offline node and my priv keys not working

[darkv0rt3x]

Hello.

I run an offline node just for creating addresses and basically avoid exposing my newest addresses private keys. And sometimes I use this node to run some commands to learn about them.
I'm running this node in an offline and encrypted Debian Buster virtual machine andd running Bitcoin Core Daemon version v0.18.1.

Anyways, the situation is this:
I have a wallet I created with this node, let's call it my-wallet just to name things an to be the most clear I can.
I created some addresses (1, 3 and bc1) from this wallet. They were all created from this wallet.
Then I have locked down the wallet with the encryptwallet command.

But now, when I try to dump my addresses private key, node tells me the same private key for all addresses.

Why is this happening?

[1714750845]

1714750845

[ranochigo]

Are you generating all 3 types of addresses? By default, Bitcoin Core only generates native segwit. Did you modify the conf file to generate legacy address?

How are you extracting the private key exactly? A single private key can be used to derive all 3 address types. Could you try dumping 2 different bc1 addresses and check the private keys?

[nc50lc]

Then I have locked down the wallet with the encryptwallet command.

This only changed the HD seed of your wallet for the new addresses, created another set of keys in your keypool while keeping the old keys.
So there shouldn't be any problem with the previously created keys.
I think this is not the issue.

I created some addresses (1, 3 and bc1) from this wallet. They were all created from this wallet.

Did you created those addresses using getnewaddress "" "address-type"; or set a start parameter/config file?
Because if you used the latter, Bitcoin Core will derive the selected address type from the same keypool.

Like my test (regtest):
Wallet started with -addresstype=legacy

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=mhbNXxRD1NySfJ8p7ehbF3hfXVKQcm5z6B hdkeypath=m/0'/0'/1'

Wallet started with -addresstype=p2sh-segwit

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=2My3QdbSW5dyiz8ccJMjvH8RWdT9fzaKeiQ hdkeypath=m/0'/0'/1'

Wallet started with -addresstype=bech32

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=bcrt1qzmrzv53lfccgaajpc9m2fvu5tadxz4n9wwjwcf hdkeypath=m/0'/0'/1'

If not through -addresstype=, there is surely a problem.

[darkv0rt3x]

Are you generating all 3 types of addresses? By default, Bitcoin Core only generates native segwit. Did you modify the conf file to generate legacy address?

How are you extracting the private key exactly? A single private key can be used to derive all 3 address types. Could you try dumping 2 different bc1 addresses and check the private keys?

Yes, I used the proper commands to generate '1', '3' and 'bc1' addresses.

What I do to try to get the private keys are:

start the deamon. Note: I tried to start it in 2 ways just to rule out any possibility.

Code:

bitcoind

and

Code:

bitcoind -wallet=wallet-name-here

The difference is only that if I use the first command, I have to load the wallet with bitcoin-cli and always use "-rpcwaller=wallet-name-here" before issuing any command.
I'll assume here that I use the 1st method using -rpcwallet before any command.

Then, after the deamon is running I load the wallet with:

Code:

bitcoin-cli loadwallet wallet-name-here

Then I unlock the wallet for 3 minutes (just as an example), because I locked it when I created it.

Code:

bitcoin-cli -rpc-wallet=wallet-name-here walletpassphrase password-here 180

Then I get the address I want to dump the private key using:

Code:

bitcoin-cli -rpc-wallet=wallet-name-here listlabels
bitcoin-cli -rpc-wallet=wallet-name-here getaddressesbylabel

and finally I try to dump the private key for the address I want:

Code:

bitcoin-cli -rpc-wallet=wallet-name-here dumpprivkey "address here"

But I'm always getting the same privkey for any address I have.
I have tried the same for the default address where there is also an address that I actually don't use, and the privkey is different. I can't understand why it gives me the same privkey in this wallet that I'm trying to do it.

Could you try dumping 2 different bc1 addresses and check the private keys?

You mean to create 2 new addresses and check their private keys?

Then I have locked down the wallet with the encryptwallet command.

This only changed the HD seed of your wallet for the new addresses, created another set of keys in your keypool while keeping the old keys.
So there shouldn't be any problem with the previously created keys.
I think this is not the issue.

I created some addresses (1, 3 and bc1) from this wallet. They were all created from this wallet.

Did you created those addresses using getnewaddress "" "address-type"; or set a start parameter/config file?
Because if you used the latter, Bitcoin Core will derive the selected address type from the same keypool.

