如何从Oracle 12c生成加密密码用于JDBC连接？客户无法提供明文密码

Hey there! Let's figure out how to generate an encrypted password for your Oracle 12c JDBC connection when you don't have access to the plaintext. Below are two practical, proven approaches you can use:

This method generates the encrypted password directly within the Oracle database, which is great if you have database access and want to align with Oracle's native tools.

First, make sure your database user has the necessary permissions to use the DBMS_CRYPTO package. Ask your DBA to run this command:

GRANT EXECUTE ON SYS.DBMS_CRYPTO TO your_database_user;

Next, run this PL/SQL block to encrypt your plaintext password. Replace the placeholder values with your actual password, secret key, and initialization vector (IV) — note that the key and IV need to be 16 bytes long for AES-128 encryption:

DECLARE
  v_plaintext VARCHAR2(100) := 'your_actual_plain_password';
  v_key RAW(128) := UTL_RAW.CAST_TO_RAW('your_16byte_secret_key');
  v_iv RAW(128) := UTL_RAW.CAST_TO_RAW('your_16byte_iv_value');
  v_encrypted RAW(2000);
BEGIN
  v_encrypted := DBMS_CRYPTO.ENCRYPT(
    src => UTL_RAW.CAST_TO_RAW(v_plaintext),
    typ => DBMS_CRYPTO.AES_CBC_PKCS5,
    key => v_key,
    iv => v_iv
  );
  -- Output raw encrypted value and Base64-encoded version (easier to share)
  DBMS_OUTPUT.PUT_LINE('Encrypted (RAW): ' || v_encrypted);
  DBMS_OUTPUT.PUT_LINE('Encrypted (Base64): ' || UTL_ENCODE.BASE64_ENCODE(v_encrypted));
END;
/

The Base64 output is the encrypted password you can share with the client. When setting up your JDBC connection, you'll need to use the same key and IV to decrypt this value before passing it to the connection string.

If you prefer generating the encrypted password directly in your application stack, use this Java approach. It uses AES encryption (matching the Oracle method above) so you can easily align with database-side decryption if needed.

Here's a reusable Java class to encrypt and decrypt passwords:

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class OraclePasswordEncryptor {
    // Match these values with what you used in the PL/SQL block if cross-referencing
    private static final String ENCRYPTION_ALGORITHM = "AES/CBC/PKCS5Padding";
    private static final String SECRET_KEY = "your_16byte_secret_key";
    private static final String INIT_VECTOR = "your_16byte_iv_value";

    public static String encrypt(String plainPassword) throws Exception {
        SecretKeySpec secretKey = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
        IvParameterSpec ivSpec = new IvParameterSpec(INIT_VECTOR.getBytes());
        
        Cipher cipher = Cipher.getInstance(ENCRYPTION_ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);
        
        byte[] encryptedBytes = cipher.doFinal(plainPassword.getBytes());
        return Base64.getEncoder().encodeToString(encryptedBytes);
    }

    public static String decrypt(String encryptedPassword) throws Exception {
        SecretKeySpec secretKey = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
        IvParameterSpec ivSpec = new IvParameterSpec(INIT_VECTOR.getBytes());
        
        Cipher cipher = Cipher.getInstance(ENCRYPTION_ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKey, ivSpec);
        
        byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedPassword));
        return new String(decryptedBytes);
    }

    public static void main(String[] args) throws Exception {
        String plainPwd = "your_actual_plain_password";
        String encryptedPwd = encrypt(plainPwd);
        System.out.println("Encrypted Password: " + encryptedPwd);
        
        // Verify decryption works
        System.out.println("Decrypted Password: " + decrypt(encryptedPwd));
    }
}

Compile and run this class — the output will be your encrypted password. When setting up your JDBC connection, call the decrypt() method to get the plaintext password and pass it to your connection setup code.

Important Notes #

• Keep keys secure: The secret key and IV are critical — if they're exposed, the encryption is useless. Store them in a secure vault or environment variable, not hard-coded in your code.
• Match parameters: Ensure the encryption algorithm, key, and IV are identical between encryption and decryption steps, otherwise you'll get invalid password errors.
• Align with client rules: If the client already uses a specific encryption standard, confirm the algorithm, key length, and padding scheme with them first to generate a compatible encrypted password.

内容的提问来源于stack exchange，提问作者user2431334