Transaction Data Signing
I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device.
What is the idea?
The user try to login in the system. The server sends a confirmation request to user's device (Android).
The user sees the date, country, city, IP, browser and OS in the app, all about the login try, and if all this informations match, he can clicks on confirm. The app will generate an 8 decimal digit token based in this informations and send it to server, the server will try to generate a token with the same informations and if both tokens match, the server accept the login try.
This is just one possible operation.
What do I need?
An universal algorithm to authenticate any online operation.
e.g.:
function generateRandonTokenUsingNParameters(){
$args = func_num_args();
$token = ""; //Start token
for($i=0; $i < $args; $i++){
$token = CRAZY_MATH_USING_ALL_PARAMETERS_TO_GENERATE_8_DIGITS_TOKEN($token, func_get_arg($i));
}
return $token; //Final token based in all informations of the operation
}
//e.g.
//LOGIN INFORMATION
$date = "2014-05-30 01:02:00"
$ip = "192.168.0.1";
$browser = "Chrome";
$city = "Los Angeles";
$country = "USA";
$os = "Windows";
$android_app_local_seed = "698dc19d489c4e4db73e28a713eab07b"; //each user have a different seed in his app
//PRINTING LOGIN TOKEN
echo generateRandonTokenUsingNParameters($date, $ip, $browser, $city, $country, $os, $android_app_local_seed);
What would you use in the CRAZY_MATH_USING_ALL_PARAMETERS_TO_GENERATE_8_DIGITS_TOKEN() function?
P.S.: I need an 8 decimal digit numeric token. Because if the user does not have internet connection, he can read the operation's details using QR Code and he will need insert the token in the system manually.