Error
Error Code:
706
SAP S/4HANA Error 706: Unsupported Symmetric Cipher
Description
This error indicates that an attempt was made to perform a symmetric encryption operation using an algorithm other than AES-256-CBC, which is the only supported cipher for this purpose in SAP S/4HANA's underlying database. It commonly occurs during data encryption, secure communication setup, or when custom SQL queries specify an invalid cipher.
Error Message
ERR_SQL_INV_SYMMETRIC_CIPHER: Currently only AES-256-CBC is supported: invalid cipher
Known Causes
4 known causesMisconfigured Encryption Settings
The system or application attempting to perform an encryption operation is configured to use a symmetric cipher other than the required AES-256-CBC.
Unsupported SQL Cipher Specification
A custom SQL script, database command, or application code explicitly requested a symmetric encryption algorithm that is not AES-256-CBC.
Third-Party Integration Mismatch
An external application or service integrating with SAP S/4HANA is attempting to encrypt or decrypt data using an unsupported symmetric cipher algorithm.
Outdated Client Libraries/Drivers
Client libraries or database drivers used to connect to SAP S/4HANA might be outdated and default to or only support older, incompatible symmetric cipher algorithms.
Solutions
3 solutions available1. Verify and Correct Cipher Configuration in SAP System medium
Ensure that the symmetric cipher used for data encryption in SAP S/4HANA is set to the supported AES-256-CBC.
1
Log in to your SAP S/4HANA system with an administrator role.
2
Access the SAP system configuration transaction for secure communication. This is typically managed within the SAP Cryptographic Library settings. You might need to consult SAP Notes or system documentation for the exact path, but common areas involve ICM (Internet Communication Manager) or STRUST transactions for certificate management, and then navigating to the cryptographic library settings.
3
Locate the configuration parameters related to symmetric encryption algorithms. Look for settings that define the cipher to be used for data encryption.
4
Verify that the configured symmetric cipher is set to 'AES-256-CBC'. If it's set to any other value, change it to 'AES-256-CBC'.
5
Save the changes and restart the relevant SAP system components (e.g., ICM, application servers) to apply the new configuration.
2. Update SAP Cryptographic Library advanced
Install or update the SAP Cryptographic Library to a version that explicitly supports AES-256-CBC.
1
Identify the current version of the SAP Cryptographic Library installed on your SAP S/4HANA system. This information can usually be found in the SAP system's technical documentation or through system information transactions.
2
Visit the SAP Support Portal (support.sap.com) and navigate to the Software Downloads section.
3
Search for the latest compatible version of the SAP Cryptographic Library for your specific SAP S/4HANA version and operating system. Ensure the release notes or documentation for the library explicitly state support for AES-256-CBC.
4
Download the appropriate installation package for the SAP Cryptographic Library.
5
Follow the SAP installation guide for the SAP Cryptographic Library to update or install the new version. This typically involves replacing existing library files and updating configuration parameters.
6
After the library update, restart all SAP S/4HANA application servers and relevant services to ensure the new library is loaded and used.
3. Review Application or Interface Specific Cipher Settings medium
Check if the error originates from a specific application or interface that is configured to use an unsupported cipher for its data encryption.
1
Identify the specific context where the Error 706 occurs. Is it during a particular transaction, an interface call (e.g., RFC, web service), or a background job?
2
If the error is related to an interface, review the configuration of that interface. For example, if it's an RFC connection, check the RFC destination configuration (SM59) and any associated security settings or parameters.
3
If it's a web service or API call, examine the configuration of the client or server endpoints for encryption settings. This might involve consulting the documentation for the specific SAP module or third-party application involved.
4
Look for any parameters that explicitly define the symmetric cipher used for data transmission or storage within that specific application or interface.
5
Update the configuration of the application or interface to use 'AES-256-CBC' as the symmetric cipher, or ensure it's compatible with the system-wide supported cipher.
6
Test the affected functionality after making the configuration changes.