Question

I am wondering if it is possible to generate a “key” that is valid for a period of (approximately) three months?

For example, let’s say (hypothetically) that I generate a key like this (pseudocode):

Key = HASH ( MachineID, Salt );

And the way I verify a key is valid is to check like this:

isValid(Key)
{
   return Key == HASH ( MachineID, Salt )
}

How would you extend this to generate a key like this:

Key = HASH ( MachineID, Salt, LastMonth, ThisMonth, NextMonth );

But still have your isValid work correctly?

One way I can see is:

isValid(Key)
{
   return Key == HASH ( MachineID, Salt, (LastMonth), (ThisMonth), (NextMonth) )
   || Key == HASH ( MachineID, Salt, (LastMonth-1), (LastMonth), (ThisMonth) )
   || Key == HASH ( MachineID, Salt, (ThisMonth), (ThisMonth+1), (ThisMonth+2) )
}

But I would like to know if any better ideas come to mind.

Answer 1

A typical way of doing this is to compose a cleartext message explaining what is needed to reach the key, which is then followed by the secure digest. You would thus return something like

function Key(password, expriry) {
    return "Expires: " + dateformat(expiry) +
           HASH(salt + expiry + password)
}

Note that the returned key contains the expiration date in clear text, but also includes it in the digest so that it cannot be tampered with. As always, it’s not necessary to decode the digest, only verify that the same inputs produced the same digest.