Generate range of promotion codes that are not guessable

Question

I'm looking for a way to generate a range of promotion codes. It would be trivial if it wasn't for both these requirements. That it needs to be a range (not saving every single promotion code in a database) to make it fast and that it is not guessable so it can not generate codes like this 000-000-001, 000-000-002, 000-000-003... and so on.

Is there an algorithm to solve this problem? I could try to solve it with some sort of hashing but trying to solve this security problem myself might leave the service open to exploits that I didn't think about.

See this question - https://stackoverflow.com/questions/11708559/coupon-code-generation — Subir Kumar Sao, Sep 20 '19 at 18:21
@JohannesKuhn the question was just edited. Look at the initial version. And honestly, I still consider it to be too broad, respectively a mere requirement dump without any own efforts. — GhostCat, Sep 20 '19 at 18:28
Does range imply sequence? I'm not certain what is being asked here. — WJS, Sep 20 '19 at 18:49
By range, I mean being able to refer to one database record for every code in the range to find out if it exist or not. So if the range contained 1 million code there would be one row in the database and not 1 million rows. — Icy Creature, Sep 20 '19 at 18:52

score 1 · Accepted Answer · answered Sep 21 '19 at 09:30

I think your first requirement (not saving every promotional code in a database) is problematic.

The question is, is it allowed to redeem a single promotional code multiple times?

If this is not allowed then you have to store the already redeemed codes in some persistent data store anyway, so why not store the generated codes in the persistent data store from the beginning, together with a flag indicating whether it has been redeemed or not?

If you don't want to store all codes / can't store all codes, you could still use a Random with a seed unique to your current campaign:

long seed = 20190921065347L; // identifies your current campaign
Random r = new Random(seed);
for (int i = 0; i < numCodes; i++) {
    System.out.println(r.nextLong());
}

or

long seed = 20190921065347L; // identifies your current campaign
Random r = new Random(seed);
r.longs(numCodes, 100_000_000_000_000L, 1_000_000_000_000_000L)
 .forEach(System.out::println);

To find out whether a code is valid you can generate the same codes again:

long seed = 20190921065347L; // identifies your current campaign
Random r = new Random(seed);
System.out.println(
    r.longs(numCodes, 100_000_000_000_000L, 1_000_000_000_000_000L)
     .anyMatch(l -> l == 350160558695557L));

score 0 · Answer 2 · answered Sep 20 '19 at 19:08

0

Would something like this work?

      Random r = new Random();
      long start = 1_000_000_000;
      long end = 10_000_000_000L;

      long n = r.longs(1, start, end).reduce(0, (a, b) -> b);
      String s = String.format("%,d", n).replace(",", "-");
      System.out.println(s);

answered Sep 20 '19 at 19:08

WJS

36,363
4
24
39

Not really, it doesn't solve both problems. Sure it is not guessable but how would you store the range and not every individual code. – Icy Creature Sep 20 '19 at 20:09
So you want to get the same code from the range, using the range to protect the actual code? If that is correct, why not store a SHA hash representation of the code? Then when someone enters the code you just run the SHA algorithm to see if it matches. Of course, that is not very fast. And just to be clear (if it isn't already) I may not be fully understanding your requirements. – WJS Sep 20 '19 at 20:19

Generate range of promotion codes that are not guessable

2 Answers2