Cryptographic Library (IAIK) shows as "weak" strength in AS JAVA

[george_hamilton]

I'm trying to debug a problem with the communication of the JAVA stack with another system (Apache). I've noticed that in the Visual Admin under

Dispatcher --> Libraries --> IAIKSecurity --> Info

It lists

"core_lib" as strength "weak" and

"tc_secssl" as strength "weak"

I also see this under the Dispatcher --> services --> SSL Provider --> Additional Info tab.

"IAIKSecurity" as "weak".

I have downloaded the unlimited strength IAIK (JCE) files and put them in the JRE. I have also installed the SAP Cryptographic libraries on the UNIX level. According to the NW07 docs, the IAIK was deployed on installation. What is missing here? Or is this normal? Help is appreciated.

[norbert_sieker · Accepted solution]

Hi George,

this refers to the library reference and is totally ok.

It means that there is a weak reference to the IAIK library (and not a hard reference).

It does not mean that you are running in weak cryptographic mode. That's completely unrelated.

Norbert

[george_hamilton · Accepted solution]

Thanks guys. I had already verified that the policy files were fine. What I was looking for was the library reference information.

[Former Member]

Hi,

The policy files are located in archive files,

<JDK_HOME>/jre/lib/security/local_policy.jar

Executing,

C:\j2sdk1.4.2_03>bin\jar -tvf C:\j2sdk1.4.2_01\jre\lib\security\local_policy.jar

in command line gives the list of local policy files.

The content of the META-INF/MANIFEST.MF file will give the jurisdiction policy in effect. Only when this file contains property Crypto-Strength: unlimited, they are "unlimited/full strength", otherwise they are "limited/full strength" jurisdiction policies.

For further details refer SAP Note 739043

Regards

Srinivasan T