ABAP recommended settings for password hash algorithms, SAP security note 1458262

SAP security note 1458262, "ABAP: recommended settings for password hash algorithms". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

There are known password hash attacks (see also Note 1237762). It’s crucial to restrict access to password hash values (refer to Note 1484692) and ensure the utilization of the latest available password hash algorithms. This note provides guidance on configuring your system to enhance security in this area.

Solution

The recommended settings depend on your system’s SAP_BASIS version and its usage scenario:

• Standalone ABAP Systems, SAP_BASIS 4.6x or 6.x: Set the profile parameter login/password_charset to 2. Refer to Note 874738 for more information.
• Standalone ABAP Systems, SAP_BASIS 7.x: Set login/password_downwards_compatibility to 0 and execute the report CLEANUP_PASSWORD_HASH_VALUES to remove redundant password hash values. Be aware that this might affect compatibility with outdated frontend or middleware components. See Note 1023437 for details.
• CUA landscape, all members with SAP_BASIS 7.02 or higher: Set login/password_downwards_compatibility to 0 and run CLEANUP_PASSWORD_HASH_VALUES across all systems to use "code version H".
• CUA landscape, all members with SAP_BASIS 7.00 or 7.01: Similar to above, resulting in the use of "code version F".
• CUA landscape, all members with SAP_BASIS 4.6x or 6.x: Set login/password_charset to 2 to use "code version E".
• CUA landscape, mixed SAP_BASIS versions: Configure systems with SAP_BASIS 4.6x or 6.x to set login/password_charset to 2 and those with SAP_BASIS 7.00 or 7.01 to set login/password_downwards_compatibility to 1, enabling the use of multiple code versions (B, E, and G).

Reason and prerequisites

ABAP systems use password-based authentication by comparing password hash values. Only the hash values and associated "code version" information are stored in the user master record. Over time, multiple password hash algorithms ("code versions") have been developed to maintain compatibility with older releases. However, maintaining this compatibility can prevent the use of more secure, newer hash algorithms or require storing additional legacy hash values.

References

• 991968 – List of values for "login/password_hash_algorithm"
• 874738 – New password hash calculation procedure (code version E)
• 1237762 – ABAP systems: Protection against password hash attacks
• 1023437 – ABAP syst: Downwardly incompatible passwords (since NW2004s)

Affected components

• SAP_BASIS 4.6A to 4.6D+
• SAP_BASIS 6.10 to 6.40+
• SAP_BASIS 7.00 to 7.02+
• SAP_BASIS 7.10 to 7.30+