MultiBit wallet engine — Distribrute Docs

Supported inputs

Distribrute supports password recovery for three reviewed MultiBit formats:

MultiBit Classic .key: an OpenSSL Salted__ private-key backup whose plaintext contains one or more WIF keys;
MultiBit Classic .wallet: a bitcoinj protobuf wallet containing scrypt-encrypted keys; and
MultiBit HD: the whole-file encrypted mbhd.wallet.aes format, including the older fixed-IV and newer per-file-IV layouts.

The engine detects the container from the submitted bytes and selects the matching operator mode. All three formats are supported in both custodial and non-custodial recovery. Exact files are still reviewed before a case is accepted.

Safe test pieces

Format	Operator mode	Included	Deliberately excluded
Classic `.key`	`72100`	The 8-byte OpenSSL salt and first 16-byte ciphertext block	The remaining encrypted WIF, complete private key, timestamps, and other backup lines
MultiBit HD `mbhd.wallet.aes`	`22700`	The first 32 encrypted bytes needed to cover both IV layouts	The remainder of the wallet, encrypted keys, addresses, and history
Classic `.wallet`	`27700`	Scrypt settings, salt, and the final two ciphertext blocks of one encrypted key	The rest of the protobuf wallet, complete encrypted key, addresses, and history

Classic `.key` disclosure

A Classic .key file encrypts the WIF private key itself, so no password predicate can inspect its opening without decrypting some key-derived text. Distribrute uses one AES block rather than the larger stock extract. After a correct password is tested, that block reveals the first 16 WIF characters—roughly 10–11 bytes of the encoded private key.

That prefix is sensitive metadata, but it is not a complete WIF and cannot sign a transaction. The unavailable remainder leaves an infeasible amount of key material to guess. The complete .key backup and spendable private key never leave the owner or high-trust wallet boundary.

MultiBit HD and Classic `.wallet`

The HD predicate decrypts only the bitcoinj protobuf header. It exposes structural format text, not a private key, xpub, address, balance, or transaction history.

The Classic .wallet predicate decrypts the final block of an encrypted key, which must be a full PKCS#7 padding block. The preceding ciphertext block is present only as the CBC chaining value and cannot be decrypted into key bytes without the omitted block before it.

Candidate checking and verification

The operator checks are deliberately minimal and can produce a probable match:

Classic .key checks that the decrypted block has a plausible base58 WIF opening;
MultiBit HD checks for the expected bitcoinj protobuf header; and
Classic .wallet checks for the expected full padding block.

In a custodial case, Verify rechecks the candidate against the stored full wallet. A Classic .key candidate must decrypt to a complete base58check-valid WIF; the HD and Classic .wallet paths must satisfy their full-wallet structural checks.

In a non-custodial case, Distribrute holds only the signed safe test piece. A matching candidate therefore remains probable until an authorized human confirms it against the owner’s real wallet during the guided local recovery.

Privacy and custody boundary

An operator controls its own machine and may inspect the exact password it finds. It also sees that the case is MultiBit and receives the KDF parameters required by the selected format. For Classic .key, it can recover the bounded WIF prefix described above after a correct match.

The operator does not receive the complete wallet, a complete private key or WIF, direct customer identity fields, a complete address set, wallet balance, or transaction history. The password and safe test piece are not enough to move funds.

Compatibility limits

The current engine does not claim support for every file carrying a .key, .wallet, or .aes extension. Unencrypted exports, damaged or truncated files, unrelated bitcoinj applications, and unrecognized layouts are rejected or reviewed separately. Preserve the original file rather than converting or importing the only copy.

MultiBit recovery also retains the general success-funding risk: many files do not reveal a usable address set before unlock. A correct password may open an empty wallet or one with no spendable balance, so password correctness alone does not guarantee settlement or an operator reward. See Operator rewards and settlement.