TDE HSM SET ENCRYPTION KEY

Applies To

All Users

Summary

It Possible To Migrate The Encryption Keys From A Software Wallet To A HSM And Viceversa ?

Solution

Currently only the migration of the encryption keys from an Oracle wallet to a HSM device is possible. The reverse migration from HSM to wallet is not supported before 12.1.

The procedure to migrate the Encryption keys from a wallet to a HSM is :

1. Set the ENCRYPTION_WALLET_LOCATION parameter in sqlnet.ora:

ENCRYPTION_WALLET_LOCATION=

(SOURCE=(METHOD=HSM)

(METHOD_DATA=

(DIRECTORY=/oracle/TDE_WALLETS/$ORACLE_SID)

)

)

2. Copy the HSM PKCS#11 library to the path specified by the vendor:

/opt/oracle/extapi/32,64/hsm/{VENDOR}/{VERSION}/libapiname.ext

3. Run the following statement :

ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "HSMuser:HSMpassword" MIGRATE USING "wallet_password";

Reverse Migration from HSM device to Oracle Wallet:

1. In 11.2.0 4 : Apply patch 20181737

2. Run : ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "wallet_password" REVERSE MIGRATE USING "HSMuser:HSMpassword";

Note: Starting from 12.1 DB, reverse migration from HSM to Oracle Software wallet is possible.

https://docs.oracle.com/database/121/ASOAG/managing-keystore-and-tde-master-encryption-key.htm#GUID-01C2DB62-E887-4BD9-AFDB-B8772E52A450

Note: In 11.2.0.4 DB, if you are facing ORA-7445 KZTHSMGMK() error while removing HSM wallet and re-doing the TDE configuration using Oracle wallet, then apply patch 20181737

Attachments :

Article Feedback