How to use Encryption in SAP and Store in Database
I have the task to save username and passwords in a SAP table. The password should be stored encrypted (aes128) in the database. Before sending, the password should be decrypted again. Decrypting doesn't work. Does anyone have experience with this?
This is my source code for storing the data:
data : passwd type string,
encoded type string,
decoded type string.
data: lv_plaintext type xstring.
data: lv_plaintext2 type xstring.
data: lv_key type xstring.
*----------------------------------------------------------------------*
* Selection-Screen
*----------------------------------------------------------------------*
parameters: p_name type char10.
parameters: p_usern type char10.
parameters: p_pass type text10.
parameters: p_descr type text120.
*----------------------------------------------------------------------*
* At Selection Screen Output
*----------------------------------------------------------------------*
at selection-screen output.
loop at screen.
if screen-name = 'P_PASS'.
screen-invisible = 1.
modify screen.
endif.
endloop.
*----------------------------------------------------------------------*
* Start of Selection
*----------------------------------------------------------------------*
start-of-selection.
* create message
data: lr_conv_sec type ref to cl_abap_conv_out_ce .
data: lr_conv_key type ref to cl_abap_conv_out_ce .
try.
call method cl_abap_conv_out_ce=>create
exporting
encoding = 'DEFAULT'
* endian =
replacement = '#'
ignore_cerr = abap_false
receiving
conv = lr_conv_sec
.
catch cx_parameter_invalid_range .
catch cx_sy_codepage_converter_init .
endtry.
lr_conv_sec->write( p_pass ).
* create key
try.
call method cl_abap_conv_out_ce=>create
exporting
encoding = 'DEFAULT'
* endian =
replacement = '#'
ignore_cerr = abap_false
receiving
conv = lr_conv_key
.
catch cx_parameter_invalid_range .
catch cx_sy_codepage_converter_init .
endtry.
lr_conv_key->write( p_pass ).
try.
call method lr_conv_sec->get_buffer
receiving
buffer = lv_plaintext.
endtry.
try.
call method lr_conv_key->get_buffer
receiving
buffer = lv_key.
endtry.
data: lv_message type xstring.
* encrypt using AES256
call method cl_sec_sxml_writer=>encrypt
exporting
plaintext = lv_plaintext
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
importing
ciphertext = lv_message.
data: ls_pwdstore type /vaps/pwdstore.
ls_pwdstore-name = p_name.
ls_pwdstore-username = p_usern.
ls_pwdstore-pwd = lv_message.
ls_pwdstore-pwdkey = lv_key.
ls_pwdstore-description = p_descr.
modify /vaps/pwdstore from ls_pwdstore.
write:/ 'Name', ' : ', ls_pwdstore-name.
write:/ 'Benutzername', ' : ', ls_pwdstore-username.
write:/ 'Passwort', ' : ', ls_pwdstore-pwd.
write:/ 'PWDKEY', ' : ', ls_pwdstore-pwdkey.
And here is the code for the display:
data : passwd type string,
encoded type string,
decoded type string.
data: lv_plaintext type xstring.
data: lv_plaintext2 type xstring.
data: lv_key type xstring.
*----------------------------------------------------------------------*
* Selection-Screen
*----------------------------------------------------------------------*
parameters: p_name type char10.
*----------------------------------------------------------------------*
* At Selection Screen Output
*----------------------------------------------------------------------*
at selection-screen output.
*----------------------------------------------------------------------*
* Start of Selection
*----------------------------------------------------------------------*
start-of-selection.
data: lv_message type xstring.
data: ls_pwdstore type /vaps/pwdstore.
data: lv_length type i,
e_string type string,
lt_binary type standard table of x255.
select single * from /vaps/pwdstore into ls_pwdstore
where name = p_name.
lv_key = ls_pwdstore-pwdkey.
lv_message = ls_pwdstore-pwd.
call method cl_sec_sxml_writer=>decrypt
exporting
ciphertext = lv_message
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
importing
plaintext = lv_plaintext2.
call function 'SCMS_XSTRING_TO_BINARY'
exporting
buffer = lv_plaintext2
importing
output_length = lv_length
tables
binary_tab = lt_binary.
call function 'SCMS_BINARY_TO_STRING'
exporting
input_length = lv_length
importing
text_buffer = e_string
tables
binary_tab = lt_binary
exceptions
failed = 1
others = 2.
if sy-subrc <> 0.
* Implement suitable error handling here
endif.
write:/ 'Name', ' : ', p_name.
write:/ 'PWD', ' : ', e_string.
The table columns PWD and PWDKEY are defined as RWASTRING.
Solution
I created sample code and it looks working. Maybe you can check your db routine, maybe you lost some data during db oprerations.
REPORT zmky_enc_dec.
DATA: lv_key TYPE xstring,
lv_plaintext TYPE xstring,
lv_plaintext2 TYPE xstring,
lv_message TYPE xstring,
lv_length TYPE i,
e_string TYPE string,
lv_ciphertext TYPE xstring.
