Andrew:
I used to work for Adobe and worked a lot with US gov clients and FIPS in
general. THere are a number of ways to accomplish this but you have to
understand COS based PDF rendering capabilities and FIPS protocols. It is
highly complicated and varies based on context. I am sure you have read
and understand the technical requirements, yet the formula for compliance
varies a lot.
In general, if the context is ultra secure compliancy with FIPS in an
"always on" mode vs; demonstrating it once, you will need to use 3rd party
tools to ensure compliance. Acrobat often gets blamed for being bloated,
yet in reality it has requirements bestowed upon it to ensure compliance.
For example, if you digitally sign a PDF, you have to save to to disk,
then reload it back from disk to ensure that the disk version has not been
tampered with by comparing the DS dictionaries with each other. CMVP in
particular validates cryptographic modules against 140-2 requirements yet
are based on ES beyond PDFBOx capabilities. Depending on the context of
compliance, the list of NIST requirements is potentially infeasible to
build as a one off.
The (Adobe specified) solution is to use their tools rather than third
party solutions like my own company (Technoracle Systems) and including
PDF box. I would aver that if the requirements are fairly strict, you
would be best served by using Adobe LiveCycle ES. While expensive, it is
well worth the cost compared to the potential of having to implement Dr.
Rinjndael's four rounds of non-linear substitution for AES. If you
absolutely insist on using PDF BOx (or similar) with additions, companies
like iText, Technoracle, Avoka, FourPoint or others can be useful to work
with.
Doing this all by yourself will likely result in huge extra costs over
just buying COTS software. I am not trying to sell you on us or any other
vendor, just trying to make you aware of the potential costs of trying to
comply vs using an already approved solution. The main reason is that
FIPS 140-2 has many requirements beyond the design goals of PDF Box.
I am happy to entertain a conversation privately on this topic as I do not
want to appear as trying to push our own solution. I am happy to provide
un-biased advice. If you want to talk further, please consult me off list
(the list should not be used for promoting a VAR software solution IMO).
Duane Nickull
***********************************
Technoracle Advanced Systems Inc.
Consulting and Contracting; Proven Results!
i. Neo4J, PDF, Java, LiveCycle ES, Flex, AIR, CQ5 & Mobile
b. http://technoracle.blogspot.com
t. @duanechaos
"Don't fear the Graph! Embrace Neo4J"
On 2012-09-06 8:48 PM, "Andrew Hauger" <[email protected]> wrote:
>Can anyone tell me how to use pdfbox to create FIPS 140-2 compliant
>encrypted documents? Adobe Reader has been placed in "FIPS mode" on all
>the workstations where I work, and our users can no longer save the PDF
>documents generated by our system. We do not want anyone tampering with
>the contents of our generated documents, and the only way I know of to
>implement the PDF security options requires encryption of the documents.
>Unfortunately, the base encryption capability of pdfbox is not FIPS 140-2
>compliant, so until I get a FIPS 140-2 solution, we will have to generate
>unsecured PDF files.
