DOCS / CLI REFERENCE
CLI Reference
enprot is a subcommand-style CLI. Common options work before or after the subcommand name.
Subcommands
encrypt[OPTIONS] <FILES...>Encrypt WORD segments in the input file(s). Replaces BEGIN/END blocks with ENCRYPTED blocks containing AEAD ciphertext.
decrypt[OPTIONS] <FILES...>Decrypt WORD segments. Reverses encrypt — restores plaintext from ENCRYPTED blocks.
store[OPTIONS] <FILES...>Store (unencrypted) WORD segments to content-addressed storage. Replaces segments with STORED pointers.
fetch[OPTIONS] <FILES...>Fetch (unencrypted) WORD segments from CAS. Restores original content from STORED pointers.
encrypt-store[OPTIONS] <FILES...>Combined: encrypt then store to CAS. The encrypted ciphertext is stored externally; the document keeps a STORED pointer to the ciphertext.
passthrough[OPTIONS] <FILES...>No-op transform. Reads and re-writes the file unchanged. Useful for verifying parsing correctness.
verify[OPTIONS] <FILES...>Verify integrity: check IMMUTABLE hashes, MUTED CAS existence, CHAIN signatures. No modifications.
inspect[OPTIONS] <FILES...>Display the parsed tree structure. Shows every node, its type, WORD, and children. JSON or text output.
merge[OPTIONS] <FILES...>Three-way WORD-aware merge driver for Git. Resolves conflicts at the block level, not the line level.
resolve[OPTIONS] <FILES...>Conflict resolver for merge results. Modes: ours, theirs, union, manual. Per-WORD override support.
keygen[OPTIONS]Generate a new key pair (Ed25519, ECDSA P-384, RSA, ML-DSA-65). Outputs PEM-encoded private and public keys.
fingerprint<PUBKEY.pem>Compute and display the fingerprint of a public key.
completions<SHELL>Generate shell completions (bash, fish, zsh, powershell).
Common flags
These flags are accepted by every subcommand:
| Flag | Description |
|---|---|
-w, --word <WORD[=PASSWORD]> | Specify a WORD and its password. Repeatable. Also accepts comma-separated list. |
-v, --verbose | Increase output verbosity. |
-q, --quiet | Suppress non-essential output. |
-k, --key <KEY=VALUE> | Alias for --word. KEY is the WORD name, VALUE is the password. |
-c, --casdir <PATH> | Content-addressed storage directory. Default: .cas |
--policy <POLICY> | Crypto policy: default, nist, fips. |
--fips | Force FIPS/NIST policy (also auto-detected from /proc/sys/crypto/fips_enabled on Linux). |
--format <FORMAT> | Output format: text (default) or json. |
-l, --left-separator <SEP> | Left separator (default: // <() |
-r, --right-separator <SEP> | Right separator (default: )>) |
Encrypt-specific flags
These flags apply to encrypt and encrypt-store:
| Flag | Description |
|---|---|
--cipher <ALG> | AEAD cipher: aes-256-siv (default), aes-256-gcm, aes-256-gcm-siv, aes-256-gcm-det, aes-256-gcm-siv-det. |
--pbkdf <ALG> | KDF: argon2id (default), scrypt, pbkdf2. |
--pbkdf-params <PARAMS> | Manual KDF parameters (e.g., "t=10,m=131072,p=1"). |
--pbkdf-disable-cache | Disable PBKDF result caching. |
--cipher-iv <HEX> | Fixed IV (testing only). |
--recipient <PUBKEY.pem> | ML-KEM multi-recipient encryption. Repeatable. |
--signer <PEM> | Sign the document with this private key. |
--anchor | Create a CHAIN anchor (provenance ledger entry). |
--inline | Keep ciphertext inline (DATA lines). Default. |
Supported ciphers
| Algorithm | Backend | Det. variant | Notes |
|---|---|---|---|
aes-256-siv | Botan 3 | — | Default. RFC 5297. Nonce-misuse resistant. |
aes-256-gcm | Botan 3 | aes-256-gcm-det | High-performance. Hardware-accelerated. |
aes-256-gcm-siv | RustCrypto | aes-256-gcm-siv-det | RFC 8452. Botan doesn't implement this. |
Deterministic (-det) variants derive the nonce from plaintext via HKDF-SHA256 + HMAC-SHA256. Same plaintext → same ciphertext → CAS dedup works on encrypted segments.
Supported signature algorithms
| Algorithm | Key type | Notes |
|---|---|---|
ed25519 | Ed25519 | Default. Fast, compact, deterministic. |
ecdsa-p384 | ECDSA P-384 | CNSA suite compliant. |
rsa-3072 | RSA 3072 | Legacy compatibility. |
ml-dsa-65 | ML-DSA (FIPS 204) | Post-quantum. NIST Round 3. |