Strategies for authenticating users once without a common identifier

Question

I create a script that accepts a list of names and email addresses and sends an email asking them to register on our secure department website. A list of names and emails is available on an open page on the same site. I need a way to provide them with a unique token that will identify them when they follow the link in the email to the page to register an account. The user will use the token only once, create an account and set his initial password.

What would be the best way to generate a token? Random string stored in database? Is the hash generated from user information and some salt? Something other? I understand that the security of this method depends on the confidentiality of an individual email invitation, which I understand.

Answer 1

Why should this be a hash in particular? Just put the new username as part of the link and arbitrarily create an authentication token of any length you want and save it in the database associated with their username until they are authenticated.

Thus, the link they receive in the letter looks something like this:

http://domain.com/confirm.php?user=Chad&t=AB14CD05 

It doesn't really matter if there is any collision, this is a fairly low risk event. In any case, what could go wrong, can someone else verify their email address for them? What worries you? Perhaps if you explain the whole process in a bit more detail, I better understand your requirements.

Answer 2

There are many different hashing algorithms. You can look at this link to find out if it will work better for you, since you do not need a secure hash. You can also see how SSL lib will generate an 8-character md4 hash code.

http://www.partow.net/programming/hashfunctions/#top

Answer 3

Why not just assign a random 64-bit number to send with a user ID. Take a 64-bit number, divide it into 5-bit chunks, and use each 5-bit chunk to index in the 32-character alphabet: 23456789ABCDEFGHJKLMNPQRSTUVWXYZ (conveniently omitting 01IO). With a 64-bit number and 5-bit / code (except the last), you get a 13-character pool to use to identify the user. You can overlay it on 2 random characters to get 3 groups of 5 characters each.

Make the id and blank part of the login url. Check the value of the bullet stored with the identifier in the database to make sure they are the same. I think that for most purposes this would be a big enough value to make it extremely difficult to guess - the number is random after all - which slug comes with which user ID. Using a cryptographically strong random number generator, I would have thought it would be unlikely that you would even get repeated numbers for any of your users.

It might look like this:

 http://example.com/activate?userid=bgates&validate=GY45M-RHQBN-32GYM 

Using a hash of known values ​​can actually make it easier for someone to guess the correct code than using a random number. Using a hash, you only need to guess which bits you are using and run them through various hashing algorithms. If someone can put them together, say, given several examples and enough time to try different combinations, then all they need to do to crack someone’s code determines (possibly) well-known attributes for a given person and uses them to personalize them and create an account. With a strong random number assigned to each person, they are left only with brute force.

Answer 4

Check gperf .

GNU gperf is an ideal hash function generator. For a given list of strings, it creates a hash function and a hash table in the form of C or C ++ code to search for a value depending on the input string. The hash function is perfect, which means that the hash of the table has no collisions, and the hash of the table search requires a single line comparison only.

As well as CMPH - C Minimum Perfect Hashing Library

There are several related SO questions:

• What is a hash string hash function that results in a 32-bit integer with low collision rates?

• What is a good hash function?

• What is a string hash function that results in a 32-bit integer with low collision rates?

• How to calculate collision odds in hash algorithms?

• Hash Collision - what are the odds?