缺少 Oracle Database 11g TDE 主密钥的文档
我浏览了整套“Oracle Database 11g 第 2 版 (11.2) 文档”，寻找用于 HSM 透明数据加密 (TDE) 的主加密密钥的详细信息。整套文档中只有一行无关紧要的内容说它使用了 AES。
令我惊讶的是，没有提及 AES 模式（CBC、ECB 等）以及使用以下命令生成的主密钥的密钥长度，而这对于大多数人来说可能是重要信息。我错过了什么吗？有人有什么想法吗？
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "user_Id:password"
I have looked through the whole set of "Oracle Database 11g Release 2 (11.2) Documentation" searching for the details of the master encryption key used for transparent data encryption (TDE) with HSM. There was only a single insignificant line out of the whole set of documentation that says it makes use of AES.
What surprised me was that no word was mentioned of the AES mode (CBC, ECB, etc) and the key length for the master key that was generated using the following command when it could have been important information for most. Did I miss something? Does anybody has any ideas?
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "user_Id:password"
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
以下答案引自Oracle论坛。
“Oracle TDE 通过 PKCS#11 专门要求 HSM 生成 AES256 密钥。”
The following answer is as quoted from Oracle Forum.
"Oracle TDE asks the HSM via PKCS#11 specifically to generate an AES256 key."
获取 Oracle 数据库高级安全管理员指南 11g R2 (E10746-02)：
http://www.foodpicky.com/download/docs/Oracle/Oracle_ASO_AdminGuide_11gR2_e10746.pdf
Get the Oracle Database Advanced Security Administrator Guide 11g R2 (E10746-02):
http://www.foodpicky.com/download/docs/Oracle/Oracle_ASO_AdminGuide_11gR2_e10746.pdf
密钥加密密钥始终应该等于或长于数据加密密钥；因此，TDE 主密钥始终是 AES、ARIA、SEED（仅 128）和 GOST 中最长的。此外，Oracle 不支持第 3 方 HSM。
key encryption keys are always supposed to equal to or longer than data encryption keys; hence TDE master keys are always the longest of AES, ARIA, SEED (only 128) and GOST. Furthermore, 3rd party HSMs are not supported by Oracle.