I have numeric IDs that I would like to use in filenames. So for example with IDs 1, 2, 3 we would have 1.jpg, 2.jpg, and 3.jpg
Now the problem is that clearly a user could just guess 4.jpg and view something they shouldn't be able to find.
Previously we have used UUIDs for this purpose but in this particular case I thought we could use a keyed hash function to avoid having to save a second ID. So 1, 2, and 3 would generate <long value 1>.jpg, <long value 2>.jpg, and <long value 3>.jpg.
So the requirements are:
- Given any particular ID, our server can quickly generate the value for the filename
- The same ID will generate the same value regardless of when/how many times it is generated (This seems to imply to me that we can't use e.g. AES encryption with an IV, since the IV is supposed to vary each time, or a salted hash function since the value would change when the salt changes)
- An attacker cannot guess the values, even if they know an ID
It doesn't matter if, given the value, an attacker can derive the original ID. E.g. they can't find the URL for ID "4" even if they can see the generated values for "1", "2", and "3".
Is there a security concern in using a keyed hash function (HMAC) in this way?