Password encrpytion for security

Question

Hi
I am using the below code to encrpyt and decrpyt my password.
Could you please let me know how to use the hash algotithm here to protect password more secure?
Abd also please let me know how to keep safe the key?
Thanks
DECLARE
   input_string       VARCHAR2 (200) :=  'Secret';
   output_string      VARCHAR2 (200);
   encrypted_raw      RAW (2000);             -- stores encrypted binary text
   decrypted_raw      RAW (2000);             -- stores decrypted binary text
   num_key_bytes      NUMBER := 256/8;        -- key length 256 bits (32 bytes)
   key_bytes_raw      RAW (32);               -- stores 256-bit encryption key
   encryption_type    PLS_INTEGER :=          -- total encryption type
                            DBMS_CRYPTO.ENCRYPT_AES256
                          + DBMS_CRYPTO.CHAIN_CBC
                          + DBMS_CRYPTO.PAD_PKCS5;
BEGIN
   DBMS_OUTPUT.PUT_LINE ( 'Original string: ' || input_string);
   key_bytes_raw := DBMS_CRYPTO.RANDOMBYTES (num_key_bytes);
   encrypted_raw := DBMS_CRYPTO.ENCRYPT
         src => UTL_I18N.STRING_TO_RAW (input_string,  'AL32UTF8'),
         typ => encryption_type,
         key => key_bytes_raw
    -- The encrypted value "encrypted_raw" can be used here
DBMS_OUTPUT.PUT_LINE ( 'key_bytes_raw: ' || key_bytes_raw);
DBMS_OUTPUT.PUT_LINE ( 'encryption_type: ' || encryption_type);
DBMS_OUTPUT.PUT_LINE ( 'encrypted_raw: ' || encrypted_raw);
   decrypted_raw := DBMS_CRYPTO.DECRYPT
         src => encrypted_raw,
         typ => encryption_type,
         key => key_bytes_raw
   DBMS_OUTPUT.PUT_LINE ( 'decrypted_raw: ' || decrypted_raw);
   output_string := UTL_I18N.RAW_TO_CHAR (decrypted_raw, 'AL32UTF8');
   DBMS_OUTPUT.PUT_LINE ('Decrypted string: ' || output_string);
END;Edited by: user212310 on Feb 4, 2011 12:46 AM

Answer 1

Wow that is really overkill unless it is important for you to be able to fetch the password back in plain text.
Like others have said most times you store the users password as a hash. When they come back, you hash whatever they give you as a password then compare the two hashes.
When considering encryption one has to decide on strength. In other words how long would it take to decrypt a string without knowing its key.
What is the data you are protecting worth? Are you just trying to keep your average hacker out or are you defending against dedicated break in attempts?
One of the simplest solutions to defeat a dedicated break in attempt is to simply put a "three strikes" and you out rule in place so the account is locked after 3 attempts with an incorrect password. Or you can simply limit the number of attempts in a given amount of time, or after three attempts you lock the account for n minutes.
There are lots of simple cyphers that can be implemented as a stored procedure that would do exactly what you want. The complex the cypher the harder it is to implement.
As to your code. It works fine on my system in pl/sql and I am on Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 linux client and server.
As to keeping your encryption key safe you can hide it in any number of tables call the column just about anything, so use your imagination.
I think your question has been answered.