intperm

Integer Permutation

This package implements a simple, configurable permutation on the set of 64-bit integers.

The permutation is based on a bitmask that maps each bit of the input to a bit of the output. The bitmask is expanded from a random seed using a PRNG, as described by George Marsaglia in his paper called Xorshift RNGs. The permutations are thus believed to be unpredictable, provided provided that the seed is kept secret.

Usage

Create a new Permutation instance by passing in a seed:

p := permutation.New(42)
a := p.MapTo(37) // 13750393542137160527
b := p.MapFrom(13750393542137160527) // 37

Use cases

Use cases may vary, but an example that I find useful is generating hard-to-guess, random-looking tokens based on IDs stored in a database. The IDs can be used together with the seed to decode the original ID, but their cardinality is the same as that of the IDs themselves. When used smartly, this can save you from having to index those tokens in the database.

Another good example is randomising IDs of private objects that are available via some sort of an API. Let's say the user accounts on your website are accessible via the path /user/:id, where :id is the user's ID. Someone could track the growth of your user base just by enumerating the URLs and keeping track of the status codes (e.g. 403 vs. 404).

Using this simple permutation, user IDs can be kept unpredictable, rendering these kinds of attacks practically useless.

See also

This library is also implemented in Python and Ruby.