diff --git a/src/libopensc/card-piv.c b/src/libopensc/card-piv.c

index 03c83868f1..794472134c 100644

--- a/src/libopensc/card-piv.c

+++ b/src/libopensc/card-piv.c

@@ -3,7 +3,7 @@

  * card-default.c: Support for cards with no driver

  *

  * Copyright (C) 2001, 2002  Juha Yrjölä <juha.yrjola@iki.fi>

- * Copyright (C) 2005-2016  Douglas E. Engert <deengert@gmail.com>

+ * Copyright (C) 2005-2018  Douglas E. Engert <deengert@gmail.com>

  * Copyright (C) 2006, Identity Alliance, Thomas Harning <thomas.harning@identityalliance.com>

  * Copyright (C) 2007, EMC, Russell Larner <rlarner@rsa.com>

  *

@@ -53,6 +53,7 @@

 #ifdef ENABLE_ZLIB

 #include "compression.h"

 #endif

+#include "simpletlv.h"

 enum {

 	PIV_OBJ_CCC = 0,

@@ -146,6 +147,16 @@ enum {

 	PIV_STATE_INIT

 };

+/* ccc_flags */

+#define PIV_CCC_FOUND		0x00000001

+#define PIV_CCC_F0_PIV		0x00000002

+#define PIV_CCC_F0_CAC		0x00000004

+#define PIV_CCC_F0_JAVA		0x00000008

+#define PIV_CCC_F3_CAC_PKI	0x00000010

+

+#define PIV_CCC_TAG_F0		0xF0

+#define PIV_CCC_TAG_F3		0xF3

+

 typedef struct piv_private_data {

 	int enumtag;

 	int  selected_obj; /* The index into the piv_objects last selected */

@@ -174,6 +185,7 @@ typedef struct piv_private_data {

 	unsigned int card_issues; /* card_issues flags for this card */

 	int object_test_verify; /* Can test this object to set verification state of card */

 	int yubico_version; /* 3 byte version number of NEO or Yubikey4  as integer */

+	unsigned int ccc_flags;	    /* From  CCC indicate if CAC card */

 } piv_private_data_t;

 #define PIV_DATA(card) ((piv_private_data_t*)card->drv_data)

@@ -198,6 +210,37 @@ struct piv_aid {

  * These can be discovered by trying GET DATA

  */

+/* ATRs of cards known to have PIV applet. But must still be tested for a PIV applet */

+static const struct sc_atr_table piv_atrs[] = {

+	/* CAC cards with PIV from: CAC-utilziation-and-variation-matrix-v2.03-20May2016.doc */

+	/* Oberthur Card Systems (PIV Endpoint) with PIV endpoint applet and PIV auth cert OBSOLETE */

+	{ "3B:DB:96:00:80:1F:03:00:31:C0:64:77:E3:03:00:82:90.00:C1", NULL, NULL, SC_CARD_TYPE_PIV_II_OBERTHUR, 0, NULL },

+

+	/* Gemalto (PIV Endpoint) with PIV endpoint applet and PIV auth cert OBSOLETE */

+	{ "3B 7D 96 00 00 80 31 80 65 B0 83 11 13 AC 83 00 90 00", NULL, NULL, SC_CARD_TYPE_PIV_II_GEMALTO, 0, NULL },

+

+	/* Gemalto (PIV Endpoint) 2 entries */

+	{ "3B:7D:96:00:00:80:31:80:65:B0:83:11:17:D6:83:00:90:00", NULL, NULL, SC_CARD_TYPE_PIV_II_GEMALTO, 0, NULL },

+

+	/* Oberthur Card System (PIV Endpoint)  2 entries*/

+	{ "3B:DB:96:00:80:1F:03:00:31:C0:64:B0:F3:10:00:07:90:00:80", NULL, NULL, SC_CARD_TYPE_PIV_II_OBERTHUR, 0, NULL },

+

+	/* Giesecke & Devrient (PIV Endpoint)  2 entries */

+	{ "3B:7A:18:00:00:73:66:74:65:20:63:64:31:34:34", NULL, NULL, SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC, 0, NULL },

