NPA-TOOL(1)

NAME
npa-tool - manual page for npa-tool 0.16.0

SYNOPSIS
npa-tool [OPTIONS]...

DESCRIPTION
npa-tool 0.16.0

-h, --help
    Print help and exit

-V, --version
    Print version and exit

-r, --reader=INT
    Number of the PC/SC reader to use (-1 for autodetect) (default=`-1')

-v, --verbose
    Use (several times) to be more verbose

  Password Authenticated Connection Establishment (PACE):

-p, --pin[=STRING]
    Run PACE with (transport) eID-PIN

-u, --puk[=STRING]
    Run PACE with PUK

-c, --can[=STRING]
    Run PACE with CAN

-m, --mrz[=STRING]
    Run PACE with MRZ (insert MRZ without newlines)

--env
    Whether to use environment variables PIN, PUK, CAN, MRZ and NEWPIN. You may want to clean your environment before enabling this. (default=off)

  PIN management:

-N, --new-pin[=STRING]
    Install a new PIN

-R, --resume
    Resume eID-PIN (uses CAN to activate last retry) (default=off)

-U, --unblock
    Unblock PIN (uses PUK to activate three more retries) (default=off)

  Terminal Authentication (TA) and Chip Authentication (CA):

-C, --cv-certificate=FILENAME Card Verifiable Certificate to create a
    certificate chain. Can be used multiple times (order is important).

--cert-desc=HEX_STRING
    Certificate description to show for Terminal Authentication

--chat=HEX_STRING
    Card holder authorization template to use (default is terminal's CHAT). Use 7F4C0E060904007F000703010203530103 to trigger EAC on the CAT-C (Komfortleser).

-A, --auxiliary-data=HEX_STRING
    Terminal's auxiliary data (default is

determined by verification of validity, age
    and community ID).

-P, --private-key=FILENAME
    Terminal's private key

--cvc-dir=DIRECTORY
    Where to look for the CVCA's certificate (default=`/home/fm/.local/etc/eac/cvc')

--x509-dir=DIRECTORY
    Where to look for the CSCA's certificate (default=`/home/fm/.local/etc/eac/x509')

--disable-ta-checks
    Disable checking the validity period of CV certifcates (default=off)

--disable-ca-checks
    Disable passive authentication (default=off)

  Read and write data groups:

--read-dg1
    Read DG 1 (Document Type) (default=off)

--read-dg2
    Read DG 2 (Issuing State) (default=off)

--read-dg3
    Read DG 3 (Date of Expiry) (default=off)

--read-dg4
    Read DG 4 (Given Names) (default=off)

--read-dg5
    Read DG 5 (Family Names) (default=off)

--read-dg6
    Read DG 6 (Religious/Artistic Name) (default=off)

--read-dg7
    Read DG 7 (Academic Title) (default=off)

--read-dg8
    Read DG 8 (Date of Birth) (default=off)

--read-dg9
    Read DG 9 (Place of Birth) (default=off)

--read-dg10
    Read DG 10 (Nationality) (default=off)

--read-dg11
    Read DG 11 (Sex) (default=off)

--read-dg12
    Read DG 12 (Optional Data) (default=off)

--read-dg13
    Read DG 13 (Birth Name) (default=off)

--read-dg14
    Read DG 14 (default=off)

--read-dg15
    Read DG 15 (default=off)

--read-dg16
    Read DG 16 (default=off)

--read-dg17
    Read DG 17 (Normal Place of Residence) (default=off)

--read-dg18
    Read DG 18 (Community ID) (default=off)

--read-dg19
    Read DG 19 (Residence Permit I) (default=off)

--read-dg20
    Read DG 20 (Residence Permit II) (default=off)

--read-dg21
    Read DG 21 (Optional Data) (default=off)

--write-dg17=HEX_STRING
    Write DG 17 (Normal Place of Residence)

--write-dg18=HEX_STRING
    Write DG 18 (Community ID)

--write-dg19=HEX_STRING
    Write DG 19 (Residence Permit I)

--write-dg20=HEX_STRING
    Write DG 20 (Residence Permit II)

--write-dg21=HEX_STRING
    Write DG 21 (Optional Data)

  Verification of validity, age and community ID:

--verify-validity=YYYYMMDD
    Verify chip's validity with a reference date

--older-than=YYYYMMDD
    Verify age with a reference date

--verify-community=HEX_STRING
    Verify community ID with a reference ID

  Special options, not always useful:

-b, --break
    Brute force PIN, CAN or PUK. Use together with -p, -a or -u (default=off)

-t, --translate=FILENAME
    File with APDUs of HEX_STRINGs to send through the secure channel (default=`stdin')

--tr-03110v201
    Force compliance to BSI TR-03110 version 2.01 (default=off)

--disable-all-checks
    Disable all checking of fly-by-data (default=off)

AUTHOR
Written by Frank Morgner <frankmorgner@gmail.com>

REPORTING BUGS
Report bugs to opensc-devel@lists.sourceforge.net