Thank you very much for your suggestion.
Note that you can truncate the tokens created by Session::Token but if
you do so be careful not to introduce bias. For example, if you choose
the length of the token as a uniformly distributed random length
between, say, 6 and 10 then the output is biased towards shorter token
sizes. Length 6 tokens should appear much less frequently than length 10
tokens because there are so many fewer of them.
Tokens always being the same length is in fact partially regarded as a
feature. As described in the POD:
"This is nice because it makes writing matching regular expressions
easier, simplifies storage (you never have to store length), and causes
various log files and things to line up neatly on your screen."
I'm not opposed to implementing variable length tokens, but it
complicates the implementation especially since you should still be able
to specify minimum entropy variable length tokens. Minimum entropy is
really the primary input to Session::Token, not length.
I don't personally have any need of variable length tokens and would
prefer not to complicate the implementation. Sorry. Patches considered
though.
On Sun Jul 29 09:39:16 2012, NEILB wrote:
Show quoted text> I realise the target for this module is token generation, but many
> password generation modules
> let you specify a minimum length and a maximum length, and you'll get
> something back within
> the range.
>
> You could support both the length and minlength/maxlength, as
> App::Genpass does.
