I'm looking to create some tokens using a keyed hash mechanism to represent our individual customers. I was planning on using combinations of the customer's personal information (e.g.
H(Firstname,Surname,DOB)) in the token to prevent frequency analysis, but is there some way I can quantify this?
For example, qualitatively I assume that using:
will be more secure than using just:
as the latter will render some values of the first name identifiable by frequency analysis given a large enough sample (I will have to open source the protocol for this, so I'm assuming that attacker knows which variables the tokens consist of). I would like know what combinations of variables will render frequency analysis impractical - are there any established techniques for this?