CLAES(1)

💖 CLAES(1) — the cryptlib tools girlies 💖

okay bestie, buckle UP, because claes is literally the conventional encryption tool that plays nice with gpg and openssl, and she is that girl. ✨

---

🌸 SYNOPSIS 🌸

claes [-debug] [-decrypt] [-cms | -openssl [-128]] [OPTION] [FILE | -]

---

🦋 DESCRIPTION 🦋

so like, claes encrypts or decrypts data in OpenPGP format, CMS format and OPENSSL format, working from files or from standard input, all using a passphrase-based AES cipher. slay.

if you don't hand her a FILE or a -, she just reads from standard input. no drama.

⚠️ okay but real talk: if data is piped into claes, then the interactive password entry is not available. she needs the terminal, she can't work with a pipe and still ask you for a secret, bestie. 💀

the size of any internal input data is limited to 256 MByte. keep that in mind, no cap.

the default mode of operation is encryption, with the ciphertext stored base64-encoded in the OpenPGP format. and to decrypt base64-encoded or binary input data, you must use the -decrypt option. periodt.

all input data is processed AS IS and is treated internally as binary data with no changes. like, zero changes. she does not touch your bytes.

for every encryption or decryption, a user-provided passphrase is read from the terminal in which claes is run. so claes always works interactively. that's her whole thing. 🫶

there is deliberately no public-key-cryptography built into claes. not a bug, an aesthetic. if you need those, please use clsmime and clkeys. 👑

---

✨ OPTIONS ✨

• -help — display this help and exit 💅
• -version — output version information and exit 🌈
• -debug — print debugging information to stderr 🔥
• -cms — produce CMS enveloped and encrypted data instead of OpenPGP (default) 💖
• -openssl — produce encrypted data in openssl format using pbkdf2 for passphrase mangling 🎀
• -128 — forces the use of 128 bit AES keys in conjunction with -openssl (AES 256 bits is the default) ⭐
• -decrypt — decrypts an encrypted message (default is encrypt). if data is compressed it will be de-compressed automatically 🦋
• -binary — uses binary data both for input and output 💜
• -compress — forces compression before data is encrypted 🌸

---

🎀 NOTES 🎀

full documentation lives at <https://senderek.ie/cryptlib/tools> 📚

this program depends on two packages providing the cryptlib shared object library and the python3-bindings to this library.

you can download both packages in RPM or DEB format at <https://senderek.ie/cryptlib/>

using FEDORA you can install the packages cryptlib and cryptlib-python3 directly from the repository. easy. 😌

in addition the program /bin/systemd-ask-password is needed to read sensible data from stdin. this program is part of the systemd package. iykyk.

---

🔥 INTEROPERABILITY 🔥

💫 gpg2

without any options, claes produces OpenPGP (base64-encoded) encrypted messages using AES-128.

she can decrypt any messages (ascii or binary) produced by GnuPG with the following ciphers: AES, AES192, AES256, 3DES and CAST-128. versatile queen. 👑

the option -binary causes the output written to a file with the .gpg extension. and because binary output does not compute the CRC24 checksum, it is much faster than the default mode and is recommended for the encryption of large files. ⚡

🫶 important: to mangle the password correctly, the option --s2k-digest-algo SHA256 must be used with gpg.

from version 1.1 an MDC packet is added to every encryption in OpenPGP mode. integrity protection is also used with the CMS format. we love a secure girlie. 🔐

💫 openssl

in OpenSSL mode, claes writes encrypted messages in the proprietary OpenSSL format using AES256 as the default.

these messages can be decrypted with openssl:

openssl aes-256-cbc -pbkdf2 -d -a -in FILE.asc

the use of AES-128 can be forced by the additional option -128, both for encryption or decryption of OpenSSL messages. 💅

there is no compression available in OpenSSL mode. sorry bestie, that's just how it is. 😭

💫 CMS

in CMS mode, claes produces PKCS#7 formated (base64-encoded) enveloped and encrypted messages. iconic. ✨

---

🌈 FILES 🌈

• /usr/bin/systemd-ask-password — this program is used to provide the passphrase based on a user's input. 🔑
• /lib64/libcl.so.3.4.9 — the cryptlib library. 📦
• /usr/lib/python3.1x/site-packages/cryptlib_py.so — bindings to the cryptlib library used by python3. 🐍

---

💀 BUGS 💀

please report bugs to innovation@senderek.ie — she wants to hear it, fr fr. 🙈

---

👑 AUTHORS 👑

claes is written by Ralf Senderek <innovation@senderek.ie>. Cryptlib is written and maintained by Peter Gutmann <pgut001@cs.auckland.ac.nz>

---

🎀 COPYRIGHT 🎀

Copyright © 2022 - 2026 Ralf Senderek. All rights reserved.

License BSD-3-Clause: <https://senderek.ie/cryptlib/bsd.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.

---

🦋 SEE ALSO 🦋

cryptlib, clsmime, clkeys

---

and that's the whole page, bestie!! 💖✨🦋🌸 this lil beauty lives in the Cryptlib Tools manual, dated February 2026, and she is CLAES(1) through and through. go encrypt something, you main character. 🎀💅🫶