Re: SQL DECRYPT_CHAR with incorrect password does not fail?

David,

Also, be aware that those SQL built-in functions like ENCRYPT_AES and DECRYPT_CHAR are really just "wrapper functionss" -- and because we have ENCRYPT_DES, ENCRYPT_AES, etc., but only one DECRYPT_CHAR function, it needs a way to communicate to the "back end" (e.g. DECRYPT_CHAR) which encryption algorithm was used ... so there is some extra data stuffed in there somewhere, likely at the start, e.g. some kind of a "header"...

So, you cannot just take the raw data in hex, that results from calling e.g. ENCRYPT_AES, and then later try to decrypt it yourself, e.g. using the MI CIPHER built-in function or using the QC3xxx APIs.

Because of this "wrapper" and "header" it is "not directly compatible" with the raw encrypt and decrypt functions.

Just a "heads up" to help you avoid possible future trouble "down the road."

Depending on your requirements, you may want to just use the "raw" encrypt and decrypt APIs directly, rather than using the "embedded SQL" provided "wrapper" functions.

All the best,

Mark S. Waterbury


On Monday, November 18, 2019, 4:32:59 PM EST, David Gibbs via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

My gut says I'm missing something...

For compatibility sake, I'm running on 7.2.

I'm encrypting data in a char column (for bit data) using the SQL
ENCRYPT_AES function.

I use the DECRYPT_CHAR function to decrypt it.

If I use the correct password, it decrypts fine.

If I use the wrong password, it does not fail. SQLCOD and SQLSTATE are
both 0.  The returned value is garbage.

Shouldn't the decrypt function, with a wrong password, set an error code?

david