Two way encryption from int to short string
I am creating a tiny web application where our clients can update some information about their company. Currently, clients do not have a username / password and we do not want to check their registration, so we want to give them an automatically generated password / key to enter the website.
Our plan is to encrypt their customerId and provide it to the client so that he can enter this key into the webapp so that we can decrypt the key into his id.
There are about 10k customers and they don't have all the emails, so some will receive an email with a URL and a code. This means that the client must enter a code, so the code can be no more than 8 characters (preferably 6).
Here's an empty template:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace ConsoleApplication1
{
class Program
{
static void Main(string[] args)
{
int passwordLength = 6;
int customerId = 12345;
string encrypted = Crypter.Encrypt(customerId, "secretKey", passwordLength);
if (customerId == Crypter.Decrypt(encrypted, "secretKey"))
{
Console.WriteLine("It worked! Well done!");
}
}
}
public static class Crypter
{
public static string Encrypt(int input, string key, int passwordLength)
{
string encryptedString = "";
//do encrypt stuffz here
return encryptedString;
}
public static int Decrypt(string encryoted, string key)
{
int decrypted = 0;
//do decrypt stuffz here
return decrypted;
}
}
}
=> Can anyone link me with more information on how to do this?
I'm not looking for "plz send me tez codez", but if someone else has done something similar already, feel free to share.
Thanks in advance for any information.
a source to share
First, I'm not sure if your idea is very good. But, putting that aside for the mummy, I'm not sure if you really need to encrypt / decrypt anything.
What you are saying is that you will take the internal client id and turn it into another id (in your case, an encrypted version of the internal client id). Why not just create two keys - the internal customer ID (the one you store in your database and use as the primary key) and the external customer ID (another 8-digit unique key that is used as an alternative). You store them both in your database and when they "enter" search engines based on later versions.
I would like you to do this: What makes someone guess your 6 or 8 digit keys. Whether they are encrypted identifiers of just some random set of characters, just 6 or 8 digits, it doesn't take long for someone to attack your site and guess someones key. The fact that you are going to format these keys to exactly 6 or 8 digits makes the job of an attacker easier.
I think you'd better send this 8 digit key so that the user can enter some information that you already know (name, email, company name, etc.) and then get them to figure out the user ID / login in their own way choice.
a source to share
Not sure if I fully understand your intentions here. Can't you just generate a UUID or something similar and use that (or part of it) as a code for the user? You will just need to store it along with the user ID in the database.
Alternatively, to enforce uniqueness, you can create an N-char code based on two separate inputs. Let's say 5 out of 8 characters can be generated randomly, while the other 3 will be uniquely based on customer ID.
a source to share