Documentation of Offline-Process

Question

Hi,
is there any document detailing the process for creating and accessing offline-accessible, policy-protected documents? Something, we could hand to our security guys for an evaluation would be really helpful.
TIA,
Nicholas
Edit:
I already looked through the documentation at http://help.adobe.com/en_US/livecycle/9.0/documentation.html an couldn't find anything.

Answer 1

I don't know of any official documentation, but I wrote this overview of the process a while back...
The basics of how offline authentication works are as follows:
When the “offline” permission is assigned to a user in the policy, the policy information and document encryption key are encrypted by a 256 bit AES principal key (generated by the PM server).  The policy information and document encryption key are embedded in the policy protected PDF, and the corresponding Principal Key is downloaded to the users client machine.
For each user that has offline permissions (for a particular document) they will have a corresponding principal key.  Whenever a connection to the Rights Management server is established (a rights managed document is opened, the user invokes the “Synchronize for offline” from Adobe Reader or Acrobat) The principal key(s) is downloaded to the client machine and stored in the microsafe.  The microsafe is essentially an encrypted database that is associated with the user account on the client machine.
For example, when I log onto my computer as “sforrest” I have a microsafe available to me that stores my principal keys.  When I open a document offline for which I have permissions, the Microsafe is accessed and the protected documents corresponding principal key is retrieved and used to decrypt the document key that is embedded in the rights managed document.  The document key is then used to decrypt the document itself.
Things to note:
There is one principal key per user, per document that the user has been given offline permissions.  i.e. If I have 10 PDFs that I am allowed to view offline, then I will have 10 principal keys in my Microsafe.
There is a microsafe for each user (tied to their profile\user account) on the client machine.  For example, if I logon to my Windows machine, when I open a rights managed PDF (offline) that I have permissions to view in the policy, I will NOT be prompted for a user name and password as I have already authenticated to the client machine, and therefore my microsafe.
If the policy was configured to “audit” events, the events will still be recorded when the document is accessed offline and stored locally until a connection is established to the RM server, at which time the recorded events will be uploaded to the RM server.
As for custom authentication, I don’t believe there would be any difference in the offline behaviour, as all of the information I noted above would would still be relevant.  The “offline” authentication method would be independent of the authentication steps taken when a connection to the RM server is available and online authentication takes place.
Hope this helps.
Steve