Skip Headers

Oracle® Databa se Advanced Security Administrator's Guide 10g Release 1 (10.1) Part Number B10772-01

Home Book List Contents Index Master Index Feedback< /font>

---

Previous Next

View PDF

How To Configure Data Encryption and Integrity

This section describes how to configure Oracle Advanced Security native Oracle Net Services encryption and integrity, and presumes the prior installation of Oracle Net Services.

The network or security admini strator sets up the encryption and integrity configuration parameters. The profile on client and server systems using data encryption and integrity (sqlnet.ora file) must contain some or all of the parameters listed in this section, under the following topics:

• About Activating Encryp tion and Integrity
• About Negotiating Encryp tion and Integrity
• Setting the Encryption S eed (Optional)
• Configuring Encryption and I ntegrity Parameters Using Oracle Net Manager

  See Also: Chapter 7, "Configu ring Secure Sockets Layer Authentication", to configure the SSL feature for encryption, integrity, and authentication

About Activating Encryption and Integrity

In any netwo rk connection, it is possible for both the client and server to each support more than one encryption algorithm and more than one int egrity algorithm. When a connection is made, the server selects which algorithm to use, if any, from those algorithms specified in th e sqlnet.ora files.

The server searches for a match between the algorithms available on bot h the client and the server, and picks the first algorithm in its own list that also appears in the client list. If one side of the c onnection does not specify an algorithm list, all the algorithms installed on that side are acceptable. The connection fails with err or message ORA-12650 if either side specifies an algorithm that is not installed.

Encryption and integrity parameters are defined by modifying a sqlnet.ora file on the clients and the servers on the network.

You can choose to configure any or all of the available Oracle Advanced Security encryption al gorithms (Table 3-2), and either or both of the available integrity algorithms (Table 3-3). Only one encryption algorithm and one integrity algorithm are used for each connect session.

About Negotiating Encryption and Integrity

To negotiate whether to turn on encryption or integrity, you can specify four p ossible values for the Oracle Advanced Security encryption and integrity configuration parameters. The four values are listed in the order of increasing security. The value REJECTED provides the minimum amount of security between client and s erver communications, and the value REQUIRED provides the maximum amount of network security:

• REJECTED
• ACCEPTED
• REQUESTED
• REQUIRED

The default value for each of the parameters is ACCEPTED.

REJECTED

Select this value if you do not elect to enable the security service, even if required by the ot her side.

In this scenario, this side of the connection specifies that the security service is not permitted. If the other side is set to REQUIRED, the connection terminates with error message O RA-12650. If the other side is set to REQUESTED, ACCEPTED, or REJECTED, the connection continues without error and without the security service enabled.

ACCEPTED

Select this value to enable the security service if required or requested by the other side.

In this scenario, this side of the conn ection does not require the security service, but it is enabled if the other side is set to REQUIRED or REQUESTED. If the other side is set to REQUIRED or REQUESTED, and an encryption or integrity algorithm match is found, the connection continues without error and with the security service enabled. If the other side is set to REQUIRED and no algorithm match is found, the connection terminates wi th error message ORA-12650.

If the other side is set to REQUESTED and no algor ithm match is found, or if the other side is set to ACCEPTED or REJECTED, the connection continues without error and without the secu rity service enabled.

REQUESTED

Select this value to enable the security serv ice if the other side permits it.

In this scenario, this side of the connection specifies t hat the security service is desired but not required. The security service is enabled if the other side specifies ACCEPTED, REQUESTED , or REQUIRED. There must be a matching algorithm available on the other side--otherwise the service is not enabled. If the other sid e specifies REQUIRED and there is no matching algorithm, the connection fails.

REQUIRED

Select this value to enable the security service or preclude the connection.

In this scenario, this side of the connection specifies that the security service must be ena bled. The connection fails if the other side specifies REJECTED or if there is no compatible algorithm o n the other side.

Table 3-1 shows whether the secur ity service is enabled, based on a combination of client and server configuration parameters. If either the server or client has spec ified REQUIRED, the lack of a common algorithm causes the connection to fail. Otherwise, if the service is en abled, lack of a common service algorithm results in the service being disabled.

