Secstore is the only reasonable solution.  You could use aescbc but you
might need to alter it to get its password from somewhere other than
the console.