Is Oracle's dbms_utility.get_hash_value algorithm documented do reverse engineered anywhere?

Question

I'm working with an existing database where passwords are hashed like this:

DBMS_UTILITY.GET_HASH_VALUE(the_username || the_password, 1000000000, 1073741824)

I know that this is bad for various reasons (not a proper cryptographically safe hash and the algorithm oracle uses may change between versions). But that database exists and it's unlikely that we can get them to change this since they have lots of users and cannot simply switch to a proper hashing algorithm without having each of them re-enter or reset their password.

Now I need to use this database for LDAP authentication (based on OpenLDAP). Unfortunately there is no way to make OpenLDAP pass the plaintext password to the database (where I could then simply call the hashing function on the plaintext password). However, modifying the LDAP client would be possible, so if I could create the hash there everything would be fine.

I'd rather avoid connecting to the Oracle database to do this since that would require the Oracle client, database login data, etc. on that machine, too. Therefore I wonder if there is any information about the algorithm used by GET_HASH_VALUE() available. I couldn't find anything on Google but maybe it's buried between all the somewhat unrelated results... In case the algorithm changed recently, the server version is 11.2.0.3.0.

• Philᵀᴹ: I can't find anything that says it's anything other than proprietary ...
• BillThor: Have you looked into ass-Through authentication?. Oracle would need to work as a sasl validator.
• ThiefMaster: Ass-Through authentication.. :D But thanks, that looks really interesting. I guess I need to implement the SASL part on my own?
• Roeland Van Heddegem: If you want to see the code of this package, you can always unwrap it. for example UnwrapIt
• ThiefMaster: @rvheddeg: I don't think the code is available... I looked at the all_source rows for dbms_utility and all I found was this: gist.github.com/ThiefMaster/f0b818f4d4514332e557 - I'm not familiar with Oracle but it looks very much like a prototype for a function defined somewhere else.

Answer 1

You cannot reverse DBMS_UTILITY.GET_HASH_VALUE. It is simply not possible.

Your problem is different: you have to identify an user thought an compliant LDAP directory (like OpenLDAP). Look for Enterprise Users or LDAP authtication in the Oracle documentation and you will find all you need ...