DuoKey

Oracle TDE

Oracle TDE external keystore, off the database host

An external keystore holds Oracle's TDE master key outside the wallet file on the database server. DuoKey's PKCS#11 bridge moves that key into Cockpit. Only master-key operations cross the network; bulk encryption stays local.

Request a demo→See the architecture

Keep the master key of Oracle databases

Oracle TDE with an external keystore: the master encryption key stays in DuoKey, reached over PKCS#11, and is never returned to the database host.

Off the database host

No software wallet on the server holds the master key.

Never returned to Oracle

Master-key operations run in DuoKey; the key bytes do not come back.

HSM or MPC

Hardware custody with Securosys, or MPC when you prefer software.

The master key lives elsewhere.

Oracle TDE wraps tablespace and table keys with a master encryption key. With DuoKey, that key sits in an external keystore instead of a wallet on the host.

  • Anyone who copies the host does not get the key.
  • Oracle sees an HSM-type wallet (WRL_TYPE = HSM).

PKCS#11, and nothing comes back.

The DuoKey PKCS#11 library holds no keys and does no cryptography locally. It sends master-key operations to the Cockpit, which runs them against the vault or HSM.

  • Standard Oracle external keystore configuration.
  • Master-key bytes are not returned to Oracle.

Rekey without downtime.

Rotate the master key in the external keystore; Oracle rewraps its tablespace keys while the data files stay as they are.

  • Setup, rekey and the usual ORA- errors are documented.
  • Every operation recorded in the Cockpit.

Hardware custody, or MPC.

Choose a Securosys HSM for hardware custody, or MPC so the key is never whole in one place. Same library, same Oracle configuration.

  • Pick per database or environment.
  • One policy and audit trail across both.

How it works

Only the master key crosses the network

To Oracle, DuoKey presents itself as an external HSM keystore. The library handles SET KEY and wrap/unwrap only; bulk tablespace encryption stays on the host, accelerated by AES-NI.

Oracle Database

Bulk data stays local, AES-NI

DuoKey PKCS#11

SET KEY, wrap / unwrap

DuoKey Cockpit

Tenant-isolated keystore

Only master-key operations cross the network. The key never resides on the database host.

Praxisbeispiele

Wo Teams das einsetzen

Financial Services

Data Encryption for DORA Compliance

Meet DORA's requirements for encryption and key management with customer-controlled keys across cloud and SaaS.

Anwendungsfall lesen
Financial Services

Secure Cloud Data Storage for Financial Services

Protect Customer Data and Ensure Compliance with DuoKey's Secure Cloud Storage for the Financial Industry

Anwendungsfall lesen

Tiefenanalysen

Leitfäden für Ihr Programm

SQL Key Management and Database Encryption: Where the Master Key Lives

Database encryption key management is where the master key lives. How SQL Server, Oracle, MySQL, PostgreSQL, MongoDB, Cassandra and Couchbase keep that key off the database, with DuoKey.

Leitfaden lesen

Oracle TDE Key Management with an HSM or External Keystore: Keep the Master Key Off the Database Host (2026)

Oracle TDE with an HSM: wallet vs HSM vs Oracle Key Vault, PKCS#11 setup to move the master key off the host, rekey, auto-login and ORA- fixes.

Leitfaden lesen

Sie verschlüsseln Ihre Daten. Aber wer kontrolliert die Schlüssel?

Erfahren Sie, warum die zentrale Souveränität die Compliance-Lücke ist, mit der die meisten Unternehmen nie rechnen, und wie Sie sie beheben können.

Leitfaden lesen

FAQ

Oracle TDE external keystore questions

What is an Oracle TDE external keystore?

It is a keystore outside the database server that holds the TDE master encryption key. Oracle's default is a software wallet file on the same host as the data. With an external keystore, such as an HSM-type keystore reached through a PKCS#11 library or Oracle Key Vault, the master key is kept elsewhere and the database asks for it to wrap and unwrap table and tablespace keys.

How does DuoKey connect to Oracle TDE?

Oracle loads DuoKey's PKCS#11 library as its HSM keystore. The library handles SET KEY and the wrap and unwrap of TDE keys against a master key held in DuoKey Cockpit. Bulk tablespace encryption stays on the database host.

Which Oracle releases has DuoKey tested?

DuoKey publishes a live testing record rather than a general compatibility promise. Full SET KEY and encrypted-tablespace round trips are confirmed on Linux for 12.1.0.2, 12.2.0.1 and 19.3 Enterprise Edition and 21c XE, and on Windows for 21.3 Enterprise Edition. The actively validated baseline is Oracle Database 12.2 and later; for 11g R2 or 12.1, confirm with DuoKey before deployment.

How is the keystore configured on Oracle 19c and later?

From 18c, and later 12.2 release updates, the keystore is set with the WALLET_ROOT instance parameter and TDE_CONFIGURATION; earlier releases use the ENCRYPTION_WALLET_LOCATION entry in sqlnet.ora. Using the wrong mechanism for a release fails with generic ORA- errors, which DuoKey's documentation maps release by release.

Does an external keystore slow the database down?

Only master-key operations cross the network: opening the keystore, setting or rotating the master key, and wrapping or unwrapping table and tablespace keys. Encryption of the data itself stays local on the database host.

Step-by-step setup, keystore options and ORA- fixes are in the Oracle TDE HSM and external keystore guide. Release-by-release detail is in the DuoKey Oracle TDE documentation.

Oracle TDE with the master key off the host.

See an Oracle external keystore backed by DuoKey on your own database.

Request a demoRead the Oracle TDE guide