Operation Manual

200
USING ACROBAT X STANDARD
Security
Last updated 10/11/2011
• Security Matters blog: blogs.adobe.com/security
More Help topics
“Removing sensitive content” on page 219
“Setting up security policies” on page 209
Choosing security methods within FIPS mode (Windows)
Acrobat and Reader provide a FIPS mode to restrict data protection to Federal Information Processing Standard
(FIPS). FIPS mode uses FIPS 140-2 approved algorithms using the RSA BSAFE Crypto-C Micro Edition (ME) 3.0.0.1
cryptographic module.
The following security options are not available in FIPS mode:
• Applying password-based security policies to documents. You can use public key certificates or Adobe LiveCycle
Rights Management ES to secure the document. However, you cannot use password encryption to secure the
document.
• Creating self-signed certificates. To create a self-signed digital ID, it must be saved to the Windows certificate store.
You cannot create a self-signed digital ID that is saved to a file.
• RC4 encryption. A PDF file can only be encrypted by using the AES encryption algorithm when in FIPS mode.
• MD5 or RIPEMD160 digest methods. In FIPS mode, only the SHA-1 and SHA-2 families of digest algorithms can
be used when creating a digital signature.
In FIPS mode, you can open and view documents that are protected with algorithms that are not FIPS compliant.
However, you can’t save any changes to the document using password security. To apply security policies to the
document, use either public key certificates or Adobe LiveCycle Rights Management ES.
FIPS mode is configured in the Windows registry by a system administrator. For more information, see Digital
Signatures Guide (PDF) at
www.adobe.com/go/learn_acr_security_en.
Securing documents with passwords
Add password security
You can limit access to a PDF by setting passwords and by restricting certain features, such as printing and editing.
However, you cannot restrict saving copies of a PDF. The copies have the same restrictions as the original PDF. Two
types of passwords are available:
Document open password With a document open password (also known as a user password), users must type in the
password you specify to open the PDF.
Permissions password When you set only a permissions password (also known as a master password), recipients don’t
need a password to open the document. However, they must type the permissions password to set or change the
restricted features.
If the PDF is secured with both types of passwords, it can be opened with either password. However, only the
permissions password allows the user to change the restricted features. Because of the added security, setting both
types of passwords is often beneficial.
Note: You cannot add passwords to a signed or certified document.
All Adobe products enforce the restrictions set by the permissions password. However, if third-party products do not
support these settings, document recipients are able to bypass some or all of the restrictions you set.