2

This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, DocumentA, encrypted with AES-128 using a password. I want to share DocumentA with Bob, via e-mail. I e-mail Bob DocumentA - now how do I give him the password?

This is a situation that would come up quite frequently, so calling to verbally give him the password each time would not be convenient. Obviously including the password in the e-mail itself is a terrible idea and defeats the purpose of encryption.

I've read the FIPS documentation from NIST (here), and the associated annexes A-D (available at the same link) and haven't been able to find any information on this rather crucial part.

Can anyone point me to the documentation that states this? Thanks so much.

  • What speaks against Public-Privat-Key Encryption instead of Symmetric Encryption? eg. PGP for Email – Serverfrog Mar 27 '18 at 14:45
  • @Serverfrog - The only thing against it is that I'm having trouble understanding how the public key are made public. I'm trying to wrap my brain around Certificate Authorities. – Eliza Bennet Mar 27 '18 at 14:57
  • @ElizaBennet How exactly is compliance with FIPS 140-2 important here? What security level is your environment in? FIPS compliance isn't just met by choosing controls from the annexes. ;) – Tom K. Mar 27 '18 at 15:23
  • @TomK.Well, we're working on documenting complete compliance with the U.S. government's CUI rules (NIST SP 800-171). Since the documents are kind of low on specifics, I figured that choosing FIPS compliant encryption would be ideal, because their own standards have to be good enough. – Eliza Bennet Mar 27 '18 at 16:31
  • For instance, one part (3.13.8) says to "Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards." - I was planning on ensuring our cryptographic methods are FIPS-compliant in order to fully check that box off. As of now, we use secure file transfer systems, but I want to establish a policy in case secure file transfers aren't available for some reason. – Eliza Bennet Mar 27 '18 at 16:37
1

You must NEVER send a password over e-mail, or similar way. You can solve that issue using Public key cryptography (or asymmetrical cryptography). I won't get into much detail about how it works but the basic idea is that everyone has a pair of keys, a public (which should be public) and a private one (which should be kept secret). The public key is used to encrypt messages and the private key to decrypt messages.

enter image description here

For example if Bob wants to send "info.pdf" to Alice, he will encrypt it with Alice's public key, which is known, and only Alice's private key can be used for the decryption (only Alice knows the private key). This of course is a very minimal example and public key cryptography is a huge topic, so you should definitely make your research on the subject.

Now there are many easy ways you can use to encrypt your e-mails, files etc... For example PGP is one of the most popular standards to use for email encryption that uses symmetric-key cryptography to encrypt the data and public-key cryptography to encrypt the key that was used to encrypt the data. Then the receiver uses his private key to decrypt the encrypted-key, and then uses the decrypted-key to decrypt the data. So PGP uses both symmetric-key cryptography and public-key cryptography.

  • I was afraid that was the answer, because I don't understand the whole digital certificates/signatures field. I'll do more research into that. But what I don't understand is why FIPS approves of using password protection when you can't really use it...? – Eliza Bennet Mar 27 '18 at 14:51
  • You have to know what to use in different circumstances. Also don't forget that One Time Pad, when is correctly used is unbreakable, but it just can't be used for everything! – game0ver Mar 27 '18 at 14:58
  • Also the link you posted also talks about "cryptographic key management" so I suppose it refers to public key cryptography. – game0ver Mar 27 '18 at 15:03
  • Thanks for the edit with more details and the picture, that helps me get this concept straight! – Eliza Bennet Mar 27 '18 at 19:28
  • @ElizaBennet You're Welcome! Also have in mind that PGP combines symmetric-key cryptography with public-key cryptography, so in this sense it also uses a password to encrypt the initial data but in order to safely transmit the key it uses asymmetrical cryptography. I also edited the answer to mention that. – game0ver Mar 27 '18 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.