DTRUST-TOOL(1)

📦
version 0.27.1 · 11 versions
, in fedora 43, fedora 44

💖 DTRUST-TOOL 💖

okay bestie, welcome to dtrust-tool, one of the OpenSC Tools 🎀 this is the little utility that spills all the tea about D-Trust signature cards and also yeets the transport protection off them. no cap. ✨

✨ SYNOPSIS ✨

dtrust-tool [OPTIONS]

🦋 DESCRIPTION 🦋

so the dtrust-tool utility is literally here to two things: display info about your D-Trust signature cards, and remove the initial transport protection. that's the whole vibe. it's giving "small tool, big responsibilities" 💅

🌸 OPTIONS 🌸

  • --reader arg, -r arg — which reader are we using, bestie? 👀 by default it just grabs the first reader that has a card actually present. but plot twist: if arg is an ATR, then it picks the reader whose card matches that ATR instead. iconic behavior tbh.
  • --wait, -w — makes dtrust-tool sit there and wait for you to insert the token into the reader. patient queen energy 🫶
  • --verify-can — okay so D-Trust Card 5 comes with a Card Access Number (CAN) printed right onto the card. its whole job is to establish a secure communication channel between the card and the card reader. normally dtrust-tool just automatically prompts for the CAN whenever it's needed. but under certain circumstances it literally cannot tell whether the CAN is necessary. so:
    • you can call dtrust-tool with just this option to force a CAN verification, and if the CAN proved right it gets saved into the cache 💾 once it's in the cache, you don't need to enter the CAN for that card ever again. slay.
    • also, if you entered a transport PIN wrong two times, the transport PIN gets suspended 😭 you need this parameter together with --unlock-transport-protection to resume the suspended transport PIN for one last attempt. if you fail to enter the transport PIN successfully, the transport PIN is blocked. at that point you need to unblock it with --unblock-pin.
  • --enter-can — there are several ways to provide a CAN, and you can read all about it in the dtrust section of the opensc.conf manpage if you want the deep lore. with this parameter, dtrust-tool prompts you interactively for a CAN and bypasses all the other sources. super useful if you:
    • are entering the CAN for the first time and want it saved in the CAN cache 💾
    • want to bypass the pin pad of the card reader. and fun fact: bypassing the pin pad saves the CAN into the cache as well.

once the CAN is cached, you don't need this parameter anymore. periodt.

  • --pin-status, -s — shows the status of the various PINs 🔍 here's the breakdown:
    • the Card Holder PIN is used for advanced signatures and decryption. it's only defined for signature cards, not for sealing cards.
    • the signature PIN is used for qualified signatures. it can only be used if it's unlocked by presenting the Transport PIN. and once the Transport PIN is used, it cannot be used anymore. one and done, no takebacks 💀
    • the PUK is used to unlock a PIN that has beend entered incorrectly several times. (yes, "beend". we keep the lore exactly as it is. 🎀)
  • --check-transport-protection, -c — in the delivery state, the card is locked by a so-called transport protection 🔒 this option lets you check if the transport protection is still in force. heads up: the Signature PIN can only be used if the transport protection is removed.

initially the transport protection should be intact. if you receive a new card and the transport protection was already broken — don't use that card and contact the producer for further advice. not a drill, bestie 🚨

if you removed the transport protection yourself, it's completely normal for dtrust-tool to report the transport protection as broken. that's just the normal operation state. it does not mean your card is broken. breathe. 😮‍💨

  • --unlock-transport-protection, -u — this command removes the transport protection. it first queries the Transport PIN, and then the new value of the Signature PIN twice. two times. because typos are real 🙈
  • --change-pin — change the specified PIN. the following PINs can be changed:
    • for D-Trust Card 4: PIN.CH, PIN.QES, PUK.CH
    • for D-Trust Card 5: PIN.QES, PIN.AUT, PUK.CH
it is not recommended to change the PUK. 🚫

to change a PIN, you first have to enter the old PIN and then the new PIN value two times.

  • --change-verify — this option specifies the PIN to verify for changing the PIN specified with the --change-pin command. the only useful application of this option is to reset the cardholder PIN (PIN.CH) of D-Trust 4.1 cards by providing the cardholder PUK (PUK.CH). in all other cases, a PIN may only be changed by providing its current value. that's the rule, i don't make them 👑
  • --resume-pin — resume a suspended PIN. this matters only for the PUK (PUK.CH) of D-Trust 5 cards. after two unsuccessful attempts to verify the PUK, the PUK is suspended. to resume the suspended PUK you first have to input the CAN, and then the value of the suspended PUK. ⚠️ and listen: if you enter the wrong PUK again, the PUK is finally blocked and cannot be recovered. no takebacks, no vibes, gone. 😭

to resume a suspended transport PIN, use --unlock-transport-protection together with --can.

  • --unblock-pin — resets the retry counter of a PIN back to its default value. to unblock a PIN, you first have to provide the PUK. the following PINs can be unblocked:
    • for D-Trust Card 4: PIN.T, PIN.CH, PIN.QES
    • for D-Trust Card 5: PIN.T, PIN.T.AUT, PIN.QES, PIN.AUT

it is impossible to unblock a blocked PUK. 💀

please keep in mind that the PUK may only be used a limited number of times — 48 times for D-Trust Card 4 and 5. so count, bestie. 🍓
  • --help, -h — print the help message on screen. classic. 💖
  • --verbose, -v — causes dtrust-tool to be more verbose. specify this flag several times to enable debug output in the opensc library. the more you say it, the more it tells you 🗣️✨

👑 SEE ALSO 👑

opensc.conf(5)

🎀 AUTHORS 🎀

dtrust-tool was written by Mario Haustein <mario.haustein@hrz.tu-chemnitz.de>. thank you mario, absolute legend 💜

and that's the whole page, bestie!! this one came from the opensc source, dated 04/19/2026 — go forth and check those transport protections, but like, responsibly. mwah 💅🌈⭐

📦 where this page comes from