1

I want to create hash based on random id, That hash has to be valid for only 15 minutes. Is there a way to do that?

I'm using this for form submission. If some unknown submitted form or some one submitted after 15 mins I should be able to figure out when it was created?

I am storing random id in session and when user submits form I want to decrypt the value and match with original id. If it matches and it is with in 15 mins or created time then I will add that value to database, after doing some validations.

3
  • What are you going to do with this hash? How do you intend it to be 'valid for 15 minutes'? How are you going to test that? What do you mean by 'random id'?
    – user40980
    Jul 15, 2015 at 22:18
  • Since you mentioned a form submission I assume you are working on a web application. You could always leave the 15 minute concern out of the hash and instead associate the hash with the time the form was originally served in the user session (generating a new hash each time the page is served) and enforce the expiration server-side.
    – Michael
    Jul 15, 2015 at 22:21
  • 4
    There is no such thing as "unhashing", that's the whole point of (cryptographic) hashing. Jul 16, 2015 at 0:05

2 Answers 2

3

Its a multipart piece of information you need to communicate.

First off, you provide the timestamp. That is what you validate against for the 'was submitted within 15 minutes'. Secondly, you have a hash of the timestamp with some additional salt. The salt is known only to you (on the server).

If the time stamp was altered, the hash of the altered time stamp + salt would not match the hashed unaltered time stamp + salt and you would reject the form submission.

This would look something like:

<form ...>
<input type="hidden" name="timestamp" value="2015.07.15.22:17" />
<input type="hidden" name="timehash" value="9BC54D13B43D456D9167DA13F2E8351B" />
...
</form>

Now, you validate against the timestamp. If you check the md5 hash of the string 2015.07.15.22:17somesalt you will find it to match the md5 sum 9BC5.... And thus you know the timestamp is valid. If the timestamp doesn't match the hash (with the known salt), then it has been tampered with.

I must point out that somesalt not need be a constant for all pages generated. It could be a random number generated for each user session (and thus persists). Just that it is secret information that you hold and consistent for this user session.

4
  • I am new to this, I have read some article on hashing and encryption.. I know hash can not convert back to original value but Encrypted code can... So should i encrypt my id or should i hash ??
    – nikunjM
    Jul 15, 2015 at 22:24
  • Dont u think if i expose timestamp to user, attacker can easily find out difference between salt and hash ...
    – nikunjM
    Jul 16, 2015 at 16:45
  • 2
    @nikunjMnage it is computationally prohibitive to go from 9BC5... to the original string. Given 9BC5... and today's information of 2015.07.18.13:17 and 07A2815BF8663EA3B2361DC754392D78 you will not be able to determine what that salt was. And the salt doesn't need to be the same for each request - it just needs to be consistent from the one used to generate the hash and validate the data.
    – user40980
    Jul 16, 2015 at 18:17
  • ok, i created a function that will create unique salt value and I m appending time and salt value.. so to create new hash.. thanks for info .. learned a lot
    – nikunjM
    Jul 16, 2015 at 18:43
1

There is a standard way of doing this called TOTP. Basically a method to hash an interval in time (usually now -> now + t) instead of just an expiration time (now + t).

Used by Google, Facebook, Microsoft, GitHub etc etc etc for two-factor authentication, usually a short set of numbers valid for 30 seconds or so, but same principle can be used for whatever timespan.

There are implementations available in many languages, or the description at Wikipedia should probably be enough to implement it yourself if you like.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.