Question

I want to auto-generate a unique 8-10 character ID string that includes a checksum bit of some kind to guard against a typo at data entry. I would prefer something that does not have sequential numbers where the data entry person would end up in a “rut” and get used to typing the same sequence all the time.

Are there any best practices/ pitfalls associated with this sort of thing?

UPDATE: OK, I guess I need to provide more detail.

1. I want to use alphanumerics, not just digits
2. I want behavior similar to a credit card checksum, except with 8-10 characters instead of 16 digits
3. I want to have the id be unique; there should not be a possibility of collision.

SECOND UPDATE OK, I don’t understand what is confusing about this, but I will try to explain further. I am trying to create tracking numbers that will go on forms, which will be filled out and data-entered at a later time. I will generate the id and slap it on the form; the id needs to be unique, it needs to support a LOT of numbers, and it needs to be reasonably idiot-proof for data-entry.

I don’t know if this has been done, or even if it can be done, but it does not hurt to ask.

Answer 1

Your question is VERY general – thus just some general aspects:

• Does the ID need to be “unguessable” ?
  IF yes then some sort of hash should be in the mix.

• Does the ID need to be “secure” (like for example an activation key or something) ?
  IF yes then some sort of public key cryptography should be in the mix.

• Does the ID / checksum calculation need to be fast ?
  IF yes then perhaps some very simple algorithm like CRC32 or Luhn (credit card checksum algorithm) or soem barcode checksum algorithm could be worth looking at.

• Is the ID generation centralized ?
  IF not then you might need to check out GUIDs, current time, MAC address and similar stuff.

UPDATE – as per comments:

• use a sequence in the DB
• take that value and hash it, for example with MD5
• take the least significant 40-48 bits of that hash
• encode it as Base-36 (0-9 and A-Z) which gives you 8-10 “digits” (alphanumeric)
• check the result against the DB and discard if the ID already there (for the very rare possibility of a collision)
• calculate CRC-6-ITU (see http://www.itu.int/rec/T-REC-G.704-199810-I/en on page 3)
• attach the CRC result as the last “digit” (as base-36 too)
• and thus you have a unique ID including checksum

to check the entered value you can just recalculate CRC-6-ITU from all digits but the last one and compare the result with the last digit.

The above is rather “unguessable” but definitely not of “high security”.

UPDATE 2 – as per comment:

For some inspiration on how to calculate CRC in javascript see this – it contains javascript code for CRC-8 etc.

You should be able to adapt this code based on the CRC-6-ITU polynomial.