Encrypt Server/Client data in network traffic i.e., whenever client[customer] triggers a query to Oracle Databases[server] the data transfer in the network needs to be encrypted to do that we need to include encryption parameter on server side sqlnet.ora file.

Oracle Advanced Encryption Standard

The purpose of a secure cryptosystem is to convert plaintext data into unintelligible ciphertext based on a key, in such a way that it is very hard (computationally infeasible) to convert ciphertext back into its corresponding plaintext without knowledge of the correct key. In a symmetric cryptosystem, the same key is used both for encryption and decryption of the same data. Oracle Advanced Security provides the Advanced Encryption Standard (AES), DES, 3DES, and RC4 symmetric cryptosystems for protecting the confidentiality of Oracle Net Services traffic. In this release, the new Federal Information Processing Standard (FIPS) encryption algorithm, Advanced Encryption Standard (AES), is supported. AES can be used by all U.S. government organizations and businesses to protect sensitive data over a network. This encryption algorithm defines three standard key lengths, which are 128-bit, 192-bit, and 256-bit.

Encryption status according to client and server parameter values is summarized in the following table (ORA-12660 is the error returned by Oracle in these cases):

The tested encryption algorithms were (other ones are available, refer to the documentation above):

• DES: Data Encryption Standard (an old 56 bit encryption method)
• 3DES168: triple DES with a three-key (168 bit) option
• AES128: Advanced Encryption Standard with 128-bit key (currently the most use for data encryption)
• AES256: Advanced Encryption Standard with 256-bit key (currently the most secure)
• RC4_128: RC4 with 128-bit key (RC4 is the international standard for high-speed data encryption)
• RC4_256: RC4 with 256-bit key

Performace Test using AES256 vs 3DES168 algorithms

vi to oracle database sqlnet.ora:

#
# Encryption
#
SQLNET.ENCRYPTION_TYPES_SERVER=(AES256)
DISABLE_OOB=on
SQLNET.ENCRYPTION_SERVER=REQUIRED
DIAG_ADR_ENABLED=OFF

So far, so good. But how do we verify it is working? We can check using a sql query, or we can enable a sqlnet level 16 trace on the client and review trace files with encryption disabled, and with encryption enabled.

Option 1: Query to show encrypted clients

In the query results, look for lines that list ciphers and contain the words “service adapter”.  Ignore the other lines. This tells us that encryption and/or integrity checking is active for the connection.

Query 1 :  select * from dba_objects ; Collecting the overall 592912 rows from dba_objects with elapsed time using sql developer tool (about 550MB are exchanged on network).

Runtime details

AES256 sql execution runtime is quicker than 3DES168 algorthim since AES256 light weight algorthim and it has inbuilt sorting/comparision is enabled.