Re: Safe session IDs

From: Glynn Clements (
Date: 01/11/02

From: Glynn Clements <>
Date: Fri, 11 Jan 2002 02:34:30 +0000
To: "Ryan M Harris" <>

Ryan M Harris wrote:

> What is the most secure way of generating a session number?

With a decent (hardware) RNG.

> I have used the following formula in the past.

> sessionid = md5( <REMOTE_IP> + REMOTE_USER_AGENT> + rand() (5 bytes from
> here) + microtime() )

> Is it secure (from a randomness perspective)?

It may be secure enough, depending upon the resolution of microtime(),
and what exactly the session ID is protecting.

> Any way to make it more secure/random?

Yes; by using a RNG, or at least a better PRNG than rand(). EGD[1] is
an option, if you have an adequate source of entropy with which to
feed it.


Glynn Clements <>