# How many characters should a session key be?

I have a session key generator that uses only letters and number. I've looked up how long a session key should be here:

https://www.owasp.org/index.php/Insufficient_Session-ID_Length

and by some forms of logic, it would say 20 characters at 8 bytes each is 160bits... more than enough. I read somewhere that 80 is the minimum, which would be 10 characters.

But, as I'm only using numbers and letter that means that the possible permutations are log(2, (52 + 10) ^ 20) ~= 119 bits (52 chars + 10 nums).

So given the 128 bit key should take 292 years to guess (cited above), and mine is 9 bits less, it should take 292 / (2^9) = .57 years to guess.. I think.

This is what I think the answer to my question is:

If using all 256 utf-8 characters, 16 characters is enough to get 128 bits (recommended) and 10 is enough to get 80 bits (min).

If only using specific characters use the following function to calculate your bits and increase charCount until it's at the desired strength. log(2, (useableChars) ^ charCount)

As Peter Harmann says, you really mean log2(x) rather than pow(2, x), besides that your formula is correct. The real error however is that you misinterpret your citation:

Now assume a 128 bit session identifier that provides 64 bits of entropy. With a very large web site, an attacker might try 10,000 guesses per second with 100,000 valid session identifiers available to be guessed. Given these assumptions, the expected time for an attacker to successfully guess a valid session identifier is greater than 292 years.

You misinterpreted that as 128 bits of entropy, but it's only 64 bits (i.e. it's 64 bits in hexadecimal).

• Nice catch, I was wondering why it was such a short time to break it :D Still, better to overestimate the attacker then underestimate. – Peter Harmann Aug 7 '18 at 23:43
• @PeterHarmann For sure. 128 bits may be overkill for an online attack, but it's only 24 characters in base64, so why not? – AndrolGenhald Aug 7 '18 at 23:46

Yes...

The only thing I would say is not correct is the pow notation (you probably mean log, though you calculated it correctly somehow anyway) and the time estimate. The 292 years sounds to me like an offline attack, not guessing a session key online is wrong as pointed by AndrolGenhald. Also note that this (80-bit minimun) probably assumes you use separate identifier (username/user id/session id). If the key identifies the session, you should get a stronger key due to the birthday paradox.

• I had used log when doing the math... funny I messed it up in the question. Is online session guessing longer due to lag? – Seph Reed Aug 7 '18 at 23:37
• @SephReed Online guessing works differently altogether. Generally, I would say it should take longer but don't necessarily rely on it. It is a good practice to assume the worst especially when it does not cost you much (few more characters). Online attacks depend more on bandwidth then on latency and importantly, you can block IPs that are guessing wrong too many times. On the other hand, attackers may use botnets for massive amounts of bandwidth and IPs. – Peter Harmann Aug 7 '18 at 23:41
• I'm not sure the birthday paradox really applies. It sort of does in that rather than trying to guess a specific user's session identifier the attacker may simply guess 1 of n identifiers, but that's not really the same. If you have a billion sessions an 80 bit key is uncomfortably small, but it's not halved, it's effectively 50 bits (divide by 2**30 since that's about a billion). It's a bigger difference with a 128 bit identifier, which would only be weakened to 98 bits, not 64 bits. – AndrolGenhald Aug 7 '18 at 23:43
• @AndrolGenhald It is a variation of the problem. While technically not the original paradox, you can find all the math related to it under the name. Also, yes it is less important if you invest in the extra entropy by going for 128 bit, more so if you go with 80-bit. Either way, you are less secure then you would have expected by 30 bits, that is why I pointed it out. – Peter Harmann Aug 7 '18 at 23:47