I want to send a Truecrypt volume through email. Of course, I need to password protect it, and the recipient needs to know the password too. A Diffie-Hellman public key exchange would seem to be the solution. What is the easiest and safest way of doing this? Specific instructions would help.
Let's call the person you are sending the volume to Bob, since that is traditional. Then:
- You choose a very large - at least 300 digits long - prime number p, and a small number g and send them to Bob (the person you are sending the Truecrypt volume to).
- You pick a large (at least 100 digits) secret number a.
- Bob picks a large (at least 100 digits) secret number b.
- You calculate the value of g^a mod p and send it to Bob. Call this C.
- Bob calculates g^b mod p and sends it to you. Call this D.
- You calculate D^a mod p. This gives you a secret number S.
- Bob calculates C^b mod p. This gives him S as well.
Now you an Bob both know S. Eve, who has listened to the whole conversation, knows the values of p, g, C, and D but she cannot calculate the value of S because she does not know the values of a or b - those were secret and never went over the insecure communication channel.
Note however that this is not enough to solve your problem. You are still vulnerable to a Man-In-The-Middle attack. If Eve can impersonate Bob and trick you into doing the above with her instead of him, then she gets to pick b and so she can work our S. So you need to add some authentication so you are sure that it's really Bob you are talking to.
The simplest way would be to use some form of secure email: S/MIME or PGP. Both have advantage and disadvantage that are out of scope but they both will allow you to protect the password (you can protect the TC file as well but it's unnecessary).
You could perform a DH key agreement exchange over email, mind you:
I do not recommend you follow these steps: using a standard mail security package will be both simpler and more secure
Here is how you'd do it, however:
- Send a first message where you agree on the values of P and G (there are plenty of libraries that can help you do that or you could even pick an existing combination)
- Each pick your secret integer (large enough) a and b
- Each perform (A=G^a mod P) and (B=G^b mod P) and exchange A and B
- Each perform (s=b^a mod P) and (s=b^a mod P) to obtain a shared secret s
- use s as password for your TC file.
Please note, however, that you need to use values of reasonable size for security (P must be about that 1024 bits at least, for instance) so you'll have to use big number arithmetic to manipulate them and you will need to check that they do not belong to a special class of weak values (see the answer to this question which describe the issue).
Because of that, picking P and G can be tricky and complex. I would recommend you use OpenSSL to do it for you in the following way:
openssl dhparam 1024 -text
This will generate a 1024 long P using the default generator G=2 and display it in a (somewhat) readable format.