- Set the Master Encryption Key by issuing the following command
ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY passwordNo database columns can be encrypted wihtout setting the master encryption key first. This command automatically creates an oracle wallet and sets the password for the wallet. The wallet is also opened as a result of this command. Note that there must be a directory $ORACLEBASE/admin/$ORACLESID otherwise you will ge an error
- Open the wallet: The wallet must be opened explicitly after the database instance starts. When you create the wallet you also open the wallet for operation. After you create the wallet and set the password, every time you open the database, you'll have to open the wallet using the same password as follows:
alter system set encryption wallet open authenticated by password;You can close the wallet like this:
alter system set encryption wallet close;The wallet must be open for Transparent Data Encryption to work. If the wallet is closed, you can access all nonencrypted columns, but not encrypted columns (you will get a "wallet not open" error).
- Create a table using CREATE TABLE as shown below
CREATE TABLE "SCOTT"."ACCOUNT"
( "ACCOUNTID" VARCHAR2(40 BYTE),
"NAME" VARCHAR2(40 BYTE),
"SSN" VARCHAR2(40 BYTE)
- Encrypt the columns: A column can be encrypted by altering the table with the following commandThe default algorithm for encryption is AES with 192-bit key. This can be changed to any other with the "using" clause added after encrypt, as shown below
alter table accounts modify (ssn encrypt using 'AES128');Some other encryption algorithms that can be used are AES128, AES192, AES256, or 3DES168.
ORA-28368: cannot auto-create wallet error
- Index types other than B-tree
- Range scan search through an index
- Large object datatypes such as BLOB and CLOB
- Original import/export utilities
- Other database tools and utilities that directly access data files