Oracle PL/SQL for DBAs

Setting Up TDE

Before you start using TDE, you have to set up the wallet where the master key is stored and secure it. Here is a step-by-step approach to wallet management.

1. Set the wallet location.

   When you enable TDE for the first time, you need to create the wallet where the master key is stored. By default, the wallet is created in the directory $ORACLE_BASE/admin/$ORACLE_SID/wallet. You can also choose a different directory by specifying it in the file SQLNET.ORA. For instance, if you want the wallet to be in the /oracle_wallet directory, place the lines in the SQLNET.ORA file as shown here. In this example, I assume that the default location is chosen.

       ENCRYPTION_WALLET_LOCATION =
         (SOURCE=
             (METHOD=file)
             (METHOD_DATA=
                (DIRECTORY=/oracle_wallet)))

   Make sure to include the wallet as a part of your regular backup process.

2. Set the wallet password.

   Now you have to create the wallet and set the password to access it. This is done in one step by issuing:

       ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "pooh";

   This command does three things:

   1. It creates the wallet in the location specified in Step 1.

   2. It sets the password of the wallet as “pooh”.

   3. It opens the wallet for TDE to store and retrieve keys.

   The password is case-sensitive, and you must enclose it in double quotes.

3. Open the wallet.

   The previous step opens the wallet for operation. However, after the wallet is created once, you do not need to re-create it. After the database comes up, you just have to open it using the same password via the ...