ORA-28347: encryption properties mismatch exchange分区表 表加密 随机

Even though you have created the exchange table TABLE2 with the same encryption attributes it will still not work, since for each table a separate column key is generated and these are randomly selected.

create table table1
    ("PARTITION_KEY" NUMBER(12),
    "ENCRYPTED_COLUMN" NUMBER(3)
    ENCRYPT USING 'AES192'
    --IDENTIFIED BY "123" 
    NO SALT)
    PARTITION BY RANGE ("PARTITION_KEY")
    (
    PARTITION "P1" VALUES LESS THAN (10) TABLESPACE "USERS"  NOLOGGING,
    PARTITION "OVER_FLOW"  VALUES LESS THAN (MAXVALUE) TABLESPACE "USERS"
    NOLOGGING );

create table table2
  ("PARTITION_KEY" NUMBER(12),
   "ENCRYPTED_COLUMN" NUMBER(3)
   ENCRYPT USING 'AES192'
   --IDENTIFIED BY "123" 
   NO SALT);

ALTER TABLE table1 EXCHANGE PARTITION P1 WITH TABLE table2;
 

In the typical case that you already have a partitioned table without IDENTIFIED BY and NO SALT attributes, you will need to rekey the partitioned table and add the NO SALT, this must be done in two steps since they cannot be combined (ORA-23290):

alter table table1 REKEY
  USING 'AES192'
  IDENTIFIED BY "123" ;
  alter table table2 REKEY
  USING 'AES192'
  IDENTIFIED BY "123" ;
  ALTER TABLE table1 EXCHANGE PARTITION P1 WITH TABLE table2;
  

alter table table1 modify ( "ENCRYPTED_COLUMN" encrypt no salt);

You are getting the following error when trying to exchange a partition of a partitioned table with a regular table that both use column encryption:

ALTER TABLE table1 EXCHANGE PARTITION P1 WITH TABLE table2
*
ERROR at line 1:
ORA-28347: encryption properties mismatch

CHANGES

You have created a partitioned table and a regular table as follows using column encryption attributes:

create table table1
    ("PARTITION_KEY" NUMBER(12),
    "ENCRYPTED_COLUMN" NUMBER(3)
    ENCRYPT USING 'AES192' NO SALT)
    PARTITION BY RANGE ("PARTITION_KEY")
    (
    PARTITION "P1" VALUES LESS THAN (10) TABLESPACE "USERS"  NOLOGGING,
    PARTITION "OVER_FLOW"  VALUES LESS THAN (MAXVALUE) TABLESPACE "USERS"
    NOLOGGING );

create table table2
  ("PARTITION_KEY" NUMBER(12),
   "ENCRYPTED_COLUMN" NUMBER(3)
   ENCRYPT USING 'AES192' NO SALT);

CAUSE

Even though you have created the exchange table TABLE2 with the same encryption attributes it will still not work, since for each table a separate column key is generated and these are randomly selected.

SOLUTION

The following scenario will work by matching the column keys to the same value:

create table table1
    ("PARTITION_KEY" NUMBER(12),
    "ENCRYPTED_COLUMN" NUMBER(3)
    ENCRYPT USING 'AES192'
    IDENTIFIED BY "" NO SALT)
    PARTITION BY RANGE ("PARTITION_KEY")
    (
    PARTITION "P1" VALUES LESS THAN (10) TABLESPACE "USERS"  NOLOGGING,
    PARTITION "OVER_FLOW"  VALUES LESS THAN (MAXVALUE) TABLESPACE "USERS"
    NOLOGGING );

create table table2
  ("PARTITION_KEY" NUMBER(12),
   "ENCRYPTED_COLUMN" NUMBER(3)
   ENCRYPT USING 'AES192'
   IDENTIFIED BY "" NO SALT);

ALTER TABLE table1 EXCHANGE PARTITION P1 WITH TABLE table2;

In the typical case that you already have a partitioned table without IDENTIFIED BY and NO SALT attributes, you will need to rekey the partitioned table and add the NO SALT, this must be done in two steps since they cannot be combined (ORA-23290):

alter table table1 REKEY
  USING 'AES192'
  IDENTIFIED BY "" ;

alter table table1 modify ( "ENCRYPTED_COLUMN" encrypt no salt);

We need to use  the extra keyword IDENTIFIED BY "" and this has to be the same for both the partitioned table and the exchange table to make sure the derived column key will be the same since if you specify this clause, then the database derives the column key from the specified password (seed), please understand that this derived column key will be stored only in its encrypted format inside the database, this is not different from the internally generated random key when this clause is omitted.

In versions that support tablespace encryption the entire issue can be avoided by making sure both partitioned table and exchange table are in an encrypted tablespace, in that case of course no separate column encryption attributes are required.