Decrypt Blockchain.info wallet export

Question

Blockchain.info's encrypted wallet format is described as:

AES encrypting the entire JSON payload with the users password which is then encoded as base64. No salt is used for single pass encryption. The exact AES specifications are 10 rounds of PBKDF2, Block Mode CBC ISO10126 padding.

However, in trying to verify my own encrypted exports, it seems thats not all the information (or correct). I think part of the issue is in how the user's password is expanded to an input key for the AES/Rijndael cipher.

• The input key for AES can be 128, 192, or 256 bits; which is being used?
• AES has its own key schedule, but it seems Blockchain is using something separate, as "PBKDF2" is another key expansion function.
• PBKDF2 is a methodology that can be used with many types of hashes; which hash is being used?

Answer 1

Okay, so after investigating the provided restore tool (thanks Lohoris for pointing it out!), I arrived at the following answers to my questions:

• The input key for the AES decryption is 32 bytes (256 bits)
• The block size used is 16 bytes (MCRYPT_RIJNDAEL_128 for PHP mcrypt functions)
• The initialization vector (IV) for the AES decryption is the first 16 bytes (one block size) of the encrypted string. The remaining encrypted string is the encrypted message.
• The user's password is expanded by using 10 rounds of PBKDF2 hashing, using SHA1 hashing, and the IV as salt (the "No salt is used for single pass encryption" note seems to just mean no salt for the AES encryption. For the PBKDF2 hashing, there is a salt).

Note, if using PHP mcrypt extension functions (like I was trying to), you need to use the mdecrypt_generic() method rather than mcrypt_decrypt(), since Blockchain using ISO10126 padding, and the mcrypt extension will only use "zero padding". You then have to un-pad the result separately.

Answer 2

While I don't have a direct answer to your questions, I guess you can find those looking at the source of the restore script.