Oracle* 11g Transparent Data Encryption with Intel® AES-NI
How to Use Oracle 11g Transparent Data Encryption* with Intel® AES-NI
This guide outlines a short test case on how to use Intel® AES-NI with Oracle Transparent Data Encryption* (Oracle TDE*). Intel® AES New Instructions (Intel® AES-NI) was first introduced in March 2010 and are also on the Intel® Xeon® processor codenamed Westmere-EX. These new instructions provide hardware cryptographic acceleration, making the AES computations in Oracle TDE faster and stronger. TDE is part of Oracle Advanced Security, which is an option that can be purchased with Oracle Database Enterprise Edition* (ODBEE). Oracle’s TDE capabilities make encrypting sensitive data in application table columns or application tablespaces seamless as the cryptographic operations are performed by the database kernel. This, and the built-in key management, dramatically lowers the cost and complexity of database encryption. Oracle implemented the Intel AES-NI hardware encryption acceleration into their database software using the Intel® Integrated Performance Primitives (Intel® IPP) crypto library. With ODBEE 18.104.22.168, Intel AES-NI is automatically detected and used for decryption by default. TDE with ODBEE 22.214.171.124 supports tablespace encryption using Intel AES-NI. Column wise encryption with Intel AES-NI is currently not supported. The test case outlined measures timing for decryption of a one million row database.
The test case documented in this paper was done using Oracle Enterprise Edition 11g Release 2 with patchset 1 (ODBEE 126.96.36.199). The first step in the test case is to install the required software. Links are provided to install the database software together with Oracle Enterprise Linux. When ODBEE is purchased, such as from oraclestore.oracle.com, there will be a customer support identification code. Save this code as it is needed to install patches.
Read the full Oracle 11g Transparent Data Encryption* with Intel® AES-NI Guide.