Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings.
The user types in "12345" (ACCESS_CODE).
Obviously, we don't want to save this access code on the device.
Now, when the user wants to decrypt he types in the access code, and if the code is correct, the decryption will happen succesfully.
However, preferably, I would like, before the decyrption takes place, check whether the access code is right, without saving it on the device.
How can this be achieved?
One way I was thinking is to encrypt a string "CHECKSTRING" with the access code. Then the check would be:
- Decrypt the encrypted "CHECKSTRING" (ENCR_STRING) --> (DECR_STRING) with ACCESS_CODE
- Check if DEC_STRING == "CHECKSTRING", then code is correct, otherwise not.
But this seems to me quite unsafe, as someone could simulate an encryption of the "CHECKSTRING" (which is known and visible in the code) for all combinations of 12345 and then cross match which code I used to obtain the ENCR_STRING.
What other alternatives are there?