Skip to main content

How to Encrypt Columns in Tables


<<Back to Oracle DB Security Main Page
To use TDE to encrypt the data in the database you must have keystore configured and wallet is open.
Check out the post Step by Step How to Configure Software Keystore/ Oracle Wallet  to configure the keystore

Encrypting Columns in Tables

Important Notes:
Do not use TDE column encryption with the following database features:
  •  Index types other than B-tree
  •  Range scan search through an index
  •  Synchronous change data capture
  •  Transportable tablespaces
  •  Columns that have been created as identity columns
  •  Columns used in foreign key constraints.
NOTE: Transparent Data Encryption protects data stored on a disk or other media. It does not protect data in transit.

Creating a Table with an Encrypted Column Using the Default Algorithm:AES192

Login as schema owner and created the table as shown
EXAMPLE1
SQL> show user;
USER is "TEST"
SQL> CREATE TABLE ENC_TEST1 (
first_name VARCHAR2(128),
last_name VARCHAR2(128),
empID NUMBER,
salary NUMBER(6) ENCRYPT);

Table created.
Note: When you encrypt a table column Salt and MAC are added by default.

Creating a Table with an Encrypted Column Using No Algorithm or a Non-Default Algorithm

EXAMPLE2
SQL> CREATE TABLE ENC_TEST2 (
first_name VARCHAR2(128),
last_name VARCHAR2(128),
empID NUMBER ENCRYPT NO SALT,
salary NUMBER(6) ENCRYPT USING '3DES168');

Table created.
  • The ENCRYPT NO SALT clause allows you to encrypt a cloumn without specifying any algorithm. 
  • You must use the NO SALT clause  to encrypt a column which you are planning to index
NOTE: All encrypted columns in a table use the same encryption algorithm, therefore in the example2 both empID and salary will columns will use the 3DES168 encryption algorithm but empID column is encrypted without salt.

Encrypting Table Column Using NOMAC Parameter

TDE adds a Message Authentication Code (MAC) to the data for integrity checking. The SHA-1 integrity algorithm is used by default. If you want to bypass the MAC to save space and improve performance you can do so as shown below.
EXAMPLE3
SQL> CREATE TABLE ENC_TEST3 (
first_name VARCHAR2(128),
last_name VARCHAR2(128),
empID NUMBER ENCRYPT 'NOMAC' ,
salary NUMBER(6));

Table created

Changing the Integrity Algorithm for a Table

EXAMPLE4
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST3';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST3            EMPID           YES NOMAC        AES 192 bits key
SQL> ALTER TABLE ENC_TEST3 REKEY USING '3DES168' 'SHA-1';

Table altered.
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST3';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST3            EMPID           YES SHA-1        3 Key Triple DES 168 bits key

SQL> ALTER TABLE ENC_TEST3 REKEY USING '3DES168' 'NOMAC';
Table altered.
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST3';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST3            EMPID           YES NOMAC        3 Key Triple DES 168 bits key

Encrypting Table Column with a Password-Generated TDE Table Key

When you encrypt the column TDE generates random keys to encrypt them. If you are using a randomly generated key to encrypt the columns you can not
  • Move an external table to a new location
  • Table partition exchange
For such scenarios, you should specify a password while you encrypt the columns so that you can use the same password to regenerate the key at the new location
EXAMPLE5
SQL> CREATE TABLE ENC_TEST4 (
first_name VARCHAR2(128),
last_name VARCHAR2(128),
empID NUMBER ,
salary NUMBER(6) ENCRYPT IDENTIFIED BY password);

Table created.

How to Encrypt Column in Existing Table

EXAMPLE6
SQL> ALTER TABLE ENC_TEST4 MODIFY (first_name ENCRYPT);
Table altered.
SQL> ALTER TABLE ENC_TEST4 MODIFY (first_name ENCRYPT NO SALT);
Table altered.

How to Add Encrypted Column to an Existing Table

EXAMPLE7
SQL> ALTER TABLE ENC_TEST3 ADD (ssn VARCHAR2(11) ENCRYPT);
Table altered.

