8

suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files VPN-RoadWarrior-Client.key and VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is actually in Sweden most of the year, so i need a secure way to deliver these keys to them remotely without compromising the security of the certificate themselves.

So this is a problem of how to bootstrap VPN security with remote clients in a sane way. For example, I could use truecrypt but then i would have to exchange a password through some unsecured channel

Is there some secure way to bootstrap the transfer of the keys?

my preliminar answer is to request the client to run some program that generates public/private key pair, ask him to send me the public key (which would have to be confirmed over phone, which is widely assumed to be a channel that even if non-secure, preserves integrity of the messages, which is what would really matter for validating a public key), and i would use the public key to encrypt the files and send them over insecure channels

is there such a program that can encrypt files based on a public key and decrypt from a private one?

  • I also need to distribute CA.crt but for the purpose of the question, i'm not concerned with the security of distributing this key
Improve this question

1 Answer 1

Reset to default
7

Your preliminar answer is a good one, if they can install programs use GPGP: http://www.gnupg.org/

Get them to generate a key pair, email you the public key, encrypt whatever you want to that and return over email.

Alternate options are:

  • Encrypt with Winzip AES256 option, choosing a long complex password (goodpassword.com) and exchange that out-of-band e.g. phone, sms

  • Place the files on an encrypted removable media e.g. hardware encrypted such as Ironkey or encrypted CD / USB and send this via courier / post. Exchange password out-of-band. This is more suitable for larger files than just a certificate and key.

Depending on your risk appetite and the information and systems the VPN provides access to you maybe comfortable also using a "secure" file sharing option e.g. Dropbox or Google apps folder

Improve this answer
2
  • 1
    i tried GnuPG and it works wonders! thanks for the suggestion.. i wish i could make RSA-4096 though, but i'm happy with 2048
    – lurscher
    Commented May 9, 2011 at 19:33
  • @lursher glad it worked, whenever you worry about things like RSA 2048 vs 4096 have a look at this: xkcd.com/538
    – Rakkhi
    Commented May 10, 2011 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .