{"action":"created","issue":{"url":"https://api.github.com/repos/robconery/pg-auth/issues/7","labels_url":"https://api.github.com/repos/robconery/pg-auth/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/robconery/pg-auth/issues/7/comments","events_url":"https://api.github.com/repos/robconery/pg-auth/issues/7/events","html_url":"https://github.com/robconery/pg-auth/issues/7","id":99913267,"number":7,"title":"Make random_value() to generate cryptographically strong random values","user":{"login":"pnowosie","id":1813036,"avatar_url":"https://avatars.githubusercontent.com/u/1813036?v=3","gravatar_id":"","url":"https://api.github.com/users/pnowosie","html_url":"https://github.com/pnowosie","followers_url":"https://api.github.com/users/pnowosie/followers","following_url":"https://api.github.com/users/pnowosie/following{/other_user}","gists_url":"https://api.github.com/users/pnowosie/gists{/gist_id}","starred_url":"https://api.github.com/users/pnowosie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pnowosie/subscriptions","organizations_url":"https://api.github.com/users/pnowosie/orgs","repos_url":"https://api.github.com/users/pnowosie/repos","events_url":"https://api.github.com/users/pnowosie/events{/privacy}","received_events_url":"https://api.github.com/users/pnowosie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-09T16:52:10Z","updated_at":"2015-08-09T17:38:49Z","closed_at":null,"body":"When generating random strings for authentication it is good idea to make it unpredictable. Since we have dependency of pg_crypto we can use gen_random_bytes() function\r\n\r\n```PLpgSQL\r\nSELECT substring( encode(gen_random_bytes(len /2 +1), 'hex'), 0, len ) into result;\r\n```\r\n\r\nIf we accept non-alphanumeric characters in random strings, we could use 'base64' encoding which compared to hex has more entropy in the same length string:\r\n```PLpgSQL\r\nSELECT substring( encode(gen_random_bytes(len * 3/4 +1), 'base64'), 0, len ) into result;\r\n```\r\n\r\nThis is even more important in [your's node-db-project](https://github.com/robconery/node-db-project) when you generate user's auth token. Does this make sense?  \r\n"},"comment":{"url":"https://api.github.com/repos/robconery/pg-auth/issues/comments/129221207","html_url":"https://github.com/robconery/pg-auth/issues/7#issuecomment-129221207","issue_url":"https://api.github.com/repos/robconery/pg-auth/issues/7","id":129221207,"user":{"login":"robconery","id":78586,"avatar_url":"https://avatars.githubusercontent.com/u/78586?v=3","gravatar_id":"","url":"https://api.github.com/users/robconery","html_url":"https://github.com/robconery","followers_url":"https://api.github.com/users/robconery/followers","following_url":"https://api.github.com/users/robconery/following{/other_user}","gists_url":"https://api.github.com/users/robconery/gists{/gist_id}","starred_url":"https://api.github.com/users/robconery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robconery/subscriptions","organizations_url":"https://api.github.com/users/robconery/orgs","repos_url":"https://api.github.com/users/robconery/repos","events_url":"https://api.github.com/users/robconery/events{/privacy}","received_events_url":"https://api.github.com/users/robconery/received_events","type":"User","site_admin":false},"created_at":"2015-08-09T17:38:49Z","updated_at":"2015-08-09T17:38:49Z","body":"Interesting point - believe me I'm not trying to brush you off I'm wanting to see the issue more clearly. There are two points being raised: the first is *randomness* and the second is *reverse engineering*. The latter is important because the `auth_token` will allow someone into the system.\r\n\r\nIf I understand you, you're suggesting that if a Bad Guy uses a timestamp, he/she can recreate the random number that was generated by `random()`. If I understand the way PG implements `random()` (based on some Googling) - [it's using this algorithm here](https://en.wikipedia.org/wiki/Linear_congruential_generator), which doesn't seem to have much to do with time.\r\n\r\nYour final point about using it for cryptography is well-taken, and I'm not doing that. I'm generating a unique, random string which isn't being used in any form of cryptographic functionality. \r\n\r\nSo... if I understand your points: I'd like to see more about guessing the value of `random()` using a timestamp. I certainly don't want anything to be guessable - so I'm not necessarily challenging you on this (more secure is almost always better) - I'm just wondering if we're way off on a fringe topic here or if there's something I'm not seeing.\r\n\r\nAlso - if you'd like to PR something on this, please do :)."}}