{"id":4889,"date":"2020-12-15T07:43:22","date_gmt":"2020-12-15T10:43:22","guid":{"rendered":"https:\/\/www.dbarj.com.br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/"},"modified":"2020-12-15T07:43:22","modified_gmt":"2020-12-15T10:43:22","slug":"understanding-internally-how-21c-gradual-database-password-rollover-works","status":"publish","type":"post","link":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/","title":{"rendered":"Understanding internally how 21c Gradual Database Password Rollover works"},"content":{"rendered":"<p>Oracle Database 21c introduced the new feature called &#8220;<strong>Gradual Database Password Rollover<\/strong>&#8220;. This allows the database password of the application user to be altered while allowing the older password to remain valid for the time specified by the\u00a0<code class=\"codeph\">PASSWORD_ROLLOVER_TIME<\/code> limit (PROFILE parameter).<\/p>\n<p>With this new feature, a password of an application can be changed without having to schedule a downtime, which is great..<\/p>\n<p>However, you may be wondering how oracle internally store and validate the old and new hashes in the dictionary. In this article, I will investigate and show how it works.<\/p>\n<h4>Getting started<\/h4>\n<p>First of all, to recap, we have the <strong>user_history$<\/strong> table that was introduced some time back to keep the old user password hashes for reuse control.<\/p>\n<h4><img loading=\"lazy\" decoding=\"async\" width=\"653\" height=\"327\" class=\"alignnone size-full wp-image-4847 \" src=\"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png\" alt=\"\" srcset=\"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png 653w, https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232-300x150.png 300w\" sizes=\"auto, (max-width: 653px) 100vw, 653px\" \/><\/h4>\n<p>Before we start, let me change the DEFAULT profile and enable the ROLLOVER feature:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; select LIMIT from dba_profiles where PROFILE='DEFAULT' AND RESOURCE_NAME='PASSWORD_ROLLOVER_TIME';\r\n\r\nLIMIT\r\n--------\r\n0\r\n\r\nSQL&gt; ALTER PROFILE DEFAULT LIMIT PASSWORD_ROLLOVER_TIME 1\/24;\r\n\r\nProfile altered.\r\n\r\nSQL&gt; select LIMIT from dba_profiles where PROFILE='DEFAULT' AND RESOURCE_NAME='PASSWORD_ROLLOVER_TIME';\r\n\r\nLIMIT\r\n--------\r\n.0416<\/pre>\n<p>The PASSWORD_ROLLOVER_TIME is given in number of days. Giving 1\/24 is 1 hour, meaning the user will still be able to use his old and new passwords for this period.<\/p>\n<p>Now, let&#8217;s start creating a new user and checking that:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; alter session set nls_date_format='YYYY-MM-DD HH24:MI:SS';\r\n\r\nSession altered.\r\n\r\nSQL&gt; select SYSDATE FROM DUAL;\r\n\r\nSYSDATE\r\n-------------------\r\n2020-12-14 20:42:49\r\n\r\nSQL&gt; create user C##DBA identified by \"welcome1\";\r\n\r\nUser created.\r\n\r\nSQL&gt; grant create session, dba to C##DBA;\r\n\r\nGrant succeeded.\r\n\r\nSQL&gt; select user_id from dba_users where username='C##DBA';\r\n\r\n   USER_ID\r\n----------\r\n       117\r\n\r\nSQL&gt; select USER#,PASSWORD_DATE from user_history$ where USER#=117 order by PASSWORD_DATE desc;\r\n\r\n     USER# PASSWORD_DATE\r\n---------- -------------------\r\n       117 2020-12-14 20:43:10\r\n\r\nSQL&gt; select row_number() over (order by PASSWORD_DATE asc) as seqnum, password from user_history$ where USER#=117 order by seqnum asc;\r\n\r\n    SEQNUM PASSWORD\r\n---------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n         1 T:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\n\r\nSQL&gt; select replace(spare4,';',chr(10)) spare4 from user$ where USER#=117;\r\n\r\nSPARE4\r\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nS:F0D6ED816568FCC320228B39CF2101E7D7F151A25217196D2FBA0E58E854\r\nT:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5<\/pre>\n<p>The &#8220;<strong>S<\/strong>&#8221; entry in SPARE4 column represents the <strong>SHA1<\/strong> hash (11g authentication) while the &#8220;<strong>T<\/strong>&#8221; entry is the <strong>SHA2<\/strong> (12c authentication). We can note that the value stored in the <strong>user_history$<\/strong> (control password reuse) has only the SHA2 entry.