The hash found in the confirmation link is 64 bits of random data and 64 bits of zeros AES128 encrypted with your password key. The master key is generated randomly and is AES128 encrypted with your password key and stored at Mega. (passwordLength + 15) / 16) rounds of AES128 encryption.

To derive your password key you do (65536.If you have the decrypted title key however it's easy to decrypt the. Only the encryption of the title key uses a 'special' key pair (hardware key generator). It might still be possible the 3DS hardware is only needed to decrypt the titlekey, though, which would make things a lot easier.