I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file producer cannot directly communicate with the authentication machine. My current methodology is as follows:
- File Producer passes time and secret to a non-reversible hashing algorithm and exports that
File Authenticity Check:
- If the time specified in the file is within arbitrary bounds and a secret associated with the ID is found continue otherwise fail
- Passes time and secret to a non-reversible hashing algorithm if it matches the oneTimeKey then it is assume to be valid.
In this methodology I have to store the secret in a database, I would prefer not to do this but I can't think of an effective way to achieve this goal any other way. Have I looked over something? Can I achieve this without storing the secret on the authentication side?