Yes, it is possible. Take a look at xmlsec/tests/testEnc.sh and search for "enc-des3cbc-keyname-element" test. Note that for encryption node selection you can use not only "--node-id" option but also "--node-name" and "--node-xpath" options: http://www.aleksey.com/xmlsec/xmlsec-man.html Aleksey