Generating random and secure CSRF tokens

Question

I googled around for secure random number generation and random string generation, combining them with some user data.

Is this good or am I totally off-base? I don't know much about cryptography but I do not see many alternatives, other than some bad code that gets copied around a lot with mt_rand and uniqid.

//csrf tokens
 public function csrf_token($regen = false)
 {
 if($regen === true) {
 //we need to give the user a token
 if(isset($_SESSION["__csrf_token"])) {
 unset($_SESSION["__csrf_token"]);
 }
 $max = mt_rand(0, mt_getrandmax());
 $rand_num = floor($max*(hexdec(bin2hex(openssl_random_pseudo_bytes(4)))/0xffffffff));
 $rand_string = "";
 for($i=0; $i < 11; $i++) {
 $x = mt_rand(0, 2);
 switch($x) {
 case 0: $rand_string.= chr(mt_rand(97,122));break;
 case 1: $rand_string.= chr(mt_rand(65,90));break;
 case 2: $rand_string.= chr(mt_rand(48,57));break;
 }
 }
 $_SESSION["__csrf_token"] = hash('whirlpool', $rand_num . $this->username . $rand_string . $this->hash_pw);
 $this->csrf_token = $_SESSION["__csrf_token"];
 return $this->csrf_token;
 }else{
 //the user already has a token
 return $this->csrf_token;
 }
 }

• icktoofay: To me, it looks like it's doing too much. I'd just generate 16 random bytes, convert them to hex, and be done with it.
• r3wt: thanks icktoofay. you're probably right. i will consider this when refactoring the code. thank you for your time.

Answer 1

If CSRF stands for Cross Site Request Forgery, then it's hard to imagine why I should help.

In any case, simply doing a cryptographic Whirlpool hash of a user-supplied string with a random seed value should be sufficiently random for most every purpose. The rest is just obfuscation and doesn't add to security.

• r3wt: I appreciate your reply. i am not the sharpest knife in the drawer and it is hard for me to decide how much is good enough. so what i infer from your post, i should just hash the hash_pw(user supplied string) with a random number(Random seed), or should i hash it with the random string as well.
• syb0rg: Related meta post on malicious code.
• r3wt: @syb0rg how is that related?
• syb0rg: @r3wt It was more related to Edward's comment about why he found it hard to help.
• r3wt: i'm lost.. what about my code is malicious?