Table of Contents

• Title and Copyright Information
• Preface
  • Audience
  • Related Documents
  • Conventions
• Changes in This Release for Oracle AI Database Transparent Data Encryption Guide
  • Changes in Oracle AI Database Transparent Data Encryption 26ai
    • Preparing for FIPS 140-3 Compliance
    • Changes for Encryption Algorithms and Modes
    • AES-XTS Encryption Mode Support for TDE Tablespace Encryption
    • Oracle Data Guard Redo Decryption for Hybrid Disaster Recovery Configurations
  • Updates to Oracle AI Database Transparent Data Encryption 26ai
    • New Parameter to Control the TDE Rekey Operations for Oracle Data Guard
• Introduction to Transparent Data Encryption
  • What Is Transparent Data Encryption?
  • How Configuring Transparent Data Encryption Works
  • Benefits of Using Transparent Data Encryption
  • Who Can Configure Transparent Data Encryption?
  • Types and Components of Transparent Data Encryption
    • About Transparent Data Encryption Types and Components
    • How Transparent Data Encryption Tablespace Encryption Works
    • How Transparent Data Encryption Column Encryption Works
    • How the Keystore for the Storage of TDE Master Encryption Keys Works
      • About the Keystore Storage of TDE Master Encryption Keys
      • Benefits of the Keystore Storage Framework
      • Types of Keystores
    • Supported Encryption and Integrity Algorithms
  • Transparent Data Encryption in a Multitenant Environment
  • Transparent Data Encryption Keystore Search Order
• Configuring United Mode
  • About Configuring United Mode
  • Operations That Are Allowed in United Mode
  • Configuring the Keystore Location and Type for United Mode
    • About Configuring the Keystore Location and Type for United Mode
    • Configuring United Mode with the Initialization Parameter File and ALTER SYSTEM
    • Example: Configuring a TDE Wallet When Multiple Databases Share the Same Host
    • Example: Configuring a TDE Wallet for an Oracle Automatic Storage Management Disk Group
  • Configuring a TDE Wallet and TDE Master Encryption Key for United Mode
    • About Configuring a TDE Wallet and TDE Master Encryption Key for United Mode
    • Step 1: Create the TDE Wallet
      • About Creating TDE Wallets
      • Creating a Password-Protected TDE Wallet
      • Creating an Auto-Login or a Local Auto-Login TDE Wallet
    • Step 2: Open the TDE Wallet
      • About Opening TDE Wallets
      • Opening the TDE Wallet in a United Mode PDB
    • Step 3: Set the TDE Master Encryption Key in the TDE Wallet
      • About Setting the TDE Wallet TDE Master Encryption Key
      • Setting the TDE Master Encryption Key in the United Mode TDE Wallet
    • Step 4: Encrypt Your Data in United Mode
  • Operations That Are Not Allowed in a United Mode PDB
  • Configuring a Container Database with United Mode PDBs for Oracle Key Vault
    • About Configuring a Container Database with United Mode PDBs for Oracle Key Vault
    • About Configuring a Container Database with United Mode PDBs for Oracle Key Vault
    • Step 1: Configure Oracle Key Vault for United Mode
    • Step 2: Open the Connection to Oracle Key Vault
      • About Opening the Connection to Oracle Key Vault
      • Opening the Oracle Key Vault Connection in a United Mode PDB
    • Step 3: Set the TDE Master Encryption Key in Oracle Key Vault
      • About Setting the External Keystore TDE Master Encryption Key
      • Heartbeat Batch Size for External Keystores
      • Setting the TDE Master Encryption Key for United Mode PDBs in an External Keystore
      • Migration of an Encrypted Database from a TDE Wallet to Oracle Key Vault or OCI KMS
    • Step 4: Encrypt Your Data in United Mode
• Configuring Isolated Mode
  • About Configuring Isolated Mode
  • Operations That Are Allowed in Isolated Mode
  • Operations That Are Not Allowed in an Isolated Mode PDB
  • Configuring the Keystore Location and Type for Isolated Mode