<\/p>\n<p><strong><span style=\"color: #800000;\">PS: When I say &#8220;SHA2&#8221;, please read &#8220;PBKDF2-based SHA512 hashing algorithm&#8221;.<\/span><\/strong><\/p>\n<p>Let&#8217;s change the user password and see what happens:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; alter user C##DBA identified by \"welcome2\";\r\n\r\nUser altered.\r\n\r\nSQL&gt; conn C##DBA\/welcome1\r\nConnected.\r\n\r\nSQL&gt; conn C##DBA\/welcome2\r\nConnected.<\/pre>\n<p>So after changing the password, you can note I still could connect using both password. How is it possible internally?<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">SQL&gt; select USER#,PASSWORD_DATE from user_history$ where USER#=117 order by PASSWORD_DATE desc;\r\n\r\n     USER# PASSWORD_DATE\r\n---------- -------------------\r\n       117 2020-12-14 20:47:25\r\n       117 2020-12-14 20:43:10\r\n\r\nSQL&gt; select row_number() over (order by PASSWORD_DATE asc) as seqnum, password from user_history$ where USER#=117 order by seqnum asc;\r\n\r\n    SEQNUM PASSWORD\r\n---------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n         1 T:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\n         2 T:2F85521FC89E01B445B622C6D4686062BCCD0AF8B030871946F85423049EB0576D3B3CDCDAB0936D299223E141B0C0889A0540443ED3857B572E54AA1A23A4E773B783F8C84531ECC4FBCF5DFF174510\r\n\r\nSQL&gt; select replace(spare4,';',chr(10)) spare4 from user$ where USER#=117;\r\n\r\nSPARE4\r\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nS:F0D6ED816568FCC320228B39CF2101E7D7F151A25217196D2FBA0E58E854\r\nT:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\nt:DF10CCD2DC546657A975E81604E99D48BD1A2729F804EA811B2111E43D64021CCA4027588D61ED9C718DAECEA5940C875CF6659049062AABA571073AD790774F451CC4B224409EFA64D5E5FBF6BB4EB5\r\nV:2F85521FC89E01B445B622C6D4686062BCCD0AF8B030871946F85423049EB0576D3B3CDCDAB0936D299223E141B0C0889A0540443ED3857B572E54AA1A23A4E773B783F8C84531ECC4FBCF5DFF174510\r\ns:7EE335579302B734BD399D2F342924862A8870F75217196D2FBA0E58E854\r\nU:5B1D91705F57E211D52F9F7546D1E6EF85130600F3CC762601AF5C2A8657\r\n\r\n<\/pre>\n<p>As you can note, SPARE 4 column has now 4 new attributes (<strong>s, t, U, V<\/strong>). Before we only had <strong>S<\/strong> and <strong>T<\/strong> uppercase. Matching their values with the past execution, we can find out that:<\/p>\n<ul>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">S: old SHA1 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">T: old SHA2 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">V: new SHA2 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">s, t, U: ???<\/span><\/strong><\/li>\n<\/ul>\n<p>Let&#8217;s change the password again and see what happens:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; alter user C##DBA identified by \"welcome3\";\r\n\r\nSQL&gt; conn C##DBA\/welcome1\r\nConnected.\r\n\r\nSQL&gt; conn C##DBA\/welcome2\r\nERROR:\r\nORA-01017: invalid username\/password; logon denied\r\n\r\nSQL&gt; conn C##DBA\/welcome3\r\nConnected.<\/pre>\n<p>Now I could only connect using the oldest one and the newest one. The one used in the middle is not working. Why?<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">SQL&gt; select USER#,PASSWORD_DATE from user_history$ where USER#=117 order by PASSWORD_DATE desc;\r\n\r\n     USER# PASSWORD_DATE\r\n---------- -------------------\r\n       117 2020-12-14 20:51:14\r\n       117 2020-12-14 20:47:25\r\n       117 2020-12-14 20:43:10\r\n\r\nSQL&gt; select row_number() over (order by PASSWORD_DATE asc) as seqnum, password from user_history$ where USER#=117 order by seqnum asc;\r\n\r\n    SEQNUM PASSWORD\r\n---------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n         1 T:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\n         2 T:2F85521FC89E01B445B622C6D4686062BCCD0AF8B030871946F85423049EB0576D3B3CDCDAB0936D299223E141B0C0889A0540443ED3857B572E54AA1A23A4E773B783F8C84531ECC4FBCF5DFF174510\r\n         3 T:B5019D0C1BEE94E5AA794DF474349F18DAFF533C791C02B9C7391B39B3D1E438B1901CF8C0565FDE9459FBBEE4B89C661C64945F4F80B7561F47BD5D7E19B243CA3487E88F01ED5924DB4014AA2850CD\r\n\r\nSQL&gt; select replace(spare4,';',chr(10)) spare4 from user$ where