Mfcttrf

Since I have a wallet.dat I suspect I already have a private key and so I could extract it for backup purpose (on paper).

How do I do it via terminal with bitcoin-cli?

Bitcoin Core will automatically create a new wallet on first start. This wallet will contain 2000 private keys (unless otherwise specified by the -keypool=<n> option) and the seed used to generate those and future keys, at least until you encrypt the wallet.

As such, there is not just one private key that you need to backup, rather you need to backup 2000 keys and the seed. Otherwise, restoring a backup will not restore all of your private keys.

The easiest way to backup your wallet is to just copy the wallet.dat file to a safe place. I would not recommend that you try to create a paper backup of your wallet.

If you insist on a paper backup, then you should record the seed. The seed can only be gotten by using the dumpwallet RPC command and then finding the private key labeled hdseed. The seed is a private key and cannot be used in any other wallet software since they do not accept the seed as a private key. You will need to remember that it specifically is not just a normal private key and that it only works in Bitcoin Core. To restore the seed, you can use the sethdseed command in a new wallet.

I really don't recommend that you try to backup the seed. There are changes happening to the Bitcoin Core wallet soon that may make your seed backup unable to work. The recommended way of backing up is to copy the wallet.dat file, and to do so periodically. This will guarantee that you have your private keys, guarantee that it is compatible with future versions of Core, and also backup transactions and metadata (such as labels).

Based upon the good answer by Andrew I want to discuss my output from bitcoin-cli dumpwallet dump.txt because I think this will be interesting for people who are at the same stage as me.

cat dump.txt shows:

# Wallet dump created by Bitcoin v0.18.99.0-12fd4bbd1
# * Created on 2019-09-25T16:04:01Z
# * Best block at time of backup was 409484 (000000000000000000bec614513591c2e5d96a488c2513396e7a723bbf7b1dcd),
# mined on 2016-04-29T22:30:07Z

# extended private masterkey: xprv*****
...

In my understanding the masterkey is derived from the seed and is used as parent for all child keys. The prefix xprv relates to it beeing hierarchical.

Then there is a list of pairs of private keys with addresses (public keys) of two kinds, reserve=1and script=1. Also, there is one hdseed=1 in the list of reserve=1. All the keys have creation dates with them and hdseed=1 has the earliest time (with others).

K**************** 2019-09-04T14:04:25Z reserve=1 # addr=3********* hdkeypath=*****

hdkeypath is probably a description to get from the masterkey to this specific child key, aka the index. This way all childkeys could be recovered from a known masterkey.

The last part of the dump contains several lines like this

0014******* 0 script=1 # addr=3**************

I am still investigating what 0014 as a starting number means.

This is a list of address prefixes.

The seed can also be encoded in easy to remember (and written) words with bx hd-mnemonic < SEED.