FIPS (Federal Information Processing Standards) Compliance in Office & PDF File API

9 minutes to read

The National Institute of Standards and Technology (NIST) developed Federal Information Processing Standards (FIPS). These standards apply to computer systems that non-military government agencies and contractors use. FIPS define security requirements for cryptographic modules and algorithms in software. DevExpress components and libraries support FIPS-compliant environments by using cryptographic algorithms that meet NIST standards. FIPS compliance is important for organizations that handle sensitive data and must follow strict security requirements.

Note

FIPS defines approved cryptographic algorithms and implementations, but many commonly available algorithms such as MD5, SHA-1, and RC4 are not compliant due to known security weaknesses.

In .NET, enforcement varies by runtime. In FIPS mode, .NET Framework may block non-compliant algorithms and throw exceptions. .NET 5 and later may execute these algorithms without errors, although the algorithms remain non-compliant. Ensure that both the algorithm and its implementation meet FIPS requirements for your target environment.

Format Support and FIPS Compliance

The table below lists file formats that DevExpress Office & PDF File API supports and their FIPS compliance:

Format	Encryption Algorithm	Revision	FIPS Compliance
PDF 1.1-1.3	RC4 40-bit	R2	Not compliant
PDF 1.4-1.5	RC4 128-bit	R3/R4	Not compliant
PDF 1.6-1.7	AES-128	R4	Not compliant
PDF 1.7 Extension 3	AES-256	R5	Not compliant
PDF 2.0	AES-256 improved	R6	Compliant
DOC (Word 97–2003)	RC4 40-bit	—	Not compliant
DOC (Word 97–2003)	RC4 128-bit	—	Not compliant
DOCX (Word 2007+)	AES-128 (CBC)	—	Compliant
DOCX (Word 2010+)	AES-256 (CBC)	—	Compliant
XLS (Excel 97–2003)	RC4 40-bit	—	Not compliant
XLS (Excel 97–2003)	RC4 128-bit	—	Not compliant
XLSX (Excel 2007+)	AES-128 (CBC)	—	Compliant
XLSX (Excel 2010+)	AES-256 (CBC)	—	Compliant

Behavior in FIPS Mode

DevExpress checks OperatingSystemLevelFipsMode.IsEnabled at the public API entry point before any cryptographic operation begins. When FIPS mode is active and the requested operation requires a non-compliant algorithm, the library throws an exception: DevExpress.Utils.OperatingSystemLevelFipsMode+ComplianceViolationException. The exception message includes the name of the non-compliant algorithm and a recommended compliant alternative.

.NET Core and .NET 5+ applications could previously use non-compliant algorithms on FIPS-enforced machines without errors. In these instances, DevExpress libraries now throw a ComplianceViolationException.

Note

FIPS enforcement is a system-wide policy that your IT or security team controls. We do not recommend that you disable FIPS compliance in your development environment to test your application. Consult your organization’s security policy first.

Cryptographic Modules and FIPS Validation

You can use the DevExpress Office & PDF File API in applications that must operate in a FIPS-compliant environment (including FIPS 140-3). However, DevExpress libraries are not cryptographic modules and do not have a separate FIPS 140 Cryptographic Module Validation Program (CMVP) certificate. The libraries delegate cryptographic operations (AES encryption, SHA hashing, and random number generation) to .NET cryptographic implementations and the underlying operating system. In .NET Framework applications, the PDF Document API also uses the Bouncy Castle cryptography library for PDF digital signatures. Refer to the following section for more information: Bouncy Castle Cryptography Library.

System.Security.Cryptography APIs are not FIPS-validated. FIPS validation applies to the underlying Windows cryptographic modules that perform the operations, not to .NET provider classes or DevExpress APIs. Whether a native implementation is FIPS-validated depends on the Windows version, build, edition, operational environment, FIPS configuration, and approved algorithm parameters. DevExpress does not independently validate or certify Windows cryptographic modules.

.NET Framework 4.8 Cryptographic Providers

In .NET Framework 4.8 applications, cryptographic operations can use the following providers:

Operation	.NET Provider	Windows API
SHA-256, SHA-384, SHA-512 hashing	`*Cng` classes	Cryptography API: Next Generation (CNG)
AES encryption	`AesCryptoServiceProvider`	CryptoAPI (CSP)
Random number generation	`RNGCryptoServiceProvider`	CryptoAPI (CSP)

A managed class name alone does not prove that a CMVP certificate covers an operation. Check the native module and the applicable Windows Security Policy to determine whether the certificate covers the operation.

Bouncy Castle Cryptography Library

The cryptographic libraries that DevExpress Office & PDF File API uses depend on the target framework:

Target Framework	Cryptographic Libraries
.NET Framework	`System.Security.Cryptography` APIs and the official BouncyCastle.Cryptography NuGet package (v2.6.2)
.NET	`System.Security.Cryptography` APIs and related system assemblies (`System.Security.Cryptography.Pkcs`, `System.Formats.Asn1`)

.NET Framework APIs do not include all CMS, PKCS, and ASN.1 capabilities available in .NET. The PDF Document API uses Bouncy Castle to implement these capabilities for PDF digital signatures in .NET Framework applications.

