botan

Command-line interface to the Botan cryptography library

TLDR

Hash a file with SHA-256 (hex, filename beside the digest)

$ botan hash --algo=[SHA-256] [path/to/file]

Hash with base64 encoding

$ botan hash --format=base64 --algo=[SHA-384] [path/to/file]

Encrypt a file with AES-256/GCM (key and nonce are hex)

$ botan cipher --cipher=AES-256/GCM --key=[hex_key] --nonce=[hex_nonce] --output=[path/to/output] [path/to/file]

Decrypt the same file

$ botan cipher --cipher=AES-256/GCM --decrypt --key=[hex_key] --nonce=[hex_nonce] --output=[path/to/output] [path/to/file]

Generate an RSA private key

$ botan keygen --algo=RSA --params=2048 > [path/to/private.pem]

Print 16 random bytes

$ botan rng 16

Show help for one command

$ botan [hash] --help

Print the version

$ botan version

SYNOPSIS

botan command [command-options] [arguments]

botan is the command-line tool for the Botan C++ cryptography library. Every invocation is `botan <command> <options>`. With no command, an unknown command, or --help, it lists available commands. `botan <command> --help` prints that command's usage.Starting in 2.9, commands that take a passphrase also accept `-` to mean read it from the terminal with echo disabled when the OS allows that. Most file arguments also accept `-` for standard input.Password hashes include gen_argon2 / check_argon2, gen_bcrypt / check_bcrypt, and pbkdf_tune. X.509 helpers include gen_pkcs10, gen_self_signed, sign_cert, cert_info, cert_verify, and ocsp_check.

PARAMETERS

hash [--algo=SHA-256] [--format=hex] [--buf-size=4096] [--no-fsname] [files...]

Digest each file (or standard input). Prints the filename next to the hash unless --no-fsname.

hmac [--hash=SHA-256] key [files...]

HMAC over files using the key in file key.

cipher [--decrypt] --cipher=name --key=hex --nonce=hex [--ad=hex] [file_]

Encrypt or decrypt with an AEAD such as AES-256/GCM.

keygen [--algo=RSA] [--params=] [--passphrase=] [--der-out]

Generate a PKCS 8 private key. RSA --params is the modulus bit length (default 3072). EC --params is a curve name (default secp256r1).

pkcs8 [--pub-out] [--der-out] [--pass-in=] [--pass-out=] key

Open a PKCS 8 key; optionally re-encrypt it or write the public key.

sign [--hash=SHA-256] [--padding=] [--passphrase=] key file

Sign file with the private key. RSA defaults to PSS.

verify [--hash=SHA-256] [--padding=] pubkey file signature

Verify a signature produced by sign.

rng [count]

Print random bytes.

version

Print the Botan version.

-h, --help

List commands, or describe one command when given after it.

INSTALL

sudo apt install botan

sudo dnf install botan

sudo pacman -S botan

sudo apk add botan3

brew install botan

nix profile install nixpkgs#botan3

CAVEATS

The CLI covers a subset of the library. Cipher names must be ones Botan knows (for example AES-256/GCM). Encrypted PKCS 8 output is interoperable mainly with AES or 3DES in CBC on other implementations. Do not pass passphrases on the command line when `-` (terminal prompt) is available.

HISTORY

Botan is a C++ cryptography library by Jack Lloyd, first released in 2002. The botan CLI ships with the library and follows `botan <command>` syntax.

RESOURCES

Homepage · Documentation · Source code