The Encrypted Master Key: How the Node Unlocks its Wealth

In the "Forge of the Core," the moment of "Unlocking" is the most critical event in the life of a wallet. When you enter your passphrase, you are not just "Starting a Program"; you are "Reconstituting a Secret." This secret is the Master Key. As we saw in Chapter 7, the Master Key is the result of stretching your passphrase through Scrypt. But the Master Key itself is never saved to the disk. Instead, it is used to "Unlock" the Encrypted Master Key (mKey) stored in your wallet.dat. This "Key-Encryption-Key" (KEK) architecture is the gold standard of financial security.

The Encrypted Master Key is the "Vesta of the Vault." It sits in your database as a scrambled blob of data. When you provide the correct passphrase, the wallet uses the resulting Master Key to "Descramble" this blob into your computer's RAM. Only then can the wallet see your HD Seed and sign your transactions. For the Sovereign Architect, understanding this "Handshake" is the key to knowing exactly why your wallet remains secure even if someone steals your computer.

Analyzing the Handshake: CCrypter::Decrypt

In the source code (src/wallet/crypter.cpp), we see the reverse of the encryption process. This is the logic that turns the "Ciphertext" from your disk back into the "Plaintext" of your wealth.

/**
 * This function "Unlocks" a piece of encrypted data using the Master Key.
 */
bool CCrypter::Decrypt(const std::vector<unsigned char>& vchCiphertext, CKeyingMaterial& vchPlaintext) const
{
 // 1. We create a "Decryption Context" using our derived Master Key.
 AES256Decrypt dec(m_vchKey.data());

 // 2. We extract the "Initialization Vector" (IV) from the ciphertext.
 // 3. We "Unlock" the data block by block.
 if (!dec.Decrypt(vchCiphertext.data(), vchCiphertext.size(), vchPlaintext.data())) {
 return false; // The key was wrong!
 }

 return true; // Success! The vault is open.
}

Explaining the Handshake: The Nested Boxes

• "The Passphrase": This is your "Thought." It only exists in your mind and for a split second in your RAM. It is the "Human Authority."

• "The Derived Key": This is the "Physical Key" created by Scrypt. It is a 256-bit number that represents your authority in a way the machine can understand. It is the "Mathematical Authority."

• "The mKey" (Encrypted Master Key): Imagine a "Small Box" that contains your Master Seed. This small box is locked with your Physical Key. When you call Decrypt, the machine uses your Physical Key to open the small box. Inside, it finds the Master Seed. It is the "Vested Authority."

• "The Return Value": If you enter the "Wrong Passphrase," the Scrypt algorithm will still produce a key, but it will be the Wrong key. When the AES256Decrypt engine tries to use that wrong key to open the box, the result will be "Gibberish." The wallet checks this gibberish and realizes: "This is not a valid seed." It then returns false and shows you the "Incorrect Passphrase" error. It is the "Judgment of the Machine."

The "Session" of the Sovereign

In the Bitcoin Core GUI, when you unlock your wallet, you can choose how long it stays "Open" (e.g., for 60 seconds). During this time, the Master Seed sits in your RAM (sanitized, as we saw in Chapter 15). Once the timer expires, the wallet "Destroys" the seed in your RAM, and the vault is "Closed" again. This "Temporal Sovereignty" ensures that even if you walk away from your computer, your wealth remains protected by the "Steel Walls" of AES. You are the "Master of the Session."