{
  "id": 105904,
  "title": "arxid: keyed, non-enumerable ID obfuscation with a measured ARX-Feistel permutation",
  "url": "https://urgent.news/2026/08/03/arxid-keyed-non-enumerable-id-obfuscation-with-a-measured-arx-feistel",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-08-03T23:15:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/lucasolopes/arxid-keyed-non-enumerable-id-obfuscation-with-a-measured-arx-feistel-permutation-3cia"
  },
  "original_language": "en",
  "account": "The arxid library provides a way to obfuscate sequential integer IDs in a secure manner. By feeding an integer into the library, it returns an unpredictable-looking code. The same code, when fed back into the library with the same key, will return the original integer. This process is keyed, reversible, and byte-for-byte identical across languages. The obfuscated ID provides a speed bump against enumeration, but it is not encryption or a MAC, and it has not been independently audited. The library uses a balanced Feistel network with an ARX (add-rotate-xor) round function over a 40-bit domain. The round function is a simple combination of addition, bit rotation, and XOR, making it fast and lightweight. The library has been calibrated with a harness to ensure a certain level of non-enumerability, with four rounds found to be sufficient for statistical non-enumerability. The output is consistent across all languages that implement the library, making it interoperable. However, it is important to note that arxid is not a substitute for encryption or access control, and it should be used in conjunction with proper security measures.",
  "summary": "If your API exposes /users/1042 , someone can request /users/1043 . And /users/1044 . Sequential integer IDs leak two things you probably didn't mean to leak: roughly how many records you have, and a trivial way to walk through all of them. arxid fixes that. Feed it an integer, get back an unpredictable-looking code; feed the code back with the same key, get the integer. Keyed, reversible, and…",
  "key_points": [
    "arxid library obfuscates sequential integer IDs securely",
    "Uses keyed, reversible ARX-Feistel permutation with 40-bit domain",
    "Four rounds provide sufficient non-enumerability"
  ],
  "editors_take": "The arxid library's ID obfuscation method provides a speed bump against enumeration while maintaining interoperability and reversibility, but requires proper security measures as it's not a substitute for encryption or access control.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}