In XQuery, how do you obfuscate a text string and maintain its character length on output?

Question

I need to obfuscate the text content of an element. Let’s say, for example, a plan ID. The plan ID may appear several times in one document or across different documents. I need the obfuscated plan ID to be unique and consistent (always map 12345 to abc72) and limited to only 5 characters. I would prefer not to have a separate document that exists that would be used as the mapping file or contain keys.

A simple hash function would not work because of the character length limitation. Any other ideas? I’d like to stick with doing this in pure XQuery.

Answer 1

You could use fn:translate (similar to unix tr command) to reliably convert one character to another. This is similar to good old rot13, but more flexible and powerful.

You could also build on this, by using a different fixed translation for each position in your text strings, as well.

Answer 2

You could still use hashing. Just truncate to the number of digits you need, something like this:

substring(
  xdmp:integer-to-hex(xdmp:hash64($input)),
  1, string-length($input))

As long as the hashing function is good, that should work just fine. If you need to handle long strings, pad the hash out multiple times and then truncate. If you need any kind of security you should throw a private key into the mix, and swap out xdmp:hash64 for xdmp:hmac-sha512. That might be a good idea anyway, since SHA-2 512 has well-known characteristics.

substring(
  xdmp:hmac-sha512($key, $input, 'base64'),
  1, string-length($input))

Hash collisions are possible, but unlikely.