Generate a strong pre-shared key

You can use a pre-shared key (PSK) (also called a shared secret) to authenticate the Cloud VPN tunnel to your peer VPN gateway. As a security best practice, we recommend that you generate a strong 32-character pre-shared key.

Use the following methods to generate a strong 32-character pre-shared key.

For more information about Cloud VPN, see the Cloud VPN overview.

For definitions of terms used on this page, see Key terms.

Generate a PSK by using JavaScript

You can generate the pre-shared key directly in a document by using JavaScript with the W3C Web Cryptography API. This API uses the Crypto.getRandomValues() method, which provides a cryptographic way of generating a pre-shared key.

The following code generates a random 32-character string by creating an array of 24 random bytes and then base64 encoding those bytes:

 var a = new Uint8Array(24);
 window.crypto.getRandomValues(a);
 console.log(btoa(String.fromCharCode.apply(null, a)));

To generate a PSK now, click Regenerate:

Generate a PSK by using OpenSSL

In the Linux or macOS command-line interface, run the following OpenSSL command:

openssl rand -base64 32

Generate a PSK by using /dev/urandom

On a Linux or macOS operating system, use /dev/urandom as a pseudorandom source to generate a pre-shared key.

1. In the Linux or macOS command-line interface, run the following command to send the random input to base64:

   head -c 32 /dev/urandom | base64
   

2. Pass the random input through a hashing function, such as sha256:

   • On Linux:

     head -c 4096 /dev/urandom | sha256sum | cut -b1-32
     

   • On macOS:

     head -c 4096 /dev/urandom | openssl sha256 | cut -b1-32
     

What's next

• To use high-availability and high-throughput scenarios or multiple subnet scenarios, see Advanced configurations.
• To help you solve common issues that you might encounter when using Cloud VPN, see Troubleshooting.