DBMS_OBFUSCATION_TOOLKIT.MD5

DBMS_OBFUSCATION_TOOLKIT.MD5(input_string => p_string) translate the p_string parameter into a MD5-string, but cannot accept NULL values? Anyone knows an answer?

That argument doesn't make much since. If I wanted to know if the value was null or not, I could simply get the MD5 for null (if it would do that) and compare those values. The value of message digest is that the attacker doesn't have any clue what original value he's looking for. It's a simple matter for find matches if I know what I'm looking for. In fact, this technique is commonly employed. It's known as a dictionary assault.

Similar Messages

Using 'dbms_obfuscation_toolkit.md5' in my insert statment itself

Hi all,
I am trying to use 'dbms_obfuscation_toolkit.md5' in my insert statment itself as : insert into TEST_USERS values('username', dbms_obfuscation_toolkit.md5('password'));
But i get this : ORA-06553: PLS-307: too many declarations of 'MD5' match
Can you please help me on how can i insert a string (not raw) as MD5 hash to a table???
The password column i have is 'varchar(20)'. I dont mind changing it to something else. I am also struggling to find this package definition/help, to check what db type this function returns :-)
Thanks for the help.

Hello,
Try posting this to the General Database Discussions forum.
This forum is for SQLJ & JDBC.

Adf - decrypt the value from dbms_obfuscation_toolkit.md5

Currently we store a string value in the DB using dbms_obfuscation_toolkit.md5(input_string=>'124').
How do I decrypt this value back so that I can display in the adf application please?

btw, md5 is secure hash algorithm so you can't decrypt value.
Dario

Issues with WWV_FLOW_ITEM.MD5 - Doesn't seem to be Determinant

I have an Interactive Report in which I include a call to WWV_FLOW_ITEM.MD5 to get the current checksum based on the value of a couple of updatable columns.
SELECT CHECK_BOX,
       RISK_PAYCOLL_ID,
       ORG_ID,
       WWV_FLOW_ITEM.MD5( VM_AMOUNT, DESCRIPTION ) AS CHECKSUM
FROM MIDAY_PAY_COLLECT
I am subsequently attempting to determine which rows have been changed by recalculating the check sum, again with WWV_FLOW_ITEM.MD5 using the VM_AMOUNT and DESCRIPTION as input fields. My expectation would be that, if the values of these fields had not been changed (or had been changed and subsequently changed back to their original values), the check sums would match. However, in every row, those changed or unchanged, I get a new, different value when I call WWV_FLOW_ITEM.MD5.
What am I missing?
-Joe

Hello Joe,
Please use documented API's. See APEX_ITEM also please specify your APEX version.
As I know, all APIs in APEX_ITEM package return HTML to display item. So when comparing hidden item value, you need to recalculate check-sum using DBMS_CRYPTO or DBMS_OBFUSCATION_TOOLKIT.MD5 depending on your version. And then you have to compare check-sum value from Hidden Item with new calculated checksum value.
Regards,
Hari

How to do md5 checksum in PL/SQL in 8i

Is there any function in PL/SQL for md5 checksum?

Oracle8i Enterprise Edition Release 8.1.7.3.0 - Production
With the Partitioning option
JServer Release 8.1.7.3.0 - Production
SQL> SET SERVEROUTPUT ON;
SQL> BEGIN
2    DBMS_OUTPUT.PUT_LINE (
3      'md5 hash => ' ||
4      DBMS_OBFUSCATION_TOOLKIT.MD5 (
5     input => UTL_RAW.CAST_TO_RAW ('plain text')));
6 END;
7 /
md5 hash => 31BC5C2B8FD4F20CD747347B7504A385
PL/SQL procedure successfully completed.
SQL>

How to enforce md5 function to accept varchar2?

I am trying to use md5 function from dbms_obfuscation_toolkit package.
There are two functions called md5 in that package, the first one accepts one parameter as raw and returns raw whereas the second one accepts one parameter as varchar2 and returns varchar2.
I want to use the second one (varchar2) I tried this code:
declare
v_output varchar2(16);
v_checksum varchar2(16);
v_input varchar2(50) DEFAULT 'SAAD';
begin
v_checksum := dbms_obfuscation_toolkit.md5 (input_string => 'SAAD');
v_output := dbms_obfuscation_toolkit.md5(v_input);
if (v_output = v_checksum) then
dbms_output.put_line('TRUE');
else
dbms_output.put_line('FALSE');
end if;
end;
An eror message appeared:
PLS-00307:too many declarations of 'MD5' match this call
I tried to cast inout_string using cast('SAAD' as varchar2(16)) but it didn't change anything.
How can I enforce md5 function to accept varchar2 and return varchar2

