Skip to Main Content
  • Questions
  • Determining whether any encryption is being used in a database

Breadcrumb

Question and Answer

Tom Kyte

Thanks for the question.

Asked: October 08, 2013 - 4:19 pm UTC

Last updated: October 09, 2013 - 3:40 pm UTC

Version: 11.2.0.2

Viewed 1000+ times

You Asked

I've been handed a database and asked whether any of it is encrypted. How to tell? There's TDE, obfuscation toolkit, - is there anyway to encrypt the entire database? Is there anyway to tell whether encryption is being used just being handed a database and asked the question - is any of it encrypted?

and Tom said...

there is tablespace encryption
select tablespace_name, encrypted from dba_tablespaces;


there is column encryption

select * from dba_encrypted_columns
http://docs.oracle.com/cd/E18283_01/server.112/e17110/statviews_3168.htm


there is lob (securefile) encryption

select * from dba_lobs.encrypt
http://docs.oracle.com/cd/E11882_01/server.112/e40402/statviews_4110.htm



then there is application encryption which could be done a) in the application b) using dbms_obfuscation_toolkit or c) the dbms_crypto package.


You can use dba_dependencies to see if anything is dependent on dbms_obfuscation_toolkit or dbms_crypto, that would give an a clue that something could be encrypted (but cannot be conclusively used to prove NOTHING is encrypted).

You can look for RAW or LONG RAW or BLOB columns - those are the only columns suitable for encrypted data.

but you cannot conclusively determine if application encrypted data exists or not - there is nothing special about it to us other than the application should be using a binary datatype to store it.

Is this answer out of date? If it is, please let us know via a Comment

More to Explore

CLOB/BLOB/etc

Complete documentation on Securefiles and Large Objects here