help with multiple smartcard readers Topic is solved

[Lucio Chiappetti]

Ubuntu 24.04.2 LTS
Browser version: 33.9.1
32-bit or 64-bit browser?: 64
Problem URL: n/a

Since a few years (cfr. https://forum.palemoon.org/viewtopic.ph ... 23#p224423) I was happily using a smartcard reader with my national health service (CNS) card. The reader is/was a Trust Alcor Micro Corp. AU9540 Smartcard Reader. I had a CNS-model-dependent .so library loaded into Pale Moon Preferences-> Advanced -> Certificates -> Security Devices
The reader was one of those with a slot in which you insert the card.

Recently I got a new identity card (CIE 3.0) which requires a NFC reader.

The first NFC reader which the shop where I went gave me proved not compatible with Linux. However when I went in the Security devices panel, I could add a new module, load the the CIE specific so library. So I had two readers visible (two modules, each one with one device). Such NFC reader however did not work, and I returned it to the shop, and cleared all.

Now I got a new NFC reader (Bit4ID miniLector AIR NFC v3, which works with Linux). However when I first plugged it in (keeping the old Alcor one in another USB slot) I found that it appeared as a second device of the pre-existing module and library. So I had two devices (the Bit4ID and the Alcor) under a single module (with the CNS .so library). This seemed suspicious to me. So I deleted all (my) entries in the Security devices panel, unplugged the Alcor, switched off the computer. Then I could do a Load of a new module, with the CIE specific /usr/local/lib/libcie-pkcs11.so.

This works nicely with my new CIE.

However presently I cannot use my CNS card, as I have no entry for the Alcor reader. The new Bit4ID reader should recognise the CNS (which is dual, slot insertion and NFC), but of course the CIE library is not compatible.

Whta is the best way to proceed to be able to use both cards ?
In the Security devices panel, when I am on a module, I see 5 buttons (Login, Logout, Change pwd, Load, Unload) of which only the latter two are active (and is
clear to me that they act on the Path of the library. When I am on a device instead Login or Logout are alternately active, also Change pwd, and Load. It is not clear to me what Load does at this stage.

How can I have two separate modules, one for the Bit4Id device and the CIE library, and one for the Alcor and the CNS library ?

Or can I have two device entries for one physical device (typically the Bit4Id) each one with a different library ?

[Gemmaugr]

Completely out of my depth here, both in regard to the cards and certificates, but as an out-of-the-box suggestion, would it not be possible to have one for Pale Moon, and one for Basilisk?

[Lucio Chiappetti]

I was not considering two browsers, nor (something I thought of later) two profiles. Anyhow I found a way ...

First I re-attached both readers (slot Alcor, and NFC bit4id) and switched on the computer. Palemoon saw one module (the CIE pkcs library) with two devices (Alcor and bit4id), but only the NFC one worked, and only with the CIE. So apparently there is some sort of auto-detect.
Then I did a load of a second module (with the CNS library) and exited and re-entered Palemoon. Now I see two modules each one with two devices. It seems somewhat slower at startup (are there conflicts ?) The Alcor device does not work with any of the two modules. The NFC device with a CIE works if invoked from the device attached to the CIE library module, and the same NFC device with a CNS works if invoked from the device attached to the CNS library module (the CNS has bith a chip and NFC capabilities).
So I detached the Alcor device, reset everything and now have two modules each pointing to the same NFC device. I just have to remember to use the right module for each card.

I won't mind however to understand the principle of operations (Moonchild ?)

[Moonchild]

I won't mind however to understand the principle of operations (Moonchild ?)

I don't really have any answers for you. I've not had a need to plug multiple card/chip readers into the browser, and the experience I've had with any such devices has always been through custom software or a plugin, not through the security device interface. And from a code base perspective it's something I barely touched, as well.

[Lucio Chiappetti]

Thanks. Anyhow it looks like that the "module" (i.e. the PKI shared library) rules over the physical device.