I am getting inproper output if I pass HARBINDER,in uppercase, to md5 and respective put_line does not print the following any output of the line(val1). In word 'Harbinder', what is there which is stopping the interpreter to print. It's strange!
declare
val varchar2(25);
val1 varchar2(25);
input varchar2(15) := 'HARBINDER';
begin
val :=dbms_obfuscation_toolkit.md5(input_string=>input);
val1 :=dbms_obfuscation_toolkit.md5(input_string=>'Harbinder');
dbms_output.put_line('Input: '||input||',Val: '||val|| ',Val1: '|| val1);
end;
OUTPUT:
Input: HARBINDER,Val: ¨
False
What can be the reason?

MD5 Encryption on UTF8 database on NVARCHAR datatype column

DECLARE
l_string NVARCHAR2(600) := '123456';
checksum NVARCHAR2(600);
BEGIN
DBMS_OUTPUT.DISABLE;
DBMS_OUTPUT.ENABLE(1000000);
DBMS_OBFUSCATION_TOOLKIT.md5 (input_string => l_string, checksum_string => checksum);
DBMS_OUTPUT.PUT_LINE(RAWTONHEX(utl_raw.cast_to_raw(checksum)));
END;
Expected value: e10adc3949ba59abbe56e057f20f883e
But it returns: FFFD00390049FFFD0059FFFDFFFD0056FFFD000FFFFD003E
Note I want to maintain nvarchar2 datatype. The value from checksum variable gets stored in column that is of type nvarchar2.
I am aware that md5 accepts and returns data in varchar2. But if someone can help me figure this out using nvarchar2 data type, that would be great.
The NLS_CHARACTERSET = AL32UTF8

Welcome to the forums. I agree with Prabodh that the APEX group may not be an idea location to ask this question. Because you are doing things with DBMS_OBFUSCATION_TOOLKIT I'd even try those types of questions in the "Database Security - General" forum which is even more specialized than the SQL/PLSQL group in this regard.
Your question is off to a great start with an easily reproducible test case. You are probably better off with DBMS_CRYPTO which is available in 10g. It's newer, bigger, better and most likely has better support for needs. I did a quick test:
SQL> l
1 declare
2 l_string varchar2(600) := '123456';
3 checksum   nvarchar2(600);
4 l_hashlower   nvarchar2(600);
5
6 begin
7
8   checksum := dbms_crypto.hash (utl_raw.cast_to_raw(l_string),2); -- 2 is md5
9   l_hashlower := lower(rawtohex(checksum));
10
11    dbms_output.put_line('md5hash: ' || checksum);
12    dbms_output.put_line('md5hash-lower: ' || l_hashlower);
13
14* end;
SQL> /
md5hash: E10ADC3949BA59ABBE56E057F20F883E
md5hash-lower: e10adc3949ba59abbe56e057f20f883e
PL/SQL procedure successfully completed.Good luck.

Md5 encryption!

I made a form, and through the form I need to insert password in one column of the table. The value that is going to be inserted need to be hashed!
So I made a function that's return md5 hash.
CREATE OR REPLACE
function md5( input varchar2 ) return sys.dbms_obfuscation_toolkit.varchar2_checksum as
begin
return sys.dbms_obfuscation_toolkit.md5( input_string => input );
end;
How I can call this function in the form and insert hashed value in the table?
Thanks!

I think that its important to note that MD5 is NOT - repeat, NOT - encryption, but rather a hash function. While on the surface they are similar they are very different things.
Basically, encryption is a two-way algorithm, where as a hash function is one-way. Thus, you can decrypt something that is encrypted, but you can not un-hash something that has been hashed (in theory and largely in practice).
Thus, your approach is mostly correct, but I think that you simply called it something that it is not.
The one flaw that you do have is that you are simply using a raw MD5 hash function on your passwords. For an experienced and dedicated hacker, this is a mere inconvenience for them, as they can easily launch a hashed dictionary attack against your password column and likely get a number of hits back.
The best way to combat this is to use what is called a salt as part of your hash function. Rather than just hashing the password column, concatenate some constant to the beginning and/or end of the string, and then hash that. You'll also have to do the same when making comparisons. This small change is enough to make a MD5 dictionary attack useless - so as long as you protect the salt. You can do this by wrapping the function that creates your hash and/or storing the salt in an encrypted table.
Have a look at the functions in the APEX sample application for an example of this approach.
Thanks,
- Scott -
http://sumnertechnologies.com/
http://spendolini.blogspot.com/

