We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated preceding transaction along with certificate based authentication. Please have a look and check if the solution below seems sound based on these requirements.
- Minimum 128 bits long
- Randomly generated
- Unpredictable/unguessable (i.e. make sure the seeding of the random number generator is good),
- Unique during its validity period,
- Must not contain any meaningful information (only random data).
Generate token using rngcryptoserviceprovider and store it as as 16 byte binary. I also saw a related post (Token-based authentication - Securing the token) to hash the token in the database but I'm told that this is not necessary for now so I was thinking what should be that size of my database column? binary(16) is a bit short.
(#2,#3,#5). Using rngcryptoserviceprovider to generate random string https://msdn.microsoft.com/en-us/library/system.security.cryptography.rngcryptoserviceprovider(v=vs.100).aspx)
(#4) table column does not have unique constraint but will get latest based on create time in case in the unlikely event that a duplicate does happen.