<p>Pieter's answer covers the technical details so I won't repeat any of that.  I would add that users should remember that the weakest point in Bitcoin-core wallet or any cryptographically strong encryption system is the passphrase.  The system converts a passphrase to an AES-256 key and that password derived key is used to encrypt a randomly generated master wallet key.  The master wallet key can not be brute forced barring a compromised or flawed PRNG however attackers can attempt to brute force the passphrase itself.  </p>

<p>The client adds attempts to harden against this attack by using both a salt (random number) and multiple rounds of hashing.   The salt prevents a precomputation attack as the same passphrase with different salts will produce different keys.  The use of multiple rounds of hashing slow down brute force attacks because the attacker will also need to perform multiple rounds on each passphrase attempted.</p>

<p>The client uses dynamic key hardening.  This means the number of rounds varies based on the computational power of the client (to keep time to encrypt or decrypt below 1 seconds).  The more computing power your hardware has the more rounds it performs, and the more difficult it will be to brute force the password.  When you change your passphrase the client will adjust the number of dynamic rounds based on your current hardware's computing power. By updating your password periodically you can ensure the password derived key keeps up with Moore's law.</p>

<p>Key hardening through the use of salt and key stretching can only go so far.  If your password is "p@ssw0rd!" or some other known commonly used password it will still be trivial to brute force the wallet.  To illustrate why lets assume the attacker has hardware which can attempt 100M hashes per second and your wallet is using 100,000 rounds of hashing.  This means the attackers hardware (100M hashes) can attempt 1,000 passwords per second.  So the wallet does slow the attacker down but if the password is weak then it can't slow it down enough.  There are lists of previously compromised/stolen/hacked passwords publicly available with tens of millions of passwords.  Without key stretching an attacker could attempt all possible known passwords in less than a second.  Key stretching slows that down to a few hours.  On the other hand lets say that your password was unknown and strong enough that with a single hash it would on average take one day to brute force.  With 100,000 rounds that increases the time to centuries.</p>

CC BY-SA 3.0
2011-10-24T16:13:09.570Z
I would add that the passphrase is called passphrase for a reason. Using "This is a very long - yet very simple - passphrase to remember" is *tons* of orders of magnitude more secure than "fl@a%%zG", even if using a dictionary attack.
Andreas Bonini
CC BY-SA 3.0
2011-10-25T01:20:12.103Z
@AndreasBonini: Thanks to your comment, that particular passphrase will now be part of the dictionary though ;-)
Thilo
CC BY-SA 4.0
2011-10-24T13:20:32.160Z
2019-09-29T15:36:31.713Z
2019-09-29T15:36:31.713Z
DeathAndTaxes
<p>A detailed explanation can be found in the application's README: <a href="https://github.com/bitcoin/bitcoin/blob/6b8a5ab622e5c9386c872036646bf94da983b190/doc/README" rel="nofollow">https://github.com/bitcoin/bitcoin/blob/6b8a5ab622e5c9386c872036646bf94da983b190/doc/README</a></p>

<p>In short:</p>

<ul>
<li>The passphrase is converted to a key/iv pair using EVP, with a dynamic number of rounds</li>
<li>This key/iv pair is used to encrypt a randomly-generated master key, using AES-256-CBC</li>
<li>The secret part of wallet keys are then encrypted using that master key, again with AES-256-CBC</li>
</ul>

CC BY-SA 3.0
2014-08-04T14:33:57.393Z
@ThePiachu Thanks for the updated link it saved me a few minutes.  I updated the answer to reflect the permanent link.
DeathAndTaxes
CC BY-SA 3.0
2012-01-19T20:15:56.717Z
Hmm, the README seems to be updated every now and then and the wallet encryption description is no longer there. Is this the version you were linking to? https://github.com/bitcoin/bitcoin/blob/6b8a5ab622e5c9386c872036646bf94da983b190/doc/README
ThePiachu
CC BY-SA 3.0
2011-10-24T11:31:42.900Z
2014-08-04T14:32:58.693Z
2014-08-04T14:32:58.693Z
Pieter Wuille
<p>What is the algorithm used for encrypting the wallet.dat file?</p>

<bitcoin-core><wallet><security><wallet.dat>
How does the Bitcoin client encrypt the wallet.dat file?
ThePiachu
# How does the Bitcoin client encrypt the wallet.dat file?

