<p>An important thing to note is that a wallet.dat file is not encrypted entirely, only private keys are. Each private key also has its own IV rather than an IV for the entire wallet file.</p>
<p>The value component of the <code>mkey</code> record contains the encrypted AES key, the salt, the derivation method, the number of derivation iterations, and other derivation parameters. This will be in the form:</p>
<pre><code>&lt;encrypted AES key length&gt; &lt;encrypted AES key bytes&gt; &lt;salt length&gt; &lt;salt bytes&gt; &lt;32-bit int derivation method&gt; &lt;32-bit int number of derivations&gt; &lt;other parameters length&gt; &lt;other parameters bytes&gt;
</code></pre>
<p>Lengths are encoded using Bitcoin's compact size unsigned integers format.</p>
<p>For example, here is an <code>mkey</code> record from a wallet:</p>
<pre><code>3051608a94fc01faba1d49d4bda9e25ea46757e5c131f47a67d0f1873a9e02481db575e08a1ad20958caf6c4c69529deb7082ce050702dd2bc0700000000bcb8040000
</code></pre>
<p>The length of the encrypted AES key is <code>30</code>. The encrypted AES key is <code>51608a94fc01faba1d49d4bda9e25ea46757e5c131f47a67d0f1873a9e02481db575e08a1ad20958caf6c4c69529deb7</code>. The length of the salt is <code>08</code>, and the salt is <code>2ce050702dd2bc07</code>. The derivation method is <code>00000000</code>, and the number of iterations is <code>bcb80400</code>. The length of the other parameters is <code>00</code>, and so there are no bytes remaining for the other parameters.</p>
<p>In order to get the actual AES key used for the wallet's private keys, the wallet's passphrase is used to construct the key used to encrypt the AES key. The only derivation method (indicated by the <code>00000000</code> in the <code>mkey</code> record) concatenates the passphrase with the salt and hashes it using SHA512. The number of times this is hashed depends on the stored iterations parameter. The first 32 bytes of that hash is the key used to encrypt the AES key. The next 16 bytes is its IV. The remaining 16 bytes are discarded.</p>
<p>This computed key is used to decrypt the AES key which is used for the actual private keys. The IV for those private keys is the first 16 bytes of the SHA256 of the key's public key.</p>

CC BY-SA 4.0
2021-12-17T20:36:08.163Z
2021-12-17T20:36:08.163Z
Ava Chow
<p>I have created an encrypted bitcoin file. I know the password and I see the mkey in the hex dump. I would like to know where the AES key / IV pair are located in the wallet.dat file?</p>

CC BY-SA 4.0
2019-07-30T18:58:26.847Z
Which AES key are you referring to?
JBaczuk
CC BY-SA 4.0
2019-07-30T19:35:16.553Z
The AES key and IV which is generated from the passphrase which is entered to encrypt the wallet. This is what I am looking for on my own wallet.dat file.
kmart875
<wallet><private-key>
Where is the AES-256 key/ IV pair stored in wallet.dat file?
kmart875
# Where is the AES-256 key/ IV pair stored in wallet.dat file?

(Asked by: username_0 on 2019-07-30)

I have created an encrypted bitcoin file. I know the password and I see the mkey in the hex dump. I would like to know where the AES key / IV pair are located in the wallet.dat file?

**Tags:** wallet, private-key

> **Comments:**
> **username_1**: Which AES key are you referring to?  
> **username_0**: The AES key and IV which is generated from the passphrase which is entered to encrypt the wallet. This is what I am looking for on my own wallet.dat file.  

---

## 1 answers

### Answer by username_2 on 2021-12-17. Score: 1

An important thing to note is that a wallet.dat file is not encrypted entirely, only private keys are. Each private key also has its own IV rather than an IV for the entire wallet file.

The value component of the `mkey` record contains the encrypted AES key, the salt, the derivation method, the number of derivation iterations, and other derivation parameters. This will be in the form:

```
<encrypted AES key length> <encrypted AES key bytes> <salt length> <salt bytes> <32-bit int derivation method> <32-bit int number of derivations> <other parameters length> <other parameters bytes>

```

Lengths are encoded using Bitcoin's compact size unsigned integers format.

For example, here is an `mkey` record from a wallet:

```
3051608a94fc01faba1d49d4bda9e25ea46757e5c131f47a67d0f1873a9e02481db575e08a1ad20958caf6c4c69529deb7082ce050702dd2bc0700000000bcb8040000

```

The length of the encrypted AES key is `30`. The encrypted AES key is `51608a94fc01faba1d49d4bda9e25ea46757e5c131f47a67d0f1873a9e02481db575e08a1ad20958caf6c4c69529deb7`. The length of the salt is `08`, and the salt is `2ce050702dd2bc07`. The derivation method is `00000000`, and the number of iterations is `bcb80400`. The length of the other parameters is `00`, and so there are no bytes remaining for the other parameters.

In order to get the actual AES key used for the wallet's private keys, the wallet's passphrase is used to construct the key used to encrypt the AES key. The only derivation method (indicated by the `00000000` in the `mkey` record) concatenates the passphrase with the salt and hashes it using SHA512. The number of times this is hashed depends on the stored iterations parameter. The first 32 bytes of that hash is the key used to encrypt the AES key. The next 16 bytes is its IV. The remaining 16 bytes are discarded.

This computed key is used to decrypt the AES key which is used for the actual private keys. The IV for those private keys is the first 16 bytes of the SHA256 of the key's public key.


---

