Secure Token Process

Question

Im currently in the mist of developing a website using PHP and MYSQL. Its a private website therefore registrations must allowed using emails. In simple tearms if a new user has to be registered. The administrator has to go into the system and add an email address to be registered.

What i want to create is a token or a pass value when this does happen.

Here are the steps:

1. Administrator adds an email to the system
2. A unique Toke value is created (e.g. 1234567890)
3. The token value is then sent to the users email
4. the user goes on the link provided and enters his email and the token value
5. If Success - User is allowed to register
6. If Fail! - Token is regenerated and send again to that email address

What i really want to know is what would be the best practice to create a token and how can we ensure to create a unique token every time an email is registered.

For further security i can ensure that each token Is only live for a couple of hours. But would this prevent unauthorized access into the system, or this is a bad idea for securing my website?

My thoughts of creating a unique token: Use hashing algorithms that use SALT so the results cannot be predicted or decrypted (Problems with MD5)

Any help or a lead towards the right direction would be greatfull.

Answer 1

I like this method of generating a cryptographically secure pseudo-random number generator or (CSPRNG) for PHP that is also unique or a Nonce. What makes this a nonce is that uniqid adds on the date/time. Also note that it is possible to generate collisions against sha1, however a collision does not make the the value less random and sah1 is only used for its digestive properties.

sha1(uniqid(mt_rand(), true));

In terms of adding a timeout, I recommend taking care of this in the database. Add a column that is called like registration_timeout and then use mysql's addtime() function to set this colmn to the current time stamp + however long you want the timeout to be.

Also keep in mind that temporary email accounts are trivial to use (http://www.mailinator.com , http://www.guerrillamail.com, ect...), so asking for someone to register an email account doesn't mean anything. Further more a user account could end up on http://www.bugmenot.com .