+

+	/* PIVKEY from Taligo */

+	/* PIVKEY T600 token and T800  on Feitian eJAVA */

+	{ "3B:FC:18:00:00:81:31:80:45:90:67:46:4A:00:64:2D:70:C1:72:FE:E0:FE", NULL, NULL, SC_CARD_TYPE_PIV_II_PIVKEY, 0, NULL },

+

+	/* PIVKEY C910 */

+	{ "3b:fc:18:00:00:81:31:80:45:90:67:46:4a:00:64:16:06:f2:72:7e:00:e0", NULL, NULL, SC_CARD_TYPE_PIV_II_PIVKEY, 0, NULL },

+

+	/* PIVKEY C980 */

+	{ "3B:f9:96:00:00:81:31:fe:45:53:50:49:56:4b:45:59:37:30:28", NULL, NULL, SC_CARD_TYPE_PIV_II_PIVKEY, 0, NULL },

+

+	{ NULL, NULL, NULL, 0, 0, NULL }

+};

+

 /* all have same AID */

 static struct piv_aid piv_aids[] = {

 	{SC_CARD_TYPE_PIV_II_GENERIC, /* TODO not really card type but what PIV AID is supported */

@@ -209,9 +252,10 @@ static struct piv_aid piv_aids[] = {

 #define CI_VERIFY_630X			    0x00000001U /* VERIFY tries left returns 630X rather then 63CX */

 #define CI_VERIFY_LC0_FAIL		    0x00000002U /* VERIFY Lc=0 never returns 90 00 if PIN not needed */

 							/* will also test after first PIN verify if protected object can be used instead */

+#define CI_NO_RANDOM			    0x00000004U /* can not use Challenge to get random data or no 9B key */

 #define CI_CANT_USE_GETDATA_FOR_STATE	    0x00000008U /* No object to test verification inplace of VERIFY Lc=0 */

 #define CI_LEAKS_FILE_NOT_FOUND		    0x00000010U /* GET DATA of empty object returns 6A 82 even if PIN not verified */

-#define CI_DISCOVERY_USELESS		    0x00000020U /* Discovery can not be used to query active AID */

+#define CI_DISCOVERY_USELESS		    0x00000020U /* Discovery can not be used to query active AID invalid or no data returned */

 #define CI_PIV_AID_LOSE_STATE		    0x00000040U /* PIV AID can lose the login state run with out it*/

 #define CI_OTHER_AID_LOSE_STATE		    0x00000100U /* Other drivers match routines may reset our security state and lose AID!!! */

@@ -219,7 +263,7 @@ static struct piv_aid piv_aids[] = {

 #define CI_NO_RSA2048			    0x00010000U /* does not have RSA 2048 */

 #define CI_NO_EC384			    0x00020000U /* does not have EC 384 */

-

+#define CI_NO_EC			    0x00040000U /* No EC at all */

 /*

  * Flags in the piv_object:

@@ -2222,11 +2266,33 @@ static int piv_get_challenge(sc_card_t *card, u8 *rnd, size_t len)

 	size_t rbuf_len = 0, out_len = 0;

 	int r;

 	unsigned int tag, cla;

+	piv_private_data_t * priv = PIV_DATA(card);

 	LOG_FUNC_CALLED(card->ctx);

+	if (priv->card_issues & CI_NO_RANDOM) {

+		r = SC_ERROR_NOT_SUPPORTED;

+		LOG_TEST_GOTO_ERR(card->ctx, r, "No support for random data");

+	}

+

 	/* NIST 800-73-3 says use 9B, previous verisons used 00 */

 	r = piv_general_io(card, 0x87, 0x00, 0x9B, sbuf, sizeof sbuf, &rbuf, &rbuf_len);

+	/*

+	 * piv_get_challenge is called in a loop. 

