Reg; Password Encryption Problem

[me_lucky]

Hi Tim,

We are facing issue with password encryption when we are migrating to 10g to 11g Database.

We use Oracle table to store application user password in database with "DBMS_OBFUSCATION_TOOLKIT.MD5" encryption function.
We have imported the database from Oracle 10g(10.2.0.3) to Oracle 11g(11.2.0.3.0), after the succesful import when we are trying to access our applicationit says invalid password. All we have to do is resetting the password to access the application.

I request you to expalin us , is this the default behaviour of Oracle or we can avoid this by using any other way.

Thanks in Advance,
Lucky

[Tim...]

Hi.

MD5 is not for encryption. It is a hashing function. Hashing is not encryption because unlike encryption, a hash can not be reversed (decrypted). There is no guarantee that hash data will be portable. There is always a possibility that Oracle will alter the algorithm or the "salt", making the value non-deterministic between versions.

You basically have to do what you've already suggested and reset the values.

Cheers

Tim...

[me_lucky]

Hi Tim,

Thanks alot for the answer.

Can i request you to provide the alternative for MD5 to encrypt the password?

Thanks & Regards,
Lucky.

[Tim...]

Hi.

There is nothing wrong with MD5. You just have to be aware of potential issues. I guess I would probably do more or less what you've done. I wrote this many years ago:

http://www.oracle-base.com/articles/9i/ ... ase-9i.php

Cheers

Tim...

[me_lucky]

Hi Tim,

Thanks again for the quick info.

Thanks & Regards,
Lucky

[Tim...]