6 ms·
I wrote a similar scheme for UEFA and Euro stickers in 2008. If they use the same scheme, it's a simple numeric sequence encoded via a PRP. So basically we too
by sklivvz1971 12y ago
I wrote a similar scheme for UEFA and Euro stickers in 2008. If they use the same scheme, it's a simple numeric sequence encoded via a PRP.
So basically we took numbers from, say 1000 to 3000 as "valid" codes, used a modified implementation of RSA to encrypt them to numbers in a specifically sized domain and then base-30 encoding them, to exclude pairs of hard to distinguish digits and numbers (5 and S, 1 and I, 0 and O).
To validate the codes, the code needs to decrypt the number and verify that the value is within our allowed range (in this example, 1000 to 3000).
This is relatively safe if the domain is big enough that random guessing has a very low probability of hitting a valid code. On the other hand, the domain needs to me small enough that the codes can be easily typed, typically 12 digits is way more than we would have done.
- junto 12y agoBy PRP do you mean "Pseudo Random Permutation"? Would you be able to outline some psuedo code to explain your answer? I tried out the codes from this rather spammy page on the FIFA stickers app (http://en.stickeralbum.fifa.com/ http://en.stickeralbum.fifa.com/), and they always seem to work, so it appears that the person that put it together has either figured out the algorithm, or knows what it was to start with!
- sklivvz1971 12y agoYes, pseudo-random permutation. The basic algorithm goes like this. To generate the codes generate_codes(range valid_range) for(i in valid_range) encoded = RSA.Encode(key, i) code = base32.Encode(encoded) print code and then, to verify a code verify(string code, range valid_range) encoded = base32.Decode(code) value = RSA.Decode(key, encoded) return valid_range.contains(value) where of course RSA is an implementation of http://en.wikipedia.org/wiki/RSA_(cryptosystem) http://en.wikipedia.org/wiki/RSA_(cryptosystem) and base32 refers to http://en.wikipedia.org/wiki/Base32 http://en.wikipedia.org/wiki/Base32. On top of that, we needed codes to be of a specified maximum length and with a specified alphabet. Thus, instead of base32 we used a different base with different letters, but the same algorithm. To fix the length of the codes, we needed the output of RSA encode to be less than a specific value. In RSA this can be controlled by choosing the modulus part of the key. There are more subtleties to this, but the gist is there.
- junto 12y agoThanks for this. Very interesting. I assume that without the RSA key I cannot generate these codes myself then, even if I was to guess at the range?
- sklivvz1971 12y agoYes, that's the idea :-)
- junto 12y agoOk, thus, if a similar scheme is being used for the FIFA stickers, the person that put this together (http://fifapaninicode7.appspot.com/ http://fifapaninicode7.appspot.com/) must know the RSA key!
- kaoD 12y agoDid you check that these codes work and are not just a ruse?
- junto 12y agoThey do work.
- sklivvz1971 12y agoOr they simply have a list of codes...