Company A needs to set up an IPsec VPN with company B, where each side will configure its own devices. Is there a recommended practical and quick way to communicate a pre-shared key from A to B? I understand that using e-mail is discouraged for security reasons. And telling it over the phone is inconvenient and error-prone.
This is a perfect application for public-key cryptography (ie. asymmetric cryptography).
They provide you with a public key (that needn't be a secret and can't be used to decrypt anything) which can be used encrypt what you need to send them, then they use their private key to decrypt it (which they don't give to anyone).
PGP would be a suitable implementation if email would otherwise be convenient:
There is the issue of how do they give you their public key without the risk someone will substitute it for another. This is probably not a significant risk unless an adversary is expecting you to send a public key over a network they control. If you are concerned you could address this in one of these ways:
- They could post it to you and you could read it via OCR (can the mail man be trusted though?)
- You could both calculate a hash of the key and they could read it out over the phone so you could verify it (less error prone, you probably don't even need to check all characters)
- Theoretically if they publish it on a page with SSL you should be safe