Overview

The DBMS_CRYPTO package provides basic encryption and decryption functions and stored procedures.

DBMS_CRYPTO supports the encryption and hash algorithms of multiple industry standards, including the Advanced Encryption Standard (AES). AES is approved by the National Institute of Standards and Technology (NIST) to replace the Data Encryption Standard (DES).

The DBMS_CRYPTO package allows you to encrypt and decrypt common data types, including RAW and large objects (LOBs), such as images and audio. In addition, DBMS_CRYPTO provides globalization support to enable data encryption and decryption between databases that use different character sets.

Data types

The following table describes the data types used by DBMS_CRYPTO subprograms.

Algorithms

The DBMS_CRYPTO package contains predefined encryption algorithms, block cipher chaining algorithms, and block cipher padding algorithms.

• The following table describes the supported hash algorithms.

  Name	Description
  HASH_MD4	Generates a 128-bit hash or message digest of the input message.
  HASH_MD5	Generates a 128-digit hash. MD5 is more complex than MD4.
  HASH_SH1	Generates a 160-bit hash. It is a Secure Hash Algorithm 1 (SHA-1) function.
  HASH_SH256	Generates a 256-bit hash. It is a SHA-2 function.
  HASH_SH384	Generates a 384-bit hash. It is a SHA-2 function.
  HASH_SH512	Generates a 512-bit hash. It is a SHA-2 function.

• The following table describes the supported encryption algorithms.

  Name	Description
  ENCRYPT_AES128	An advanced encryption standard and a block cipher. It uses 128-bit keys.
  ENCRYPT_AES192	An advanced encryption standard and a block cipher. It uses 192-bit keys.
  ENCRYPT_AES256	An advanced encryption standard and a block cipher. It uses 256-bit keys.
  ENCRYPT_DES	A data encryption standard and a block cipher. It uses 56-bit keys.
  ENCRYPT_3DES_2KEY	A data encryption standard and a block cipher. It encrypts the same block three times by using two keys. A valid key is 112 bits long.
  ENCRYPT_3DES	A data encryption standard and a block cipher. It encrypts the same block three times.

• The following table describes the supported block cipher chaining algorithms.

  Name	Description
  CHAIN_ECB	The Electronic Codebook (ECB) mode. It divides plain text data into blocks of identical length and encrypts each block.
  CHAIN_CBC	The Cipher Block Chaining (CBC) mode. It divides plain text data into blocks, performs XOR operation on each block with an initial block or its previous ciphertext block, and then encrypts the result.
  CHAIN_CFB	The Cipher Feedback (CFB) mode. It encrypts data units smaller than blocks.
  CHAIN_OFB	The Output Feedback (OFB) mode. It supports running block ciphers as synchronous stream ciphers. It is similar to CFB and differs from the latter in that n bits of the previous output block are moved to the rightmost position of the queue of data to be encrypted.

• The following table describes the supported block cipher padding algorithms.

  Name	Description
  PAD_PKCS5	Provides padding in compliance with PKCS #5, namely Password-Based Cryptography Standard.
  PAD_NONE	Allows you to specify no padding algorithm. The caller must ensure that the block size is correct. Otherwise, the package will return an error.

Limitations

DBMS_CRYPTO does not directly support data of the VARCHAR2 type. To encrypt data of the VARCHAR2 type, you must first convert the data to the uniform database character set AL32UTF8, and then to the RAW data type. You can use DBMS_CRYPTO to encrypt data after these conversions.

Subprograms

The following table describes the DBMS_CRYPTO subprograms supported by the current OceanBase Database version.