w3ctag/capability-urls — pull request #5 by martinthomson (2014-12-12 05:20:13+00:00)
Title: Entropy requirements

The current text around guessing isn't quite right for a couple of reasons. Here's what I've done.

1. I've made the guessability thing a MUST rather than a weak SHOULD. If you care about using these URIs as access control mechanisms, you have to have entropy.
2. A random number is not the only way to create a capability URL. You can also use crypto. It's probably not worth going into the details, particularly since there isn't a really good reference that describes how to do it properly ([this](https://tools.ietf.org/html/draft-rescorla-stateless-tokens-01) would be OK if were more stable).
3. I've removed the advice against roll-your-own random number generation and replaced that with a reference to RFC 4086, which is a very good primer on randomness for security.
4. I've recommended a minimum level of entropy. A system that is able to limit guesses in some fashion might be able to use a lower entropy value, but it's not always easy to know that it is safe to do so. For instance, if you have a large enough population of valid values, limiting guesses might not be enough. As general guidance, I consider it best to be a little conservative.

(This builds on #4, so you might be better served just looking at the last commit. If you don't like the whitespace changes, feel free to cherry-pick.)