HELP WITH BLOB CRYPTING

Question

HI Guys,
i can't get the dbms_crypto procedure to work correctly:
i've a table where i upload data via apex, all stored in a blob table of mine and the download proc as well to download file: i can't crypt the blob file.
my custom proc is triggered:
As you can see only update, such it doesn't crypt nothing ;-(
I've copied only the encrypt proc such the problem has to be similare for the other proc as well.
Probably the error is using the same blob as source as destination, however i can't fix this, and i think is possible to 'work' on the same blob.
Note that only for test purpose i have copied the blob from another col of the same table (BLOB_CONTENT_NON_CRYPT), so my col has data in it.
create or replace TRIGGER BI_BNFOWNFL BEFORE INSERT ON BNFOWNFL
FOR EACH ROW
DECLARE
B BLOB;
begin
IF INSERTING THEN
select "BNFOWNFL_SEQ".nextval into :NEW.ID from dual;
END IF;
IF UPDATING THEN
B:=:OLD.BLOB_CRYPTED;
P_ENCRYPT.encrypt_ssnBLOB(B);
:NEW.BLOB_CRYPTED:=B;
NULL;
END IF;
end;
MY PROC IS AS FOLLOWS:
PROCEDURE encrypt_ssnBLOB( p_ssn IN OUT NOCOPY BLOB);
PROCEDURE decrypt_ssnBLOB( p_ssn IN OUT NOCOPY BLOB);
G_KEY RAW(32) := UTL_I18N.STRING_TO_RAW( 'ZORRO', 'AL32UTF8' );
PROCEDURE encrypt_ssnBLOB( p_ssn IN OUT NOCOPY BLOB )
IS
BEGIN
dbms_crypto.encrypt
( dst => p_ssn,
src => p_ssn,
typ => DBMS_CRYPTO.DES_CBC_PKCS5,
key => G_KEY );
END encrypt_ssnBLOB;
Thanx a lot for help