    • About Configuring the Keystore Location and Type for Isolated Mode
    • Configuring the Keystore Location and Keystore Type for an Isolated Mode PDB
    • Example: Restoring an Older Version of a Control File
    • Example: Addressing the Problem of a Lost Control File
    • Example: Configuring Isolated Mode in an Oracle Real Application Clusters Environment
    • Resolving the Transition From an Isolated Mode PDB to a United Mode PDB in a Data Guard Environment
  • Configuring a TDE Wallet and TDE Master Encryption Key in Isolated Mode
    • About Configuring a TDE Wallet in Isolated Mode
    • Step 1: Create a TDE Wallet in a PDB Configured in Isolated Mode
    • Step 2: Open the TDE Wallet in an Isolated Mode PDB
    • Step 3: Set the TDE Master Encryption Key in the TDE Wallet of the Isolated Mode PDB
    • Step 4: Encrypt Your Data in Isolated Mode
  • Configuring a Container Database with Isolated Mode PDBs for Oracle Key Vault
    • About Configuring an External Keystore in Isolated Mode
    • Step 1: Configure Isolated PDBs for Oracle Key Vault
    • Step 2: Open the Isolated Mode PDB External Keystore
    • Step 3: Set the First TDE Master Encryption Key in the External Keystore
      • Setting the TDE Master Encryption Key in the Isolated Mode External Keystore
      • Migration of a Previously Configured Encryption Key in Isolated Mode
    • Step 4: Encrypt Your Data in Isolated Mode
• Encrypting Columns in Tables
  • About Encrypting Columns in Tables
  • Data Types That Can Be Encrypted with TDE Column Encryption
  • Restrictions on Using TDE Column Encryption
  • Creating Tables with Encrypted Columns
    • About Creating Tables with Encrypted Columns
    • Creating a Table with an Encrypted Column Using the Default Algorithm
    • Creating a Table with an Encrypted Column Using No Algorithm or a Non-Default Algorithm
    • Using the NOMAC Parameter to Save Disk Space and Improve Performance
    • Example: Using the NOMAC Parameter in a CREATE TABLE Statement
    • Example: Changing the Integrity Algorithm for a Table
    • Creating an Encrypted Column in an External Table
  • Encrypting Columns in Existing Tables
    • About Encrypting Columns in Existing Tables
    • Adding an Encrypted Column to an Existing Table
    • Encrypting an Unencrypted Column
    • Decrypting an Application Table Column
  • Creating an Index on an Encrypted Column
  • Adding Salt to an Encrypted Column
  • Removing Salt from an Encrypted Column
  • Changing the Encryption Key or Algorithm for Tables with Encrypted Columns
  • Migrating the Algorithm to the Latest Supported Algorithm for Tables
• Encryption Conversions for Tablespaces and Databases
  • About Encryption Conversion for Tablespaces and Databases
  • Impact of a Closed TDE Keystore on Encrypted Tablespaces
  • Restrictions on Using Transparent Data Encryption Tablespace Encryption
  • Creating an Encrypted New Tablespace
    • Step 1: Set the COMPATIBLE Initialization Parameter for Tablespace Encryption
      • About Setting the COMPATIBLE Initialization Parameter for Tablespace Encryption
      • Setting the COMPATIBLE Initialization Parameter for Tablespace Encryption
    • Step 2: Set the TDE Master Encryption Key
    • Step 3: Create the Encrypted Tablespace
      • About Creating Encrypted Tablespaces
      • Creating an Encrypted Tablespace
      • Example: Creating an Encrypted Tablespace That Uses AES192
      • Example: Creating an Encrypted Tablespace That Uses the Default Algorithm
  • Setting the Tablespace Encryption Default Algorithm
  • Encrypting Future Tablespaces
    • About Encrypting Future Tablespaces
    • Setting Future Tablespaces to be Encrypted
  • Encrypted Sensitive Credential Data in the Data Dictionary
  • Offline Encryption of Existing Tablespaces
    • About Offline Encryption of Existing Tablespaces
    • Encrypting an Existing User-Defined Tablespace with Offline Conversion
