Configuring Network Encryption

You can configure network encryption by using either Oracle Net Manager or by editing the sqlnet.ora file. This guide explains how to use Oracle Net Manager to configure network encryption.

To configure network encryption: 

1. On the server computer, start Oracle Net Manager.

   • UNIX: From $ORACLE_HOME/bin, enter the following at the command line:

     netmgr
     

   • Windows: From the Start menu, click All Programs. Then, click Oracle - HOME_NAME, Configuration and Migration Tools, and then Net Manager

2. From the Oracle Net Configuration navigation tree, expand Local, and then select Profile.

3. From the list, select Oracle Advanced Security.

4. Under Oracle Advanced Security, select the Encryption tab.

   The Encryption settings pane appears.

5. Enter the following settings:

   • Encryption: From the list, select SERVER to configure the network encryption for the server. (For the client computer, you select CLIENT.)

   • Encryption Type: Select from the following values to specify the actions of the server (or client) when negotiating encryption and integrity:

     • accepted: Service will be active if the other side of the connection specifies either required or requested, and there is a compatible algorithm available on the receiving database; it will otherwise be inactive.

     • rejected: Service must not be active, and the connection will fail if the other side requires any of the methods in this list.

     • requested: Service will be active if the other side of the connection specifies either accepted, required, or requested, and there is a compatible algorithm available on the other side. Otherwise, the service is inactive.

     • required: Service must be active, and the connection will fail if the other side specifies rejected, or if there is no compatible algorithm on the other side.

   • Encryption Seed: Enter a random string of up to 256 characters. Oracle Database uses the encryption seed to generate cryptographic keys. This is required when either encryption or integrity is enabled.

     If you choose to use special characters such as a comma [,] or a right parenthesis [)] as a part of the Encryption Seed parameter, enclose the value within single quotation marks.

   • Available Methods: Select one or more of the following algorithms, and use the move button (>) to move them to the Selected Methods list. The order in which they appear in the Selected Methods list determines the preferred order for negotiation. That is, the first algorithm listed is selected first, and so on.

     • AES256: Advanced Encryption Standard (AES). AES was approved by the National Institute of Standards and Technology (NIST) to replace Data Encryption Standard (DES). AES256 enables you to encrypt a block size of 256 bits.

     • RC4_256: Rivest Cipher 4 (RC4), which is the most commonly used stream cipher that protects protocols such as Secure Sockets Layer (SSL). RC4_256 enables you to encrypt up to 256 bits of data.

     • AES192: Enables you to use AES to encrypt a block size of 192 bits.

     • 3DES168: Triple Data Encryption Standard (TDES) with a three-key option. 3DES168 enables you to encrypt up to 168 bits of data.

     • AES128: Enables you to use AES to encrypt a block size of 128 bits.

     • RC4_128: Enables you to use RC4 to encrypt up to 128 bits of data.

     • 3DES112: Enables you to use Triple DES with a two-key (112 bit) option.

     • DES: Data Encryption Standard (DES) 56-bit key. Note that National Institute of Standards and Technology (NIST) no longer recommends DES.

     • RC4_40: Enables you to use RC4 to encrypt up to 40 bits of data. (Not recommended.)

     • DES40: Enables you to use DES to encrypt up to 40 bits of data. (Not recommended.)

6. From the File menu, select Save Network Configuration, and then select Exit to exit Oracle Net Manager.

7. Repeat these steps for each client computer that connects to the server.