Oracle PL/SQL for DBAs

Generating Keys

As mentioned earlier, the DBMS_OBFUSCATION_TOOLKIT function used to generate an encryption key, DES3GETKEY, is not available in the DBMS_CRYPTO package. A new function, RANDOMBYTES, takes its place. If you want to use my get_key function in Oracle Database 10g, you will need to change this function to use RANDOMBYTES instead.

You need to be aware of the following differences when switching key generation methods:

• In the DBMS_OBFUSCATION_TOOLKIT, the DES3GETKEY function could generate a key with a datatype of either VARCHAR2 or RAW. In DBMS_CRYPTO, all encryptions involving VARCHAR2 are done through RAW, so a VARCHAR2 key is not useful, and the RANDOMBYTES function returns only a RAW key.

• In DBMS_CRYPTO, you do not need to specify the seed as you do in the DBMS_OBFUSCATION_TOOLKIT. The function gets the seed from the parameter SQLNET.CRYPTO_SEED inside the file SQLNET.ORA. This parameter, therefore, must have a valid value of any combination of characters between 10 and 70 bytes long. Here is an example setting of the parameter:

      SQLNET.CRYPTO_SEED = weipcfwe0cu0we98c0wedcpoweqdufd2d2df2dk2d2d23fv43098fpi
  wef02uc2ecw1x982jd23d908d

Let’s see how I need to change my get_key function to accommodate these changes.

    /* File on web: get_key_2.sql */

    CREATE OR REPLACE FUNCTION get_key (p_length IN PLS_INTEGER)

       RETURN RAW
    IS
       l_ret   RAW (4000);
    BEGIN
       l_ret := dbms_crypto.randombytes (p_length);
       RETURN l_ret;
    END;
    /

Note that there is no which parameter, either. In addition, I have ...