DATA: lt_binary TYPE STANDARD TABLE OF x255.
lv_plaintext = '646570'.
lv_key = '5A1F47FE14F72'.
* encription
* encrypt using AES256
CALL METHOD cl_sec_sxml_writer=>encrypt
EXPORTING
plaintext = lv_plaintext
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
IMPORTING
ciphertext = lv_ciphertext.
* decription
lv_ciphertext = 'D8B7F50D13B58F8C0B9B50A59891ED2F1C368D6F2DB97A789BDAC131EE346CE8'.
CALL METHOD cl_sec_sxml_writer=>decrypt
EXPORTING
ciphertext = lv_ciphertext
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
IMPORTING
plaintext = lv_plaintext2.
CALL FUNCTION 'SCMS_XSTRING_TO_BINARY'
EXPORTING
buffer = lv_plaintext2
IMPORTING
output_length = lv_length
TABLES
binary_tab = lt_binary.
CALL FUNCTION 'SCMS_BINARY_TO_STRING'
EXPORTING
input_length = lv_length
IMPORTING
text_buffer = e_string
TABLES
binary_tab = lt_binary
EXCEPTIONS
failed = 1
OTHERS = 2.
WRITE:/ 'PWD', ' : ', e_string.
Separated report:
REPORT zmky_enc.
DATA: lv_key TYPE xstring,
lv_plaintext TYPE xstring,
lv_ciphertext TYPE xstring.
lv_plaintext = '6D6B79736F6674'.
lv_key = '5A1F47FE14F72'.
* encrypt using AES256
CALL METHOD cl_sec_sxml_writer=>encrypt
EXPORTING
plaintext = lv_plaintext
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
IMPORTING
ciphertext = lv_ciphertext.
WRITE:/ 'Encrypt', ' : ', lv_ciphertext.
Decryption
REPORT zmky_dec.
DATA: lv_key TYPE xstring,
lv_plaintext TYPE xstring,
lv_text TYPE string,
lv_length TYPE i,
lv_ciphertext TYPE xstring.
DATA: lt_binary TYPE STANDARD TABLE OF x255.
lv_key = '5A1F47FE14F72'.
lv_ciphertext = 'D9276417EA8C93AE373CE24272BD68974C524CC6E34AB2D9496162F5E1CEB2B8'.
CALL METHOD cl_sec_sxml_writer=>decrypt
EXPORTING
ciphertext = lv_ciphertext
key = lv_key
algorithm = cl_sec_sxml_writer=>co_aes128_algorithm
IMPORTING
plaintext = lv_plaintext.
CALL FUNCTION 'SCMS_XSTRING_TO_BINARY'
EXPORTING
buffer = lv_plaintext
IMPORTING
output_length = lv_length
TABLES
binary_tab = lt_binary.
CALL FUNCTION 'SCMS_BINARY_TO_STRING'
EXPORTING
input_length = lv_length
IMPORTING
text_buffer = lv_text
TABLES
binary_tab = lt_binary
EXCEPTIONS
failed = 1
OTHERS = 2.
WRITE:/ 'Decrypted', ' : ', lv_text.
- How to check if the decryption is correct?
- What is the main difference between base64_encode hashing and (sha1, md5, ...)?
- Javascript encryption for JSON object
- How to encrypt/decrypt a dynamic SQL query in Golang with a fixed-size encrypted result?
- How to get cipher text as result of encryption using aes cbc 128 bit with open ssl in c language
- How to Export Private / Secret ASC Key to Decrypt GPG Files
- Should I do any transformation to AES CMAC provided key?
- Postfix and OpenJDK 11: "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)"
- "No key data found" when using pgpainless to import key
- Why do i get different results when I print out characters in the buffer when using a for loop and a printf function?
- Why AES Decrypt code doesn't work in php 7.2
- Encrypting (large) files in PHP with openSSL
- What are the differences between .pem, .cer, and .der?
- C++ free encryption libraries
- Fill empty C string correctly
- AEADBadTagException: mac check in GCM failed during AES decryption with BouncyCastle
- Configure Keycloak to Encrypt SAML Assertions with AES-128-GCM Instead of AES-128-CBC
- How do I query an SEE encrypted database using rusqlite?
- C# Dataprotector Decrypt function doesn't work with Logon or TokenService
- PGP BouncyCastle + Kleopatra Decryption: Unknown Packet Type: 20
- Usefulness of SQL Server "with encryption" statement
- How to safely store & process secret key for JWT
- Database column encryption postgres
- How to encrypt data that needs to be decrypted in node.js?
- CCCrypt encryption result issue
- Determine what ciphers and key-exchange algorithms are available with Python Paramiko
- Is it possible to decipher at random position with nodejs crypto?
- How to choose an AES encryption mode (CBC ECB CTR OCB CFB)?
- Securely storing an access token
- convert Bouncy Castle's AsymmetricCipherKeyPair (RSA) to java.security.KeyPair