Changes in This Release for Oracle Key Vault

This Oracle Key Vault release introduces new features that enhance the use of Oracle Key Vault in a large enterprise.

Changes for Oracle Key Vault Release 21.16

Oracle Key Vault release 21.16 introduces several new features.

Listing a Security Object’s Wallet Memberships by its Name

Starting with Oracle Key Vault release 21.16, you can look up a security object by its name attribute value to retrieve its UUID and list the wallets that contain the object.

The following RESTful services utility command supports the new --name option:

The command returns information only for the objects and wallets accessible that are accessible by the user running the command.

For Oracle Database TDE master encryption keys, you can specify the name attribute value derived from the TDE master key identifier (MKID). This helps you identify keys that already exist in Oracle Key Vault before uploading them.

Changes for Oracle Key Vault Release 21.13

Oracle Key Vault release 21.13 introduces several new features.

Renamed Endpoint Installation Options for Oracle AI Database 26ai New Feature Support

Oracle AI Database 26ai uses the OpenSSL FIPS module when operating in FIPS mode for cryptographic operations.

Starting with release 21.11, Oracle Key Vault provides an OpenSSL-based PKCS#11 library that you can use in FIPS mode with Oracle AI Database 26ai. Additionally, Oracle Key Vault supports the newer version of the local auto-login wallet introduced with Oracle AI Database 26ai.

Starting with Oracle Key Vault release 21.13, the installation options for endpoint software to support newer features of Oracle AI Database 26ai are renamed as follows:

Oracle Key Vault continues to support the previous db23ai option for backward compatibility, but recommends that you use db26ai.

Changes for Oracle Key Vault Release 21.11

Oracle Key Vault release 21.11 introduces several new features.

Protection for Security Objects During Register and Download Operations

Starting with release 21.11, you can protect security objects when registering or downloading them from Oracle Key Vault. Objects are protected using a symmetric key stored in Oracle Key Vault.

During object registration, you provide an encrypted object and an unwrapping key. Oracle Key Vault uses the unwrapping key to decrypt the object before registering.

Following commands are updated to include the new option --unwrap-key-uuid:

During object download, you provide a wrapping key. Oracle Key Vault uses the wrapping key to encrypt the object before returning.

Following commands are updated to include the new option --wrap-key-uuid

Specify the UUID of the symmetric key used for wrapping or unwrapping with the new options.

Searching for Security Objects With Their Date Attributes Within a Specified Date Range

Starting with release 21.11, you can search for security objects based on their date attributes, such as activation date, deactivation date, etc., that fall within a specified range.

When you provide a date range for a date attribute, the result includes all objects whose corresponding date attribute value falls within the specified range, including the start and end dates.

You can specify date range for date attributes for below commands:

Support for Cryptographic Parameters Attribute

Starting with release 21.11, the Oracle Key Vault RESTful services utility provides a new option --crypto-parameter that you can use to specify cryptographic parameter attributes with several managed-object commands such as register, get, locate, and fetch.

Following commands are enhanced to support the new option:

Listing Status of Each Node in a Cluster with One Command

Starting with release 21.11, the Oracle Key Vault RESTful services utility provides a new option to list the status of each cluster node with one command.

You specify the new option --all-nodes to the okv cluster service monitor command to get the status of all cluster nodes. Earlier, this command allowed you to obtain the status of only one cluster node at time using the --node-name option.

System Time of Oracle Key Vault Server

Starting with release 21.11, the output of the okv server info get command always includes the serverTime - the current system time of Oracle Key Vault server.

In earlier releases, serve time was included only when the command was run by a user with the System Administrator role.

Changes for Oracle Key Vault Release 21.10

Oracle Key Vault release 21.10 introduces several new features.

New Oracle Key Vault Endpoint Platforms - Linux for Arm (aarch64) Architecture and IBM: Linux on System z

Starting with Oracle Key Vault release 21.10, you can provision Oracle Key Vault endpoints on the Linux for Arm (aarch64) architecture and IBM: Linux on System z.

Oracle Databases running on Linux for Arm (aarch64) or IBM: Linux on System z can also be enrolled as Oracle Key Vault endpoints for TDE key management. You can set up endpoints for SSH servers or clients on both these platforms. All the endpoint software like okvutil, PKCS#11 library, the RESTful services utility, Java, and C SDK are available on these platforms.

The new endpoint platforms are supported with the Oracle Key Vault 21 RESTful services utility but not available with the deprecated classic RESTful services utility.

List Recently Active or Inactive Endpoint using the RESTful Services Utility Command

Starting with Oracle Key Vault release 21.10, you can list the endpoints that were active or inactive recently using the RESTful services utility.

