# Secure offline treasure hunt

Say I would like to create an app that would allow users to organize treasure hunts for their parties. The host of the party would create a list of GPS coordinates for each hiding spot and distribute the list to the guests. At the treasure hunt, guests would then use the app – offline – to get alerts when they are close to a hiding spot, record how long they took to find each treasure, etc.

Given the above setup, a moderately tech-savvy user will just look at the list of GPS coordinates and spoil the hunt. To what degree can this be avoided? In this example, obfuscation would probably be sufficient, but I am interested in the general case.

I’ve considered distributing the list in this form: HASH(QUANTIZE(latitude) || QUANTIZE(longitude)) with the quantization level set to allow the app to give hints at the appropriate distance, but I’m not sure if this could be tweaked to still be difficult to attack.

Is this a know problem? Are there any standard techniques or approaches that can be (practically) applied to it? I'd also appreciate pointers to related questions/papers.

• Your original idea, with a random pepper should be good enough. By pepper what I mean is $hash(value + pepper)$; say pepper is 10 bits, so in average you'll need to do $2^{9}$ rounds to verify the hash. And you can make it harder as you want, as you increase the size of the pepper. – zetaprime Oct 9 '18 at 18:36

The best that can be done for an offline system is to make the is_coordinate_close() function expensive to compute. Still a user can then either bring a powerful portable computer or connect to remote computing capacity to brute force the data set you provide. Additionally, increasing the cost of the function increases the power consumption of your app.