MD5 algorithm

Hi! How do I desencrypt using the dbms_obfuscation_toolkit with the MD5 algorithm?
This is my test of encryptation:
ora817 >> DECLARE
2 --
3 l_String      VARCHAR2(255) ;
4 --
5 BEGIN
6      --
7      dbms_obfuscation_toolkit.MD5 (
8                                      input_string    => 'Oracle' ,
9                                      checksum_string => l_String
10                                   ) ;
11      --
12      dbms_output.put_line('l_String: '||l_String) ;
13      --
14 END ;
15 /
l_String: 0▬.Î┐l►¸1A▼/─@┬O
PL/SQL procedure successfully completed.Thanks!

Hi,
As I understand it you can't "desencrypt" an MD5 checksum because it's just that -- a checksum.
ie. you can only check the MD5 checksum of a new value to your computed MD5 checksum of the original value to see if the new value is the same as the original value.
Cheers,
Colin

MD5 Migration issues using different character set

Hi,
DBname = test1 , db charcter set WE8ISO8859P1 ,os charcter set WE8ISO8859P1
DBname = test2 , db charcter set US7ASCII ,os charcter set UTF8
In both DB table1 having encrypted data using md5 encryption techniques . (dbms_obfuscation_toolkit.md5(input_string => v_input) )
Now i want to migrate data from test2 DB to test1 DB .How to migrate any one please help.
Thanks in advance
Naveen

I'm not sure that I follow what you're suggesting but it sounds like you're on the right track.
I'm still not sure whether you need the MD5 hash to match data in the database or not. If you change the character set of the underlying data, the MD5 hash may change so just keeping the hash intact may not be sufficient.
Justin

MD5 PLS-00307: too many declarations of 'MD5' match this call

Hi I wonder if any one can help, I am trying to write an equlivent of mysqls MD5 function.
When I compile the following I get this error message:
PLS-00307: too many declarations of 'MD5' match this call
function MD5(str varchar2)
RETURN VARCHAR2 IS
md_str VARCHAR2(16);
BEGIN
md_str := dbms_obfuscation_toolkit.md5(str);
return md_str;
END;

Looks to be like Oracle have bolloxed this one well and truly.
A desc of the toolkit reveals this:
PROCEDURE MD5
Argument Name                  Type                    In/Out Default?
INPUT                          RAW                     IN
CHECKSUM                       RAW(16)                 OUT
FUNCTION MD5 RETURNS RAW(16)
Argument Name                  Type                    In/Out Default?
INPUT                          RAW                     IN
PROCEDURE MD5
Argument Name                  Type                    In/Out Default?
INPUT_STRING                   VARCHAR2                IN
CHECKSUM_STRING                VARCHAR2                OUT
FUNCTION MD5 RETURNS VARCHAR2(16)
Argument Name                  Type                    In/Out Default?
INPUT_STRING                   VARCHAR2                IN.
i.e. two overloaded functions and two overloaded procedures with exactly the same signature. This is not supposed to handle, because the signature (number and type of parameters) is how the database deteremines which version of teh function to call. Identical signatures causes your PLS-307 error.
If it's any consolation, they appear to have fixed it in Oracle 9i (there's a solitary MD5 procedure).
Cheers, APC

Getting the MD5 of an entire ROW ?

Hi All,
I'm looking for how to get the MD5 of an entire row (or a known set of columns).
I've found the DBMS_OBFUSCATION_TOOLKIT.MD5 function, which takes either "input IN RAW" or "input_string IN VARCHAR2" as a parameter.
So, I've three questions:
1) Is is possible to get the entire value Row in a manner to pass into this function? (e.g. As a String)
2) Is this DBMS_OBFUSCATION_TOOLKIT package only in Enterprise edition and not in Standard edition ? (How do I check this)
3) or Is there a better way to get the MD5 of a Row ??
My row of data will contain a column of type MDSYS.SDO_GEOMETRY.
Cheers,
Ronan