USER#=117;\r\n\r\nSPARE4\r\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nS:F0D6ED816568FCC320228B39CF2101E7D7F151A25217196D2FBA0E58E854\r\nT:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\nt:B761C2BE40827859924A320C2485B9CE850D39AB8343F2FAEBBDBD09916D63B2F6912AEE24FA4690CEC4742E5836D7315BC14C2FB78C5DBAB89D6D0DFAF41794451CC4B224409EFA64D5E5FBF6BB4EB5\r\nV:B5019D0C1BEE94E5AA794DF474349F18DAFF533C791C02B9C7391B39B3D1E438B1901CF8C0565FDE9459FBBEE4B89C661C64945F4F80B7561F47BD5D7E19B243CA3487E88F01ED5924DB4014AA2850CD\r\ns:9DB5F1A429351277A882362544C35A48B83B9F015217196D2FBA0E58E854\r\nU:DAD93E9BEEABC8997868EF2C430AE18B6D62DF8930CAF6BAC606D428A708\r\n<\/pre>\n<p>So the <strong>&#8220;S&#8221;<\/strong> and <strong>&#8220;T&#8221;<\/strong> entries are still as before, with the old SHA1 and SHA2 <strong>(welcome1 <\/strong>password<strong>)<\/strong> entry. All the others hashes changed. And we can still confirm that <strong>&#8220;V&#8221;<\/strong> has the new SHA2 hash matching with the <strong>user_history$<\/strong> table.<\/p>\n<p>Let&#8217;s now expire the rollover period and see what happens:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; ALTER USER C##DBA EXPIRE PASSWORD ROLLOVER PERIOD;\r\n\r\nSQL&gt; conn C##DBA\/welcome1\r\nERROR:\r\nORA-01017: invalid username\/password; logon denied\r\n\r\nSQL&gt; conn C##DBA\/welcome2\r\nERROR:\r\nORA-01017: invalid username\/password; logon denied\r\n\r\nSQL&gt; conn C##DBA\/welcome3\r\nConnected.<\/pre>\n<p>As expected, the 2 old password versions are not working anymore (the second was already failing when I created the third). Now checking once again the dictionary:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"oracledb\">SQL&gt; select USER#,PASSWORD_DATE from user_history$ where USER#=117 order by PASSWORD_DATE desc;\r\n\r\n     USER# PASSWORD_DATE\r\n---------- -------------------\r\n       117 2020-12-14 20:51:14\r\n       117 2020-12-14 20:47:25\r\n       117 2020-12-14 20:43:10\r\n\r\nSQL&gt; select row_number() over (order by PASSWORD_DATE asc) as seqnum, password from user_history$ where USER#=117 order by seqnum asc;\r\n\r\n    SEQNUM PASSWORD\r\n---------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n         1 T:00D396D65A0A899837CA952D3122C6CC146F8883D2B307EE744FE23E53EF489307721CD9D726F9075593807D6E470A69824D63AF0CFE2119B012CA90FE7A4C7E451CC4B224409EFA64D5E5FBF6BB4EB5\r\n         2 T:2F85521FC89E01B445B622C6D4686062BCCD0AF8B030871946F85423049EB0576D3B3CDCDAB0936D299223E141B0C0889A0540443ED3857B572E54AA1A23A4E773B783F8C84531ECC4FBCF5DFF174510\r\n         3 T:B5019D0C1BEE94E5AA794DF474349F18DAFF533C791C02B9C7391B39B3D1E438B1901CF8C0565FDE9459FBBEE4B89C661C64945F4F80B7561F47BD5D7E19B243CA3487E88F01ED5924DB4014AA2850CD\r\n\r\nSQL&gt; select replace(spare4,';',chr(10)) spare4 from user$ where USER#=117;\r\n\r\nSPARE4\r\n----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nS:DAD93E9BEEABC8997868EF2C430AE18B6D62DF8930CAF6BAC606D428A708\r\nT:B5019D0C1BEE94E5AA794DF474349F18DAFF533C791C02B9C7391B39B3D1E438B1901CF8C0565FDE9459FBBEE4B89C661C64945F4F80B7561F47BD5D7E19B243CA3487E88F01ED5924DB4014AA2850CD\r\n<\/pre>\n<p>What is curious is that now I&#8217;m back to only <strong>&#8220;S&#8221;<\/strong> and <strong>&#8220;T&#8221;<\/strong> entries.<\/p>\n<ul>\n<li>The <strong>&#8220;S&#8221;<\/strong> (current SHA1) received what was on <strong>&#8220;U&#8221;<\/strong><\/li>\n<li>The <strong>&#8220;T&#8221;<\/strong> (current SHA2) received what was on <strong>&#8220;V&#8221;<\/strong><\/li>\n<\/ul>\n<p>Now we can conclude that:<\/p>\n<ul>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">S: old SHA1 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">T: old SHA2 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">U: new SHA1 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">V: new SHA2 hash<\/span><\/strong><\/li>\n<\/ul>\n<p>What about <strong>s<\/strong> and <strong>t<\/strong> (lowercase)?<\/p>\n<p>Using <a href=\"https:\/\/www.openwall.com\/john\/\" target=\"_blank\" rel=\"noopener noreferrer\">john<\/a> for password recovery and trying to use the 3 passwords versions I used in this article, surprisingly they both had the latest used password <strong>(welcome3 <\/strong>password<strong>).