+	 * some cards may allow 1 challenge expecting it to be part of 

+	 * NIST 800-73-3 part 2 "Authentication of PIV Card Application Administrator"

+	 * and return "6A 80" if last command was a get_challenge.

+	 * Now that the card returned error, we can try one more time.

+	 */

+	 if (r == SC_ERROR_INCORRECT_PARAMETERS) {

+		if (rbuf)

+			free(rbuf);

+		rbuf_len = 0;

+		r = piv_general_io(card, 0x87, 0x00, 0x9B, sbuf, sizeof sbuf, &rbuf, &rbuf_len);

+		if (r == SC_ERROR_INCORRECT_PARAMETERS) {

+			r = SC_ERROR_NOT_SUPPORTED;

+		}

+	}

 	LOG_TEST_GOTO_ERR(card->ctx, r, "GENERAL AUTHENTICATE failed");

 	p = rbuf;

@@ -2635,6 +2701,91 @@ static int piv_process_discovery(sc_card_t *card)

 	LOG_FUNC_RETURN(card->ctx, r);

 }

+/*

+ * parse a CCC to test  if this is a Dual CAC/PIV

+ * We read teh CCC using the PIV API.

+ * Look for CAC RID=A0 00 00 00 79

+ */

+ static int piv_parse_ccc(sc_card_t *card, u8* rbuf, size_t rbuflen)

+{

+	int r = 0;

+	const u8 * body;

+	size_t bodylen;

+	unsigned int cla_out, tag_out;

+

+	u8  tag;

+	const u8 * end;

+	size_t len;

+

+	piv_private_data_t * priv = PIV_DATA(card);

+

+	SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);

+

+	if (rbuf == NULL || rbuflen == 0) {

+		r = SC_ERROR_WRONG_LENGTH;

+		goto  err;

+	}

+

+	/* Outer layer is a DER tlv */

+	body = rbuf;

+	if ((r = sc_asn1_read_tag(&body, rbuflen, &cla_out, &tag_out,  &bodylen)) != SC_SUCCESS) {

+		sc_log(card->ctx, "DER problem %d",r);

+		r = SC_ERROR_INVALID_ASN1_OBJECT;

+		goto err;

+	}

+

+	priv->ccc_flags |= PIV_CCC_FOUND;

+

+	/* CCC  entries are simple tlv */

+	end = body + bodylen;

+	

+	for(; (body < end); body += len) {

+	

+		r = sc_simpletlv_read_tag((u8**)&body, end - body , &tag, &len;;

+		if (r < 0)

+			goto err;

+		switch (tag) {

+			case PIV_CCC_TAG_F0:

+				if (len == 0x15) {

+					if (memcmp(body ,"\xA0\x00\x00\x03\08", 5) == 0)

+						priv->ccc_flags |= PIV_CCC_F0_PIV;

+					else if (memcmp(body ,"\xA0\x00\x00\x00\x79", 5) == 0)

+						priv->ccc_flags |= PIV_CCC_F0_CAC;

+					if (*(body + 6) == 0x02)

+						priv->ccc_flags |= PIV_CCC_F0_JAVA;

+				}

+				break;

+			case PIV_CCC_TAG_F3:

+				if (len == 0x10) {

+					if (memcmp(body ,"\xA0\x00\x00\x00\x79\x04", 6) == 0)

+						priv->ccc_flags |= PIV_CCC_F3_CAC_PKI;

+				}

+				break;

+		}

+	}

+

+err:

+	LOG_FUNC_RETURN(card->ctx, r);

+}

+

+static int piv_process_ccc(sc_card_t *card)

+{

+	int r = 0;

+	u8 * rbuf = NULL;

+	size_t rbuflen = 0;

+

+	SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE);

+	r = piv_get_cached_data(card, PIV_OBJ_CCC, &rbuf, &rbuflen);

