Skip to content

passlib.hash.oracle11 - Oracle 11g password hash

This class implements the hash algorithm introduced in version 11g of the Oracle Database. It supersedes the Oracle 10 password hash. This class can be can be used directly as follows:

from passlib.hash import oracle11 as oracle11

# generate new salt, hash password
hashed = oracle11.hash("password")
print(hashed)
# > 'S:4143053633E59B4992A8EA17D2FF542C9EDEB335C886EED9C80450C1B4E6'

# verify password
print(oracle11.verify("password", hashed))
# > True
print(oracle11.verify("secret", hashed))
# > False

Tip

See also: the generic PasswordHash usage examples

Warning

This implementation has not been compared very carefully against the official implementation or reference documentation, and its behavior may not match under various border cases. caveat emptor.

Interface

oracle11 

oracle11(salt=None, **kwds)

This class implements the Oracle11g password hash, and follows the :ref:password-hash-api.

It supports a fixed-length salt.

The :meth:~passlib.ifc.PasswordHash.using method accepts the following optional keywords:

Parameters:

  • salt (str, default: None ) –

    Optional salt string. If not specified, one will be autogenerated (this is recommended). If specified, it must be 20 hexadecimal characters.

  • relaxed (bool) –

    By default, providing an invalid value for one of the other keywords will result in a :exc:ValueError. If relaxed=True, and the error can be corrected, a :exc:~passlib.exc.PasslibHashWarning will be issued instead. Correctable errors include salt strings that are too long.

    .. versionadded:: 1.6

encrypt classmethod 

encrypt(*args, **kwds)

Legacy alias for :meth:hash.

.. deprecated:: 1.7 This method was renamed to :meth:!hash in version 1.7. This alias will be removed in version 2.0, and should only be used for compatibility with Passlib 1.3 - 1.6.

parsehash classmethod 

parsehash(hash, checksum=True, sanitize=False)

[experimental method] parse hash into dictionary of settings.

this essentially acts as the inverse of :meth:hash: for most cases, if hash = cls.hash(secret, **opts), then cls.parsehash(hash) will return a dict matching the original options (with the extra keyword checksum).

this method may not work correctly for all hashes, and may not be available on some few. its interface may change in future releases, if it's kept around at all.

Parameters:

  • hash –

    hash to parse

  • checksum –

    include checksum keyword? (defaults to True)

  • sanitize –

    mask data for sensitive fields? (defaults to False)

bitsize classmethod 

bitsize(salt_size=None, **kwds)

[experimental method] return info about bitsizes of hash

default_salt_size 

default_salt_size()

default salt size (defaults to max_salt_size)

default_salt_chars 

default_salt_chars()

charset used to generate new salt strings (defaults to salt_chars)

Format & Algorithm

An example oracle11 hash (of the string password) is:

S:4143053633E59B4992A8EA17D2FF542C9EDEB335C886EED9C80450C1B4E6

An oracle11 hash string has the format S:{checksum}{salt}, where:

  • S: is the prefix used to identify oracle11 hashes (as distinct from oracle10 hashes, which have no constant prefix).
  • {checksum} is 40 hexadecimal characters; encoding a 160-bit checksum.

(4143053633E59B4992A8EA17D2FF542C9EDEB335 in the example)

  • {salt} is 20 hexadecimal characters; providing a 80-bit salt (C886EED9C80450C1B4E6 in the example).

The Oracle 11 hash has a very simple algorithm: The salt is decoded from its hexadecimal representation into binary, and the SHA-1 digest of {password}{raw_salt} is then encoded into hexadecimal, and returned as the checksum.

Deviations

Passlib's implementation of the Oracle11g hash may deviate from the official implementation in unknown ways, as there is no official documentation. There is only one known issue:

  • Unicode Policy

Lack of testing (and test vectors) leaves it unclear as to how Oracle 11g handles passwords containing non-7bit ascii. In order to provide support for unicode strings, Passlib will encode unicode passwords using utf-8 before running them through Oracle11. This behavior may be altered in the future, if further testing reveals another behavior is more in line with the official representation.

References