287 reputation
311
bio website langnostic.blogspot.com
location Toronto, Canada
age 29
visits member for 2 years, 1 month
seen Apr 9 at 17:48

Common Lisp/Scheme/Elisp/JavaScript/PHP hacker with a degree in Graphic Design, an eye for layout and a hungry, hungry mind.


Oct
16
comment Initialization Vector Properties
@StephenTouset again - A session token is a piece of information that an HTTP server generates and passes to the client. The client then sends it back with each request so that the server can associate various application data with a particular requester. A user doesn't necessarily need to authenticate to get a token, or necessarily send it back (if they're using the application in a stateless fashion). Some servers try to prevent users from sharing session tokens, but that's not a requirement either. From what I understand, the output of a CSPRNG would do, assuming HTTPS was used.
Oct
16
comment Initialization Vector Properties
@StephenTouset - That... solves my problem entirely. I'll edit the snippet into the question; code gets stripped of newlines in comments.
Oct
16
comment Initialization Vector Properties
Correct, I'm very new and not hiding the fact. If I knew of an off-the-shelf solution, I'd be using it. I'm not trying to generate "keys" in the cryptographic sense; that was just an unfortunate word choice. My understanding of a session token is that it's basically the output of a CSPRNG; a piece of data that's difficult to guess regardless of how many examples a particular attacker has seen, or how much of your implementation they've read. On that basis, if I had a CSPRNG, I'd just use it directly rather than jumping through these AES hoops. Can you recommend one?