Like my test (regtest):
Wallet started with -addresstype=legacy

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=mhbNXxRD1NySfJ8p7ehbF3hfXVKQcm5z6B hdkeypath=m/0'/0'/1'

Wallet started with -addresstype=p2sh-segwit

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=2My3QdbSW5dyiz8ccJMjvH8RWdT9fzaKeiQ hdkeypath=m/0'/0'/1'

Wallet started with -addresstype=bech32

Code:

cUKHjYsDHDotrZMuiMGewq7KDU9YRdMPDbKCcaVQ9fF6cHtQZj5A 2020-05-23T04:05:48Z
reserve=1 # addr=bcrt1qzmrzv53lfccgaajpc9m2fvu5tadxz4n9wwjwcf hdkeypath=m/0'/0'/1'

If not through -addresstype=, there is surely a problem.

No, I've created them all by command getnewaddress and address-type.

[ranochigo]

But I'm always getting the same privkey for any address I have.
I have tried the same for the default address where there is also an address that I actually don't use, and the privkey is different. I can't understand why it gives me the same privkey in this wallet that I'm trying to do it.

You mean to create 2 new addresses and check their private keys?

If you aren't getting any error when you dump the priv key, it would appear that there isn't an issue with the commands given.

To clarify, when you mean any address, you mean when you use any 2 different addresses from the same type? Ie, You're querying 2 different bc1 addresses, 2 different P2PWSH or 2 different legacy addresses? Does the address start with 5, K or L?

[bob123]

You can derive all 3 kinds of addresses (legacy, p2sh, bech32) from the same private key.
And i think this is what happened here.

You can try what ranochigo mentioned. Create a second address from any type. This private key will be different.

[darkv0rt3x]

But I'm always getting the same privkey for any address I have.
I have tried the same for the default address where there is also an address that I actually don't use, and the privkey is different. I can't understand why it gives me the same privkey in this wallet that I'm trying to do it.

You mean to create 2 new addresses and check their private keys?

If you aren't getting any error when you dump the priv key, it would appear that there isn't an issue with the commands given.

To clarify, when you mean any address, you mean when you use any 2 different addresses from the same type? Ie, You're querying 2 different bc1 addresses, 2 different P2PWSH or 2 different legacy addresses? Does the address start with 5, K or L?

I'm sorry I wasn't clear.
I have tried the dumpprivkey for one address starting with 1, and then repeated the command for an address starting with 3 and finallyrepeated the command dumpprivkey for an address starting with bc1. So I got 3 outputs. That output, which is the private key, was the same for the 3 times I used the dumpprivkey  for each of the 3 addresses.


I'll create 2 new addresses, bc1 ones and will check the private keys. I'll do it from within this wallet.

And now, is it still possible to get each address private key individually?

You can derive all 3 kinds of addresses (legacy, p2sh, bech32) from the same private key.
And i think this is what happened here.

You can try what ranochigo mentioned. Create a second address from any type. This private key will be different.

Which would be the commands I need to use to get the individual addresses private keys?



Edited;

Ok, I just created 2 new addresses in this same wallet and privkeys are different.

So now the question is how do I retrieve my other addresses individual private keys???

[LoyceV]

I have tried the dumpprivkey for one address starting with 1, and then repeated the command for an address starting with 3 and finallyrepeated the command dumpprivkey for an address starting with bc1. So I got 3 outputs. That output, which is the private key, was the same for the 3 times I used the dumpprivkey  for each of the 3 addresses.

I don't think this is a problem. You have 3 addresses, all derived from the same private key. You can try importing them in Electrum (on an offline computer that won't get a internet connection without wiping it):

Private key for SegWit addresses
A private key can be used to create SegWit addresses (starting with "3" or "bc1"). You can import them into Electrum by adding "p2wpkh-p2sh:" or "p2wpkh:" respectively in front of the private key (source and details).

[darkv0rt3x]

I have tried the dumpprivkey for one address starting with 1, and then repeated the command for an address starting with 3 and finallyrepeated the command dumpprivkey for an address starting with bc1. So I got 3 outputs. That output, which is the private key, was the same for the 3 times I used the dumpprivkey  for each of the 3 addresses.

I don't think this is a problem. You have 3 addresses, all derived from the same private key. You can try importing them in Electrum (on an offline computer that won't get a internet connection without wiping it):

Private key for SegWit addresses
A private key can be used to create SegWit addresses (starting with "3" or "bc1"). You can import them into Electrum by adding "p2wpkh-p2sh:" or "p2wpkh:" respectively in front of the private key (source and details).

