title: How to use Encryption in SAP
body: <p>SAP servers are capable of encrypting and hashing data. But there doesn't appear to be a suitable API to call. SAP Note 1456433 talks about the class <code>CL_SEC_SXML_XENCRYPTION</code>.   The signature of basic encryption is clearly geared towards SSF and unsuitable to basic private key encryption/decryption. I don't want/need envelopes and user certificates. Just private keys.</p>
  
  <p>I found an AES library on GitHub <a href="https://github.com/Sumu-Ning/AES" rel="nofollow noreferrer">AES library in ABAP</a>  and tweaked that to suit us.  But it is very slow.   I would like to use the encryption libraries SAP has. Clearly, the libraries are there but find a suitably exposed API seems the issue.  </p>
  
  <p><strong>Does anybody know how to use basic encryption in SAP?</strong><br>
  In SAP ABAP stack, using ABAP.
  Eg (a call to use AES-CBC 128, with PKCS7 padding </p>
  
  <p>where only a private key and data to encrypt is required. As example:</p>
  
  <pre><code>public static method  encrypt_xstring  
   importing i_key  type xstring  
         i_data  type xstring  
         i_initialization_vector  type xstring optional  
         i_padding_standard  type char10 optional  
         i_encryption_mode  type char10 optional  
    exporting e_data  type xstring  
  </code></pre>
  
  <p>Use case is encrypting data on clients with a private key and sending the data to SAP system.  The source supports private keys and libraries like AES-CBC.
  And we have encrypted data interchange working. 
  Next step is to use a supported and faster library.</p>
  
  <p><strong>EDIT:</strong> In case anyone needs to encryption / decryption properly in abap
  And is looking at the answer. Use class CL_SEC_SXML_WRITER.
  CL_SEC_SXML_WRITER was exactly what i was looking for
  BUT SAP didnt expose it properly.  It is only useful for encryption no decryption.</p>
  
  <p>When interacting with external libraries.  Where PKCS7  padding is used and SALTs
  or Initialization vectors are required.
  SAP offer an ENCRYPT_IV but no Decrypt_IV.    Why ????
  So you cant use the tool and remain compliant. :(
  It is not considered safe to use AES-CBC without IV.
  Why would SAP do that ?</p>
  
  <blockquote>
    <p>ENCRYPT_IV   instead of ENCRYPT but no DECRYPT_IV </p>
  </blockquote>
  
  <p>The offer an Add Padding but no remove padding. OK roll your own padding removal, no big deal.  Its like the must be another library for the other direction.</p>
  
  <p>So i can use the tool to encrypt but not decrypt.
  My main problem was decrypting quickly strings sent from a mobile device.
  So still need to use the old ABAP code for that :(</p>