I'm having trouble designing a system for authenticated content from my site distributed by other people. I'm working in Ruby on Rails, but I don't think that at a theoretical level my question isn't restricted to that framework. In order to not give too much away, my site (let's call it www.site.com) helps businesses keep inventory of who has purchased what item, and allows customers to view their purchase history.
Hence, I have the following problem:
- Suppose Alice sells cheeseburgers. Alice makes an account on site.com and registers her cheeseburgers as an item that she sells. Consequently, site.com stores Alice's cheeseburger in a SQL database with the id 92314
- Bob is a customer at Alice's cheeseburger stand and has recently purchased a cheeseburger.
- Alice would like to tell Bob about site.com and its ability to track purchases. Hence, Alice sends a request to site.com to return
hashAthat corresponds to item with id 92314.
- Bob visits
www.site.com/purchase/hashAand is prompted to either create an account or sign in to log his new cheeseburger purchase from Alice's Delicious and Delectable cheeseburgers.
- Charlie also visits Alice's cheeseburger stand and purchases a cheeseburger.
- Alice would also like to tell Charlie about site.com and sends a request that generates
hashBfor Charlie to use in the same manner.
My question is, how do I come up with a scheme that can generate
hashB in a way that my web server can efficiently lookup the items. I suspect that
hashB can be generated from
hashA using some sort cipher using
hashA as a seed. I don't know how, upon receiving
hashB, site.com will know that it corresponds to item 92314. I suspect that using a nonce will help.
Things that I would like to avoid include:
- Having Charlie use
hashAafter it has been used by Bob
- Exposing the id 92314 to the user
- Having a single point of failure (i.e. a single key that encrypts hashes for all ids)
- Having things break if Charlie uses
hashBbefore Bob uses
Disclaimer: My expertise is more in computer graphics and less in web development or cryptography, so pointing me towards things to Google is helpful. If this belongs in any of the other stackexchange sites (Cryptography, Programmers, etc). Feel free to let me know and I will move it.