Data Encryption Storage with the DBMS_CRYPTO Package
The DBMS_CRYPTO package enables you to perform on-demand encryption and decryption of stored data.
While encryption is not the ideal solution for addressing several security threats, it is clear that selectively encrypting sensitive data before storage in the database does improve security. Examples of such data could include credit card numbers and national identity numbers.
The DBMS_CRYPTO package enables encryption and decryption for common Oracle Database data types, including RAW and large objects (LOBs), such as images and sound. Specifically, it supports BLOBs and CLOBs. In addition, it provides Globalization Support for encrypting data across different database character sets.
The following cryptographic algorithms are supported:
-
AES, DES (deprecated), 3DES (deprecated), PBE_MD5DES (deprecated), 3DES_2KEY (deprecated), RC4 (deprecated), SM4
-
Cryptographic hash algorithms MD5(deprecated), SHA1(deprecated), SHA2, SHA3, SM3, SHAKE
-
Keyed hash (MAC) algorithms MD5 (deprecated), SHA1 (deprecated), SHA2, SHA3
-
Public Key Encryption Algorithm RSA_PKCS1_OAEP, RSA_PKCS1_OAEP_SHA2, SM2
-
Sign and verify algorithms SHA1-RSA, SHA2-RSA, SHA3-RSA, SHA2-ECDSA, SHA3-ECDSA, SM3-SM2
Block cipher modifiers are also provided with DBMS_CRYPTO. You can choose from several padding options, including Public Key Cryptographic Standard (PKCS) #5, and from four block cipher chaining modes, including Galois/Counter Mode (GCM). Padding must be done in multiples of eight bytes.
Note:
-
DES is no longer recommended by the National Institute of Standards and Technology (NIST).
-
Usage of SHA-1 is more secure than MD5. (MD5 has been deprecated starting in Oracle Database 21c.)
Starting with Oracle Database 21c, older encryption and hashing algorithms are deprecated. Deprecated algorithms include MD4, MD5, DES, 3DES, and RC4-related algorithms. Removing older, less secure cryptography algorithms prevents accidental use of these APIs. To meet your security requirements, Oracle recommends that you use more modern cryptography algorithms such as AES.
Starting with Oracle Database 21c, older encryption and hashing algorithms are deprecated.
As a consequence of this deprecation, Oracle recommends that you review your network encryption configuration to see if you have specified use of any of the deprecated algorithms. If any are found, then switch to using a more modern cipher, such as AES. See Configuring Oracle AI Database Native Network Encryption and Data Integrity for more information.
-
Usage of SHA-2 is more secure than SHA-1.
-
Keyed MD5 is not vulnerable.
The following table summarizes the DBMS_CRYPTO package features.
| Feature | DBMS_CRYPTO Supported Functionality |
|---|---|
HASH |
DBMS_CRYPTO supported algorithms |
HMAC |
MD5 (deprecated), SHA1 (deprecated), SHA2, SHA3, SM3, SHAKE |
KMACXOF |
KMAC |
ENCRYPT |
AES, DES (deprecated), 3DES (deprecated), PBE_MD5DES (deprecated), 3DES_2KEY (deprecated), RC4 (deprecated), SM4 |
ENCRYPT algorithm chaining modifiers |
CBC, CFB, ECB, OFB, GCM, CCM, XTS |
ENCRYPT algorithm padding modifiers |
PAD_PKCS5, PAD_NONE, PAD_ZERO, PAD_ORCL |
| Public key encryption | SHA-1, SHA-2, SM2 |
| Public key types | RSA, ECDSA, SM2 |
| Signature algorithms | SHA1-RSA, SHA2-RSA, SHA3-RSA, SHA2-ECDSA, SHA3-ECDSA, SM3-SM2 |
The following table shows supported hash functions.
| Hash Algorithm | Description |
|---|---|
HASH_MD5 (deprecated) |
MD5 hash |
HASH_SH1 (deprecated) |
SHA-1 hash |
HASH_SH256 |
256-bit SHA-2 hash |
HASH_SH384 |
384-bit SHA-2 hash |
HASH_SH512 |
512-bit SHA-2 hash |
HASH_SHA3_224 |
224-bit SHA-3 hash |
HASH_SM3 |
SM3 hash |
HASH_SHA3_256 |
256-bit SHA-3 hash |
HASH_SHA3_384 |
384-bit SHA-3 hash |
HASH_SHA3_512 |
512-bit SHA-3 hash |
HASH_SHAKE128 |
128-bit SHAKE hash |
HASH_SHAKE256 |
256-bit SHAKE hash |
The following table shows supported HMAC algorithms.
