Oracle PL/SQL for DBAs

Conclusion

In this chapter, we have looked at encryption, key management, hashing, and related concepts. Let’s summarize the key concepts here: Encryption of data is the disguising of the data so its true meaning is not visible. It requires three basic ingredients—the input data, an encryption key, and an encryption algorithm. There are two fundamental methods of encryption: asymmetric or public key encryption, where the keys used to encrypt and decrypt are different; and symmetric key encryption, where the keys are the same. The former is typically used in data transmission and requires elaborate setup, while the latter is relatively simple to implement.

The most important and challenging aspect of building an encryption infrastructure is not using the APIs themselves, but building a reliable and secure key-management system. There are a variety of different ways to do that: you can use the database, the filesystem, or both as a key store. You can use a single key for the entire database, one key per row of the table, or something in between. You can use two different keys: one regular key stored somewhere and a master key stored at a different location. The key that is used to encrypt data is not the one stored, but is a bitwise XOR operation of the master and stored keys. If either one is compromised, the encrypted data still cannot be decrypted unless the other one is accessible as well.

Sometimes it is not necessary to hide data, but we nevertheless have to ensure that it has ...