    • Decrypting an Existing Tablespace with Offline Conversion
  • Encryption Conversions for Existing Online Tablespaces
    • About Encryption Conversions for Existing Online Tablespaces
    • Encrypting an Existing Tablespace with Online Conversion
    • Rekeying an Existing Tablespace with Online Conversion
    • Rekeying the SYSAUX and UNDO Tablespaces with Online Conversion
    • Decrypting an Existing Tablespace with Online Conversion
    • Finishing an Interrupted Online Encryption Conversion
  • Rekeying an Encrypted Tablespace
  • Creating an Encrypted Database Using DBCA
    • Using DBCA to Create an Encrypted Database
    • Using DBCA to Create an Oracle Data Guard Standby Database from an Encrypted Primary Database
    • Best Practice after DBCA Creates an Encrypted Database
  • Encryption Conversions for Existing Databases
    • About Encryption Conversions for Existing Databases
    • Encrypting an Existing Database with Offline Conversion
    • Encrypting an Existing Database with Online Conversion
• Managing the Keystore and the Master Encryption Key
  • Managing the Keystore
    • Performing Operations That Require a Keystore Password
    • Configuring Auto-Open Connections into External Key Managers
      • About Auto-Open Connections into External Key Managers
      • Configuring an Auto-Open Connection into an External Key Manager
    • Changing the Oracle Key Vault Password
    • Configuring an External Store for a Keystore Password
      • About Configuring an External Store for a Keystore Password
      • Configuring the External Keystore Password Store with WALLET_ROOT
      • When to Use the EXTERNAL STORE Clause After Configuration
    • Backing Up Password-Protected TDE Wallets
      • About Backing Up Password-Protected TDE Wallets
      • Creating a Backup Identifier String for the Backup TDE Wallet
      • Backing Up a Password-Protected TDE Wallet
    • How the V$ENCRYPTION_WALLET View Interprets Backup Operations
    • Backups of the External Keystore
    • Merging TDE Wallets
      • About Merging TDE Wallets
      • Merging One TDE Wallet into an Existing TDE Wallet
      • Merging Two TDE Wallets into a Third New TDE Wallet
      • Merging an Auto-Login TDE Wallet into an Existing Password-Protected TDE Wallet
      • Reversing a TDE Wallet Merge Operation
    • Moving a TDE Wallet to a New Location
    • Moving a TDE Wallet Out of Automatic Storage Management
    • Migrating from a TDE Wallet to Oracle Key Vault
      • Migrating from a Password-Protected TDE Wallet to an External Keystore
        • Step 1: Convert the TDE Wallet to Open with the External Keystore
        • Step 2: Configure the External Keystore Type
        • Step 3: Perform the External Keystore Migration
      • Migrating from an External Keystore to a Password-Based TDE Wallet
        • About Migrating Back from an External Keystore
        • Step 1: Configure the External Keystore Type
        • Step 2: Configure the Keystore for the Reverse Migration
        • Step 3: Configure the External Keystore to Open with the TDE Wallet
      • Keystore Order After a Migration
    • Migration of Keystores to and from Oracle Key Vault
    • Configuring Keystores for Automatic Storage Management
      • About Configuring Keystores for Automatic Storage Management
      • Configuring a Keystore to Point to an ASM Location
      • Configuring a Keystore to Point to an ASM Location When the WALLET_ROOT Location Does Not Follow OMF Guidelines
    • Managing Updates to the PKCS#11 Library
      • About Managing Updates to the PKCS#11 Library
      • Switching Over to an Updated PKCS#11 Library
    • Backup and Recovery of Encrypted Data
    • Dangers of Deleting TDE Wallets
    • Features That Are Affected by Deleted Keystores
  • Managing the TDE Master Encryption Key
    • TDE Master Encryption Key Attribute Management
      • TDE Master Encryption Key Attributes
      • Finding the TDE Master Encryption Key That Is in Use
