use Crypt::RC4;

sub nice_encrypt {
    my($val, $key) = @_;
    return join '',
           map { sprintf('%02x', ord()) }
           split //, RC4($key, $val);
}
sub nice_decrypt {
    my($val, $key) = @_;
    return RC4($key, join '',
                     map { chr(hex($_)) }
                     $val =~ /../g);
}

my $encstr = nice_encrypt("foobar", 123);
my $decstr = nice_decrypt($encstr,  123);

print "$encstr\n$decstr\n";

__END__

output - 359fd0e08406
         foobar
[download]

broquaint

It encrypts and decrypts with the same function (I forget the technical term for it ...)

Symmetrical cipher. Also (though this doesn't matter in this particular case), RC4 is a stream cipher, which means it encrypts a character at a time. This is as opposed to a block cipher, which encrypts a small block of characters (usually 8 characters, in my experience) at once.
___________________
Kurt

use Digest::MD5 ;
my $id = '213455' ;
# WARNING: this is the third password any cracker would guess, don't r
+eally use it.
my $secret = 'open sesame' ;
my $mac = Digest::MD5::md5_hex ("${id}${secret}") ;
[download]

Then just tack the MAC onto the end of the subscription ID: my $url = "http://www.mysite.com/renew.cgi?id=${id}${mac}" ;

Actually, you could even add the MAC as another CGI parameter, it wouldn't make any difference. The link is shorter this way though (my example gives a URL of http://www.mysite.com/renew.cgi?id=213455da74bbd77b3890eadce45ef45add94c8 -- I don't know if that's short enough or not. If you need it to be shorter, you could use md5_base64 instead of md5_hex, but be careful because standard base64 includes some characters (like "+") that aren't compatible with URL's.) Then just check the MAC when the client surfs in. Presto, nobody can fake a link anymore unless they can read the victim's email. Of course, this is all totally off-base if you're posting these links on a public web page or something. The basic principle would remain the same even in that case: never trust data coming from the client. HTH!

Disclaimer: IANACE (I am not a crypto expert)

Update: Well, I was surprised to learn that "${id}${secret}" does not mean the same thing as "$id$secret," although both would work correctly in my example above. Apparently the ${} form is actually a symref, which should not be used unless you already know why they are bad. :) I had no idea there was a difference between the two forms (actually it was a complete accident that I used the ${} form in my example, normally I stay away from it.) Thanks to crazyinsomniac for picking this one up.

I can see two approaches to implementing this. One, create a universal 6 digit key, that all users would be encrypted against. Two, create a key for each user.

Obviously the first method is easier to manage, but is also 'less secure'. If a user knows what their ID is, they can easily figure out the key, and from that can get anyone else's user ID. Of course this requires the user knowing that the encryption is XOR and that all IDs are encrpyted with the same key. So the big question becomes, how secure do you need this? Is it likely that a valid user will try to figure out someone's ID? How valuable is the information that is encrypted?

Happy Hacking!

Rob.

That said, I went with the Crypt::RC4 solution. Our magazine is free to US subscribers (it's a trade magazine for restaurant folks, so you guys wouldn't be interested, I bet ;)), so there's no credit card #'s and the folks that do use this online that receive the e-mail (or actually have e-mail to begin with!) won't monkey around with the URL to figure out others (especially when they see that awesome encryption of their userid: 62c88fb1d64d).

Thanks again for all your responses!

Jason

Incidentally, the second edition of O'Reilly's CGI Programming book explains these issues very nicely. You can even read that chapter on-line here.

Thanks! I'll check that out. I just bought the mod_perl book from O'Reilly and I'm looking forward to writing my first project in that! :)