I want to know what are the points to be kept in mind while creating a hash token for my password reset links.
In particular, how to make it un-predictable for an attacker?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Most random number generators just generate pseudorandom numbers. They create a series of numbers which appears random at first glance, but the numbers do follow an exact algorithm. To prevent them from generating the same series of numbers everytime they are used, they are initialized by seeding them with a start value. A good pseudorandom number generator should output a different series of numbers for every possible seed value.
In practice, a pseudorandom number generator is often initialized with the current time. Because the time will be different everytime a program is run, it will never generate the same stream of numbers. Unfortunately this is insufficient for any security purpose, because the time of initialization is very predictable. For that reason you need to combine values from other entropy sources which are hard or impossible to predict for an outside attacker.
Which entropy sources are feasible depends on your environment.
Use a cryptographically secure random number generator to generate a random sequence. There are many available, built into different platforms. Many frameworks and languages provide wrappers to access these such as the openssl_random_pseudo_bytes function in PHP.
You could generate your own. The article above suggests:
A cryptographically secure hash of a counter might also act as a good CSPRNG in some cases. In this case, it is also necessary that the initial value of this counter is random and secret. However, there has been little study of these algorithms for use in this manner, and at least some authors warn against this use.
However, you should seed it with something unpredictable. That is, set the counter to be hashed as an unpredictable generated number and simply increment it each time. You would need adequate entropy for both your counter value and your output hash (128 bit).
Since you need an unpredictable source for this anyway, and there is some warning against this use I would go with the first option of simply generating a cryptographically secure sequence using built in language functions.