The ENCRYPT_NEW_TABLESPACES dynamic database initialization parameter controls if future tablespaces are encrypted.

By default, all Oracle Cloud databases are encrypted. If you install an off-the-shelf application into such a database, its installation scripts most likely do not have the encryption syntax. In this case, because ENCRYPT_NEW_TABLESPACES is set to CLOUD_ONLY, those tablespaces would be created encrypted regardless.

In an Oracle Cloud environment, the following scenarios may occur when you create encrypted tablespaces in Oracle Cloud and on-premises environments:

• You create a test database in Oracle Cloud and the tablespaces were encrypted by using when the ENCRYPT_NEW_TABLESPACE parameter has been set to automatically create the Cloud database as encrypted. However, you may not have the intention or even an Advanced Security Option license to bring the encrypted database back on premises. For this use case, Oracle Recovery Manager (Oracle RMAN) provides the option to duplicate or restore AS DECRYPTED.

• In this case, you either need an Advanced Security license (which includes Transparent Data Encryption and Data Redaction) for the on-premises standby database, or you cannot use the standby database. If a new tablespace is transparently encrypted, then a similar scenario to the first item in this list may occur. For example, suppose you do not have an Advanced Security Option (ASO) license, and you have an automatically encrypted tablespace in the Oracle Cloud. The standby database on premises is also automatically encrypted. In this case, you either need an Advanced Security license (which includes Transparent Data Encryption and Data Redaction) for the on-premises standby database, or you cannot use the standby database.

You can set the ENCRYPT_NEW_TABLESPACES database initialization parameter to automatically encrypt future tablespaces that you create.

• In SQL*Plus, enter the following ALTER SYSTEM statement:

  ALTER SYSTEM SET ENCRYPT_NEW_TABLESPACES = value;

  In this specification, value can be:

  • CLOUD_ONLY transparently encrypts the tablespace in the Cloud using the tablespace encryption default algorithm if you do not specify the ENCRYPTION clause of the CREATE TABLESPACE SQL statement. It applies only to an Oracle Cloud environment. If you create the tablespace on premises, then it will follow the CREATE TABLESPACE statement specification that you enter. For example, if you omit the ENCRYPTION clause, then the tablespace is created unencrypted. If you include this clause and use a different algorithm, then the tablespace will use that algorithm. CLOUD_ONLY is the default.

  • ALWAYS automatically encrypts the tablespace using the tablespace encryption default algorithm if you omit the ENCRYPTION clause of CREATE TABLESPACE, for both the Cloud and premises scenarios.

    If you do provide the ENCRYPTION clause, however, the algorithm that you specify takes precedence over the tablespace encryption default algorithm.

  • DDL encrypts the tablespace using the specified setting of the ENCRYPTION clause of CREATE TABLESPACE, for both Oracle Cloud and on-premises environments.

You can encrypt or decrypt an existing data file of a user tablespace when the tablespace is offline or when the database is not open.

Use the offline encryption method if you do not plan to change the compatibility of your databases from Oracle Database 11g release 2 (11.2) or Oracle Database 12c release 1 (12.1) to release 12.2, which is irreversible. The offline encryption method is also useful if you want to quickly make use of Transparent Data Encryption before you upgrade this database to release 12.2. You can both encrypt and decrypt offline tablespaces.

Note the following:

• If you want to encrypt the Oracle Database-supplied tablespaces (SYSTEM, SYSAUX, and UNDO) using the offline conversion method, then you must use the method that is described in Encrypting an Existing Database with Offline Conversion.

• You can use the online method to rekey, change the encryption algorithm, or decrypt a tablespace that was previously encrypted with the offline method.

• If you have configured Oracle Data Guard, then you can minimize downtime by encrypting the tablespaces on the standby first, switching over to the primary, and then performing an offline encryption the tablespaces on the new standby database. Offline encryption (both on the data file and tablespace level) are is performed on the standby first. Online encryption is an Oracle Data Guard transaction, and as such, it is replayed on the standby database.

• You cannot specify the encryption algorithm in an offline conversion. In an offline conversion, all data files and tablespaces are encrypted using the AES128 encryption key. You can check the encryption key by querying the ENCRYPTIONALG column in the V$DATABASE_KEY_INFO view.

• You can convert offline tablespaces in parallel by using multiple foreground sessions to encrypt different data files.

• If you are using Oracle Data Guard, you can minimize the downtime by encrypting the tablespaces on the standby first, switching over, and then encrypting the tablespaces on the original primary next.

• For Oracle Database 11g release 2 (11.2.0.4) and Oracle Database 12c release 1 (12.1.0.2), you cannot perform an offline encryption of the SYSTEM and SYSAUX tablespaces. Also, Oracle does not recommend encrypting offline the UNDO tablespace in these releases. Doing so prevents the keystore from being closed, and this prevents the database from functioning. In addition, encrypting the UNDO tablespace while the database is offline is not necessary because all undo records that are associated with any encrypted tablespaces are already automatically encrypted in the UNDO tablespace. If you want to encrypt the TEMP tablespace, you must drop and then recreate it as encrypted.

To encrypt an existing tablespace with offline conversion, you can use the ALTER TABLESPACE SQL statement with the OFFLINE and ENCRYPT clauses.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege if you plan to encrypt the SYSTEM and SYSAUX tablespaces. Otherwise, connect with the SYSKM administrative privilege.

2. Bring the tablespace offline.

   ALTER TABLESPACE users OFFLINE NORMAL;

3. Back up the tablespace.

   The offline conversion method does not use auxiliary disk space or files, and it operates directly in-place to the data files. Therefore, you should perform a full backup of the user tablespace before converting it offline.

4. As a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege, open the software keystore.
   For example:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY software_keystore_password; 

5. Encrypt the tablespace.
   For example, to encrypt an entire tablespace, include its data files:

   ALTER TABLESPACE users ENCRYPTION OFFLINE ENCRYPT; 

   To encrypt individual data files within a tablespace, use the ALTER DATABASE DATAFILE SQL statement. For example, to encrypt the data files user_01.dbf and user_02.dbf:

   ALTER DATABASE DATAFILE 'user_01.dbf' ENCRYPT;
   ALTER DATABASE DATAFILE 'user_02.dbf' ENCRYPT;

   In the same database session, these statements encrypt each of the data files in sequence, one after another. If you execute each statement in its own database session, then they will be executed in parallel.

   If the encryption process is interrupted, then rerun the ALTER TABLESPACE statement. The kinds of errors that you can expect in an interruption are general errors, such as file system or storage file system errors. The data files within the tablespace should be consistently encrypted. For example, suppose you offline a tablespace that has 10 files but for some reason, the encryption only completes for nine of the files, leaving one decrypted. Although it is possible to bring the tablespace back online with such inconsistent encryption if the COMPATIBLE parameter is set to 12.2.0.0 or higher, then it is not recommended to leave the tablespace in this state. If COMPATIBLE is less than 12.2.0.0, then it is not possible to bring the tablespace online if the encryption property is inconsistent across the data files.
6. Bring the tablespace back online or open the database.
   • To bring the tablespace back online:

     ALTER TABLESPACE users ONLINE;

   • To open a database in a non-multitenant environment:

     ALTER DATABASE OPEN

   • In a multitenant environment, you can encrypt a data file or tablespace with the offline method if the root is open and the PDB is not open. For example, for a PDB named hr_pdb:

     ALTER PLUGGABLE DATABASE hr_pdb OPEN

7. Perform a full backup of the converted tablespace.

To decrypt an existing tablespace with offline conversion, you can use the ALTER TABLESPACE SQL statement with the OFFLINE and DECRYPT clauses.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege if you plan to decrypt the SYSTEM and SYSAUX tablespaces. Otherwise, connect with the SYSKM administrative privilege.

2. Bring the tablespace offline.

   ALTER TABLESPACE users OFFLINE NORMAL;

3. As a user who has been granted the ADMINISTER KEY MANAGEMENT or SYSKM privilege, open the keystore.
   For example:

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY software_keystore_password; 

4. Run the ALTER TABLESPACE SQL statement to perform the decryption.
   For example, for a tablespace called users:

   ALTER TABLESPACE users ENCRYPTION OFFLINE DECRYPT; 

   If the decryption process is interrupted, then rerun the ALTER TABLESPACE statement. The kinds of errors that you can expect in an interruption are general errors, such as file system or storage file system errors. The data files within the tablespace should be consistently decrypted. For example, suppose you offline a tablespace that has 10 files but for some reason, the decryption only completes for nine of the files, leaving one encrypted. Although it is possible to bring the tablespace back online with such inconsistent decryption if the COMPATIBLE parameter is set to 12.2.0.0 or higher, then it is not recommended to leave the tablespace in this state. If COMPATIBLE is less than 12.2.0.0, then it is not possible to bring the tablespace online if the encryption property is inconsistent across the data files.

5. Bring the tablespace online.

   ALTER TABLESPACE users ONLINE;

You can encrypt, decrypt, or rekey existing user tablespaces, and the SYSTEM, SYSAUX, and UNDO tablespace when they are online.

However, you cannot encrypt, decrypt, or rekey a temporary tablespace online.

An online tablespace can be created by using the ONLINE clause of the CREATE TABLESPACE SQL statement. When you encrypt or rekey a tablespace online, the tablespace will have its own independent encryption keys and algorithms.

Note the following:

• If an offline tablespace has been encrypted, then you can rekey it online to use a different algorithm.

• You can encrypt multiple tablespaces online in parallel by using multiple foreground sessions to encrypt different tablespaces. Within each tablespace, the data files are encrypted sequentially.

• If the conversion is interrupted, then you can resume the process by issuing the FINISH clause of the ALTER TABLESPACE SQL statement.

• A redo log is generated for each online tablespace conversion.

• Do not encrypt the SYSTEM and UNDO tablespaces concurrently with other tablespaces.

• You cannot use the transportable tablespace feature with Oracle Data Pump while you are encrypting a tablespace.

• You cannot run the ALTER TABLESPACE statement concurrently with the following features:

  • ADMINISTER KEY MANAGEMENT SET KEY SQL statement

  • FLASHBACK DATABASE SQL statement

• If you are using Oracle-managed files for the data files, then the encryption process rekeys the data files that are associated with the tablespace and then copies or moves them to the default Oracle-managed files location.

• You can add new files to the tablespace after you have encrypted it. Oracle Database reformats the new file with the new encryption key. Blocks will be encrypted using the new key.

• Previous operations that took place in the root or the PDB may require the control files to be cross-checked against the data dictionary before you can begin the online conversion process. An ORA-241 operation disallowed: control file is not yet checked against data dictionary error may occur. To resolve this problem, restart the root or PDB, and then try issuing the online conversion commands again.

• For security reasons, once online conversion processes a data file, Oracle will zero out the original data file before deletion. This prevents the database from leaving ghost data on disk sectors. However, there is a known limitation that can occur if you are performing an online tablespace conversion at the same time that Oracle Recovery Manager (Oracle RMAN) is validating files. The online tablespace conversion processes each file one at a time. If Oracle RMAN is validating a file at the same time that it is being processed by the online tablespace conversion, then Oracle RMAN could report a corruption problem (ORA-01578: ORACLE data block corrupted (file # , block # )). It does this because it sees the blocks that comprise the file as zero. This is a false alarm and you can ignore the error. If this occurs, then try running the Oracle RMAN validation process again.

To encrypt an existing tablespace with online conversion, use ALTER TABLESPACE with the ONLINE and ENCRYPT clauses.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege if you plan to encrypt the SYSTEM and SYSAUX tablespaces. Otherwise, connect with the SYSKM administrative privilege.

2. Ensure that the COMPATIBLE initialization parameter is set to 12.2.0.0.

   You can use the SHOW PARAMETER command to check the current setting of a parameter.

3. Ensure that the database is open in read-write mode.

   You can query the STATUS column of the V$INSTANCE dynamic view to find if a database is open and the OPEN_MODE column of the V$DATABASE view to find if it in read-write mode.

4. If necessary, open the database in read-write mode.

   ALTER DATABASE OPEN READ WRITE;

5. Ensure that the auxiliary space is at least the same size as the largest data file of this tablespace.

   This size requirement is because Oracle Database performs the conversion one file at a time. For example, if the largest data file of the tablespace is 32 GB, then ensure that you have 32 GB of auxiliary space. To find the space used by a data file, query the BYTES or BLOCKS column of the V$DATAFILE dynamic performance view.

6. Create and open a master encryption key.

   For example:

   ADMINISTER KEY MANAGEMENT CREATE KEYSTORE 'keystore_location' IDENTIFIED BY software_keystore_password;
   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY software_keystore_password;
   ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY software_keystore_password WITH BACKUP;

7. Run the ALTER TABLESPACE statement using the ENCRYPTION and ENCRYPT clauses to perform the encryption.

   For example, for a non-Oracle managed files tablespace named users:

   ALTER TABLESPACE users ENCRYPTION ONLINE USING 'AES192' ENCRYPT FILE_NAME_CONVERT = ('users.dbf', 'users_enc.dbf');

   In this example:

   • ENCRYPTION ONLINE USING ‘AES192’ ENCRYPT sets the statement to encrypt the tablespace users while it is online and assigns it the AES192 encryption algorithm. If you omit the USING algorithm clause, then the default algorithm, AES128, is used. For the SYSTEM and UNDO tablespaces, you can use the ENCRYPT clause to encrypt the tablespace, but you cannot specify an encryption algorithm because they must be encrypted with the existing database key the first time. After encrypting the tablespace, use the REKEY clause to specify the algorithm.

   • FILE_NAME_CONVERT specifies one or more pairs of data files that are associated with the tablespace. The first name in the pair is an existing data file, and the second name is for the encrypted version of this data file, which will be created after the ALTER TABLESPACE statement successfully executes. If the tablespace has more than one data file, then you must process them all in this statement. Note the following:

     • Separate each file name with a comma, including multiple pairs of files. For example:

       FILE_NAME_CONVERT = ('users1.dbf', 'users1_enc.dbf', 'users2.dbf', 'users2_enc.dbf')

     • You can specify directory paths in the FILE_NAME_CONVERT clause. For example, the following clause converts and moves the matching files of the tablespace from the dbs directory to the dbs/enc directory:

       FILE_NAME_CONVERT = ('dbs', 'dbs/enc')

     • The FILE_NAME_CONVERT clause recognizes patterns. The following example converts the data files users_1.dbf and users_2.dbf to users_enc1.dbf and users_enc2.dbf:

       FILE_NAME_CONVERT = ('users', 'users_enc')

     • In an Oracle Data Guard environment, include the name of the standby database data file in the FILE_NAME_CONVERT settings.

     • You must use the FILE_NAME_CONVERT clause for non-Oracle managed files. (In an Oracle-managed files configuration, new data files are created automatically.)

     • You can find the data files for a tablespace by querying the V$DATAFILE or V$DATAFILE_HEADER dynamic views.

     By default, data files are in the $ORACLE_HOME/dbs directory. If the data files are located there, then you do not have to specify a path.

To rekey an existing tablespace that is online, you can use the REKEY clause of the ALTER TABLESPACE SQL statement.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege if you plan to rekey the SYSTEM and SYSAUX tablespaces. Otherwise, connect with the SYSKM administrative privilege.

2. Ensure that the following requirements are met:
   • The COMPATIBLE initialization parameter is set to 12.2.0.0.
   • The database is open and in read-write mode.
   • A master encryption key has been created and is open.
3. Query the KEY_VERSION and STATUS columns of the V$ENCRYPTED_TABLESPACES dynamic view to find the current status of the encryption algorithm used by the master encryption key.
4. Perform the rekey operation, based on the status returned by the V$ENCRYPTED_TABLESPACES dynamic view:

   • If the key version status of the tablespace is NORMAL, then specify the new algorithm of the online tablespace rekey.

     For example:

     ALTER TABLESPACE users ENCRYPTION USING 'AES192' REKEY FILE_NAME_CONVERT = ('users.dbf', 'users_enc.dbf');

   • If the key version status is ENCRYPTING, DECRYPTING, or REKEYING, then use the FINISH clause.

     For example:

     ALTER TABLESPACE users ENCRYPTION ONLINE FINISH REKEY FILE_NAME_CONVERT = ('users.dbf', 'users_enc.dbf');

5. If the ORA-00241 operation disallowed: control file inconsistent with data dictionary error appears, then restart the database.
   In a multitenant environment, restart the CDB root database and then retry Step 4.

To decrypt an existing tablespace with online conversion, you can use the ALTER TABLESPACE SQL statement with DECRYPT clause.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege if you plan to decrypt the SYSTEM and SYSAUX tablespaces. Otherwise, connect with the SYSKM administrative privilege.

