[Feature Request]: Secure Wallet Management for Aptos CLI

[mshakeg]

Current Situation

The Aptos CLI currently stores private keys and mnemonics in plain text within a .aptos folder typically located in a project's root directory. This approach has several drawbacks:

1. Security risk: Storing sensitive information in plain text is vulnerable to unauthorized access.
2. Duplication: Each project requires a separate profile, resulting in multiple copies of the same private key.
3. Lack of portability: Wallets are tied to specific project directories, making it inconvenient to use the same wallet across multiple projects.

Proposed Solution

Implement a secure wallet management system for the Aptos CLI, similar to Foundry's wallet commands, while maintaining compatibility with the existing profile-based system. This system should:

1. Provide a single local encrypted store for private keys and mnemonics.
2. Allow users to manage multiple wallets across all Aptos projects.
3. Implement secure key derivation and encryption techniques to protect sensitive information.
4. Integrate seamlessly with existing CLI commands and workflows.

Feature Details

New Wallet Commands

Introduce the following wallet commands to the Aptos CLI:

1. aptos wallet: Display wallet management help and available subcommands.
2. aptos wallet list: List all available wallets.
3. aptos wallet new [name]: Create a new wallet with an optional name.
4. aptos wallet import [name]: Import an existing private key or mnemonic.
5. aptos wallet export [name]: Securely export a wallet's private key or mnemonic.
6. aptos wallet remove [name]: Remove a wallet from the management system.
7. aptos wallet sign [name] [message]: Sign a message using the specified wallet.
8. aptos wallet verify [address] [signature] [message]: Verify a signature.
9. aptos wallet link [wallet_name] [profile_name]: Associate a wallet with an existing profile(profiles could still be local to a prjoect?).
10. aptos wallet info [wallet_name]: Display wallet information, such as associated profiles.

Integration with Existing CLI Commands

To maintain compatibility with existing CLI commands:

1. Modify the aptos init command to optionally use a wallet:

   aptos init --profile [profile_name] --wallet [wallet_name] --network [network]
   

2. Introduce a new --wallet flag as an alternative to --profile in all existing commands:

   aptos [command] --wallet [wallet_name] --network [network] [other_options]
   

3. Maintain support for the current --profile flag in all existing commands.

4. When a profile is specified, the CLI will first check if it's associated with a wallet. If so, it will use the wallet's credentials. If not, it will fall back to the current behavior of using the profile's stored private key.

Usage Examples

1. Creating a multisig account using a profile (current method, backward compatible):

   aptos multisig create \
       --profile <profile> \
       --additional-owners $other_owner_addr \
       --num-signatures-required 1 \
       --assume-yes
   

2. Creating a multisig account using a wallet directly:

   aptos multisig create \
       --wallet <wallet_name> \
       --network <network> \
       --additional-owners $other_owner_addr \
       --num-signatures-required 1 \
       --assume-yes
   

Implementation Considerations

1. Master Password: Require users to set a master password to access the wallet management system.
2. Backup and Recovery: Provide mechanisms for users to securely backup and restore their wallets.
3. Integration: Update existing Aptos CLI commands to work seamlessly with the new wallet management system.
4. Wallet Storage Location: Store the encrypted wallet data in a centralized location (e.g., ~/.aptos/wallets/) rather than in individual project directories.

Benefits

1. Enhanced security: Centralized, encrypted storage reduces the risk of exposing private keys.
2. Improved user experience: Users can easily manage and use the same wallet across multiple projects and networks.
3. Standardization: Aligns with best practices in crypto wallet management, similar to other ecosystems like Ethereum (Foundry).
4. Flexibility: Users can choose between the new wallet system and the existing profile system, allowing for a gradual transition.
5. Reduced duplication: Eliminates the need to store multiple copies of the same private key across different projects.