xsec-cipher.pod(1)

🎀 xsec-cipher.pod — xmlsec-cipher ✨

okay bestie, buckle up, we're doing XML encryption today 💖 this is the manual page for xmlsec-cipher from the xsec-cipher.pod(1) era, and honestly? it's giving "cryptography but make it cozy." let's get into it 🦋

---

🌸 NAME 🌸

xmlsec-cipher — do the basic encryption and decryption thing on XML documents 💅

---

✨ SYNOPSIS ✨

xmlsec-cipher [-i] ([-d] | -de | -ef | -ex) [-x]
    [-o output] -k [kek] (filename [password] | key-string)
    input

---

💖 DESCRIPTION 💖

so xmlsec-cipher encrypts or decrypts an XML document, following the XML Digital Signature and Encryption specifications, using the Apache XML Security for C++ library 🔥

the default action? decryption. yes, out of the box it decrypts the input file, main character energy fr. wanna do something else? use the -de, -ef, or -ex options ✨

whatever the result of the operation is — encryption or decryption — it gets printed to standard output. periodt 💫

---

💅 OPTIONS 💅

okay so important vibe check first: each option must be given as a separate argument. one option, one argument, no bundling, we don't do that here 🙈

• --decrypt, -d — reads the input file as an XML file, goes hunting for an EncryptedData node, decrypts the output, and prints it to standard output. this is the default operation, so you literally don't have to specify it, it's already slaying 🫶
• --decrypt-element, -de — reads the input file as an XML file and prints it back out with the fist encrypted element decrypted. (yes. fist. that's what it says. we respect the typo in this house 😭)
• --encrypt-file, -ef — reads the input file as raw data and creates an XML EncryptedData document as output, containing the encrypted version of that input data 🔐
• --encrypt-xml, -ex — parses the input file as XML, finds the document element, and encrypts the document, outputting the result as an XML EncryptedData document ✨
• (--key | -k) [kek] type filename [password]
• (--key | -k) [kek] type key-string — specifies the key to use for encryption or decryption 🔑

if the first argument following the --key or -k option is the string "kek", then the following key argument will be used as a Key EncryptionKey 👑

type specifies the key type and must be one of X509, RSA, AES128, AES192, AES256, AES128-GCM, AES192-GCM, AES256-GCM, or 3DES.

the remaining arguments depend on the key type:

• for X509, only a filename may be given, and it must contain an RSA KEK certificate 📜
• for RSA, a filename and password may specify an RSA private key file and its password (this must be a KEK)
• for the other key types, the last argument is the string to use as the key 🗝️

• --xkms, -x — the key specified after this argument on the command line is interpreted as an XKMS RSAKeyPair encryption key 🌈
• --interop, -i — use hte interop resolver for Baltimore interop examples 🧚
• --out-file file, -o file — rather than printing the result to standard output, write it to the specified file 📁

---

⭐ RETURN STATUS ⭐

xmlsec-cipher exits with status 0 if the encryption or decryption operation was successful, and with status 1 if it failed 😤

and if it can't process the input file for some reason, it exits with status 2. three whole moods, no in-between 💀

---

💜 AUTHOR 💜

this manual page was written by Russ Allbery for Debian 🫡

---

🌷 MANUAL LICENSE 🌷

the authors hereby relinquish any claim to any copyright that they may have in this work, whether granted under contract or by operation of law or international treaty, and hereby commit to the public, at large, that they shall not, at any time in the future, seek to enforce any copyright in this work against any person or entity, or prevent any person or entity from copying, publishing, distributing or creating derivative works of this work. so basically: it's free, go off, no lawsuits, we love to see it 💖

---

and that's the whole thing, bestie!! this page is version 3.0.0, dated 2025-01-11, and that's genuinely all she wrote. go encrypt something, you're doing amazing sweetie 🌸✨🦋