Generate User Specific 1 Time Coupon Code

Question

So I need to generate a code that can be tied to a specific user/prospect with a dollar amount built into it. It needs to be reversible so that client application can confirm the validity of the code and apply the discount a manager intends.

I'd like to make the code as short as possible but it needs to be well obfuscated so that the salesmen cannot start messing with it on their own.

I can come up with something myself bouncing numbers around, dividing by pi and converting to hex and whatnot but I'd be really interested in ideas or best practices from the community.

I'm doing this in C# but I expect that methods from any language can be translated.

edit: to clarify. I can't store this stuff ahead of time, the codes have to be built on the fly and carry all the information with them.

eg. Salesman 14 calls in about client 773 and wants to give them $500 off their order. 14, 773 and 500 must be in the coupon code and able to be extracted in the client app after the salesman keys in the code.

Answer 1

I would use the customer code and the coupon expiration date. As for verification, you could just store valid coupons in your database and verify off that. You could scan the coupon table once a day to purge expired codes.

Answer 2

How clever are your salesmen (or women)? Could you just base 64 encode the value?

Check here for how to base64 encode and decode:

http://arcanecode.wordpress.com/2007/03/21/encoding-strings-to-base64-in-c/

Other than that I would encrypt the value with a key known by you and the client application.

Answer 3

Sounds like a case for asymetric encryption. You could give out the public key to everybody, thus providing them with the info for validating the coupon, but the ability to create a cupon would rest with the owner of the private key (= you).

I would create a coupon class that serialises to xml, and then encrypt the xml string. Validation would be to decrypt the string and see if it is valid xml (I recommend not to deserialise the object without checking this before).

Answer 4

Generate a public/private key pair for signing. Digitally sign the combination of user ID and coupon value using the private key. Publish the coupon value + signature as the coupon code, encoded, for example, using letters and numbers. The client application would verify the code by recreating the combination of data that was originally signed (e.g., prepend the user ID to the coupon value) and then verifying the digital signature.

Answer 5

I'm guessing from way you've phrased the question you don't want to store the codes in a database (if you did, you could simply verify each code against the database)

So, what you could do is take all the pertinent information about what is in the coupon, then hash it together with a secret salt to prevent tampering.

Thus, suppose you wanted a coupon for user 23 worth $200, you might build up a string like "23_200", and calculate an MD5 hash with a secret salt of "BillTheLizard" to get 2671519131e974ee6fc746151e98f4a8, thus the complete code you give the customer is 200_23_2671519131e974ee6fc746151e98f4a8

Now when you received the code, you break it apart, and check that md5("200_23"+secret) = 2671519131e974ee6fc746151e98f4a8 to verify the value

Edit: If an 32 character hash is too long, you could always truncate it, e.g. chopping it down to 8 chars would still give you 4294967296 different hash values.

Answer 6

This is just to sum up the answers so far. There are two main distinct ways of generating such coupon codes:

1. Centralized solution: the information about each coupon is stored in your database. The coupon code can then be randomly generated and short -- it's just a reference to a record in your database that contains all the necessary information, such as coupon value, customer ID, rep ID. Verifying such a code requires online access to your servers.

2. Decentralized solution: the coupon is a standalone piece of information that can be verified in offline mode, without accessing any of your servers. As a result, the coupon code has to contain some (or even all) of the information. The most secure way is to use asymmetric cryptography so that nobody other than the holder of the private key (you) can generate coupons.

Answer 7

Steve Gibson talks about one time passwords on his website, but there's no reason why you couldn't use it to create one time coupon codes: http://grc.com/ppp