openssl AES256 with a common standardized Password-Based Key Derivation Function

[derlange2k]

btcrecover can operate in 2 modes:

1. Mode:

It operates on the full key backup file. This way, btcrecover can compare a second AES block:

Code:

  # If another AES block is available, decrypt and check it as well to avoid false positives
                        if len(encrypted_block) >= 32:
                            b58_privkey = l_aes256_cbc_decrypt(key1 + key2, encrypted_block[:16], encrypted_block[16:32])
                            for c in b58_privkey:
                                if c > b"z" or c < b"1" or b"9" < c < b"A" or b"Z" < c < b"a" or c in b"IOl":
                                    break  # not base58
                            # If the loop above doesn't break, it's base58; we've found it

2. Mode:

You use the extract script from btcrecover and btcreover operates on the output from the extract script. the script only extracts the first AES block. This mode is for the purpose, if you want to brute-force from a third-party, which you don't want to send the whole backup. Because in case, he is able to brute-force it, he has the wallet and is the owner of the BTC.

So in my case, i have the key backup file, so we could check the second AES block, which should avoide false positivs.

Maybe i'm wrong? With my limit coding skills i assume it works this way.