diff --git a/Cargo.lock b/Cargo.lock
index f976d2c..f70d1c4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2165,6 +2165,7 @@ dependencies = [
  "hex",
  "openpgp-card",
  "openpgp-card-pcsc",
+ "rand",
  "reqwest",
  "rpassword",
  "rust_util",
diff --git a/Cargo.toml b/Cargo.toml
index a386cef..f2a9d9f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,6 +16,7 @@ clap = { version = "4.1.4", features = ["derive"] }
 hex = "0.4.3"
 openpgp-card = "0.3.7"
 openpgp-card-pcsc = "0.3.0"
+rand = "0.8.5"
 reqwest = { version = "0.11.14", features = ["blocking", "rustls", "rustls-tls"] }
 rpassword = "7.2.0"
 rust_util = "0.6.42"
diff --git a/src/cmd_decrypt.rs b/src/cmd_decrypt.rs
index 286f2a5..ee40294 100644
--- a/src/cmd_decrypt.rs
+++ b/src/cmd_decrypt.rs
@@ -33,6 +33,7 @@ pub struct CmdDecrypt {
 }
 
 pub fn decrypt(cmd_decrypt: CmdDecrypt) -> XResult<()> {
+    debugging!("Cmd decrypt: {:?}", cmd_decrypt);
     for path in &cmd_decrypt.paths {
         match decrypt_single(path, &cmd_decrypt.pin, &cmd_decrypt.slot) {
             Ok(_) => success!("Decrypt {} succeed", path.to_str().unwrap_or("N/A")),
diff --git a/src/cmd_encrypt.rs b/src/cmd_encrypt.rs
index 1c0be8f..ddd8ab0 100644
--- a/src/cmd_encrypt.rs
+++ b/src/cmd_encrypt.rs
@@ -1,7 +1,8 @@
 use std::path::PathBuf;
 
 use clap::Args;
-use rust_util::{debugging, simple_error, XResult};
+use rand::random;
+use rust_util::{debugging, failure, simple_error, success, XResult};
 
 use crate::config::{TinyEncryptConfig, TinyEncryptConfigEnvelop};
 use crate::spec::{TinyEncryptEnvelop, TinyEncryptEnvelopType};
@@ -13,6 +14,8 @@ pub struct CmdEncrypt {
     pub paths: Vec<PathBuf>,
     // Comment
     pub comment: Option<String>,
+    // Comment
+    pub encrypted_comment: Option<String>,
     // Encryption profile
     pub profile: Option<String>,
 }
@@ -20,16 +23,23 @@ pub struct CmdEncrypt {
 pub fn encrypt(cmd_encrypt: CmdEncrypt) -> XResult<()> {
     let config = TinyEncryptConfig::load(TINY_ENC_CONFIG_FILE)?;
     let envelops = config.find_envelops(&cmd_encrypt.profile);
-    if envelops.is_empty() {
-        return simple_error!("Cannot find any valid envelops");
-    }
+    if envelops.is_empty() { return simple_error!("Cannot find any valid envelops"); }
 
-    let (key, nonce) = make_key_and_nonce();
+    debugging!("Cmd encrypt: {:?}", cmd_encrypt);
+    for path in &cmd_encrypt.paths {
+        match encrypt_single(path, &envelops) {
+            Ok(_) => success!("Encrypt {} succeed", path.to_str().unwrap_or("N/A")),
+            Err(e) => failure!("Encrypt {} failed: {}", path.to_str().unwrap_or("N/A"), e),
+        }
+    }
+    Ok(())
+}
+
+fn encrypt_single(path: &PathBuf, envelops: &[&TinyEncryptConfigEnvelop]) -> XResult<()> {
+    let (key, nonce) = make_key256_and_nonce();
     let envelops = encrypt_envelops(&key, &envelops)?;
 
     debugging!("Envelops: {:?}", envelops);
-
-    println!("Cmd encrypt: {:?}", cmd_encrypt);
     Ok(())
 }
 
@@ -68,10 +78,8 @@ fn encrypt_envelop_pgp(key: &[u8], envelop: &TinyEncryptConfigEnvelop) -> XResul
     })
 }
 
-fn make_key_and_nonce() -> (Vec<u8>, Vec<u8>) {
-    // TODO use random
-    let key = [0u8; 32];
-    let nonce = [0u8; 12];
-
+fn make_key256_and_nonce() -> (Vec<u8>, Vec<u8>) {
+    let key: [u8; 32] = random();
+    let nonce: [u8; 12] = random();
     (key.into(), nonce.into())
 }
\ No newline at end of file