I'm trying to figure out a simple way to verify ownership over a short period of time (typically 8 - 24h), to be used in a mobile application.
One of the ideas I came up with is to hash the following concatenated sequence:
user pincode + user unique ID + payload where pincode is a 6 digit passcode, provided by user unique ID is a GUID identifying the device, generated once payload is a rather long JSON payload, different each time
Provided I'm using an algorithm like SHA-512 or similar, what's the risk of using always the same header (pincode + ID) for multiple hashes?
Is it easier for an attacker to figure out a header if used for multiple hashes?
Optionally, do you think this would be a valid ownership verification, knowing an attacker could potentially replicate a payload.