<\/strong><\/p>\n<p><span style=\"text-decoration: underline;\"><span style=\"color: #993300;\"><strong>Why Oracle keeps 2 password formats for the same password?<\/strong><\/span><\/span><\/p>\n<p>If you note, the <strong>&#8220;s&#8221;<\/strong> and <strong>&#8220;S&#8221;<\/strong> have both the same SALT (last 20 characters) for the SHA1 and <strong>&#8220;t&#8221;<\/strong> and <strong>&#8220;T&#8221;<\/strong> also have the same SALT (last 32 characters) for the SHA2.<\/p>\n<p>So is seems that the reason Oracle keeps the new hashes using the same salt is <span style=\"text-decoration: underline;\">to use a single salt during the authentication flow<\/span> . That being said, it will be transparent for any client to support this new feature. All the server needs to do is compare the provided hash with the 2 possible options. And once the rollover period is over, the password using the new SALT will be used for security.<\/p>\n<p>So, in summary:<\/p>\n<ul>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">S: old SHA1 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">T: old SHA2 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">U: new SHA1 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">V: new SHA2 hash<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">s: new SHA1 hash using old SALT<\/span><\/strong><\/li>\n<li><strong><span style=\"font-family: 'courier new', courier, monospace;\">t: new SHA2 hash using old SALT<\/span><\/strong><\/li>\n<\/ul>\n<p>The SALT of <strong>&#8220;s&#8221;<\/strong> and <strong>&#8220;S&#8221;<\/strong> (in the case of a 11g authentication), or <strong>&#8220;t&#8221;<\/strong> and <strong>&#8220;T&#8221;<\/strong> (in the case of a 12c authentication) will be the one processed during the client\/server authentication on the rollover period and once it expires, the <strong>&#8220;U&#8221;<\/strong> and <strong>&#8220;V&#8221;<\/strong> entries (with new SALT) will replace the <strong>&#8220;S&#8221;<\/strong> and <strong>&#8220;T&#8221;<\/strong> entries.<\/p>\n<p>That&#8217;s it!<\/p>\n<b>Have you enjoyed? Please leave a comment or give a \ud83d\udc4d!<\/b>\n<div class='watch-action'><div class='watch-position align-left'><div class='action-like'><a class='lbg-style2 like-4889 jlk' href='javascript:void(0)' data-task='like' data-post_id='4889' data-nonce='de4404f630' rel='nofollow'><img class='wti-pixel' src='https:\/\/www.dbarj.com.br\/wp-content\/plugins\/wti-like-post\/images\/pixel.gif' title='Like' \/><span class='lc-4889 lc'>+2<\/span><\/a><\/div><\/div> <div class='status-4889 status align-left'><\/div><\/div><div class='wti-clear'><\/div>","protected":false},"excerpt":{"rendered":"<p>Oracle Database 21c introduced the new feature called &#8220;Gradual Database Password Rollover&#8220;. This allows the database password of the application user to be altered while allowing the older password to remain valid for the time specified by the\u00a0PASSWORD_ROLLOVER_TIME limit (PROFILE parameter). With this new feature, a password of an application can be changed without having &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/\">Continue lendo<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-4889","post","type-post","status-publish","format-standard","hentry","category-database","item-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Understanding internally how 21c Gradual Database Password Rollover works - DBA - Rodrigo Jorge - Oracle Tips and Guides<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"DBA RJ\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/\"},\"author\":{\"name\":\"DBA RJ\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"headline\":\"Understanding internally how 21c Gradual Database Password Rollover works\",\"datePublished\":\"2020-12-15T10:43:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/\"},\"wordCount\":725,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/img_5fd3cda2c8232.png\",\"articleSection\":[\"Oracle Database General\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/\",\"name\":\"Understanding internally how 21c Gradual Database Password Rollover works - DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/img_5fd3cda2c8232.png\",\"datePublished\":\"2020-12-15T10:43:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/img_5fd3cda2c8232.png\",\"contentUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2020\\\/12\\\/img_5fd3cda2c8232.