NPA-TOOL(1) OpenSC Tools NPA-TOOL(1) NAME npa-tool - displays information of an ID card or ePassport. SYNOPSIS npa-tool [OPTIONS] DESCRIPTION The npa-tool utility is used to display information stored on an ID card or on a passport and to perform some write and verification operations. Extended Access Control version 2 is performed according to ICAO Doc 9303 or BSI TR-03110 so that an ICAO compliant machine readable travel document (MRTD) as well as EAC compliant ID cards, for example the German ID card (neuer Personalausweis, nPA), may be read. OPTIONS --help, -h Print help and exit. --version, -V Print version and exit. --reader arg, -r arg Number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen. --verbose, -v Causes npa-tool to be more verbose. Specify this flag several times to be more verbose. Password Authenticated Connection Establishment (PACE) --pin [STRING], -p [STRING] Run PACE with (transport) eID-PIN. --puk [STRING], -u [STRING] Run PACE with PUK. --can [STRING], -c [STRING] Run PACE with Card Access Number (CAN). --mrz [STRING], -m [STRING] Run PACE with Machine Readable Zone (MRZ). Enter the MRZ without new- lines. --env Specify whether to use environment variables PIN, PUK, CAN, MRZ, and NEWPIN. You may want to clean your environment before enabling this. (default=off) PIN management --new-pin [STRING], -N [STRING] Install a new PIN. --resume, -R Resume eID-PIN (uses CAN to activate last retry). (default=off) --unblock, -U Unblock PIN (uses PUK to activate three more retries). (default=off) Terminal Authentication (TA) and Chip Authentication (CA) --cv-certificate FILENAME, -C FILENAME Specify Card Verifiable (CV) certificate to create a certificate chain. The option can be given multiple times, in which case the order is im- portant. --cert-desc HEX_STRING Certificate description to show for Terminal Authentication. --chat HEX_STRING Specify the Card Holder Authorization Template (CHAT) to use. If not given, it defaults to the terminal's CHAT. Use 7F4C0E060904007F000703010203530103 to trigger EAC on the CAT-C (Kom- fortleser). --auxiliary-data HEX_STRING, -A HEX_STRING Specify the terminal's auxiliary data. If not given, the default is de- termined by verification of validity, age and community ID. --private-key FILENAME, -P FILENAME Specify the terminal's private key. --cvc-dir DIRECTORY Specify where to look for the certificate of the Country Verifying Cer- tification Authority (CVCA). If not given, it defaults to /home/fm/.lo- cal/etc/eac/cvc. --x509-dir DIRECTORY Specify where to look for the X.509 certificate. If not given, it de- faults to /home/fm/.local/etc/eac/x509. --disable-ta-checks Disable checking the validity period of CV certificates. (default=off) --disable-ca-checks Disable passive authentication. (default=off) Card application --application app What application to select on the card, use eID for the electronic identification application and eMRTD for the ePassport application. (default=eID) Read and write data groups --read-all-dgs Read all available data groups. --read-dg1 Read data group 1. --read-dg2 Read data group 2. --read-dg3 Read data group 3. --read-dg4 Read data group 4. --read-dg5 Read data group 5. --read-dg6 Read data group 6. --read-dg7 Read data group 7. --read-dg8 Read data group 8. --read-dg9 Read data group 9. --read-dg10 Read data group 10. --read-dg11 Read data group 11. --read-dg12 Read data group 12. --read-dg13 Read data group 13. --read-dg14 Read data group 14. --read-dg15 Read data group 15. --read-dg16 Read data group 16. --read-dg17 Read data group 17. --read-dg18 Read data group 18. --read-dg19 Read data group 19. --read-dg20 Read data group 20. --read-dg21 Read data group 21. --write-dg17 HEX_STRING Write data group 17. --write-dg18 HEX_STRING Write data group 18. --write-dg19 HEX_STRING Write data group 19. --write-dg20 HEX_STRING Write data group 20. --write-dg21 HEX_STRING Write data group 21. Verification of validity, age and community ID --verify-validity YYYYMMDD Verify chip's validity with a reference date. --older-than YYYYMMDD Verify age with a reference date. --verify-community HEX_STRING Verify community ID with a reference ID. Special options, not always useful --break, -b Brute force PIN, CAN or PUK. Use together with options -p, -a, or -u. (default=off) --translate FILENAME, -t FILENAME Specify the file with APDUs of HEX_STRINGs to send through the secure channel. (default=`stdin') --tr-03110v201 Force compliance to BSI TR-03110 version 2.01. (default=off) --disable-all-checks Disable all checking of fly-by-data. (default=off) AUTHORS npa-tool was written by Frank Morgner <frankmorgner@gmail.com>. opensc 08/29/2026 NPA-TOOL(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=npa-tool&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>