Still no luck with that one...
select DBMS_OBFUSCATION_TOOLKIT.MD5( input_string => TO_CHAR( ROUTEN ) ) ) AS MD5 FROM interstates;
ERROR at line 1:
ORA-00907: missing right parenthesis
I've seen examples, using that input_string, but only in a procedure, I can't get it to work through a standard SQL statement.
For example:
SQL> SET SERVEROUTPUT ON;
SQL> BEGIN
2 DBMS_OUTPUT.PUT_LINE (
3 'md5 hash => ' ||
4 DBMS_OBFUSCATION_TOOLKIT.MD5 (
5 input => UTL_RAW.CAST_TO_RAW ('plain text'))
6 );
7 END;
8 /
md5 hash => 31BC5C2B8FD4F20CD747347B7504A385
PL/SQL procedure successfully completed.
SQL> SELECT DBMS_OBFUSCATION_TOOLKIT.MD5 ( input => UTL_RAW.CAST_TO_RAW ('plain text')) FROM DUAL;
SELECT DBMS_OBFUSCATION_TOOLKIT.MD5 ( input => UTL_RAW.CAST_TO_RAW ('plain text')) FROM DUAL
ERROR at line 1:
ORA-00907: missing right parenthesis

MD5 hash value from a file

Hello Oracle Community,
version 11.1
well a lof of questions from me today. Is it possible to generate a MD5 value from a file with PL/SQL and if so how can I do it ?
Ilja

Hi Ilja,
I never work with files from Oracle, but maybe you could try combining these:
UTL_FILE.GET_RAW (
   fid IN utl_file.file_type,
   r    OUT NOCOPY RAW,
   len IN PLS_INTEGER DEFAULT NULL);
DBMS_OBFUSCATION_TOOLKIT.MD5(
   input         IN RAW)
RETURN raw_checksum;Regards
Peter

Default Encrypted Password

Dear All,
i want to insert encrypted Password of 'password' string into table user_dtl column PASSWORD .
How can i insert Encripted password into table.
Thanks

Hi Vedant,
See the CUSTOM_HASH function that is installed with sample application in the APEX.
Here is the code for it:
create or replace function custom_hash (p_username in varchar2, p_password in varchar2)
return varchar2
is
l_password varchar2(4000);
l_salt varchar2(4000) := 'XFSPL28ZTWEWWM6FHWMK68AG5NQVLU';
begin
-- This function should be wrapped, as the hash algorithm is exposed here.
-- You can change the value of l_salt or the method of which to call the
-- DBMS_OBFUSCATOIN toolkit, but you much reset all of your passwords
-- if you choose to do this.
l_password := utl_raw.cast_to_raw(dbms_obfuscation_toolkit.md5
(input_string => p_password || substr(l_salt,10,13) || p_username ||
substr(l_salt, 4,10)));
return l_password;
end;
i want to insert encrypted Password of 'password' string into table user_dtl column PASSWORD.The above function will give the encrypted password which can be inserted into USER_DTL as follows:
INSERT INTO USER_DTL(USERNAME,PASSWORD) VALUES(:P1_USERNAME, CUSTOM_HASH(:P1_USERNAME,:P1_PASSWORD))Be sure that PASSWORD column in USER_DTL is of type VARCHAR2 and of adequate length as to accommodate the encrypted password.
Hope it helps!
Regards,
Kiran

