I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system.
The registration code has some expiration time, so that if the user doesn't register within the validity period, the registration code will expire a new registration code needs to be generated.
Is there any standard that would suggest what should be the entropy of such a registration code?
On one hand, it should be long enough so that an attacker can't guess it. On the other hand, it should be short enough so that the user can enter it easily into the system.