SSF configuration for external Smartcard Readers

Question

Hello colleagues,
I 'm working at a customer who is implementing a SAP project (R/3 4.6C SR2), in which is involved the goverment.
The goverment is forcing to the customer to implement digital signature in some steps of his business process, one of this steps is running on SAP R/3 system. The digital signature will be used with digital signature in order to "package" some critical data like "billing amount", for instance.
The goverment is imposing the smartcard encryption solution, that is hardware encryption.
I have been looking for information about it, so I understood the following:
1._ Some smartcards vendors are compliance with SAP.
2._ I need to install in the server running SAP the smartcard and the smartreader in order to manipulate and to access the encryption functionality.
3._  The smartcard is configured in SAP by transaction SSFA and other reports.
4._  The encryption functionality is accessed by SSF function group.
I downloaded the documents "SSF user guide", "security quick guide: digital signature" and "digital signature in FI".
I've found into a paper called "Digital Signatures
in SAP Applications - Web App.Server 6.40" the following:
1.3.1. SSF for the ABAP Stack
The SSF Library for the ABAP Stack is used in applications that are written in ABAP. It supports the functions for creating and verifying digital signatures (PKCS#7), and functions for encrypting and decrypting documents.
SSF requires an external security product to provide these functions. The SAP Security Library (SAPSECULIB) is delivered with the SAP system as the default product. However, the SAP Security Library only supports digital signatures without cryptographic hardware (SmartCards, SmartTokens, Cryptoboards). Instead of the SAPSECULIB, customers can also use the SAPCRYPTOLIB, which can be downloaded from the SAP Service Marketplace. The SAPSECULIB supports the DSA (Digital Signature Algorithm) algorithm, and the SAPCRYPTOLIB supports both the DSA and the RSA algorithms. The algorithm that you must use in your signature process depends on the CA that issues the certificate. Most CAs use the RSA algorithm. Note that country-specific export guidelines apply in the case of the SAPCRYPTOLIB. For more information, see SAP Note 397175.
For support for encrypting and decrypting documents, and for generating digital signatures using cryptographic hardware, an external security products from our partners is required. These security products use SAP’s SSF interface and are certified for this by SAP. For a list of the certified products, see the SAP Service Marketplace under http://service.sap.com/securitypartners, and then choose the link “Partner for Secure Store and Forward, digital signatures“ (SSF).
The SSF Library for the ABAP stack is available as of SAP Basis 4.0.
I don't undertand how is the relationship between SAPCRYPTOLIB and the SmartReader Card established/configured.
We think about the "Government of Chile" will deliver the customer a SmartCard Reader from Schlumberger (Cryptoflex 16K Card).
Should be great if you can provide me with any useful information in order to understand how to implement this configuration.
Best regards, Carlos
Message was edited by: Carlos Guevara
Message was edited by: Carlos Guevara
Message was edited by: Carlos Guevara

Answer 1

Hi,
Thanks a lot for your answer. I have more questions:
As I mentioned before, the Government office will provide a SmartCard reader to the customer: it's "Cryptoflex 16K card from Schlumberger". You can take a look to its features here:
http://www.cryptoflex.com/Products/Cryptoflex_Features/cryptoflex_features.html#
There, you can see the following:
Supported Applications and Platforms
Integrates with PC/SC
Integrates with PKSC#11   >>> (*)
Entrust Ready
Plug & Play with Windows 2000 and Windows XP
Axalto SDK
In the document about Digital Signatures "DigSig_Netweaver_BestPractices_en.doc", you can see the following:
1.2.1 PKCS#7
PKCS#7 stands for Public-Key Cryptography Standard # 7. The PKCS standards are specifications that were developed by RSA Security for secure information exchange using the Internet. PKCS#7 is currently a format established in the market. It describes a wrapper format, meaning that the output format does not correspond to the input format. If, for example, a PKCS#7 signature is attached to a PDF document, the document is then in PKCS#7 format. This format is a binary format, which in turn means that direct display is not very good, and is not suitable for a user. A special tool (viewer) must therefore be used for display. Unfortunately, usable PKCS#7 viewers are not currently available on the market. This format is very suitable for purely automatic processing (without a display component for the user).
SAP offers the PKCS#7 signature on the ABAP platform (as of SAP Basis 4.0B) and on the Java platform (as of SAP Web AS 6.30).
So here are my questions:
1) From above, can you tell me if I'm wrong, or this SmartCard ("Cryptoflex 16K card from Schlumberger") is incompatible with SAP Digital Signature implementation (the Smartcard uses PKCS#11 -see (*) above- and SAP uses PKCS#7)?
2) I didn't find to Schlumberger as a certified partner into the SAP link for Certified Partners for Digital Signatures:
http://www50.sap.com/softwarepartnerdir/products/certify/prod_def.asp?DescID=259&ProdDesc=Digital%20Signatures%2C%20Encryption%20and%20SSF
Does it mean that this partner can't provide SSF compatibility?
3) Can you provide me any kind of documentation in order to understand what are the whole configurations that need to be done from the "basis" side (if questions 1 and 2 are false) in order to configure this arquitecture?
4) Can you explain a little bit how the SAPCRYPTOLIB is used in this context? I mean, should we need it in order to encrypt/decrypt digital signatures/envelopes?
Best Regards, Carlos