Cryptography with SAPCRYPTOLIB

[Former Member]

Hi Folks,

Anyone have experience with SAPCRYPTOLIB?

The point is: I have a table that store encrypted data (algorithm TDES) and I want to unencrypted these data.

Anyone knows how to work with this library?

Thanks in advance,

Ricardo.

[Former Member]

Hi Folks,

Anyone have experience with SAPCRYPTOLIB?

The point is: I have a table that store encrypted data (algorithm TDES) and I want to unencrypted these data.

Anyone knows how to work with this library?

Thanks in advance,

Ricardo.

[Wolfgang_Janzen]

There is no API available in ABAP to utilize all the cryptographic operations implemented by the SAPCRYPTOLIB, directly (i.e. single algorithms such as 3DES).

Only the SSF API can be used.

SSF (Secure Store and Forward) provides functions for digital signatures and encryption.

You can use program SSF02 (via SA38) to test those functions. See also:

Regards, Wolfgang

[Former Member]

Hi Wolfgang,

I have some doubts about using SFF API:

The SFF API works with SAPCRYPTOLIB? Or either, the TDES algorithm is supported by SSF API?

If so, all I need to do is implement respectively SFF functions over encrypted data? The point is: I receive a message via https from a web service. But into the payload, some elements are encrypted by TDES algorithm and these elements are stored in a table.

I would like to know how I can decrypt these table fields. The idea is develop an abap report that calls a function to decrypt these fields. But I don’t know which methods/functions I have that can use TDES algorithm to decrypt data in internal tables.

Thanks a lot for your great help,

Regards, Ricardo.

[Wolfgang_Janzen]

Hi Ricardo,

as you most probably know cryptographic software is subject of export control (similiar to military weapons - sounds weird but we cannot change it).

Therefore the cryptographic functions are not shipped with the product but with an external library (SAPCRYPTOLIB) that can be installed optionally.

The SSF functions are always provided by an external library: either SAPSECULIB (part of the standard shipment) or SAPCRYPTOLIB or a (certified) 3rd party SSF library (required when using SSF functionality on the client side).

There are ABAP function modules for hash algorithms (implemented in the kernel) and there are ABAP function modules for SSF functions (implemented in the SSF library). Dependent on the SSF library in use various SSF functions are available.

SSF (Secure Store and Forward) is designed to operate on (persistent) data - in contrast to SSL (and SNC) which provide encryption services for transient data (i.e. only during data transmission). If data should remain encrypted beyond the scope of data transmission then SSF (or XML encryption) is the right choice.

An important question is:

how is your data structured? Is all the data encrypted or are only parts of it encrypted (=> typical use case for XML encryption)? And how does the recipient determine the sender (in order to use the correct corresponding key)?

That's why usually not just an algorithm (here: triple DES) is required but an infrastructure.

Since you are referring to Web Services I'd expect that the data is encrypted using XML encryption. Am I right?

Regards, Wolfgang

[Former Member]

Hi Wolfgang,

Sorry, but I was out of the Office and I can’t answer you.

Being more specific, the scenario is:

My client receive messages in XML format, some of the fields are encrypted with algorithm Triple-DES. This information is stored into a Z table of a SAP ERP 2005. The idea is develop an ABAP report that reads this table and decrypt the encrypted fields.

I know that algorithm Triple-DES is a symmetric algorithm and the same key is used to encrypt and decrypt, so this key is a private key that need to be save in a secure place.

I would like to use SSF programming to develop this report and just read the SSF programming guide. I don’t know if I need to use all the functions that it has… The encryption process is already done (the infrastructure is also defined) and all I need to do is the inverse process (decrypt).

I have some questions:

In which place is safe to save the private key? On a table, file, into WAS?

Which extra configurations I need to do to start my ABAP report?

Which functions of a SSFG function group I need to use? Like I said before I think that I only need to decrypt the encrypted data, so it means only a SSF_DEVELOPE function is necessary?

Thanks a lot for your help.

Regards,

Ricardo.

[Former Member]

My solution ->

Regards, Ricardo.