Deprecating 3DES & MD5 in Oracle 19c/23ai: Migrating to FIPS-Compliant AES-256 & SHA-2 Encryption

Executive Summary: Deprecation of Legacy Cryptography

n accordance with NIST SP 800-131A and FIPS 140-3 security guidelines, Oracle has officially deprecated legacy 3DES (Triple-DES) encryption algorithms and MD5 message digest hashing across modern Oracle Database releases.

Legacy network configurations relying on 3DES or DES in sqlnet.ora face severe vulnerabilities:

1. Sweet32 Attack Vector (CVE-2016-2183): 3DES uses 64-bit block sizes, allowing attackers eavesdropping on encrypted SQL Net traffic to recover plaintext session tokens.
2. FIPS Compliance Violations: Financial institutions, government agencies, and higher-ed portals running 3DES fail automated PCI-DSS and FIPS compliance scans.
3. Connection Dropping: Upgraded database binaries automatically reject connection requests specifying 3DES or MD5 algorithms (ORA-12650: No common encryption algorithm).

This guide details how to audit legacy encryption settings and migrate to FIPS-compliant AES-256 native network encryption.

---

Technical Architecture & Cryptographic Migration

<div class="process-flow">
  <div class="process-step">
    <div class="step-number">Deprecated</div>
    <div class="step-title">3DES / DES / RC4 / MD5 (Sweet32 Vulnerable)</div>
  </div>
  <div class="process-arrow">➔</div>
  <div class="process-step">
    <div class="step-number">Audit Step</div>
    <div class="step-title">sqlnet.ora & dba_db_links Inspection</div>
  </div>
  <div class="process-arrow">➔</div>
  <div class="process-step">
    <div class="step-number">FIPS Target</div>
    <div class="step-title">AES-256-GCM / SHA-256 (FIPS 140-3 Compliant)</div>
  </div>
</div>

---

🔍 Diagnostic Checklist: Audit Your Encryption Posture

Execute these diagnostic checks to determine if your server or client configurations rely on deprecated 3DES/MD5 algorithms:

Diagnostic 1: Check sqlnet.ora Native Network Encryption Settings

Inspect $ORACLE_HOME/network/admin/sqlnet.ora on your database server:

grep -E "SQLNET.ENCRYPTION|SQLNET.CRYPTO_CHECKSUM" $ORACLE_HOME/network/admin/sqlnet.ora

Risk Criteria:

• 🚨 3DES168 / 3DES112 / DES: Critical Risk! Legacy 3DES encryption is active and must be removed.
• 🚨 MD5: High Risk! MD5 hashing is vulnerable to collision attacks and non-compliant.

---

Step-by-Step Production Migration Runbook

Step 1: Update Server-Side sqlnet.ora Configuration

Replace legacy 3DES and MD5 algorithm definitions in $ORACLE_HOME/network/admin/sqlnet.ora with FIPS-compliant AES-256 parameters:

# ====================================================================
# FIPS 140-3 Compliant Native Network Encryption (sqlnet.ora)
# ====================================================================

# Enforce Server-Side Encryption Requirement
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128)

# Enforce Strong Checksum Algorithms (SHA-2 Family)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA512, SHA384, SHA256)

---

Step 2: Update Client-Side sqlnet.ora Parameters

Ensure application server hosts (PeopleSoft PIA, Banner Web, ORDS, custom app servers) match the updated AES-256 encryption requirements:

# Client-Side Encryption Configuration
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256, AES192)
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA512, SHA256)

---

Step 3: Verify Active Connection Encryption

Run this SQL query to verify that active user sessions are connecting over AES-256 encryption rather than 3DES:

-- Audit encryption algorithm for active database sessions
SELECT 
    s.sid, 
    s.username, 
    s.program,
    n.network_service_banner
FROM v$session s
JOIN v$session_connect_info n ON s.sid = n.sid
WHERE n.network_service_banner LIKE '%Encryption%' 
   OR n.network_service_banner LIKE '%Crypto%'
ORDER BY s.sid;

Expected Result:

AES256 Encryption service adapter for Linux: Version 19.0.0.0.0
SHA256 Crypto-checksumming service adapter for Linux: Version 19.0.0.0.0

📚 Official Documentation & Technical References

• Oracle Net Services Administrator’s Guide 19c - Configuring Native Network Encryption — Official documentation on SQLNET encryption parameters (SQLNET.ENCRYPTION_TYPES_SERVER, SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER).
• Oracle Database Security Guide 23ai - Cryptographic Support — Details on legacy cipher deprecation (3DES, RC4, MD5) and modern TLS/AES standards in 23ai.
• Mike Dietrich Blog: Native Network Encryption vs TLS/TCPS in Oracle Database — Insights on upgrading database network encryption and securing connection adapters.
• ORACLE-BASE: Native Network Encryption in Oracle Databases — Tim Hall’s guide to configuring and verifying native network encryption.

---

Need an expert security audit of your Oracle network encryption or assistance enforcing FIPS 140-3 compliance across your database infrastructure? Contact our Security Specialists or explore our Enterprise Health Audits.