Index: trunk/src/VBox/Frontends/VBoxManage/VBoxManage.cpp
===================================================================
--- trunk/src/VBox/Frontends/VBoxManage/VBoxManage.cpp	(revision 54473)
+++ trunk/src/VBox/Frontends/VBoxManage/VBoxManage.cpp	(revision 54487)
@@ -491,4 +491,5 @@
             { "clonehd",          USAGE_CLONEMEDIUM,       handleCloneMedium }, /* backward compatibility */
             { "clonevdi",         USAGE_CLONEMEDIUM,       handleCloneMedium }, /* backward compatibility */
+            { "encryptmedium",    USAGE_ENCRYPTMEDIUM,     handleEncryptMedium},
             { "createvm",         USAGE_CREATEVM,          handleCreateVM },
             { "modifyvm",         USAGE_MODIFYVM,          handleModifyVM },
Index: trunk/src/VBox/Frontends/VBoxManage/VBoxManage.h
===================================================================
--- trunk/src/VBox/Frontends/VBoxManage/VBoxManage.h	(revision 54473)
+++ trunk/src/VBox/Frontends/VBoxManage/VBoxManage.h	(revision 54487)
@@ -105,4 +105,5 @@
 #define USAGE_NATNETWORK            RT_BIT_64(59)
 #define USAGE_MEDIUMPROPERTY        RT_BIT_64(60)
+#define USAGE_ENCRYPTMEDIUM         RT_BIT_64(61)
 #define USAGE_ALL                   (~(uint64_t)0)
 /** @} */
@@ -262,4 +263,5 @@
 int handleCloneMedium(HandlerArg *a);
 int handleMediumProperty(HandlerArg *a);
+int handleEncryptMedium(HandlerArg *a);
 RTEXITCODE handleConvertFromRaw(int argc, char *argv[]);
 HRESULT showMediumInfo(const ComPtr<IVirtualBox> &pVirtualBox,
Index: trunk/src/VBox/Frontends/VBoxManage/VBoxManageDisk.cpp
===================================================================
--- trunk/src/VBox/Frontends/VBoxManage/VBoxManageDisk.cpp	(revision 54473)
+++ trunk/src/VBox/Frontends/VBoxManage/VBoxManageDisk.cpp	(revision 54487)
@@ -1633,3 +1633,104 @@
 }
 
+static const RTGETOPTDEF g_aEncryptMediumOptions[] =
+{
+    { "--newpassword",  'n', RTGETOPT_REQ_STRING },
+    { "--oldpassword",  'o', RTGETOPT_REQ_STRING },
+    { "--cipher",       'c', RTGETOPT_REQ_STRING }
+};
+
+int handleEncryptMedium(HandlerArg *a)
+{
+    HRESULT rc;
+    int vrc;
+    ComPtr<IMedium> hardDisk;
+    const char *pszPasswordNew = NULL;
+    const char *pszPasswordOld = NULL;
+    const char *pszCipher = NULL;
+    const char *pszFilenameOrUuid = NULL;
+
+    int c;
+    RTGETOPTUNION ValueUnion;
+    RTGETOPTSTATE GetState;
+    // start at 0 because main() has hacked both the argc and argv given to us
+    RTGetOptInit(&GetState, a->argc, a->argv, g_aEncryptMediumOptions, RT_ELEMENTS(g_aEncryptMediumOptions),
+                 0, RTGETOPTINIT_FLAGS_NO_STD_OPTS);
+    while ((c = RTGetOpt(&GetState, &ValueUnion)))
+    {
+        switch (c)
+        {
+            case 'n':   // --newpassword
+                pszPasswordNew = ValueUnion.psz;
+                break;
+
+            case 'o':   // --oldpassword
+                pszPasswordOld = ValueUnion.psz;
+                break;
+
+            case 'c':   // --cipher
+                pszCipher = ValueUnion.psz;
+                break;
+
+            case VINF_GETOPT_NOT_OPTION:
+                if (!pszFilenameOrUuid)
+                    pszFilenameOrUuid = ValueUnion.psz;
+                else
