Generate User Specific 1 Time Coupon Code

Question

So I need to generate a code that can be tied to a specific user/prospect with a dollar amount built into it. It needs to be reversible so that client application can confirm the validity of the code and apply the discount a manager intends.

I'd like to make the code as short as possible but it needs to be well obfuscated so that the salesmen cannot start messing with it on their own.

I can come up with something myself bouncing numbers around, dividing by pi and converting to hex and whatnot but I'd be really interested in ideas or best practices from the community.

I'm doing this in C# but I expect that methods from any language can be translated.

edit: to clarify. I can't store this stuff ahead of time, the codes have to be built on the fly and carry all the information with them.

eg. Salesman 14 calls in about client 773 and wants to give them $500 off their order. 14, 773 and 500 must be in the coupon code and able to be extracted in the client app after the salesman keys in the code.

Answer 1

Generate a public/private key pair for signing. Digitally sign the combination of user ID and coupon value using the private key. Publish the coupon value + signature as the coupon code, encoded, for example, using letters and numbers. The client application would verify the code by recreating the combination of data that was originally signed (e.g., prepend the user ID to the coupon value) and then verifying the digital signature.

Answer 2

Sounds like a case for asymetric encryption. You could give out the public key to everybody, thus providing them with the info for validating the coupon, but the ability to create a cupon would rest with the owner of the private key (= you).

I would create a coupon class that serialises to xml, and then encrypt the xml string. Validation would be to decrypt the string and see if it is valid xml (I recommend not to deserialise the object without checking this before).

Answer 3

I would use the customer code and the coupon expiration date. As for verification, you could just store valid coupons in your database and verify off that. You could scan the coupon table once a day to purge expired codes.