Qlik Replicate: How to get encryption keys in Oracle

[lyka]

To specify the correct encryption key(s) used for TDE tablespace encryption or TDE column encryption,  you first need to find the relevant entry (or entries in the case of multiple keys) in the Oracle Wallet containing the encryption key(s). After you find the relevant entry or entries, copy the entry and its value (or entries and values if more than one) into the Names and Values fields respectively.

Resolution

All steps need to be carried out with Oracle tools. Consulting with your database administrator.

Use mkstore (Oracle tools) to retrieve the key name and value:

1. Find the wallet location from SQLNET.ORA
   
   ENCRYPTION_WALLET_LOCATION=
   (SOURCE=(METHOD=FILE)(METHOD_DATA=
   (DIRECTORY=C:\app\Administrator\product\11.2.0\wallet)))
   
   
2. Default wallet file name is ewallet.p12
3. Find utility under Oracle's BIN folder
   
   mkstore -wrl <wallet location> -list
   
   Example:
   
   C:\app\Administrator\product\11.2.0\dbhome_1\BIN>mkstore -wrl C:\app\Administrator\product\11.2.0\wallet\ewallet.p12 -list
   
   Oracle Secret Store Tool : Version 11.2.0.1.0 - Production
   Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.
   
   Enter wallet password:
   
   Oracle Secret Store entries:
   
   ORACLE.SECURITY.DB.ENCRYPTION.AZ/TmY8w/U+avzy6WaFuVtUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
   ORACLE.SECURITY.TS.ENCRYPTION.BZNJRjDLNauhStemoL881TwCAwAAAAAAAAAAAAAAAAAAAAAAAAAA
   
   

4. We now obtain the Master Key.
   
   Use mkstore utility with viewEntry option to get the value of Master Key.
   
   mkstore -wrl <wallet location> -viewEntry <Master Key>

   C:\app\Administrator\product\11.2.0\dbhome_1\BIN>mkstore -wrl
   C:\app\Administrator\product\11.2.0\wallet\ewallet.p12 -viewEntry ORACLE.SECURITY.DB.ENCRYPTION.AZ/TmY8w/U+avzy6WaFuVtUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

   Oracle Secret Store Tool : Version 11.2.0.1.0 - Production

   Copyright (c) 2004, 2009, Oracle and/or its affiliates. All rights reserved.

   ===

   ORACLE.SECURITY.DB.ENCRYPTION.AZ/TmY8w/U+avzy6WaFuVtUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AEMAASAAUMCtL4/HKmd+004l+LZTd7Kr9vs1u8SekOj/OPuJVJQDEACeDhlMpgOn7YhqqhPS7foWBQcAeHUFGQ8zLw==
   
   

5. Encryption entries of Qlik Replicate
   
   Name (length 82)
   ORACLE.SECURITY.DB.ENCRYPTION.AZ/TmY8w/U+avzy6WaFuVtUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
   
   Value (length 92)
   AEMAASAAUMCtL4/HKmd+004l+LZTd7Kr9vs1u8SekOj/OPuJVJQDEACeDhlMpgOn7YhqqhPS7foWBQcAeHUFGQ8zLw==

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

[EdSan]

Hi, do you know how we can obtain encryption keys when the wallet is stored within ASM?