Use vault.sh or vault.bat file in "bin" directory for password encryption.
Just wanted to comment that if you're using JDV installation and you have a subscription, I would suggest you download the latest patch because there are updates for picketlink that your missing (based on the version you show in your above java command).
I have same issue. Seems 'picketbox-4.1.1.Final-redhat-1.jar' with EAP-6.4 for Linux is corrupted, I can't even take a peek at it. The same version of picketbox jar for Windows and the lower version of picketbox jar wirh EAP 6.1 for Linux works fine.