websecurity@lists.webappsec.org

The Web Security Mailing List

View all threads

Oracle wallet and Oracle password file ency?

DD
Deepak Dhyani
Mon, Aug 18, 2014 9:34 AM

Hi,

I want to understand how oracle(11g) stores passwords in files.

1)Password files authentication(SYS auth). How credentials are ency/hashed
in files? How it works internally.

2)Oracle wallet (it uses 3DES I guess) . For autologin how it secures the
password? where it stores the keys etc. Looks like it's just files
permissions based security but want to understand internals.

Any pointers?

for DB user authetication it uses salted hash which is fine.

Thanks
Deepak

Hi, I want to understand how oracle(11g) stores passwords in files. 1)Password files authentication(SYS auth). How credentials are ency/hashed in files? How it works internally. 2)Oracle wallet (it uses 3DES I guess) . For autologin how it secures the password? where it stores the keys etc. Looks like it's just files permissions based security but want to understand internals. Any pointers? for DB user authetication it uses salted hash which is fine. Thanks Deepak