Oracle table encryption in 11gR2

Question

Hi All,
I was trying to encrypt a column in a table but still i would able to see the data in normal format
See the below example which i tried
SQL> create table ENC.TEST_INDUSTRY_ENC as select * from ENC.INDUSTRY;
Table created.
SQL> desc TEST_INDUSTRY_ENC
Name Null? Type
M_ROW$$ VARCHAR2(18)
ID NOT NULL NUMBER
INDUSTRY_NAME NOT NULL VARCHAR2(4000)
SQL> alter table TEST_INDUSTRY_ENC Modify(ID encrypt SALT);
Table altered.
SQL> desc TEST_INDUSTRY_ENC
Name Null? Type
M_ROW$$ VARCHAR2(18)
ID NOT NULL NUMBER ENCRYPT
INDUSTRY_NAME NOT NULL VARCHAR2(4000)
SQL> select id from TEST_INDUSTRY_ENC where rownum < 10;
ID
604
605
607
625
608
626
310
602
304
Please let me know how can i achieve it
Thanks,
Bhanu Sanam

Answer 1

TDE is Transparent Data Encryption. The whole point is that data is stored encrypted on disk and decrypted on the fly when a user with access to the data issues a query. So what you're seeing is the expected behavior.
Rather than use TDE, you could use the DBMS_CRYPTO package to encrypt the data (you'd want to declare the encrypted column as a RAW(n) rather than a VARCHAR2(n)). You would then have to call the DBMS_CRYPTO package again to decrypt it. If you handle the encryption yourself, however, you'll have to solve the key management problem which tends to be rather hard.
If you store the key in the database, you don't end up adding much, if any, security. You can restrict the ability of a user to call your decrypt routine, but if you're going to rely on that, you'd have more control if you restricted their ability to SELECT the data in the first place. And once the user has the ability to call the decrypt routine, they can decrypt any of the encrypted data so you lose the fine-grained control you have when granting object-level permissions on the data. Plus it becomes harder to figure out who has access to sensitive data.
If you store the key outside the database, you have to figure out how to back it up since losing the key would make all the data unrecoverable. And how to secure the key from the various systems admins/ developers/ DBAs/ etc. that would have access to whatever systems store the key, retrieve the key, etc.
Justin