decryption of wallet

[pateyway]

Hi,
So I have a paper wallet with an encrypted private key with 54 entries starting with for example rgHM7 or wTdev, so it doesn't seem to be a bip38 encryption. What kind of encryption can it be and how can I go about to decrypt it. The paper wallet was generated at bitaddress.org. And oh how I regret encrypting it
Could someone please help?

[1715534271]

1715534271

[1715534271]

1715534271

[1715534271]

1715534271

[1715534271]

1715534271

[1715534271]

1715534271

[BitMaxz]

If it was generated from bitaddress.org why not try to decrypt it there if you still know the passphrase?

If not, and if you forgot some parts of the passphrase you can use the bitcoin recovery tool from FinderOuter
or if you totally forgot them then you can try to brute force your encrypted private key you can use this https://github.com/3rdIteration/btcrecover
I'm sure brute-forcing your encrypted private key to decrypt it would be a long journey if you have a long passphrase.

[nc50lc]

The paper wallet was generated at bitaddress.org. And oh how I regret encrypting it

The characters resembles the Base64 format, but the number of characters doesn't match.
I tried the earliest release (v2.8.1), the earliest tag (v1.6) and the latest version (web) of bitaddress and all don't output any 54-character string.

[LoyceV]

So I have a paper wallet with an encrypted private key with 54 entries starting with for example rgHM7 or wTdev, so it doesn't seem to be a bip38 encryption. What kind of encryption can it be and how can I go about to decrypt it. The paper wallet was generated at bitaddress.org.

When did you create this paper wallet? You may be able to find a version of Bitaddress from around that time. See if you can create a similar wallet, it might help determine what happened.
Also: did you print the wallet, or did you write it down? I've seen people make mistakes writing down keys.

[o_e_l_e_o]

So I have a paper wallet with an encrypted private key with 54 entries starting with for example rgHM7 or wTdev

Do you mean the strings have 54 characters each, or you have 54 strings? Can you elaborate on what character set the strings are using? Do they end with a "=" symbol?

The only thing which bitaddress generates which fits that character set are private keys in Base64 format. These should be 44 characters long.

Are you sure you used bitaddress? Did you download and verify the latest release and run it offline?

[NotATether]

It could be AES encryption encoded in Base58. Check the paper wallet to see if there is any design identifying what we are it came from.

[pateyway]

http://
I have printed the wallet and I am all sure it is from bitaddress.org from maj 2020.
I would put in a photo here but it looks like I am not able to. The encrypted key of a similar adress is

rgHM7eKVe37vCGtGQRVNRcN6pfa2gRAzaxdsG86RSmKdnMAEkPZnHJ

This waller is 100% empty so no worries 
Anyone any clue how to decrypt this shit?

[LoyceV]

I have printed the wallet and I am all sure it is from bitaddress.org from maj 2020.
I would put in a photo here but it looks like I am not able to. The encrypted key of a similar adress is

rgHM7eKVe37vCGtGQRVNRcN6pfa2gRAzaxdsG86RSmKdnMAEkPZnHJ

I haven't seen this format on Bitaddress.org.
Feel free to email (LoyceVswitzerland@protonmail.com) me the picture (the one that isn't funded, obviously), I'll post it here.

[pateyway]

I haven't seen this format on Bitaddress.org.
Feel free to email (LoyceVswitzerland@protonmail.com) me the picture (the one that isn't funded, obviously), I'll post it here.
[/quote]

Thanks, I just sent it.

[LoyceV]

Thanks, I just sent it.

This is the picture I received:


This indeed looks like Bitaddress.org's Paper Wallet with "Hide Art?" ticked. And it shows what I've seen myself too: the printer (driver) messed up the page. It looks like a few characters are missing, you're supposed to have 58 characters, and the first 2 are supposed to be "6P" That still leaves a lot of options, and BIP38 is heavy encryption, but it should be possible to brute-force the missing characters.
Or, since you have a QR-code, you can try that. It's partially covered with text, but it might still work. Be careful though: several QR-decoders steal any Bitcoin they can.
Mycelium (on Android) supports BIP38. Be careful what you're using, especially if a large amount is at risk.

[o_e_l_e_o]

The BIP38 encrypted private key will be right aligned with the line of text above it which should say "Encrypted Private Key (Password required)". If you can read all of that line (I can't quite make out whether you can see "required)" under the QR code from the small image you have attached), then you should also therefore have the end of the private key.

This would mean that OP's printer has cut off the the first 4 characters, the first 2 of which will be "6P", meaning he just has to brute force 2 characters in a known position, which will be relatively easy to do provided he knows the decryption password.

