A replicated or restored database can use the existing CSP Vault for Databases deployment to access its TDE master keys. TDE master key transfer is required when the test environment is isolated from the production environment and uses an independently installed CSP Vault for Databases cluster.

In this workflow, the production CSP Vault for Databases environment is the environment from which the TDE master keys are exported, and the test CSP Vault for Databases environment is the environment into which the keys are imported. The test environment does not initially contain the TDE master keys used by the production database. Transfer the required keys so that the test database can access the encrypted data.

The database and TDE master keys are transferred separately. Use a database replication or restore method appropriate for your environment to copy the database. To protect the TDE master keys during transfer, create a wrapping key in the test environment. The production environment uses the public key to wrap the master keys during export. The corresponding private key remains in the test environment and is used to unwrap the keys during import.

Complete the procedures below to transfer Oracle TDE master keys from a production CSP Vault for Databases environment to a test CSP Vault for Databases environment:

TDE master key transfer is supported only between independently installed CSP clusters. You cannot import the same keys into two different vaults within the same CSP cluster. You also cannot import keys into a different vault within the production CSP cluster.

To create a wrapping key keyset  

Create a wrapping key keyset to store and manage the wrapping key used during TDE master key transfer operations. A wrapping key is a cryptographic key used to protect TDE master keys during transfer between CSP Vault for Databases environments. The production CSP Vault for Databases uses the wrapping key to wrap exported TDE master keys, and the test CSP Vault for Databases uses the corresponding private key to unwrap the imported keys. This allows TDE master keys to be securely transferred between isolated CSP Vault for Databases environments.

  1. Log in to the standby Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.

  3. From the Actions drop-down list, select Create Key Set. The Create Key Set window appears.

  4. Under Details, complete the following fields:
    • Name: Enter a name for the key set. For example, wrapping_keys.
    • Admin Group: From the drop-down list, select Cloud Admin Group.
    • Database Type: From the drop-down list, select Generic Key Set.

      The Generic Key Set database type is used to create a wrapping key and download its public key. The public key is used to protect TDE master keys during export from the production environment, while the corresponding private key is used to unwrap the imported keys in the test environment.

  5. Click Continue.
  6. If you you did not configure an HSM for your CSP Vault for databases, a message indicating HSM is not available for this vault appears. Click Apply. A message indicating KeySet was created successfully appears.

To create a wrapping key 

Create a CloudKey to serve as the wrapping key used to protect TDE master keys during transfer between CSP Vault for Databases environments. The wrapping key is used to encrypt exported TDE master keys in the production environment and decrypt them after import into the test environment.

  1. Log in to the standby Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the CloudKeys tab.
  4. From the Key Set drop-down list, select the wrapping key you created in To create a wrapping key keyset. For example, wrapping_keys.
  5. From the Actions drop-down list, select Create CloudKey. The Create CloudKey window appears.
  6. Under Details, complete the following fields:
    • Name: Enter a name for the cloud key. For example, toi_wrapping_key.
    • Cipher: From the drop-down list, select an algorithm based on your requirements.
      Available options:
      • RSA-2048
      • RSA-3072
      • RSA-4096
      • ML-KEM 1024
  7. Click Continue. The system takes you to the Alerts tab in the Create CloudKey window.
  8. Click Apply. The CloudKey Created Successfully window appears.
  9. Click Close.

To download the wrapping key 

  1. Log in to the standby Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the CloudKeys tab.
  4. In the table, select the CloudKey you created in To create a CloudKey. For example, toi_wrapping_key.
  5. Click Download Wrapping Key.

    The wrapping key is a .key file, which includes the public key.

To export the CloudKey from the production environment

  1. Log in to the primary Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the CloudKeys tab.
  4. From the Keyset drop-down list, select the keyset from which you want to export TDE master keys.
  5. From the Actions drop-down list, select Export All CloudKeys. The Export All CloudKeys window appears.
  6. For Wrapping Key, select Load File. The File Upload window appears.
  7. Select the wrapping key file that you downloaded from the standby Cryptographic Security Platform Vault for Databases in To download the CloudKey. 
  8. Click Open.
  9. Click Export.

    The exported file is a .keys file, which includes all the exported keys.


To import the CloudKey to the test environment

  1. Log in to the standby Cryptographic Security Platform Vault for Databases webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the CloudKeys tab.
  4. From the Keyset drop-down list, select the keyset where TDE keys should be imported. 
  5. From the Actions drop-down list, select Import CloudKeys. The Import TDE Keys window appears.
  6. For Key File, select Load File. The File Upload window appears.
  7. Select the .keys file that you exported in To export the CloudKey from the production environment.
  8. Click Open.
  9. Click Import. The following Confirm window appears.
  10. Click OK. A success message and the CloudKeys Imported Result window appear.
  11. Click Close.