+

+	if (r < 0)

+		goto err;

+

+	/* the object is now cached, see what we have */

+	r = piv_parse_ccc(card, rbuf, rbuflen);

+err:

+	LOG_FUNC_RETURN(card->ctx, r);

+}

+

 static int piv_find_discovery(sc_card_t *card)

 {

@@ -2922,7 +3073,8 @@ piv_finish(sc_card_t *card)

 static int piv_match_card(sc_card_t *card)

 {

 	int r = 0;

-

+	

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d\n", card->type);

 	/* piv_match_card may be called with card->type, set by opensc.conf */

 	/* user provide card type must be one we know */

 	switch (card->type) {

@@ -2931,7 +3083,13 @@ static int piv_match_card(sc_card_t *card)

 		case SC_CARD_TYPE_PIV_II_HIST:

 		case SC_CARD_TYPE_PIV_II_NEO:

 		case SC_CARD_TYPE_PIV_II_YUBIKEY4:

+		case SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC:

 		case SC_CARD_TYPE_PIV_II_GI_DE:

+		case SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_GEMALTO:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR:

+		case SC_CARD_TYPE_PIV_II_PIVKEY:

 			break;

 		default:

 			return 0; /* can not handle the card */

@@ -2950,13 +3108,14 @@ static int piv_match_card(sc_card_t *card)

 		piv_finish(card);

 	}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d r:%d\n", card->type,r);

 	return r;

 }

 static int piv_match_card_continued(sc_card_t *card)

 {

-	int i, r;

+	int i, r = 0;

 	int type  = -1;

 	piv_private_data_t *priv = NULL;

 	int saved_type = card->type;

@@ -2973,12 +3132,19 @@ static int piv_match_card_continued(sc_card_t *card)

 		case SC_CARD_TYPE_PIV_II_HIST:

 		case SC_CARD_TYPE_PIV_II_NEO:

 		case SC_CARD_TYPE_PIV_II_YUBIKEY4:

+		case SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC:

 		case SC_CARD_TYPE_PIV_II_GI_DE:

+		case SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_GEMALTO:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR:

+		case SC_CARD_TYPE_PIV_II_PIVKEY:

 			type = card->type;

 			break;

 		default:

 			return 0; /* can not handle the card */

 	}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d type:%d r:%d\n", card->type, type, r);

 	if (type == -1) {

 		/*

@@ -2997,18 +3163,6 @@ static int piv_match_card_continued(sc_card_t *card)

 					!(memcmp(card->reader->atr_info.hist_bytes, "Yubikey", 7))) {

 				type = SC_CARD_TYPE_PIV_II_NEO;

 			}

-			/*

-			 * https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp1239.pdf

-			 * lists 2 ATRS with historical bytes:

-			 *   73 66 74 65 2D 63 64 30 38 30

-			 *   73 66 74 65 20 63 64 31 34 34

-			 * will check for 73 66 74 65

-			 */

-			else if (card->reader->atr_info.hist_bytes_len >= 4

-					&& !(memcmp(card->reader->atr_info.hist_bytes, "sfte", 4))) {

-				type = SC_CARD_TYPE_PIV_II_GI_DE;

-			}

-

 			else if (card->reader->atr_info.hist_bytes_len > 0

 					&& card->reader->atr_info.hist_bytes[0] == 0x80u) { /* compact TLV */

 				size_t datalen;

@@ -3029,10 +3183,17 @@ static int piv_match_card_continued(sc_card_t *card)

 				}

 			}

 		}

-		if (type == -1)

-			type = SC_CARD_TYPE_PIV_II_GENERIC;

+		sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d type:%d r:%d\n", card->type, type, r);

+

+		if (type == -1) {

+			/* use known ATRs  */

+			i = _sc_match_atr(card, piv_atrs, &type);

+			if (type == -1)

+				type = SC_CARD_TYPE_PIV_II_GENERIC; /* may  still be CAC with PIV Endpoint */

