PL/SQL Implementation of PKCS #7 Padding

I’ve been working on an Oracle package for encrypting/decrypting data using AES256. I need the package to be compatible with a separate C# implementation of AES256 I’m also working on. In the .NET AESManaged Class, the default padding mode is PKCS #7, which the Oracle DBMS_CRYPTO package does not support.

So I’ve thrown together an implementation of PKCS7 padding in PL/SQL to use on the Oracle side. Details about the PKCS7 padding are described in RFC 5652.

fn_PKCS7_Pad:

Pads the raw data out to a multiple of the block size. Block size is in bytes.

CREATE OR REPLACE FUNCTION fn_PKCS7_Pad(pData IN RAW, pBlockSize IN PLS_INTEGER) RETURN RAW IS vPadSize PLS_INTEGER; vPadValue RAW(2); BEGIN vPadSize := pBlockSize - MOD(utl_raw.length(pData), pBlockSize); vPadValue := hextoraw(ltrim(to_char(vPadSize, 'XX'))); RETURN utl_raw.concat(pData, utl_raw.copies(vPadValue, vPadSize)); END; /

Note: If the data is already a multiple of the block size then the data is padded with one full block. This is per the RFC.

fn_PKCS7_Trim:

Function trims the padding off of the incoming raw data.

CREATE OR REPLACE FUNCTION fn_PKCS7_Trim(pData IN RAW) RETURN RAW IS vPadSize PLS_INTEGER; vPadValue RAW(2); BEGIN vPadValue := utl_raw.substr(pData, -1, 1); vPadSize := to_number(rawtohex(vPadValue), 'XX'); RETURN utl_raw.substr(pData, 1, utl_raw.length(pData) - vPadSize); END; /

The trim function is currently making some fairly broad assumptions about the data. One assumption is that the data is in fact padded. Also it is trimming off the number of bytes dictated by the last byte without actually checking to see if the previous bytes have the same value and the correct number of pad bytes are present. When I get some time, I’ll go back and add some sanity checks.

Test Code:

DECLARE PROCEDURE sp_test_pkcs7 (pData IN RAW, pBlockSize IN PLS_INTEGER) IS vInData RAW(100); vDataPadded RAW(100); vDataTrimmed RAW(100); BEGIN vInData := hextoraw(pData); vDataPadded := fn_pkcs7_pad(vInData, pBlockSize); vDataTrimmed := fn_pkcs7_trim(vDataPadded); dbms_output.put_line('------------------------------------'); dbms_output.put_line('IN: ' || rawtohex(vInData)); dbms_output.put_line('BLOCK SIZE: ' || pBlockSize); dbms_output.put_line('PADDED: ' || rawtohex(vDataPadded)); dbms_output.put_line('TRIMMED: ' || rawtohex(vDataTrimmed)); dbms_output.put_line('------------------------------------'); END; BEGIN sp_test_pkcs7('AABBCC', 8); --3 bytes of data sp_test_pkcs7('AABBCCDDEEFF', 8); --6 byes of data sp_test_pkcs7('AABBCCDDEEFFAABB', 8); --8 bytes of data END; /

Output:

------------------------------------
IN:         AABBCC
BLOCK SIZE: 8
PADDED:     AABBCC0505050505
TRIMMED:    AABBCC
------------------------------------
------------------------------------
IN:         AABBCCDDEEFF
BLOCK SIZE: 8
PADDED:     AABBCCDDEEFF0202
TRIMMED:    AABBCCDDEEFF
------------------------------------
------------------------------------
IN:         AABBCCDDEEFFAABB
BLOCK SIZE: 8
PADDED:     AABBCCDDEEFFAABB0808080808080808
TRIMMED:    AABBCCDDEEFFAABB
------------------------------------

Full Code in Text File