11g encrypted tablespace tips

Question:  What is the 11g encrypted tablespace and how does it differ from transparent data encryption?

 Answer:  The 11g tablespace encryption is the next evolution of the 10g transparent data encryption (TDE).  See here for the  history of Oracle encryption. and details on Oracle transparent data encryption.

TDE had serious limitations, it could not do range scans, and there were primary/foreign key issues.
 
The 11g tablespace encryption supports many encryption algorithms including 3DES168, AES128. AES192, and AES256.

Transparent (Tablespace) Encryption is part of the extra cost Advanced Security Option and it works using the new 11g encryption clause of the create tablespace command.

Here is a demonstration of how 11g encrypted tablespaces work to hide data.

create tablespace
   encrypted
datafile
    '/…/encrypted.dbf' size 10m
    ENCRYPTION default storage( encrypt );

Tablespace created.
create tablespace
   clear
datafile
   '/…/clear.dbf' size 10m;

Tablespace created.
-- Assign a table to the clear tablespace
 
create table t tablespace clear
    as select * from all_users;
 
Table created.
 
create index t_idx on t(lower(username))
  tablespace clear;
 
Index created.
-- Use “strings” to see inside a dbf
 
alter system checkpoint;
 
System altered.
 
$ strings /…/clear.dbf | grep -i ops.mculp
        OPS$             from the table
        ops$              from the index
-- add table to encrypted tablespace
 
alter table t move tablespace encrypted;
Table altered.
 
alter index t_idx rebuild tablespace encrypted;
Index altered.
-- cannot see anything with strings or grep:
 
alter system checkpoint;
 
System altered.
 
$ strings /…/encrypted.dbf | grep -i ops

Guarantee your Success! Oracle is the world's most complex, robust and flexible database, considered impossible to master without a mentor. That's why all BC Oracle trainers are working professionals, experts in Oracle who share their tips and secrets.

Burleson is the American Team Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum. Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications. Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:  and include the URL for the page.                      Burleson Consulting The Oracle of Database Support Oracle Performance Tuning Remote DBA Services   Copyright ? 1996 -  2012  All rights reserved. Oracle ? is the registered trademark of Oracle Corporation.