PGP Encryption issue

[former_member200386]

Dear Experts,

I am working on file to file (FTP)scenario using PGP encryption.

i need to encrypt the file using SHA1 algorithm.

i  followed the below links.

http://scn.sap.com/community/pi-and-soa-middleware/blog/2012/04/10/pgpencryption-module-how-to-guide.

http://scn.sap.com/community/pi-and-soa-middleware/blog/2013/02/07/using-pgp-in-process-integration.

I have placed both public, private keys in the usr/sap/<System ID>/<Instance ID>/sec.

I am getting the below error. while i am testing the scenario. i am getting the below error.

My client didn't shared any Private passwords, So I used the pwdOwnPrivatekey password as same as FTP log in password.

whom will share the pwdOwnPrivatekey parameter password?

Receiver client or PI Team ?

If Pi Team needs to give , How can we generate the password. Please find the screen shots below.

Thanks & Reagrds,

Pavan

[Former Member]

Hi Pavan,

Is that Privateownkey parameter mandatory in your case.If not try without maintaining them, your scenario should work.

[former_member200386]

Hi Sujit,

Thanks for the prompt response, I removed the Privateownkey parameter in my channel module configuration. I facing  strange behavior

If I choose applyEncryption value as false  my scenario is working fine. i can see the out put file is in PGP format.

If I choose applyEncryption value as true i am getting this below error.

Message processing failed. Cause: java.lang.Exception: Could not process message, Internal PGP Error (org.bouncycastle.openpgp.PGPException: exception encrypting session key)

i followed the procedure mentioned in below blog and updated the JCE files already, but still i am getting the error

http://scn.sap.com/community/b2b-integration/blog/2012/07/12/b2b-adapters--updating-to-jce-unlimited...

thanks & regards,

Pavan

[Former Member]

See if this will help you http://scn.sap.com/community/pi-and-soa-middleware/blog/2013/03/27/pgp-and-sftp-faq-sheet

[former_member200386]

Dear Team,

My requirement is i have to Encrypt & Sign , I have generated the Both Private & Public Keys using PGP Gold tool. I shared the Partner public key to Third party team. but they are not able to decrypt the file.

I am able to decrypt the message with my private key & Passpharse. please let me know whick key needs to share with Thirdparty (file receiver team) to decrypt the message at their end.

Thanks & Regards,

Pavan

[Bhargavakrishna]

Hi Pavan,

You should share your shared public key.

you can encrypt/decrypt file, using shared public keys, you can use shell script .

Refer below link to encypt or decrypt a file using java code.

/people/sandeep.maurya4/blog/2011/01/23/pgp-encryptiondecryption-using-java-code

discussions on same issue.

http://scn.sap.com/thread/1979272

Refer the shell script given by Simone Pantaleoni in the above discussion.

hope it will helpful..

Regards

Bhargava krishna

[Former Member]

Hi Pavan,

You have created a Public Key and Private key (with passphrase) using Gold tool.

Share this public key with your partner and ask him to share his public key with you.

Encrypt the outgoing msg using your partner's public key and sign using your private key (with password phase in pwdOwnPrivateKey parameter). Configure the PGPEncryption module in receiver comm channel with required parameters namely applyEncryption,partnerPublicKey, applySignature, ownPrivateKey,pwdOwnPrivateKey (private key password generated in Gold tool).  .

Decrypt the incoming msg with your Private key (with password phrase in pwdOwnPrivateKey parameter). Provide the PGP Decryption module in sender comm channel with required parameters namely ownPrivateKey (means your own private key), partnerPublicKey, pwdOwnPrivateKey (private key password generated in Gold tool).

Thanks

Rakesh

[former_member200386]

HI Rakesh,

I am getting the below error. when i tried to test my scenario. i  imported latest .jar files as suggest by below blog.

http://scn.sap.com/community/b2b-integration/blog/2012/07/12/b2b-adapters--updating-to-jce-unlimited.... still i am getting the error.

Message processing failed. Cause: java.lang.Exception: Could not process message, Internal PGP Error (org.bouncycastle.openpgp.PGPException: exception encrypting session key)

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

I experienced the same error in past and it got resolved by updating the JCE unlimited jurisdiction file. Please check whether the file under \sapjvm_6\jre\lib\security path. Restarting server might solve your issue.

Thanks

Rakesh

[former_member200386 · Accepted solution]

HI Rakesh,

As you suggested we restarted the PI server. still facing the same error.