(Asked by: username_0 on 2011-10-24)

What is the algorithm used for encrypting the wallet.dat file?

**Tags:** bitcoin-core, wallet, security, wallet.dat


---

## 2 answers

### Answer by username_4 on 2011-10-24. Score: 10 | Accepted answer

A detailed explanation can be found in the application's README: <https://github.com/bitcoin/bitcoin/blob/6b8a5ab622e5c9386c872036646bf94da983b190/doc/README>

In short:

* The passphrase is converted to a key/iv pair using EVP, with a dynamic number of rounds
* This key/iv pair is used to encrypt a randomly-generated master key, using AES-256-CBC
* The secret part of wallet keys are then encrypted using that master key, again with AES-256-CBC

> **Comments:**
> **username_0**: Hmm, the README seems to be updated every now and then and the wallet encryption description is no longer there. Is this the version you were linking to? https://github.com/bitcoin/bitcoin/blob/6b8a5ab622e5c9386c872036646bf94da983b190/doc/README  
> **username_1**: @username_0 Thanks for the updated link it saved me a few minutes.  I updated the answer to reflect the permanent link.  

---

### Answer by username_1 on 2011-10-24. Score: 10

username_4's answer covers the technical details so I won't repeat any of that. I would add that users should remember that the weakest point in Bitcoin-core wallet or any cryptographically strong encryption system is the passphrase. The system converts a passphrase to an AES-256 key and that password derived key is used to encrypt a randomly generated master wallet key. The master wallet key can not be brute forced barring a compromised or flawed PRNG however attackers can attempt to brute force the passphrase itself.

The client adds attempts to harden against this attack by using both a salt (random number) and multiple rounds of hashing. The salt prevents a precomputation attack as the same passphrase with different salts will produce different keys. The use of multiple rounds of hashing slow down brute force attacks because the attacker will also need to perform multiple rounds on each passphrase attempted.

The client uses dynamic key hardening. This means the number of rounds varies based on the computational power of the client (to keep time to encrypt or decrypt below 1 seconds). The more computing power your hardware has the more rounds it performs, and the more difficult it will be to brute force the password. When you change your passphrase the client will adjust the number of dynamic rounds based on your current hardware's computing power. By updating your password periodically you can ensure the password derived key keeps up with Moore's law.

Key hardening through the use of salt and key stretching can only go so far. If your password is "p@ssw0rd!" or some other known commonly used password it will still be trivial to brute force the wallet. To illustrate why lets assume the attacker has hardware which can attempt 100M hashes per second and your wallet is using 100,000 rounds of hashing. This means the attackers hardware (100M hashes) can attempt 1,000 passwords per second. So the wallet does slow the attacker down but if the password is weak then it can't slow it down enough. There are lists of previously compromised/stolen/hacked passwords publicly available with tens of millions of passwords. Without key stretching an attacker could attempt all possible known passwords in less than a second. Key stretching slows that down to a few hours. On the other hand lets say that your password was unknown and strong enough that with a single hash it would on average take one day to brute force. With 100,000 rounds that increases the time to centuries.

> **Comments:**
> **username_2**: I would add that the passphrase is called passphrase for a reason. Using "This is a very long - yet very simple - passphrase to remember" is *tons* of orders of magnitude more secure than "fl@a%%zG", even if using a dictionary attack.  
> **username_3**: @username_2: Thanks to your comment, that particular passphrase will now be part of the dictionary though ;-)  

---

