I recently bought 2 NK3c NFC and they worked fine until I tried to follow the GPG guide. My goal was to have a master key offline for backup.
I followed the guide a first time with bogus keys to understand how things work, and managed to upload a first gpg key to my nk3, then I went through it again.
The second time I tried keytocard, gpg asked for the gpg passphrase, then the nk3 admin PIN, asked me to confirm I wanted to replace the existing key. The NK3 LED blinked green for about 3 seconds, then went solid red.
After waiting a few minutes, I hit ctrl+c and tried nitropy nk3 test which gets stuck:
❯ nitropy nk3 test
Command line tool to interact with Nitrokey devices 0.11.2
(nothing happens here for several minutes)
I see nothing in journalctl nor in dmesg.
After another ctrl+c, I tried
❯ nitropy nk3 reboot
Command line tool to interact with Nitrokey devices 0.11.2
Critical error:
An unhandled exception occurred
Exception encountered: CtapError('CTAP error: 0x00 - SUCCESS')
--------------------------------------------------------------------------------
Critical error occurred, exiting now
Unexpected? Is this a bug? Would you like to get support/help?
- You can report issues at: https://support.nitrokey.com/
- Writing an e-mail to support@nitrokey.com is also possible
- Please attach the log: '/tmp/nitropy-20260224T141414-cjkanv2f.log' with any support/help request!
- Please check if you have udev rules installed: https://docs.nitrokey.com/nitrokeys/nitrokey3/firmware-update#troubleshooting-linux
The logfile contains the following:
602 INFO pynitrokey.cli Timestamp: 2026-02-24 14:14:15.362004
603 INFO pynitrokey.cli OS: uname_result(system='Linux', node='hostname', release='6.17.13+deb14-amd64', version='#1 SMP PREEMPT_DYNAMIC Debian 6.17.13-1 (2025-12-20)', machine='x86_64')
603 INFO pynitrokey.cli Python version: 3.13.11
603 INFO pynitrokey.cli Cli arguments: ['nk3', 'reboot']
606 INFO pynitrokey.cli pynitrokey version: 0.11.2
607 INFO pynitrokey.cli cryptography version: 46.0.3
608 INFO pynitrokey.cli fido2 version: 2.0.0
611 INFO pynitrokey.cli nethsm version: 1.4.1
612 INFO pynitrokey.cli nitrokey version: 0.4.2
612 INFO pynitrokey.cli pyusb version: 1.3.1
684 DEBUG fido2.hid.linux Failed opening device /dev/hidraw4
Traceback (most recent call last):
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 96, in list_descriptors
devices.append(get_descriptor(hidraw))
~~~~~~~~~~~~~~^^^^^^^^
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 53, in get_descriptor
with open(path, "rb") as f:
~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/dev/hidraw4'
686 DEBUG fido2.hid.linux Failed opening device /dev/hidraw3
Traceback (most recent call last):
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 96, in list_descriptors
devices.append(get_descriptor(hidraw))
~~~~~~~~~~~~~~^^^^^^^^
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 53, in get_descriptor
with open(path, "rb") as f:
~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/dev/hidraw3'
687 DEBUG fido2.hid.linux Failed opening device /dev/hidraw2
Traceback (most recent call last):
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 96, in list_descriptors
devices.append(get_descriptor(hidraw))
~~~~~~~~~~~~~~^^^^^^^^
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 53, in get_descriptor
with open(path, "rb") as f:
~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/dev/hidraw2'
688 DEBUG fido2.hid.linux Failed opening device /dev/hidraw1
Traceback (most recent call last):
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 96, in list_descriptors
devices.append(get_descriptor(hidraw))
~~~~~~~~~~~~~~^^^^^^^^
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 53, in get_descriptor
with open(path, "rb") as f:
~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/dev/hidraw1'
688 DEBUG fido2.hid.linux Failed opening device /dev/hidraw0