But why these 2 addresses are created with different PKs and the other ones I have, all have the same PK? I can't see the reason why.
Also, what you suggest to do with Electrum is to import those 3 addresses I have that are giving out the same PK?

[hosseinimr93]

But why these 2 addresses are created with different PKs and the other ones I have, all have the same PK? I can't see the reason why.
Also, what you suggest to do with Electrum is to import those 3 addresses I have that are giving out the same PK?

Every private key can generate three kinds of address. The generated address can be legacy (starts with 1), nested segwit (starts with 3), native segwit (starts with bc1).
The two new private keys you have can generate other kinds of addresses too.

Let's say you have a legacy HD wallet with 20 different addresses.
You have 20 different legacy addresses and 20 different private keys.

These 20 private keys can generate 20 native segwit addresses and 20 nested segwit addresses too.

[darkv0rt3x]

But why these 2 addresses are created with different PKs and the other ones I have, all have the same PK? I can't see the reason why.
Also, what you suggest to do with Electrum is to import those 3 addresses I have that are giving out the same PK?

Every private key can generate three kinds of address. The generated address can be legacy (starts with 1), nested segwit (starts with 3), native segwit (starts with bc1).
The two new private keys you have can generate other kinds of addresses too.

Let's say you have a legacy HD wallet with 20 different addresses.
You have 20 different legacy addresses and 20 different private keys.

These 20 private keys can generate 20 native segwit addresses and 20 nested segwit addresses too.

Ok, I think I understand. But I don't want that to happen. I want a different private key each time I add a new address to my node... Can that be done?

And another question. Once I import one of those 3 keys to an online wallet like Electrum or so, that private key will be exposed to the internet and therefore all three address can be generated and bitcoins stolen, right? Even if I have never used the other 2 addresses online, right?

[LoyceV]

And another question. Once I import one of those 3 keys to an online wallet like Electrum or so, that private key will be exposed to the internet and therefore all three address can be generated and bitcoins stolen, right? Even if I have never used the other 2 addresses online, right?

Unless there's a security problem, Electrum shouldn't expose any of it's private keys to the internet. But indeed, if you use 1 key for 3 addresses, all addresses can be emptied if someone would get their hands on the private key.
If you want your private keys to remain cold storage, you shouldn't use them on an online computer. If you want to use Electrum, you can import the address on an online computer, create a transaction, copy the transaction to an offline computer, and sign it there using the private keys in Electrum. It doesn't hurt to decode the signed transaction before continuing to ensure it does what you want. Then, copy the signed transaction to an online computer and broadcast the transaction.
It's a hassle, but doable. Disclaimer: this was a short description, make sure you understand what you're doing before doing it.

[darkv0rt3x]

And another question. Once I import one of those 3 keys to an online wallet like Electrum or so, that private key will be exposed to the internet and therefore all three address can be generated and bitcoins stolen, right? Even if I have never used the other 2 addresses online, right?

Unless there's a security problem, Electrum shouldn't expose any of it's private keys to the internet. But indeed, if you use 1 key for 3 addresses, all addresses can be emptied if someone would get their hands on the private key.
If you want your private keys to remain cold storage, you shouldn't use them on an online computer. If you want to use Electrum, you can import the address on an online computer, create a transaction, copy the transaction to an offline computer, and sign it there using the private keys in Electrum. It doesn't hurt to decode the signed transaction before continuing to ensure it does what you want. Then, copy the signed transaction to an online computer and broadcast the transaction.
It's a hassle, but doable. Disclaimer: this was a short description, make sure you understand what you're doing before doing it.

Well, I use a similar approach.
But the deal here is not to create transactions. I just wanted to retrieve the individual PKs of these 3 adresses I have instead of that same PK.

The approach I use, because I don't have an offline computer, is that I created a virtual machine and removed all internet devices such as network cards etc so that it has no communication with the internet whatsoever, and this is an encrypted virtual volume. So, it's in this offline virtual machine that I run my offline node and create my addresses.

And the thing is that I didn't want to use my PKs anywhere other than in this offline node unless I'm going to spend all the BTC in those addresses.
Like, I use this rule of thumb that when I use one of my addresses PK to send some transaction out of my address, this address will be shortly left and forgotten as soon as I empty it. I don't want to use an address for much time after I used it for the first time. You know what I mean?

Anyway, coming back to the topic, so, in my offline node I cannot retrieve those 3 addresses individual private keys? I mean they must have one, no?

[nc50lc]

Anyway, coming back to the topic, so, in my offline node I cannot retrieve those 3 addresses individual private keys? I mean they must have one, no?

