arxid: keyed, non-enumerable ID obfuscation with a measured ARX-Feistel permutation
If your API exposes /users/1042 , someone can request /users/1043 . And /users/1044 . Sequential integer IDs leak two things you probably didn't mean to leak: roughly how many records you have, and a trivial way to walk through all of them. arxid fixes that. Feed it an integer, get back an unpredictable-looking code; feed the code back with the same key, get the integer. Keyed, reversible, and…
The arxid library provides a way to obfuscate sequential integer IDs in a secure manner. By feeding an integer into the library, it returns an unpredictable-looking code. The same code, when fed back into the library with the same key, will return the original integer. This process is keyed, reversible, and byte-for-byte identical across languages.
The obfuscated ID provides a speed bump against enumeration, but it is not encryption or a MAC, and it has not been independently audited. The library uses a balanced Feistel network with an ARX (add-rotate-xor) round function over a 40-bit domain. The round function is a simple combination of addition, bit rotation, and XOR, making it fast and lightweight.
The library has been calibrated with a harness to ensure a certain level of non-enumerability, with four rounds found to be sufficient for statistical non-enumerability. The output is consistent across all languages that implement the library, making it interoperable. However, it is important to note that arxid is not a substitute for encryption or access control, and it should be used in conjunction with proper security measures.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
