New Algorithm Request Blockchain.info V0 Wallet

[Drax4545]

Blockchain v0 wallet is using a different algorithm than blockchain v1 wallets to v4.

Example of the wallet and password. wallet.aes.zip

You can decrypt it here: https://pastehtml.com/view/blubcjzgc.html https://github.com/blockchain/my-wallet-backup-decryption-tool

The creator posts about the wallet. https://bitcointalk.org/index.php?topic=40264.msg799527#msg799527

[solardiz]

@Drax4545 Does this request differ from @WiseMonkeyX's #5347, and if so in what ways, or is it a dupe? Either way, there's currently no intent/incentive to prioritize these, so they will likely just hang here for a long time, unless one of you two or someone else volunteers to work on them and contributes a pull request. Thanks.

[solardiz]

Related issue and discussion on hashcat GitHub: https://github.com/hashcat/hashcat/issues/3820

[solardiz]

@Drax4545 @WiseMonkeyX Also, how does(?) this differ from #5331?

[Drax4545]

@Drax4545 @WiseMonkeyX Also, how does(?) this differ from #5331?

Those in #5331 are blockchain v1 wallet. Which uses 10 rounds. blockchain v0 wallet uses only 1 round.

https://github.com/hashcat/hashcat/issues/3820

[Drax4545]

How much to correct this one? I'm willing to sponsor this request.

[solardiz]

@Drax4545 Thank you. Can you please e-mail me at solar@openwall.com and we'll take further discussion from there (I may add CC: as necessary)? In general, we don't have full cost estimates in advance (it takes some research to arrive at them, which means already starting the work), so it's either a bounty you offer, or a two-step process (first we agree on what it'd cost to research the request and come up with a full cost estimate, and then if you accept we proceed with the actual implementation at the agreed full cost or its estimate).

[solardiz]

As I now understand from an e-mail discussion, we're now getting 100% false negatives for v0 and v1 formats, so people end up wasting time and compute resources. Maybe before we have proper support for these versions, we should add their detection and reject them explicitly. This is hopefully easy enough to implement sooner.

[ghost]

From the blockchain devs themselves decrypt tool:

function decryptWalletV1 (data, password) {
  // Possible decryption methods for v1 wallets
  var decryptFns = [
    // v1: CBC, ISO10126, 10 iterations
    decryptDataWithPassword.bind(null, data, password, 10),

    // v1: OFB, nopad, 1 iteration
    decryptDataWithPassword.bind(null, data, password, 1, {
      mode: AES.OFB,
      padding: NoPadding
    }),

    // v1: OFB, ISO7816, 1 iteration
    // ISO/IEC 9797-1 Padding method 2 is the same as ISO/IEC 7816-4:2005
    decryptDataWithPassword.bind(null, data, password, 1, {
      mode: AES.OFB,
      padding: Iso97971
    }),

    // v1: CBC, ISO10126, 1 iteration
    decryptDataWithPassword.bind(null, data, password, 1, {
      mode: AES.CBC,
      padding: Iso10126
    })
];

  return decryptFns.reduce(function (acc, decrypt) {
    if (acc) return acc;
    try {
      return JSON.parse(decrypt());
    } catch (e) {
      return null;
    }
  }, null)