Repository navigation
LAB 23 (Vault Use in OCI Compute)
Vault in OCI Compute refers to deploying Oracle Key Vault on Oracle Cloud Infrastructure (OCI) VM instances, enabling secure, scalable, and flexible key management for databases and applications hosted in OCI. It provides encryption key lifecycle management, cluster deployments, and hybrid setups across on-premises and cloud environments.
-
Oracle Key Vault (OKV) is Oracle’s centralized key management solution.
-
In OCI Compute, it is deployed as a VM instance from the Oracle Cloud Marketplace.
-
It manages encryption keys, secrets, and credentials for OCI-based databases and applications.
-
Quick Deployment: Launch directly from Oracle Cloud Marketplace without hardware procurement.
-
Scalability: Supports standalone, clustered, and hybrid deployments (cloud + on-premises).
-
Flexibility: Same look and feel as on-premises OKV, but cloud-native.
-
Security: Centralized key lifecycle management (generation, rotation, expiration).
-
Integration: Works seamlessly with Oracle Database Transparent Data Encryption (TDE) and other OCI services
Note :- Into the Create Vault a option Named Make it a virtual private vault available to make the vault virtual. Virtual Vault also work in other region as well as same region.
1. Go to Created Vault and click on Created Vault ""Test_vault" and click on "Master encryption keys" and after click on "Create key"
2. In Protection Mode select "Software" , In Key Shape Algorithm select - "AES (Symmetric key used for Encrypt and Decrypt)", In Key Shape length select 256 bits. and click on create.
Storage: Keys are protected using software within OCI Vault.
Security Boundary: Relies on OCI’s operating system and application-level protections.
Performance: Lower cost, easier to provision, suitable for dev/test workloads.
Compliance: Not FIPS-certified; best for non-critical or non-regulated workloads.
Use Cases:
-
Development and testing environments
-
Applications with moderate security needs
-
Cost-sensitive projects
Storage: Keys are generated and stored inside FIPS 140-2 Level 3 certified HSMs.
Security Boundary: Keys never leave the HSM in plaintext; all cryptographic operations happen inside the hardware.
Tamper Resistance: Physical protections against intrusion or tampering.
Compliance: Meets strict regulatory requirements (finance, healthcare, government).
Performance: Hardware acceleration for cryptographic operations.
Use Cases:
-
Production workloads with sensitive data
-
Compliance-driven industries
-
Applications requiring strong root of trust (SSL/TLS, code signing, payment systems)
Comparison Table
In Oracle Cloud Infrastructure (OCI), every key in OCI Vault has a key shape — a combination of algorithm and length that defines how cryptographic operations are performed. Understanding these shapes is essential for designing secure and compliant cloud architectures.
Type: Symmetric encryption
Lengths: 128, 192, 256 bits
Use Cases:
Encrypting data at rest (Object Storage, Block Volumes, Databases)
Fast, efficient encryption/decryption
Notes:
Keys are used for both encryption and decryption.
AES‑256 is recommended for high‑security workloads.
Type: Asymmetric encryption
Lengths: 2048, 3072, 4096 bits
Use Cases:
Encrypting small data (e.g., symmetric keys)
Digital signatures and certificate management
Notes:
Public key encrypts; private key decrypts.
Larger key sizes increase security but reduce performance.
Type: Asymmetric (elliptic curve)
Curves Supported: P‑256, P‑384, P‑521
Use Cases:
Digital signatures
Lightweight cryptography for mobile and IoT
Notes:
Provides strong security with smaller key sizes.
Ideal for performance‑sensitive applications.