Encryptind and decrypting database column in oracle 10g

Question

hi guys...
i am sai sandeep,i got a doubt how to encrypt a database column in oracle 10g..?
i am using a table " emp_uid " ,and strtucture as follows,
create table emp_uid(user_id varchar2(20),pwd varchar2(20));
i need to encrypt a pwd column in the emp_uid.
how to do it..?
thanking u  advance.....

Answer 1

Ok, here's a basic example...
SQL> create table myusers (username varchar2(30), password varchar2(40));
Table created.
SQL> create or replace procedure add_user(username in varchar2
  2                                      ,password in varchar2) is
  3  begin
  4    insert into myusers (username, password)
  5      values (add_user.username
  6             ,dbms_crypto.hash(utl_raw.cast_to_raw(add_user.username||'!'||add_user.password)
  7                              ,dbms_crypto.hash_sh1)
  8             );
  9    commit;
10  end;
11  /
Procedure created.
SQL> exec add_user('Fred','Fr3ddy')
PL/SQL procedure successfully completed.
SQL> select * from myusers
  2  /
USERNAME                       PASSWORD
Fred                           E5C975DB4C0A1CF65683E36421A6305F09F4EA9A
SQL> set serverout on;
SQL> create or replace procedure loginuser(username in varchar2
  2                                       ,password in varchar2) is
  3    v_hash     varchar2(40);
  4    v_username varchar2(30);
  5  begin
  6    v_hash := dbms_crypto.hash(utl_raw.cast_to_raw(loginuser.username||'!'||loginuser.password), dbms_crypto.hash_sh1);
  7    select username
  8    into   v_username
  9    from   myusers
10    where  username = loginuser.username
11    and    password = v_hash;
12    dbms_output.put_line('User: '||v_username||' logged in.');
13  exception
14    when no_data_found then
15      dbms_output.put_line('Username/Password is not valid!');
16  end;
17  /
Procedure created.
SQL> exec loginuser('Fred','Freddy');
Username/Password is not valid!
PL/SQL procedure successfully completed.
SQL> exec loginuser('Fred','Fr3ddy');
User: Fred logged in.
PL/SQL procedure successfully completed.
Ideally you would do the hashing of the password inside the client side application so only the Hashed value goes over the network, but the above demonstrates the principle of using hashes to store passwords.  Because it's a one way algorithm, only a brute force method can be used to try and determine the original password.  There is no way to directly un-hash the value.  To check for a valid login, we don't retrieve the password and try to unhash it to compare against what the user has supplied, we actually take what the user has supplied and hash that in the same way and then compare the hashes.
The point of including the username or some other data in the hashing process means that if two users have the same password, they will still have different hash values, so it won't be apparent they are the same passwords.  In my example, the point of putting another character between the concatenation of username and password is in case the username and password together would give the same result e.g.
If we had one user "Fred" with password "Fr3ddy" then just concatenating the strings would give "FredFr3ddy".
If we had another user "FredF" and he happened to choose a password "r3ddy" then just concatenating those would also give "FredFr3ddy"
by introducing a known breaking character they would be different e.g. "Fred!Fr3ddy" and "FredF!r3ddy" and hence give different hash values.
That's the basics of how passwords are stored for security.
It would take a lot of processing power and brute force methods just to determine a single password for a single user when using hashing methods of security.
With encryption, a brute force method could be used to find the decryption key, and once found that could be used to decrypt ALL the encyrpted data, hence it is less secure, especially when some clever person will no doubt have written the key down somewhere so they don't forget it.  With hashing there's no key to write down.