    • Creating Custom TDE Master Encryption Key Attributes for Reports
      • About Creating Custom Attribute Tags
      • Creating a Custom Attribute Tag
    • Setting or Rekeying the TDE Master Encryption Key in the Keystore
      • About Setting or Rekeying the TDE Master Encryption Key in the Keystore
      • Creating, Tagging, and Backing Up a TDE Master Encryption Key
      • About Rekeying the TDE Master Encryption Key
      • Rekeying the TDE Master Encryption Key
      • Changing the TDE Master Encryption Key for a Tablespace
    • Exporting and Importing the TDE Master Encryption Key
      • About Exporting and Importing the TDE Master Encryption Key
      • About Exporting TDE Master Encryption Keys
      • Exporting a TDE Master Encryption Key
      • Example: Exporting a TDE Master Encryption Key by Using a Subquery
      • Example: Exporting a List of TDE Master Encryption Key Identifiers to a File
      • Example: Exporting All TDE Master Encryption Keys of the Database
      • About Importing TDE Master Encryption Keys
      • Importing a TDE Master Encryption Key
      • Example: Importing a TDE Master Encryption Key
      • How Keystore Merge Differs from TDE Master Encryption Key Export or Import
    • Converting from ENCRYPTION_WALLET_LOCATION to WALLET_ROOT and TDE_CONFIGURATION
    • Management of TDE Master Encryption Keys Using Oracle Key Vault
  • Transparent Data Encryption Data Dynamic and Data Dictionary Views
• Administering United Mode
  • Administering Keystores and Master Encryption Keys in United Mode
    • Changing the Keystore Password in United Mode
      • Changing the Password-Protected TDE Wallet Password in United Mode
      • Changing the Password of an External Keystore in United Mode
    • Backing Up a Password-Protected TDE Wallet in United Mode
    • Closing Keystores in United Mode
      • About Closing Keystores
      • Closing a TDE Wallet in United Mode
      • Closing an External Keystore in United Mode
    • Creating TDE Master Encryption Keys for Later Use in United Mode
      • About Creating a TDE Master Encryption Key for Later Use
      • Creating a TDE Master Encryption Key for Later Use in United Mode
    • Example: Creating a Master Encryption Key in All PDBs
    • Activating TDE Master Encryption Keys in United Mode
      • About Activating TDE Master Encryption Keys
      • Activating a TDE Master Encryption Key in United Mode
      • Example: Activating a TDE Master Encryption Key
    • Creating User-Defined TDE Master Encryption Keys
      • About User-Defined TDE Master Encryption Keys
      • Creating a User-Defined TDE Master Encryption Key in United Mode
    • Rekeying the TDE Master Encryption Key in United Mode
    • Finding the TDE Master Encryption Key That Is in Use in United Mode
    • Creating a Custom Attribute Tag in United Mode
    • Moving TDE Master Encryption Keys into a New Keystore in United Mode
      • About Moving TDE Master Encryption Keys into a New Keystore
      • Moving a TDE Master Encryption Key into a New Keystore in United Mode
    • Automatically Removing Inactive TDE Master Encryption Keys in United Mode
    • Isolating a Pluggable Database Keystore
  • Administering Transparent Data Encryption in United Mode
    • Moving PDBs from One CDB to Another in United Mode
    • Unplugging and Plugging a PDB with Encrypted Data in a CDB in United Mode
      • Unplugging a PDB That Has Encrypted Data in United Mode
      • Plugging a PDB That Has Encrypted Data into a CDB in United Mode
      • Unplugging a PDB That Has Master Encryption Keys Stored in an External Keystore in United Mode
      • Plugging a PDB That Has Master Encryption Keys Stored in an External Keystore in United Mode
    • Managing Cloned PDBs with Encrypted Data in United Mode
      • About Managing Cloned PDBs That Have Encrypted Data in United Mode
      • Cloning a PDB with Encrypted Data in a CDB in United Mode
