keystore created:
------------------
keytool -genseckey -alias vault -storetype jceks -keyalg AES -keysize 128 -storepass mypassword -keypass mypassword -keystore vault-fallback.keystore

Correct masked password:
==========================
<vault>
  <vault-option name="KEYSTORE_URL" value="vault-fallback.keystore"/>
  <vault-option name="KEYSTORE_PASSWORD" value="MASK-0UWB5tlhOmKYzJVl9KZaPN"/>
  <vault-option name="KEYSTORE_ALIAS" value="valias"/>
  <vault-option name="SALT" value="bdfbdf12"/>
  <vault-option name="ITERATION_COUNT" value="12"/>
  <vault-option name="ENC_FILE_DIR" value="vault_data/"/>
</vault>

Incorrect masked passwordi (generated by previous version of PicketBox):
note the missing 0 in Base64 part of masked password
========================================================================
<vault>
  <vault-option name="KEYSTORE_URL" value="vault-fallback.keystore"/>
  <vault-option name="KEYSTORE_PASSWORD" value="MASK-UWB5tlhOmKYzJVl9KZaPN"/>
  <vault-option name="KEYSTORE_ALIAS" value="valias"/>
  <vault-option name="SALT" value="bdfbdf12"/>
  <vault-option name="ITERATION_COUNT" value="12"/>
  <vault-option name="ENC_FILE_DIR" value="vault_data/"/>
</vault>

vault content created (from EAP6.1 dir):
-----------------------------------------
./bin/vault.sh -e vault_data/ -k vault-fallback.keystore -v valias -p mypassword -i 12 -s bdfbdf12 -b vblock -a attr1 -x secret1