+		}

 	}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d type:%d r:%d\n", card->type, type, r);

 	/* allocate and init basic fields */

 	priv = calloc(1, sizeof(piv_private_data_t));

@@ -3046,6 +3207,7 @@ static int piv_match_card_continued(sc_card_t *card)

 	card->drv_data = priv; /* will free if no match, or pass on to piv_init */

 	priv->selected_obj = -1;

 	priv->pin_preference = 0x80; /* 800-73-3 part 1, table 3 */

+	/* TODO Dual CAC/PIV are bases on 800-73-1 were priv->pin_preference = 0. need to check later */

 	priv->logged_in = SC_PIN_STATE_UNKNOWN;

 	priv->tries_left = 10; /* will assume OK at start */

 	priv->pstate = PIV_STATE_MATCH;

@@ -3064,38 +3226,104 @@ static int piv_match_card_continued(sc_card_t *card)

 	}

 	/*

-	 * detect if active AID is PIV. NIST 800-73 says Only one PIV application per card

-	 * and PIV must be the default application

-	 * This can avoid doing doing a select_aid and losing the login state on some cards

+	 * Detect if active AID is PIV. NIST 800-73 says only one PIV application per card

+	 * and PIV must be the default application.

+	 * Try to avoid doing a select_aid and losing the login state on some cards.

 	 * We may get interference on some cards by other drivers trying SELECT_AID before

-	 * we get to see if PIV application is still active.

+	 * we get to see if PIV application is still active

 	 * putting PIV driver first might help. 

-	 * This may fail if the wrong AID is active

+	 * This may fail if the wrong AID is active.

+	 * Discovery Object introduced in 800-73-3 so will return 0 if found and PIV applet active.

+	 * Will fail with SC_ERROR_FILE_NOT_FOUND if 800-73-3 and no Discovery object.

+	 * But some other card could also return SC_ERROR_FILE_NOT_FOUND.

+	 * Will fail for other reasons if wrong applet is selected, or bad PIV implimentation. 

 	 */

-	i = piv_find_discovery(card);

+	

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d CI:%08x r:%d\n", card->type,  priv->card_issues, r);

+	if (priv->card_issues & CI_DISCOVERY_USELESS) /* TODO may be in wrong place */

+		i = -1;

+	else

+		i = piv_find_discovery(card);

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i:%d CI:%08x r:%d\n", card->type, i, priv->card_issues, r);

 	if (i < 0) {

 		/* Detect by selecting applet */

 		i = piv_find_aid(card);

 	}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i:%d CI:%08x r:%d\n", card->type, i, priv->card_issues, r);

 	if (i >= 0) {

+		int iccc = 0;

+		 /* We now know PIV AID is active, test CCC object  800-73-* say CCC is required */

+		switch (card->type)  {

+			/*

+			 * For cards that may also be CAC, try and read the CCC

+			 * CCC is required and all Dual PIV/CAC will have a CCC

+			 * Currently Dual PIV/CAC are based on NIST 800-73-1 which does not have Discovery or History

+			 */

+			case SC_CARD_TYPE_PIV_II_GENERIC: /* i.e. really dont know what this is */

+			case SC_CARD_TYPE_PIV_II_HIST:

+			case SC_CARD_TYPE_PIV_II_GI_DE:

+			case SC_CARD_TYPE_PIV_II_GEMALTO:

+			case SC_CARD_TYPE_PIV_II_OBERTHUR:

+				iccc = piv_process_ccc(card);

+				sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d iccc:%d ccc_flags:%08x CI:%08x r:%d\n",

+						card->type, iccc, priv->ccc_flags, priv->card_issues, r);

+				/* ignore an error? */

+				/* if CCC says it has CAC with PKI on card set to one of the SC_CARD_TYPE_PIV_II_*_DUAL_CAC */