+                    return errorSyntax(USAGE_ENCRYPTMEDIUM, "Invalid parameter '%s'", ValueUnion.psz);
+                break;
+
+            default:
+                if (c > 0)
+                {
+                    if (RT_C_IS_PRINT(c))
+                        return errorSyntax(USAGE_ENCRYPTMEDIUM, "Invalid option -%c", c);
+                    else
+                        return errorSyntax(USAGE_ENCRYPTMEDIUM, "Invalid option case %i", c);
+                }
+                else if (c == VERR_GETOPT_UNKNOWN_OPTION)
+                    return errorSyntax(USAGE_ENCRYPTMEDIUM, "unknown option: %s\n", ValueUnion.psz);
+                else if (ValueUnion.pDef)
+                    return errorSyntax(USAGE_ENCRYPTMEDIUM, "%s: %Rrs", ValueUnion.pDef->pszLong, c);
+                else
+                    return errorSyntax(USAGE_ENCRYPTMEDIUM, "error: %Rrs", c);
+        }
+    }
+
+    if (!pszFilenameOrUuid)
+        return errorSyntax(USAGE_ENCRYPTMEDIUM, "Disk name or UUID required");
+
+    if (!pszPasswordNew && !pszPasswordOld)
+        return errorSyntax(USAGE_ENCRYPTMEDIUM, "No password specified");
+
+    /* Always open the medium if necessary, there is no other way. */
+    rc = openMedium(a, pszFilenameOrUuid, DeviceType_HardDisk,
+                    AccessMode_ReadWrite, hardDisk,
+                    false /* fForceNewUuidOnOpen */, false /* fSilent */);
+    if (FAILED(rc))
+        return 1;
+    if (hardDisk.isNull())
+    {
+        RTMsgError("Invalid hard disk reference, avoiding crash");
+        return 1;
+    }
+
+    ComPtr<IProgress> progress;
+    CHECK_ERROR(hardDisk, ChangeEncryption(Bstr(pszPasswordNew).raw(), Bstr(pszPasswordOld).raw(),
+                                           Bstr(pszCipher).raw(), progress.asOutParam()));
+    if (SUCCEEDED(rc))
+        rc = showProgress(progress);
+    if (FAILED(rc))
+    {
+        if (rc == E_NOTIMPL)
+            RTMsgError("Encrypt hard disk operation is not implemented!");
+        else if (rc == VBOX_E_NOT_SUPPORTED)
+            RTMsgError("Encrypt hard disk operation for this cipher is not implemented yet!");
+        else if (!progress.isNull())
+            CHECK_PROGRESS_ERROR(progress, ("Failed to encrypt hard disk"));
+        else
+            RTMsgError("Failed to encrypt hard disk!");
+    }
+
+    return SUCCEEDED(rc) ? 0 : 1;
+}
+
 #endif /* !VBOX_ONLY_DOCS */
Index: trunk/src/VBox/Frontends/VBoxManage/VBoxManageHelp.cpp
===================================================================
--- trunk/src/VBox/Frontends/VBoxManage/VBoxManageHelp.cpp	(revision 54473)
+++ trunk/src/VBox/Frontends/VBoxManage/VBoxManageHelp.cpp	(revision 54487)
@@ -631,4 +631,12 @@
                      "\n", SEP);
 
+    if (fCategory & USAGE_ENCRYPTMEDIUM)
+        RTStrmPrintf(pStrm,
+                           "%s encryptmedium %s   <uuid|filename>\n"
+                     "                            [--newpassword <new password>]\n"
+                     "                            [--oldpassword <old password>]\n"
+                     "                            [--cipher <cipher identifier>]\n"
+                     "\n", SEP);
+
     if (fCategory & USAGE_CONVERTFROMRAW)
         RTStrmPrintf(pStrm,
