Search Results des3_cbc_pkcs5




Overview
Explore in AI Chat

Overview

FND_CRYPTO is the Oracle E-Business Suite cryptography package provided in the APPS schema. It supplies a server-side, PL/SQL-accessible implementation of common cryptographic primitives — hashing, message authentication codes, symmetric block ciphers, random number generation, and data encoding — so that other EBS components can protect sensitive data and verify integrity without depending on external toolkits. The package is a thin PL/SQL wrapper around the database's built-in UTL_RAW and DBMS_CRYPTO functionality, exposed under the EBS namespace with named constants for each supported algorithm.

Functionally, FND_CRYPTO addresses three business needs: confidentiality (encrypting/decrypting data such as passwords, keys, or configuration values), integrity (producing hashes and keyed MACs to detect tampering), and unpredictability (generating random bytes, numbers, and strings for tokens, salts, or session identifiers). Its availability in the APPS schema makes it callable from concurrent programs, forms, workflow, and custom code throughout the E-Business Suite in both 12.1.1 and 12.2.2.

Key Procedures and Functions

The package exposes twelve documented callable units. Their declared purpose is as follows:

  • ENCRYPT — Encrypts plaintext data using a stream or block cipher with a user-supplied key and an optional initialization vector (IV).
  • DECRYPT — Performs the inverse operation, recovering plaintext from ciphertext given the same key and IV.
  • ENCRYPTNUM — Encrypts numeric values, allowing sensitive identifiers or amounts to be stored in protected form.
  • DECRYPTNUM — Decrypts numeric values produced by ENCRYPTNUM.
  • HASH — Computes a one-way message digest of input data (for example the MD5 hash identified by the HASH_MD5 constant).
  • MAC — Produces a keyed message authentication code. The HMAC_MD5 constant (value 1) is the primary HMAC algorithm defined in the package header, alongside HMAC_CRC. This is the member the user's "hmac_md5" search typically targets.
  • RANDOMBYTES — Returns a RAW value of randomly generated bytes.
  • RANDOMNUMBER — Returns a randomly generated number within the full supported numeric range.
  • SMALLRANDOMNUMBER — Returns a randomly generated number constrained to a smaller range, suitable for lightweight identifiers.
  • ENCODE — Converts raw data into a printable encoding format (Base64, URL, or URL-with-bit-drop, per the ENCODE_B64, ENCODE_URL, and ENCODE_ORC constants).
  • DECODE — Reverses ENCODE, restoring the original raw data from its encoded representation.
  • RANDOMSTRING — Returns a randomly generated character string, useful for tokens, salts, and temporary credentials.

Tables Accessed

FND_CRYPTO does not read or write application tables. The documented table reference is UTL_RAW, accessed through an APPS synonym, which is the Oracle-supplied RAW manipulation package used for byte-level conversion and formatting of the RAW inputs and outputs handled by FND_CRYPTO. The cryptographic computations themselves are stateless: no persistence of keys, ciphertext, or random seeds occurs within the package. Callers are responsible for storing encrypted values and keys in their own application or custom tables.

Usage Notes

FND_CRYPTO is invoked wherever EBS or custom code needs programmatic cryptography inside the database. Typical scenarios include encrypting and decrypting stored credentials or configuration secrets, generating and validating HMAC values for message or parameter integrity, deriving hash values for comparison, and producing random tokens for security-sensitive workflows. Because it resides in APPS, it is reachable from concurrent program PL/SQL, Forms server-side logic, workflow function activities, OAF/ADF business component code, and ad hoc SQL or PL/SQL sessions.

Two header constants deserve particular attention: HMAC_MD5 (PLS_INTEGER := 1) selects the HMAC-MD5 algorithm for the MAC function, and HASH_MD5 (:= 2) selects MD5 for the HASH function. The package also defines block cipher constants DES_CBC_PKCS5 (4353) and DES3_CBC_PKCS5 (4355), the latter being the default crypto_type for ENCRYPT, reflecting the package's preference for Triple-DES. The header declares InvalidCipherSuite, mapped to Oracle error -28827, raised when an unsupported cipher type is requested. With 30 dependent packages documented, FND_CRYPTO is a shared infrastructure component, so changes to its behavior or constants should be treated as potentially wide-impacting.