Oracle Database 11 g - Online Public Access Catalog

320 CHAPTER 7 ■ DATA PUMPChoosing an Encryption ModeThe encryption mode specifies the type of security to apply when encryption and decryptionoperations are performed. There are three ENCRYPTION_MODE options:• dual• password• transparentUsing the transparent encryption mode is equivalent to performing a TDE-enabled export.If Oracle Wallet is open, no intervention is required by the DBAs to perform a transparentencrypted export.If the ENCRYPTION_PASSWORD parameter is specified and Oracle Wallet is open, Oracle usesthe dual mode for encryption. If Oracle Wallet is not available on the target database, you canuse the ENCRYPTION_PASSWORD parameter that was specified at the time of export to decrypt thedata during import.The following example shows how to perform a TDE-enabled Data Pump export:expdp dumpfile=oratmp:tde.dmp tables=rodba.docs \parallel=2 encryption_mode=transparent \encryption=all userid="'/ as sysdba'"Let’s look at the password encryption mode. This option indicates that the password hasto be provided to perform an import. To be able to import a password-encrypted export dump,the password must be provided during the import operation. The following Data Pump exportuses the password ENCRYPTION_MODE with the default encryption algorithm of AES128-bitencryption:expdp dumpfile=dbadir:encrypted.dmp schemas=rodba \userid=rodba/oracle123 encryption_mode=password \encryption_password=oracle123Using password mode is by far the easiest way to start performing encrypted Data Pumpexports. Let’s add a higher level of cryptography to the equation:expdp dumpfile=dbadir:encrypted.dmp.compressed tables=rodba.docs \userid=rodba/oracle123 encryption_mode=password \encryption_password=oracle123 ENCRYPTION_ALGORITHM=aes256By specifying the encryption algorithm of AES256, the highest level of encryption is set forthe export dump file.The dual encryption mode can be used when you need to restore to an alternate server onwhich the Oracle Wallet file is not accessible. The dual mode provides flexibility of using eitherTDE or the password option during the export/import operation. To perform dual Data Pumpexports, you can invoke the expdp utility with the following parameters:expdp dumpfile=oratmp:tde.dualdmp tables=rodba.docs \parallel=2 encryption_mode=dual \encryption=all userid="'/ as sysdba'" encryption_password=11g