Edit: Actually, I've been able to recreate this by trying to print my own page of paper wallets from bitaddress and messing with the scaling factor up to around ~150%. It does indeed only cut characters off from the start. And actually, bitaddress only generates EC multiplied compressed keys, meaning all the keys will have the prefix "6Pn". So OP is only missing a single character from each key, in the 4th position, which will be between the characters "M" and "Z". Given that "O" isn't used in Base58Check, then that only leaves 13 possibilities for each key.

[pateyway]

Wow! Thank you so much guy. I now see that the first ones are cut of. I didn't realize it before ok. I will try to use bitaddress now to decrypt the key. Thanks so much for your brightness.

[pateyway]

Edit: Actually, I've been able to recreate this by trying to print my own page of paper wallets from bitaddress and messing with the scaling factor up to around ~150%. It does indeed only cut characters off from the start. And actually, bitaddress only generates EC multiplied compressed keys, meaning all the keys will have the prefix "6Pn". So OP is only missing a single character from each key, in the 4th position, which will be between the characters "M" and "Z". Given that "O" isn't used in Base58Check, then that only leaves 13 possibilities for each key.

Hey so I still have problems with the private key. I've tried to start with 6Pn(A-Z) but it says that all of those are invalid keys. It is the key and not the pass phrase because I made a new wallet and put in the wrong phrase and I got a different message. Could it be that the third digit "n" could be different as well. I made the wallet in 2020 if that has any meaning. Any bright ideas ?

[LoyceV]

Any bright ideas ?

Have you tried the QR-code?

Otherwise, The FinderOuter may work for brute-forcing, although I'm not sure if it can brute-force missing characters in a BIP-38 key with known password. If it can't, @Coding Enthusiast may be willing to add this feature.

[o_e_l_e_o]

Could it be that the third digit "n" could be different as well. I made the wallet in 2020 if that has any meaning. Any bright ideas ?

It could be, but it's unlikely. bitaddress's source code hasn't changed for 6 years. Are you 100% sure all the other characters are correct?

although I'm not sure if it can brute-force missing characters in a BIP-38 key with known password.

It can, and indeed, knowledge of the password is unnecessary. BIP38 keys use Base58Check, so it can brute force a few missing characters until it finds those that match with the checksum.

Edit:

I've tested the string you shared above: rgHM7eKVe37vCGtGQRVNRcN6pfa2gRAzaxdsG86RSmKdnMAEkPZnHJ

I'm unable to find any combination of 6P** (or 6P*string* or 6Pstring**) which creates a valid key. Again, are you sure you have the right characters?

[pateyway]

Oh so you tested one of the other private keys and were not able to get a private key either? If they are correct? Well I double checked if I wrote down the other characters correctly, if they are not correct then why would they not be?

[larry_vw_1955]

Thanks, I just sent it.

This is the picture I received:


This indeed looks like Bitaddress.org's Paper Wallet with "Hide Art?" ticked. And it shows what I've seen myself too: the printer (driver) messed up the page.

bitaddress really should be more careful about how it prints things out. either print it out correctly and fully or don't print anything

[o_e_l_e_o]

Oh so you tested one of the other private keys and were not able to get a private key either?

Correct. Hence me asking if you are sure the characters you have posted here are accurate. If I go to bitaddress and create a page of encrypted paper wallets, I can brute force missing characters with 100% accuracy. So either the string you have shared above has incorrect characters or is not a BIP38 key at all.

Are you able to share a high resolution picture of the key you have shared above (the one you said has no funds on it)? You can crop out the other keys. And you can share it privately if you prefer.

bitaddress really should be more careful about how it prints things out. either print it out correctly and fully or don't print anything

There is nothing it can do stop people from locally scaling the page it produces, so much that it is too large for a single piece of paper, which is what has happened here.

[LoyceV]

if they are not correct then why would they not be?

Have you tried the QR-code?

bitaddress really should be more careful about how it prints things out. either print it out correctly and fully or don't print anything

I don't think they can help it much when printing from a browser. This is one of the many reasons I test my backup before funding it. By manually typing the key and decrypting it with different software than you used to create it, you know you can decrypt it later. If your test fails, you know not to fund it. (of course, all this should be done off-line, running a Live Linux from RAM).

[larry_vw_1955]

I don't think they can help it much when printing from a browser. This is one of the many reasons I test my backup before funding it. By manually typing the key and decrypting it with different software than you used to create it, you know you can decrypt it later. If your test fails, you know not to fund it. (of course, all this should be done off-line, running a Live Linux from RAM).

that's a pretty good idea but why does it need to be different software than you used to create it? you can generate a private key in bitaddress and then go and verify it within bitaddress too.  so u don't need another different software.