De eerste 100 ordernummers

Order numbers are a mail-order invention. Aaron Montgomery Ward began trading from Chicago in 1872 with a price list and no shop at all; Richard Sears and Alvah Roebuck followed in the 1890s. A business that never meets its customers has to join a letter, a payment, a packed parcel and a complaint to the same transaction, and across four departments the only thing that can carry that join is a number written on every piece of paper. Sequential numbering came free, because the orders arrived in a pile and were numbered as they were opened.

Its weakness was discovered by other people's statisticians. During the Second World War, Allied economic intelligence estimated German tank production from the serial numbers of captured and destroyed vehicles, working mainly from gearbox numbers because those fell in two unbroken sequences, with chassis, engine and wheel numbers used to cross-check. The reasoning is that a sample of serials drawn from a consecutive run tells you how long the run is. Richard Ruggles and H. Brodie set the work out in the Journal of the American Statistical Association in 1947; their own rule of thumb, tucked into a footnote, was to estimate the total as the sample maximum plus the average gap between observations. German records recovered after the war showed the statistical estimates had been far more accurate than the conventional intelligence estimates they were meant to check, and the method is now taught as the German tank problem.

The same arithmetic works on a shop. Place two orders a week apart, subtract one reference from the other, and you have the volume in between; a figure a company would never publish is legible from two emailed receipts. Web applications then added a second problem: an order reference that appears in a URL and is checked against no owner lets a visitor walk the sequence and read other people's orders — the flaw catalogued by OWASP as an insecure direct object reference, now folded into Broken Access Control.

The usual answer is to separate the two jobs. Accounting keeps a private, gapless, sequential key; the customer is shown something else — a reference with a check digit so it survives being read down a phone line, or a permuted one that is unique without sitting next to its neighbours.

Belangrijkste eigenschappen

• Two references from a consecutive series disclose the number of orders between them, so a sequential customer-facing number publishes order volume to anyone holding two receipts.
• The German tank problem estimates the size of a consecutively numbered population from a sample: for sampling without replacement the minimum-variance unbiased estimate is m + m/k − 1, where m is the largest serial seen and k the number of serials seen.
• The scramble option applies n → (6364136223846793·n + 1442695040888963) mod 10^w and then reverses the w-digit zero-padded result, where w is the width of the {SEQ:n} field.
• Both steps are one-to-one — the multiplier ends in 3, so it shares no factor with 10 and hence none with 10^w, and reversal is a bijection on fixed-width digit strings — so distinct counters can never collide.
• The reversal is what makes the output look unpatterned, because the affine map alone sends consecutive counters a constant distance apart — but the whole composition is still a fixed, unkeyed permutation, so it is obfuscation and not encryption.
• The modulus 10^24 is about 10^8 times larger than the exact integer range of a double, so the counter and the permutation are computed with arbitrary-precision integers throughout.
• A Luhn check digit catches every single-digit error and every swap of two adjacent digits except 09 for 90, which is why it is worth having on a reference that gets read aloud.
• The pattern fields are {SEQ:n} for the padded counter, {YYYY}, {YY}, {MM}, {DD} and {Q} for the date, {N:n} for random digits, {A:n} for random letters, {X:n} for random letters and digits, and {LUHN} for a check digit over the digits to its left.