I'm currently creating an OAuth provider in Java using Jersey. To the best of my knowledge Jersey does not provide a method to create oauth tokens so I'm creating my own.
For those unfamiliar with OAuth, the tokens will be used in a somewhat similar fashion to public/private keys to sign and verify all requests to the server.
A String
is formed using a token issued by the server (me) and then encrypted with that token secret (which only the server and the application know). The signature is then sent to the server and verified.
Each token must be:
- non-sequential
- non-guessable
- unique (the tokens will be stored in a database so uniqueness can be verified)
This is the code I'm thinking of using to generate the keys:
public String generateToken() {
SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
MessageDigest digest = MessageDigest.getInstance("SHA-256");
secureRandom.setSeed(secureRandom.generateSeed(128));
return new String(digest.digest((secureRandom.nextLong() + "").getBytes()));
}
I'm generating a Long
using Java's SecureRandom with SHA-1-PRNG.
Using a 128 bit seed again generated by SecureRandom.
I'm then using SHA-256 to hash the resulting Long
to get a 32 character Unicode String as the token.
- Is anyone able to see any issues with this style of token generation?
- If multiple tokens were requested in a row, is there a chance of predicting the next one?
- I assume that 32 characters is more than enough for this kind of request signing.
java.security.KeyPairGenerator
and generate, for example an RSA key pair and use those? \$\endgroup\$