How Safe Can a Six-Character Redeem Code Be?
Suppose we send a customer a six-character code such as 7Q2M9A for a benefit they may claim once. It must contain
digits and uppercase letters, and another customer must not receive the same code. On entry, the server checks whether
the code was actually issued, grants the benefit, and prevents a second use.
This is a bearer-style redeem code: possessing the string lets someone claim the benefit. It has different requirements from a public promotional code shared by many people. This article concerns individually issued codes.
Before choosing a cipher, we need to ask: which parts handle collision-free issuance, hiding issuance order, valid redemption, and guessing resistance?