Answer 1

Hi, Marcello, glad to hear - you got the process working, but after i reread your post ( if i understood you correctly ) - i have some doubts on your procedure - could you get the original documents by decrypting your encrypted documents successfully ?
The main problem with it in my opinion - you can't pass to the encrypt procedure the same lob locator for source and for destination. Docs says - the output lob will be overwritten and it will be indeed (http://download-uk.oracle.com/docs/cd/B19306_01/appdev.102/b14258/d_crypto.htm#sthref1552).
To demonstrate this i set up some examples - in the first part i encrypt using the same lob locator passed to the encrypt procedure, in the second i created a trigger which works properly ( i.e. the encrypted part can be decrypted again, the encryption part of trigger body can/should be placed in the procedure of course). Another issue - with assignment like A_LOB := :NEW.LOB_COLUMN within the trigge - on this way your new variable points to the same lob as :NEW.LOB_COLUMN and therefor can not be used as destination lob parameter for the encrypt procedure - that is why i used in my example DBMS_LOB.COPY procedure.
scott@ORA102> DECLARE
2 l_blob_1 BLOB;
3 l_blob_2 BLOB;
4 G_KEY RAW(32) := UTL_I18N.STRING_TO_RAW( lpad('ZORRO',8), 'AL32UTF8' );
5 BEGIN
6 dbms_lob.createtemporary(l_blob_1,TRUE);
7 dbms_lob.createtemporary(l_blob_2,TRUE);
8 l_blob_1 := UTL_I18N.STRING_TO_RAW('Hello, world!','AL32UTF8');
9 l_blob_2 := UTL_I18N.STRING_TO_RAW('God save the queen','AL32UTF8');
10 dbms_output.put_line('1 LOB content before encryption: '||rawtohex(l_blob_1));
11 dbms_output.put_line('2 LOB content before encryption: '||rawtohex(l_blob_2));
12 dbms_crypto.encrypt( dst => l_blob_1,src => l_blob_1,typ => DBMS_CRYPTO.DES_CBC_PKCS5,key => G_KEY );
13 dbms_crypto.encrypt( dst => l_blob_2,src => l_blob_2,typ => DBMS_CRYPTO.DES_CBC_PKCS5,key => G_KEY );
14 dbms_output.put_line('1 LOB content after encryption: '||rawtohex(l_blob_1));
15 dbms_output.put_line('2 LOB content after encryption: '||rawtohex(l_blob_2));
16 -- now try to decrypt the "encrypted" blob - it seems, we got the junk
17 -- to accomplish it - l_blob_1 should be properly encrypted form of l_blob_2:
18 dbms_crypto.decrypt( dst => l_blob_1,src => l_blob_2,typ => DBMS_CRYPTO.DES_CBC_PKCS5,key => G_KEY );
19 dbms_output.put_line('2 LOB content after PROPER decryption: '||rawtohex(l_blob_1));
20 END;
21 /
1 LOB content before encryption: 48656C6C6F2C20776F726C6421
2 LOB content before encryption: 476F6420736176652074686520717565656E
1 LOB content after encryption: 501A81E5BE464DB3
2 LOB content after encryption: 501A81E5BE464DB3
2 LOB content after PROPER decryption:
PL/SQL procedure successfully completed.
scott@ORA102>
scott@ORA102> DROP TABLE test_encryption;
Table dropped.
scott@ORA102> CREATE TABLE test_encryption(ID NUMBER,plain_blob BLOB,encrypted_blob BLOB);
Table created.
scott@ORA102> INSERT INTO test_encryption(ID,plain_blob,encrypted_blob)
2 VALUES(1,rawtohex('Hello World!'),NULL);
1 row created.
scott@ORA102> CREATE OR REPLACE TRIGGER trg_test_encryption
2 BEFORE UPDATE ON test_encryption
3 FOR EACH ROW
4 DECLARE
5 G_KEY RAW(32) := UTL_I18N.STRING_TO_RAW( lpad('ZORRO',8), 'AL32UTF8' );
6 l_blob BLOB;
7 BEGIN
8 dbms_lob.createtemporary(:NEW.encrypted_blob,TRUE);
9 dbms_lob.open(:NEW.encrypted_blob,dbms_lob.lob_readwrite);
10 dbms_lob.open(:NEW.plain_blob,dbms_lob.lob_readonly);
11 dbms_lob.copy(:NEW.encrypted_blob,:NEW.plain_blob,dbms_lob.getlength(:NEW.plain_blob),1,1);
12 dbms_crypto.encrypt( dst => :NEW.encrypted_blob,src =>:NEW.plain_blob ,typ => DBMS_CRYPTO.DES_CBC_PKCS5,key => G_KEY );
13 END;
14 /
Trigger created.
scott@ORA102> UPDATE test_encryption SET ID=ID;
1 row updated.
scott@ORA102> COMMIT;
Commit complete.
scott@ORA102> col plain for a20
scott@ORA102> col enc for a20
scott@ORA102>
scott@ORA102> SELECT
2 dbms_lob.getlength(plain_blob) len_plain,
3 dbms_lob.substr(plain_blob,dbms_lob.getlength(plain_blob),1) plain,
4 dbms_lob.getlength(encrypted_blob) len_enc,
5 dbms_lob.substr(encrypted_blob,dbms_lob.getlength(encrypted_blob),1) enc
6 FROM test_encryption;
LEN_PLAIN PLAIN LEN_ENC ENC
12 48656C6C6F20576F726C 16 6784483CC01870D1BE58
6421 FB64909783DB
scott@ORA102>
scott@ORA102> -- now try to decrypt the encrypted value
scott@ORA102> DECLARE
2 G_KEY RAW(32) := UTL_I18N.STRING_TO_RAW( lpad('ZORRO',8), 'AL32UTF8' );
3 l_src BLOB;
4 l_tgt BLOB;
5 BEGIN
6 dbms_lob.createtemporary(l_tgt,TRUE);
7 SELECT encrypted_blob INTO l_src FROM test_encryption FOR UPDATE;
8 dbms_lob.open(l_tgt,dbms_lob.lob_readwrite);
9 dbms_lob.open(l_src,dbms_lob.lob_readonly);
10 dbms_crypto.decrypt( dst => l_tgt,src => l_src ,typ => DBMS_CRYPTO.DES_CBC_PKCS5,key => G_KEY );
11 dbms_output.put_line(utl_raw.cast_to_varchar2(l_tgt));
12 ROLLBACK;
13 END;
14 /
Hello World!
PL/SQL procedure successfully completed.
Best regards
Maxim