/usr/bin/botan

Usage: botan <cmd> <cmd-options>
All commands support --verbose --help --output= --error-output= --rng-type= --drbg-seed=

Available commands:

asn1:
   asn1print          Decode and print file with ASN.1 Basic Encoding Rules (BER)
   oid_info           Provide information about an object identifier

Encoders/Decoders:
   base32_dec         Decode Base32 encoded file
   base32_enc         Encode given file to Base32
   base58_dec         Decode Base58 encoded file
   base58_enc         Encode given file to Base58
   base64_dec         Decode Base64 encoded file
   base64_enc         Encode given file to Base64
   hex_dec            Hex decode a given file
   hex_enc            Hex encode a given file

Compression:
   compress           Compress a given file
   decompress         Decompress a given compressed archive

Encryption:
   cipher             Encrypt or decrypt with a symmetric cipher

Forward Error Correction:
   fec_decode         Recover data from FEC shares
   fec_encode         Forward error encode a file
   fec_info           Display information about a FEC share

Hash Functions:
   hash               Compute the message digest of given file(s)

HMAC:
   hmac               Compute the HMAC tag of given file(s)

Informational:
   config             Print the used prefix, cflags, ldflags or libs
   cpu_clock          Estimate the speed of the CPU cycle counter
   cpuid              List available processor flags (aes_ni, SIMD extensions, ...)
   has_command        Test if a command is available
   version            Print version info

Miscellaneous:
   cc_decrypt         Decrypt the passed valid ciphertext credit card number using FPE decryption
   cc_encrypt         Encrypt the passed valid credit card number using FPE encryption
   entropy            Sample a raw entropy source
   http_get           Retrieve resource from the passed http/https url
   rng                Sample random bytes from the specified rng
   roughtime          Retrieve time from Roughtime server
   roughtime_check    Parse and validate Roughtime chain file
   speed              Measures the speed of algorithms
   uuid               Print a random UUID

Number Theory:
   factor             Factor a given integer
   gen_prime          Samples one or more primes
   is_prime           Test if the integer n is composite or prime
   mod_inverse        Calculates a modular inverse

Password Hashing:
   check_argon2       Verify Argon2 password hash
   check_bcrypt       Verify bcrypt password hash
   gen_argon2         Calculate Argon2 password hash
   gen_bcrypt         Calculate bcrypt password hash
   pbkdf_tune         Tune a PBKDF algo

pkcs12:
   pkcs12_export      Export private key and certificate(s) to PKCS#12/PFX format
   pkcs12_info        Inspect a PKCS#12/PFX file (and optionally extract key and certificates)

PSK Database:
   psk_get            Read a value saved with psk_set
   psk_list           List all values saved to the database
   psk_set            Save a PSK encrypted in the database

Public Key Cryptography:
   dl_group_info      Print raw Diffie-Hellman parameters (p,g) of the standardized DH group name
   ec_group_info      Print raw elliptic curve domain parameters of the standardized curve name
   fingerprint        Calculate a public key fingerprint
   gen_dl_group       Generate ANSI X9.42 encoded Diffie-Hellman group parameters
   keygen             Generate a PKCS #8 private key
   pk_decrypt         Decrypt a file using a RSA private key
   pk_encrypt         Encrypt a file using a RSA public key
   pk_workfactor      Provide estimate of strength of public key based on size
   pkcs8              Open a PKCS #8 formatted key
   sign               Sign arbitrary data
   verify             Verify the authenticity of the given file with the provided signature

Testing:
   marvin_test        Run a test for MARVIN attack
   timing_test        Run various timing side channel tests

TLS:
   tls_ciphers        Lists all ciphersuites for a policy and TLS version
   tls_client         Connect to a host using TLS/DTLS
   tls_client_hello   Parse a TLS client hello message
   tls_http_server    Provides a simple HTTP server
   tls_proxy          Proxies requests between a TLS client and a TLS server
   tls_server         Accept TLS/DTLS connections from TLS/DTLS clients

Secret Sharing:
   tss_recover        Recover a split secret
   tss_split          Split a secret into parts

X.509:
   cert_info          Parse X.509 certificate and display data fields
   cert_verify        Verify if the passed X.509 certificate passes path validation
   create_cert_for_key   Generate a certificate by a CA for a given public key. This is for instance needed to issue ML-KEM certificates, for which PKCS#10 requests cannot be generated.
   gen_pkcs10         Generate a PKCS #10 certificate signing request (CSR)
   gen_self_signed    Generate a self signed X.509 certificate
   ocsp_check         Verify an X.509 certificate against the issuers OCSP responder
   sign_cert          Create a CA-signed X.509 certificate from a PKCS #10 CSR
   trust_roots        List certs in the system trust store