Decrypt password

[ckwan]

Hi everyone,
I have a situation where I want to get back my users'password where the user might forget the password and the application want to sent to the particular user for the lost password. And also this is transparent to the system admin user.

Any ideas on this ?

Thanks

[SANJAY_G]

AFAIK you cannot decrypt the password stored in data dictionary.

[adewri]

Originally posted by ckwan
Hi everyone,
I have a situation where I want to get back my users'password where the user might forget the password and the application want to sent to the particular user for the lost password. And also this is transparent to the system admin user.

Any ideas on this ?

Thanks

Well if that was possible, then there goes the security...

no you cannot decrypt the password, what you can do is save the encrypted password some where and then reuse it to reset the password to initial password in case the user losses his or her password.

SQL> select username,password from dba_users where username ='HR';

USERNAME                       PASSWORD
------------------------------ ------------------------------
HR                             E3FDF7CE80ED18FE

SQL> conn hr/manager;
Connected.
--initial password was manager
SQL> conn sys as sysdba
Enter password:
Connected.
SQL> alter user hr identified by hr;

User altered.
--changed the password
SQL> conn hr/manager;
ERROR:
ORA-01017: invalid username/password; logon denied


Warning: You are no longer connected to ORACLE.
SQL> conn sys as sysdba
Enter password:
Connected.
SQL> alter user hr identified by values 'E3FDF7CE80ED18FE';

User altered.
--resets the password to manager
SQL> conn hr/manager;
Connected.
SQL>

This method is good in case you don't know a user password and you want to make changes in his/her schema without letting her know

Just change it, make changes, reset it

Little bit off the main topic. But you can find a way to use it.

HTH

[jmodic]

You can not decrypt the password because it is not stored encrypted in the database dictionary!

The gibberish values that can be seen in DBA_USERS.PASSWORD column are not encripted passwords, they are hash values of passwords + corresponding usernames. So they are obteined by implementing some hashing alghorytm, not some encription alghorytm.

There is a huge difference between encryption and hashing. Encrypton is a reversible proces, while hashing is not. What that means? With encryption, you can allways get the original value from the encrypted value, provided that you have propper encryption key and an alghorytm. But with hashing process it is different. You can (generally speaking) never get the original value from the hashed value, even if you know the hashing algorythm. It is mathematicaly one-way process.

Oracle stores only hashed values of the passwords, so noone (including everyone in Oracle Corp.) can ever "guess" what the real password is, even if he got access to thos hashed passwords. The only way to get real password from its hash value is by use of brute force.

[adewri]

hashed not encrypted thats news...

so i get to learn another new thing from the great one

[abhaysk]

U have one method.....to get the password at the time of change....& can be stored in a table........

U Need to change the PSWD once....may u assign the same PSWD at the time of change....

create table user_pass(username varchar2(30), new_pass varchar2(30), old_pass varchar2(30), date_log date);

create or replace function fonc_pass
(username varchar2,
password varchar2,
old_password varchar2)
return boolean is 
n boolean;
m integer;
differ integer;
isdigit boolean;
ischar boolean;
ispunct boolean;
digitarray varchar2(20);
punctarray varchar2(25);
chararray varchar2(52);

begin 
insert into user_pass values(username,password,old_password,sysdate);
return(true);
end;
/

create user steeve identified by qwerty;

grant create session to steeve;

create profile test_pass limit
password_verify_function fonc_pass;

alter user steeve profile test_pass;

alter user steeve password expire;

-- ***************************************************************

SQL> show user;
USER is "SYS"
SQL> create table user_pass(username varchar2(30), new_pass varchar2(30), old_pass varchar2(30), date_log date);

Table created.

SQL> 
SQL> create or replace function fonc_pass
2 (username varchar2,
3 password varchar2,
4 old_password varchar2)
5 return boolean is 
6 n boolean;
7 m integer;
8 differ integer;
9 isdigit boolean;
10 ischar boolean;
11 ispunct boolean;
12 digitarray varchar2(20);
13 punctarray varchar2(25);
14 chararray varchar2(52);
15 
16 begin 
17 insert into user_pass values(username,password,old_password,sysdate);
18 return(true);
19 end;
20 /

Function created.

SQL> 
SQL> create user steeve identified by qwerty;

User created.

SQL> 
SQL> grant create session to steeve;

Grant succeeded.

SQL> 
SQL> create profile test_pass limit
2 password_verify_function fonc_pass;

Profile created.

SQL> 
SQL> alter user steeve profile test_pass;

User altered.

SQL> 
SQL> alter user steeve password expire;

User altered.

SQL> connect steeve/qwerty
ERROR:
ORA-28001: the password has expired


Changing password for steeve
New password: *******
Retype new password: *******
Password changed
Connected.
SQL> connect sys/YOURSYSPASSWORD
Connected.
SQL> select * from user_pass;

USERNAME NEW_PASS OLD_PASS DATE_LOG
------------------------------ ------------------------------ ------------------------------ ---------
STEEVE qwerty2 qwerty 04-SEP-02

1 row selected.

SQL>

U Need to change the PSWD once....may u assign the same PSWD at the time of change....

Here in above example it wud be "qwerty"

& o/p wud be old and new pswd same.


Regards
Abhay.

[Shestakov]

Originally posted by adewri
hashed not encrypted thats news...

In oracle (and in unix too):

hash_pwd = TO_HASH(pwd, username)
and not exists (as a mathematic method in nature):
pwd = TO_PWD(hash_pwd, username)

but encription/description has reverse mathematic methods
if u can:
encr_pwd = TO_ENCR(pwd, username)
then must be exists (as a mathematic method):
pwd = TO_DESCR(encr_pwd, username)

NOTE: TO_HASH, TO_PWD, TO_ENCR, TO_DESCR are not real functions
only as example.

[DaPi]

Originally posted by jmodic
The only way to get real password from its hash value is by use of brute force.

You mean Mr.Hanky with a shot-gun?

[jmodic]

Originally posted by DaPi
You mean Mr.Hanky with a shot-gun?

Yep, that would be one of the variants of using brute force to crack the password. Certanly the most efficient and the cheapest variant...