To list the endpoint that were recently active, use the following command:

To list the endpoint with no recent activity, use the following command:

You can use the commands to check how often the endpoints connect to the Oracle Key Vault server. You can also use the commands to identify the defunct endpoints for house-keeping.

Changes for Oracle Key Vault Release 21.9

Oracle Key Vault release 21.9 introduces several new features.

List the Wallet Membership of an Object Using RESTful Services Utility Command

Starting with Oracle Key Vault release 21.9, you can now list all the wallet memberships of a given managed object.

Following command is added to RESTful services utility to support this enhancement:

okv manage-access wallet list-object-wallets --uuid <uuid>

The RESTful services utility command is run by a user. Only those wallets that this user has access to, will be listed. The object may be a member of the wallets that the user running the command has no access to. These wallets are not listed.

Allow List for Approved RESTful Connections

Starting with Oracle Key Vault release 21.9, you can enable access to RESTful services utility from the allowed IP addresses only.

With this new feature, only the configured list of IP addresses can use the RESTful services utility. In earlier Oracle Key Vault releases, you could either enable or disable the RESTful services utility only.

Changes for Oracle Key Vault Release 21.8

Oracle Key Vault release 21.8 introduces several new features.

Server-side Filtering for RESTful Services Utility Commands

Starting in Oracle Key Vault release 21.8, you can now specify options to do server-side filtering for the RESTful services utility commands that list endpoints or wallets, list objects that endpoints have access to, list objects in wallet and for those that list completed backups.

You can filter the list of endpoints by platform, type, or registration status. You can filter the list of wallets by their type, either general or SSH server wallets. You can filter the list of objects that endpoints have access to or list objects in the wallet by type such as, secret or certificate, or state like active or compromised. You can filter the list of completed backups for a specific backup destination or filter them by type, that is, one-time or periodic, or simply filter by the backup name. You can specify more than one option for filtering and can also specify more than one value for the filtering option. For example, you can list all endpoints on Linux and Microsoft Windows platforms by using the following command with the filter options:

--platform "LINUX64, WINDOWS"

The following commands support this enhancement:

RESTful Services Utility Commands Support for Custom Attributes

Starting with Oracle Key Vault Release 21.8, you can specify custom-attributes and KMIP-attributes of security objects as command line options when using RESTful services utility commands, such as add, modify, delete, and get. The fetch and locate commands also support additional attributes on the command line.

KMIP attributes like activation date and deactivation date are now available as command line options --activation-date and --deactivation-date respectively. You can pass the custom-attributes using the new command line option --custom-attribute.

The following commands support this enhancement:

Changes for Oracle Key Vault Release 21.7

Oracle Key Vault release 21.7 introduces several new features.

RESTful Services Utility Changes to Support SSH Keys Management

Starting with release 21.7, you can use the Oracle Key Vault RESTful services utility to create and register SSH keys and manage SSH Server wallets and SSH Server endpoints.

The following Oracle Key Vault RESTful services utility commands have been updated to support the SSH key pair creation and registration of SSH private and public keys:

A new option –ssh-user is added to these commands. Use of this option makes the underlying public and private key objects identified as the SSH keys.

To support the creation of SSH Server endpoint and SSH Server wallet, following commands have been updated:

Changes for Oracle Key Vault Release 21.6

Oracle Key Vault release 21.6 introduces several new features.

Endpoint IP Address Attribute Added to endpoint get RESTful Command

Oracle Key Vault supports endpoint IP address in the endpoint get RESTful command.

The endpoint IP address that was used at enrollment time is now recorded, and displayed with the okv admin endpoint get --endpoint endpoint_name command.

Sign and Verify Operations in Oracle Key Vault

Starting with Oracle Key Vault release 21.6, sign and verify operations can be performed using Oracle Key Vault’s RESTful services, or the Oracle Key Vault client tool okvutil:

Both of the Oracle Key Vault RESTful API and Oracle Key Vault client utility okvutil provide sign and verify functionality.

The new or updated commands are as follows:

Changes for Oracle Key Vault Release 21.5

Oracle Key Vault release 21.5 introduces several new features that affect this guide.

Support for Cluster Management and Monitoring using RESTful Services Utility

Starting in Oracle Key Vault release 21.5, you can deploy, manage, and monitor the multi-master cluster using RESTful services utility.

Using the RESTful services utility, you can now perform several cluster management operations including creating a cluster, adding or deleting a node, enabling or disabling a node. You can also monitor and manage the cluster services and replication links between nodes using RESTful services utility.

The new commands are as follows:

Related Topics

Support for System Resources Monitoring using RESTful Services Utility

Starting in Oracle Key Vault release 21.5, you can obtain the current and historical utilization metrics of the system resources such as CPU and memory using RESTful services utility. These system metrics would help you appropriately configure system resources for the Oracle Key Vault servers to meet the performance and scalability requirements of your deployment.

