This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, DocumentA, encrypted with AES-128 using a password. I want to share DocumentA with Bob, via e-mail. I e-mail Bob DocumentA - now how do I give him the password?
This is a situation that would come up quite frequently, so calling to verbally give him the password each time would not be convenient. Obviously including the password in the e-mail itself is a terrible idea and defeats the purpose of encryption.
I've read the FIPS documentation from NIST (here), and the associated annexes A-D (available at the same link) and haven't been able to find any information on this rather crucial part.
Can anyone point me to the documentation that states this? Thanks so much.