Can anyone explain what are the advantages of using BIP 38 Bitcoin wallet encryption to simply encrypting the private key with AES256?


See the following links for an overview and for details.

Note: In short, if you do not have a strong understanding of the BIP38 encryption and decryption workflow, do not BIP38-encrypt your paper wallet. Just print your paper wallet out without encryption, and keep it safe the same way you would jewels or cash.

Just encrypting with AES provides excellent security but the weakness is the key which is unwieldily since it needs to be random binary data and the encrypted output which is also binary data. In order to use a passphrase as the encryption key a function such as PBKDF2 is generally used and the output can be base64 encoded to make it ASCII so it can be printed/written. Finally, unless you are a crypto domain expert do not roll-your-own security schemes, they generally will contain flaws rendering the security null.

Note: Scrypt is a form of Password-Based Key Derivation Function (PBKDF2) that has increased memory requirements.

BIP38 encryption provides the above and some inter ability with the crypto currency eco-system.

  • Thank you Zaph, I understand. So here is a more specific question. I am building a simple app for cold storage of Bitcoin on an offline Raspberry Pi (coincooler.com). What I am currently doing is encrypting a comma delimited list of keys with AEScrypt. The password is a random string of length 40 on the alphabet [a-zA-Z0-9 + some extra characters]. Is there a vulnerability in that scheme? Apr 4 '14 at 13:25
  • When designing a security system first you must decide on the level of security needed. What level of security are you looking for? How many $ will this be protecting? Just yourself of for public/wide distribution? What are the attacks you are protecting against? There is a large range of security, high end devices self-destruct on detection of tampering or attack. When I designed mass market security products I paid a top level security expert to vet my design and implementation. His first questions were along the line of what I asked above and more.
    – zaph
    Apr 4 '14 at 13:56

BIP38 does use AES behind the scenes.

This question is difficult to answer, because AES has multiple modes (ways of using it) and only some of them are secure. As Zaph noted, you also need to pick a secure key derivation function (though a single iteration of PBKDF will not suffice).

Instead of making your own implementation, why not use gpg -c or BIP38?

  • Thanks Nick. What I ended up doing was using OpenSSL. The random 256 bit key is derived using OpenSSL's AES256 CBC cipher. In case the user opts for a password I stretch it a million times using OpenSSL's PKCS5 standardPBKDF2_HMAC with random salt and IV. Oct 30 '14 at 15:36
  • @AssafShomer random 256 bit key is derived using OpenSSL's AES256 CBC You know that AES isn't a random number generator, right?
    – Nick ODell
    Oct 30 '14 at 15:48
  • Of course, what i meant was Oct 30 '14 at 15:54
  • OpenSSL::Cipher::AES256.new(:CBC).random_key Oct 30 '14 at 15:55
  • Using the ruby implementation of OpenSSL. Sorry for the multiple comments, not used to enter being Post... Oct 30 '14 at 15:57

BIP 38 is currently the ultimate form of cold storage paper wallets. If you print copies of your BIP38 QR codes corresponding to your private keys, and somebody steals a copy, you are probably not going to loose any money provided you have strong passwords.

Additionally, software based wallets are starting to support the importation and sweeping of BIP38 encoded cold wallets. Any BIP 38 encoded private keys are easy to spot because the begin with "6PR". These first three letters allow BIP standards-based wallets to recognize the private keys are AES encrypted and will prompt the user for a password to support importation or sweeping.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.