Accessing APEX from E-Business Suite 11.5.10

Hi All -
I am brand new to APEX and have basically inherited the program duties b/c the school district that I work for had to cut costs and therefore had to let our consultants go - which means that I need to manage the system with no knowledge.....
that being said - I apologize in advance if I am very slow.
My first task is to see if we can set up the system where the users can access APEX straight from Oracle without having to login a separate time. I found this doc: http://www.oracle.com/technology/products/database/application_express/pdf/Extend_Oracle_Applications_11i.pdf
I tried to follow that but am sure I am missing something. Here is what I put in my pl/sql procedure:
/* Formatted on 1/21/2010 11:36:16 AM (QP5 v5.136.908.31019) */
CREATE OR REPLACE PACKAGE BODY OAE_PKG
IS
PROCEDURE LaunchOAE (parameters IN VARCHAR2)
IS
l_apex_launcher VARCHAR2 (2000);
l_apex_launcher_profile VARCHAR2 (2000);
l_userid applsys.FND_USER.user_id%TYPE;
l_username applsys.FND_USER.user_name%TYPE;
l_password VARCHAR2 (2000);
l_launcher_params VARCHAR2 (2000);
l_resp_id NUMBER;
l_resp_appl_id NUMBER;
l_security_group_id NUMBER;
l_org_id NUMBER;
BEGIN
l_apex_launcher_profile := fnd_profile.VALUE ('OAE_LAUNCHER');
IF l_apex_launcher_profile IS NULL
THEN
HTP.p ('Please contact System Administrator. ');
HTP.p ('Profile - OAE_LAUNCHER is null');
RETURN;
END IF;
l_userid := FND_GLOBAL.USER_ID;
l_username := FND_GLOBAL.USER_NAME;
l_resp_id := FND_GLOBAL.RESP_ID;
l_resp_appl_id := FND_GLOBAL.RESP_APPL_ID;
l_security_group_id := FND_GLOBAL.SECURITY_GROUP_ID;
l_org_id := FND_GLOBAL.ORG_ID;
l_launcher_params :=
'/f?p=200:1:::NO::P101_USERNAME,P101_PASSWORD,P101_RESP_ID,P101_RESP_APPL_ID,P101_SECURITY_GROUP_ID,P101_ORG_ID:'
|| l_username
|| ','
|| l_password
|| ','
|| l_resp_id
|| ','
|| l_resp_appl_id
|| ','
|| l_security_group_id
|| ','
|| l_org_id;
l_apex_launcher := l_apex_launcher_profile || l_launcher_params;
OWA_UTIL.redirect_url (l_apex_launcher);
--end if;
EXCEPTION
WHEN OTHERS
THEN
HTP.p (SQLERRM);
END LaunchOAE;
FUNCTION apex_generate_hash (p_string IN VARCHAR2, p_offset IN NUMBER DEFAULT 0)
RETURN VARCHAR2
IS
BEGIN
IF p_string IS NULL
THEN
RETURN NULL;
END IF;
RETURN RAWTOHEX(UTL_RAW.cast_to_raw(DBMS_OBFUSCATION_TOOLKIT.MD5 (
input_string => p_string || ':'
|| TO_CHAR (
SYSDATE
- (p_offset/24 * 60 * 60),
'YYYYMMDD HH24MISS'))));
END apex_generate_hash;
FUNCTION apex_validate_hash (p_string IN VARCHAR2,
p_hash IN VARCHAR2,
p_delay IN NUMBER DEFAULT 5)
RETURN BOOLEAN
IS
BEGIN
FOR i IN 0 .. p_delay
LOOP
IF p_hash = apex_generate_hash (p_string, i)
THEN
RETURN TRUE;
END IF;
END LOOP;
RETURN FALSE;
END apex_validate_hash;
PROCEDURE apex_launch (application IN NUMBER DEFAULT 300,
page IN NUMBER DEFAULT 18,
request IN VARCHAR2 DEFAULT NULL,
item_names IN VARCHAR2 DEFAULT NULL,
item_values IN VARCHAR2 DEFAULT NULL)
AS
BEGIN
OWA_UTIL.mime_header ('text/html', FALSE);
OWA_COOKIE.send (
name => 'APEX_APPS_' || application,
VALUE => FND_GLOBAL.user_name
|| ':'
|| apex_generate_hash (FND_GLOBAL.user_name),
PATH => '/');
OWA_UTIL.redirect_url('http://erpweb2:7777/pls/apex/f?p=300:18');-- fnd_profile.VALUE ('OAE_LAUNCHER')
--|| '/f?p='
--|| application
--|| ':'
--|| page
--|| '::'
--|| request
--|| ':::'
--|| item_names
--|| ':'
--|| item_values);
END apex_launch;
END;
When I click on the function in e-biz I get the message in my url: http://erpdev.garlandisd.net:8005/OA_HTML/AppsLocalLogin.jsp?requestUrl=APPSHOMEPAGE&cancelUrl=http%3A%2F%2Ferpdev.garlandisd.net%3A8005%2Foa_servlets%2Foracle.apps.fnd.sso.AppsLogin&langCode=US&errText=Invalid+Function.++Please+contact+the+System+Administrator.+Please+login+again.&username=RSMCANGU&s1=yhfxzOgYHeU6wrTC0FOlsQ..
Any help would be greatly appreciated!!
Rob

Hi;
Please check below link
How to access Oracle Apps (EBS) tables/views in APEX
http://apps2fusion.com/at/64-kr/393-how-to-access-oracle-apps-ebs-tablesviews-in-apex<< check Vishal post
Regard
Helios

DBMS_OBFUSCATION_TOOLKIT.MD5

Similar Messages

Maybe you are looking for