Blockchain.info Wallet Format

Question

I've noticed that BCI's Wallet version has been updated to version 2 in recent times (and also employs key stretching, amongst other security features).

I've referred to BCI's Wallet Support Page and it says Version 2 wallet data is of the following format:

{
"version" : "2.0",
"pbkdf2_iterations" : 10000,
"payload" : "ENCRYPTED VERSION 1 PAYLOAD (SEE BELOW)"
}

What about the below JSON object (which can be accessed via URL of format https://blockchain.info/wallet/INSERT_GUID_HERE?format=json&resend_code=false)? What version does this correspond to?

To be clear, the difference is my JSON data is missing:

• the pbkdf2_iterations variable
• the version (=2) variable

For the data in question, here is the (edited) JSON object which is taken from the aforementioned link (replacing GUID with the actual GUID):

{"initial_error":"For Improved security add an email address to your account.","auth_type":0,"real_auth_type":0,"symbol_local":{"symbol":"$","code":"USD","symbolAppearsAfter":false,"name":"U.S. dollar","local":true,"conversion":442752.14734791},"clientTimeDiff":26055161055,"war_checksum":"c8c296cf351e7691","language":"en","symbol_btc":{"symbol":"mBTC","code":"MBC","symbolAppearsAfter":true,"name":"MilliBit (mBTC)","local":false,"conversion":100000.00000000},"extra_seed":"89e4807b343acfed576c474a675da1daac3ddb76691d05963a9e0a76533ca7ad4cd12ff058b40a1dd2f57a40759bb484a3708c3545ccfd995913964f148d405f","payload":"PAYLOAD DATA","guid":"GUID","serverTime":1423127480609,"payload_checksum":"8f8e16d79e7528e9725bef006a9752894e5d344d0324ba4ac6f6e4d804e02971","sync_pubkeys":false}

Compare this to current JSON data (for a wallet created for this purposehttps://blockchain.info/wallet/1d39195b-d918-4b7b-acae-d47db3324454?format=json&resend_code=false

{"initial_error":"For Improved security add an email address to your account.","extra_seed":"92a5d897af5c491e9e36dfad95f72b616553b23e02777859729c49b934ebbe1a575aa31a8ce0ba9978b9901caae649dd112d1759da5e48117379fbab0a91b083","auth_type":0,"real_auth_type":0,"payload":"{\"pbkdf2_iterations\":5000,\"version\":2,\"payload\":\"RyUtA4LJw69ly2ADu+zZLfoQ447o0gKhwXUAtzdbKpWOtvwjzHM8VY+zXU1z\/FklZJK\/in7XpWzz+zKnw3kHw0oSkLf1FaYVNR4zivUTRuXUaj5g\/Yq6DPhxpHyjEJGtXriqPP\/X713FePGBW5QolJplgIY15Q4GLNdPbanxfEI9LGuvO87tIXxUWY597MtqNzQQH67P+zCMw4q+kgS4wzchI\/D\/cQHRYH2gNSjMiv9rZbUPM7NKVR6IYJPokyoslHBBpN\/9qyCFNUHy1l\/SdPeNXRa\/UnBSsXu7Sf8TZuLL1REvYfoyFm3JOE3Fk3iJWbjN\/mgzDOFuF9sMXiqL5r7+guMm05da3bVvyLYOSMK7ZXRFKnDle53ga5FUhy+GUYcnHTSbXU3qTmDzr4Y4J1EE\/CDm7ceNXs9kl9OLy5bVU6MyezVvRR7hIDrBQLsA5kQMtZz6KTE7L5AaZ6aoigP94iP06SB8ZDOlcjVX\/nkDGS2Ajk2bPu5LiZwxglEgzEUpRrd3rglWp14n3X7EhF8w3PUgNeZTO2znOVwYNi568u+ORE3iOgOOkWLYTjV0QWOAdUn2OCR95lUna5MJbD19v5B0Jhn18grhJM\/2k34R\/F\/U2qhhRm6\/qVajAMSW7OTQzRdx0pyYXAHkbXjEUW1q0GyvEru9eg\/gkzc8j6PTZCp1avxevyqctddkgie4MM2saL09sH2rbrWfyV2Ihw==\"}","symbol_local":{"symbol":"$","code":"USD","symbolAppearsAfter":false,"name":"U.S. dollar","local":true,"conversion":443419.65235899},"guid":"1d39195b-d918-4b7b-acae-d47db3324454","payload_checksum":"030de1efb09ee9485eaf009095b02b5ec8536432fa3ccc5588e8831b9c9983ea","war_checksum":"c8c296cf351e7691","language":"en","symbol_btc":{"symbol":"BTC","code":"BTC","symbolAppearsAfter":true,"name":"Bitcoin","local":false,"conversion":100000000.00000000},"sync_pubkeys":false}

Answer 1

I mostly detailed the various encryption schemes used in version 1 wallets over here: https://bitcointalk.org/index.php?topic=1012475.msg11105755#msg11105755

Incidentally, it's not trivial to create such a wallet any longer, now that the default is version 2. It is easy to convert a version 1 wallet into version 2: just change the iteration count under security settings.

(edited to include the referenced content here, on request)

That's a version 1 (what the code refers to as version 0 IIRC) encrypted wallet. There have been several different encryption schemes used for this wallet version—the only way to differentiate them is to try them all, and see which one works.

The schemes have some shared attributes: the payload is stored base-64 encoded, the first 16 bytes is used as both the KDF's salt and the encryption mode's IV (and the rest is the ciphertext), the password is UTF-8 encoded (it's not normalized), and the KDF is PBKDF2-SHA1. The scheme differences, in most recent to oldest order, are:

• the KDF iteration count is 10, encryption is AES-256 in CBC mode with ISO 10126 padding (same as version 2 wallets, but with a hard-coded iteration count)
• same as the above, but the iteration count is 1
• the iteration count is 1, encryption is AES-256 in OFB mode with ISO 7816-4 padding

Likewise, the second-password encryption has gone through a number of schemes; I think they parallel the ones above, but I'm not sure and don't have the details readily available.

The second password is also stored hashed inside the wallet file, and I do have the details of the various hashing schemes (again, password is UTF-8 encoded, most recent to oldest):

• the salt is the sharedKey field (the literal string, not the underlying UUID bytes), the hash is PBKDF1-SHA256 with an iteration count of 10 (same as version 2 wallets, but with a hard-coded iteration count)
• same as the above, but the iteration count is 1
• the hash is SHA256(password) (unsalted)