Disabling Encryption for a Table Column

EXAMPLE8
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST4';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST4            FIRST_NAME      NO  SHA-1        AES 192 bits key
TEST       ENC_TEST4            SALARY          YES SHA-1        AES 192 bits key

2 rows selected.
SQL> ALTER TABLE ENC_TEST4 MODIFY (first_name DECRYPT);
Table altered.
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST4';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST4            SALARY          YES SHA-1        AES 192 bits key

Adding Salt to an Encrypted Column

Salt is a random string added to data before encryption, is a way to strengthen the security of encrypted data. Adding salt requires an additional 16 bytes of storage per encrypted data value.
EXAMPLE9
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST2';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST2            EMPID           NO  SHA-1        3 Key Triple DES 168 bits key
TEST       ENC_TEST2            SALARY          YES SHA-1        3 Key Triple DES 168 bits key

SQL> ALTER TABLE ENC_TEST2 MODIFY (EMPID ENCRYPT SALT);
Table altered.
SQL>  select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST2';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST2            EMPID           YES SHA-1        3 Key Triple DES 168 bits key
TEST       ENC_TEST2            SALARY          YES SHA-1        3 Key Triple DES 168 bits key

Removing Salt from an Encrypted Column

EXAMPLE10
SQL> ALTER TABLE ENC_TEST2 MODIFY (EMPID ENCRYPT NO SALT);
Table altered.

Creating Index on an Encrypted Column

NOTE:You can create an index on an encrypted column only if it is not salted.
EXAMPLE11
SQL> CREATE INDEX employee_idx on ENC_TEST2 (empID);

Index created.
Changing the Encryption Key or Algorithm for Tables with Encrypted Columns

EXAMPLE12
SQL> ALTER TABLE ENC_TEST2 REKEY;
Table altered.
SQL> select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST2';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST2            EMPID           NO  SHA-1        3 Key Triple DES 168 bits key
TEST       ENC_TEST2            SALARY          YES SHA-1        3 Key Triple DES 168 bits key
SQL> ALTER TABLE ENC_TEST2 REKEY USING 'AES192';
Table altered.
SQL>  select OWNER,TABLE_NAME,COLUMN_NAME,SALT,INTEGRITY_ALG,ENCRYPTION_ALG from dba_encrypted_columns where OWNER='TEST' and TABLE_NAME='ENC_TEST2';
OWNER      TABLE_NAME           COLUMN_NAME     SAL INTEGRITY_AL ENCRYPTION_ALG
---------- -------------------- --------------- --- ------------ -----------------------------
TEST       ENC_TEST2            EMPID           NO  SHA-1        AES 192 bits key
TEST       ENC_TEST2            SALARY          YES SHA-1        AES 192 bits key

Comments

  1. How does that data looks like for these column? thank you.

    ReplyDelete
  2. How To Encrypt Columns In Tables >>>>> Download Now

    >>>>> Download Full

    How To Encrypt Columns In Tables >>>>> Download LINK

    >>>>> Download Now

    How To Encrypt Columns In Tables >>>>> Download Full

    >>>>> Download LINK JJ

    ReplyDelete

Post a Comment

Popular posts from this blog

How to Power On/off Oracle Exadata Machine

<<Back to Exadata Main Page How to Power On/off Oracle Exadata Machine Oracle Exadata machines can be powered on/off either by pressing the power button on front of the server or by logging in to the ILOM interface. Powering on servers using  button on front of the server The power on sequence is as follows. 1. Start Rack, including switches  Note:- Ensure the switches have had power applied for a few minutes to complete power on  configuration before starting Exadata Storage Servers 2.Start Exadata Storage Servers  Note:- Ensure all Exadata Storage Servers complete the boot process before starting the   database servers 3. Start Database Servers Powering On Servers Remotely using ILOM The ILOM can be accessed using the Web console, the command-line interface (CLI), IPMI, or SNMP. For example, to apply power to server dm01cel01 using IPMI, where dm01cel01-ilom is the host name of the ILOM for the server to be powered on, run the

