I would suggest NOT filing off the serial number.
Typically the authentication credential store contains some permutation of the following:
- the user's identifier (ie, username)
- the token identifier (ie, serial number)
- the user's password
The token identifier is combined with a seed key and the current time stamp to figure out the current "key" that is submitted by the user along with their username. If a different user submitted this "key", it should not work because it does not match the username and password of the true user.
When a user looses or breaks a token, they should report it via the serial number, and a new token and new serial number would be issued. At that point, you want the administrators to be able to easily identify the old and new serial numbers and remove the old serial number. Human error being what it is, I'd say don't make the serial number hard to determine, or it will become hard to verify which entry is the old token and which is the new.
Several times, I've had to identify multiple tokens held by a given user (I work in a high security system where 1 user can have several tokens, each for a different purpose) - being able to look up the serial number on the token in the database is the best way to avoid locking out the user account with bad password attempts. A random serial number is FAR better, in these cases, than putting a label on the token saying "access to top secret system".
That said, serial numbers are linked to a security function and should be treated with some degree of care - it shouldn't be used for authentication, and when transmitted, make sure users transmit it securely.