 |
|
Implementing the SHA1
Algorithm
Oracle Forensics tips by Paul Wright
|
DBMS_UTILITY.GET_HASH_VALUE should be
used for low priority patch checking and quick checksumming of many
packages. If there is a suspected incident then use
DBMS_OBFUSCATION_TOOLKIT.MD5 on the suspect package or on 10g
DBMS_CRYPTO. DBMS_CRYPTO is the most secure as it implements the
SHA1 algorithm but it is not available on 9i.
This is an implementation of SHA1
using DBMS_CRYPTO:
dbms_crypto.hash.auto.sql
set wrap
off
set linesize 400
set serveroutput on
create or replace procedure sha1sum(lvtype in varchar2,lvname in
varchar2,lvschema in varchar2)
is
l_hash raw(2000);
begin
l_hash:=dbms_crypto.hash(dbms_metadata.get_ddl(lvtype, lvname,
lvschema), dbms_crypto.hash_sh1);
dbms_output.put_line('HashSHA1='||l_hash||' Name='||lvschema||'.'||lvname);
end;
/
SQL> create
or replace procedure sha1sum(lvtype in varchar2,lvname in
varchar2,lvschema in varchar2)
2
is
3 l_hash raw(2000);
4 begin
5 l_hash:=dbms_crypto.hash(dbms_metadata.get_ddl(lvtype,
lvname,
lvschema), dbms_crypto.hash_sh1);
6 dbms_output.put_line('HashSHA1='||l_hash||'
Name='||lvschema||'.'||lvname);
7 end;
8 /
Procedure
created.
SQL> exec
sha1sum('VIEW','DBA_USERS','SYS');
HashSHA1=9B99749CE9B88DE8183FEB8637ED564BAC1BC201 Name=SYS.DBA_USERS
PL/SQL
procedure successfully completed.
To recap, DBMS_UTILITY.GET_HASH_VALUE
is available on 7, 8, 9, 10 and fast but has different
implementation on 7 therefore a different checksum is returned.
DBMS_OBFUSCATION.MD5 is on 9 and 10 but is slower though
cryptographically stronger than DBMS_UTILITY and weaker than
DBMS_CRYPTO HASH_SH1.
DBMS_CRYPTO HASH_SH1 is on 10 only and not fast but the most secure
of the three. If you use MD5 and SHA1 together this is not
susceptible to malicious use of a collision.
Therefore DBMS_UTILITY is useful for
checking patches and day to day state checking where speed is
important but for higher security MD5 or preferably SHA1 should be
used. For high security purposes it is preferable to check integrity
using both MD5 and SHA1 due to the fact that collisions in MD5 allow
for two files with differing content to have the same checksum.
Also by using
stripwire
it is possible
for an attacker to control the content of a malicious collision.
Using both MD5 and SHA1 checksums, dual collisions become all but
impossible (see scenario 6). This is a judgment call for the
analyst. For the sake of these examples we will use SHA1 but please
see later chapters for examples using MD5 and DBMS_UTILITY.
This is an excerpt from the book "Oracle
Forensics: Oracle Security Best Practices", by Paul M. Wright,
the father of Oracle Forensics.