Using the RESTful services utility, you can obtain the information about the:

The new or updated commands are as follows:

Related Topics

RESTful Services Utility Commands Reduce Need for Intermediate JSON Files

Starting in Oracle Key Vault release 21.5, you can specify custom-attributes and certain KMIP attributes as the command line options when using RESTful services utility to create, register, fetch and locate security objects.

In earlier releases, commands that use the attributes or custom-attributes could only be executed using the JSON input method only. The RESTful services utility is enhanced to support the passing of attributes and custom-attributes as the command line options for the commands to create or register security objects. These commands also support simplified variants of the complex input.

The KMIP attributes “activation date” and “deactivation date” are exposed as the command line options --activation-date and --deactivation-date respectively. You can pass the custom-attributes using the new command line option –custom-attribute. Several RESTful services utility commands also support simplified and complex format on name and custom attribute.

The following commands have been updated to accommodate this enhancement:

Related Topics

Support for Text Output Format in RESTful Services Utility

Starting in Oracle Key Vault release 21.5, several RESTful services utility commands are enhanced to support the output in the text format.

In previous releases, the RESTful services utility commands always produced output in the JSON format. Now, you can use the new command line option -output_format to generate the command output in the text format. The text output format helps simplify the creation of automation scripts such as when the output of a command serves as input for another command.

Supported values for the –output_format option are:

The following commands have been updated to accommodate this enhancement:

Related Topics

Changes for Oracle Key Vault Release 21.4

Oracle Key Vault release 21.4 introduces several new features that affect this guide.

RESTful Services Utility Commands to Support the Extractable Attribute for Symmetric Encryption Keys

Starting in Oracle Key Vault release 21.4, to strengthen the protection of symmetric keys, you now can restrict these keys from leaving Oracle Key Vault by setting the extractable attribute.

The following commands have been updated to accommodate this enhancement:

Related Topics

Support for Cryptographic Operations in RESTful Services Utility

Oracle Key Vault release 21.4 adds the support for performing cryptographic operations within Oracle Key Vault.

You can use either RESTful services utility commands or C and Java SDK to perform encryption and decryption operations.

This enhancement accommodates the use of symmetric keys that have been configured to not be extracted from Oracle Key Vault.

The new commands are as follows:

Related Topics

Support for Policy Based Automatic Purging of Old Oracle Key Vault Backups in RESTful Services Utility

Starting in Oracle Key Vault release 21.4, you can create a policy to schedule the removal of one or more remote backups.

The following commands have been updated:

The following commands are new:

Related Topics

Enhancements to Endpoint, Endpoint Group, and Wallet-Related RESTful Services Utility Commands

Starting in Oracle Key Vault release 21.4, additional commands are available to enable you to perform more operations with endpoints, endpoint groups, and wallets.

The new commands are as follows:

The commands to list objects for an endpoint (okv admin endpoint list-objects) and a wallet (okv admin wallet list-objects) provide an option to show or hide the wallet membership of the objects. Omitting wallet membership information of objects can improve command’s performance.

Related Topics

Support Endpoint Configuration Using the RESTful Services Utility

Starting in Oracle Key Vault release 21.4, you can update the endpoint configuration parameters and endpoint settings for keys and secrets of an endpoint using the RESTful service utility command okv admin endpoint update.

The endpoint configuration parameters includes various PKCS#11 settings and endpoint settings for keys and secrets includes the extractable attribute setting for the new symmetric keys.

Related Topics

RESTful Commands to Set Date and Time Accommodate ISO 8601 Standard

Starting in Oracle Key Vault release 21.4, the duration time interval settings will follow a subset of the ISO 8601 standard, and the fixed format for date and time settings are compatible with ISO 8601 when using RESTful commands.

You can specify the following formats:

You can use these formats in the following combinations:

The timestamp format that has been used in previous releases is still supported.

The following commands have been updated for this enhancement:

Related Topics

Support for Command Line Help for the RESTful Services Utility

Starting in Oracle Key Vault release 21.4, you can find the command line help information about the RESTful services utility commands.

This enhancement enables you to find the detailed help information about the various categories, resources, and actions that are supported for all Oracle Key Vault RESTful services utility commands. The help information shows the command’s syntax, and definitions for the available categories, resources, and actions as well as the configuration parameters that are applicable to all the commands.

Related Topics

Changes for Oracle Key Vault Release 21.3

Oracle Key Vault release 21.3 introduces one new feature that affects this guide.

Enhancements for RESTful Services Utility Commands Used for Registration

In Oracle Key Vault release 21.3, RESTful services utility commands that are used for the registration of managed objects will have additional attributes.

The affected commands are as follows:

In previous releases, these commands provided two attributes, name and contactInfo. In this release, in addition to these two attributes, the following new attributes are included:

Related Topics