Re: Unique code for every user

From:

Daniel Pitts <newsgroup.spamfilter@virtualinfinity.net>

Newsgroups:

comp.lang.java.programmer

Date:

Tue, 06 Oct 2009 11:00:45 -0700

Message-ID:

<1CLym.473068$Ta5.135499@newsfe15.iad>

Barry wrote:

HI,

I'm building a system where I wish to give my users a unique code each
time they perform a transaction. On returning to my system, they can
then enter this code to retreive the data associated with it.

I number my transactions in assending order, 0, 1, 2 and so on, so I
need a function that will transform this value to a unique nine digit
number. I also need a function that will transform this value back
again to the transaction number.

Something like this -

long codeTransactionNumber(long transactionNumber)
{
return transactionNumber + 100000000;
}

long uncodeTransactionNumber(long transactionNumber)
{
return transactionNumber - 100000000;
}

Thie problem with this though is that the user with the code
100-000-003 can easily guess that 100-000-004 is also a code for
another transaction. What would be a better way to generate this
number?

Also, I should point out that the number of clients that this system
has is very low - 5 per day max. Also, they enter the code using a
touch screen interface so entering many codes is difficult.

Thanks for your advice,

Barry

You could try encrypting the transactionId and a hash-code. Its
important to store the hash-code and check it on decrypting, otherwise
they may still be able to find other transactions.

Psuedo-code:

public String calcSecureCode(long transactionId) {
    return transactionId + "-" + calcHash(transactionId) ;
}
String encodeTransactionNumber(long transactionId) {
    String toEncrypt = calcSecureCode(transactionId);
    return encrypt(toEncrypt);
}

Long decodeTransactionNumber(String encrypted) {
    String decrypted = decrypt(encrypted);
    long transactionId =
Long.valueOf(StringUtils.substringBefore(decrypted, "-"));
    if (calcSecureCode(transactionId).equals(decrypted)) {
       return transactionId;
    }
    // Failed validation.
    return false;
}

make sure "encrypt" and "decrypt" use secure encryption, as the
transaction+hash is still vulnerable if the outside user figures out
your hash algorithm.

--
Daniel Pitts' Tech Blog: <http://virtualinfinity.net/wordpress/>