Re: Transparent Data Encryption

"EdStevens" <quetico_man_at_yahoo.com> wrote in message news:1146662837.790352.160120_at_i40g2000cwc.googlegroups.com...
> So, it sounds like I don't need a certificate to do this, but I do need
> to back out and start over. To do that, it seems that I should
>
> 1) decrypt the columns I have currently encrypted with my current key
> 2) get rid of the current wallet, located at
> ORACL_HOME\admin\<sid>\wallet (is this as simple as deleting the
> current wallet file? I don't find any sql syntax that looks like it
> would reverse the 'ALTER SYSTEM SET ENCRYPTION KEY....')
> 3) use Wallet Manager to create a new key and wallet
> 4) encrypt the designated columns.
>
> sanity check?
>

I believe you can get away with this sequence:

1. open TDE wallet in OWM (answer "Yes" to "Your default wallet directory doesn't exist. Do you want to continue?" question you get when you select Wallet|Open... and browse to $ORACLE_HOME\admin\$ORACLE_SID\wallet .
2. Make it "autologin" by checking Auto Login checkbox in Wallet menu and save the wallet. This should create .sso file and Oracle then should be able to open the wallet automagically on startup. Now, if someone steals your wallet along with the database itself, encryption will be of no use because they don't need to know the wallet password to be able to open it, but your exports and backups should be safe.

--
   Vladimir M. Zakharychev
   N-Networks, makers of Dynamic PSP(tm)
   http://www.dynamicpsp.com