DTRUST-TOOL(1) OpenSC Tools DTRUST-TOOL(1) NAME dtrust-tool - displays information about D-Trust signature cards and remove the transport protection SYNOPSIS dtrust-tool [OPTIONS] DESCRIPTION The dtrust-tool utility is used to display information about D-Trust signa- ture cards and to remove the initial transport protection. OPTIONS --reader arg, -r arg Number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen. --wait, -w Causes dtrust-tool to wait for the token to be inserted into reader. --verify-can, D-Trust Card 5 comes with a Card Access Number (CAN) printed onto the card. The purpose of this number is to establish a secure communication channel between the card and the card reader. In normal operation dtrust-tool automatically prompts for the CAN when necessary. Under certain circumstances dtrust-tool cannot decide whether the CAN is nec- essary. * You may call dtrust-tool with just this option to force a CAN veri- fication, which saves the CAN into the cache if it proved right. Once the CAN was saved into the cache, You do not need to enter the CAN of this card again. * In case you entered a transport PIN wrong two times, the transport PIN is suspended. You need this parameter together with --un- lock-transport-protection to resume the suspended transport PIN for a last attempt. Failing to enter the transport PIN successfully blocks the transport PIN. You then need to unblock the transport PIN with --unblock-pin. --enter-can, There are several ways to provide a CAN. See the dtrust section in the opensc.conf manpage for details. With this parameter dtrust-tool will prompt interactively for a CAN, bypassing all other sources. This is useful if you: * enter the CAN for the first time and want it to be saved in the CAN cache * want to bypass the pin pad of card reader. Bypassing the pin pad will save the CAN into the cache as well. Once the CAN is cached, you do not need this parameter anymore. --pin-status, -s Show the status of the various PINs. The Card Holder PIN is used for advanced signatures and decryption. It is only defined for signature cards, but not for sealing cards. The signature PIN is used for quali- fied signatures. It can only be used if it is unlocked by presenting the Transport PIN. Once the Transport PIN is used, it cannot be used anymore. The PUK is used to unlock PIN which had beend entered incor- rectly several times. --check-transport-protection, -c In the delivery state the card is locked by a so called transport pro- tection. This option allows to check if the transport protection is still in force. The Signature PIN can only be used if the transport protection is removed. Initially the transport protection should be intact. If you receive a new card and the transport protection was already broken, don't use that card and contact the producer for further advice. If you removed the transport protection, it is normal that dtrust-tool reports the transport protection as broken. This is the normal opera- tion state. It does not mean your card is broken. --unlock-transport-protection, -u This command removes the transport protection. It first queries the Transport PIN and then the new value of the Signature PIN twice. --change-pin, Change the specified PIN. The following PINs can be changed: * For D-Trust Card 4: PIN.CH, PIN.QES, PUK.CH * For D-Trust Card 5: PIN.QES, PIN.AUT, PUK.CH It is not recommended to change the PUK. To change a PIN, you first have to enter the old PIN and then the new PIN value two times. --change-verify, This option specifies the PIN to verify for changing the PIN specified with the --change-pin command. The only useful application of this op- tion is to reset the cardholder PIN (PIN.CH) of D-Trust 4.1 cards by providing the cardholder PUK (PUK.CH). In all other cases, a PIN may only changed by providing its current value. --resume-pin, Resume a suspended PIN. This matters only for the PUK (PUK.CH) of D-Trust 5 cards. After two unsuccessful attempts to verify the PUK, the PUK is suspended. To resume the suspended PUK you first have to input the CAN and then the value of the suspended PUK. If you enter the wrong PUK again, the PUK is finally blocked and cannot be recovered. To resume a suspended transport PIN use --unlock-transport-protection together with --can. --unblock-pin, Reset the retry counter of a PIN to its default value. To unblock a PIN, you first have to provide the PUK. The following PINs can be un- blocked: * For D-Trust Card 4: PIN.T, PIN.CH, PIN.QES * For D-Trust Card 5: PIN.T, PIN.T.AUT, PIN.QES, PIN.AUT It is impossible to unblock a blocked PUK. Please keep in mind that the PUK may only be used a limited number of times (48 times for D-Trust Card 4 and 5). --help, -h Print help message on screen. --verbose, -v Causes dtrust-tool to be more verbose. Specify this flag several times to enable debug output in the opensc library. SEE ALSO opensc.conf(5) AUTHORS dtrust-tool was written by Mario Haustein <mario.haustein@hrz.tu-chem- nitz.de>. opensc 08/29/2026 DTRUST-TOOL(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | SEE ALSO | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=dtrust-tool&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>