Would you store an encrypted wallet (backup) of significant value on dropbox?
Assuming the passcode is good and secure.
The wallet in question is bitcoin-qt, encrypted using the built-in encryption feature.
Add a comment
|
2 Answers
Yes, you could store encrypted wallet in the dropbox.
From the first glance into the source code, the encryption algorithm is AES 256 CBC. This is industry standard protocol that is NOT known to be brute-force crackable* (subject to correct usage). You can read up more on the B. Schneier blog AES tag, where the most recent post say
[...] Reading the above, the obvious question to ask is: can the NSA break AES?
My guess is that they can't. That is, they don't have a cryptanalytic attack against the AES algorithm that allows them to recover a key from known or chosen ciphertext with a reasonable time and memory complexity. I believe that what the "top official" was referring to is attacks that focus on the implementation and bypass the encryption algorithm: side-channel attacks, attacks against the key generation systems (either exploiting bad random number generators or sloppy password creation habits), attacks that target the endpoints of the communication system and not the wire, attacks that exploit key leakage, attacks against buggy implementations of the algorithm, and so on. These attacks are likely to be much more effective against computer encryption.
There are chances, that the satellite code around the algorithm wasn't used correctly, or that there is a back door. There are some talks on the general security concepts in this thread. Despite it being open-source, there is no guarantee there are no bugs.
As an alternative you can store your wallet on the encrypted TrueCrypt partition. TrueCrypt source code is currently being investigated by the independent body for the security flaws.
Personally, I would use default encryption and trust it provides sufficient level of protection. Make sure your pass-phrase is strong, long and random, and that it is stored securely.
It all comes down to much do you care about the wallet's security. The more secure it is the less convenient it will be for you. In this case your wallet will be only as secure as your dropbox account (decrypting the wallet is just a matter of time).
Saving the encrypted wallet on your PC is also not that safe. If you really care about it you can store it in a usb stick with a linux based OS installed in it (Instead of keeping it on the PC). That way The OS with the wallet accesses the internet only for a brief time when you make a transaction. This is not a convenient way to perform a transaction but is the safest I know.
-
1You say it's "just a matter of time" to decrypt a wallet. That's a given. But what kind of practical timeframe are we talking about? 10000 years, or 5 days?– obeliaCommented Jan 6, 2014 at 21:23
-
Of course if you ware to use a password with 20 characters it would be virtually uncrackable. However I read not too long ago that a 25 AMD GPU cluster can bust any possible combination of an 8 character password in just 5.5 hours, which means that 1 GPU can crack it in about a week, which is still a feasible time frame. Anyway, if you decide to do this make sure you make a ridiculously long password, just in case. Commented Jan 7, 2014 at 0:19
-
3@User2344452 that assumes no key stretching. The Bitcoin wallet uses PBKDF2 with at least 100,000 rounds. So checking one password attempt isn't one hash it is 100,000 hashes and thus the computing requirements increase by a factor of 100,000. The wallet will perform a benchmark on your system to pick a iteration count that maximizes security while not creating an excessive delay for the user. Commented Apr 20, 2014 at 16:05