HANA Data volume Encryption

[Former Member]

Hi Team,

I was trying to understand , How HANA encryption works in detail may be the tool used for encrypting .

Is it using OpenSSL for encryption  ?

Then SAP Netweawer SSFS for encrypting those encryption keys ?

Is this true ?

Thanks,

Razal 

[lbreddemann · Accepted solution]

Hey Razal,

OpenSSL is used in SAP HANA but it is not affected by the "Heartbleed" bug if that's where your question in aiming at (http://www.saphana.com/community/blogs/blog/2014/04/11/no-heartbleed-with-sap-hana).

The persistency encryption of SAP HANA encrypts pages during savepoint writing and there is no external tool available to decrypt the data volumes.

- Lars

[Former Member · Accepted solution]

Hi Lars,

I was trying to understand the tool used for Encryption , Is this using OpenSSL  to do the page level encryption  ?

Thanks,

Razal

[lbreddemann · Accepted solution]

Well 'tool' is a little bit misleading.

In some parts of the process OpenSSL libraries are called, yes.

In others the SAPcrypto-library is used.

We don't call any executable with a certain set of parameters or something like that.

Very easy speaking, before a certain part of the memory is written out to disk, we encrypt this piece/buffer via a API function call. The encrypted part gets written to disk then.

Upon loading the data back to memory, we look up the encryption key that was used with the specific savepoint we're trying to load the data from and hand the buffer and the encryption key over to a different API call.

So, from a SAP HANA core developer point of view, yes, OpenSSL is a 'tool' we use, just like libstdc...

- Lars

[Former Member · Accepted solution]

Thanks a lot Lars ,
This is great answer (Always your answers are great and explanatory , appreciate it )

Tool :

Yes you are correct , Tool is not correct term here .

We should call it as a "piece code/ module "

My question should be re-framed as
whether  HANA encryption code/ module  uses OpenSSL libraries ? Only OpenSSL or any other.  ?

But you already answered my question

Thanks.

Razal

[lbreddemann · Accepted solution]

Mohammed Razal V N wrote:

But you already answered my question  

Thanks.
Razal

Glad to hear that - time to close this thread then.

Aaaaaaand TICK - another good deed done

Have a nice weekend!

- Lars

[Former Member · Accepted solution]

Thanks Lars for the details. I have another question here. This is regarding the encryption master key. I read that the master key is a non-unique key during initial setup of HANA and we need to generate new master key and re-enrypt the SSFS root key with this.

So the qeustions would be

01. Where is the existance of initial Master Key? (where it is stored inside the database? )

02. Is the newly generated key a UNIQUE one?

Regards

Sujith Raj

[lbreddemann · Accepted solution]

Hi there,

no idea about the answers to your questions and currently no time to investigate.

AFAIK this is not documented anywhere public yet anyhow...

What do you need the information for? Just pure interest?

- Lars

[Former Member · Accepted solution]

you too have a great weekend

[Former Member · Accepted solution]

Thanks Lars, we were testing this in our
landscape and also there were some customer requirements were some POCs
are being built now. So asked for curiosity.

Regards

Sujith Raj