Oracle TDE (Part II): Advanced Encryption and Storage Considerations

  Oracle TDE provides flexible encryption options for both database and tablespace levels. The default encryption standard for database and tablespace encryption is AES128, while AES192 is used for column-level encryption. For added security, a random string, known as SALT, is appended to plaintext before encryption in column-level encryption. SALT enhances security but cannot be applied to indexed columns.

Supported Encryption and Integrity Algorithms

Oracle TDE supports multiple encryption algorithms, including AES, ARIA, GOST, SEED, and DES. To ensure data integrity, the SHA-1 hashing algorithm is used with TDE column encryption.

Encrypting Existing Tablespaces

Before Oracle version 12.1, encrypting an existing non-encrypted tablespace was not possible. To encrypt data in such tablespaces, you needed to create a new encrypted tablespace and migrate the data.

Keystore Management in Multitenant Environments

In a multitenant architecture, you can manage keystores at either the CDB (Container Database) level or for individual PDBs (Pluggable Databases). Oracle supports two management modes:

• Unified Mode: A single keystore is configured for the entire CDB and its associated PDBs.

• Isolated Mode: Separate keystores and TDE master encryption keys are managed for each PDB. This mode allows different keystore types for isolated PDBs.

Oracle TDE Storage Overhead: What You Need to Know

When implementing TDE, be aware of the associated storage overhead:

1. Column Encryption Overhead

Padding: Encryption involves mandatory padding, adding between 8 and 16 bytes to each value, depending on the encryption algorithm.

Integrity Check: An optional 20-byte overhead can be added for integrity checking. This can be avoided with the 'NOMAC' option.

SALT: If SALT is used, expect an additional 16-byte overhead. This can be bypassed with the 'NO SALT' option.

2. Tablespace Encryption Overhead

No Overhead: TDE tablespace encryption does not add any storage overhead, making it a cost-effective method for securing large datasets.

 

Oracle TDE delivers a robust encryption framework that protects your data across various storage and backup scenarios. By understanding how to configure and optimize TDE, you can ensure your data remains secure while maintaining operational efficiency.