About TDE encryption feature of oracle

Question

Hi All,
I am facing problems while checking this feature of Encryption,
I created in database1, table1 with user1, coulum1 in the table1 was with encrypt keyword as follows.
create table table1(ID number(3), PHONE number(11) encrypt);
Inserted some rows and selected those rows, it shows them successfully, Ideally it should show the actual data for user1.
gave the select permission to user2 from user1 for table1 as follows:
grant select on table1 to user2;
Now logged in with user2 to same database1.
now when I query the database for table1 as follows:
select * from database1.table1;
It shows all the rows successfully, Ideally it should NOT show the actual data for user2.
Can someone please tell me the solution or explain me the procedure to test it properly.
Thanks in advance,
Nikhil Joshi.

Answer 1

TDE encrypts data when it is on disk "at rest". If a user has SELECT access to the data in question, TDE will transparently (hence the T) decrypt the data. TDE will never present any user with encrypted data-- either the user does not have privileges to select the data in the first place or they do and TDE will decrypt it.
If you want to limit what data a particular user can access, you'd either want to do that conventionally by, for example, creating a view on the table that does not have the phone number and only granting access on that view to user2. Or, assuming you're using 11.2, you could create a VPD policy that limits what columns a particular user can see. A VPD policy would generally make sense if you wanted to allow user2 to see the phone number for some rows but not others.
Justin