0

I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website.

My plan is to generate a hash based on the datetime, users specific "ID" and a random int.

Then take this hash and use it a prefix to uniqid as per:

$hash = sha1(date("Y-m-d H:i:s") . $memberId . random_int(0, 9999) );
$OTP = uniqid($hash, true);

After a bit of thinking I guess the use of uniqid is pretty redundant, but would it actually make it less secure to do it this way?

1
  • 1
    I edited your title to clarify the distinction between One-Time Passcodes and One-Time Pad. Please don't be afraid to spell things out if there is a potential to mistake things.
    – user163495
    May 22, 2019 at 12:58

1 Answer 1

3

First, if you take a hash of data containing in part random values, you would be better served by using directly random data, with the random_bytes function.

For the usage of uniqid, you should first read its documentation. You are not using the "prefix" argument as it is meant to be used.

To directly answer your question, you should avoid using uniqid because it is not meant to be used to authenticate users. You could instead use a 16 bytes string returned by random_bytes, encoded in hexadecimal or base64.

1
  • Excellent, thank you for your time - I will do exactly that.
    – Aphire
    May 22, 2019 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .