5 Switching from MES to OpenSSL Cryptographic Provider

Before switching from Dell BSAFE Crypto-C Micro Edition Suite, or MES (legacy provider) to OpenSSL (next-generation provider), complete the following pre-switch verification steps:

1. 1. Inventory TDE Data Encryption Algorithms

   Query your encrypted tablespaces and columns to identify any using 3DES168 (deprecated). 3DES encryption is outdated, slow, and no longer considered secure. Re-encrypt to AES256 before switching to FIPS 140-3 mode.

2. Inventory TDE Master Encryption Key Algorithm
   Verify that the TDE master encryption key uses AES256. If the MEK uses ARIA256, SEED128, or GOST256, rekey to AES256:

   ADMINISTER KEY MANAGEMENT SET KEY USING ALGORITHM 'AES256' IDENTIFIED BY keystore_password WITH BACKUP;

3. Check and Convert Wallet Encryption
   Wallets created before Oracle Database 19.22 may use 3DES. Check and convert:

   openssl pkcs12 -info -in ./ewallet.p12 -nodes

   orapki wallet convert -wallet wallet_location -compat_v12

4. Verify RMAN Encryption Algorithm
   If using RMAN backup encryption, verify the algorithm is AES-based:

   CONFIGURE ENCRYPTION ALGORITHM 'AES256';

5. Verify Data Pump Encryption Algorithm

   Use ENCRYPTION_ALGORITHM=AES256 for Data Pump exports.

6. Review FIPS Mode Configuration
   If enabling FIPS 140-3 mode:

   • Set FIPS_140=TRUE and FIPS_VERSION=FIPS140-3
   • In FIPS mode, only AES128, AES192, and AES256 are available
   • Append -fips140_mode to orapki commands
7. Benchmark Performance

   Run representative workloads after switching providers to verify performance.

All modes of symmetric encryption using AES256 are considered quantum resistant. Standardizing on AES256 across all TDE operations provides the broadest compatibility with both current and future cryptographic requirements.