Comments on: Add TDE to Oracle Database and upload keys to OKV

By: M. Mateen

M. Mateen — Fri, 25 Oct 2024 10:37:00 +0000

Alexandre Nestor,
As per your suggested configuration, there are two wallets OKV (Primary) and FILE (Secondary). I want to remove local wallet (FILE/ Secondary) after migration and want to keep only OKV for online authentication. Can you help what else configuration will be required

By: Alexandre Nestor

Alexandre Nestor — Wed, 22 Nov 2023 17:26:25 +0000

In reply to Nkec.

You are right. The step is missing. As I tried several time, and root.sh is to be executed only one time, I skipped the step. Thank’s for the remark. I will add it.
The root-sh copy the liborapkcs.so library to /opt/oracle/extapi/64/hsm/oracle/1.0.0 (on unix like platform). This library is used by in the communication between Oracle Database and. If the KEYSTORE_CONFIGURATION=FILE then OKV is not used.
Besides, in my opinion OKV is a long term wallet backup solution. In case of rekey, OKV keep the trace of the old key. In case of KEYSTORE_CONFIGURATION=FILE you have to manage it by yourself, which can be tricky.

By: Nkec

Nkec — Wed, 22 Nov 2023 16:37:53 +0000

Hi Alexandre,

Thank you for very usefull okv posts.

Have you executed root.sh after db endpoint enrollment (Copying PKCS library)?
(This step is missing in the post)

My understanding:
PKCS library is needed for ‘tde online’ encription . (KEYSTORE_CONFIGURATION=OKV|FILE)
PKCS library is not needed if okv is used only for ‘long term wallet backup’ . (KEYSTORE_CONFIGURATION=FILE; okv is used to upload/download wallet).

Best regards.

By: Alexandre Nestor

Alexandre Nestor — Mon, 06 Nov 2023 18:55:16 +0000

In reply to Sriram.

Hi Siriam, The blogs doesn’t show the error that I had and the pain to make it work, only the successfully commands :). But it works… Good luck and if I can help do not hesitate…

By: Sriram

Sriram — Mon, 06 Nov 2023 17:29:32 +0000

Thanks Alexandre, excellent blog.

I am trying to set this up without rest api, and having lot of issues, currently have a oracle SR open, if that is not resolved soon will try your steps.

By: Alexandre Nestor

Alexandre Nestor — Mon, 06 Nov 2023 14:17:24 +0000

In reply to Casi. Hello Casi, thank'you for the sugestion. The post is how to bring TDE configuration to OKV. I supposed in this one that the OKV cluster is correctly installed and configured. I will make another post to explain how to build an OKV cluster. Best regards.

By: Casi

Casi — Mon, 06 Nov 2023 07:17:05 +0000

Thanks for the blog post, very informative. As it’s crucial not to loose encryption keys, I would add that in the proposed setup, OKV in a standalone (single server) setup is a single point of failure. It’s recommended to either implement
a) multi-master clusters deployment (see https://docs.oracle.com/en/database/oracle/key-vault/21.7/okvag/multimaster_concepts.html#GUID-AFB5DF9F-7F72-4A40-ADB8-1401F38B33E7 ) – it’s the same replication principle as Oracle Unified Directory uses to ensure high-availability.
b) primary-standby configuration (active/passive servers – see https://docs.oracle.com/en/database/oracle/key-vault/21.7/okvag/okv_primary_standby.html#GUID-6FEDBFCC-7914-43B8-80DB-C427A44AFC35 )
c) at least a backup/restore configuration (scp over ssh to to a backup location is proposed – see https://docs.oracle.com/en/database/oracle/key-vault/21.7/okvag/backup_restore.html#GUID-0F86F274-D887-4AD0-9CDB-DF30F8E98C99 )