CODEWITHSUNDEEP
java
user2859250
user2859250

Reputation: 71

java unique number less then 12 characters

I have a user case which involves generating a number which a user enters into a website to link a transaction to their account.

So I have the following code which generates a random 12 digit number:

public String getRedemptionCode(long utid, long userId) {       
    long nano = System.nanoTime();      
    long temp = nano + utid + 1232;
    long redemptionCode = temp + userId + 5465;     
    if (redemptionCode < 0) {
        redemptionCode = Math.abs(redemptionCode);
    }       
    String redemptionCodeFinal = StringUtils.rightPad(String.valueOf(redemptionCode), 12, '1');
    redemptionCodeFinal = redemptionCodeFinal.substring(0, 12);
    return redemptionCodeFinal;
}

This method takes in two params which are generated by a DB.

What I need to understand is:

  1. Is this random? I have a test which ran this method 1 million times and it always seem to be random.

  2. Can I cut this down to 8 characters?

Upvotes: 2

Views: 448

Answers (2)

Mike Samuel
Mike Samuel

Reputation: 120576

No it is neither unique nor random.

It is not "random" in the sense of highly entropic / uncorrelated with other values.

The only source of non-determinism is System.nanoTime, so all the entropy comes from a few of the least significant bits of the system clock. Simply adding numbers like 1232 and 5465 does not make the result less correlated with subsequent results.

Is this random? I have a test which ran this method 1 million times and it always seem to be random.

If this code is used in multiple threads on the same machine, or on multiple machines with synced clocks, you will see duplicates more quickly.

Since there is low entropy, you are likely to see duplicates by random chance fairly quickly. Math.se addresses the likelihood depending on how many of these you generate.

Can I cut this down to 8 characters?

Only if you don't lose entropy. Consider two ways of truncating a timestamp:

long time = ...;   // Least significant bits have randomness.
String s = "" + time;
// Cut off the right-most, most entropic bits
String bad = time.substring(0, 8);
// Cut off the left-most, least entropic bits
String better = time.substring(time.length() - 8);

Since it is a straightforward calculation from an increasing counter, an attacker who can try multiple times can predict the value produced in a way that they would not be able to had you used a crypto-strong random number generator like java.util.SecureRandom.

Upvotes: 3

Adam Stelmaszczyk
Adam Stelmaszczyk

Reputation: 19857

Is this random?

You are asking, is your function based on System.nanoTime() a random number generator (RNG)?

The definition of RNG is: generator, which generates numbers that lack any pattern.

So, are numbers returned from your function without any pattern?

No, they have an easily-observable pattern, because they depend on System.nanoTime() (system clock).

Can I cut this down to 8 characters?

Yes, you can, but it's still not random. Adding or padding won't help too.

Use SecureRandom instead.

Upvotes: 2

Related Questions