Message processing failed. Cause: java.lang.Exception: Could not process message, Internal PGP Error (org.bouncycastle.openpgp.PGPException: exception encrypting session key)

any other ideas?

Thanks & Regards,

Pavan

[Former Member · Accepted solution]

Did you also check whether the Unlimited strength Jurisdiction jar file is present in the specified path...

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

We have checked the .jar files they are well in placed.please find the sceen shot . after that i have restarted the server also. still i getting same error.

Any other ideas?

Thanks & Regards,

Pavan

[former_member200386]

Hi Rakesh,

Today we placed the Unlimited strength Jurisdiction jar files agian and restarted the server, Now my Encryption scenario is working.

Now I'm trying to decrypt the PGP files using the same keys. I am getting the below error.

Error: java.lang.NullPointerException: while trying to invoke the method org.bouncycastle.openpgp.PGPPrivateKey.getKey() of an object loaded from local variable 'privKey'

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

I hope you are decrypting the msg using below parameters in localejbs/PGPDecryption module:

ownPrivateKey          <Your own private key generated in Gold Tool>

pwdOwnPrivateKey   <Password for private key generated in Gold Tool> 

partnerPublicKey      <Your partner's public key>

Please make sure that you provided correct private key, which is used for decryption.

Also I would like to know whether your partner is signing the file with his Private key. If he is not signing it, then whatever key you provide in partnerPublicKey parameter will not make any difference. If he is not signing the msg, try replacing partnerPublicKey with your own public key and check whether it works.

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

sorry i have changed my  design plan,

for the encryption interface i have not used the PGP gold tool keys, I have used my client provided Public key & our own Private key and passpharse. with the keys  i am able to encrypt the files. Now  i  want to make sure the decyrption is also working , so i used same keys in my decryption interface.

i am getting the below error now.

tempt to process file failed with java.lang.NullPointerException: while trying to invoke the method org.bouncycastle.openpgp.PGPPrivateKey.getKey() of an object loaded from local variable 'privKey'

[Former Member]

Hi Pavan,

Please make sure you are decrypting the msg using below parameters in localejbs/PGPDecryption module:

ownPrivateKey          <Your own private key generated in Gold Tool>

pwdOwnPrivateKey   <Password for private key generated in Gold Tool>

partnerPublicKey      <Your partner's public key>

Also I would like to know whether your partner is signing the file with his Private key. If he is not signing it, then whatever key you provide in partnerPublicKey parameter will not make any difference. If he is not signing the msg, try replacing partnerPublicKey with your own public key and check whether it works.

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

sorry i have changed my  design plan,

for the encryption interface i have not used the PGP gold tool keys, I have used my client provided Public key & our own Private key and paraphrase. with the keys  i am able to encrypt the files.Scenario is working fine.

Now  i  want to make sure the decryption is also working ,

so i used same keys in my decrypt scenario also.  i am getting above error which i mentioned in my previous response.

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

I completely understood your design and what ou provided in encryption module is perfectly right (partnerPublicKey = client public key, ownPrivateKey = your privatekey generated in gold tool, pwdOwnPrivateKey = password for private key generated in Goldtool)

Please let me know whether you have configured Decryption module as below:

ownPrivateKey          <Your own private key generated in Gold Tool>

pwdOwnPrivateKey   <Password for private key generated in Gold Tool>

partnerPublicKey      <Your client's public key>

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

I configured my sender comm channel as you said.

ownPrivateKey          <Private key which i used for encryption scenario

pwdOwnPrivateKey   <Password for private key  which is used for encryption scenario

partnerPublicKey      <Partner public key which i used for encryption scenario

I am not able to attach  the screen shot of my module configuration.

Please tell me can we decrypt the files using same keys which i used for encryption?

or do i need use separate Private keys & Pass phrase?

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

Your config is fine for decryption and it should work.

As I said earlier, If your client is not signing the file (just encrypting), then whatever key you provide in partnerPublicKey parameter will not make any difference. If he is not signing the msg, try replacing partnerPublicKey with your own public key and check whether it works.

To be more clear, provide your own public key (instead of partner's public key) for parameter partnerPublicKey

Also make sure that the msg you are trying to decrypt is encrypted by your client using your own public key i.e. the one generated in Gold tool).

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

I want to clear one thing. i am trying to decrypt the same file which I encrypted .

to achieve this i used same keys & password which i used for my encryption module config .

Am i doing correct ? Please clarify me.

Thanks & Regards,

pavan

[Former Member]

Hi Pavan,

Yes, you are doing it right.

