Fixes on hash and crypto. stuff about authlogic

[thedarkone]

Hey kless,

I wrote the code in question. Good call with rstrip instead of strip. I also kinda missed that SecureRandom already does .delete("\n"), so that is also redundant. The reason I only use 15 bytes is because I wanted to be fully compatible with the previous ad-hoc implementation that always produced 20 character tokens.

Same thing with hex_token, the original implementation returned 64 bytes (128 characters).

[tredoe]

Hi thedarkone,

thanks for contributing to this great plugin. This is the great thing respect to open software; whatever person to can check the code and make it better. In my case I know anything about security and I'm very strict respect to it.

Today it's very common (and recommended) to use an entropy of 128 bits (16 bytes) which it's used too in the initialization vectors (IV) of criptogaphic algorithms, and I'm sure that it's by that reason because SecureRandom returns 16 bytes by default.

So, at least for me, I think that the security is more important that the compatibility, and in this case I think that the change doesn't hurts.

In the next documents is explained any basic things about criptography and hashes:

https://bitbucket.org/ares/cryha/src/tip/doc/hash.txt
https://bitbucket.org/ares/cryha/src/tip/doc/sym_crypto.txt

Greetings!

[jaredbeck]

Closing after seven years with no activity. If this is still a problem, please let us know.