macOS: sigining in takes 16 seconds

[daringer]

Signing in into macOS using a Nitrokey 3 and PIV takes 16 seconds, to be investigated...

[orolhawion]

@daringer I just did the things as documented here. Unfortunately I cannot provide any logs. On the login screen I just enter the PIV PIN and wait about 16 seconds before the login screen disappears and I get access to my desktop.

[orolhawion]

I found this in the system logs today:

2025-08-21 20:23:38.466936+0200 localhost usbsmartcardreaderd[624]: [com.apple.CryptoTokenKit:ccid] Failed to set frequency and data rate: { messageType: PC_to_RDR_SetDataRateAndClockFrequency dwLength: 8 bSlot: 0 bSeq: 255 bChainParameter: 0 }({ messageType: PC_to_RDR_GetParameters dwLength: 0 bSlot: 0 bSeq: 255 bChainParameter: 0 })

Throwing this into ChatGPT together with the information of using a Nitrokey 3 it suggests the following:

That’s a symptom of Nitrokey 3’s firmware not supporting the optional CCID “data rate negotiation” command. macOS’s CCID driver tries, fails, retries, then falls back — each retry costs seconds.

I do not know if anything of this is true, but perhaps it helps when analyzing the issue.

[orolhawion]

With NK3 firmware 1.8.2 something changed. I was not able to login with the NK3 piv any longer. PIN was accepted, but I suppose the auth request was kind of rejected by the OS.

However, after a factory-reset of the PIV applet and regenerating PIV keys and certs in 9a and 9d, login works again and is significantly faster, like 3-4 seconds in total. I did not change anything on my machine.