Earlier versions of DevExpress Office & PDF File API included a built-in copy of Bouncy Castle 1.8 source code. The current version references the official NuGet package instead, so that the libraries receive Bouncy Castle security fixes without delay.

FIPS Validation Status

The BouncyCastle.Cryptography package is not a FIPS 140-validated cryptographic module. The package implements FIPS-approved algorithms (such as AES, SHA-2, RSA, and HMAC). However, an approved algorithm does not mean that its implementation passed FIPS validation. In .NET Framework applications, PDF digital signature operations that rely on Bouncy Castle do not run within a FIPS-validated module boundary.

Bouncy Castle also ships Bouncy Castle FIPS .NET API (BC-FNA). BC-FNA is a separate product with its own package and Security Policy, not the regular BouncyCastle.Cryptography package. BC-FNA 1.0.2 holds FIPS 140-2 certificate #4416, which is on the CMVP Historical list. BC-FNA is not a drop-in replacement for BouncyCastle.Cryptography. You cannot replace the package or rebuild DevExpress libraries from source code with BC-FNA to obtain a FIPS-validated configuration.

DevExpress Office & PDF File API does not use BC-FNA. A switch to BC-FNA requires API compatibility checks and verification that the libraries use the module according to its FIPS Security Policy. Review the BC-FNA license terms before use. A product that uses a FIPS-validated library is not automatically FIPS-compliant: compliance also depends on the runtime environment and how the application uses cryptography.

Windows Server CMVP Certificates

Microsoft validates Windows cryptographic modules in the CMVP and publishes certificate numbers and Security Policies for each Windows version and build. Certificates for earlier Windows builds can move to the CMVP Historical list. Before you deploy an application, check the current certificate status for the Windows build in your deployment environment.

Refer to the following Microsoft help topics for additional information:

Deployment Requirements

To deploy an application to a FIPS-enforced environment, ensure the following:

The application runs on the Windows build and operational environment that the applicable CMVP certificate covers.
Windows configuration meets the module’s Security Policy and approved mode requirements.
The application does not use legacy document encryption (RC4, PDF AES-256 Revision 5) or other configurations that DevExpress FIPS enforcement rejects.
You use OperatingSystemLevelFipsMode.ForcedFipsMode only as an additional guard, not as a replacement for operating system FIPS configuration or CMVP validation.

Best Practices for FIPS Compliance

Switch to a FIPS-Compliant Format

Convert your documents to FIPS-compliant formats before you deploy your application to FIPS environments. The table below lists the recommended compliant alternatives for common formats:

Current Format	Compliant Replacement
Encrypted XLS	Encrypted XLSX
Encrypted DOC	Encrypted DOCX
PDF with RC4 or AES-128	PDF with AES-256 (`PdfEncryptionAlgorithm.AES256`)
XLSX / DOCX sheet or document protection with SHA-1 or MD5 hash algorithm	SHA-256 (or stronger) protection hash algorithm

The following properties and parameters allow you to specify compliant algorithms for supported formats:

PDF Document API: PdfEncryptionOptions.Algorithm
Spreadsheet Document API: EncryptionOptions.Type
Word Document API: DocumentEncryption.Type

The following code snippet encrypts a PDF document with the AES-256 algorithm (Revision 6):

C#
VB.NET

using DevExpress.Pdf;

using (PdfDocumentProcessor processor = new PdfDocumentProcessor()) {
    processor.LoadDocument("Document.pdf");
    PdfEncryptionOptions encryptionOptions = new PdfEncryptionOptions {
        Algorithm = PdfEncryptionAlgorithm.AES256,
        UserPasswordString = "userPassword",
        OwnerPasswordString = "ownerPassword"
    };
    processor.SaveDocument("EncryptedDocument.pdf",
        new PdfSaveOptions { EncryptionOptions = encryptionOptions });
}

Imports DevExpress.Pdf

Using processor As New PdfDocumentProcessor()
    processor.LoadDocument("Document.pdf")
    Dim encryptionOptions As New PdfEncryptionOptions() With {
        .Algorithm = PdfEncryptionAlgorithm.AES256,
        .UserPasswordString = "userPassword",
        .OwnerPasswordString = "ownerPassword"
    }
    processor.SaveDocument("EncryptedDocument.pdf",
        New PdfSaveOptions() With {.EncryptionOptions = encryptionOptions})
End Using

The following code snippet saves an XLSX workbook with strong (Agile) encryption. The EncryptionType.Strong type uses AES-256 encryption and the SHA-512 hash algorithm:

C#
VB.NET

using DevExpress.Spreadsheet;

using (Workbook workbook = new Workbook()) {
    workbook.LoadDocument("Document.xlsx");
    EncryptionSettings encryptionSettings = new EncryptionSettings {
        Type = EncryptionType.Strong,
        Password = "password"
    };
    workbook.SaveDocument("EncryptedDocument.xlsx", DocumentFormat.Xlsx, encryptionSettings);
}