+				if (priv->ccc_flags & PIV_CCC_F3_CAC_PKI) {

+					switch (card->type)  {

+						case SC_CARD_TYPE_PIV_II_GENERIC:

+						case SC_CARD_TYPE_PIV_II_HIST:

+						case SC_CARD_TYPE_PIV_II_GI_DE:

+						    card->type = SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC;

+						    priv->card_issues |= CI_DISCOVERY_USELESS;

+						    priv->obj_cache[PIV_OBJ_DISCOVERY].flags |= PIV_OBJ_CACHE_NOT_PRESENT;

+						    break;

+						case SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC:

+						case SC_CARD_TYPE_PIV_II_GEMALTO:

+							card->type = SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC;

+							priv->card_issues |= CI_DISCOVERY_USELESS;

+							priv->obj_cache[PIV_OBJ_DISCOVERY].flags |= PIV_OBJ_CACHE_NOT_PRESENT;

+							break;

+						case SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC:

+						case SC_CARD_TYPE_PIV_II_OBERTHUR:

+							card->type =  SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC;

+							priv->card_issues |= CI_DISCOVERY_USELESS;

+							priv->obj_cache[PIV_OBJ_DISCOVERY].flags |= PIV_OBJ_CACHE_NOT_PRESENT;

+							break;

+					}

+				}

+				break;

+

+				/* if user forced it to be one of the CAC types, assume it is CAC */

+			case SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC:

+			case SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC:

+			case SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC:

+				priv->card_issues |= CI_DISCOVERY_USELESS;

+				priv->obj_cache[PIV_OBJ_DISCOVERY].flags |= PIV_OBJ_CACHE_NOT_PRESENT;

+				break;

+			}

+		}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i:%d CI:%08x r:%d\n", card->type, i, priv->card_issues, r);

+	if (i >= 0 && (priv->card_issues & CI_DISCOVERY_USELESS) == 0) {

 		/*

-		 * We now know PIV AID is active, test DISCOVERY object 

-		 * Some CAC cards with PIV don't support DISCOVERY and return 

-		 * SC_ERROR_INCORRECT_PARAMETERS. Any error other then 

-		 * SC_ERROR_FILE_NOT_FOUND means we cannot use discovery 

+		 * We now know PIV AID is active, test DISCOVERY object again 

+		 * Some PIV don't support DISCOVERY and return 

+		 * SC_ERROR_INCORRECT_PARAMETERS. Any error 

+		 * including SC_ERROR_FILE_NOT_FOUND means we cannot use discovery 

 		 * to test for active AID.

 		 */

 		int i7e = piv_find_discovery(card);

-		if (i7e != 0 && i7e !=  SC_ERROR_FILE_NOT_FOUND) {

+		sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i7e:%d CI:%08x r:%d\n", card->type, i7e, priv->card_issues, r);

+		if (i7e != 0) {

 			priv->card_issues |= CI_DISCOVERY_USELESS;

 			priv->obj_cache[PIV_OBJ_DISCOVERY].flags |= PIV_OBJ_CACHE_NOT_PRESENT;

 		}

 	}

-

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i:%d CI:%08x r:%d\n", card->type, i, priv->card_issues, r);

 	if (i < 0) {

 		/* don't match. Does not have a PIV applet. */

 		sc_unlock(card);

@@ -3104,6 +3332,7 @@ static int piv_match_card_continued(sc_card_t *card)

 		return 0;

 	}

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d i:%d CI:%08x r:%d\n", card->type, i, priv->card_issues, r);

 	/* Matched, caller will use or free priv and sc_lock as needed */

 	priv->pstate=PIV_STATE_INIT;

 	return 1; /* match */

@@ -3124,7 +3353,7 @@ static int piv_init(sc_card_t *card)

 	/* continue the matching get a lock and the priv */

 	r = piv_match_card_continued(card);

 	if (r != 1)  {

-		sc_log(card->ctx,"piv_match_card_continued failed");

