Question

I am using Oracle 9 and JDBC and would like to encyrpt a clob as it is inserted into the DB. Ideally I’d like to be able to just insert the plaintext and have it encrypted by a stored procedure:

String SQL = 'INSERT INTO table (ID, VALUE) values (?, encrypt(?))'; PreparedStatement ps = connection.prepareStatement(SQL); ps.setInt(id); ps.setString(plaintext); ps.executeUpdate(); 

The plaintext is not expected to exceed 4000 characters but encrypting makes text longer. Our current approach to encryption uses dbms_obfuscation_toolkit.DESEncrypt() but we only process varchars. Will the following work?

FUNCTION encrypt(p_clob IN CLOB) RETURN CLOB IS     encrypted_string        CLOB;     v_string                CLOB; BEGIN   dbms_lob.createtemporary(encrypted_string, TRUE);   v_string := p_clob;   dbms_obfuscation_toolkit.DESEncrypt(     input_string => v_string,     key_string => key_string,     encrypted_string => encrypted_string );   RETURN UTL_RAW.CAST_TO_RAW(encrypted_string); END; 

I’m confused about the temporary clob; do I need to close it? Or am I totally off-track?

Edit: The purpose of the obfuscation is to prevent trivial access to the data. My other purpose is to obfuscate clobs in the same way that we are already obfuscating the varchar columns. The oracle sample code does not deal with clobs which is where my specific problem lies; encrypting varchars (smaller than 2000 chars) is straightforward.

Answer 1

I note you are on Oracle 9, but just for the record in Oracle 10g+ the dbms_obfuscation_toolkit was deprecated in favour of dbms_crypto.

dbms_crypto does include CLOB support:

DBMS_CRYPTO.ENCRYPT(    dst IN OUT NOCOPY BLOB,    src IN            CLOB         CHARACTER SET ANY_CS,    typ IN            PLS_INTEGER,    key IN            RAW,        iv  IN            RAW          DEFAULT NULL);  DBMS_CRYPT.DECRYPT(    dst IN OUT NOCOPY CLOB         CHARACTER SET ANY_CS,    src IN            BLOB,    typ IN            PLS_INTEGER,    key IN            RAW,    iv  IN            RAW          DEFAULT NULL);