One post tagged with "Application Security"

Suppose we need to generate redeem codes made of exactly six uppercase letters and digits.

36^6 = 2,176,782,336
log2(36^6) = approximately 31.02 bits

More than 2.1 billion strings are possible. At first glance, that seems large enough to stop worrying about both duplicates and guessing. Once we design an actual issuer, however, we discover that this single number hides four different problems.

• Format: a code must contain exactly six ASCII characters from 0-9 and A-Z.
• Uniqueness: two distinct issuances must never receive the same code.
• Prediction resistance: observing one code should not make the next code easy to calculate.
• Validity: a well-formed string is not necessarily a code that was issued and can still be redeemed.

This article is not about public promotional codes shared by many people. It focuses on bearer-style redeem codes that are generated once per issuance and let whoever possesses the string claim a benefit. Mathematics that solves one of these problems does not automatically solve the others.

Collision-free generation, hiding issuance order, and deciding whether a redemption is valid are separate requirements.