0

SAP servers are capable of encrypting and hashing data. But there doesn't appear to be a suitable API to call. SAP Note 1456433 talks about the class CL_SEC_SXML_XENCRYPTION. The signature of basic encryption is clearly geared towards SSF and unsuitable to basic private key encryption/decryption. I don't want/need envelopes and user certificates. Just private keys.

I found an AES library on GitHub AES library in ABAP and tweaked that to suit us. But it is very slow. I would like to use the encryption libraries SAP has. Clearly, the libraries are there but find a suitably exposed API seems the issue.

Does anybody know how to use basic encryption in SAP?
In SAP ABAP stack, using ABAP. Eg (a call to use AES-CBC 128, with PKCS7 padding

where only a private key and data to encrypt is required. As example:

public static method  encrypt_xstring  
 importing i_key  type xstring  
       i_data  type xstring  
       i_initialization_vector  type xstring optional  
       i_padding_standard  type char10 optional  
       i_encryption_mode  type char10 optional  
  exporting e_data  type xstring  

Use case is encrypting data on clients with a private key and sending the data to SAP system. The source supports private keys and libraries like AES-CBC. And we have encrypted data interchange working. Next step is to use a supported and faster library.

EDIT: In case anyone needs to encryption / decryption properly in abap And is looking at the answer. Use class CL_SEC_SXML_WRITER. CL_SEC_SXML_WRITER was exactly what i was looking for BUT SAP didnt expose it properly. It is only useful for encryption no decryption.

When interacting with external libraries. Where PKCS7 padding is used and SALTs or Initialization vectors are required. SAP offer an ENCRYPT_IV but no Decrypt_IV. Why ???? So you cant use the tool and remain compliant. :( It is not considered safe to use AES-CBC without IV. Why would SAP do that ?

ENCRYPT_IV instead of ENCRYPT but no DECRYPT_IV

The offer an Add Padding but no remove padding. OK roll your own padding removal, no big deal. Its like the must be another library for the other direction.

So i can use the tool to encrypt but not decrypt. My main problem was decrypting quickly strings sent from a mobile device. So still need to use the old ABAP code for that :(

5
  • Does the data need to be encrypted inside the SAP system? Or are you trying to secure the transmission?
    – Bryan Cain
    Apr 23, 2018 at 14:17
  • I don’t really understand this question. ABAP runs on the SAP system, not the client. Are you looking to encrypt data on an SAP system and send it to another SAP system? Perhaps this question is along the same lines as Bryan’s, but my impression is that if you expose a private key in user-space ABAP, you shouldn’t have much expectation that that key is private any longer. ABAP has a Secure Store and Forward system and API, which I suggest you look in to further - help.sap.com/viewer/1a93b7a44ac146b5ad9b6fd95c1223cc/7.5.9/… Apr 23, 2018 at 16:22
  • yes it is for use on ABAP stack. I have looked at the SSF libraries. They all assume documents, envelopes, certificates etc. They dont expose the underlying encryption API. At least I couldnt find it.
    – phil soady
    Apr 24, 2018 at 1:02
  • Well, then I think you’re going to be limited to customer developed and OSS libraries like the one you have found. You may also want to look into the options for calling command line programs from ABAP, which would allow you to use pretty much whatever you want. I would still recommend against managing a private key within the ABAP runtime outside of the secure store or SSF framework. It’s not designed for that purpose. Apr 24, 2018 at 1:51
  • The users private keys are encrypted. The SAP system itself has a private key used to encrypt the users private keys.Of course if SAP exposed the functionality properly then none of this would be necessary
    – phil soady
    May 3, 2018 at 7:42

2 Answers 2

2

I have similar requirements and I found the cl_sec_sxml_writer class. Please have a look at the following example. Note that the writer requires XSTRING parameters which is why I'm using conversion classes.

REPORT zged_aes.

DATA lv_message_string TYPE string.

" create message
DATA(lr_conv_sec) = cl_abap_conv_out_ce=>create( ).
lr_conv_sec->write( data = 'This is my secret' ).

" create key
DATA(lr_conv_key) = cl_abap_conv_out_ce=>create( ).
lr_conv_key->write( data = 'MySymmetricKey' ).

" encrypt using AES256
cl_sec_sxml_writer=>encrypt(
  EXPORTING
    plaintext =  lr_conv_sec->get_buffer( )
    key =        lr_conv_key->get_buffer( )
    algorithm =  cl_sec_sxml_writer=>co_aes256_algorithm_pem
  IMPORTING
    ciphertext = DATA(lv_message) ).

" decrypt message 
cl_sec_sxml_writer=>decrypt(
  EXPORTING
    ciphertext = lv_message
    key =        lr_conv_key->get_buffer( )
    algorithm =  cl_sec_sxml_writer=>co_aes256_algorithm_pem
  IMPORTING
    plaintext =  DATA(lv_message_decrypted) ).

" convert xstring to string for output
cl_abap_conv_in_ce=>create( input = lv_message_decrypted)->read( IMPORTING data = lv_message_string ).

" output secret message
WRITE lv_message_string.

I tested it on a NetWeaver 7.50 SP 6 system.

1
  • nice pick up Ged. The class even has PKCS7_padding method. Some im ready to test
    – phil soady
    Aug 27, 2018 at 1:51
-1

I got the ENCRYPT_IV method to work alongside method DECRYPT of class CL_SEC_SXML_WRITER.

The caveat here is that I didn't generate the Symmetric Key and IV by making use of Class cl_abap_conv_out_ce.

I already had my keys and IV from a Java implementation test.

The only thing I needed was to create the Key and IV as an XSTRING and initializing them with the Hex format of my Java implementation (they were in Byte format.

Because of this, I first converted them to Hex and passed those values to the ABAP Xstring types).

Not the answer you're looking for? Browse other questions tagged or ask your own question.