NPA-TOOL(1)

    .SH "NAME" npa-tool - displays information on the German eID card (neuer Personalausweis, nPA).
    .SH "SYNOPSIS"
        .HP u
            npa-tool
             [OPTIONS]

    .SH "DESCRIPTION"

        .PP The npa-tool utility is used to display information stored on the German eID card (neuer Personalausweis, nPA), and to perform some write and verification operations.

    .SH "OPTIONS"

        .PP
                .PP --help, -h

                        Print help and exit.
                    .RE
                    .PP --version, -V

                            Print version and exit.
                        .RE
                        .PP --reader arg, -r arg

                                Number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen.
                            .RE
                            .PP --verbose, -v

                                    Causes npa-tool to be more verbose. Specify this flag several times to be more verbose.
                                .RE

                        .SS "Password Authenticated Connection Establishment (PACE)"

                                .PP --pin [STRING], -p [STRING]

                                        Run PACE with (transport) eID-PIN.
                                    .RE
                                    .PP --puk [STRING], -u [STRING]

                                            Run PACE with PUK.
                                        .RE
                                        .PP --can [STRING], -c [STRING]

                                                Run PACE with Card Access Number (CAN).
                                            .RE
                                            .PP --mrz [STRING], -m [STRING]

                                                    Run PACE with Machine Readable Zone (MRZ). Enter the MRZ without newlines.
                                                .RE
                                                .PP --env

                                                        Specify whether to use environment variables PIN, PUK, CAN, MRZ, and NEWPIN. You may want to clean your environment before enabling this. (default=off)
                                                    .RE

                                            .SS "PIN management"

                                                    .PP --new-pin [STRING], -N [STRING]

                                                            Install a new PIN.
                                                        .RE
                                                        .PP --resume, -R

                                                                Resume eID-PIN (uses CAN to activate last retry). (default=off)
                                                            .RE
                                                            .PP --unblock, -U

                                                                    Unblock PIN (uses PUK to activate three more retries). (default=off)
                                                                .RE

                                                        .SS "Terminal Authentication (TA) and Chip Authentication (CA)"

                                                                .PP --cv-certificate FILENAME, -C FILENAME

                                                                        Specify Card Verifiable (CV) certificate to create a certificate chain. The option can be given multiple times, in which case the order is important.
                                                                    .RE
                                                                    .PP --cert-desc HEX_STRING

                                                                            Certificate description to show for Terminal Authentication.
                                                                        .RE
                                                                        .PP --chat HEX_STRING

                                                                                Specify the Card Holder Authorization Template (CHAT) to use. If not given, it defaults to the terminal's CHAT. Use 7F4C0E060904007F000703010203530103 to trigger EAC on the CAT-C (Komfortleser).
                                                                            .RE
                                                                            .PP --auxiliary-data HEX_STRING, -A HEX_STRING

                                                                                    Specify the terminal's auxiliary data. If not given, the default is determined by verification of validity, age and community ID.
                                                                                .RE
                                                                                .PP --private-key FILENAME, -P FILENAME

                                                                                        Specify the terminal's private key.
                                                                                    .RE
                                                                                    .PP --cvc-dir DIRECTORY

                                                                                            Specify where to look for the certificate of the Country Verifying Certification Authority (CVCA). If not given, it defaults to /home/fm/.local/etc/eac/cvc.
                                                                                        .RE
                                                                                        .PP --x509-dir DIRECTORY

                                                                                                Specify where to look for the X.509 certificate. If not given, it defaults to /home/fm/.local/etc/eac/x509.
                                                                                            .RE
                                                                                            .PP --disable-ta-checks

                                                                                                    Disable checking the validity period of CV certificates. (default=off)
                                                                                                .RE
                                                                                                .PP --disable-ca-checks

                                                                                                        Disable passive authentication. (default=off)
                                                                                                    .RE

                                                                                            .SS "Read and write data groups"

                                                                                                    .PP --read-dg1

                                                                                                            Read data group 1: Document Type.
                                                                                                        .RE
                                                                                                        .PP --read-dg2

                                                                                                                Read data group 2: Issuing State.
                                                                                                            .RE
                                                                                                            .PP --read-dg3

