Oracle Encryption Wallet
Version 12.2

General Information
Library Note Morgan's Library Page Header
Which has the higher priority in your organization: Deploying a new database or securing the ones you already have? Looking for a website, and resources, dedicated solely to securing Oracle databases? Check out DBSecWorx.
Be sure to view the full listing of monographs in Morgan's Library
Secure storage of encryption keys and certificates
Data Dictionary Objects
CDB_WALLET_ACES GV$ENCRYPTION_WALLET NACL$_WALLET_EXP_TBL
CDB_WALLET_ACLS GV$WALLET USER_WALLET_ACES
DBA_WALLET_ACES NACL$_WALLET V$ENCRYPTION_WALLET
DBA_WALLET_ACLS NACL$_WALLET_EXP V$WALLET
Exceptions
Error Code Reason
ORA-28353 Wallet did not open
ORA-28354 Encryption wallet, auto login wallet, or HSM is already open
ORA-28368 Can not autocreate wallet
ORA-28390 Auto login wallet not open but encryption wallet may be open
Topics
Create Infrastructure KEYSTORE WALLET
 
Create: Operating System Level
Create directory mkdir $ORACLE_BASE\admin\<SID>\wallet
-- Note: This step is identical with the one performed with SECUREFILES. If a wallet already exists skip this step.

host

mkdir $ORACLE_BASE\admin\orabase\wallet

exit
Alter SQLNET.ORA file -- Note: This step is identical with the one performed with SECUREFILES. If a wallet already exists skip this step.

 # sqlnet.ora Network Configuration File: c:\app\oracle\product\12.2.0\dbhome_1\network\admin\sqlnet.ora
# Generated by Oracle configuration tools.

# This file is actually generated by netca. But if customers choose to
# install "Software Only", this file wont exist and without the native
# authentication, they will not be able to connect to the database on NT.

SQLNET.AUTHENTICATION_SERVICES= (NTS)

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

ENCRYPTION_WALLET_LOCATION=
(SOURCE=
(METHOD=FILE)
(METHOD_DATA= (DIRECTORY=c:\app\oracle\admin\orabase\wallet)))

-- Note: if you do not use this wallet location expect ORA-28368: cannot auto-create wallet when setting the key
 
Create: Database Level
Set Encryption Key ALTER SYSTEM SET encryption key authenticated by "<password>";
conn / as sysdba

SQL> show con_name

CON_NAME
------------------------------
CDB$ROOT

ALTER SYSTEM SET ENCRYPTION KEY AUTHENTICATED BY "N0way!";

desc gv$encryption_wallet

col wrl_parameter format a40

SELECT * FROM v$encryption_wallet;
 
KEYSTORE
Create Keystore ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '<keystore_location>'
IDENTIFIED BY <keystore_password>;
Create Autologin Keystore ADMINISTER KEY MANAGEMENT CREATE [LOCAL] AUTOLOGIN KEYSTORE' <keystore_location>'
IDENTIFIED BY <keystore_password>;
Open Keystore ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <keystore_password>
[CONTAINER = <ALL | CURRENT>];
Close Keystore ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE
[IDENTIFIED BY <keystore_password>]
[CONTAINER = <ALL | CURRENT>];
Backup Keystore ADMINISTER KEY MANAGEMENT BACKUP KEYSTORE [USING '<backup_identifier>']
[IDENTIFIED BY <keystore_password>]
TO '<keystore_location>';
Alter Keystore Password ADMINISTER KEY MANAGEMENT ALTER KEYSTORE PASSWORD
[IDENTIFIED BY <old_keystore_password>]
SET <new_keystore_password>]
[WITH BACKUP [USING '<backup_identifier>']];
Merge Into New Keystore ADMINISTER KEY MANAGEMENT MERGE KEYSTORE
'<keystore1_location>' [IDENTIFIED BY <keystore1_password>]
ADD KEYSTORE '<keystore2_location>' [IDENTIFIED BY <keystore2_password>]
INTO NEW KEYSTORE '<keystore3_location>' [IDENTIFIED BY <keystore3_password>];
Merge Into Existing Keystore ADMINISTER KEY MANAGEMENT MERGE KEYSTORE
'<keystore1_location>' [IDENTIFIED BY <keystore1_password>]
INTO EXISTING KEYSTORE '<keystore2_location>' [IDENTIFIED BY <keystore2_password>]
[WITH BACKUP [USING '<backup_identifier>']];
Administer Key Management Syntax ADMINISTER KEY MANAGEMENT <key_management_clauses>
Administer Key Management Syntax ADMINISTER KEY MANAGEMENT <secret_management_clauses>
Create Keystore Administrator for containers 1 and 3
SQL> CREATE USER c##sec_admin IDENTIFIED BY "N0Way!";

User created.