+		sc_log(card->ctx,"piv_match_card_continued failed card->type:%d", card->type);

 		piv_finish(card);

 		/* tell sc_connect_card to try other drivers */

 		LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_CARD);

@@ -3147,6 +3376,7 @@ static int piv_init(sc_card_t *card)

 	 * Set card_issues based on card type either set by piv_match_card or by opensc.conf

 	 */

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d CI:%08x r:%d\n", card->type, priv->card_issues, r);

 	switch(card->type) {

 		case SC_CARD_TYPE_PIV_II_NEO:

 		case SC_CARD_TYPE_PIV_II_YUBIKEY4:

@@ -3178,6 +3408,7 @@ static int piv_init(sc_card_t *card)

 	 * may be set earlier or later then in the following code. 

 	 */

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d CI:%08x r:%d\n", card->type, priv->card_issues, r);

 	switch(card->type) {

 		case SC_CARD_TYPE_PIV_II_NEO:

 			priv->card_issues |= CI_NO_EC384

@@ -3196,30 +3427,53 @@ static int piv_init(sc_card_t *card)

 				priv->card_issues |= CI_VERIFY_LC0_FAIL;

 			break;

+		case SC_CARD_TYPE_PIV_II_GI_DE:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR:

+		case SC_CARD_TYPE_PIV_II_GEMALTO:

+			priv->card_issues |= 0; /* could add others here */

+			break;

+

 		case SC_CARD_TYPE_PIV_II_HIST:

-			priv->card_issues |= 0;

+			priv->card_issues |= 0; /* could add others here */

 			break;

-		case SC_CARD_TYPE_PIV_II_GI_DE:

+		case SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC:

+		case SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC:

 			priv->card_issues |= CI_VERIFY_LC0_FAIL

 				| CI_PIV_AID_LOSE_STATE

-				| CI_OTHER_AID_LOSE_STATE;;

+				| CI_NO_RANDOM

+				| CI_OTHER_AID_LOSE_STATE;

 			/* TODO may need more research */

 			break;

+

 		case SC_CARD_TYPE_PIV_II_GENERIC:

 			priv->card_issues |= CI_VERIFY_LC0_FAIL

 				| CI_OTHER_AID_LOSE_STATE;

 			/* TODO may need more research */

 			break;

+		case SC_CARD_TYPE_PIV_II_PIVKEY:

+			priv->card_issues |= CI_VERIFY_LC0_FAIL

+				| CI_PIV_AID_LOSE_STATE /* be conservative */

+				| CI_NO_EC384 | CI_NO_EC

+				| CI_NO_RANDOM; /* does not have 9B key */

+				/* Discovery object returns 6A 82 so is not on card by default */

+				/*  TODO may need more research */

+			break;

+

 		default:

-		     priv->card_issues = 0; /* opensc.conf may have it wrong, continue anyway */

-		     sc_log(card->ctx, "Unknown PIV card->type %d", card->type);

-		     card->type = SC_CARD_TYPE_PIV_II_BASE;

+			priv->card_issues |= CI_VERIFY_LC0_FAIL

+				| CI_OTHER_AID_LOSE_STATE;

+			/* opensc.conf may have it wrong, continue anyway */

+			sc_log(card->ctx, "Unknown PIV card->type %d", card->type);

+			card->type = SC_CARD_TYPE_PIV_II_GENERIC;

 	}

 	sc_log(card->ctx, "PIV card-type=%d card_issues=0x%08x", card->type, priv->card_issues);

+	sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH card->type:%d CI:%08x r:%d\n", card->type, priv->card_issues, r);

+

 	priv->enumtag = piv_aids[0].enumtag;

 	/* PKCS#11 may try to generate session keys, and get confused

@@ -3233,15 +3487,20 @@ static int piv_init(sc_card_t *card)

