generating coupon code - vb.net

Question

I have five fields
1.CustomerID
2.BusinessID
3.OfferID
4.Day of Purchase
5.Month Of Purchase
Private Function MakeCouponCode(ByVal sn As Int16) As String
Dim a(16) As Char
Dim chk As Int16
Dim check, tDate, slNo, couponCode As String
'..............................setting customerID
If HFCustID.Value.Length = 1 Then
HFCustID.Value = "00" & HFCustID.Value
ElseIf HFCustID.Value.Length = 2 Then
HFCustID.Value = "0" & HFCustID.Value
End If
'..............................setting businessID
If HFBusiID.Value.Length = 1 Then
HFBusiID.Value = "0" & HFBusiID.Value
End If
'..............................setting offerID
If HFOfferID.Value.Length = 1 Then
HFOfferID.Value = "0" & HFOfferID.Value
End If
'..............................setting todays date as ddmm
If Today.Day.ToString.Length = 1 Then
tDate = "0" & Today.Day.ToString
Else
tDate = Today.Day.ToString
End If
If Today.Month.ToString.Length = 1 Then
tDate = tDate & "0" & Today.Month.ToString
Else
tDate = tDate & Today.Month.ToString
End If
'...............................calculating and setting the check digits
If sn < 10 Then
slNo = "0" & Convert.ToString(sn)
Else
slNo = Convert.ToString(sn)
End If
'...............................calculating and setting the check digits
chk = Convert.ToInt16(HFCustID.Value) + Convert.ToInt16(HFCustID.Value) + Convert.ToInt16(HFOfferID.Value) + Today.Day + Today.Month + sn
check = Convert.ToString(chk)
If check.Length = 1 Then
check = "00" & check
ElseIf check.Length = 2 Then
check = "0" & check
End If
'...............................concatenate all for coupon code
couponCode = HFCustID.Value & HFBusiID.Value & HFOfferID.Value & tDate & slNo & check
Return couponCode
End Function
I am using the above code to make a CouponCode...but somehow its not very hard to crack...Any idea how can i make a bullet proof coupon code in not more than 16 digits????

Answer 1

If I understand you correctly, you're generating a 16-digit coup code, and then to validate it, you're using a sort of checksum?
If anyone figures out your checksum algorithm, they're going to be able to generated unlimited coupons.
I think it's better to pre-generate a few thousand or hundred thousand (however many you need) coupon codes, and perhaps make them one-time use (by deleting them or checking if they're already used).
Of course...this depends on your needs. A lot of sites just have easy-to-remember unlimited use coupon codes just to trick people into thinking they're getting a deal.

Answer 2

If you don't want people to be able to generate or guess valid coupon codes, consider using a cryptographic hash function.

Answer 3

One option is to use a hash function. On wikipedia you can find a whole list of them for various hash sizes and uses. With 16 digits you are looking at a 64 bit hash function which I would not call bullet proof.