SQL> GRANT create session TO c##sec_admin;

Grant succeeded.

SQL> GRANT syskm TO c##sec_admin;

Grant succeeded.

-- also grant create session
SQL> conn sys@pdbdev as sysdba
Enter password:
Connected.

SQL> GRANT create session TO c##sec_admin;

Grant succeeded.
Create Keystore ADMINISTER KEY MANAGEMENT CREATE [LOCAL] [AUTO_LOGIN] KEYSTORE <'keystore_path_and_location'>
IDENTIFIED BY <password>;
conn / as sysdba

SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE 'c:\apps18\admin\orabase18\wallet' IDENTIFIED BY "N0Way!42";

keystore altered.

SQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN FROM KEYSTORE 'c:\apps18\admin\orabase18\wallet' IDENTIFIED BY "N0Way!";

keystore altered.
Open Keystore ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY <password> [CONTAINER = <ALL | CURRENT>];
conn / as sysdba

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "N0Way!";

keystore altered.

SQL> SELECT * FROM v$encryption_wallet;

WRL_TYPE WRL_PARAMETER                       STATUS             WALLET_TY WALLET_OR FULLY_BAC CON_ID
-------- ----------------------------------- ------------------ --------- --------- --------- ------
FILE     C:\APP2\ORACLE\ADMIN\ORABASE\WALLET OPEN_NO_MASTER_KEY PASSWORD  SINGLE    UNDEFINED      1

-- log in to container 3
SQL> conn sys@pdbdev as sysdba

SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "N0Way!";

SQL> SELECT * FROM v$encryption_wallet;

WRL_TYPE  WRL_PARAMETER  STATUS             WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
--------- -------------- ------------------ ----------- --------- --------- ------
FILE                     OPEN_NO_MASTER_KEY PASSWORD    SINGLE    UNDEFINED      3
Set a Master Key ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY '<keystore_password>']
[WITH BACKUP USING '<backup_name>'
[CONTAINER = <ALL | CURRENT>;
SQL> conn c##sec_admin/"N0Way!"
password:

SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "N0WayIn!" WITH BACKUP USING 'tde_key_backup';
ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "N0Access!" WITH BACKUP USING 'tde_key_backup'
*
ERROR at line 1:
ORA-46671: master key not set in root container

SQL> conn c##sec_admin/"N0Way!"
Connected.

SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "N0WayIn!" WITH BACKUP USING 'tde_key_backup';

keystore altered.

SQL> SELECT * FROM v$encryption_wallet;

WRL_TYPE  WRL_PARAMETER                        STATUS  WALLET_TYPE WALLET_OR FULLY_BAC CON_ID
--------- ------------------------------------ ------- ----------- --------- --------- ------
FILE      C:\APP\ORACLE\ADMIN\ORABASE\WALLET\  OPEN    PASSWORD    SINGLE    NO             1
Close Keystore ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE
[IDENTIFIED BY '<keystore_password>']
[CONTAINER = <ALL | CURRENT>;
SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "N0Access!";

keystore altered.
Drop Keystore ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE
[IDENTIFIED BY '<keystore_password>']
[CONTAINER = <ALL | CURRENT>;
SQL> ADMINISTER KEY MANAGEMENT DROP KEYSTORE IDENTIFIED BY "N0Access!";

keystore altered.
 
WALLET
Open the wallet ALTER SYSTEM SET [ENCRYPTION] WALLET OPEN IDENTIFIED BY <password>;
desc gv$encryption_wallet

col wrl_parameter format a50

SELECT *
FROM gv$encryption_wallet;

ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "N0way!";

-- failure to do so will result in: ORA-28365: wallet is not open
SELECT *
FROM v$encryption_wallet;
Close the wallet ALTER SYSTEM SET WALLET CLOSE;
ALTER SYSTEM SET WALLET CLOSE;

Related Topics
Network Access Control Lists
SecureFiles
Security
Transparent Data Encryption
What's New In 19c
What's New In 20c-21c

Morgan's Library Page Footer
This site is maintained by Dan Morgan. Last Updated: This site is protected by copyright and trademark laws under U.S. and International law. © 1998-2021 Daniel A. Morgan All Rights Reserved
  DBSecWorx