Guideline for Oracle Transparent Network Encryption and Integrity setup

You can use Oracle’s Network Data Encryption (also denoted as Transparent Network Encryption - “TNE”) and Integrity features to secure the communication between the application server and the database server. For comprehensive background information on this topic see the Oracle Database Advanced Security Administrator's Guide [Oracle Advanced Security].

Encryption is enabled or disabled based on a combination of the client-side encryption-level setting and the server-side encryption-level setting. Similarly, integrity is enabled or disabled based on a combination of the client-side integrity-level setting and the server-side integrity-level setting.

Encryption and integrity support the same setting levels: REJECTED, ACCEPTED, REQUESTED, and REQUIRED. The table below shows how these possible settings on the client-side and server-side combine to either enable or disable the feature:

	Client
Server		Rejected	Accepted (default)	Requested	Required
	Rejected	OFF	OFF	OFF	fails: ORA-12660
	Accepted (default)	OFF	OFF	ON	ON
	Requested	OFF	ON	ON	ON
	Required	fails ORA-12660	ON	ON	ON
Table 335: Oracle client/server negotiations for encryption or integrity

Algorithm Name	Value
AES 256-bit key	AES256
RC4 256-bit key	RC4_256
AES 192-bit key	AES192
3-key 3DES	3DES168
AES 128-bit key	AES128
RC4 128-bit key	RC4_128
2-key 3DES	3DES112
RC4 56-bit key	RC4_56
DES 56-bit key	DES
RC4 40-bit key	RC4_40
DES 40-bit key	DES40
Table 336: Encryption algorithms for Oracle as negotiated by in decreasing order of preference

Parameter Description	Parameter Name	Possible Settings
Client encryption level	oracle.net.encryption_client	REJECTED ACCEPTED REQUESTED REQUIRED
Client encryption selected list	oracle.net.encryption_types_client	See Encryption algorithms for Oracle as negotiated by in decreasing order of preference
Client integrity level	oracle.net.crypto_checksum_client	REJECTED ACCEPTED REQUESTED REQUIRED
Client integrity selected list	oracle.net.crypto_checksum_types_client	SHA1 MD5
Table 337: JDBC Thin Client (Oracle.Net) Parameters for Encryption and Integrity

Example to enforce encryption

You can enforce encryption by a configuration on the application server1 The application server in this case represents a “client” of the database server. with the following settings, where the example below assumes that you want to use encryption with the algorithm RC4_128 with integrity checks based on the hash algorithm SHA1:

1. Set the following JDBC client settings by JVM settings:

   • Add -Doracle.net.encryption_client=REQUIRED as new option

   • Add -Doracle.net.encryption_types_client=(RC4_128) as new option

   • Add -Doracle.net.crypto_checksum_client=REQUIRED as new option

   • Add -Doracle.net.crypto_checksum_types_client=(SHA1) as new option

2. Restart the domain for the changes to take effect.

If you want to enforce encryption, it is enough to enforce this on one side, i.e. either on a client side (like above) or on a database server side (see further down below). The example above will enforce encryption, unless the database server rejects to do so. In the latter case the connection to the database would fail (according to Oracle client/server negotiations for encryption or integrity with the error ORA-12660).

If you want to make sure that only a certain client uses encrypted connections but still want to keep the possibility for unencrypted connections to the database server for other database clients, you can achieve this by adjusting only the client-side settings (in this case via JVM settings on the application server) as shown above. Instead of enforcing encryption on the application server, this can also be done on the database server side in the Oracle configuration file “sqlnet.ora”:

If the encryption on database server side is enforced, only clients which support encryption can connect. For further background information and related solutions, such as SSL encryption with Oracle, also see the Oracle White Paper “SSL With Oracle JDBC Thin Driver” [Oracle SSL].