{"record":{"id":"c5cb0744f02c542e","repo":"shadow1ng/fscan","slug":"oracle-session-key-should-be-either-64-or-96-bytes","errorCode":null,"errorMessage":"oracle session key should be either 64 or 96 bytes long","messagePattern":"oracle session key should be either 64 or 96 bytes long","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1339,"sourceCode":"\t\t\t}\n\t\tdefault:\n\t\t\terr := s.readMsg(msg)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif msg == 4 {\n\t\t\t\tif s.hasError() {\n\t\t\t\t\treturn nil, s.oracleError()\n\t\t\t\t}\n\t\t\t\treturn auth.finish(username, password, nego)\n\t\t\t}\n\t\t}\n\t}\n}\n\nfunc (auth *oracleAuthObject) finish(username, password string, nego *oracleTCPNego) (*oracleAuthObject, error) {\n\tif len(auth.eServerSessKey) != 64 && len(auth.eServerSessKey) != 96 {\n\t\treturn nil, errors.New(\"oracle session key should be either 64 or 96 bytes long\")\n\t}\n\tvar key []byte\n\tvar speedyKey []byte\n\tpadding := false\n\tvar err error\n\tswitch auth.verifierType {\n\tcase 2361:\n\t\tkey, err = oracleKeyFromUserPass(username, password)\n\tcase 6949:\n\t\tif len(nego.serverCompileTimeCaps) > 4 && nego.serverCompileTimeCaps[4]&2 == 0 {\n\t\t\tpadding = true\n\t\t}\n\t\tsalt, err := hex.DecodeString(auth.salt)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\th := sha1.New()\n\t\t_, _ = h.Write(append([]byte(password), salt...))","sourceCodeStart":1321,"sourceCodeEnd":1357,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1321-L1357","documentation":"finish() derives client-side session keys from the server's encrypted session key (eServerSessKey). The Oracle auth protocol defines this as either 64 bytes (AES-192) or 96 bytes (AES-256); any other length means key derivation cannot proceed, so the library rejects the authentication data before attempting decryption.","triggerScenarios":"auth.finish(username, password, nego) is called after parsing the auth response and len(auth.eServerSessKey) is neither 64 nor 96 — typically when verifierType indicates PBKDF2/AES but the server sent a legacy or malformed session key.","commonSituations":"Server configured for a crypto strength the plugin's length check doesn't cover; mixed-version behavior where an older verifier type is answered with a different key size; a truncated auth response from the network.","solutions":["Check Oracle server crypto/NNE configuration and version against plugin-supported combinations (64 vs 96 byte keys)","Retry and inspect whether the auth response was truncated by the network/proxy — a full 64/96-byte key may simply be missing tail bytes","Align AUTH_PBKDF2_* parameters and verifier type between client and server (e.g. avoid forcing key size via sqlnet crypto settings)","Log the actual session-key length and file an upstream issue if your server version legitimately uses a different size"],"exampleFix":"// before\nif len(auth.eServerSessKey) != 64 && len(auth.eServerSessKey) != 96 {\n\treturn nil, errors.New(\"oracle session key should be either 64 or 96 bytes long\")\n}\n// after\nif len(auth.eServerSessKey) != 64 && len(auth.eServerSessKey) != 96 {\n\treturn nil, fmt.Errorf(\"oracle session key should be either 64 or 96 bytes long: got %d\", len(auth.eServerSessKey))\n}","handlingStrategy":"validation","validationCode":"// validate session-key length before deriving keys\nif len(auth.eServerSessKey) != 64 && len(auth.eServerSessKey) != 96 {\n\treturn fmt.Errorf(\"bad server session key length: %d\", len(auth.eServerSessKey))\n}","typeGuard":"func validServerSessKey(k []byte) bool { return len(k) == 64 || len(k) == 96 }","tryCatchPattern":"auth, err := authObj.finish(user, pass, nego)\nif err != nil && strings.Contains(err.Error(), \"session key should be either 64 or 96 bytes\") {\n\treturn fmt.Errorf(\"server sent %d-byte session key; check server crypto config and version support: %w\", len(auth.eServerSessKey), err)\n}","preventionTips":["Align server NNE/PBKDF2 crypto settings with the plugin's supported key sizes","Rule out truncated auth responses (retry / direct connection test)","Log the actual key length when diagnosing version mismatches"],"tags":["oracle","authentication","session-key","crypto"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}