PIV-TOOL(1)

📦
version 0.27.1 · 17 versions
, in fedora 43, fedora 44

💖 PIV-TOOL(1) 💖

okay so bestie, welcome to piv-tool — a smart card utility for HSPD-12 PIV cards, straight out of the OpenSC Tools lineup. ✨

🌸 NAME 🌸

piv-tool — smart card utility for HSPD-12 PIV cards 🪪

✨ SYNOPSIS ✨

piv-tool [OPTIONS]

The way that this works is that piv-tool is a command line utility you can use to do alllll the miscellaneous smart card operations on a HSPD-12 PIV smart card as defined in NIST 800-73-3. It is intended for use with test cards only. 🙈

It can load objects, generate key pairs, and send arbitrary APDU commands to a card — but only after you've authenticated to the card using the card key provided by the card vendor. iykyk. 🔑

🎀 OPTIONS 🎀

  • --serial — Print the card serial number derived from the CHUID object, if any. Output is in hex byte format. ⭐
  • --name, -n — Print the name of the inserted card (driver). 💅
  • --admin argument, -A argument — Authenticate to the card using a 2DES, 3DES or AES key. The argument is of the form
{A|M}:ref:alg

and it is required, where A uses "EXTERNAL AUTHENTICATION" and M uses "MUTUAL AUTHENTICATION". ref is normally 9B, and alg is 03 for 3DES, 01 for 2DES, 08 for AES-128, 0A for AES-192 or 0C for AES-256. The key is provided by the card vendor. The environment variable PIV_EXT_AUTH_KEY must point to either a binary file matching the length of the key or a text file containing the key in the format:

XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
  • --genkey argument, -G argument — Generate a key pair on the card and output the public key. The argument is of the form
ref:alg

and it is required, where ref is 9A, 9C, 9D or 9E and alg is 06, 07, 11 or 14 for RSA 1024, RSA 2048, ECC 256 or ECC 384 respectively. 🔥

  • --object ContainerID, -O ContainerID — Load an object onto the card. The ContainerID is as defined in NIST 800-73-n without leading 0x. Example: CHUID object is 3000. 🫶
  • --cert ref, -C ref — Load a certificate onto the card. ref is 9A, 9C, 9D or 9E. 🎀
  • --compresscert ref, -Z ref — Load a certificate that has been gzipped onto the card. ref is 9A, 9C, 9D or 9E. 🧚
  • --out file, -o file — Output file for any operation that produces output.
  • --in file, -i file — Input file for any operation that requires an input file.
  • --key-slots-discovery file — Print properties of the key slots. Needs 'admin' authentication. 👑
  • --send-apdu apdu, -s apdu — Sends an arbitrary APDU to the card in the format AA:BB:CC:DD:EE:FF.... This option may be repeated. 📨
  • --reader arg, -r arg — Number of the reader to use. By default, the first reader with a present card is used. If arg is an ATR, the reader with a matching card will be chosen. 🌈
  • --wait, -w — Wait for a card to be inserted. ⏳
  • --verbose, -v — Causes piv-tool to be more verbose. Specify this flag several times to enable debug output in the opensc library. 🔍

🦋 SEE ALSO 🦋

opensc-tool(1)

💜 AUTHORS 💜

piv-tool was written by Douglas E. Engert <deengert@gmail.com>. 👑

and that's the whole vibe check, bestie — no cap. 💖 This page is from the opensc source, version-dated 04/19/2026, and it slayed. periodt. 💅✨

📦 where this page comes from