But if still you are facing issue, try as below:

I hope you have a public and private key (with pwd) pair generated using Gold Tool

Encrypt the file using encryption module (don't perform signing)

Ex:

partnerPublicKey = public_gold_key.asc

Now try decrypting the file using decryption module.

Ex:

partnerPublicKey = public_gold_key.asc

ownPrivateKey = private_gold_key.asc

pwdOwnPrivateKey = *****

Thanks

Rakesh

[Former Member]

Hi Pavan,

Yes, you are doing it right.

But if still you are facing issue, try as below:

I hope you have a public and private key (with pwd) pair generated using Gold Tool

Encrypt the file using encryption module (don't perform signing)

Ex:

partnerPublicKey = public_gold_key.asc

Now try decrypting the file using decryption module.

Ex:

partnerPublicKey = public_gold_key.asc

ownPrivateKey = private_gold_key.asc

pwdOwnPrivateKey = *****

Thanks

Rakesh

[former_member200386]

HI Rakesh,

Thanks for the prompt response. As i said i am not using the keys which i generated using PGP Gold tool. I am using the keys provided by my client .

I used the PGP Gold tool generated keys( Private & Public, password) for and created another scenarios  for encryption & Decryption.  using these PGP keys i am able to do both encryption & decryption of the same file.

BUT I am not able to perform the decryption with my client given keys.  I am doing this decryption scenario to make sure that encryption is working.  my actual requirement is just Encryption only.

Regards,

pavan

[Former Member]

Hi Pavan,

Client will only provide his public key to you. I hope you have encrypted the file using Client's public key and sent the file (ex: "file_enc.txt") to Client. Client will decrypt the file using his private key.

For decryption, Client has to encrypt the file using your public key, which you can decrypt using your own private key.

I think you are playing with wrong combination of keys for decryption. You cannot decrypt the file "file_enc.txt" using your private key (because it was encrypted using client's public key).

I hope its clear and I am able to clear your doubts on the issue.

Regards

Rakesh

[former_member200386]

Hi Rakesh,

Thanks for the prompt response , Now i got it, i used wrong keys as you said.

my actual requirement is i need to encrypt the file using clinet(third party) provided public key then sign using our company private key.

1 st I need to encrypt and after that apply digital signature.

when i open my receiver comm channel audit log , I can see sigining is happening 1st then encryption is performed.

Audit Log for Message: 7517c7e5-ccee-11e2-cd2a-0000007826ca

04.06.2013 13:42:11.892 Information PGP Encryption Module: The module-paramteter "asciiArmored" is not set. Using default value "true" 04.06.2013 13:42:11.892 Information PGP Encryption Module: The module-paramteter "format" is not set. Using default value "binary" 04.06.2013 13:42:11.892 Warning PGP Encryption Module: The module-paramteter "dynamicFileName" is not set. Will be using Message ID as the file name while encrypting. 04.06.2013 13:42:11.892 Warning PGP Encryption Module: The module-paramteter "dynamicNamespace" is not set. Will be using Message ID as the file name while encrypting. 04.06.2013 13:42:11.893 Information PGP Encryption Module: Reading public key at E:\usr\sap\XD1\DVEBMGS00\sec\BOADPULL.asc 04.06.2013 13:42:11.893 Information PGP Encryption Module: The module-paramteter "encryptionAlgo" is not set. Using default value "CAST5" 04.06.2013 13:42:11.893 Information PGP Encryption Module: The module-paramteter "keyRootPath" is not set. Using default value "E:\usr\sap\XD1\DVEBMGS00\sec" 04.06.2013 13:42:11.894 Information PGP Encryption Module: Reading private key at E:\usr\sap\XD1\DVEBMGS00\sec\BofAEMEA_IDocs.asc 04.06.2013 13:42:11.901 Information PGP Encryption Module: Applying compression. 04.06.2013 13:42:11.901 Information PGP Encryption Module: Creating ASCII-Armor 04.06.2013 13:42:11.901 Information PGP Encryption Module: Processing 04.06.2013 13:42:11.901 Information PGP Encryption Module: Signing 04.06.2013 13:42:11.901 Warning PGP Encryption Module: "dynamicFileName" and "dynamicNamespace" not configured. Using message ID as the file name. 04.06.2013 13:42:12.003 Information PGP Encryption Module: Applying encryption 04.06.2013 13:42:12.005 Information File adapter receiver: processing started; QoS required: ExactlyOnce 04.06.2013 13:42:12.005 Information MP: processing local module localejbs/CallSapAdapter 04.06.2013 13:42:12.005 Information PGP Encryption Module: Message successfull processed. 04.06.2013 13:42:12.012 Information File Adapter Receiver Channel CC_FIle_BOFA_PGPFileTransfer_Receiver: Start processing; party "*" / service "BC_BOFA_RECEIVER" 04.06.2013 13:42:12.018 Information Write to file "\\alxn-sapxd1\PI_OUT\O_240_0000000001196744" as binary, size 2454 bytes 04.06.2013 13:42:12.026 Information File processing finished

will this create problems for the client to decrypt the file?

