Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations?
Our situation: we have some technical staff well versed in crypto, PKI, key use, and key management. And nontechnical staff who aren't.
We have mandates / requests to exchange encrypted data with end users. On the receipt side, we offer a public PGP key and can decrypt data locally in a secure environment. We encourage (but don't require) users to encrypt data sent to us.
This question arises on the sending side. Clients and regulatory environments vary (finance, energy, healthcare, services, government), as do end-user platforms (mostly PC, some Mac, some other).
I'm leaning toward two suggestions:
- Client creates, as needed, a PGP keypair, and shares the public key with us. We encrypt data against that, send it by appropriate means, and they decrypt the data.
- We use an appropriate, acceptable symmetric-key encryption tool (e.g.: WinZIP files) and share the password out-of-band.
Not having to generate all the relevant text would be a bonus.
What I've found are references which aren't particularly relevant because:
- They're very dated (1990s / early 2000s), technical PGP/GPG references.
- They're newer, but generally Linux/Ubuntu-specific references (use 'em, like 'em, but most of our users are elsewhere).
- They don't address the business-needs case, or importance of key management for PKI in language an end-user is likely to understand.