"""decrypt the seed in an Electrum wallet file

:param wallet_file: an open Electrum 1.x or 2.x file

:type wallet_file: file

:param get_password_fn: a callback returning a password that's called iff one is required

:type get_password_fn: function

:return: the (typically hex-encoded) decrypted key and the mnemonic

:rtype: (str, str)

"""

with wallet_file:

wallet_file_text = wallet_file.read()

try:

# Electrum 1.x

wallet = ast.literal_eval(wallet_file_text)

except Exception:

# Electrum 2.x

wallet = json.loads(wallet_file_text)

del wallet_file_text

seed_version = wallet.get('seed_version')

if seed_version is None:

warn('seed_version not found')

elif seed_version not in (4, 11):

warn('unexpected seed_version: ' + str(seed_version))

wallet_type = wallet.get('wallet_type')

if not wallet_type:

warn('wallet_type not found')

elif wallet_type not in ('old', 'standard'):

warn('untested wallet_type: ' + wallet['wallet_type'])

if wallet.get('use_encryption'):

b64_encrypted_data = wallet['seed']

# Carefully check base64 encoding and truncate it at the first unrecoverable character group

b64_chars_set = set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')

assert len(b64_chars_set) == 64

for i in xrange(0, len(b64_encrypted_data), 4): # iterate over 4-character long groups

char_group_len = len(b64_encrypted_data[i:])

if char_group_len == 1:

warn('ignoring unrecoverable base64 suffix {!r} in encrypted seed'.format(b64_encrypted_data[i:]))

b64_encrypted_data = b64_encrypted_data[:i]

break

elif 2 <= char_group_len <= 3:

warn('adding padding to incomplete base64 suffix {!r} in encrypted seed'.format(b64_encrypted_data[i:]))

b64_encrypted_data += '=' * (4 - char_group_len)

for j,c in enumerate(b64_encrypted_data[i:i+4]): # check the 4 characters in this group

if c not in b64_chars_set:

if j > 1 and c == '=': # padding characters are allowed in positions 2 and 3 of a group,

b64_chars_set = '=' # and once one is found all the rest must be padding

else:

warn('found invalid base64 char {!r} at position {} in encrypted seed; ignoring the rest'.format(c, i+j))

if j <= 1: # character groups of length 0 or 1 are invalid: the entire group is truncated

b64_encrypted_data = b64_encrypted_data[:i]

else: # else truncate and replace invalid characters with padding

b64_encrypted_data = b64_encrypted_data[:i+j]

b64_encrypted_data += '=' * (4-j)

break

# Decode base64 and then extract the IV and encrypted_seed

iv_and_encrypted_seed = b64_encrypted_data.decode('base64')

if seed_version == 4 and len(iv_and_encrypted_seed) != 64:

warn('encrypted seed plus iv is {} bytes long; expected 64'.format(len(iv_and_encrypted_seed)))

iv = iv_and_encrypted_seed[:16]

encrypted_seed = iv_and_encrypted_seed[16:]

if len(encrypted_seed) < 16:

warn('length of encrypted seed, {}, is less than one AES block (16), giving up'.format(len(encrypted_seed)))

return None, None

encrypted_seed_mod_blocksize = len(encrypted_seed) % 16

if encrypted_seed_mod_blocksize != 0:

warn('length of encrypted seed, {}, is not a multiple of the AES block size (16); truncating {} bytes'

.format(len(encrypted_seed), encrypted_seed_mod_blocksize))

encrypted_seed = encrypted_seed[:-encrypted_seed_mod_blocksize]

password = get_password_fn() # get a password via the callback

if password is None:

return None, None

if unicodedata.normalize('NFC', password) != unicodedata.normalize('NFD', password):

if password == unicodedata.normalize('NFC', password):

the_default = 'NFC'

elif password == unicodedata.normalize('NFD', password):

the_default = 'NFD'

else:

the_default = 'a combination'

warn('password has different NFC and NFD encodings; only trying the default ({})'.format(the_default))

password = password.encode('UTF-8')

# Derive the encryption key

key = hashlib.sha256( hashlib.sha256( password ).digest() ).digest()

# Decrypt the seed

key_expander = aespython.key_expander.KeyExpander(256)

block_cipher = aespython.aes_cipher.AESCipher( key_expander.expand(map(ord, key)) )

stream_cipher = aespython.cbc_mode.CBCMode(block_cipher, 16)

stream_cipher.set_iv(bytearray(iv))

seed = bytearray()

for i in xrange(0, len(encrypted_seed), 16):

seed.extend( stream_cipher.decrypt_block(map(ord, encrypted_seed[i:i+16])) )

padding_len = seed[-1]

# check for PKCS7 padding

if not (1 <= padding_len <= 16 and seed.endswith(chr(padding_len) * padding_len)):

warn('not removing invalid PKCS7 padding (the password was probably entered wrong)')

seed = str(seed)

else:

seed = str(seed[:-padding_len])

else:

seed = wallet['seed']

# For Electrum 2.x, there's no additional hex encoding; we're done

if seed_version == 11:

try:

return None, seed.decode('UTF-8')

except UnicodeDecodeError:

return None, seed

if len(seed) != 32:

warn('decrypted seed is {} characters long, expected 32'.format(len(seed)))

# For Electrum 1.x, carefully check hex encoding and truncate it at the first non-hex digit

hex_seed = seed

for i,h in enumerate(hex_seed):

if not ('0' <= h <= '9' or 'a' <= h <= 'f'):

if 'A' <= h <= 'F':

warn('found unexpected capital hex digit')

else:

warn('found invalid hex digit {!r} at position {} in decrypted seed; ignoring the rest'.format(h, i))

hex_seed = hex_seed[:i]

break

# Count number of hex digits for informational purposes

if len(hex_seed) != len(seed):

hex_digit_count = 0

for h in seed:

if '0' <= h <= '9' or 'a' <= h <= 'f':

hex_digit_count += 1

warn('info: {} out of {} characters in decrypted seed are lowercase hex digits'

.format(hex_digit_count, len(seed)))

if len(hex_seed) < 8:

warn('length of valid hex-encoded digits is less than 8, giving up')

return seed, None

else:

if len(hex_seed) % 8 != 0:

warn('length of hex-encoded digits is not divisible by 8, some digits will not be included in the mnemonic')

encoding = sys.stdin.encoding or 'ASCII'

if 'utf' not in encoding.lower():

warn('terminal does not support UTF; passwords with non-ASCII chars might not work')

password = getpass.getpass('This wallet is encrypted, please enter its password: ')

if isinstance(password, str):

password = password.decode(encoding) # convert from terminal's encoding to unicode