312 reputation
311
bio website langnostic.inaimathi.ca
location Toronto, Canada
age 29
visits member for 2 years, 5 months
seen Jul 2 at 18:02

Common Lisp/Scheme/Haskell/Elisp/JavaScript hacker with a degree in Graphic Design, an eye for layout and a hungry, hungry mind.


Mar
30
awarded  Critic
Mar
30
awarded  Citizen Patrol
Mar
27
awarded  Good Question
Dec
23
awarded  Notable Question
Nov
30
awarded  Popular Question
Oct
16
revised Initialization Vector Properties
added 513 characters in body
Oct
16
comment Initialization Vector Properties
@StephenTouset again - A session token is a piece of information that an HTTP server generates and passes to the client. The client then sends it back with each request so that the server can associate various application data with a particular requester. A user doesn't necessarily need to authenticate to get a token, or necessarily send it back (if they're using the application in a stateless fashion). Some servers try to prevent users from sharing session tokens, but that's not a requirement either. From what I understand, the output of a CSPRNG would do, assuming HTTPS was used.
Oct
16
accepted Initialization Vector Properties
Oct
16
comment Initialization Vector Properties
@StephenTouset - That... solves my problem entirely. I'll edit the snippet into the question; code gets stripped of newlines in comments.
Oct
16
revised Initialization Vector Properties
Renaming "session key" to "session token" for clarity
Oct
16
awarded  Editor
Oct
16
revised Initialization Vector Properties
added 2 characters in body
Oct
16
comment Initialization Vector Properties
Correct, I'm very new and not hiding the fact. If I knew of an off-the-shelf solution, I'd be using it. I'm not trying to generate "keys" in the cryptographic sense; that was just an unfortunate word choice. My understanding of a session token is that it's basically the output of a CSPRNG; a piece of data that's difficult to guess regardless of how many examples a particular attacker has seen, or how much of your implementation they've read. On that basis, if I had a CSPRNG, I'd just use it directly rather than jumping through these AES hoops. Can you recommend one?
Oct
16
awarded  Custodian
Oct
16
reviewed Approve suggested edit on Initialization Vector Properties
Oct
16
asked Initialization Vector Properties
Jul
13
awarded  Yearling
Jan
16
awarded  Popular Question
Apr
11
awarded  Nice Question
Mar
3
accepted How big an RSA key is considered secure today?