2-way encryption from int into a short string

Question

Hi guys.

I'm building a tiny webapplication in which our customers can update some details about their company. The customers currently don't have a login/password and we don't want to validate their registration, so we want to give them a automaticly generated password/key to login to the website.

Our plan to encrypt their customerId and give that to the customer so that he can enter that key on the webapp to allow us to decrypt the key into his ID.

There are about 10K customers and they don't all have an email, so some will receive a letter with the URL and the code. This means that the customer has to type the code in, so the code can't be more than 8 characters (preferably 6).

Here's an empty template:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            int passwordLength = 6;
            int customerId = 12345;
            string encrypted = Crypter.Encrypt(customerId, "secretKey", passwordLength);
            if (customerId == Crypter.Decrypt(encrypted, "secretKey"))
            {
                Console.WriteLine("It worked! Well done!");
            }
        }

    }

    public static class Crypter
    {
        public static string Encrypt(int input, string key, int passwordLength)
        {
            string encryptedString = "";
            //do encrypt stuffz here

            return encryptedString;
        }
        public static int Decrypt(string encryoted, string key)
        {
            int decrypted = 0;
            //do decrypt stuffz here

            return decrypted;
        }
    }
}

=> Can anyone link me to more information on how to do this?

I'm not looking for a "plz send me teh codez" but if anyone has already made something like this, feel free to share.

Thanks in advance for any information.

Answer 1

Not sure that I quite understand your intentions here. Can't you simply generate a UUID or something akin and use that (or part of it) as the code for a user? You would simply need to store it alongside the user ID in the database.

As an alternative to insure uniqueness, you could generate a N-char code based on two separate inputs. Say, 5 out of 8 chars could could be generated randomly, while the other 3 would be uniquely based on the customer ID.

Answer 2

Don't base your secret code on user ID. Instead, generate a random 6 character string for each customer and store it in the database. It's not vulnerable to finding the actual algorithm.

Answer 3

Firstly, I'm not sure if your idea is a very good one. But, putting that aside for a momement, I'm not sure you really need to encrypt/decrypt anything.

What you're saying is that you'll take some internal customer ID and turn it into some other ID (in your case, and encrypted version of the internal customer ID). Why not just create 2 keys - an internal customer ID (the one you keep in your database and use as the primary key) and external customer ID.(another 8 digit unique key that is used as an alternative). You store both in your database and when they "login" you lookup based upon the later.

I would as you you this though: What stops someone guessing your 6 or 8 digit keys. Regardless of whether they're encrypted IDs of just some random set of characters, with only 6 or 8 digits it won't take long for someone to run an attack on your site and guess someones key. The very fact that you're going to format these keys into exactly 6 or 8 digits makes the attacker's job easier.

I think you'd be better of sending out this 8 digit key, getting the user to enter some info that you already know (their name, e-mail address, company name etc) and then getting them to define a userid/login of their choice.

Answer 4

I agree with another poster who says don't base the encrypted string on something in your database. It is much easier to generate unique random strings to store in the database.

But, if you must use the user ID, I suggest looking at the following namespace.

System.Security.Cryptography