Verify Master Encryption Key

This section provides information on how to verify the master encryption key (v$encryption_keys).

To verify Master Key, run the following sample query:

Sample:

select key_id,creation_time,key_use,keystore_type,origin,con_id from v$encryption_keys order by CREATION_TIME desc;

v$encryption_keys supports up to 0.5 million keys in CipherTrust Manager LTS version 2.11.1 and higher.

Understanding the DATA_OBJECT_SUPPORTED_IDEN Object

When using Oracle TDE with CipherTrust Manager, you may encounter an opaque object named DATA_OBJECT_SUPPORTED_IDEN. This section answers common questions about this object and its management.

1. What is the DATA_OBJECT_SUPPORTED_IDEN object?

   DATA_OBJECT_SUPPORTED_IDEN is an opaque object automatically created by Oracle within CipherTrust Manager the first time the Oracle TDE keystore is opened. It is a one-time creation; if the object already exists, a new one will not be created.

2. What is its role in CipherTrust Manager?

   This object is essential for the proper functioning of the Oracle V$ENCRYPTION_KEYS view. Oracle uses this object to query key metadata from CipherTrust Manager. If this object does not exist or is inaccessible, the functionality of the V$ENCRYPTION_KEYS view may be impacted.

3. How is its owner assigned?

   The owner of the DATA_OBJECT_SUPPORTED_IDEN object is the same CipherTrust Manager user that was used to initially open the Oracle keystore.

4. What is the impact of changing the owner?

   Changing the owner of the DATA_OBJECT_SUPPORTED_IDEN object is not recommended. This action will cause the V$ENCRYPTION_KEYS view to stop working.

5. What happens if the owner of DATA_OBJECT_SUPPORTED_IDEN is deleted?

   Deleting the owner of this object can have severe consequences. If the deleted user is also the owner of the Master Encryption Key (MEK), the Oracle wallet may be closed. This will prevent all cryptographic operations, potentially leading to database downtime.

6. What should be done if the DATA_OBJECT_SUPPORTED_IDEN object is accidentally deleted?

   If the DATA_OBJECT_SUPPORTED_IDEN object is deleted from CipherTrust Manager, you can recover by closing and then re-opening the Oracle wallet.

   -- Close the wallet
   ADMINISTER KEY MANAGEMENT SET KEYSTORE CLOSE IDENTIFIED BY "<cm_user:cm_user_password>";
   -- Re-open the wallet
   ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "<cm_user:cm_user_password>";
   

   During the re-opening process, Oracle detects that the object is missing and automatically sends a request to CAKM for Oracle TDE to recreate it on CipherTrust Manager. After this is complete, the V$ENCRYPTION_KEYS view will function correctly again.

7. How can other users view v$encryption_keys?

   To allow multiple CipherTrust Manager users with Key_User privileges to view the v$encryption_keys, they must be granted permissions on the DATA_OBJECT_SUPPORTED_IDEN object. The recommended way to do this is:

   1. Create a group in CipherTrust Manager.

   2. Add the desired users to this group.

   3. Grant this group Read, Use, and Export permissions on the DATA_OBJECT_SUPPORTED_IDEN object.