2. Ensure that the following requirements are met:
   • The COMPATIBLE initialization parameter is set to 12.2.0.0.
   • The database is open and in read-write mode.
   • A master encryption key has been created and is open.
   • There is enough auxiliary space to complete the decryption.
3. Run the ALTER TABLESPACE SQL statement with the DECRYPT clause.

   For example:

   ALTER TABLESPACE users ENCRYPTION ONLINE DECRYPT FILE_NAME_CONVERT = ('users_enc.dbf', 'users.dbf');

   In this specification:

   • When you specify the files to decrypt, enter them in the reverse order in which they were originally encrypted. That is, first enter the name of the encrypted file (users_enc.dbf), followed by the data file (users.dbf).

   • Do not provide an algorithm key for the decryption.

If an online encryption process is interrupted, then you can complete the conversion by rerunning the ALTER TABLESPACE statement using the FINISH clause.

1. Query the V$ENCRYPTED_TABLESPACES to check the STATUS column for the tablespace.

   If the STATUS column reports ENCRYPTING, DECRYPTING, or REKEYING, then re-run the ALTER TABLESPACE statement with the FINISH clause, as described in this procedure. If the STATUS reports NORMAL, then you can rerun ALTER TABLESPACE without the FINISH clause.

   You can find the tablespace name that matches the TS# and TABLESPACE_NAME columns by querying the V$DATAFILE_HEADER view.

2. If necessary query the following additional views to find information about the tablespace whose online conversion was interrupted:
   • DBA_TABLESPACES to find if the STATUS of the tablespace indicates if it is online or offline.
   • V$ENCRYPTED_TABLESPACES to find if the STATUS of the tablespace indicates if it is encrypted, and what the KEY_VERSION of the encryption key is.
   • V$DATAFILE and V$DATAFILE_HEADER to find the data files that are associated with a tablespace.
3. Run the ALTER TABLESPACE statement using the FINISH clause.
   Examples are as follows:

   • For an encryption operation:

     ALTER TABLESPACE users ENCRYPTION ONLINE FINISH ENCRYPT FILE_NAME_CONVERT = ('users.dbf', 'users_enc.dbf');

   • For a decryption operation:

     ALTER TABLESPACE users ENCRYPTION ONLINE FINISH DECRYPT FILE_NAME_CONVERT = ('users_enc.dbf', 'users.dbf');

     Note the order in which the files are specified: first, the name of the encrypted file, and then the name of the data file. (In the encryption operation, the name of the data file is specified first, followed by the name of the encrypted file.)

   • For a rekey operation:

     ALTER TABLESPACE users ENCRYPTION ONLINE FINISH REKEY FILE_NAME_CONVERT = ('users.dbf', 'users_enc.dbf');

     You cannot specify an algorithm when you use the FINISH clause in an ALTER TABLESPACE statement.
4. To check the conversion, query the STATUS column of the V$ENCRYPTED_TABLESPACES view.
   The status should be NORMAL. In an Oracle Data Guard environment, if the database does not have NORMAL as the STATUS, then run the ALTER TABLESPACE ... FINISH statement on the primary or the standby data file that did not successfully convert.

The encryption conversion of an entire database encrypts all tablespaces, including the Oracle-supplied SYSTEM, SYSAUX, UNDO, and TEMP tablespaces.

Note the following:

• To perform the encryption, you can use the offline and online functionality of the tablespace encryption conversions.

• You can encrypt any or all of the Oracle-supplied tablespaces, and in any order. The encryption of the Oracle-supplied tablespaces has no impact on the encryption of user-created tablespaces.

• When you encrypt the Oracle-supplied tablespaces, Oracle Database prevents the keystore from being closed.

• You cannot encrypt an existing temporary tablespace, but you can drop the existing temporary tablespace and then recreate it as encrypted.

• The UNDO and TEMP metadata that is generated from sensitive data in an encrypted tablespace is already automatically encrypted. Therefore, encrypting UNDO and TEMP is optional.

• Oracle recommends that you encrypt the Oracle-supplied tablespaces by using the default tablespace encryption algorithm, AES128. However, you can rekey any of these tablespaces afterwards to use a different encryption algorithm if you want. (To find the current encryption key for the current database, you can query the V$DATABASE_KEY_INFO dynamic view.)

• The performance effect of encrypting all the tablespaces in a database depends on the workload and platform. Many modern CPUs provide built-in hardware acceleration, which results in a minimal performance impact.

