NK3 PIV not working, during python error

Nitrokeys FIDO2 / Nitrokey 3
1

When I call “nitropy nk3 piv” I only see this error about an missing python lib. But the lib exits.

nitropy nk3 piv
Command line tool to interact with Nitrokey devices 0.7.1
Critical error:
This command requires the pyscard library that is not available on your system. Please consult https://docs.nitrokey.com/nitrokeys/nitrokey3/troubleshooting#pyscard-is-not-available for more information

Modules of the virtual Python environment:

pip list
Package             Version
------------------- ------------
appdirs             1.4.4
argparse-addons     0.12.0
asn1crypto          1.5.1
astunparse          1.6.3
bincopy             20.0.0
bitarray            2.9.2
bitstring           4.1.4
capstone            4.0.2
certifi             2024.2.2
cffi                1.16.0
charset-normalizer  3.3.2
click               8.1.3
click-aliases       1.0.1
click-command-tree  1.1.1
click-option-group  0.5.6
cmsis-pack-manager  0.5.3
colorama            0.4.6
crcmod              1.7
cryptography        42.0.5
deepmerge           1.1.1
ecdsa               0.19.0
fastjsonschema      2.19.1
fido2               1.1.3
fire                0.6.0
hexdump             3.3
hidapi              0.14.0.post3
humanfriendly       10.0
idna                3.7
importlib_metadata  7.1.0
importlib_resources 6.4.0
intelhex            2.3.0
intervaltree        3.1.0
lark                1.1.9
libusb-package      1.0.26.1
libusb1             3.1.0
libusbsio           2.1.12
natsort             8.4.0
nethsm              1.2.1
nitrokey            0.2.3
nkdfu               0.2
oscrypto            1.3.0
pip                 24.3.1
platformdirs        4.1.0
prettytable         3.9.0
protobuf            5.28.3
psutil              5.9.8
pycparser           2.22
pyelftools          0.31
pylink-square       1.2.0
pynitrokey          0.7.1
pyocd               0.36.0
pyocd-pemicro       1.1.5
pypemicro           0.1.11
pyscard             2.2.0
pyserial            3.5
python-dateutil     2.7.5
pyusb               1.2.1
PyYAML              6.0.1
requests            2.31.0
ruamel.yaml         0.18.6
ruamel.yaml.clib    0.2.8
semver              3.0.2
setuptools          75.4.0
six                 1.16.0
sly                 0.5
sortedcontainers    2.4.0
spsdk               2.1.1
termcolor           2.4.0
tlv8                0.10.0
tqdm                4.66.4
typing_extensions   4.3.0
urllib3             2.0.7
wcwidth             0.2.13
wheel               0.43.0
zipp                3.18.1

Status of the key:

nitropy nk3 status
Command line tool to interact with Nitrokey devices 0.7.1
UUID:               <REMOVED>
Firmware version:   v1.8.0
Init status:        ok
Free blocks (int):  24
Free blocks (ext):  459
Variant:            LPC55

So what will be the real problem?

2

Did you try what is written under the URL of the error message?
https://docs.nitrokey.com/nitrokeys/nitrokey3/troubleshooting#pyscard-is-not-available

To fix this error, please install nitropy with the pcsc extra dependencies:
pip install pynitrokey[pcsc] pipx install pynitrokey[pcsc]

3

Yes this was the first try.
pip install pynitrokey[pcsc]

4

How did you install pynitrokey, i. e. what does which nitropy say?

5

After creating an virtual python environment via:
<path to the venv>/bin/pip install pynitrokey[pcsc]
which nitropy:
/usr/bin/which: no nitropy
Because it will only accessible via <path to the venv>/bin/nitropy

6

When I’m using the test code(list smart card readers) from pysacard to get an list of the reader’s the code can use the module. So I think the error is not the missing lib.
https://pyscard.sourceforge.io/pyscard-wrapper.html#wrapper-samples
Call:

<path to the venv>/bin/python /tmp/test.py
Context established!
PCSC Readers: ['Nitrokey Nitrokey 3 [CCID/ICCD Interface] 00 00']
PCSC Reader groups: ['SCard$DefaultReaders']
Released context.
7

Please try to run the following Python snippet in the venv. It should show exactly what is going wrong:

import pynitrokey.nk3.piv_app
8

This will give an complete other error:

bin/python -c "import pynitrokey.nk3.piv_app"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "<venv path>/pynitrokey/lib64/python3.12/site-packages/pynitrokey/nk3/piv_app.py", line 6, in <module>
    from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
ModuleNotFoundError: No module named 'cryptography.hazmat.decrepit'
9

Ah, I see, sorry for the confusion. You should be able to fix this problem by updating cryptography to v43.0.3, for example with:

$ pip install cryptography==43.0.3

The lower version requirement for the cryptography dependency is set incorrectly in v0.7.0 and v0.7.1. This is already fixed but not released yet. I will try to publish a release with the fix today.

10

I found the bug.
pynitrokey requites an to old version of cryptography:

Requires-Dist: cryptography (>=41)

Updating cryptography to 44 will fix it.

11

I’ve released v0.7.2 with the fixed dependency specification.

12

Thanks, I will mark is as resolved.