How to Find VIP of an Oracle RAC Cluster

<<Back to Oracle RAC Main Page How to Find Out VIP of an Oracle RAC Cluster Login clusterware owner (oracle) and execute the below command to find out the VIP hostname used in Oracle RAC $ olsnodes -i node1     node1-vip node2     node2-vip OR $ srvctl config nodeapps -viponly Network 1 exists Subnet IPv4: 10.0.0.0/255.255.0.0/bondeth0, static Subnet IPv6: Ping Targets: Network is enabled Network is individually enabled on nodes: Network is individually disabled on nodes: VIP exists: network number 1, hosting node node1 VIP Name: node1-vip VIP IPv4 Address: 10.0.0.1 VIP IPv6 Address: VIP is enabled. VIP is individually enabled on nodes: VIP is individually disabled on nodes: VIP exists: network number 1, hosting node node2 VIP Name: node2-vip VIP IPv4 Address: 10.0.0.2 VIP IPv6 Address: VIP is enabled. VIP is individually enabled on nodes: VIP is individually disabled on nodes:

ORA-28374: typed master key not found in wallet

<<Back to Oracle DB Security Main Page ORA-46665: master keys not activated for all PDBs during REKEY SQL> ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL ; ADMINISTER KEY MANAGEMENT SET KEY FORCE KEYSTORE IDENTIFIED BY xxxx WITH BACKUP CONTAINER = ALL * ERROR at line 1: ORA-46665: master keys not activated for all PDBs during REKEY I found following in the trace file REKEY: Create Key in PDB 3 resulted in error 46658 *** 2019-02-06T15:27:04.667485+01:00 (CDB$ROOT(1)) REKEY: Activation of Key AdnU5OzNP08Qv1mIyXhP/64AAAAAAAAAAAAAAAAAAAAAAAAAAAAA in PDB 3 resulted in error 28374 REKEY: Keystore needs to be restored from the REKEY backup.Aborting REKEY! Cause: All this hassle started because I accidently deleted the wallet and all wallet backup files too and also forgot the keystore password. There was no way to restore the wallet back. Fortunately in my case the PDB which had encrypted data was supposed to be deco

ORA-16905: The member was not enabled yet

<<Back to Oracle DataGuard Main Page ORA-16905 Physical Standby Database is disabled DGMGRL> show configuration; Configuration - DG_ORCL1P   Protection Mode: MaxPerformance   Members:   ORCL1PP - Primary database     ORCL1PS - Physical standby database (disabled)       ORA-16905: The member was not enabled yet. Fast-Start Failover:  Disabled Configuration Status: SUCCESS   (status updated 58 seconds ago) DGMGRL> DGMGRL> enable database 'ORCL1PS'; Enabled. DGMGRL>  show configuration; Configuration - DG_ORCL1P   Protection Mode: MaxPerformance   Members:   ORCL1PP - Primary database     ORCL1PS - Physical standby database Fast-Start Failover:  Disabled Configuration Status: SUCCESS   (status updated 38 seconds ago)

How to Switch Log File from All Instances in RAC

<<Back to Oracle RAC Main Page Switch The Log File of All Instances in Oracle RAC. In many cases you need to switch the logfile of the database. You can switch logfile using alter system switch logfile command but if you want to switch the logfile from all the instances you need to execute the command on all the instances individually and therefore you must login on all the instances. You can avoid this and switch logfile of all instances by just running the below command from any of the instance in RAC database SQL> ALTER SYSTEM SWITCH ALL LOGFILE;   System altered.

