.041s<br>
sys 0m8.720s<br>
<br>
<br>
$ export OPENSC_DEBUG=3<br>
using debug and then use the command again prints minute after
minute similar<br>
messages. (usually with a different card-drvier.c)<br>
Here is a sample message, here with card-coolkey.c.<br>
[....]<br>
Outgoing APDU (12 bytes):<br>
00 A4 04 00 07 62 76 01 FF 00 00 00 .....bv.....<br>
</div>
<div><br>
</div>
<div> 11:37:33.235 [opensc-pkcs11]
reader-pcsc.c:249:pcsc_internal_transmit: called<br>
11:37:33.289 [opensc-pkcs11]
reader-pcsc.c:282:pcsc_internal_transmit: Microsoft UICC ISO
Reader 699446e9 1:SCardTransmit/Control failed: 0x00000005<br>
11:37:33.289 [opensc-pkcs11]
reader-pcsc.c:503:pcsc_detect_card_presence: called<br>
11:37:33.289 [opensc-pkcs11]
reader-pcsc.c:373:refresh_attributes: Microsoft UICC ISO
Reader 699446e9 1 check<br>
11:37:33.611 [opensc-pkcs11]
reader-pcsc.c:412:refresh_attributes: returning with: 0
(Success)<br>
11:37:33.611 [opensc-pkcs11]
reader-pcsc.c:511:pcsc_detect_card_presence: returning with: 5<br>
11:37:33.611 [opensc-pkcs11]
reader-pcsc.c:503:pcsc_detect_card_presence: called<br>
11:37:33.611 [opensc-pkcs11]
reader-pcsc.c:373:refresh_attributes: Microsoft UICC ISO
Reader 699446e9 1 check<br>
11:37:33.937 [opensc-pkcs11]
reader-pcsc.c:412:refresh_attributes: returning with: 0
(Success)<br>
11:37:33.937 [opensc-pkcs11]
reader-pcsc.c:511:pcsc_detect_card_presence: returning with: 5<br>
11:37:33.937 [opensc-pkcs11]
reader-pcsc.c:343:pcsc_transmit: unable to transmit<br>
11:37:33.937 [opensc-pkcs11] apdu.c:380:sc_single_transmit:
unable to transmit APDU: -1107 (Transmit failed)<br>
11:37:33.937 [opensc-pkcs11] apdu.c:518:sc_transmit:
transmit APDU failed: -1107 (Transmit failed)<br>
11:37:33.937 [opensc-pkcs11] card.c:515:sc_unlock: called<br>
11:37:33.937 [opensc-pkcs11] reader-pcsc.c:759:pcsc_unlock:
called<br>
11:37:33.964 [opensc-pkcs11]
card-coolkey.c:995:coolkey_apdu_io: result r=-1107
apdu.resplen=0 sw1=00 sw2=00<br>
11:37:33.965 [opensc-pkcs11]
card-coolkey.c:1000:coolkey_apdu_io: Transmit failed<br>
11:37:33.965 [opensc-pkcs11]
card-coolkey.c:1023:coolkey_apdu_io: returning with: -1107
(Transmit failed)<br>
11:37:33.965 [opensc-pkcs11] card.c:337:sc_connect_card:
trying driver 'muscle'<br>
11:37:33.965 [opensc-pkcs11] apdu.c:550:sc_transmit_apdu:
called<br>
11:37:33.965 [opensc-pkcs11] card.c:466:sc_lock: called<br>
11:37:33.965 [opensc-pkcs11] reader-pcsc.c:717:pcsc_lock:
called<br>
11:37:34.021 [opensc-pkcs11]
card-muscle.c:844:muscle_card_reader_lock_obtained: called<br>
11:37:34.022 [opensc-pkcs11]
card-muscle.c:852:muscle_card_reader_lock_obtained: returning
with: 0 (Success)<br>
11:37:34.022 [opensc-pkcs11] card.c:505:sc_lock: returning
with: 0 (Success)<br>
11:37:34.022 [opensc-pkcs11] apdu.c:515:sc_transmit: called<br>
11:37:34.022 [opensc-pkcs11] apdu.c:363:sc_single_transmit:
called<br>
11:37:34.022 [opensc-pkcs11] apdu.c:367:sc_single_transmit:
CLA:0, INS:A4, P1:4, P2:0, data(6) 0x7faed39fc070<br>
11:37:34.022 [opensc-pkcs11]
reader-pcsc.c:336:pcsc_transmit: reader 'Microsoft UICC ISO
Reader 699446e9 1'<br>
11:37:34.022 [opensc-pkcs11]
reader-pcsc.c:337:pcsc_transmit: <br>
Outgoing APDU (11 bytes):<br>
00 A4 04 00 06 A0 00 00 00 01 01 ...........<br>
[....]<br>
</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre wrap="" class="moz-quote-pre">_______________________________________________
Opensc-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/opensc-devel">https://lists.sourceforge.net/lists/listinfo/opensc-devel</a>
</pre>
</blockquote>
</body>
</html>
--------------y0l3o7yH9zvMuE8e4vyI5ksl--
--===============2715829135111018333==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============2715829135111018333==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel
--===============2715829135111018333==--