diff --git a/spring-cloud-cli/src/main/java/org/springframework/cloud/cli/command/encrypt/EncryptorFactory.java b/spring-cloud-cli/src/main/java/org/springframework/cloud/cli/command/encrypt/EncryptorFactory.java
index 5d417ba..424d869 100644
--- a/spring-cloud-cli/src/main/java/org/springframework/cloud/cli/command/encrypt/EncryptorFactory.java
+++ b/spring-cloud-cli/src/main/java/org/springframework/cloud/cli/command/encrypt/EncryptorFactory.java
@@ -18,7 +18,6 @@ package org.springframework.cloud.cli.command.encrypt;
 import org.springframework.boot.cli.util.Log;
 import org.springframework.security.crypto.encrypt.Encryptors;
 import org.springframework.security.crypto.encrypt.TextEncryptor;
-import org.springframework.security.rsa.crypto.ExtendedKeyHelper;
 import org.springframework.security.rsa.crypto.RsaSecretEncryptor;
 
 /**
@@ -56,7 +55,7 @@ public class EncryptorFactory {
 				Log.info("Trying public key");
 			}
 			try {
-				encryptor = new RsaSecretEncryptor(ExtendedKeyHelper.parsePublicKey(data));
+				encryptor = new RsaSecretEncryptor(data);
 			}
 			catch (IllegalArgumentException e) {
 				if (verbose) {
diff --git a/spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/DecryptCommandTests.java b/spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/DecryptCommandTests.java
new file mode 100644
index 0000000..d0ea7a7
--- /dev/null
+++ b/spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/DecryptCommandTests.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2013-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.cloud.cli.command.encrypt;
+
+import static org.junit.Assert.assertEquals;
+
+import java.nio.charset.Charset;
+
+import org.junit.Test;
+import org.springframework.boot.cli.command.status.ExitStatus;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.security.rsa.crypto.RsaSecretEncryptor;
+import org.springframework.util.StreamUtils;
+
+/**
+ * @author Dave Syer
+ *
+ */
+public class DecryptCommandTests {
+
+	private DecryptCommand command = new DecryptCommand();
+
+	@Test
+	public void decryptsFromSymmetricKey() throws Exception {
+		assertEquals(ExitStatus.OK, command.run("-k", "deadbeef",
+				"68b7f624de187e79cebfdc9e2e869189b981d7e976385839506de265bb892a5d"));
+	}
+
+	@Test
+	public void decryptsFromRsaKey() throws Exception {
+		RsaSecretEncryptor encryptor = new RsaSecretEncryptor(StreamUtils.copyToString(
+				new ClassPathResource("private.pem").getInputStream(),
+				Charset.forName("UTF-8")));
+		String cipher = encryptor.encrypt("foo");
+		assertEquals(ExitStatus.OK,
+				command.run("-k", "@src/test/resources/private.pem", cipher));
+	}
+
+	@Test(expected = IllegalArgumentException.class)
+	public void failsWithPlainText() throws Exception {
+		assertEquals(ExitStatus.OK, command.run("-k", "deadbeef", "foo"));
+	}
+
+	@Test(expected = IllegalStateException.class)
+	public void failsWithBadFile() throws Exception {
+		assertEquals(ExitStatus.OK, command.run("-k", "@nosuchfile", "foo"));
+	}
+
+}
diff --git a/spring-cloud-cli/src/main/java/org/springframework/security/rsa/crypto/ExtendedKeyHelper.java b/spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/EncryptCommandTests.java
similarity index 53%
rename from spring-cloud-cli/src/main/java/org/springframework/security/rsa/crypto/ExtendedKeyHelper.java
rename to spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/EncryptCommandTests.java
index 053f8bf..84fca2a 100644
--- a/spring-cloud-cli/src/main/java/org/springframework/security/rsa/crypto/ExtendedKeyHelper.java
+++ b/spring-cloud-cli/src/test/java/org/springframework/cloud/cli/command/encrypt/EncryptCommandTests.java
@@ -13,16 +13,30 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.rsa.crypto;
+package org.springframework.cloud.cli.command.encrypt;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+import org.springframework.boot.cli.command.status.ExitStatus;
 
-import java.security.interfaces.RSAPublicKey;
 
 /**
  * @author Dave Syer
  *
  */
-public class ExtendedKeyHelper extends RsaKeyHelper {
-	public static RSAPublicKey parsePublicKey(String key) {
-		return RsaKeyHelper.parsePublicKey(key);
+public class EncryptCommandTests {
+	
+	private EncryptCommand command = new EncryptCommand();
+	
+	@Test
+	public void encryptsFromSymmetricKey() throws Exception {
+		assertEquals(ExitStatus.OK, command.run("-k", "deadbeef", "foo"));
 	}
+
+	@Test(expected=IllegalStateException.class)
+	public void failsWithBadFile() throws Exception {
+		assertEquals(ExitStatus.OK, command.run("-k", "@nosuchfile", "foo"));
+	}
+
 }
diff --git a/spring-cloud-cli/src/test/resources/private.pem b/spring-cloud-cli/src/test/resources/private.pem
new file mode 100644
index 0000000..16f1630
--- /dev/null
+++ b/spring-cloud-cli/src/test/resources/private.pem
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDQ835BXnZ7WU6SJd39rpl/qjm97W+i2K2fSMBzbCtbC3Z733tc
+TJH20nb0n97V6/ItKx0YcI3McHVH0PcqlxVRMO78RtvBuSOJZfddNaafKAEm7YFW
+FWs2OVGRj497T+/QpSlV9zAbtHUusJWHdu6mSaPMhJwY5Gm0kMUBQnMZuQIDAQAB
+AoGAEkTXyxtZPJuoVPrel+mGHjVh6wsxcYmEVKLlwLG6cLFl4Jq/jGhdcrkgEW9Q
+6l9Aw1Y7qwFcRH2oo2jP03d2M4SMcJeAf5nC9lnNmXnEXurJvjNDuP6GihTQBMFZ
+R35IXKRjwPDobG76INySu3dbpdCj3HZIozdgpGIS4uKL/WkCQQD3gsmdvfOcsXtz
+t/BswnuZoeqOJjoHr+6Sr5AWI1FXitTeAWvupKBbLscpGdk8/AsfK9E96xCPk1N3
+ws+AG/NvAkEA2B4kAlUnz6pA2BG1MKNqc6Am+MfXmOCDdTcoSEav17KAb3tPx0FY
+4n+CTd4lsGG13rXxtXETxKA9xVD2RkcRVwJABIofjIcZWrxemUa8YCJJBg5UMPs+
+gTmW1JXnvKA1M7fWI6Q/CId4cXOwL27L7zRoN9Aj7FDNYvS+ySmHiL/6fQJBANZN
+1RFHFeoz/ocD0DNB6L5tchfCO0VKZLDoGBbLmXT/eaKSmcKRRy2amUDT53Wm/qyw
+qNVuItcYuwgdx4ha0pMCQDZfzYIH//t0K+jW5N7+pdLP1KsnSuHZOPn3uQaSXhWr
+5JupxP9s5r6DMztLpcFHN/fQRCYVg+5KOCWDgZYTamE=
+-----END RSA PRIVATE KEY-----