scdaemon

scdaemon, the smart card daemon, is a component of the GnuPG (GNU Privacy Guard) suite that provides the low-level interface between GnuPG and physical smart cards or USB security tokens. It runs as a background daemon and communicates with card readers using the PC/SC (and CCID) standards. When a compatible card is present, gpg-agent requests cryptographic operations through scdaemon, which delegates them to the card.

Private keys remain on the card; scdaemon does not extract them. Instead, it forwards signing, decryption, and authentication requests to the card, which performs the operations internally. PIN entry and access control are mediated through the pinentry program, and the card enforces its own security policy (such as retry limits).

scdaemon supports a range of OpenPGP devices, including OpenPGP cards and USB tokens like YubiKey that implement an OpenPGP applet, as well as other CCID/PC/SC compliant cards. It can manage multiple readers and works with gpg-agent to enable features such as SSH authentication using OpenPGP keys on the card.

Configuration is performed through scdaemon.conf, which specifies reader assignments, timeouts, logging, and other behaviors. On startup, gpg-agent can launch scdaemon on demand, or it can run in the foreground for debugging. The tool is widely used in conjunction with GnuPG, gpg-agent, and pinentry.

See also: GnuPG, gpg-agent, PC/SC, CCID, OpenPGP, YubiKey.