0

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it

Step 1: Generate a random number using a good a CSPRNG (Cryptographically Secure Pseudorandom Number Generator) . This will be the seed of the token

Step 2: Hash the seed using a salt. The hashed version will be the token.

My question is, if the token is created by hashing anyway, is it still necessary that the seed is generated from a good CSPRNG? would it matter?

1
  • how computationally expensive is the hash and how long must the token last? If the hash is secure and the life time short, a modern PRNG probably isn't terribly risky, but it's likely faster/cheaper to just use a CSPRNG with a fast hash.
    – dandavis
    Commented Dec 3, 2020 at 9:29

1 Answer 1

1

In general, cryptographic techniques assume that the attacker knows everything about your scheme except for the secrets. This is Kerckhoff's Principle. That means that the attacker knows the techniques you use to generate the secret and the size of the set.

Under this principle, you need to generate the secret securely and from a large enough set, that is, with at least 128 bits of entropy. Using a non-cryptographic PRNG won't be suitable for this because it's easily guessable.

If your goal is to generate some sort of verifiable token, you can use HMAC (with a cryptographically secure hash, such as SHA-256) to take your secret and hash any additional data you want (such as your salt) to generate the token. If you just need a completely random token, then you can just use a CSPRNG.

Note that it is secure to generate a token with an increasing ID using HMAC as long as your secret is secure: token = N || HMAC-SHA-256(secret, N). This is also true for any other non-secret contents in place of an integer. HMAC is better than using a plain hash because it avoids length-extension attacks on common hashes.

Even if you think nobody will know if you use a non-CSPRNG, under your scheme, if someone knows the data being hashed other than the seed, they can brute-force your scheme to recover the weak seed and forge tokens. Note that modern CSPRNGs can be faster than non-CSPRNGs, so there's really no reason not to use the right tool for the job.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .