I'm building a website on which I want to make it very easy for users to create pages anonymously and later be able to come back and edit those pages. One way to do so is to give out confidential tickets which are derived from the page ID to those users when they create the page. Later I would be able to derive the page ID from the ticket and allow a user in possession of the ticket to edit that page.
Of course this needs to be secure, so: 1) third parties shouldn't be able to derive the page ID from a given ticket, and even more importantly: 2) third parties should not be able to predict the ticket for a given page ID.
I could of course easily do this by randomly generating the tickets and storing them in a database, however I would like to try and do this without having to store the tickets.
In other words I'm looking for something like this:
- Let A be a unique public page ID.
- Let S be some kind of unchanging master key or other secret I possess and don't give out.
- Using S, transform A to B, such that I can later transform B back to A, but someone not in possession of S cannot.
- It should not be possible, or be very hard, to derive S even if you have a large collection of A-B pairs.
Does such a process exist? One thing I thought of is a simple XOR, however that would be easy to crack with just a few examples of A-B pairs. I can't use a hash, because they are intentionally irreversible; I can't derive A from B if B is a hash of A.
ID
secret from the holder of a ticket a requirement? That is, if I create a page and get a ticket, do you want theID
to be hidden from me or is it not a problem if I know it (as long as I can't create a valid ticket, of course)?