ORA-65104: operation not allowed on an inactive pluggable database alter pluggable database open

<<Back to DB Administration Main Page ORA-65104: operation not allowed on an inactive pluggable database SQL> alter pluggable database TEST_CLON open; alter pluggable database TEST_CLON open * ERROR at line 1: ORA-65104: operation not allowed on an inactive pluggable database Cause The pluggable database status was UNUSABLE. It was still being created or there was an error during the create operation. A PDB can only be opened if it is successfully created and its status is marked as NEW in cdb_pdbs.status column SQL> select PDB_NAME,STATUS from cdb_pdbs; PDB_NAME             STATUS -------------------- --------------------------- PDB$SEED             NORMAL TEST_CLON            UNUSABLE Solution:  Drop the PDB and create it again. Related Posts How to Clone Oracle PDB (Pluggable Database) with in the Same Container

ORA-46630: keystore cannot be created at the specified location

<<Back to DB Administration Main Page ORA-46630: keystore cannot be created at the specified location CDB011> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '+DATAC4/CDB01/wallet/' IDENTIFIED BY "xxxxxxx"; ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '+DATAC4/CDB01/wallet/' IDENTIFIED BY "EncTest123" * ERROR at line 1: ORA-46630: keystore cannot be created at the specified location Cause  Creating a keystore at a location where there is already a keystore exists Solution To solve the problem, use a different location to create a keystore (use ENCRYPTION_WALLET_LOCATION in sqlnet.ora file to specify the keystore location), or move this ewallet.p12 file to some other location. Note: Oracle does not recommend deleting keystore file (ewallet.p12) that belongs to a database. If you have multiple keystores, you can choose to merge them rather than deleting either of them.

Starting RMAN and connecting to Database

  <<Back to Oracle Backup & Recovery Main Page Starting RMAN and connecting to Database Starting RMAN and connecting to Database To start RMAN you need to set the environment and type rman and press enter. You can connect to database either using connect command or using command line option. using command line option localhost:$ export ORACLE_HOME=/ora_app/product/18c/dbd2 localhost:$ export PATH=$ORACLE_HOME/bin:$PATH localhost:$ export ORACLE_SID=ORCL1P localhost:$ rman target / Recovery Manager: Release 18.0.0.0.0 - Production on Sun Apr 4 08:11:01 2021 Version 18.11.0.0.0 Copyright (c) 1982, 2018, Oracle and/or its affiliates.  All rights reserved. connected to target database: ORCL1P (DBID=4215484517) RMAN> using connect option localhost:$ rman RMAN> connect target sys@ORCL1P  target database Password:******** connected to target database: ORCL1P (DBID=4215484517) NOTE: To use connect command you need to ensure that  you have proper TNS sentry for database (ORCL

How to Attach to a Datapump Job and Check Status of Export or Import

<<Back to Oracle DATAPUMP Main Page How to check the progress of  export or import Jobs You can attach to the export/import  job using ATTACH parameter of oracle datapump utility. Once you are attached to the job you check its status by typing STATUS command. Let us see how Step1>  Find the Export/Import Job Name You can find the datapump job information from  DBA_DATAPUMP_JOBS or  USER_DATAPUMP_JOBS view. SQL> SELECT OWNER_NAME,JOB_NAME,OPERATION,JOB_MODE,STATE from DBA_DATAPUMP_JOBS; OWNER_NAME JOB_NAME                       OPERATION            JOB_MODE   STATE ---------- ------------------------------ -------------------- ---------- ---------- SYSTEM     SYS_EXPORT_FULL_02             EXPORT               FULL       EXECUTING OR You can also find the job name for export/import in logfile in beginning itself. Step2>Attach to the Job and check status One you get the Export/Import Job Name attach the job and check its status. You can attach or det

ORA-15040: diskgroup is incomplete

<<Back to Oracle ASM Main Page ORA-15040: diskgroup is incomplete SQL> startup ORA-00099: warning: no parameter file specified for ASM instance ASM instance started Total System Global Area 1140850688 bytes Fixed Size                  8629704 bytes Variable Size            1107055160 bytes ASM Cache                  25165824 bytes ORA-15110: no diskgroups mounted Reason: The reason of this error is simply the ASM is not able to find the some or all the disks. Solution: Investigate and make all the disks available to ASM to mount the disk group. Make sure the disks has proper permissions. If you are using AFD check following services are online oracleacfs oracleadvm oracleoks  oracleafd   Source of Problem : Issue started after restart of the server After restarting the server when I tried to start the ASM instance its started throwing error.  ORA-15110: no diskgroups mounted Investigation in my Case Step1> ASM Logfile Scanning  Looked i