Table 3-1 Encrypti on and Data Integrity Negotiations

REQUESTED

REQUIRED

Setting the Encryption Seed (Optional)

Several seeds are used to generate a random number on the client and on the server. One of the seed s that can be used is a user-defined encryption seed. This is set with the sqlnet.crypto_seed parameter in the sql net.ora file. It can be 10 to 70 characters in length and changed at any time. The Diffie-Hellman key exchange uses the random numbers to generate unique session keys for every connect session.

Configuring Encryption and Integrity Parameters Using Oracle Net Manager

Figure 3-1 Oracle Advanced Security Encryption Window

Text description of the illustration asoencry.gif

2. Choose the Encryption tab.
3. Depending upon which system you are configuring, select CLIENT or SERVER from the pull-down list.
From the Encryption Type list, select one of the following:
• REQUESTED
• REQUIRED
• ACCEPTED
• REJECTED
5. (Optional) In the Encryption Seed field, ente r between 10 and 70 random characters; the encryption seed for the client should not be the same as that for the server.
6. Select an encryption algorithm in the Available Methods list. Move it to the Selected Methods list by choosing the right arrow [>]. Repeat for each additional method you want to use.
7. Choose File > Save Network Configuration. The sqlnet.ora file is upd ated.
8. Repeat this procedure to configure encryption on the other system . The sqlnet.ora file on the two systems should contain the following entries:
   • On the server:

     SQLNET.ENCRYPTION_SERVER = [acce
     pted | rejected | requested | required]
     SQLNET.ENCRYPTION_TYPES_SERVER = (valid_encryption_algorithm [,valid_
     encryption_alg
     orithm])
     

   • On the c lient:

     SQLNET.ENCRYPTION_CLIENT = [accepted | reje
     cted | requested | required]
     SQLNET.ENCRYPTION_TYPES_CLIEN
     T = (valid_encryption_algorithm [,valid_
     encryption_algorithm])
     
     

   Valid encryption algorithms and their associated legal values are summarized by Table 3-2:

   Table 3-2 Valid Encryption Algorithms

   Algorithm Name	Legal Value
   RC4 256-bit key	RC4_256
   RC4 128-bit key	RC4_128
   RC4 56-bit key	RC4_56
   RC4 40-bit key	RC4_40
   AES 256-bit key	AES256
   AES 192-bit key	AES192
   AES 128-b it key	AES128
   3-key 3DES	3DES168
   2-key 3DES	3DES112
   DES 56-bit key	DES
   DES 40-bit key	DES40

   Configuring Integrity on the Client and the Server

   Use Oracle Net Manager to configure data integrity on the client and on the server (See "Starting Oracle Net Manager"):

   1. Navigate to the Oracle Advance d Security profile. (See "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security tabbed window appears (Figure 3-2):

   Figure 3-2 Oracle Advanced Security Integrity Wind ow

   

   Text description of the illustration cfig0002.gif

   2. Choose the Integrity tab.
   3. Depending upon which system you are configuring, choose the Server or Client< /strong> check box.
   4. From the Checksum Level list, select one of the following checksum level values:
      • REQUE STED
      • REQUIRED
      • ACCEPTED< /li>
      • REJECTED
   5. < /a>Select an integrity algorithm in the Available Methods list. Move it to the Sel ected Methods list by choosing the right arrow [>]. Repeat for each additional method you w ant to use.
   6. Choose File > Save Network Configuration. The sqlnet.ora file is updated.
   7. Repeat this procedure to configure integrity on the other system. The sqlnet.ora file on the two sys tems should contain the following entries:
      • On the server:

        SQLNET.CRYPTO_CHECKSUM_SERVER = [accepted | rejected
         | requested | 
        required]
        SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER =
         (valid_crypto_checksum_algorithm 
        [,valid_crypto_checksum_algorithm])
        
        

      On the client:

      SQLNET.CRYPTO_CHECKSUM_CLIENT
      = [accepted | rejected | requested | 
      requ
      ired]
      SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (valid_crypto_checksum_algorithm 
      [,valid_c
      rypto_checksum_algorithm])
      
      

      Valid integrity algorit hms and their associated legal values are displayed by Table 3-3:

      Table 3-3 Valid In tegrity Algorithms

      Algorithm Name	Legal Values
      MD5	MD5
      SHA-1	SHA1

---

Previous Next

Copyright © ; 1996, 2003 Oracle Corporation All Rights Reserved.

Home Book List Contents Index Master Index Feedback