[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92582":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},92582,"cnie-python-tools","hufon\u002Fcnie-python-tools","hufon","Experimental Python toolkit for reading the French National Identity Card (*Carte Nationale d'Identité*, CNI) via a PC\u002FSC **contact** smart card reader, using PACE-CAN authentication and Secure Messaging.",null,"Python",83,10,1,0,32,46.32,"MIT License",false,"main",true,[],"2026-07-22 04:02:06","# cnie-python-tools\n\nExperimental Python toolkit for reading the French National Identity Card (*Carte Nationale d'Identité*, CNI) via a PC\u002FSC **contact** smart card reader, using PACE-CAN authentication and Secure Messaging.\n\n> **Disclaimer:** This project is for educational and research purposes only. Use it solely on cards you own or have explicit permission to read.\n\n---\n\n## What it does\n\nModern French CNIs (issued since 2021) embed a chip that stores biographic data and a facial image in the ICAO LDS (Logical Data Structure) format ([ICAO Doc 9303](https:\u002F\u002Fwww.icao.int\u002Fpublications\u002Fpages\u002Fpublication.aspx?docnum=9303)). This toolkit:\n\n- **Authenticates** to the chip using PACE-CAN (Password Authenticated Connection Establishment with the Card Access Number printed on the card), implemented with BrainpoolP256r1 ECDH + AES-CBC-CMAC-256.\n- **Establishes** a Secure Messaging (SM) session to protect all subsequent exchanges.\n- **Reads and parses** ICAO LDS Data Groups:\n  - **DG1** — MRZ (Machine Readable Zone): document number, name, birth date, nationality, expiry date\n  - **DG2** — Facial image (JPEG \u002F JPEG 2000)\n  - **DG11 \u002F DG12** — Additional personal details (best-effort)\n  - **DG13** — France-specific operator data: address, place of birth, height (best-effort)\n  - **DG14** — Security infos (OID list)\n  - **EF.SOD** — Document Security Object: hash verification of all read DGs\n- **Dumps** raw binary EF\u002FDG files and a structured `summary.json`.\n\n---\n\n## What to expect\n\n### Tested readers\n\n| Reader | Interface | Status |\n|---|---|---|\n| ACS ACR38U | Contact | ✅ Primary supported hardware |\n| ACS ACR39U | Contact | ✅ Primary supported hardware |\n| HID Omnikey 3021 | Contact | ✅ Primary supported hardware |\n| ACS ACR122U | Contactless (NFC) | ✅ Confirmed working (community report) — full PACE-CAN + DG1\u002FDG2\u002FDG11\u002FDG12\u002FDG13\u002FDG14 read successfully |\n\n> **Biometric data cannot be extracted by this tool.**\n> DG3 (fingerprints) and DG4 (iris scan) are protected by Extended Access Control (EAC), a PKI-based protocol that requires a government-issued terminal certificate. Without it, the card returns `6982` (security status not satisfied). This tool implements PACE-CAN only and has no EAC support.\n\n- All DGs accessible without EAC are read.\n- DG hash verification against EF.SOD is implemented. **Full CMS certificate chain verification is not yet implemented.**\n- DG13 parsing is best-effort, based on the field layout observed on French CNI samples — it is not a universal ICAO standard and may vary across card versions.\n- Reading uses short APDUs only, in chunks of `0xE0` bytes.\n\n---\n\n## Hardware requirement\n\nA **PC\u002FSC-compatible smart card reader** is required. This includes:\n\n- **Contact readers** (e.g. ACS ACR38U, ACS ACR39U, HID Omnikey 3021) — primary supported hardware.\n- **NFC\u002Fcontactless readers** (e.g. ACS ACR122U) — **confirmed working** for PACE-CAN authentication and DG1\u002FDG2\u002FDG11\u002FDG12\u002FDG13\u002FDG14 reads. Community-tested, not part of the primary test matrix; results may vary depending on card positioning on the antenna.\n\n> **Note:** The French CNI chip supports a dual interface (contact + contactless), so both reader types can access it. Contactless reads may be more sensitive to card placement\u002Ftiming than contact reads due to RF coupling.\n\n---\n\n## System dependencies\n\n`pyscard` requires a PC\u002FSC stack at the OS level.