                                                                                                                    Read data group 3: Date of Expiry.
                                                                                                                .RE
                                                                                                                .PP --read-dg4

                                                                                                                        Read data group 4: Given Name(s).
                                                                                                                    .RE
                                                                                                                    .PP --read-dg5

                                                                                                                            Read data group 5: Family Name.
                                                                                                                        .RE
                                                                                                                        .PP --read-dg6

                                                                                                                                Read data group 6: Religious/Artistic Name.
                                                                                                                            .RE
                                                                                                                            .PP --read-dg7

                                                                                                                                    Read data group 7: Academic Title.
                                                                                                                                .RE
                                                                                                                                .PP --read-dg8

                                                                                                                                        Read data group 8: Date of Birth.
                                                                                                                                    .RE
                                                                                                                                    .PP --read-dg9

                                                                                                                                            Read data group 9: Place of Birth.
                                                                                                                                        .RE
                                                                                                                                        .PP --read-dg10

                                                                                                                                                Read data group 10: Nationality.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg11

                                                                                                                                                Read data group 11: Sex.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg12

                                                                                                                                                Read data group 12: Optional Data.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg13

                                                                                                                                                Read data group 13: Birth Name.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg14

                                                                                                                                                Read data group 14.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg15

                                                                                                                                                Read data group 15.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg16

                                                                                                                                                Read data group 16.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg17

                                                                                                                                                Read data group 17: Normal Place of Residence.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg18

                                                                                                                                                Read data group 18: Community ID.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg19

                                                                                                                                                Read data group 19: Residence Permit I.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg20

                                                                                                                                                Read data group 20: Residence Permit II.
                                                                                                                                            .RE
                                                                                                                                            .PP --read-dg21

                                                                                                                                                Read data group 21: Optional Data.
                                                                                                                                            .RE
                                                                                                                                            .PP --write-dg17 HEX_STRING

                                                                                                                                                Write data group 17: Normal Place of Residence.
                                                                                                                                            .RE
                                                                                                                                            .PP --write-dg18 HEX_STRING

                                                                                                                                                Write data group 18: Community ID.
                                                                                                                                            .RE
                                                                                                                                            .PP --write-dg19 HEX_STRING

                                                                                                                                                Write data group 19: Residence Permit I.
                                                                                                                                            .RE
                                                                                                                                            .PP --write-dg20 HEX_STRING

                                                                                                                                                Write data group 20: Residence Permit II.
                                                                                                                                            .RE
                                                                                                                                            .PP --write-dg21 HEX_STRING

                                                                                                                                                Write data group 21: Optional Data.
                                                                                                                                            .RE

                                                                                                                                    .SS "Verification of validity, age and community ID"

                                                                                                                                            .PP --verify-validity YYYYMMDD

                                                                                                                                                Verify chip's validity with a reference date.
                                                                                                                                            .RE
                                                                                                                                            .PP --older-than YYYYMMDD

                                                                                                                                                Verify age with a reference date.
                                                                                                                                            .RE
                                                                                                                                            .PP --verify-community HEX_STRING

                                                                                                                                                Verify community ID with a reference ID.
                                                                                                                                            .RE

                                                                                                                                    .SS "Special options, not always useful"

                                                                                                                                            .PP --break, -b

                                                                                                                                                Brute force PIN, CAN or PUK. Use together with options -p, -a, or -u. (default=off)
                                                                                                                                            .RE
                                                                                                                                            .PP --translate FILENAME, -t FILENAME

                                                                                                                                                Specify the file with APDUs of HEX_STRINGs to send through the secure channel. (default=`stdin')
                                                                                                                                            .RE
                                                                                                                                            .PP --tr-03110v201

                                                                                                                                                Force compliance to BSI TR-03110 version 2.01. (default=off)
                                                                                                                                            .RE
                                                                                                                                            .PP --disable-all-checks

                                                                                                                                                Disable all checking of fly-by-data. (default=off)
                                                                                                                                            .RE

                                                                                                                                .SH "AUTHORS"

                                                                                                                                    .PP npa-tool was written by Frank Morgner <frankmorgner@gmail.com>.