I have multiple entities (servers) that all share a private secret already. Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times.
I have another server (command & control) with a communication channel to all my clients. I want the command & control to handle the generating and rotating of the temporary secrets. I also don't want the command & control to ever know the temporary secret.
- command & control generates a random blob
- command & control distributes the blob to clients
- clients use their shared secret to reduce the blob into a common secret (using I presume a pseudo-random cryptographic function)
- the final secret needs to be ~80 bytes
What would be the best practices to do this?