<p>While I don't have a <em>direct</em> answer to your questions, I guess you can find those looking at the source of <a href="https://bitbucket.org/lohoris/mywallet-restore" rel="nofollow">the restore script</a>.</p>

CC BY-SA 3.0
2013-03-01T15:36:13.570Z
Thanks Lohoris; that got me on the right track! I did find that that particular restore script is outdated (the encryption method changed in March of 2012). Though it pointed me to [this working script](https://gist.github.com/anfedorov/2757171) and the [restore tool](https://blockchain.info/DecryptWallet.html) that helped me figure it out.
MidnightLightning
CC BY-SA 3.0
2013-03-01T08:59:35.040Z
2013-03-01T08:59:35.040Z
o0'.
<p>Okay, so after investigating the provided <a href="https://blockchain.info/DecryptWallet.html">restore tool</a> (thanks Lohoris for pointing it out!), I arrived at the following answers to my questions:</p>

<ul>
<li>The input key for the AES decryption is 32 bytes (256 bits)</li>
<li>The block size used is 16 bytes (<code>MCRYPT_RIJNDAEL_128</code> for <a href="http://php.net/mcrypt">PHP mcrypt</a> functions)</li>
<li>The initialization vector (IV) for the AES decryption is the first 16 bytes (one block size) of the encrypted string. The remaining encrypted string is the encrypted message.</li>
<li>The user's password is expanded by using 10 rounds of PBKDF2 hashing, using SHA1 hashing, <strong>and the IV as salt</strong> (the "No salt is used for single pass encryption" note seems to just mean no salt for the AES encryption. For the PBKDF2 hashing, there is a salt).</li>
</ul>

<p>Note, if using PHP <code>mcrypt</code> extension functions (like I was trying to), you need to use the <code>mdecrypt_generic()</code> method rather than <code>mcrypt_decrypt()</code>, since Blockchain using ISO10126 padding, and the <code>mcrypt</code> extension will only use "zero padding". You then have to un-pad the result separately.</p>

CC BY-SA 3.0
2013-03-01T15:33:47.080Z
2013-03-01T15:56:40.067Z
2013-03-01T15:56:40.067Z
MidnightLightning
<p>Blockchain.info's encrypted wallet format is <a href="https://blockchain.info/wallet/wallet-format">described</a> as:</p>

<blockquote>
  <p>AES encrypting the entire JSON payload with the users password which
  is then encoded as base64. No salt is used for single pass encryption.
  The exact AES specifications are 10 rounds of PBKDF2, Block Mode CBC
  ISO10126 padding.</p>
</blockquote>

<p>However, in trying to verify my own encrypted exports, it seems thats not all the information (or correct). I think part of the issue is in how the user's password is expanded to an input key for the AES/Rijndael cipher.</p>

<ul>
<li>The input key for AES can be 128, 192, or 256 bits; which is being used?</li>
<li>AES has its own <a href="http://en.wikipedia.org/wiki/Rijndael_key_schedule">key schedule</a>, but it seems Blockchain is using something separate, as "PBKDF2" is another key expansion function.</li>
<li>PBKDF2 is a methodology that can be used with many types of hashes; which hash is being used?</li>
</ul>

<blockchain.info>
Decrypt Blockchain.info wallet export
MidnightLightning
# Decrypt Blockchain.info wallet export

(Asked by: username_0 on 2013-03-01)

Blockchain.info's encrypted wallet format is [described](https://blockchain.info/wallet/wallet-format) as:

> AES encrypting the entire JSON payload with the users password which
> is then encoded as base64. No salt is used for single pass encryption.
> The exact AES specifications are 10 rounds of PBKDF2, Block Mode CBC
> ISO10126 padding.

However, in trying to verify my own encrypted exports, it seems thats not all the information (or correct). I think part of the issue is in how the user's password is expanded to an input key for the AES/Rijndael cipher.

* The input key for AES can be 128, 192, or 256 bits; which is being used?
* AES has its own [key schedule](http://en.wikipedia.org/wiki/Rijndael_key_schedule), but it seems Blockchain is using something separate, as "PBKDF2" is another key expansion function.
* PBKDF2 is a methodology that can be used with many types of hashes; which hash is being used?

**Tags:** blockchain.info


---

## 2 answers

### Answer by username_0 on 2013-03-01. Score: 7 | Accepted answer

Okay, so after investigating the provided [restore tool](https://blockchain.info/DecryptWallet.html) (thanks Lohoris for pointing it out!), I arrived at the following answers to my questions:

* The input key for the AES decryption is 32 bytes (256 bits)
* The block size used is 16 bytes (`MCRYPT_RIJNDAEL_128` for [PHP mcrypt](http://php.net/mcrypt) functions)
* The initialization vector (IV) for the AES decryption is the first 16 bytes (one block size) of the encrypted string. The remaining encrypted string is the encrypted message.
* The user's password is expanded by using 10 rounds of PBKDF2 hashing, using SHA1 hashing, **and the IV as salt** (the "No salt is used for single pass encryption" note seems to just mean no salt for the AES encryption. For the PBKDF2 hashing, there is a salt).

Note, if using PHP `mcrypt` extension functions (like I was trying to), you need to use the `mdecrypt_generic()` method rather than `mcrypt_decrypt()`, since Blockchain using ISO10126 padding, and the `mcrypt` extension will only use "zero padding". You then have to un-pad the result separately.


---

### Answer by username_1 on 2013-03-01. Score: 3

While I don't have a *direct* answer to your questions, I guess you can find those looking at the source of [the restore script](https://bitbucket.org/lohoris/mywallet-restore).

> **Comments:**
> **username_0**: Thanks Lohoris; that got me on the right track! I did find that that particular restore script is outdated (the encryption method changed in March of 2012). Though it pointed me to [this working script](https://gist.github.com/anfedorov/2757171) and the [restore tool](https://blockchain.info/DecryptWallet.html) that helped me figure it out.  

---