Answer 4

1.CustomerID i guess at least 3 digits
2.BusinessID maybe 2 digits
3.OfferID 2 digits?
4.Day of Purchase 2 digits
5.Month Of Purchase 2 digits
so in total 11 digits. only 5 remaining.
I would create a longer code and then split it up into 2 parts
1. part are all information that you listed. If you like you can pseudo encrypt them by doing some weird calculations. only important that you can still easily read them
2. part is an encrypted hash from the first part. (take first part, use a hash function, encrypt the result of that hash with a password that only you know)
If someone enters a coupon, you can read all fields without problem, and the remaining fields are used to verify that it is a valid coupon. calculate hash again and encrypt it, and check if your calculation gives the same result. I would use at least 5 digits for the verification.
Here are the functions I use for hash and encryption. Make sure to add the System.Security.Cryptography. You should add those Salt numbers, and store in your program the password. just make sure it will not be readable in any way by users.
Imports System.Security.Cryptography
Imports System.Security
Imports System.Net.Sockets
Imports System.Text
Imports System.IO
Imports System
Namespace Crypt
Module Hash
Function MD5hash(ByVal data() As Byte) As Byte()
' This is one implementation of the abstract class MD5.
Dim md5 As New MD5CryptoServiceProvider()
Dim result As Byte() = md5.ComputeHash(data)
Return result
End Function
' Hash an input string and return the hash as
' a 32 character hexadecimal string.
Function getMd5Hash(ByVal input As String) As String
' Create a new instance of the MD5CryptoServiceProvider object.
Dim md5Hasher As New MD5CryptoServiceProvider()
' Convert the input string to a byte array and compute the hash.
Dim data As Byte() = md5Hasher.ComputeHash(Encoding.Default.GetBytes(input))
' Create a new Stringbuilder to collect the bytes
' and create a string.
Dim sBuilder As New StringBuilder()
' Loop through each byte of the hashed data
' and format each one as a hexadecimal string.
Dim i As Integer
For i = 0 To data.Length - 1
sBuilder.Append(data(i).ToString("x2"))
Next i
' Return the hexadecimal string.
Return sBuilder.ToString()
End Function
' Verify a hash against a string.
Function verifyMd5Hash(ByVal input As String, ByVal hash As String) As Boolean
' Hash the input.
Dim hashOfInput As String = getMd5Hash(input)
' Create a StringComparer an compare the hashes.
Dim comparer As StringComparer = StringComparer.OrdinalIgnoreCase
If 0 = comparer.Compare(hashOfInput, hash) Then
Return True
Else
Return False
End If
End Function
End Module
Module Crypto
''' <summary>
''' Encrypts data with Hash from passToHash
''' </summary>
''' <param name="data"></param>
''' <param name="passToHash"></param>
''' <returns></returns>
''' <remarks></remarks>
Function EncryptWithHash(ByVal data As String, ByVal passToHash As String) As String
Dim _hash As String = getMd5Hash(passToHash)
Dim _result As String = Encrypt(data, _hash)
Return _result
End Function
''' <summary>
''' Decrypts data with Hash from passToHash
''' </summary>
''' <param name="data"></param>
''' <param name="passToHash"></param>
''' <returns>can throw exception</returns>
''' <remarks></remarks>
Function DecryptWithHash(ByVal data As String, ByVal passToHash As String) As String
Dim _hash As String = getMd5Hash(passToHash)
Dim _result As String = Encrypt(data, _hash)
Return _result
End Function
''' <summary>
''' Creates a hash and encrypts it
''' </summary>
''' <param name="data"></param>
''' <param name="password"></param>
''' <returns></returns>
''' <remarks></remarks>
Function SigCreate(ByVal data As String, ByVal password As String) As String
Dim _hash As String = getMd5Hash(data)
Dim _crypt As String = Encrypt(_hash, password)
Return _crypt
End Function
''' <summary>
''' Verifies, if the encrypted Hash is valid
''' </summary>
''' <param name="data"></param>
''' <param name="password"></param>
''' <param name="enc"></param>
''' <returns></returns>
''' <remarks></remarks>
Function SigCheck(ByVal data As String, ByVal password As String, ByVal enc As String) As Boolean
Try
Dim _dec As String = Decrypt(enc, password)
Return verifyMd5Hash(data, _dec)
Catch ex As Exception
End Try
Return False
End Function
Private Salt As Byte() = {51, 39, 204, 201, 190, 167, 217, 190, _
56, 110, 254, 186, 23, 56, 117, 222, _
214, 32, 28, 16, 27, 23, 31, 211, _
101, 92, 143, 234, 45, 63, 75, 82}
''' <summary>
''' Encrypts Data with the given password
''' </summary>
''' <param name="Data"></param>
''' <param name="Password"></param>
''' <returns></returns>
''' <remarks></remarks>
Function Encrypt(ByVal data As String, ByVal password As String) As String
Dim pdb As New Rfc2898DeriveBytes(password, Salt)
Dim alg As Rijndael = Rijndael.Create()
alg.Key = pdb.GetBytes(32)
alg.IV = pdb.GetBytes(16)
Dim ms As New IO.MemoryStream
Dim cs As New CryptoStream(ms, alg.CreateEncryptor, CryptoStreamMode.Write)
cs.Write(System.Text.Encoding.Default.GetBytes(data), 0, data.Length)
cs.Close()
ms.Close()
Return Convert.ToBase64String(ms.ToArray)
End Function
''' <summary>
''' Decrypts Data with the given password
''' </summary>
''' <param name="Data"></param>
''' <param name="Password"></param>
''' <returns></returns>
''' <remarks>can throw exception</remarks>
Function Decrypt(ByVal data As String, ByVal password As String) As String
Dim pdb As New Rfc2898DeriveBytes(password, Salt)
Dim alg As Rijndael = Rijndael.Create()
alg.Key = pdb.GetBytes(32)
alg.IV = pdb.GetBytes(16)
Dim ms As New IO.MemoryStream
Dim cs As New CryptoStream(ms, alg.CreateDecryptor, CryptoStreamMode.Write)
cs.Write(Convert.FromBase64String(data), 0, Convert.FromBase64String(data).Length)
cs.Close()
ms.Close()
Return System.Text.Encoding.Default.GetString(ms.ToArray)
End Function
End Module
End Namespace