I'm trying to compare two techniques for generating an OAuth 2 PKCE code_verifier.
- For each character, get a random byte and "mod 66" to map to one of the 66 valid characters.
- For each character, get a random byte and "mod 64" to map to a subset of the valid characters. (We could also use 6 random bits per character instead of 8.)
It appears that the min-entropy of both techniques is the same (answer). Are there any other security-related factors I should consider?
Note: for the purposes of this question, I'm only worried about the security of the secret. Let's ignore the efficiency and/or potential timing side-channels of the secret generation code for now.