      • Remotely Clone an Encrypted PDB in United Mode
      • Relocating an Encrypted PDB in United Mode
    • How Keystore Open and Close Operations Work in United Mode
    • Finding the Keystore Status for All of the PDBs in United Mode
• Administering Isolated Mode
  • Administering Keystores and TDE Master Encryption Keys in Isolated Mode
    • Changing the Keystore Password in Isolated Mode
      • Changing the Password-Protected TDE Wallet Password in Isolated Mode
      • Changing the Password of an External Keystore in Isolated Mode
    • Backing Up a Password-Protected TDE Wallet in Isolated Mode
    • Merging TDE Wallets in Isolated Mode
      • Merging One TDE Wallet into an Existing TDE Wallet in Isolated Mode
      • Merging Two TDE Wallets into a Third New TDE Wallet in Isolated Mode
    • Closing Keystores in Isolated Mode
      • Closing a TDE Wallet in Isolated Mode
      • Closing an External Keystore in Isolated Mode
    • Creating a User-Defined TDE Master Encryption Key in Isolated Mode
    • Creating a TDE Master Encryption Key for Later Use in Isolated Mode
    • Activating a TDE Master Encryption Key in Isolated Mode
    • Rekeying the TDE Master Encryption Key in Isolated Mode
    • Moving a TDE Master Encryption Key into a New Keystore in Isolated Mode
    • Creating a Custom Attribute Tag in Isolated Mode
    • Exporting and Importing the TDE Master Encryption Key in Isolated Mode
      • Exporting a TDE Master Encryption Key in Isolated Mode
      • Importing a TDE Master Encryption Key in Isolated Mode
    • Storing Oracle Database Secrets in Isolated Mode
      • About Storing Oracle Database Secrets in a Keystore in Isolated Mode
      • Storing Oracle Database Secrets in a TDE Wallet in Isolated Mode
      • Example: Adding an Oracle Key Vault Password to a TDE Wallet
      • Example: Changing an Oracle Key Vault Password Stored as a Secret in a TDE Wallet
      • Example: Deleting an Oracle Key Vault Password Stored as a Secret in a TDE Wallet
      • Storing Oracle Database Secrets in an External Keystore in Isolated Mode
      • Example: Adding an Oracle Database Secret to an External Keystore
      • Example: Changing an Oracle Database Secret in an External Keystore
      • Example: Deleting an Oracle Database Secret in an External Keystore
    • Storing Oracle GoldenGate Secrets in a Keystore in Isolated Mode
      • About Storing Oracle GoldenGate Secrets in Keystores in Isolated Mode
      • Oracle GoldenGate Extract Classic Capture Mode TDE Requirements
      • Configuring Keystore Support for Oracle GoldenGate
        • Step 1: Decide on a Shared Secret for the Keystore
        • Step 2: Configure Oracle Database for TDE Support for Oracle GoldenGate
        • Step 3: Store the TDE GoldenGate Shared Secret in the Keystore
        • Step 4: Set the TDE Oracle GoldenGate Shared Secret in the Extract Process
    • Migrating Keystores in Isolated Mode
      • Reverse Migrating an Isolated PDB from Oracle Key Vault to a TDE Wallet
      • Migrating from an External Keystore to a Password-Protected TDE Wallet in Isolated Mode
    • Uniting a Pluggable Database Keystore
    • Creating a Keystore When the PDB Is Closed
      • About Creating a Keystore When the PDB Is Closed
      • Reverting a Keystore Creation Operation When a PDB Is Closed
  • Administering Transparent Data Encryption in Isolated Mode
    • Cloning or Relocating Encrypted PDBs in Isolated Mode
    • Unplugging and Plugging a PDB with Encrypted Data in a CDB in Isolated Mode
      • Unplugging a PDB That Has Encrypted Data in Isolated Mode
      • Plugging a PDB That Has Encrypted Data into a CDB in Isolated Mode
      • Unplugging a PDB That Has Master Encryption Keys Stored in an External Keystore in Isolated Mode
      • Plugging a PDB That Has Master Keys Stored in an External Keystore in Isolated Mode
    • Cloning a PDB with Encrypted Data in a CDB in Isolated Mode
