Yes, pseudo-random permutation.

The basic algorithm goes like this. To generate the codes

    generate_codes(range valid_range)

      for(i in valid_range)
        encoded = RSA.Encode(key, i)
        code = base32.Encode(encoded)
        print code

and then, to verify a code

    verify(string code, range valid_range)

      encoded = base32.Decode(code)
      value = RSA.Decode(key, encoded)

      return valid_range.contains(value)

where of course RSA is an implementation of http://en.wikipedia.org/wiki/RSA_(cryptosystem) and base32 refers to http://en.wikipedia.org/wiki/Base32.

On top of that, we needed codes to be of a specified maximum length and with a specified alphabet. Thus, instead of base32 we used a different base with different letters, but the same algorithm. To fix the length of the codes, we needed the output of RSA encode to be less than a specific value. In RSA this can be controlled by choosing the modulus part of the key.

There are more subtleties to this, but the gist is there.

Thanks for this. Very interesting.

I assume that without the RSA key I cannot generate these codes myself then, even if I was to guess at the range?

Yes, that's the idea :-)

Ok, thus, if a similar scheme is being used for the FIFA stickers, the person that put this together (http://fifapaninicode7.appspot.com/) must know the RSA key!

Or they simply have a list of codes...

Did you check that these codes work and are not just a ruse?

They do work.