• In a multitenant environment, you can encrypt any tablespaces in any pluggable databases (PDBs), including the Oracle-supplied tablespaces. However, the keystore in the CDB root must be open at all times so that a PDB can open its keystore. You can check the status of whether a keystore is open by querying the STATUS column of the V$ENCRYPTION_WALLET view

When you encrypt an existing database with offline conversion, you do not specify an encryption algorithm.

1. Connect as a user who has the SYSDBA administrative privilege.

   For example:

   sqlplus sec_admin as sysdba
   Enter password: password

   You must have the SYSDBA administrative privilege to encrypt the SYSTEM and SYSAUX tablespaces.

2. Mount the database.

   STARTUP MOUNT

3. Open the keystore.

   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY keystore_password;

4. Run the ALTER TABLESPACE SQL statement to encrypt the SYSTEM, SYSAUX, and UNDO tablespaces. Do not specify an algorithm, and do not encrypt the SYSTEM tablespace concurrently with the encryption of other tablespaces.

   For example, to encrypt the SYSTEM tablespace:

   ALTER TABLESPACE SYSTEM ENCRYPTION OFFLINE ENCRYPT;

5. Open the database.
   For example, to open the database in read/write mode:

   ALTER DATABASE OPEN READ WRITE;

6. For a temporary tablespace, drop it and then recreate it as encrypted. Do not specify an algorithm.

   For example, for a user-created tablespace:

   DROP TABLESPACE temp_01;
   CREATE TEMPORARY TABLESPACE temp_01 
   TEMPFILE 'temp01.dbf' SIZE 5M AUTOEXTEND ON 
   ENCRYPTION ENCRYPT;

   You cannot drop the default TEMP tablespace. You must first create a new tablespace and make it the default before you can drop TEMP.

   For example:

   CREATE TEMPORARY TABLESPACE temp_01 
   TEMPFILE 'temp01.dbf' SIZE 5M AUTOEXTEND ON 
   ENCRYPTION ENCRYPT;
   
   ALTER DATABASE DEFAULT TEMPORARY TABLESPACE temp_01;
   
   DROP TABLESPACE TEMP;

7. Run the ALTER TABLESPACE SQL statement to encrypt other user tablespaces. Alternatively, you can proceed to the next step and open the database first, and then perform the steps described in Encrypting an Existing User-Defined Tablespace with Offline Conversion.
8. Open the database.

   ALTER DATABASE OPEN;

When you encrypt an existing database with online conversion, you do not specify an encryption algorithm.

1. Perform the following tasks, which are described in Encrypting an Existing Tablespace with Online Conversion:
   1. Connect as a user who has been granted the SYSDBA administrative privilege.
   2. Ensure that the COMPATIBLE parameter is set to 12.2.0.0.
   3. Ensure that the database is open in read-write mode.
   4. Ensure that you have enough auxiliary space to complete the encryption.
   5. Back up the tablespaces that you must encrypt.
   6. Open the keystore.
2. Run the ALTER TABLESPACE SQL statement to encrypt the SYSTEM, SYSAUX, and UNDO tablespaces. Do not specify an algorithm, and do not encrypt the SYSTEM tablespace concurrently with the encryption of other tablespaces.

   For example, to encrypt the SYSTEM tablespace:

   ALTER TABLESPACE SYSTEM ENCRYPTION ONLINE ENCRYPT 
   FILE_NAME_CONVERT=('system01.dbf','system01_enc.dbf');

3. For a temporary tablespace, drop it and then recreate it as encrypted. Do not specify an algorithm.

   For example, for a user-created tablespace:

   DROP TABLESPACE temp_01;
   CREATE TEMPORARY TABLESPACE temp_01 
   TEMPFILE 'temp01.dbf' SIZE 5M AUTOEXTEND ON 
   ENCRYPTION ENCRYPT;

   You cannot drop the default TEMP tablespace. You must first create a new tablespace and make it the default before you can drop TEMP.

   For example:

   CREATE TEMPORARY TABLESPACE temp_01 
   TEMPFILE 'temp01.dbf' SIZE 5M AUTOEXTEND ON 
   ENCRYPTION ENCRYPT;
   
   ALTER DATABASE DEFAULT TEMPORARY TABLESPACE temp_01;
   
   DROP TABLESPACE TEMP;