    • Remotely Cloning an Encrypted PDB in Isolated Mode
    • Relocating an Encrypted PDB in Isolated Mode
    • How Keystore Open and Close Operations Work in Isolated Mode
    • Exporting and Importing Master Encryption Keys for a PDB in Isolated Mode
      • About Exporting and Importing Master Encryption Keys for a PDB in Isolated Mode
      • Exporting or Importing a Master Encryption Key for a PDB in Isolated Mode
      • Example: Exporting a Master Encryption Key from a PDB in Isolated Mode
      • Example: Importing a Master Encryption Key into a PDB in Isolated Mode
• General Considerations of Using Transparent Data Encryption
  • Migrating Encrypted TDE Columns or Tablespaces after a Database Upgrade from Release 11g
  • Compression and Data Deduplication of Encrypted Data
  • Security Considerations for Transparent Data Encryption
    • Transparent Data Encryption General Security Advice
    • Transparent Data Encryption Column Encryption-Specific Advice
    • Managing Security for Plaintext Fragments
  • Performance and Storage Overhead of Transparent Data Encryption
    • Performance Overhead of Transparent Data Encryption
    • Storage Overhead of Transparent Data Encryption
  • Modifying Your Applications for Use with Transparent Data Encryption
  • How ALTER SYSTEM and orapki Map to ADMINISTER KEY MANAGEMENT
  • Data Loads from External Files to Tables with Encrypted Columns
  • Transparent Data Encryption and Database Close Operations
• Using Transparent Data Encryption with Other Oracle Features
  • How Transparent Data Encryption Works with Export and Import Operations
    • About Exporting and Importing Encrypted Data
    • Exporting and Importing Tables with Encrypted Columns
    • Using Oracle Data Pump to Encrypt Entire Dump Sets
    • Using Oracle Data Pump with Encrypted Data Dictionary Data
  • How Transparent Data Encryption Works with Oracle Data Guard
    • About Using Transparent Data Encryption with Oracle Data Guard
    • Encryption of Tablespaces in an Oracle Data Guard Environment
      • About the Encryption of Tablespaces in an Oracle Data Guard Environment
      • Configuring the Encryption of Tablespaces in an Oracle Data Guard Environment
      • Encrypting an Existing Tablespace in Oracle Data Guard with Online Conversion
    • Configuring TDE and Oracle Key Vault in an Oracle Data Guard Environment
    • Configuring Wallet-Based Transparent Data Encryption in Oracle Data Guard
    • Migrating a TDE Wallet in an Oracle Data Guard Environment to Oracle Key Vault
    • Isolating an Encrypted PDB in an Oracle Data Guard Environment
    • Uncoupling the Standby Database from the Primary Database Online Encryption Process
  • How Transparent Data Encryption Works with Oracle Real Application Clusters
    • About Using Transparent Data Encryption with Oracle Real Application Clusters
    • Configuring TDE in Oracle Real Application Clusters for Oracle Key Vault
  • How Transparent Data Encryption Works with SecureFiles
    • About Transparent Data Encryption and SecureFiles
    • Example: Creating a SecureFiles LOB with a Specific Encryption Algorithm
    • Example: Creating a SecureFiles LOB with a Column Password Specified
  • How Transparent Data Encryption Works with Oracle Call Interface
  • How Transparent Data Encryption Works with Editions
  • Configuring Transparent Data Encryption to Work in a Multidatabase Environment
• Quick-start Setup Guide for Wallet Based Transparent Data Encryption
• Frequently Asked Questions About Transparent Data Encryption
  • Transparency Questions About Transparent Data Encryption
  • Performance Questions About Transparent Data Encryption
• Troubleshooting TDE
  • Error: ORA-28374: Typed Master Key Not Found
    • Find Missing TDE Master Keys in Oracle Key Vault
    • Find Missing TDE Master Keys in Cloud-Native Key Managers
    • Find Missing TDE Master Keys in Any Third Party Key Managers