openclaw - 💡(How to fix) Fix [Feature Request] Add config encryption for credentials at rest [1 comments, 2 participants]

# openclaw/crypto.py
import os, json, base64, hashlib
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import keyring  # optional, pip install keyring

_KEYRING_SERVICE = "openclaw"
_KEYRING_ACCOUNT = "config_master_key"
_SALT_FILE = os.path.expanduser("~/.openclaw/.salt")

def _derive_key(password: bytes, salt: bytes) -> bytes:
    # PBKDF2-HMAC-SHA256, 200k iterations
    return hashlib.pbkdf2_hmac("sha256", password, salt, 200_000, dklen=32)

def _get_salt() -> bytes:
    if not os.path.exists(_SALT_FILE):
        os.makedirs(os.path.dirname(_SALT_FILE), exist_ok=True)
        salt = os.urandom(16)
        with open(_SALT_FILE, "wb") as f:
            f.write(salt)
        return salt
    with open(_SALT_FILE, "rb") as f:
        return f.read()

def _load_master_key() -> bytes:
    """Try OS keyring first, otherwise raise."""