Traceback (most recent call last):
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 96, in list_descriptors
devices.append(get_descriptor(hidraw))
~~~~~~~~~~~~~~^^^^^^^^
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/linux.py", line 53, in get_descriptor
with open(path, "rb") as f:
~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/dev/hidraw0'
816 WARNING pynitrokey.cli An unhandled exception occurred
Traceback (most recent call last):
File "/nix/store/cx7is7lvdg5g1xapxq25fk8cg21ffycl-python3.13-pynitrokey-0.11.2/lib/python3.13/site-packages/pynitrokey/cli/__init__.py", line 141, in main
nitropy()
~~~~~~~^^
[ stacktrace removed ]
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/__init__.py", line 232, in _do_call
raise CtapError(struct.unpack_from(">B", recv)[0])
fido2.ctap.CtapError: CTAP error: 0x00 - SUCCESS
824 DEBUG root print: Critical error:
824 DEBUG root print: An unhandled exception occurred
824 ERROR root CTAP error: 0x00 - SUCCESS
Traceback (most recent call last):
[ stacktrace removed ]
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/__init__.py", line 232, in _do_call
raise CtapError(struct.unpack_from(">B", recv)[0])
fido2.ctap.CtapError: CTAP error: 0x00 - SUCCESS
829 DEBUG root listing all connected devices:
836 DEBUG root :: 'Nitrokey FIDO2' keys
836 DEBUG root :: 'Nitrokey Start' keys:
856 DEBUG root :: 'NK3' keys
876 DEBUG root Unable to list devices. See log for the details.
876 ERROR root Unable to list devices
Traceback (most recent call last):
[ stacktrace removed ]
File "/nix/store/z6v2y6axcpaccc6m8cynfkga9wlk4a90-python3.13-fido2-2.0.0/lib/python3.13/site-packages/fido2/hid/__init__.py", line 232, in _do_call
raise CtapError(struct.unpack_from(">B", recv)[0])
fido2.ctap.CtapError: CTAP error: 0x00 - SUCCESS
885 DEBUG root print: --------------------------------------------------------------------------------
885 DEBUG root print: Critical error occurred, exiting now
885 DEBUG root print: Unexpected? Is this a bug? Would you like to get support/help?
885 DEBUG root print: - You can report issues at: https://support.nitrokey.com/
885 DEBUG root print: - Writing an e-mail to support@nitrokey.com is also possible
885 DEBUG root print: - Please attach the log: '/tmp/nitropy-20260224T141414-cjkanv2f.log' with any support/help request!
885 DEBUG root print: - Please check if you have udev rules installed: https://docs.nitrokey.com/nitrokeys/nitrokey3/firmware-update#troubleshooting-linux
Interestingly, after about 10 more minutes (so around 20 minutes after the LED turned red), the LED goes off, and I can now do a nitropy nk3 reboot with no error.
Trying the keytocard leads to the same problem again though.
The same problem happened with my second key, so I imagine it’s not a hardware issue.
I have installed the udev rules (this is on debian sid) but it doesn’t seem to make any difference.
Is this a software bug?
edit
I forgot to mention versions (this is after unplugging/replugging the nk3):
❯ nitropy version
Command line tool to interact with Nitrokey devices 0.11.2
0.11.2
❯ nitropy nk3 test
Command line tool to interact with Nitrokey devices 0.11.2
Found 1 NK3 device(s):
- Nitrokey 3 at /dev/hidraw5
Running tests for Nitrokey 3 at /dev/hidraw5
[1/5] uuid UUID query SUCCESS 7B2893666C059456820AEBBDEF2E6B5B
[2/5] version Firmware version query SUCCESS v1.8.3
[3/5] status Device status SUCCESS Status(init_status=<InitStatus: 0>, ifs_blocks=48, efs_blocks=471, variant=<Variant.LPC55: 1>)
Running SE050 test: |
[4/5] se050 SE050 SUCCESS SE050 firmware version: 3.1.1 - 1.11, (persistent: (32767,), transient_deselect: (607,), transient_reset: (592,))
Please press the touch button on the device ...
Please press the touch button on the device ...
[5/5] fido2 FIDO2 SUCCESS
5 tests, 5 successful, 0 skipped, 0 failed
Summary: 1 device(s) tested, 1 successful, 0 failed