| Algorithm | Description |
|---|---|
HMAC_MD5 (deprecated) |
MD5 HMAC |
HMAC_SH1 (deprecated) |
SHA-1 HMAC |
HMAC_SH256 |
256-bit SHA-2 HMAC |
HMAC_SH384 |
384-bit SHA-2 HMAC |
HMAC_SH512 |
512-bit SHA-2 HMAC |
HMAC_SHA3_224 |
224-bit SHA-3 HMAC |
HMAC_SHA3_256 |
256-bit SHA-3 HMAC |
HMAC_SHA3_384 |
384-bit SHA-3 HMAC |
HMAC_SHA3_512 |
512-bit SHA-3 HMAC |
The following table shows KMACXOF algorithms.
| Algorithm | Description |
|---|---|
KMACXOF_128 |
128-bit KMAC |
KMACXOF_256 |
256-bit KMAC |
The following table shows ENCRYPT algorithms.
| Algorithm | Description |
|---|---|
ENCRYPT_RC4 (deprecated) |
RC4 encrypt |
ENCRYPT_DES (deprecated) |
DES encrypt |
ENCRYPT_3DES_2KEY (deprecated) |
3DES_2KEY encrypt |
ENCRYPT_3DES (deprecated) |
3DES encrypt |
ENCRYPT_PBE_MD5DES (deprecated) |
PBE_MD5DES encrypt |
ENCRYPT_AES |
AES encrypt |
ENCRYPT_AES128 |
128-bit AES encrypt |
ENCRYPT_AES192 |
192-bit AES encrypt |
ENCRYPT_AES256 |
256-bit AES encrypt |
ENCRYPT_SM4 |
SM4 Encrypt |
The following table shows ENCRYPT alogorithm chaining modifiers.
| Algorithm | Description |
|---|---|
CHAIN_CBC |
CBC Chain mode |
CHAIN_CFB |
CFB Chain mode |
CHAIN_ECB |
ECB Chain mode |
CHAIN_OFB |
OFB Chain mode |
CHAIN_GCM |
GCM Chain mode |
CHAIN_CCM |
CCM Chain mode |
CHAIN_XTS |
XTS Chain mode |
The following table shows ENCRYPT algorithm padding modifiers.
| ENCRYPT Alogorithm Padding Modifier | Description |
|---|---|
PAD_PKCS5 |
PKCS#5 padding |
PAD_NONE |
No padding |
PAD_ZERO |
Zero padding |
PAD_ORCL |
ORCL padding |
The following table shows convenience constants for block ciphers.
| Convenience Constant for Block Ciphers | Description |
|---|---|
DES_CBC_PKCS5 (deprecated) |
DES Encrypt with CBC Chain mode and PKCS#5 padding |
DES3_CBC_PKCS5 (deprecated) |
3DES Encrypt with CBC Chain mode and PKCS#5 padding |
AES_CBC_PKCS5 |
AES Encrypt with CBC Chain mode and PKCS#5 padding |
AES_GCM_NONE |
AES Encrypt with GCM Chain mode and no padding |
AES_CCM_NONE |
AES Encrypt with CCM Chain mode and no padding |
AES_XTS_NONE |
AES Encrypt with XTS Chain mode and no padding |
SM4_CFB_NONE |
SM4 Encrypt with CFB Chain mode and no padding |
SM4_OFB_NONE |
SM4 Encrypt with OFB Chain mode and no padding |
The following table shows public key encryption algorithms.
| Public Key Encryption Algorithm | Description |
|---|---|
PKENCRYPT_RSA_PKCS1_OAEP (deprecated) |
RSA with OAEP |
PKENCRYPT_RSA_PKCS1_OAEP_SHA2 |
RSA with SHA-2 and OAEP |
PKENCRYPT_SM2 |
SM2 encrypt |
The following table shows public key types.
