Re: Unique code for every user
Barry wrote:
HI,
I'm building a system where I wish to give my users a unique code each
time they perform a transaction. On returning to my system, they can
then enter this code to retreive the data associated with it.
I number my transactions in assending order, 0, 1, 2 and so on, so I
need a function that will transform this value to a unique nine digit
number. I also need a function that will transform this value back
again to the transaction number.
Something like this -
long codeTransactionNumber(long transactionNumber)
{
return transactionNumber + 100000000;
}
long uncodeTransactionNumber(long transactionNumber)
{
return transactionNumber - 100000000;
}
Thie problem with this though is that the user with the code
100-000-003 can easily guess that 100-000-004 is also a code for
another transaction. What would be a better way to generate this
number?
Also, I should point out that the number of clients that this system
has is very low - 5 per day max. Also, they enter the code using a
touch screen interface so entering many codes is difficult.
Thanks for your advice,
Barry
You could try encrypting the transactionId and a hash-code. Its
important to store the hash-code and check it on decrypting, otherwise
they may still be able to find other transactions.
Psuedo-code:
public String calcSecureCode(long transactionId) {
return transactionId + "-" + calcHash(transactionId) ;
}
String encodeTransactionNumber(long transactionId) {
String toEncrypt = calcSecureCode(transactionId);
return encrypt(toEncrypt);
}
Long decodeTransactionNumber(String encrypted) {
String decrypted = decrypt(encrypted);
long transactionId =
Long.valueOf(StringUtils.substringBefore(decrypted, "-"));
if (calcSecureCode(transactionId).equals(decrypted)) {
return transactionId;
}
// Failed validation.
return false;
}
make sure "encrypt" and "decrypt" use secure encryption, as the
transaction+hash is still vulnerable if the outside user figures out
your hash algorithm.
--
Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>