Thanks & Regards,

pavan

[Former Member]

Hi Pavan,

No, this will not create any problem to decrypt the file...

Award points if helpful...

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

My client is failed to decrypt the file from his end. He is saying is not seen any valid signature in the file.

Any Inputs ,so that i can solve my issue.

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

Please make sure that you have done as per following:

Generated your own public and Private key pair (you can use Gold tool) and share your public key with client.

In Encryption module, you have to use your client's public key for parameter "partnerPublicKey", you have to use you own private key for parameter "ownPrivateKey"

, provide private key password for parameter "pwdOwnPrivateKey"

Once you place encrypted file into Client's FTP/SFTP location, ask him to decrypt it using your own public key.

Award point if helpful...

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

Thanks for your response. I have completed the scenario. Like Below

pgp	applyEncryption	true
pgp	applySignature	true
pgp	ownPrivateKey	BofAEMEA_IDocs.asc
pgp	partnerPublicKey	BOADPULL.asc
pgp	pwdOwnPrivateKey	******
pgp	signingAlgo	SHA1

where partnerPubilcKey---->Partner public key

ownPrivateKey--->My company Private key

pwdOwnPrivateKey-->password for Private key.

I am not getting any errors while executing my scenario. My clinet is not able to decrypt PGP file from his end.

He is getting below error.

event 8: Analyze

File is encrypted. event 9: Recipients

Secret key is required to read it.

Key for user ID "BOAD042018 <DTS 24X7 support @ 888-269-5266>"

event 6: Passphrase

event 23: Decryption

symmetric cipher used: CAST5

event 3: error -11391

event 2: final

Error decrypting file '/global/pgp/extrtmp/pgpextr/ALEXPHAI635464074556'.

Corrupt data.

Bad packet

Client is using system uses the following software for Encryption/Decryption:

McAfee E-Business Server v8.6 - Full License

This error has been known to happen due to partial incompatibility in the way certain software does the encryption process.  It could be related to what’s been known as the “BouncyCastle” issue which requires some tuning of the encryption settings in order to resolve. I cannot be certain that this is the issue with your particular software, however, I thought I’d mention it  in case it can be helpful when you consult with your software provider’s support team.

Please share your thoughts ,is there any thing wrong in PI encryption mechanism?

Thanks & Regards,

Pavan

Message was edited by: pavan thiruveedula

[Former Member]

Hi Pavan,

Try with following settings:

pgp	applyCompression	ZIP
pgp	applyEncryption	true
pgp	applySignature	true
pgp	asciiArmored	true
pgp	ownPrivateKey	BofAEMEA_IDocs.asc
pgp	partnerPublicKey	BOADPULL.asc
pgp	pwdOwnPrivateKey	******
pgp	signingAlgo	SHA1

If this doesn't work, ask your client to specify the algorithm he is using.

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

Thanks for being with me all time and answered my questions. At last i have done this thing.

Here my Module config that worked for me.

pgp	applyCompression	None
pgp	applyEncryption	true
pgp	applySignature	true
pgp	asciiArmored	false
pgp	ownPrivateKey	BofAEMEA_IDocs.asc
pgp	partnerPublicKey	BOADPULL.asc
pgp	pwdOwnPrivateKey	******
pgp	signingAlgo	SHA1

Thanks & Regards,

Pavan

[Former Member]

Hi Pavan,

Good to hear that your issue is resolved

Please close this thread and award points if helpful...

Thanks

Rakesh

[former_member200386]

Hi Rakesh,

Please Copy my Module configuration in your reply, I mark your reply as correct answer.

Thnaks ,

Pavan

[Former Member]

Hello,

Your client will not provide you any private key and its corresponding passphrase.

Ask ur basis team to create the same for u so that u can sign the file...

http://scn.sap.com/community/b2b-integration/blog/2012/07/12/its-all-about-keys-secure-connectivity-...

Thanks

Amit Srivastava