cmd/clef: encrypt the master seed on disk (#17704)

* cmd/clef: encrypt master seed of clef

Signed-off-by: YaoZengzeng <yaozengzeng@zju.edu.cn>

* keystore: refactor for external use of encryption

* clef: utilize keystore encryption, check flags correctly

* clef: validate master password

* clef: add json wrapping around encrypted master seed

2 files changed, 19 insertions, 0 deletions

diff --git a/signer/core/api.go b/signer/core/api.go
index c380fe977..2b96cdb5f 100644
--- a/signer/core/api.go
+++ b/signer/core/api.go
@@ -197,6 +197,12 @@ type (
 	Message struct {
 		Text string `json:"text"`
 	}
+	PasswordRequest struct {
+		Prompt string `json:"prompt"`
+	}
+	PasswordResponse struct {
+		Password string `json:"password"`
+	}
 	StartupInfo struct {
 		Info map[string]interface{} `json:"info"`
 	}
diff --git a/signer/rules/rules_test.go b/signer/rules/rules_test.go
index c2f92d51f..55614077c 100644
--- a/signer/rules/rules_test.go
+++ b/signer/rules/rules_test.go
@@ -81,6 +81,10 @@ func (alwaysDenyUI) OnInputRequired(info core.UserInputRequest) (core.UserInputR
 func (alwaysDenyUI) OnSignerStartup(info core.StartupInfo) {
 }
 
+func (alwaysDenyUI) OnMasterPassword(request *core.PasswordRequest) (core.PasswordResponse, error) {
+	return core.PasswordResponse{}, nil
+}
+
 func (alwaysDenyUI) ApproveTx(request *core.SignTxRequest) (core.SignTxResponse, error) {
 	return core.SignTxResponse{Transaction: request.Transaction, Approved: false, Password: ""}, nil
 }
@@ -250,6 +254,11 @@ func (d *dummyUI) ShowInfo(message string) {
 func (d *dummyUI) OnApprovedTx(tx ethapi.SignTransactionResult) {
 	d.calls = append(d.calls, "OnApprovedTx")
 }
+
+func (d *dummyUI) OnMasterPassword(request *core.PasswordRequest) (core.PasswordResponse, error) {
+	return core.PasswordResponse{}, nil
+}
+
 func (d *dummyUI) OnSignerStartup(info core.StartupInfo) {
 }
 
@@ -526,6 +535,10 @@ func (d *dontCallMe) OnInputRequired(info core.UserInputRequest) (core.UserInput
 func (d *dontCallMe) OnSignerStartup(info core.StartupInfo) {
 }
 
+func (d *dontCallMe) OnMasterPassword(request *core.PasswordRequest) (core.PasswordResponse, error) {
+	return core.PasswordResponse{}, nil
+}
+
 func (d *dontCallMe) ApproveTx(request *core.SignTxRequest) (core.SignTxResponse, error) {
 	d.t.Fatalf("Did not expect next-handler to be called")
 	return core.SignTxResponse{}, core.ErrRequestDenied