No, if they are indeed have the same private key, then it's their private key; you can derive all non-multisig address types from the same private key.
Try to use getaddressinfo (usage link) and see if "ismine:" for the three addresses is true.

If those addresses were derived from the same key, Bitcoin core will be able to restore them through bitcoin-cli importprivkey "prv_key" "label" false (usage link).
It will be imported as each of the three address type if you're using 0.19.1 (all three addresses at the same time), I don't know if 0.18 will do the same.

[khaled0111]

..
Anyway, coming back to the topic, so, in my offline node I cannot retrieve those 3 addresses individual private keys? I mean they must have one, no?

They don't have individual private keys. Those three addresses are derived from the same private key.
If you want a new PK, simply create a new address from the same format (P2PKH, P2SH or Bech32).
However, again, that new created PK can be used to create two other addresses from other formats. This is basically why a wallet such as Electrum requires to provide the type of the address you want to generate when importing a private key.

[darkv0rt3x]

Anyway, coming back to the topic, so, in my offline node I cannot retrieve those 3 addresses individual private keys? I mean they must have one, no?

No, if they are indeed have the same private key, then it's their private key; you can derive all non-multisig address types from the same private key.
Try to use getaddressinfo (usage link) and see if "ismine:" for the three addresses is true.

If those addresses were derived from the same key, Bitcoin core will be able to restore them through bitcoin-cli importprivkey "prv_key" "label" false (usage link).
It will be imported as each of the three address type if you're using 0.19.1 (all three addresses at the same time), I don't know if 0.18 will do the same.

I didn't understand the underlined sentence. Addresses starting with 3 and bc1 are multisig, right? Addresses starting with 1 are not muktisig, if I'm not mistaken.
In my case, I have one non-multisig and 2 multisg, so I'm not sure what you mean when you say 'non-multisg'.

And about importprivkey, I don't want to import them. They were created in this node, so they don't need to be imported. Unless you mean to import them into another wallet/node.

[ranochigo]

I didn't understand the underlined sentence. Addresses starting with 3 and bc1 are multisig, right? Addresses starting with 1 are not muktisig, if I'm not mistaken.

Nope. Addresses starting with 3 are P2SH (Pay to Script Hash) address. It allows the user to fulfill certain criteria before a transaction involving that address is valid. bc1 is a bech32 address, aka. native segwit. Address starting with 1 are P2PKH (Pay to Public Key Hash) address.

A multisig address has to be a P2SH address while a P2SH address doesn't necessarily has to be a multisig address.

[bob123]

Ok, I got it. So, if I want, after I created those 2 new bech32 addresses, to create 2 other addresses started with a 3 but not derived from the same PK as the 2 bech32, can it be done?

Yes.
Just use a different derivation index.

Your first address can have the index 1.
Regardless of the type of this or the next address you want to derive, use index 2 for the next address.
This requires you to keep track of all the used indexes.

But what is the reason for that ?
Are you planning on giving out or publishing private keys ? If not, there is no practical reason i can think of to complicate the derivation of your keys.

[darkv0rt3x]

Ok, I got it. So, if I want, after I created those 2 new bech32 addresses, to create 2 other addresses started with a 3 but not derived from the same PK as the 2 bech32, can it be done?

Yes.
Just use a different derivation index.

Your first address can have the index 1.
Regardless of the type of this or the next address you want to derive, use index 2 for the next address.
This requires you to keep track of all the used indexes.

But what is the reason for that ?
Are you planning on giving out or publishing private keys ? If not, there is no practical reason i can think of to complicate the derivation of your keys.

I understand what you mean. But it can be a bit confusing to be working with a few keys knowing that some of them shares the same PK and some others won't. I would rather to have a unique pair rather than this. It's easier to make a 1:1 relationship than to have to sometimes do a 1:1 and other times a 1:3.
I'm not sure I explained myself clearly.
I mean that it adds complexity to think that I have some addresses that shares PKs (1 PK : 3 addresses) and addresses that doesn't share PKs (1 PK : 1 address).

How do you set those indexes when you create addresses in your node? I mean, the 'getnewaddress' command only have 1 parameter which is the label and it is optional!

[bob123]

Each private key can generate those 3 types of addresses.
It is just whether or not you actually derive/use it at index X.

Is there a specific reason for you to derive all 3 types of addresses ?
And why do you want to save the private key together with the address in a database ? Couldn't you just save the derivation path together with the address ?
This would allow you to securely store the seed while still retaining the necessary information to derive the needed private key at any given time (with access to the seed).