 	_sc_card_add_rsa_alg(card, 2048, flags, 0); /* optional */

 	_sc_card_add_rsa_alg(card, 3072, flags, 0); /* optional */

-	flags = SC_ALGORITHM_ECDSA_RAW | SC_ALGORITHM_ECDH_CDH_RAW | SC_ALGORITHM_ECDSA_HASH_NONE;

-	ext_flags = SC_ALGORITHM_EXT_EC_NAMEDCURVE | SC_ALGORITHM_EXT_EC_UNCOMPRESES;

+	if (!(priv->card_issues & CI_NO_EC)) {

+		flags = SC_ALGORITHM_ECDSA_RAW | SC_ALGORITHM_ECDH_CDH_RAW | SC_ALGORITHM_ECDSA_HASH_NONE;

+		ext_flags = SC_ALGORITHM_EXT_EC_NAMEDCURVE | SC_ALGORITHM_EXT_EC_UNCOMPRESES;

+

+		_sc_card_add_ec_alg(card, 256, flags, ext_flags, NULL);

+		if (!(priv->card_issues & CI_NO_EC384))

+			_sc_card_add_ec_alg(card, 384, flags, ext_flags, NULL);

+	}

-	_sc_card_add_ec_alg(card, 256, flags, ext_flags, NULL);

-	if (!(priv->card_issues & CI_NO_EC384))

-		_sc_card_add_ec_alg(card, 384, flags, ext_flags, NULL);

+	if (!(priv->card_issues & CI_NO_RANDOM))

+		card->caps |= SC_CARD_CAP_RNG;

-	/* TODO may turn off SC_CARD_CAP_ISO7816_PIN_INFO later */

-	card->caps |= SC_CARD_CAP_RNG | SC_CARD_CAP_ISO7816_PIN_INFO;

+	/* May turn off SC_CARD_CAP_ISO7816_PIN_INFO later */

+	card->caps |=  SC_CARD_CAP_ISO7816_PIN_INFO;

 	/*

 	 * 800-73-3 cards may have a history object and/or a discovery object

@@ -3565,11 +3824,13 @@ static int piv_card_reader_lock_obtained(sc_card_t *card, int was_reset)

 	    r =  SC_ERROR_NO_CARD_SUPPORT;

 	} else {

 	    r = piv_find_discovery(card);

+	    sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH piv_find_discovery card->type:%d r:%d\n", card->type, r);

 	}

 	if (r < 0) {

 		if (was_reset > 0 || !(priv->card_issues & CI_PIV_AID_LOSE_STATE)) {

 			r = piv_select_aid(card, piv_aids[0].value, piv_aids[0].len_short, temp, &templen);

+			sc_debug(card->ctx,SC_LOG_DEBUG_MATCH, "PIV_MATCH piv_select_aid card->type:%d r:%d\n", card->type, r);

 		} else {

 			r = 0; /* cant do anything with this card, hope there was no interference */

 		}

diff --git a/src/libopensc/cards.h b/src/libopensc/cards.h

index f4df17fb04..121182bb6a 100644

--- a/src/libopensc/cards.h

+++ b/src/libopensc/cards.h

@@ -136,7 +136,13 @@ enum {

 	SC_CARD_TYPE_PIV_II_HIST,

 	SC_CARD_TYPE_PIV_II_NEO,

 	SC_CARD_TYPE_PIV_II_YUBIKEY4,

+	SC_CARD_TYPE_PIV_II_GI_DE_DUAL_CAC,

 	SC_CARD_TYPE_PIV_II_GI_DE,

+	SC_CARD_TYPE_PIV_II_GEMALTO_DUAL_CAC,

+	SC_CARD_TYPE_PIV_II_GEMALTO,

+	SC_CARD_TYPE_PIV_II_OBERTHUR_DUAL_CAC,

+	SC_CARD_TYPE_PIV_II_OBERTHUR,

+	SC_CARD_TYPE_PIV_II_PIVKEY,

 	/* MuscleApplet */

 	SC_CARD_TYPE_MUSCLE_BASE = 15000,