# Generating and distributing a secret without trusting the source

I have multiple entities (servers) that all share a private secret already. Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times.

I have another server (command & control) with a communication channel to all my clients. I want the command & control to handle the generating and rotating of the temporary secrets. I also don't want the command & control to ever know the temporary secret.

So basically:

• command & control generates a random blob
• command & control distributes the blob to clients
• clients use their shared secret to reduce the blob into a common secret (using I presume a pseudo-random cryptographic function)
• the final secret needs to be ~80 bytes

What would be the best practices to do this?

You'd use a KBKDF on the clients, using the earlier secret as Input Keying Material (IKM) using the random as salt or Info input. KDF's generally have an output size parameter as well.