For anti-CSRF Encrypted Token Pattern, the OWASP page describes the pre-encrypted token as being composed of three items: the user's ID, a timestamp value and a nonce.
The programmatic need for the first two is obvious but what about the third? What is the actual need for the random data component?
I get why in the case of the ordinary Synchronizer Token Pattern.
But what would be the problem for Encrypted Token Pattern with implementing a token composed of only UserId and timestamp, which is then subsequently subject to encrypt-then-mac.
Is it deemed important to make the encrypted token more cryptographically secure (by making the plaintext longer and less predictable)?