Encryption Keys and Certificates

Configuration Managers can create and manage the company's different types of security assets using the Encryption Keys and Certificates tile on the Self-Service Dashboard.

Business applications, in general, process confidential information. Software applications secure confidential information by restricting access and sometimes encrypting data. Information Security departments, auditors, customers, and other stakeholders review assets, methods, and processes used to secure confidential information. SAP Fieldglass provides a common platform that enables reusable services to store, retrieve, and use assets (encryption keys and certificates) to implement a common interface for all business applications to secure confidential data; reduce duplication of code and processes; and provide a single view to all security assets. Data marked as secure are encrypted through the keys and stored encrypted in the SAP Fieldglass database.

The following table describes the different asset types supported by this feature.

Asset Type	Characteristics	Storage
Symmetric Key (DEK)	Used to encrypt/decrypt sensitive field level data, custom fields, unique ID, and security ID. Encryption converts plain text into an unintelligible form called cipher text. Decryption converts the cipher text back to plain text. The same secret key is used for encryption and decryption.	Symmetric keys are stored in the SAP Fieldglass vault.
Public Key Infrastructure (PKI)	Asymmetric key used to encrypt a symmetric key and for exchanging data with third-party customers. The keys are also used in system-to-system authentication and TLS implementation. The algorithm uses 2 encryption keys, a public key visible/available to everyone and a private key that is kept private, to encrypt/decrypt data. The public key is used to encrypt the data and the private key is used to decrypt it.	Private keys are stored in the SAP Fieldglass vault.
Pretty Good Privacy (PGP) Key	Used to encrypt files transmitted to or received from customers. Caution Weak encryption configurations, such as the CAST 128‑bit cipher or RSA key sizes that fall below our required security standards for PGP keys, are now deprecated. Under the new automated expiration process, all newly generated PGP keys will use AES‑256 encryption wrapped in a 2048‑bit RSA key, ensuring a substantially higher level of cryptographic strength and long‑term protection. Customer-provided keys will be required to follow the same security standard.	Private keys are stored in the SAP Fieldglass vault.
Secure Shell (SSH) Key	Provides a secure way to authenticate and establish a connection between your computer and a remote server. They’re commonly used for logging into servers, especially in cloud environments, without needing to type a password.	Private keys are stored in the SAP Fieldglass vault.
X.509	Used to generate KeyStore private keys and identity certificates, and to store Truststore certificates.	Private keys and certificates are stored in KeyStore stores. Certificates from trusted CAs (Certificate Authorities) are stored in Truststore stores.

After choosing a vault to store the security assets, you can create, generate, activate, rotate, and revoke encryption keys, as well as associate keys to other keys. Key storage and retrieval are managed by the system.