security: encrypt EOA private key with keystore JSON

[hadv]

Summary

• Fix security vulnerability: The EOA vanity miner previously printed the raw private key to stdout, creating a data leak risk via terminal scrollback, shell logging, screen sharing, or piped output
• Encrypted keystore output: Private key is now encrypted using the standard Ethereum Web3 Secret Storage format (scrypt + AES-128-CTR) and saved to a JSON keystore file with 0600 permissions — the same format used by geth account new
• Memory safety: Raw private key bytes are zeroed from memory immediately after encryption
• New CLI flags: --output/-o for custom file path, --password for scripted use, --light-kdf for faster encryption in testing

Security details

• The raw private key is never printed to stdout
• Interactive password prompt uses golang.org/x/term.ReadPassword() (no echo) with confirmation
• Keystore file written with 0600 permissions (owner read/write only)
• Private key material (big.Int bits and []byte slice) is explicitly zeroed after use

Usage

# Interactive password prompt (recommended)
./vaneth --mode eoa -p 0xABC

# Scripted with password flag
./vaneth --mode eoa -p 0xABC --password mypassword -o mykey.json

# Use lighter KDF for testing
./vaneth --mode eoa -p 0x00 --light-kdf --password test

Test plan

• go build ./... compiles cleanly
• go vet ./... passes
• go test ./... passes
• Manual test: run EOA miner with --light-kdf --password test, verify keystore JSON is written
• Manual test: verify keystore can be imported into geth or another Ethereum wallet
• Manual test: verify interactive password prompt works with confirmation

🤖 Generated with Claude Code