\n\n**Fedora \u002F RHEL:**\n```bash\nsudo dnf install pcsc-lite pcsc-lite-ccid pcsc-lite-devel swig python3-devel\nsudo systemctl enable --now pcscd\n```\n\n**Debian \u002F Ubuntu:**\n```bash\nsudo apt install pcscd libpcsclite-dev swig python3-dev\nsudo systemctl enable --now pcscd\n```\n\n---\n\n## Installation\n\nRequires Python ≥ 3.11.\n\nUsing [uv](https:\u002F\u002Fgithub.com\u002Fastral-sh\u002Fuv) (recommended):\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FYOUR_USERNAME\u002Fcnie-python-tools.git\ncd cnie-python-tools\nuv sync\n```\n\nUsing pip:\n\n```bash\npip install -e .\n```\n\n---\n\n## Usage\n\n```bash\nuv run cnie-dump --out .\u002Fdump\n```\n\nThe CAN (6-digit number printed on the front of the card, bottom-right) is prompted interactively with hidden input. It can also be passed directly:\n\n```bash\nuv run cnie-dump --can 123456 --out .\u002Fdump\n```\n\n| Option | Description |\n|---|---|\n| `--can CAN` | Card Access Number (prompted if omitted) |\n| `--out DIR` | Output directory (default: `cnie_dump`) |\n| `--trace` | Print raw APDU and SM traces |\n| `--no-sod` | Skip reading EF.SOD |\n\n---\n\n## Output\n\n| File | Content |\n|---|---|\n| `ef_com.bin` | Raw EF.COM |\n| `ef_sod.bin` | Raw EF.SOD (if read) |\n| `dg1.bin` … `dg14.bin` | Raw Data Group files |\n| `dg2_photo.jpg` \u002F `.jp2` \u002F `.j2k` | Extracted facial image |\n| `summary.json` | Parsed structured data |\n\n`summary.json` includes:\n\n- `DG1` — Parsed MRZ fields\n- `DG2` — Photo extraction status\n- `DG3` — Present on the card but not readable without EAC (`6982`)\n- `DG13` — Best-effort France-specific fields: height, address, place of birth\n- `DG14` — List of security OIDs from SecurityInfos\n- `SOD` — Hash algorithm, per-DG hash values, and verification result\n\n---\n\n## Project structure\n\n```\ncnie\u002F\n├── pcsc.py              # PC\u002FSC transport layer\n├── pace.py              # PACE-CAN (BrainpoolP256r1 ECDH + AES-CBC-CMAC-256)\n├── secure_messaging.py  # SM session state, DO87\u002FDO97\u002FDO99\u002FDO8E wrapping\u002Funwrapping\n├── lds.py               # AID selection, EF.COM, EF.SOD, resilient DG reading\n├── datagroups.py        # DG1\u002FDG2\u002FDG11–DG14 parsers\n├── sod.py               # EF.SOD hash extraction and DG hash verification\n├── apdu.py              # APDU helpers\n├── crypto.py            # Cryptographic primitives\n└── tlv.py               # BER-TLV parser\n```\n\n---\n\n## Known limitations\n\n- **No EAC support** — DG3 (fingerprints) and DG4 (iris scan) are protected by EAC (Extended Access Control), a PKI-based protocol requiring a government-issued terminal certificate. These DGs always return `6982` and **cannot be read by this tool**.\n- **No CMS signature verification** — EF.SOD embeds a CMS-signed structure with a certificate chain up to the CSCA (Country Signing Certificate Authority). Full chain verification is not yet implemented.\n- **DG13 is France-specific** — Field interpretation is based on observed samples and may be inaccurate for other card generations.\n- **Primarily tested with contact readers** — NFC\u002Fcontactless access has been confirmed to work with the ACS ACR122U, but is not part of the primary test matrix. Behavior with other contactless readers is unverified.\n- **Short APDUs only** — APDU command chaining is not used.\n\n---\n\n## References\n\n- [ICAO Doc 9303 — Machine Readable Travel Documents](https:\u002F\u002Fwww.icao.int\u002Fpublications\u002Fpages\u002Fpublication.aspx?docnum=9303)\n- [BSI TR-03110 — Advanced Security Mechanisms for MRTD (PACE)](https:\u002F\u002Fwww.bsi.bund.de\u002FEN\u002FThemen\u002FUnternehmen-und-Organisationen\u002FStandards-und-Zertifizierung\u002FTechnische-Richtlinien\u002FTR-nach-Thema-sortiert\u002Ftr03110\u002FTR-03110_node.html)\n\n---\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n","这是一个用于读取法国新版国民身份证（CNI）芯片数据的实验性Python工具，支持通过PC\u002FSC接触式智能卡读卡器完成PACE-CAN身份认证与安全通信（Secure Messaging）。核心功能包括解析ICAO LDS标准下的多个数据组（如DG1证件信息、DG2人脸图像、DG13地址与出生地等），验证数据完整性（EF.SOD），并导出结构化JSON与原始二进制文件。项目不支持需政府证书的扩展访问控制（EAC），因此无法读取指纹（DG3）或虹膜（DG4）等生物特征。适用于合规场景下的证件信息解析、身份验证研究及ICAO电子护照\u002FCNI协议教学演示。",2,"2026-07-09 02:30:25","CREATED_QUERY"]