hashes in python and oracle sql not matching

Question

I have to functions to generate a hash (sha512) of a random element. The first one is a oracle sql query:

select RAND, DBMS_CRYPTO.HASH(RAND, 6 /*SHA512*/) as sha512 from 
    (select DBMS_CRYPTO.RANDOMBYTES(5) as RAND from DUAL);

which returns

RAND
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SHA512                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
C1BEC41854                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
E4BD639D4726D294CB63B6DDC651C6B6F5708ED3FC9B2E08A71DD7D36958B7B13BD31ECA28039565121F3067167D719292A86B6CAD052EFC9A56923594946084

When I try to generate the hash for C1BEC41854 in python I use the following script

from hashlib import sha512
h = 'C1BEC41854'
b = bytes.fromhex(h)
print(sha512(b).hexdigest())

which returns

a63f4d25b5f0fc51fb27ae1e1c5f4ff19edc7b790d2373071ae8f454e63766a19b69a200690a32a65dd57be5b47fec29ee15c354f52ad5916127bb4cf674ab37

Can you please help me figure out why the both hashes are not identical?

That string C1BEC41854 needs to be converted into bytes before being hashed (it's not magic). Are both methods using the same encoding algorithm? Maybe one has a default UTF-8 encoding and the other one uses ISO-8859-1 or other. — The Impaler
– The Impaler, Commented Jun 21, 2018 at 14:53
Are you using any salt to hash? (you should) Is it the same salt on both sides? — The Impaler
– The Impaler, Commented Jun 21, 2018 at 14:55
@TheImpaler no i am not using any salt. atmI am just trying to generate a matching hash. As soon as this works I will include the salt. Also DBMS_CRYPTO.RANDOMBYTES() returns RAW so this schould be bytes and in bytes.fromhex(h) i get a bytes object in python — jan-seins
– jan-seins, Commented Jun 21, 2018 at 15:02
When I try this without the DBMS_CRYPTO.RANDOMBYTES() but with a defined string hallo like this: select RAND, dbms_crypto.hash(RAND, 6 /*SHA512*/) as sha512 from (select UTL_I18N.STRING_TO_RAW( 'hallo', 'AL32UTF8' ) as RAND from dual); it is working just fine — jan-seins
– jan-seins, Commented Jun 21, 2018 at 15:07

Community · Accepted Answer · 2020-06-20 09:12:55Z

3

In your Oracle query, you're generating multiple random byte strings.

Try this to demonstrate:

select RAND, RAND, RAND, DBMS_CRYPTO.HASH(RAND, 6 /*SHA512*/) as sha512 from 
    (select DBMS_CRYPTO.RANDOMBYTES(5) as RAND from DUAL);

Note the three different values for RAND. So the hash you are generating is actually for a different byte sequence than you think it is.

To fix it, you can use this bit of trickery courtesy of AskTom

select RAND,DBMS_CRYPTO.HASH(RAND, 6 /*SHA512*/) as sha512 from 
    (select rownum, DBMS_CRYPTO.RANDOMBYTES(5) as RAND from DUAL);

including rownum in the subquery makes RAND consistent each time you use it as a field in the top level SELECT.

AskTom Question on the subject

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Jun 21, 2018 at 15:51

James

3,4711 gold badge22 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Marmite Bomber Over a year ago

excelent observation!

tbone · Accepted Answer · 2018-06-21 19:39:44Z

1

This will give you the same result (uppercased):

SELECT sys.dbms_crypto.hash(
  hextoraw('C1BEC41854'),
  6--HASH_SH512
) from dual;

Looks like your string is a hex value already, so I just did a hextoraw. If it was a basic string like 'Hello' then I'd use utl_raw.cast_to_raw.

Output:

A63F4D25B5F0FC51FB27AE1E1C5F4FF19EDC7B790D2373071AE8F454E63766A19B69A200690A32A65DD57BE5B47FEC29EE15C354F52AD5916127BB4CF674AB37

answered Jun 21, 2018 at 19:39

tbone

15.5k3 gold badges37 silver badges42 bronze badges

Collectives™ on Stack Overflow

hashes in python and oracle sql not matching

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related