Changes in This Release for Oracle Database Advanced Security Guide

This preface contains:

Changes in Oracle Database Advanced Security 19c

The following are changes in Oracle Database Advanced Security Guide for Oracle Database 19c.

Parent topic: Changes in This Release for Oracle Database Advanced Security Guide

OpenSSL Cryptographic Provider Support

Starting with this release update, Oracle Database 19c supports the next-generation cryptographic provider based on OpenSSL, as an alternative to the default Dell BSAFE Crypto-C Micro Edition Suite, or MES (legacy provider). The next-generation provider enables FIPS 140-3 compliance.

The following changes affect Transparent Data Encryption (TDE) when using the next-generation provider:
  • 3DES168 (deprecated) is desupported for data encryption when the next-generation provider operates in FIPS 140-3 mode. 3DES encryption is outdated, slow, and no longer considered secure. Oracle recommends transitioning to AES. Review your encryption configurations to ensure you do not use 3DES. Existing data encrypted with 3DES168 must be re-encrypted with an AES algorithm before enabling FIPS 140-3.
  • The GOST and SEED master encryption key algorithms are not supported with the next-generation provider. If your TDE master key uses one of these algorithms, rekey to AES256 before switching to the next-generation provider.
  • Wallet compatibility is maintained between providers. However, keystore files created before Oracle Database 19.22 may use 3DES for PKCS#12 container encryption and must be converted to AES-256 using the orapki wallet convert command before enabling FIPS 140-3 mode.
  • AES-CFB remains the only supported mode for tablespace encryption on Oracle Database 19c. AES-XTS mode is not available on this release.
  • The default tablespace encryption algorithm is AES128 (CFB mode). The default column encryption algorithm is AES192 (CBC mode). Oracle recommends AES256 for both, as all modes of symmetric encryption using AES256 are considered quantum resistant.

FIPS Parameter Configuration

To enable FIPS mode with the next-generation provider, set the following parameters in the fips.ora file. The fips.ora file is located by default in $ORACLE_HOME/ldap/admin, or in a location specified by the FIPS_HOME environment variable:

  • FIPS_140=TRUE enables FIPS mode.
  • FIPS_VERSION=FIPS140-3 (recommended) enables FIPS 140-3 mode.
  • FIPS_VERSION=FIPS140-2 (deprecated) explicitly selects FIPS 140-2 mode. In a future release, this value will be desupported and FIPS140-3 will become the default FIPS version.

In FIPS mode, only AES128, AES192, and AES256 are available for TDE operations.

Related Topics

Parent topic: Changes in Oracle Database Advanced Security 19c

Improved Key Management Support for Encrypting Oracle-Managed Tablespaces

In this release, closing a TDE keystore is now allowed even when the Oracle-managed tablespaces (SYSTEM, SYSAUX, TEMP, and UNDO tablespaces) are encrypted.

Internal operations on these tablespaces when they are encrypted continue to be unaffected even when the TDE keystore is in the CLOSED state.

Closing the TDE keystore has no effect on queries of an encrypted SYSTEM, SYSAUX, TEMP, or UNDO tablespace, unlike queries of a user-created tablespace, which continue to return an ORA-28365 wallet is not open error when the TDE keystore is closed.

User-initiated operations such as decrypt on any encrypted Oracle-managed tablespace still require the TDE keystore to be in the OPEN state.

Related Topics

Parent topic: Changes in Oracle Database Advanced Security 19c

Transparent Online Conversion Support for Auto-Renaming in Non-Oracle-Managed Files Mode

Starting with this release, online tablespace encryption no longer requires you to specify the FILE_NAME_CONVERT clause in the ALTER TABLESPACE ENCRYPT SQL statement. The file names will retain their original names.

This enhancement helps to prevent you from having to rename files back to the original name afterward, sometimes missing files.

Related Topics

Parent topic: Changes in Oracle Database Advanced Security 19c

Support for More Algorithms for Offline Tablespace Encryption

In previous releases, only the AES128 encryption algorithm was supported for offline tablespace encryption. In addition to AES128, this release introduces support for the AES192 and AES256 encryption algorithms, as well as ARIA, GOST, and 3DES encryption algorithms for offline tablespace encryption.

This enhancement benefits scenarios in which you have concerns about auxiliary space usage required by online tablespace encryption.

Related Topics

Parent topic: Changes in Oracle Database Advanced Security 19c

Updates to Oracle Advanced Database Security 19c

Oracle Advanced Database Security release 19c has one update from the last update of release 19c.

Parent topic: Changes in This Release for Oracle Database Advanced Security Guide

Oracle Data Guard Redo Decryption for Hybrid Disaster Recovery Configurations

Available for Oracle Database release 19.16, Oracle Data Guard enables you to decrypt redo operations in hybrid cloud disaster recovery configurations where the Cloud database is encrypted with TDE and the on-premises database is not.

Hybrid disaster recovery is often considered a quick-stepping stone to cloud adoption. By enabling the ability to quickly configure disaster recovery even in cases where on-premises databases might not already be encrypted with TDE, the steps required to configure hybrid disaster recovery environments are reduced while still ensuring that redo data is still encrypted during the transportation process.

To enable this feature, Oracle Database introduces the TABLESPACE_ENCRYPTION initialization parameter, which enables you to control the automatic encryption of tablespaces in both the primary and standby databases, for on-premises and Oracle Cloud Infrastructure (OCI) environments. For example, an on-premises database can be unencrypted and an OCI database can be encrypted.

Related Topics

Parent topic: Updates to Oracle Advanced Database Security 19c