Step 2: Create the Wallet

To create the wallet, use the ALTER SYSTEM SQL statement. By default, the Oracle wallet stores a history of retired master keys, which enables you to change them and still be able to decrypt data that was encrypted under an old master key. A case-sensitive wallet password unknown to the database administrator provides separation of duty: The database administrator might be able to restart the database, but the wallet is closed and must be manually opened by a security administrator before the database can encrypt or decrypt the data.

To create the wallet:  

1. In SQL*Plus, connect as a user with administrative privileges, such as SYS, or as a security administrator.

   For example:

   CONNECT SYSTEM
   Enter password: password
   

2. Enter the following ALTER SYSTEM statement, where password is the password you want to use to protect the Oracle wallet:

   ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "password";
   

   Enclose the password in double quotation marks. As with other passwords that you create in Oracle Database, the password does not appear in clear text or in any dynamic views or logs.

   This statement generates the wallet with a new encryption key and sets it as the current transparent data encryption master key. If you plan to use public key infrastructure (PKI) to configure the master encryption key, then specify a certificate ID, which is an optional string that contains the unique identifier of a certificate stored in the Oracle wallet. Use the following syntax:

   ALTER SYSTEM SET ENCRYPTION KEY certificate_ID IDENTIFIED BY "password";