You'll regret using natural keys

Re:You'll regret using natural keys by rav on Wednesday June 05, 2024 @01:10PM (#40587573)

Instead of a random string ID, you can devise a fixed secret key and expose the auto-incremented ID xor the fixed secret key as the public-facing ID. This saves you the separate index but still avoids the German tank problem. But it gives you a new problem, namely a secret that's hard or impossible to rotate.

[ Parent | on HN ]

Re:You'll regret using natural keys by cogman10 on Wednesday June 05, 2024 @01:24PM (#40587752)

This is insecure. Assuming the user can get a few key examples (which, we assume they would be able to if the german tank problem is a problem) then the secret can easily be revealed. [1]

[1] https://dev.to/wrongbyte/cryptography-basics-breaking-repeat...

[ Parent | on HN ]

Re:You'll regret using natural keys by senderista on Wednesday June 05, 2024 @02:24PM (#40588481)

XOR isn't secure enough, but you're on the right track. Instead, use an actual block cipher.

[ Parent | on HN ]