The book Mastering Ethereum explains the keystore file in geth as follows: "The private key in the JSON file is not directly encrypted by the password. On the contrary, the password will be expanded through continuous hash operations (and then encrypted). Hash The calculation repeats 262144 rounds. This parameter can be seen in the crypto.kdfparams.n parameter of JSON. Any attempt to brute force the password must go through 262144 rounds of hash calculation, which will greatly reduce the speed of the attack. If the length and complexity are sufficient, the attack of brute force guessing passwords is no longer effective (the complexity of the password itself × 262144 rounds of hashing, the amount of calculation will be very large)."

So I want to know if the private key is not directly encrypted by the password, how can the user obtain the private key from the keystore after entering the password? Does it have to pass 262144 rounds of hash calculation to get the private key? Why take this method, it feels that the efficiency will be very low.

1 Answer 1


The private key is encrypted but the address is not. Once the private key is decrypted you can verify if it generates the address. If it doesn't then you know the password was wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.