shadow1ng/fscan · error

unsupported oracle advanced service algorithm %d

Error message

unsupported oracle advanced service algorithm %d

What it means

During ANO service types 2/3 (data integrity / encryption) negotiation, the server advertises an algorithm ID for the crypto service. The library only supports algorithm ID 0 (i.e. no algorithm / pass-through), so any negotiated encryption or checksumming algorithm is rejected with the numeric ID.

Source

Thrown at plugins/services/oracle_raw.go:878

			if err != nil {
				return err
			}
			if name != "" && name != "TCPS" {
				return fmt.Errorf("unsupported oracle authentication service %s", name)
			}
		} else if status != 0xfbff {
			return errors.New("oracle advanced authentication negotiation failed")
		}
	case 2, 3:
		if _, err := s.readANOVersion(); err != nil {
			return err
		}
		algo, err := s.readANOUB1()
		if err != nil {
			return err
		}
		if algo != 0 {
			return fmt.Errorf("unsupported oracle advanced service algorithm %d", algo)
		}
		for i := 2; i < subPackets; i++ {
			if err := s.skipANOPacket(); err != nil {
				return err
			}
		}
	case 4:
		if _, err := s.readANOVersion(); err != nil {
			return err
		}
		if _, err := s.readANOStatus(); err != nil {
			return err
		}
		_, err := s.readANOBytes()
		return err
	default:
		for i := 0; i < subPackets; i++ {
			if err := s.skipANOPacket(); err != nil {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Change server sqlnet.ora: set SQLNET.ENCRYPTION_SERVER and SQLNET.CRC_SERVER to REJECTED or ACCEPTED (not REQUIRED) so the no-algorithm option is acceptable.
2. Use TCPS (TLS) connections instead of native network encryption, which this library supports.
3. If native TNS encryption is mandatory, switch to Oracle's official driver (godror/ODPI-C) which implements ANO crypto algorithms.

Example fix

# before (sqlnet.ora)
SQLNET.ENCRYPTION_SERVER=(REQUIRED)
# after
SQLNET.ENCRYPTION_SERVER=(REQUESTED)

// Verify server ANO crypto policy before connecting:
// sqlnet.ora must not set SQLNET.ENCRYPTION_SERVER=(REQUIRED)
// or SQLNET.CRC_SERVER=(REQUIRED); use REQUESTED/ACCEPTED.

When it happens

Trigger: advancedNegotiation -> readANOServiceData(serviceType=2 or 3) reads a UB1 algorithm byte that is non-zero, because the server requires Oracle Native Encryption or MD5/SHA checksumming for this connection.

Common situations: Server has SQLNET.ENCRYPTION_SERVER=REQUIRED or SQLNET.CRC_SERVER=REQUIRED with AES/3DES/RC4 configured; connecting from an environment where DBAs mandate network encryption at the TNS layer instead of TLS.

Related errors

• oracle advanced authentication negotiation failed
• unsupported oracle authentication service %s
• oracle redirect is not supported by lightweight auth
• oracle advanced negotiation header mismatch
• short oracle charset negotiation

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/e8bcea2ea1d9f1de. Report an issue: GitHub.