Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Read the value from Oracle Wallet 
        
(Message started by: Pete Finnigan on Jan 4^th, 2006, 6:53am)

Title: Read the value from Oracle Wallet
Post by Pete Finnigan on Jan 4^th, 2006, 6:53am

Hi,

We are using 10gR2 on Red Hat Enterprise Linux ES release 4 with Multi master replication environment.
I want to encrypt a column using DBMS_CRYPTO package. Here the critical part is storing the encryption key in a secured environment.
To store the encryption key what is the best approach?

Shell I use the Oracle Wallet to store the key, if so how to retrieve the key value from the wallet.
Is there any way to retrieve the key from wallet using PL/SQL programs?

Thanks in advance for any suggestion.

Title: Re: Read the value from Oracle Wallet
Post by Pete Finnigan on Jan 4^th, 2006, 9:07am

Sckkumar,

I'm not sure if storing the encryption key in a wallet is a good idea (for your purpose). And I don't know if there is a kind of API in PL/SQL to access a wallet.
But you could experiment with the mkstore utility to store your encryption keys:

Code:

oracle@Asus:~/Mkstore > mkstore -create -wrl .
Enter password:

Enter password again:

oracle@Asus:~/Mkstore > mkstore -createEntry encryptionkey hetpassword -wrl .
Enter password:

oracle@Asus:~/Mkstore > mkstore -viewEntry encryptionkey -wrl .
Enter password:

encryptionkey = hetpassword

Now you have to device some mechanism to read the wallet value of encryptionkey. I don't think it's easy.

Another, much simpler, way is to store the passwords in a table and encrypt the column with TDE (Transparant Data Encryption). The encrypted column can only be read when the DBA has enabled the wallet. For more information see http://www.oracle.com/technology/pub/articles/10gdba/nanda_10gr2dba_part1.html

Ivan

Title: Re: Read the value from Oracle Wallet
Post by Pete Finnigan on Jan 4^th, 2006, 9:47am

isaez,

Thanks for you comments.

i tried this option.

But to retrive the same from pl/sql is there any option available?

I haven't find any api like that. that y i raised the quiestion.