Let say I have several application that aren't connected to any network, and I have one requirement that says each application could produce a token from an input that other application could validate the token provided the same input is given to it.
For example, a person accessing application 1, input a string and get a token, then he/she travels to application 2, input the string and the token to it, then application 2 tells to the person if the token is valid or not. Even thought the token is exposed to users, it should be safe enough that no one could fake it.
In prototype phase, I simply encrypt the input using AES with a hard coded 128 AES Key and then obfuscate the cipher text a little to generate the token. But I still have some worries as I get an impression that using same static key for symmetric are vulnerable and easy to compromise.
Because there's no means for these application to talk to each other and which application will validate the token generated by which application, I'm planning to use some kind of AES Key generation to renew AES key periodically for all applications. I was hoping that the key will be different from time to time, but all the application will be using the same key at anytime.
Is there exist an open standard algorithm or strategy to generate AES Key that meets my need above? Maybe I haven't look enough, but I can't seems to find it.
Thanks in advanced!