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/2020\\\/12\\\/understanding-internally-how-21c-gradual-database-password-rollover-works\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Understanding internally how 21c Gradual Database Password Rollover works\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#website\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/\",\"name\":\"DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"description\":\"Blog about Databases, Security and High Availability\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/pt-br\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\",\"name\":\"DBA RJ\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"contentUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"width\":712,\"height\":712,\"caption\":\"DBA RJ\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Understanding internally how 21c Gradual Database Password Rollover works - DBA - Rodrigo Jorge - Oracle Tips and Guides","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/","twitter_misc":{"Escrito por":"DBA RJ","Est. tempo de leitura":"10 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#article","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/"},"author":{"name":"DBA RJ","@id":"https:\/\/www.dbarj.com.br\/pt-br\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"headline":"Understanding internally how 21c Gradual Database Password Rollover works","datePublished":"2020-12-15T10:43:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/"},"wordCount":725,"commentCount":0,"publisher":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"image":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png","articleSection":["Oracle Database General"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/","url":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/","name":"Understanding internally how 21c Gradual Database Password Rollover works - DBA - Rodrigo Jorge - Oracle Tips and Guides","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#primaryimage"},"image":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png","datePublished":"2020-12-15T10:43:22+00:00","breadcrumb":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#primaryimage","url":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png","contentUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2020\/12\/img_5fd3cda2c8232.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbarj.com.br\/pt-br\/2020\/12\/understanding-internally-how-21c-gradual-database-password-rollover-works\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.dbarj.com.br\/pt-br\/"},{"@type":"ListItem","position":2,"name":"Understanding internally how 21c Gradual Database Password Rollover works"}]},{"@type":"WebSite","@id":"https:\/\/www.dbarj.com.br\/pt-br\/#website","url":"https:\/\/www.dbarj.com.br\/pt-br\/","name":"DBA - Rodrigo Jorge - Oracle Tips and Guides","description":"Blog about Databases, Security and High Availability","publisher":{"@id":"https:\/\/www.dbarj.com.br\/pt-br\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbarj.com.br\/pt-br\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":["Person","Organization"],"@id":"https:\/\/www.dbarj.com.br\/pt-br\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9","name":"DBA RJ","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","url":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","contentUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","width":712,"height":712,"caption":"DBA RJ"},"logo":{"@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png"}}]}},"_links":{"self":[{"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/posts\/4889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/comments?post=4889"}],"version-history":[{"count":0,"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/posts\/4889\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/media?parent=4889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/categories?post=4889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/pt-br\/wp-json\/wp\/v2\/tags?post=4889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}