I am using a syymetric token, a fernet from the python cryptography module. I am trying to make it such that a terminal logs into a website automatically.
I store the serial number and mac address of the terminal. The terminal authenticates itself by sending the serial number as a user name, and the encrypted messasge as the password. The key to encrypt the mesage is made up of the serial number and the mac address of the terminal (but not limited to), and the message it send is also the serial number and mac address.
The server then receives the password, checks in its own DB the mac address of the serial number, then knows how to recreate the key, then unencrypts the messasge and checks if the message contains the serial number and mac address correctly.
Is it better to:
- Leave it as is
- Make the encryption message always the same for all terminals (ie. a constant), as mac address and serial number change the encryption key anyways.
- Leave the encryption key the same for all terminals (i.e. a constant), since the message contains the serial number and mac address
- Something else?
It just seems a bit "daft" what Im doing but not sure what is better.