Imports DevExpress.Spreadsheet

Using workbook As New Workbook()
    workbook.LoadDocument("Document.xlsx")
    Dim encryptionSettings As New EncryptionSettings() With {
        .Type = EncryptionType.Strong,
        .Password = "password"
    }
    workbook.SaveDocument("EncryptedDocument.xlsx", DocumentFormat.Xlsx, encryptionSettings)
End Using

The following code snippet saves a DOCX document with strong (Agile) encryption:

C#
VB.NET

using DevExpress.XtraRichEdit;
using DevExpress.XtraRichEdit.API.Native;

using (RichEditDocumentServer server = new RichEditDocumentServer()) {
    server.LoadDocument("Document.docx");
    EncryptionSettings encryptionSettings = new EncryptionSettings {
        Type = EncryptionType.Strong,
        Password = "password"
    };
    server.SaveDocument("EncryptedDocument.docx", DocumentFormat.Docx, encryptionSettings);
}

Imports DevExpress.XtraRichEdit
Imports DevExpress.XtraRichEdit.API.Native

Using server As New RichEditDocumentServer()
    server.LoadDocument("Document.docx")
    Dim encryptionSettings As New EncryptionSettings() With {
        .Type = EncryptionType.Strong,
        .Password = "password"
    }
    server.SaveDocument("EncryptedDocument.docx", DocumentFormat.Docx, encryptionSettings)
End Using

Note

Compliant document encryption settings do not confirm that your deployment environment is FIPS 140-3 validated. Refer to the Cryptographic Modules and FIPS Validation section for more information.

Check for FIPS Mode and Notify a User

Use the DevExpress.Utils.OperatingSystemLevelFipsMode.IsEnabled property to detect FIPS mode before any API call, and display an actionable message before the library throws an exception.

C#
VB.NET

using DevExpress.Utils;

if (OperatingSystemLevelFipsMode.IsEnabled) {
    // Notify the user that legacy encrypted files are unavailable.
    Console.WriteLine("FIPS mode is on. Encrypted DOC, XLS, and legacy PDF files are unavailable.");
}

Imports DevExpress.Utils

If OperatingSystemLevelFipsMode.IsEnabled Then
    ' Notify the user that legacy encrypted files are unavailable.
    Console.WriteLine("FIPS mode is on. Encrypted DOC, XLS, and legacy PDF files are unavailable.")
End If

Update Existing Exception Handlers

If you process documents that may use non-compliant encryption algorithms, update existing exception handlers. Catch ComplianceViolationException instead of (or in addition to) TargetInvocationException.

C#
VB.NET

using DevExpress.Spreadsheet;
using DevExpress.Utils;

using (Workbook workbook = new Workbook()) {
    workbook.Options.Import.Password = "password";
    try {
        workbook.LoadDocument("Report.xls", DocumentFormat.Xls);
    }
    catch (OperatingSystemLevelFipsMode.ComplianceViolationException ex) {
        // Notify the user that the file encryption is not FIPS-compliant.
        Console.WriteLine("This file format is not supported in FIPS mode: " + ex.Message);
    }
}

Imports DevExpress.Spreadsheet
Imports DevExpress.Utils

Using workbook As New Workbook()
    workbook.Options.Import.Password = "password"
    Try
        workbook.LoadDocument("Report.xls", DocumentFormat.Xls)
    Catch ex As OperatingSystemLevelFipsMode.ComplianceViolationException
        ' Notify the user that the file encryption is not FIPS-compliant.
        Console.WriteLine("This file format is not supported in FIPS mode: " & ex.Message)
    End Try
End Using

Note

Existing catch (SecurityException) blocks do not require changes because ComplianceViolationException derives from System.Security.SecurityException.

Test FIPS Compliance

As a precaution, you can test FIPS compliance without an OS FIPS policy before you update or deploy your application. Set OperatingSystemLevelFipsMode.ForcedFipsMode = true at application startup to enforce FIPS checks in any environment:

C#
VB.NET

using DevExpress.Utils;

// Enforce DevExpress FIPS checks without an OS FIPS policy.
OperatingSystemLevelFipsMode.ForcedFipsMode = true;
// Run document processing tests.

Imports DevExpress.Utils

' Enforce DevExpress FIPS checks without an OS FIPS policy.
OperatingSystemLevelFipsMode.ForcedFipsMode = True
' Run document processing tests.

Important

ForcedFipsMode enforces DevExpress document format and algorithm restrictions only, even if the operating system does not enforce FIPS mode. It does not verify the Windows build, CMVP certificates, or selected cryptographic providers, and does not confirm that the operating system runs a validated module in its approved mode.

Controls

FREE UTILITIES

Controls and Extensions

FREE UTILITIES

.NET

Java

Controls

FREE UTILITIES

Controls and Extensions

FREE UTILITIES

.NET

Java

Format Support and FIPS Compliance

Behavior in FIPS Mode

Cryptographic Modules and FIPS Validation

.NET Framework 4.8 Cryptographic Providers

Bouncy Castle Cryptography Library

FIPS Validation Status

Windows Server CMVP Certificates

Deployment Requirements

Best Practices for FIPS Compliance

Switch to a FIPS-Compliant Format

Check for FIPS Mode and Notify a User

Update Existing Exception Handlers

Test FIPS Compliance