suppose i've created VPN certificates for a certain VPN-RoadWarrior-Client, expressed in the files
VPN-RoadWarrior-Client.crt*, however VPN-RoadWarrior-Client is actually in Sweden most of the year, so i need a secure way to deliver these keys to them remotely without compromising the security of the certificate themselves.
So this is a problem of how to bootstrap VPN security with remote clients in a sane way. For example, I could use truecrypt but then i would have to exchange a password through some unsecured channel
Is there some secure way to bootstrap the transfer of the keys?
my preliminar answer is to request the client to run some program that generates public/private key pair, ask him to send me the public key (which would have to be confirmed over phone, which is widely assumed to be a channel that even if non-secure, preserves integrity of the messages, which is what would really matter for validating a public key), and i would use the public key to encrypt the files and send them over insecure channels
is there such a program that can encrypt files based on a public key and decrypt from a private one?
- I also need to distribute
CA.crtbut for the purpose of the question, i'm not concerned with the security of distributing this key