| Public Key Type | Description |
|---|---|
KEY_TYPE_RSA |
RSA key type |
KEY_TYPE_ECDSA |
ECDSA key type |
KEY_TYPE_SM2 |
SM2 key typeSM2 key type |
The following table shows SIGN algorithms.
| Algorithm | Description |
|---|---|
SIGN_SHA224_RSA |
224-bit SHA-2 hash function with RSA |
SIGN_SHA256_RSA |
256-bit SHA-2 hash function with RSA |
SIGN_SHA256_RSA_X931 |
256-bit SHA-2 hash function with RSA and X931 padding |
SIGN_SHA384_RSA |
384-bit SHA-2 hash function with RSA |
SIGN_SHA384_RSA_X931 |
384-bit SHA-2 hash function with RSA and X931 padding |
SIGN_SHA512_RSA |
512-bit SHA-2 hash function with RSA |
SIGN_SHA512_RSA_X931 |
512-bit SHA-2 hash function with RSA and X931 padding |
SIGN_SHA1 (deprecated) |
SHA-1 hash function with RSA |
SIGN_SHA1_RSA_X931 (deprecated) |
SHA-1 hash function with RSA and X931 padding |
SIGN_SHA224_ECDSA |
224-bit SHA-2 hash function with ECDSA |
SIGN_SHA256_ECDSA |
256-bit SHA-2 hash function with ECDSA |
SIGN_SHA384_ECDSA |
384-bit SHA-2 hash function with ECDSA |
SIGN_SHA512_ECDSA |
512-bit SHA-2 hash function with ECDSA |
SIGN_ECDSA |
Elliptic Curve Digital Signature Algorithm |
SIGN_SM3_SM2 |
SM3 hash function with SM2 Signature Algorithm |
SIGN_SHA3_224_RSA |
224-bit SHA-3 hash function with RSA |
SIGN_SHA3_256_RSA |
256-bit SHA-3 hash function with RSA |
SIGN_SHA3_384_RSA |
384-bit SHA-3 hash function with RSA |
SIGN_SHA3_512_RSA |
512-bit SHA-3 hash function with RSA |
SIGN_SHA3_224_ECDSA |
224-bit SHA-3 hash function with ECDSA |
SIGN_SHA3_256_ECDSA |
256-bit SHA-3 hash function with ECDSA |
SIGN_SHA3_384_ECDSA |
384-bit SHA-3 hash function with ECDSA |
SIGN_SHA3_512_ECDSA |
512-bit SHA-3 hash function with ECDSA |
DBMS_CRYPTO supports a range of algorithms that accommodate both new and existing systems. Although 3DES_2KEY and MD4 are provided for backward compatibility, you achieve better security using 3DES, AES, or SHA-1. Therefore, 3DES_2KEY is not recommended.
The DBMS_CRYPTO package includes cryptographic checksum capabilities (MD5), which are useful for comparisons, and the ability to generate a secure random number (the RANDOMBYTES function). Secure random number generation is an important part of cryptography; predictable keys are easily guessed keys; and easily guessed keys may lead to easy decryption of data. Most cryptanalysis is done by finding weak keys or poorly stored keys, rather than through brute force analysis (cycling through all possible keys).
Note: Do not use DBMS_RANDOM, because it is unsuitable for cryptographic key generation.
The DBMS_CRYPTO package also supports Password-Based Key Derivation Function 2 (PBKDF2). Applications can use DBMS_CRYPTO.PBKDF2 to derive cryptographic key material from a password or passphrase, a salt, and an iteration count, and then use the derived key with the appropriate DBMS_CRYPTO encryption, decryption, or other related operations. PBKDF2 uses repeated HMAC operations with a salt, which increases the computational effort needed to test candidate passwords and helps reduce the usefulness of precomputed password hash tables. A higher iteration count increases resistance to brute-force attacks, but also increases computation time. It is recommended to use DBMS_CRYPTO.RANDOMBYTES to randomly generate a cryptographically secure salt for each password or passphrase, and to choose an iteration count that meets the application’s security and performance requirements.
Key management is programmatic. That is, the application (or caller of the function) must supply the encryption key. This means that the application developer must find a way of storing and retrieving keys securely. The relative strengths and weaknesses of various key management techniques are discussed in the sections that follow. The DES algorithm itself has an effective key length of 56-bits.