How to use Encryption in SAP

SAP servers are capable of encrypting and hashing data. But there doesn't appear to be a suitable API to call. SAP Note 1456433 talks about the class CL_SEC_SXML_XENCRYPTION. The signature of basic encryption is clearly geared towards SSF and unsuitable to basic private key encryption/decryption. I don't want/need envelopes and user certificates. Just private keys.

I found an AES library on GitHub AES library in ABAP and tweaked that to suit us. But it is very slow. I would like to use the encryption libraries SAP has. Clearly, the libraries are there but find a suitably exposed API seems the issue.

Does anybody know how to use basic encryption in SAP?
In SAP ABAP stack, using ABAP. Eg (a call to use AES-CBC 128, with PKCS7 padding

where only a private key and data to encrypt is required. As example:

public static method  encrypt_xstring  
 importing i_key  type xstring  
       i_data  type xstring  
       i_initialization_vector  type xstring optional  
       i_padding_standard  type char10 optional  
       i_encryption_mode  type char10 optional  
  exporting e_data  type xstring

Use case is encrypting data on clients with a private key and sending the data to SAP system. The source supports private keys and libraries like AES-CBC. And we have encrypted data interchange working. Next step is to use a supported and faster library.

EDIT: In case anyone needs to encryption / decryption properly in abap And is looking at the answer. Use class CL_SEC_SXML_WRITER. CL_SEC_SXML_WRITER was exactly what i was looking for BUT SAP didnt expose it properly. It is only useful for encryption no decryption.

When interacting with external libraries. Where PKCS7 padding is used and SALTs or Initialization vectors are required. SAP offer an ENCRYPT_IV but no Decrypt_IV. Why ???? So you cant use the tool and remain compliant. :( It is not considered safe to use AES-CBC without IV. Why would SAP do that ?

ENCRYPT_IV instead of ENCRYPT but no DECRYPT_IV

The offer an Add Padding but no remove padding. OK roll your own padding removal, no big deal. Its like the must be another library for the other direction.

So i can use the tool to encrypt but not decrypt. My main problem was decrypting quickly strings sent from a mobile device. So still need to use the old ABAP code for that :(

Solution

I have similar requirements and I found the cl_sec_sxml_writer class. Please have a look at the following example. Note that the writer requires XSTRING parameters which is why I'm using conversion classes.

REPORT zged_aes.

DATA lv_message_string TYPE string.

" create message
DATA(lr_conv_sec) = cl_abap_conv_out_ce=>create( ).
lr_conv_sec->write( data = 'This is my secret' ).

" create key
DATA(lr_conv_key) = cl_abap_conv_out_ce=>create( ).
lr_conv_key->write( data = 'MySymmetricKey' ).

" encrypt using AES256
cl_sec_sxml_writer=>encrypt(
  EXPORTING
    plaintext =  lr_conv_sec->get_buffer( )
    key =        lr_conv_key->get_buffer( )
    algorithm =  cl_sec_sxml_writer=>co_aes256_algorithm_pem
  IMPORTING
    ciphertext = DATA(lv_message) ).

" decrypt message 
cl_sec_sxml_writer=>decrypt(
  EXPORTING
    ciphertext = lv_message
    key =        lr_conv_key->get_buffer( )
    algorithm =  cl_sec_sxml_writer=>co_aes256_algorithm_pem
  IMPORTING
    plaintext =  DATA(lv_message_decrypted) ).

" convert xstring to string for output
cl_abap_conv_in_ce=>create( input = lv_message_decrypted)->read( IMPORTING data = lv_message_string ).

" output secret message
WRITE lv_message_string.

I tested it on a NetWeaver 7.50 SP 6 system.